legion-crypt 1.5.12 → 1.5.37

data/lib/legion/crypt/vault.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
 require 'legion/logging/helper'
-require 'uri'
-require 'vault'
+require 'legion/crypt/vault_operation'
+require 'legion/crypt/vault_client'
 
 module Legion
   module Crypt
@@ -16,34 +16,30 @@ module Legion
       end
 
       def connect_vault
-        @sessions = []
-        vault_settings = Legion::Settings[:crypt][:vault]
-        ::Vault.address = resolve_vault_address(vault_settings)
-        ::Vault.ssl_verify = resolve_ssl_verify(vault_settings[:tls])
-        namespace = vault_settings[:vault_namespace]
-        log.info "Vault connection requested address=#{::Vault.address} namespace=#{namespace || 'none'} ssl_verify=#{::Vault.ssl_verify}"
-
-        Legion::Settings[:crypt][:vault][:token] = ENV['VAULT_DEV_ROOT_TOKEN_ID'] if ENV.key? 'VAULT_DEV_ROOT_TOKEN_ID'
-        return nil if Legion::Settings[:crypt][:vault][:token].nil?
-
-        ::Vault.token = Legion::Settings[:crypt][:vault][:token]
-        ::Vault.namespace = namespace if namespace
+        return unless start_session_tracking
+
+        configuration = Legion::Settings[:crypt][:vault]
+        configuration[:token] = ENV['VAULT_DEV_ROOT_TOKEN_ID'] if ENV.key? 'VAULT_DEV_ROOT_TOKEN_ID'
+        return nil if configuration[:token].nil?
+
+        client = vault_client
+        log.info "Vault connection requested address=#{client.address} namespace=#{client.namespace || 'none'} ssl_verify=#{client.ssl_verify}"
         if vault_healthy?
-          Legion::Settings[:crypt][:vault][:connected] = true
-          log.info "Vault connected at #{::Vault.address} (namespace=#{namespace || 'none'})"
+          configuration[:connected] = true
+          log.info "Vault connected at #{client.address} (namespace=#{client.namespace || 'none'})"
         end
       rescue StandardError => e
-        log_vault_connection_error(e)
+        handle_exception(e, level: :error, operation: 'crypt.vault.connect_vault')
         Legion::Settings[:crypt][:vault][:connected] = false
         false
       end
 
       def vault_healthy?
-        ::Vault.sys.health_status.initialized?
-      rescue ::Vault::HTTPError => e
+        vault_client.sys.health_status.initialized?
+      rescue Legion::Crypt::Vault::HTTPError => e
         # 429 = standby, 472 = DR secondary, 473 = performance standby
         # All indicate an initialized, healthy Vault — just not the active node.
-        return true if e.message =~ /\b(429|472|473)\b/
+        return true if [429, 472, 473].include?(e.code)
 
         raise
       end
@@ -51,7 +47,7 @@ module Legion
       def read(path, type = nil, cluster_name: nil)
         full_path = type.nil? || type.empty? ? path : "#{type}/#{path}"
         log_read_context(full_path, cluster_name: cluster_name)
-        lease = logical_client(cluster_name: cluster_name).read(full_path)
+        lease = logical_client(cluster_name: cluster_name).read(path: full_path)
         if lease.nil?
           log_vault_debug("Vault read: #{full_path} returned nil")
           return nil
@@ -68,7 +64,7 @@ module Legion
 
       def get(path, cluster_name: nil)
         log.debug "Vault kv get: path=#{path}"
-        result = kv_client(cluster_name: cluster_name).read(path)
+        result = kv_client(cluster_name: cluster_name).read(path: path)
         if result.nil?
           log.debug "Vault kv get: #{path} returned nil"
           return nil
@@ -83,7 +79,7 @@ module Legion
 
