legion-crypt 1.5.38 → 1.5.42

data/lib/legion/crypt/vault_cluster.rb

@@ -1,331 +0,0 @@
-# frozen_string_literal: true
-
-require 'legion/logging/helper'
-require 'uri'
-require 'legion/crypt/vault_client'
-require 'legion/crypt/tls'
-require 'legion/crypt/vault_operation'
-
-module Legion
-  module Crypt
-    module VaultCluster
-      include Legion::Logging::Helper
-
-      def vault_client(name = nil)
-        name = resolve_cluster_name(name)
-        loop do
-          candidate = accepted = nil
-          signature, generation = vault_clients_mutex.synchronize do
-            return @vault_clients&.dig(name, :client) if Legion::Crypt.respond_to?(:stopping) && Legion::Crypt.stopping
-
-            @vault_clients ||= {}
-            entry = @vault_clients[name]
-            signature = vault_client_signature(config: name.nil? ? vault_settings : clusters[name])
-            cached = cached_vault_client(entry: entry, signature: signature)
-            return cached if cached
-
-            unless signature
-              (@retired_vault_clients ||= ObjectSpace::WeakMap.new)[entry[:client]] = true if entry
-              @vault_clients.delete(name)
-              return nil
-            end
-            signature.transform_values! { |value| value.is_a?(String) ? value.dup.freeze : value }
-            [signature, @vault_client_generation || 0]
-          end
-          candidate = build_vault_client(signature, name: name)
-          accepted = install_vault_client(name: name, signature: signature, client: candidate, generation: generation)
-          return accepted if accepted
-        ensure
-          retire_vault_client(client: candidate) unless accepted.equal?(candidate)
-        end
-      end
-
-      def publish_vault_grant(client:, config:, grant:, auth_method:, issued_at: Time.now, **)
-        token = grant.fetch(:token)
-        ttl = grant[:lease_duration].to_f
-        expires_at = issued_at + ttl if ttl.positive?
-        vault_clients_mutex.synchronize do
-          pair = @vault_clients&.find { |_name, entry| entry[:client].equal?(client) }
-          raise IOError, 'Vault client replaced during authentication' if @retired_vault_clients&.key?(client)
-
-          if pair
-            name, entry = pair
-            current_config = name.nil? ? vault_settings : clusters[name]
-            unless config.equal?(current_config) && current_vault_client?(entry: entry, signature: vault_client_signature(config: current_config))
-              raise IOError, 'Vault client configuration changed during authentication'
-            end
-          end
-          client.token = token
-          connected = expires_at.nil? || expires_at > Time.now
-          config.merge!(token: token, lease_duration: grant[:lease_duration], renewable: grant[:renewable],
-                        expires_at: expires_at, connected: connected, relogin_required: !connected, auth_method: auth_method)
-          entry[:signature][:token] = token&.dup&.freeze if entry
-        end
-      end
-
-      def clear_vault_clients(deadline: nil, **)
-        deadline ||= ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + Legion::Crypt::VaultOperation::SHUTDOWN_TIMEOUT
-        clients = vault_clients_mutex.synchronize do
-          @vault_client_generation = (@vault_client_generation || 0) + 1
-          previous = (@vault_clients || {}).values.map { |entry| entry[:client] }
-          previous.concat(@retired_vault_clients.keys) if @retired_vault_clients
-          @vault_clients = {}
-          @retired_vault_clients = nil
-          previous.uniq
-        end
-        clients.each { |client| retire_vault_client(client: client, deadline: deadline) }
-      end
-
-      def cluster(name = nil)
-        name = resolve_cluster_name(name)
-        clusters[name]
-      end
-
-      def default_cluster_name
-        name = vault_settings[:default]
-        name ? name.to_sym : clusters.keys.first
-      end
-
-      def clusters
-        vault_settings[:clusters] || {}
-      end
-
-      def connected_clusters
-        vault_clients_mutex.synchronize do
-          now = Time.now
-          clusters.select do |_, config|
-            config[:token] && config[:connected] && !config[:relogin_required] &&
-              (!config[:expires_at] || config[:expires_at] > now)
-          end
-        end
-      end
-
-      def connect_all_clusters
-        log.info "Vault cluster connect requested configured_clusters=#{clusters.size}"
