legion-crypt 1.5.12 → 1.5.37

data/lib/legion/crypt/cluster_secret.rb

@@ -1,19 +1,31 @@
 # frozen_string_literal: true
 
 require 'securerandom'
+require 'digest'
+require 'timeout'
 require 'legion/logging/helper'
 
 module Legion
   module Crypt
     module ClusterSecret
+      class InitializationError < StandardError; end
+
       include Legion::Logging::Helper
 
       def find_cluster_secret
-        %i[from_settings from_vault from_transport generate_secure_random].each do |method|
+        secret_length
+        cluster_secret_timeout
+        raise InitializationError, 'Cluster secret initialization cancelled during shutdown' if Legion::Settings[:client]&.dig(:shutting_down)
+
+        %i[from_settings from_vault from_transport].each do |method|
+          break if method == :from_transport && only_member? == true
+
           result = send(method)
           next if result.nil?
 
           unless validate_hex(result)
+            raise InitializationError, 'Configured cluster secret is not valid hexadecimal key material' if method == :from_settings
+
             log.warn("Legion::Crypt.#{method} gave a value but it isn't a valid hex")
             next
           end
@@ -21,7 +33,7 @@ module Legion
           set_cluster_secret(result, method != :from_vault)
           return result
         end
-        return unless only_member?
+        return unless only_member? == true
 
         key = generate_secure_random
         set_cluster_secret(key)
@@ -50,26 +62,36 @@ module Legion
       alias cluster_secret from_settings
 
       def from_transport
-        return nil unless Legion::Settings[:transport][:connected]
+        return nil unless Legion::Settings[:transport]&.dig(:connected)
+        return nil if defined?(Legion::Transport::TYPE) && Legion::Transport::TYPE == 'local'
 
         require 'legion/transport/messages/request_cluster_secret'
         log.info 'Requesting cluster secret via public key'
         log.warn 'cluster_secret already set but we are requesting a new value' unless from_settings.nil?
-        start = Time.now
+        start = ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
+        deadline = start + cluster_secret_timeout
         Legion::Transport::Messages::RequestClusterSecret.new.publish
         sleep_time = 0.001
-        until !Legion::Settings[:crypt][:cluster_secret].nil? || (Time.now - start) > cluster_secret_timeout
-          sleep(sleep_time)
-          sleep_time *= 2 unless sleep_time > 0.5
+        while from_settings.nil?
+          raise InitializationError, 'Cluster secret initialization cancelled during shutdown' if Legion::Settings[:client]&.dig(:shutting_down)
+
+          remaining = deadline - ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
+          break unless remaining.positive?
+
+          sleep([sleep_time, remaining].min)
+          sleep_time = [sleep_time * 2, 0.5].min
         end
 
         unless from_settings.nil?
-          log.info "Received cluster secret in #{((Time.new - start) * 1000.0).round}ms"
+          elapsed = ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) - start
+          log.info "Received cluster secret in #{(elapsed * 1000.0).round}ms"
           return from_settings
         end
 
         log.error 'Cluster secret is still unknown!'
         nil
+      rescue InitializationError
+        raise
       rescue StandardError => e
         handle_exception(e, level: :error, operation: 'crypt.cluster_secret.from_transport')
         nil
@@ -87,7 +109,16 @@ module Legion
       end
 
       def only_member?
-        Legion::Transport::Queue.new('node.crypt', passive: true).consumer_count.zero?
+        return true if defined?(Legion::Transport::TYPE) && Legion::Transport::TYPE == 'local'
+
+        transport = Legion::Settings[:transport]
+        return Legion::Transport::Queue.new('node.crypt', passive: true).consumer_count.zero? if transport&.dig(:connected)
+
+        return true unless defined?(Legion::Transport)
+        return true if transport&.dig(:enabled) == false
+        return true if defined?(Legion::Mode) ? Legion::Mode.lite? : ENV['LEGION_MODE'] == 'lite'
+
+        nil
       rescue StandardError => e
         handle_exception(e, level: :warn, operation: 'crypt.cluster_secret.only_member?')
         nil
@@ -96,8 +127,8 @@ module Legion
       def set_cluster_secret(value, push_to_vault = true) # rubocop:disable Style/OptionalBooleanParameter
         raise TypeError unless validate_hex(value)
 