       def write(path, cluster_name: nil, **hash)
         log.info "Vault kv write requested path=#{path}"
-        kv_client(cluster_name: cluster_name).write(path, **hash)
+        kv_client(cluster_name: cluster_name).write(path: path, data: hash)
         log.info "Vault kv write complete path=#{path}"
       rescue StandardError => e
         handle_exception(e, level: :error, operation: 'crypt.vault.write', path: path)
@@ -91,7 +87,7 @@ module Legion
       end
 
       def delete(path, cluster_name: nil)
-        logical_client(cluster_name: cluster_name).delete(path)
+        logical_client(cluster_name: cluster_name).delete(path: path)
         log.info "Vault delete complete path=#{path}"
         { success: true, path: path }
       rescue StandardError => e
@@ -100,89 +96,149 @@ module Legion
       end
 
       def exist?(path, cluster_name: nil)
-        !kv_client(cluster_name: cluster_name).read_metadata(path).nil?
+        !kv_client(cluster_name: cluster_name).read_metadata(path: path).nil?
       end
 
-      def add_session(path:)
-        @sessions ||= []
-        @sessions.push(path)
+      def start_session_tracking
+        session_mutex.synchronize do
+          return false if crypt_stopping?
+
+          @sessions = []
+          @sessions_stopped = false
+          @session_generation = (@session_generation || 0) + 1
+        end
+        true
       end
 
-      def close_sessions
-        return if @sessions.nil?
+      def add_session(path:)
+        session_mutex.synchronize do
+          return if @sessions_stopped || crypt_stopping?
+
+          (@sessions ||= []).push(path)
+        end
+      end
 
+      def close_sessions(deadline: nil)
+        deadline ||= ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + VaultOperation::SHUTDOWN_TIMEOUT
+        pending = session_mutex.synchronize do
+          @sessions_stopped = true
+          @session_generation = (@session_generation || 0) + 1
+          detached = @sessions || []
+          @sessions = []
+          detached
+        end
         log.info 'Closing all Legion::Crypt vault sessions'
+        closed = []
+        pending.each do |session|
+          break if ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) >= deadline
 
-        @sessions.each do |session|
-          close_session(session: session)
+          VaultOperation.with_timeout(deadline: deadline) { close_session(session: session) }
+          closed << session
+        rescue StandardError => e
+          handle_exception(e, level: :error, operation: 'crypt.vault.close_session')
         end
+        closed
       end
 
       def shutdown_renewer
-        return unless Legion::Settings[:crypt][:vault][:connected]
-        return if @renewer.nil?
+        renewer = session_mutex.synchronize do
+          @sessions_stopped = true
+          @session_generation = (@session_generation || 0) + 1
+          detached = @renewer
+          @renewer = nil
+          detached
+        end
+        return if renewer.nil?
 
         log.info 'Shutting down Legion::Crypt::Vault::Renewer'
-        @renewer.cancel
+        renewer.cancel
       end
 
       def close_session(session:)
-        ::Vault.sys.revoke(session)
+        vault_client.sys.revoke(lease_id: session)
       end
 
       def renew_session(session:)
-        ::Vault.sys.renew(session)
+        vault_client.sys.renew(lease_id: session)
       end
 
       def renew_sessions(**_opts)
+        generation, pending = session_mutex.synchronize do
+          return [] if @sessions_stopped || crypt_stopping?
+
+          [@session_generation, (@sessions || []).dup]
+        end
         log.debug 'Vault renewal cycle start'
-        result = if respond_to?(:connected_clusters) && connected_clusters.any?
-                   renew_cluster_tokens
-                 else
-                   @sessions.each do |session|
-                     renew_session(session: session)
-                   end
-                 end
+        return renew_cluster_tokens(generation: generation) if respond_to?(:connected_clusters) && connected_clusters.any?
+
+        renewed = []
+        pending.each do |session|
+          break unless session_maintenance_active?(generation: generation)
+
+          VaultOperation.with_timeout { renew_session(session: session) }
+          renewed << session
+        rescue StandardError => e
+          handle_exception(e, level: :error, operation: 'crypt.vault.renew_session')
+        end
         log.debug 'Vault renewal cycle complete'
-        result
+        renewed
       rescue StandardError => e
         handle_exception(e, level: :error, operation: 'crypt.vault.renew_sessions')
         raise
       end
 