-        log_vault_debug("connect_all_clusters: #{clusters.size} cluster(s) configured")
-        results = {}
-        clusters.each do |name, config|
-          log_vault_debug("connect_all_clusters: #{name} (auth_method=#{config[:auth_method].inspect})")
-          case config[:auth_method]&.to_s
-          when 'kerberos'
-            results[name] = connect_kerberos_cluster(name, config)
-          when 'ldap'
-            next # handled by ldap_login_all
-          else
-            next unless config[:token]
-
-            client = vault_client(name)
-            config[:connected] = cluster_healthy?(client)
-            results[name] = config[:connected]
-            log_cluster_connected(name, config) if config[:connected]
-          end
-        rescue StandardError => e
-          config[:connected] = false
-          results[name] = false
-          log_vault_error(name, e, operation: 'crypt.vault_cluster.connect_all_clusters')
-        end
-
-        connected = results.select { |_, v| v }
-        log.info "Vault cluster connect complete connected=#{connected.size} attempted=#{results.size}"
-        log_vault_debug("connect_all_clusters: #{connected.size}/#{results.size} connected")
-        sync_vault_connected(connected.any?)
-        results
-      end
-
-      private
-
-      def cluster_healthy?(client)
-        client.sys.health_status.initialized?
-      rescue Legion::Crypt::Vault::HTTPError => e
-        return true if [429, 472, 473].include?(e.code)
-
-        handle_exception(e, level: :warn, operation: 'crypt.vault_cluster.cluster_healthy')
-        raise
-      end
-
-      def sync_vault_connected(connected)
-        return unless defined?(Legion::Settings)
-
-        Legion::Settings[:crypt][:vault][:connected] = connected
-      end
-
-      def selected_connected_cluster_name(name = nil)
-        active_clusters = connected_clusters
-        return nil if active_clusters.empty?
-
-        if name
-          cluster_name = name.to_sym
-          raise ArgumentError, "Vault cluster not connected: #{cluster_name}" unless active_clusters.key?(cluster_name)
-
-          return cluster_name
-        end
-
-        default_name = vault_settings[:default]&.to_sym
-        return default_name if default_name && active_clusters.key?(default_name)
-
-        active_clusters.keys.first
-      end
-
-      def resolve_cluster_name(name)
-        return name.to_sym if name
-
-        default_cluster_name
-      end
-
-      def vault_clients_mutex
-        @vault_clients_mutex ||= Mutex.new
-      end
-
-      def current_vault_client?(entry:, signature:, **)
-        return false unless entry && signature
-        return false unless entry[:signature].all? { |key, value| key == :token || value == signature[key] }
-
-        entry[:signature][:token] == signature[:token] || entry[:client].token == signature[:token]
-      end
-
-      def cached_vault_client(entry:, signature:, **)
-        return unless current_vault_client?(entry: entry, signature: signature)
-
-        entry[:signature][:token] = signature[:token]&.dup if entry[:signature][:token] != signature[:token]
-        entry[:client]
-      end
-
-      def install_vault_client(name:, signature:, client:, generation:, **)
-        vault_clients_mutex.synchronize do
-          raise IOError, 'Vault clients cleared during construction' unless generation == (@vault_client_generation || 0)
-          raise IOError, 'Crypt stopped during client construction' if Legion::Crypt.respond_to?(:stopping) && Legion::Crypt.stopping
-
-          entry = @vault_clients[name]
-          current_signature = vault_client_signature(config: name.nil? ? vault_settings : clusters[name])
-          cached = cached_vault_client(entry: entry, signature: current_signature)
-          return cached if cached
-          return unless signature == current_signature
-
-          (@retired_vault_clients ||= ObjectSpace::WeakMap.new)[entry[:client]] = true if entry
-          @vault_clients[name] = { client: client, signature: signature }
-          client
-        end
-      end
-
-      def resolve_vault_address(vault_settings:, **)
-        protocol = vault_settings[:protocol] || 'http'
-        address  = vault_settings[:address] || 'localhost'
-        port     = vault_settings[:port] || 8200
-
-        if address.match?(%r{\Ahttps?://})
-          uri = URI.parse(address)
-          protocol = uri.scheme
-          address  = uri.host
-          port     = uri.port if vault_settings[:port].nil?