-        Legion::Settings[:crypt][:cluster_secret] = value
-        @cs = nil
+        Legion::Settings[:crypt][:cluster_secret] = value.dup.freeze
+        @cluster_secret_cache = nil
         Legion::Settings[:crypt][:cs_encrypt_ready] = true
         push_cs_to_vault if push_to_vault && settings_push_vault
         log.info "Cluster secret loaded into settings push_to_vault=#{push_to_vault}"
@@ -114,11 +145,19 @@ module Legion
       end
 
       def cluster_secret_timeout
-        Legion::Settings[:crypt][:cluster_secret_timeout] || 5
+        timeout = Legion::Settings[:crypt].fetch(:cluster_secret_timeout, 5)
+        unless timeout.is_a?(Numeric) && timeout.finite? && timeout.positive?
+          raise InitializationError, 'cluster_secret_timeout must be a finite positive number'
+        end
+
+        timeout
       end
 
       def secret_length
-        Legion::Settings[:crypt][:cluster_length] || Legion::Settings[:crypt][:cluster_lenth] || 32
+        length = Legion::Settings[:crypt][:cluster_length] || Legion::Settings[:crypt][:cluster_lenth] || 32
+        raise InitializationError, 'cluster_length must be a positive integer' unless length.is_a?(Integer) && length.positive?
+
+        length
       end
 
       def generate_secure_random(length = secret_length)
@@ -126,10 +165,26 @@ module Legion
       end
 
       def cs
-        @cs ||= Digest::SHA256.digest(find_cluster_secret)
+        secret_length
+        raise InitializationError, 'Cluster secret initialization cancelled during shutdown' if Legion::Settings[:client]&.dig(:shutting_down)
+
+        source = from_settings || Timeout.timeout(cluster_secret_timeout) { find_cluster_secret }
+        raise InitializationError, 'No validated cluster secret is available' unless validate_hex(source)
+
+        Legion::Settings[:crypt][:cs_encrypt_ready] = true
+        cached = @cluster_secret_cache
+        return cached[:key] if cached && cached[:secret] == source
+
+        source = source.dup.freeze
+        key = Digest::SHA256.digest(source)
+        @cluster_secret_cache = { secret: source, key: key }.freeze
+        key
       rescue StandardError => e
+        Legion::Settings[:crypt][:cs_encrypt_ready] = false
         handle_exception(e, level: :error, operation: 'crypt.cluster_secret.cs')
-        nil
+        raise if e.is_a?(InitializationError)
+
+        raise InitializationError, 'Cluster secret initialization failed'
       end
 
       def validate_hex(value, length = secret_length)
@@ -137,10 +192,7 @@ module Legion
         return false if value.empty?
         return false unless value.match?(/\A\h+\z/)
 
-        expected_length = length.to_i * 2
-        return true if expected_length.zero?
-
-        value.length == expected_length
+        length.is_a?(Integer) && length.positive? && value.length == length * 2
       end
 
       def cluster_secret_vault_path

data/lib/legion/crypt/erasure.rb

@@ -12,11 +12,9 @@ module Legion
           key_path = "#{tenant_prefix}/#{tenant_id}/master_key"
 
           log.info "[crypt] Erasing tenant #{tenant_id}"
-          if Legion::Crypt.respond_to?(:delete)
-            Legion::Crypt.delete(key_path)
-          elsif defined?(Legion::Crypt::Vault)
-            delete_vault_key(key_path)
-          end
+          result = Legion::Crypt.delete(key_path)
+          raise(result[:error] || 'Vault key deletion failed') unless result[:success]
+
           Legion::Events.emit('crypt.tenant_erased', { tenant_id: tenant_id, erased_at: Time.now.utc }) if defined?(Legion::Events)
           log.warn "[crypt] Tenant #{tenant_id} cryptographically erased"
 
@@ -28,7 +26,6 @@ module Legion
 
         def verify_erasure(tenant_id:)
           key_path = "#{tenant_prefix}/#{tenant_id}/master_key"
-          raise 'Legion::Crypt.read is unavailable' unless Legion::Crypt.respond_to?(:read)
 
           data = Legion::Crypt.read(key_path, nil)
           erased = data.nil?
@@ -41,10 +38,6 @@ module Legion
 
         private
 
-        def delete_vault_key(path)
-          ::Vault.logical.delete(path)
-        end
-
         def tenant_prefix
           begin
             Legion::Settings[:crypt][:partition_keys][:vault_tenant_prefix]

data/lib/legion/crypt/jwks_client.rb

@@ -12,6 +12,7 @@ module Legion
   module Crypt
     module JwksClient
       CACHE_TTL = 3600
+      MISS_REFRESH_COOLDOWN = 30
 