-      def renew_cluster_tokens
+      def renew_cluster_tokens(generation: session_mutex.synchronize { @session_generation })
+        renewed = []
         connected_clusters.each_key do |name|
-          client = vault_client(name)
-          client.auth_token.renew_self
+          break unless session_maintenance_active?(generation: generation)
+
+          VaultOperation.with_timeout { vault_client(name).auth_token.renew_self }
+          renewed << name
           log.info "Vault token renewed for cluster #{name}"
         rescue StandardError => e
           log_vault_error(name, e)
         end
+        renewed
       end
 
       def vault_exists?(name)
-        ::Vault.sys.mounts.key?(name.to_sym)
+        vault_client.sys.mounts.key?(name.to_sym)
       end
 
       private
 
+      def session_mutex
+        @session_mutex ||= Mutex.new
+      end
+
+      def crypt_stopping?
+        Legion::Crypt.respond_to?(:stopping) && Legion::Crypt.stopping
+      end
+
+      def session_maintenance_active?(generation:, **)
+        session_mutex.synchronize do
+          !@sessions_stopped && !crypt_stopping? && @session_generation == generation
+        end
+      end
+
       def kv_client(cluster_name: nil)
-        if respond_to?(:connected_clusters) && connected_clusters.any?
-          connected_vault_client(cluster_name).kv(settings[:kv_path])
+        mount = Legion::Settings[:crypt][:vault][:kv_path]
+        if respond_to?(:connected_clusters) && (clusters.any? || connected_clusters.any?)
+          connected_vault_client(cluster_name).kv(mount: mount)
         else
           raise ArgumentError, "Vault cluster not connected: #{cluster_name}" if cluster_name
 
-          ::Vault.kv(settings[:kv_path])
+          vault_client.kv(mount: mount)
         end
       end
 
       def logical_client(cluster_name: nil)
-        if respond_to?(:connected_clusters) && connected_clusters.any?
+        if respond_to?(:connected_clusters) && (clusters.any? || connected_clusters.any?)
           connected_vault_client(cluster_name).logical
         else
           raise ArgumentError, "Vault cluster not connected: #{cluster_name}" if cluster_name
 
-          ::Vault.logical
+          vault_client.logical
         end
       end
 
@@ -191,16 +247,16 @@ module Legion
                       client = connected_vault_client(cluster_name)
                       client.respond_to?(:namespace) ? client.namespace : 'n/a'
                     else
-                      'n/a (global client)'
+                      vault_client.namespace
                     end
         log.debug "Vault read: path=#{full_path}, namespace=#{namespace}"
       end
 
       def connected_vault_client(cluster_name = nil)
         selected_cluster = selected_connected_cluster_name(cluster_name)
-        raise ArgumentError, "Vault cluster not connected: #{cluster_name}" if selected_cluster.nil? && cluster_name
+        raise ArgumentError, "Vault cluster not connected: #{cluster_name || default_cluster_name}" if selected_cluster.nil?
 
-        selected_cluster ? vault_client(selected_cluster) : nil
+        vault_client(selected_cluster)
       end
 
       def unwrap_kv_v2(data, full_path)
@@ -210,32 +266,6 @@ module Legion
         data[:data]
       end
 