-        end
-
-        "#{protocol}://#{address}:#{port}"
-      end
-
-      def vault_client_signature(config:, **)
-        return unless config.is_a?(Hash)
-
-        tls = Legion::Crypt::TLS.migrate_legacy(config[:tls] || {})
-        verify = %w[none mutual].include?(tls[:verify].to_s) ? tls[:verify].to_s : 'peer'
-
-        namespace =
-          if config.key?(:namespace)
-            config[:namespace]
-          elsif defined?(Legion::Settings)
-            crypt_settings = Legion::Settings[:crypt]
-            crypt_settings.respond_to?(:dig) ? crypt_settings.dig(:vault, :vault_namespace) : nil
-          end
-        {
-          address: resolve_vault_address(vault_settings: config), namespace: namespace, token: config[:token],
-          verify: verify, ca: tls[:ca], cert: tls[:cert], key: tls[:key],
-          timeout: vault_settings[:operation_timeout] || Legion::Crypt::VaultOperation::DEFAULT_TIMEOUT
-        }
-      end
-
-      def build_vault_client(signature, name:)
-        building = Thread.current[:legion_vault_clients_building] ||= []
-        build_key = [self, name]
-        raise IOError, 'Circular Vault TLS material dependency' if building.include?(build_key)
-
-        building << build_key
-        begin
-          tls = Legion::Crypt::TLS.resolve(signature.slice(:verify, :ca, :cert, :key))
-          %i[ca cert key].each do |attribute|
-            raise IOError, "Configured Vault TLS #{attribute} could not be resolved" if signature[attribute] && tls[attribute].nil?
-          end
-          options = signature.slice(:address, :namespace, :token, :timeout).merge(tls: tls)
-          log.info "Building Vault client address=#{options[:address]} namespace=#{options[:namespace].inspect} tls_verify=#{tls[:verify]}"
-          Legion::Crypt::VaultClient.new(**options)
-        ensure
-          building.delete(build_key)
-        end
-      end
-
-      def retire_vault_client(client:, deadline: nil, **)
-        return unless client.respond_to?(:shutdown)
-
-        Legion::Crypt::VaultOperation.with_timeout(deadline: deadline) do
-          client.shutdown
-        end
-      rescue StandardError => e
-        handle_exception(e, level: :warn, operation: 'crypt.vault_cluster.retire_vault_client')
-      end
-
-      def log_vault_error(name, error, operation: 'crypt.vault_cluster.error')
-        handle_exception(error, level: :error, operation: operation, cluster_name: name)
-      end
-
-      def connect_kerberos_cluster(name, config)
-        krb_config = config[:kerberos] || {}
-        spn = krb_config[:service_principal]
-        auth_path = krb_config[:auth_path] || Legion::Crypt::KerberosAuth::DEFAULT_AUTH_PATH
-
-        log_vault_debug("connect_kerberos_cluster[#{name}]: SPN=#{spn}, auth_path=#{auth_path}, namespace=#{config[:namespace].inspect}")
-
-        unless spn
-          log_vault_warn(name, 'Kerberos auth missing service_principal, skipping')
-          config[:connected] = false
-          return false
-        end
-
-        require 'legion/crypt/kerberos_auth'
-        client = vault_client(name)
-        log_vault_debug("connect_kerberos_cluster[#{name}]: client.namespace=#{client.respond_to?(:namespace) ? client.namespace.inspect : 'n/a'}")
-        log.info "Connecting Vault cluster #{name} via Kerberos auth_path=#{auth_path}"
-
-        result = Legion::Crypt::KerberosAuth.login(
-          vault_client:      client,
-          service_principal: spn,
-          auth_path:         auth_path
-        )
-
-        publish_vault_grant(client: client, config: config, grant: result, auth_method: 'kerberos')
-        log_vault_debug("connect_kerberos_cluster[#{name}]: policies=#{result[:policies].inspect}")
-        log_cluster_connected(name, config)
-        true
-      rescue Legion::Crypt::KerberosAuth::GemMissingError => e
-        handle_exception(e, level: :warn, operation: 'crypt.vault_cluster.connect_kerberos_cluster', cluster_name: name)
-        log_vault_warn(name, e.message)
-        config[:connected] = false