       @cache = {}
       @cache_mutex = Mutex.new
@@ -22,39 +23,30 @@ module Legion
         include Legion::Logging::Helper
 
         def fetch_keys(jwks_url)
-          with_url_lock(jwks_url) do
-            log.debug "JWKS fetch: #{jwks_url}"
-            response = http_get(jwks_url)
-            jwks_data = parse_response(response)
-            keys = parse_jwks(jwks_data)
-
-            cache_write(jwks_url, keys)
-            log.info "JWKS fetched url=#{jwks_url} keys=#{keys.size}"
-            keys
-          end
-        rescue StandardError => e
-          handle_exception(e, level: :warn, operation: 'crypt.jwks.fetch_keys', jwks_url: jwks_url)
-          raise
+          with_url_lock(jwks_url) { refresh_keys(jwks_url: jwks_url) }
         end
 
         def find_key(jwks_url, kid)
           cached = cache_read(jwks_url)
+          return cached[:keys][kid] if cached && !expired?(cached[:fetched_at]) && cached[:keys][kid]
 
-          if cached && !expired?(cached[:fetched_at])
-            key = cached[:keys][kid]
-            if key
-              log.debug "JWKS cache hit: kid=#{kid}"
-              return key
-            end
+          with_url_lock(jwks_url) do
+            cached = cache_read(jwks_url)
+            fresh = cached && !expired?(cached[:fetched_at])
+            return cached[:keys][kid] if fresh && cached[:keys][kid]
 
-            log.debug "JWKS cache miss for kid=#{kid}; refreshing keys"
-          end
+            if cached && cached[:refresh_after] && (fresh || cached[:error]) &&
+               ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) < cached[:refresh_after]
+              raise cached[:error] if cached[:error]
+
+              raise Legion::Crypt::JWT::InvalidTokenError, "signing key not found: #{kid}"
+            end
 
-          keys = fetch_keys(jwks_url)
-          key = keys[kid]
-          return key if key
+            keys = refresh_keys(jwks_url: jwks_url, requested_kid: kid)
+            return keys[kid] if keys[kid]
 
-          raise Legion::Crypt::JWT::InvalidTokenError, "signing key not found: #{kid}"
+            raise Legion::Crypt::JWT::InvalidTokenError, "signing key not found: #{kid}"
+          end
         end
 
         def prefetch!(jwks_url)
@@ -87,24 +79,44 @@ module Legion
         def clear_cache
           stop_background_refresh!
           @cache_mutex.synchronize { @cache = {} }
-          @locks_mutex.synchronize { @locks = {} }
           log.info 'JWKS cache cleared'
         end
 
         private
 
+        def refresh_keys(jwks_url:, requested_kid: nil, **)
+          previous = cache_read(jwks_url)
+          refreshing_miss = requested_kid && previous && !expired?(previous[:fetched_at])
+          log.debug "JWKS fetch: #{jwks_url}"
+          keys = parse_jwks(parse_response(http_get(jwks_url)))
+          entry = { keys: keys, fetched_at: Time.now }
+          if requested_kid && (refreshing_miss || !keys.key?(requested_kid))
+            entry[:refresh_after] = ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + MISS_REFRESH_COOLDOWN
+          end
+          cache_write(jwks_url, entry)
+          log.info "JWKS fetched url=#{jwks_url} keys=#{keys.size}"
+          keys
+        rescue StandardError => e
+          if requested_kid
+            entry = (previous || { keys: {}, fetched_at: nil }).merge(
+              error: e, refresh_after: ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + MISS_REFRESH_COOLDOWN
+            )
+            cache_write(jwks_url, entry)
+          end
+          handle_exception(e, level: :warn, operation: 'crypt.jwks.fetch_keys', jwks_url: jwks_url)
+          raise
+        end
+
         def cache_read(jwks_url)
           @cache_mutex.synchronize { @cache[jwks_url] }
         end
 