-      def resolve_ssl_verify(tls_config)
-        return true if tls_config.nil?
-
-        verify = tls_config[:verify]&.to_s
-        verify != 'none'
-      end
-
-      def resolve_vault_address(vault_settings)
-        protocol = vault_settings[:protocol] || 'http'
-        address  = vault_settings[:address] || 'localhost'
-        port     = vault_settings[:port] || 8200
-
-        if address.match?(%r{\Ahttps?://})
-          uri = URI.parse(address)
-          protocol = uri.scheme
-          address  = uri.host
-          port     = uri.port if vault_settings[:port].nil?
-        end
-
-        "#{protocol}://#{address}:#{port}"
-      end
-
-      def log_vault_connection_error(error)
-        handle_exception(error, level: :error, operation: 'crypt.vault.connect_vault', address: ::Vault.address)
-      end
-
       def log_vault_debug(message)
         log.debug(message)
       end

data/lib/legion/crypt/vault_client.rb

@@ -0,0 +1,355 @@
+# frozen_string_literal: true
+
+require 'faraday'
+require 'legion/json'
+require 'openssl'
+require 'uri'
+
+module Legion
+  module Crypt
+    module Vault
+      class HTTPError < StandardError
+        attr_reader :code, :errors, :address
+
+        def initialize(code:, errors: [], address: nil, **)
+          @code = Integer(code)
+          @errors = Array(errors)
+          @address = address
+          super("Vault HTTP #{@code}#{": #{@errors.join('; ')}" unless @errors.empty?}")
+        end
+      end
+
+      class HTTPClientError < HTTPError; end
+      class HTTPServerError < HTTPError; end
+    end
+
+    class VaultClient
+      CONNECTION_ATTRIBUTES = %i[address ssl_verify ca cert key timeout].freeze
+
+      attr_reader(*CONNECTION_ATTRIBUTES, :logical, :sys, :auth_token, :token)
+      attr_accessor :namespace
+
+      def initialize(address:, token: nil, namespace: nil, tls: {}, timeout: 5, **)
+        @address = validate_address(address: address)
+        @timeout = validate_timeout(timeout: timeout)
+        @token = token
+        @namespace = namespace
+        @ssl_verify = tls[:verify] != false && tls[:verify].to_s != 'none'
+        @ca = tls[:ca]
+        @cert = tls[:cert]
+        @key = tls[:key]
+        @mutex = Mutex.new
+        @retired = false
+        @logical = Logical.new(client: self)
+        @sys = Sys.new(client: self)
+        @auth_token = AuthToken.new(client: self)
+      end
+
+      CONNECTION_ATTRIBUTES.each do |attribute|
+        define_method(:"#{attribute}=") do |value|
+          value = validate_address(address: value) if attribute == :address
+          value = validate_timeout(timeout: value) if attribute == :timeout
+          @mutex.synchronize do
+            return value if instance_variable_get(:"@#{attribute}") == value
+
+            previous = @connection
+            @connection = nil
+            instance_variable_set(:"@#{attribute}", value)
+            previous&.close
+          end
+          value
+        end
+      end
+
+      def token=(value)
+        @mutex.synchronize do
+          raise IOError, 'Vault client has been shut down' if @retired
+
+          @token = value
+        end
+      end
+
+      def kv(mount:, **)
+        KV.new(client: self, mount: mount)
+      end
+
+      def put(path:, body:, headers: {}, **)
+        request(method: :put, path: path, body: body, headers: headers) || {}
+      end
+
+      def request(method:, path:, body: nil, headers: {}, nil_on_not_found: false, **)
+        connection, request_headers, address = @mutex.synchronize do
+          raise IOError, 'Vault client has been shut down' if @retired
+
+          [@connection ||= build_connection, vault_headers(headers: headers), @address]
+        end
+        payload = body.is_a?(String) || body.nil? ? body : Legion::JSON.dump(body)
+        response = connection.run_request(method, request_path(path: path), payload, request_headers)
+        return nil if nil_on_not_found && response.status == 404
+
+        decode_response(response: response, address: address)
+      end
+
+      def shutdown
+        @mutex.synchronize do
+          @retired = true
+          previous = @connection