-        false
-      rescue Legion::Crypt::KerberosAuth::AuthError => e
-        handle_exception(e, level: :warn, operation: 'crypt.vault_cluster.connect_kerberos_cluster', cluster_name: name)
-        log_vault_warn(name, "Kerberos auth failed: #{e.message}")
-        config[:connected] = false
-        false
-      end
-
-      def log_cluster_connected(name, config)
-        log.info "Vault cluster connected: #{name} at #{config[:address]}"
-      end
-
-      def log_vault_warn(name, message)
-        log.warn("Vault cluster #{name}: #{message}")
-      end
-
-      def log_vault_debug(message)
-        log.debug(message)
-      end
-    end
-  end
-end

data/lib/legion/crypt/vault_entity.rb

@@ -1,78 +0,0 @@
-# frozen_string_literal: true
-
-require 'legion/logging/helper'
-require 'legion/crypt/vault_client'
-require 'legion/crypt/lease_manager'
-
-module Legion
-  module Crypt
-    module VaultEntity
-      extend Legion::Logging::Helper
-
-      # Create or lookup a Vault entity for a Legion principal.
-      # Returns the Vault entity ID string, or nil on failure.
-      def self.ensure_entity(principal_id:, canonical_name:, metadata: {})
-        existing = find_by_name(canonical_name: canonical_name)
-        return existing if existing
-
-        response = Legion::Crypt::LeaseManager.instance.vault_logical.write(
-          path: 'identity/entity',
-          data: {
-            name:     "legion-#{canonical_name}",
-            metadata: metadata.merge(
-              legion_principal_id:   principal_id,
-              legion_canonical_name: canonical_name,
-              managed_by:            'legion'
-            )
-          }
-        )
-        extract_id(response)
-      rescue StandardError => e
-        handle_exception(e, level: :warn, operation: 'crypt.vault_entity.ensure_entity', canonical_name: canonical_name)
-        nil
-      end
-
-      # Create an alias linking an auth method mount to the entity.
-      # Idempotent — swallows "already exists" 4xx errors.
-      def self.ensure_alias(entity_id:, mount_accessor:, alias_name:)
-        Legion::Crypt::LeaseManager.instance.vault_logical.write(
-          path: 'identity/entity-alias',
-          data: { name: alias_name, canonical_id: entity_id, mount_accessor: mount_accessor }
-        )
-      rescue Legion::Crypt::Vault::HTTPClientError => e
-        if e.message.include?('already exists')
-          log.debug 'Vault entity alias already exists (idempotent)'
-        else
-          handle_exception(e, level: :warn, operation: 'crypt.vault_entity.ensure_alias', alias_name: alias_name)
-        end
-        nil
-      rescue StandardError => e
-        handle_exception(e, level: :warn, operation: 'crypt.vault_entity.ensure_alias', alias_name: alias_name)
-        nil
-      end
-
-      # Look up a Vault entity by its Legion canonical name.
-      # Returns the Vault entity ID string, or nil if not found.
-      def self.find_by_name(canonical_name:)
-        response = Legion::Crypt::LeaseManager.instance.vault_logical.read(path: "identity/entity/name/legion-#{canonical_name}")
-        extract_id(response)
-      rescue StandardError => e
-        handle_exception(e, level: :warn, operation: 'crypt.vault_entity.find_by_name', canonical_name: canonical_name)
-        nil
-      end
-
-      # ---------------------------------------------------------------------------
-      # Private helpers
-      # ---------------------------------------------------------------------------
-
-      # Extract the entity ID from the client's symbol-keyed response data.
-      def self.extract_id(response)
-        data = response&.data
-        return nil unless data
-
-        data[:id]
-      end
-      private_class_method :extract_id
-    end
-  end
-end

data/lib/legion/crypt/vault_jwt_auth.rb

@@ -1,97 +0,0 @@
-# frozen_string_literal: true
-
-require 'legion/logging/helper'
-require 'legion/crypt/vault_client'
-
-module Legion
-  module Crypt
-    # Vault JWT auth backend integration.