-        def cache_write(jwks_url, keys)
-          @cache_mutex.synchronize do
-            @cache[jwks_url] = { keys: keys, fetched_at: Time.now }
-          end
+        def cache_write(jwks_url, entry)
+          @cache_mutex.synchronize { @cache[jwks_url] = entry }
         end
 
         def expired?(fetched_at)
-          Time.now - fetched_at > CACHE_TTL
+          fetched_at.nil? || Time.now - fetched_at > CACHE_TTL
         end
 
         def http_get(url)

data/lib/legion/crypt/jwt.rb

@@ -109,18 +109,16 @@ module Legion
       def self.verify_with_jwks(token, jwks_url:, **opts)
         header = decode_header(token)
         kid = header['kid']
-        algorithm = header['alg'] || 'RS256'
+        algorithm = header['alg']
 
-        raise InvalidTokenError, 'token header missing kid' unless kid
-
-        validate_algorithm!(algorithm)
-
-        public_key = Legion::Crypt::JwksClient.find_key(jwks_url, kid)
+        raise InvalidTokenError, 'token header missing or invalid kid' unless kid.is_a?(String) && !kid.empty?
+        raise InvalidTokenError, 'unsupported token algorithm' unless SUPPORTED_ALGORITHMS.include?(algorithm)
 
         verify_expiration = opts.fetch(:verify_expiration, true)
         issuers = opts[:issuers]
         audience = opts[:audience]
         validate_external_requirements!(issuers: issuers, audience: audience)
+        public_key = Legion::Crypt::JwksClient.find_key(jwks_url, kid)
 
         decode_opts = {
           algorithm:         algorithm,
@@ -165,7 +163,10 @@ module Legion
         raise DecodeError, 'invalid token format' unless parts.size == 3
 
         header_json = Base64.urlsafe_decode64(parts[0])
-        ::JSON.parse(header_json)
+        header = ::JSON.parse(header_json)
+        raise DecodeError, 'JWT header must be an object' unless header.is_a?(Hash)
+
+        header
       rescue ::JSON::ParserError, ArgumentError => e
         handle_exception(e, level: :warn, operation: 'crypt.jwt.decode_header')
         raise DecodeError, "failed to decode token header: #{e.message}"

data/lib/legion/crypt/kerberos_auth.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'legion/logging/helper'
+require 'legion/crypt/vault_client'
 
 module Legion
   module Crypt
@@ -17,7 +18,7 @@ module Legion
         attr_reader :kerberos_principal
       end
 
-      def self.login(vault_client:, service_principal:, auth_path: DEFAULT_AUTH_PATH)
+      def self.login(vault_client:, service_principal:, auth_path: DEFAULT_AUTH_PATH, principal_guard: nil)
         raise GemMissingError, 'lex-kerberos gem is required for Kerberos auth' unless spnego_available?
 
         log.info "KerberosAuth login requested auth_path=#{auth_path}"
@@ -26,12 +27,21 @@ module Legion
         ns   = vault_client.respond_to?(:namespace) ? vault_client.namespace.inspect : 'n/a'
         log.debug("KerberosAuth: login: vault_client.address=#{addr}, namespace=#{ns}")
 
-        @kerberos_principal = nil
+        if principal_guard
+          principal_guard.call { @kerberos_principal = nil }
+        else
+          @kerberos_principal = nil
+        end
         token = obtain_token(service_principal)
         log.debug("KerberosAuth: login: SPNEGO token obtained (#{token.length} chars)")
 