+          @connection = nil
+          previous&.close
+        end
+        nil
+      end
+
+      def inspect
+        "#<#{self.class}>"
+      end
+
+      class Logical
+        def initialize(client:, **)
+          @client = client
+        end
+
+        def read(path:, **)
+          Secret.decode(data: @client.request(method: :get, path: path, nil_on_not_found: true))
+        end
+
+        def write(path:, data:, **)
+          Secret.decode(data: @client.put(path: path, body: data))
+        end
+
+        def delete(path:, **)
+          @client.request(method: :delete, path: path)
+          true
+        end
+      end
+
+      class Sys
+        class HealthStatus
+          def initialize(data:, **)
+            @initialized = data[:initialized]
+          end
+
+          def initialized?
+            @initialized == true
+          end
+        end
+
+        def initialize(client:, **)
+          @client = client
+        end
+
+        def health_status
+          HealthStatus.new(data: @client.request(method: :get, path: 'sys/health'))
+        end
+
+        def mounts
+          @client.request(method: :get, path: 'sys/mounts').fetch(:data)
+        end
+
+        def renew(lease_id:, **)
+          Secret.decode(data: @client.put(path: 'sys/leases/renew', body: { lease_id: lease_id }))
+        end
+
+        def revoke(lease_id:, **)
+          @client.put(path: 'sys/leases/revoke', body: { lease_id: lease_id })
+          true
+        end
+      end
+
+      class AuthToken
+        def initialize(client:, **)
+          @client = client
+        end
+
+        def renew_self
+          Secret.decode(data: @client.put(path: 'auth/token/renew-self', body: {}))
+        end
+
+        def revoke_self
+          @client.put(path: 'auth/token/revoke-self', body: {})
+          true
+        end
+      end
+
+      class KV
+        def initialize(client:, mount:, **)
+          @client = client
+          mount = mount.to_s
+          first = mount.index(%r{[^/]})
+          @mount = first ? mount[first..mount.rindex(%r{[^/]})] : ''
+        end
+
+        def read(path:, **)
+          response = @client.request(method: :get, path: "#{@mount}/data/#{path}", nil_on_not_found: true)
+          return nil if response.nil?
+
+          Secret.decode(data: response.merge(data: response.dig(:data, :data)))
+        end
+
+        def write(path:, data:, **)
+          Secret.decode(data: @client.put(path: "#{@mount}/data/#{path}", body: { data: data }))
+        end
+
+        def read_metadata(path:, **)
+          Secret.decode(data: @client.request(method: :get, path: "#{@mount}/metadata/#{path}", nil_on_not_found: true))
+        end
+      end
+
+      class Secret
+        attr_reader :data, :auth, :lease_id, :lease_duration
+
+        def self.decode(data:, **)
+          return nil if data.nil? || data.empty?
+
+          new(data: data)
+        end
+
+        def initialize(data:, **)
+          @data = data[:data]
+          @auth = Auth.new(data: data[:auth]) unless data[:auth].nil?
+          @lease_id = data[:lease_id]
+          @lease_duration = data[:lease_duration]
+          @renewable = data[:renewable]
+        end
+
+        def renewable?
+          @renewable == true
+        end
+
+        def inspect
+          "#<#{self.class}>"
+        end
+      end
+
+      class Auth
+        attr_reader :client_token, :lease_duration, :policies, :metadata
+
+        def initialize(data:, **)
+          @client_token = data[:client_token]
+          @lease_duration = data[:lease_duration]
+          @policies = data[:policies]
+          @metadata = data[:metadata]
+          @renewable = data[:renewable]
+        end
+
+        def renewable?
+          @renewable == true
+        end
+
+        def inspect
+          "#<#{self.class}>"
+        end
+      end
+
+      private
+
+      def validate_address(address:, **)
+        uri = URI.parse(address.to_s)
+        unless uri.is_a?(URI::HTTP) && uri.host && !uri.userinfo && !uri.query && !uri.fragment
+          raise ArgumentError, 'Vault address must be an HTTP(S) URL without credentials, query, or fragment'