-    #
-    # Allows Legion workers to authenticate to Vault using JWT tokens
-    # via Vault's JWT/OIDC auth method. The worker presents a signed JWT
-    # and receives a Vault token with policies scoped to the worker's role.
-    #
-    # Vault config prerequisites:
-    #   vault auth enable jwt
-    #   vault write auth/jwt/config jwks_url="..." (or bound_issuer + jwt_validation_pubkeys)
-    #   vault write auth/jwt/role/legion-worker bound_audiences="legion" ...
-    module VaultJwtAuth
-      DEFAULT_AUTH_PATH = 'auth/jwt/login'
-      DEFAULT_ROLE      = 'legion-worker'
-
-      class AuthError < StandardError; end
-
-      extend Legion::Logging::Helper
-
-      # Authenticate to Vault using a JWT token.
-      # Returns a Vault token string on success.
-      #
-      # @param jwt [String] Signed JWT token (issued by Legion or Entra ID)
-      # @param role [String] Vault JWT auth role name (default: 'legion-worker')
-      # @param auth_path [String] Vault auth mount path (default: 'auth/jwt/login')
-      # @return [Hash] { token:, lease_duration:, policies:, metadata: }
-      def self.login(jwt:, role: DEFAULT_ROLE, auth_path: DEFAULT_AUTH_PATH)
-        raise AuthError, 'Vault is not connected' unless Legion::Crypt.vault_connected?
-
-        log.info "[crypt:vault_jwt] authenticating role=#{role} auth_path=#{auth_path}"
-        response = Legion::Crypt.vault_client.logical.write(path: auth_path, data: { role: role, jwt: jwt })
-
-        raise AuthError, 'Vault JWT auth returned no auth data' unless response&.auth
-
-        {
-          token:          response.auth.client_token,
-          lease_duration: response.auth.lease_duration,
-          renewable:      response.auth.renewable?,
-          policies:       response.auth.policies,
-          metadata:       response.auth.metadata
-        }
-      rescue Legion::Crypt::Vault::HTTPClientError => e
-        handle_exception(e, level: :warn, operation: 'crypt.vault_jwt_auth.login', role: role, auth_path: auth_path,
-                            category: 'client_error')
-        raise AuthError, "Vault JWT auth failed: #{e.message}"
-      rescue Legion::Crypt::Vault::HTTPServerError => e
-        handle_exception(e, level: :warn, operation: 'crypt.vault_jwt_auth.login', role: role, auth_path: auth_path,
-                            category: 'server_error')
-        raise AuthError, "Vault server error during JWT auth: #{e.message}"
-      rescue StandardError => e
-        handle_exception(e, level: :error, operation: 'crypt.vault_jwt_auth.login', role: role, auth_path: auth_path)
-        raise if e.is_a?(AuthError)
-
-        raise AuthError, "Vault JWT auth failed: #{e.message}"
-      end
-
-      # Authenticate and set the Vault client token for subsequent operations.
-      # This replaces the current Vault token with the JWT-authenticated one.
-      #
-      # @return [Hash] Same as login
-      def self.login!(jwt:, role: DEFAULT_ROLE, auth_path: DEFAULT_AUTH_PATH)
-        generation = Legion::Crypt.vault_auth_generation
-        client = Legion::Crypt.vault_client
-        config = Legion::Crypt.cluster || Legion::Settings[:crypt][:vault]
-        result = login(jwt: jwt, role: role, auth_path: auth_path)
-        Legion::Crypt.install_vault_grant(client: client, config: config, grant: result, auth_method: 'jwt', generation: generation)
-        log.info "[crypt:vault_jwt] authenticated via JWT auth, policies=#{result[:policies].join(',')}"
-        result
-      end
-
-      # Issue a Legion JWT and use it to authenticate to Vault in one step.
-      # Convenience method for workers that need Vault access.