         result = exchange_token(vault_client, token, auth_path)
-        @kerberos_principal = result[:metadata]&.dig('username') || result[:metadata]&.dig(:username)
+        principal = result[:metadata]&.dig('username') || result[:metadata]&.dig(:username)
+        if principal_guard
+          principal_guard.call { @kerberos_principal = principal }
+        else
+          @kerberos_principal = principal
+        end
         log.debug("KerberosAuth: login: authenticated as #{@kerberos_principal.inspect}, policies=#{result[:policies].inspect}")
         log.debug("KerberosAuth: login: renewable=#{result[:renewable]}, ttl=#{result[:lease_duration]}s")
         log.info "KerberosAuth login success principal=#{@kerberos_principal || 'unknown'} auth_path=#{auth_path}"
@@ -80,11 +90,11 @@ module Legion
           namespace = vault_client.respond_to?(:namespace) ? vault_client.namespace.inspect : 'n/a'
           log.debug("KerberosAuth: exchange_token: PUT /v1/#{auth_path} (namespace=#{namespace})")
           json = vault_client.put(
-            "/v1/#{auth_path}",
-            '{}',
-            'Authorization' => "Negotiate #{spnego_token}"
+            path:    "/v1/#{auth_path}",
+            body:    '{}',
+            headers: { 'Authorization' => "Negotiate #{spnego_token}" }
           )
-          response = ::Vault::Secret.decode(json)
+          response = Legion::Crypt::VaultClient::Secret.decode(data: json)
           raise AuthError, 'Vault Kerberos auth returned no auth data' unless response&.auth
 
           auth = response.auth
@@ -95,7 +105,7 @@ module Legion
             policies:       auth.policies,
             metadata:       auth.metadata
           }
-        rescue ::Vault::HTTPClientError => e
+        rescue Legion::Crypt::Vault::HTTPClientError => e
           handle_exception(e, level: :warn, operation: 'crypt.kerberos_auth.exchange_token', auth_path: auth_path)
           log.debug("KerberosAuth: exchange_token: HTTP error: #{e.message}")
           raise AuthError, "Vault Kerberos auth failed: #{e.message}"

data/lib/legion/crypt/ldap_auth.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'legion/logging/helper'
+require 'legion/crypt/vault_operation'
 
 module Legion
   module Crypt
@@ -9,35 +10,35 @@ module Legion
 
       def ldap_login(cluster_name:, username:, password:)
         cluster_name = cluster_name.to_sym
+        generation = vault_auth_generation
+        config = clusters.fetch(cluster_name)
         log.info "LDAP login requested user=#{username} cluster=#{cluster_name}"
         client = vault_client(cluster_name)
-        secret = client.logical.write("auth/ldap/login/#{username}", password: password)
+        secret = Legion::Crypt::VaultOperation.with_timeout do
+          client.logical.write(path: "auth/ldap/login/#{username}", data: { password: password })
+        end
         auth = secret.auth
-        token = auth.client_token
 
-        clusters[cluster_name][:token] = token
-        clusters[cluster_name][:connected] = true
-        client.token = token if client.respond_to?(:token=)
+        grant = { token: auth.client_token, lease_duration: auth.lease_duration, renewable: auth.renewable?, policies: auth.policies }
+        install_vault_grant(client: client, config: config, grant: grant, auth_method: 'ldap', generation: generation)
 
         log.info "LDAP login success: user=#{username}, cluster=#{cluster_name}"
-        { token: token, lease_duration: auth.lease_duration,
-          renewable: auth.renewable?, policies: auth.policies }
+        grant
       rescue StandardError => e
-        handle_exception(e, level: :error, operation: 'crypt.ldap_auth.ldap_login', cluster_name: cluster_name, username: username)
-        log.error "LDAP login failed: user=#{username}, cluster=#{cluster_name}: #{e.message}"
+        log.error "LDAP login failed: user=#{username}, cluster=#{cluster_name}, error=#{e.class}"
         raise
       end
 
       def ldap_login_all(username:, password:)
         results = {}
         clusters.each do |name, config|
-          next unless config[:auth_method] == 'ldap'
+          next unless config[:auth_method].to_s == 'ldap'
 
           results[name] = ldap_login(cluster_name: name, username: username, password: password)
         rescue StandardError => e
-          handle_exception(e, level: :warn, operation: 'crypt.ldap_auth.ldap_login_all', cluster_name: name, username: username)
-          log.warn("Legion::Crypt::LdapAuth#ldap_login_all cluster=#{name} failed: #{e.message}")
-          results[name] = { error: e.message }
+          log.warn("Legion::Crypt::LdapAuth#ldap_login_all cluster=#{name} failed: #{e.class}")
+          message = password.to_s.empty? ? e.message : e.message.gsub(password.to_s, '[REDACTED]')
+          results[name] = { error: message }
         end
         log.info "LDAP login_all complete successes=#{results.count { |_, result| result.is_a?(Hash) && !result.key?(:error) }} attempted=#{results.size}"
         results