+        end
+
+        uri.to_s.freeze
+      rescue URI::InvalidURIError
+        raise ArgumentError, 'Vault address must be a valid HTTP(S) URL'
+      end
+
+      def validate_timeout(timeout:, **)
+        seconds = Float(timeout)
+        raise ArgumentError, 'Vault timeout must be positive and finite' unless seconds.positive? && seconds.finite?
+
+        seconds
+      end
+
+      def vault_headers(headers:, **)
+        result = Faraday::Utils::Headers.new('Accept' => 'application/json', 'Content-Type' => 'application/json')
+        result.update(headers)
+        result.delete('X-Vault-Token')
+        result.delete('X-Vault-Namespace')
+        result['X-Vault-Token'] = @token unless @token.nil?
+        result['X-Vault-Namespace'] = @namespace unless @namespace.nil?
+        result
+      end
+
+      def request_path(path:, **)
+        relative = path.to_s.sub(%r{\A/v1(?:/|\z)}, '').sub(%r{\A/+}, '')
+        encoded = relative.split('/', -1).map do |segment|
+          if ['.', '..'].include?(segment)
+            segment.gsub('.', '%2E')
+          else
+            URI.encode_www_form_component(segment).gsub('+', '%20')
+          end
+        end
+        "/v1/#{encoded.join('/')}"
+      end
+
+      def build_connection
+        Faraday.new(url: @address, ssl: tls_options) do |connection|
+          connection.options.timeout = @timeout
+          connection.options.open_timeout = @timeout
+          connection.options.read_timeout = @timeout
+          connection.options.write_timeout = @timeout
+          connection.adapter :net_http
+        end
+      end
+
+      def tls_options
+        options = { verify: @ssl_verify != false && @ssl_verify.to_s != 'none' }
+        if @ca
+          if @ca.include?('-----BEGIN')
+            store = OpenSSL::X509::Store.new
+            certificates = @ca.scan(/-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----/m)
+            raise ArgumentError, 'Vault CA PEM contains no certificates' if certificates.empty?
+
+            certificates.each { |certificate| store.add_cert(OpenSSL::X509::Certificate.new(certificate)) }
+            options[:cert_store] = store
+          else
+            options[:ca_file] = @ca
+          end
+        end
+        options[:client_cert] = tls_certificate(certificate: @cert) if @cert
+        options[:client_key] = tls_key(key: @key) if @key
+        options
+      end
+
+      def tls_certificate(certificate:, **)
+        return certificate if certificate.is_a?(OpenSSL::X509::Certificate)
+
+        pem = certificate.include?('-----BEGIN') ? certificate : File.read(certificate)
+        certificates = pem.scan(/-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----/m)
+        return OpenSSL::X509::Certificate.new(pem) if certificates.length < 2
+
+        certificates.map { |entry| OpenSSL::X509::Certificate.new(entry) }
+      end
+
+      def tls_key(key:, **)
+        return key if key.is_a?(OpenSSL::PKey::PKey)
+
+        OpenSSL::PKey.read(key.include?('-----BEGIN') ? key : File.read(key))
+      end
+
+      def decode_response(response:, address:, **)
+        status = response.status
+        unless (200..299).cover?(status)
+          error_class = if (400..499).cover?(status)
+                          Legion::Crypt::Vault::HTTPClientError
+                        elsif (500..599).cover?(status)
+                          Legion::Crypt::Vault::HTTPServerError
+                        else
+                          Legion::Crypt::Vault::HTTPError
+                        end
+          begin
+            decoded = response.body.nil? || response.body.empty? ? {} : Legion::JSON.load(response.body)
+          rescue Legion::JSON::ParseError
+            raise error_class.new(code: status, errors: [response.body.to_s], address: address)
+          end
+          errors = decoded.is_a?(Hash) ? decoded[:errors] : [response.body.to_s]
+          raise error_class.new(code: status, errors: errors, address: address)
+        end
+        return nil if status == 204 || response.body.nil? || response.body.empty?
+
+        Legion::JSON.load(response.body)
+      end
+    end
+  end
+end