legion-crypt 1.5.2 → 1.5.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 01cec7ac57c7d5448b5fba4237fdccc9ac8099966a4a546e95dd4888d838604f
-  data.tar.gz: ac81d602c9fc34493aeabe3fdeadd12f01fb36f8c248ac44687166fd24d9a48d
+  metadata.gz: 63ba23115939920477655378eaff3adacb4f37dac754cffc7e888a9eebc8ab08
+  data.tar.gz: 88960246bf06ae1e228529958d9e431693a9fa8e8279234ae1498c130bf1490d
 SHA512:
-  metadata.gz: dea3247dbaf00a49507ededcfdd72e9e3545485cbcec511657d2e2c602e03f2230c3c34e93108ae14ede71aa7a768a36573c3f852595444f2f6ed118a351bd8c
-  data.tar.gz: 011ac0f235a69f7655ab1237d2a87faf3d343de20ef1ffe1e9576b5a555e9c0e5d46dfc6d77dd137851835850e3877783c70f62a216c3dd1a4af9c3e080e9ed6
+  metadata.gz: abf411468507856a834cc3e06df344eaecc5deebcb552a77d4cfd30ac1c091506f8b284eea79660d3dc109f2e622816c32871d4c4eda047a51ec3a9dbb689467
+  data.tar.gz: 557b616f75af3857df71a6530ea4a7e26680163fc2274e3a09ecfb2a12de628cc9bf64b90fb8e527c8ae43b1ac741a070b3f68d281591369ab460e2e348bd4e8

data/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Legion::Crypt
 
+## [Unreleased]
+
+## [1.5.4] - 2026-04-06
+
+### Added
+- `JWT.issue_identity_token` — convenience method wrapping `JWT.issue` with identity claims from `Identity::Process` (Wire Format Phase 3); accepts `issuer:` kwarg (defaults to `'legion'`) passed through to `JWT.issue`; normalizes and rejects conflicting string-keyed extra claims before merging
+
+## [1.5.3] - 2026-04-06
+
+### Added
+- `JwksClient.prefetch!(url)` — fire-and-forget JWKS key fetch in background thread
+- `JwksClient.start_background_refresh!(url, interval:)` — `Concurrent::TimerTask` for hourly key refresh
+- `JwksClient.stop_background_refresh!` — stops background refresh timer task
+- `bootstrap_lease_ttl: 300` in vault defaults (5-minute TTL for bootstrap credentials)
+
+### Changed
+- `JwksClient.clear_cache` now also stops any running background refresh task
+
 ## [1.5.2] - 2026-04-03
 
 ### Fixed

data/legion-crypt.gemspec

@@ -25,6 +25,7 @@ Gem::Specification.new do |spec|
     'rubygems_mfa_required' => 'true'
   }
 
+  spec.add_dependency 'concurrent-ruby', '~> 1.3'
   spec.add_dependency 'ed25519', '~> 1.3'
   spec.add_dependency 'jwt', '>= 2.7'
   spec.add_dependency 'legion-logging', '>= 1.5.0'

data/lib/legion/crypt/jwks_client.rb

@@ -6,6 +6,7 @@ require 'json'
 require 'openssl'
 require 'jwt'
 require 'legion/logging/helper'
+require 'concurrent'
 
 module Legion
   module Crypt
@@ -56,7 +57,33 @@ module Legion
           raise Legion::Crypt::JWT::InvalidTokenError, "signing key not found: #{kid}"
         end
 
+        def prefetch!(jwks_url)
+          Thread.new do
+            fetch_keys(jwks_url)
+          rescue StandardError => e
+            log.debug "JWKS prefetch failed for #{jwks_url}: #{e.message}" if respond_to?(:log)
+          end
+        end
+
+        def start_background_refresh!(jwks_url, interval: CACHE_TTL)
+          stop_background_refresh!
+
+          @refresh_task = Concurrent::TimerTask.new(execution_interval: interval, run_now: false) do
+            fetch_keys(jwks_url)
+          rescue StandardError => e
+            log.debug "JWKS background refresh failed: #{e.message}" if respond_to?(:log)
+          end
+          @refresh_task.execute
+          log.info "JWKS background refresh started (interval=#{interval}s)" if respond_to?(:log)
+        end
+
+        def stop_background_refresh!
+          @refresh_task&.shutdown
+          @refresh_task = nil
+        end
+
         def clear_cache
+          stop_background_refresh!
           @cache_mutex.synchronize { @cache = {} }
           @locks_mutex.synchronize { @locks = {} }
           log.info 'JWKS cache cleared'

data/lib/legion/crypt/jwt.rb

@@ -36,6 +36,29 @@ module Legion
         raise
       end
 
+      def self.issue_identity_token(signing_key:, extra_claims: {}, algorithm: 'HS256', ttl: 3600, issuer: 'legion')
+        unless defined?(Legion::Identity::Process) && Legion::Identity::Process.resolved?
+          raise ArgumentError,
+                'Identity::Process not resolved'
+        end
+
+        identity = Legion::Identity::Process.identity_hash
+        identity_fields = {
+          sub:            identity[:canonical_name],
+          principal_id:   identity[:id],
+          canonical_name: identity[:canonical_name],
+          kind:           identity[:kind].to_s,
+          mode:           identity[:mode].to_s,
+          groups:         (identity[:groups] || [])[0, 50]
+        }
+        normalized_extra_claims = symbolize_keys(extra_claims || {}).reject do |key, _value|
+          identity_fields.key?(key)
+        end
+        payload = normalized_extra_claims.merge(identity_fields)
+
+        issue(payload, signing_key: signing_key, algorithm: algorithm, ttl: ttl, issuer: issuer)
+      end
+
       def self.verify(token, verification_key:, **opts)
         algorithm = opts.fetch(:algorithm, 'HS256')
         verify_expiration = opts.fetch(:verify_expiration, true)

data/lib/legion/crypt/settings.rb

@@ -72,7 +72,8 @@ module Legion
             service_principal: nil,
             auth_path:         'auth/kerberos/login'
           },
-          clusters:            {}
+          clusters:            {},
+          bootstrap_lease_ttl: 300
         }
       end
     end

data/lib/legion/crypt/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Crypt
-    VERSION = '1.5.2'
+    VERSION = '1.5.4'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-crypt
 version: !ruby/object:Gem::Version
-  version: 1.5.2
+  version: 1.5.4
 platform: ruby
 authors:
 - Esity
@@ -9,6 +9,20 @@ bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: concurrent-ruby
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
 - !ruby/object:Gem::Dependency
   name: ed25519
   requirement: !ruby/object:Gem::Requirement