-      #
-      # @param worker_id [String] Digital worker ID
-      # @param owner_msid [String] Worker's owner MSID
-      # @param role [String] Vault JWT auth role name
-      # @return [Hash] Same as login
-      def self.worker_login(worker_id:, owner_msid:, role: DEFAULT_ROLE)
-        log.info "[crypt:vault_jwt] worker login requested role=#{role} worker_id=#{worker_id}"
-        jwt = Legion::Crypt::JWT.issue(
-          { worker_id: worker_id, sub: owner_msid, scope: 'vault', aud: 'legion' },
-          signing_key: Legion::Crypt.cluster_secret,
-          ttl:         300,
-          issuer:      'legion'
-        )
-
-        login(jwt: jwt, role: role)
-      end
-    end
-  end
-end

data/lib/legion/crypt/vault_kerberos_auth.rb

@@ -1,51 +0,0 @@
-# frozen_string_literal: true
-
-require 'legion/logging/helper'
-require 'legion/crypt/vault_client'
-
-module Legion
-  module Crypt
-    module VaultKerberosAuth
-      DEFAULT_AUTH_PATH = 'auth/kerberos/login'
-
-      class AuthError < StandardError; end
-
-      extend Legion::Logging::Helper
-
-      def self.login(spnego_token:, auth_path: DEFAULT_AUTH_PATH)
-        raise AuthError, 'Vault is not connected' unless Legion::Crypt.vault_connected?
-
-        log.info "[crypt:vault_kerberos] login requested auth_path=#{auth_path}"
-        data = Legion::Crypt.vault_client.put(
-          path: auth_path, body: '{}', headers: { 'Authorization' => "Negotiate #{spnego_token}" }
-        )
-        response = Legion::Crypt::VaultClient::Secret.decode(data: data)
-        raise AuthError, 'Vault Kerberos auth returned no auth data' unless response&.auth
-
-        {
-          token:          response.auth.client_token,
-          lease_duration: response.auth.lease_duration,
-          renewable:      response.auth.renewable?,
-          policies:       response.auth.policies,
-          metadata:       response.auth.metadata
-        }
-      rescue Legion::Crypt::Vault::HTTPClientError => e
-        handle_exception(e, level: :warn, operation: 'crypt.vault_kerberos_auth.login', auth_path: auth_path)
-        raise AuthError, "Vault Kerberos auth failed: #{e.message}"
-      rescue StandardError => e
-        handle_exception(e, level: :error, operation: 'crypt.vault_kerberos_auth.login', auth_path: auth_path)
-        raise
-      end
-
-      def self.login!(spnego_token:, auth_path: DEFAULT_AUTH_PATH)
-        generation = Legion::Crypt.vault_auth_generation
-        client = Legion::Crypt.vault_client
-        config = Legion::Crypt.cluster || Legion::Settings[:crypt][:vault]
-        result = login(spnego_token: spnego_token, auth_path: auth_path)
-        Legion::Crypt.install_vault_grant(client: client, config: config, grant: result, auth_method: 'kerberos', generation: generation)
-        log.info "[crypt:vault_kerberos] authenticated via Kerberos auth, policies=#{result[:policies].join(',')}"
-        result
-      end
-    end
-  end
-end

data/lib/legion/crypt/vault_operation.rb

@@ -1,27 +0,0 @@
-# frozen_string_literal: true
-
-require 'timeout'
-
-module Legion
-  module Crypt
-    module VaultOperation
-      DEFAULT_TIMEOUT = 5
-      SHUTDOWN_TIMEOUT = 10
-
-      def self.with_timeout(deadline: nil, **)
-        configuration = defined?(Legion::Settings) ? Legion::Settings[:crypt] : nil
-        timeout = configuration&.dig(:vault, :operation_timeout) || DEFAULT_TIMEOUT
-        raise ArgumentError, 'Vault operation_timeout must be a finite positive number' unless timeout.is_a?(Numeric) && timeout.finite? && timeout.positive?
-
-        if deadline
-          remaining = deadline - ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
-          raise Timeout::Error, 'Vault operation deadline expired' unless remaining.positive?
-
-          timeout = [timeout, remaining].min
-        end
-        operation_deadline = ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + timeout
-        Timeout.timeout(timeout) { yield(operation_deadline) }
-      end
-    end
-  end
-end