legion-crypt 1.5.0 → 1.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5b7ffab5835f3a3ac600a9bfe87e1e015e362d07d5814c956c13cc7552d23775
-  data.tar.gz: 18179a5915360c9f22151ec6a08ac813e580c2c2fb36dffd95b6f42aa9a4c242
+  metadata.gz: a988afa9a1eca8337d8355120b5c5b7ea5a7feb5333477db6c3d22b1a9714bc2
+  data.tar.gz: '068dce6425c3bd706848b2daab7a8465b1b1a7ffe5aa207b386b6263685b2db6'
 SHA512:
-  metadata.gz: cce5f0d26e384c890c7117f0e710a9ff0f27da5794e8c2c9f05b3bdd81cacf3a551ffaaa9f31a75fea68e512918370b6deb8870c30cd010ea2da622a87c04611
-  data.tar.gz: acac22b254e94ccfd8ead507e014c7a619b715f8aab8000454d2e428633096ea3b251e21ab51ba67b31c879d6b07733670eb4cff1bf657ec553892262f72d199
+  metadata.gz: 6467a8507feb5172ea8fc081ddfe30fc82fd7fff7591a24ea0e10bd822a1939e326d98b7b6e8c9efdb8efe0ae4eb7e58b1ac9973beba5bf880db77a37589183a
+  data.tar.gz: c81cadc3cdc2cbbc78d51dcc8884b1f4a3259c00383f7ead23208443bf852cf606489e980bd01b2a3887d69f0b1c9de5aff6a889c33632a2c1c4a8172daaebf5

data/AGENTS.md

@@ -32,6 +32,15 @@ bundle exec rubocop
 - Maintain compatibility for Kerberos, LDAP, and JWT Vault auth paths.
 - Cryptographic defaults and key lifecycle behavior are contract-sensitive; change only with test coverage.
 
+## Known Risks
+
+- Vault-backed cluster secret sync is inconsistent today: config key mismatch, read/write path mismatch, and push happens before the new secret is stored.
+- External JWKS verification currently accepts tokens without issuer/audience enforcement unless the caller passes both explicitly; fail closed when touching this path.
+- Multi-cluster Vault behavior has correctness gaps around LDAP token propagation, default-cluster routing, and lease-manager client selection.
+- SPIFFE X.509 fetch currently falls back to a self-signed SVID on Workload API failure; treat that path as security-sensitive and avoid expanding the fallback behavior.
+- `Ed25519` and `Erasure` include helper paths that call `Legion::Crypt::Vault.read/write` directly; verify runtime behavior before relying on those helpers.
+- Current specs pass, but some of the highest-risk paths above are under-covered or only covered with mocks that preserve the existing behavior.
+
 ## Validation
 
 - Run targeted specs for changed auth/crypto paths first.

data/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Legion::Crypt
 
+## [1.5.1] - 2026-04-03
+
+### Fixed
+- Vault `read` method no longer prepends a `legion/` mount prefix to paths — the default `type` parameter changed from `'legion'` to `nil` to match the actual KV v2 mount path in the `legionio` namespace
+- LeaseManager now registers an `at_exit` hook to revoke active Vault leases on unclean process exit, preventing orphaned dynamic credentials (RabbitMQ users, PostgreSQL roles, Redis creds)
+
 ## [1.5.0] - 2026-04-02
 
 ### Fixed

data/lib/legion/crypt/lease_manager.rb

@@ -24,6 +24,8 @@ module Legion
         @state_mutex.synchronize { @vault_client = vault_client }
         return if definitions.nil? || definitions.empty?
 
+        register_at_exit_hook
+
         log.info "LeaseManager start requested definitions=#{definitions.size}"
         definitions.each do |name, opts|
           path = opts['path'] || opts[:path]
@@ -156,6 +158,19 @@ module Legion
 
       private
 
+      def register_at_exit_hook
+        return if @at_exit_registered
+
+        at_exit do
+          next if @state_mutex.synchronize { @active_leases.empty? }
+
+          shutdown
+        rescue StandardError # best effort on crash
+          nil
+        end
+        @at_exit_registered = true
+      end
+
       def logical
         client = @state_mutex.synchronize { @vault_client }
         client ? client.logical : ::Vault.logical

data/lib/legion/crypt/vault.rb

@@ -47,7 +47,7 @@ module Legion
         raise
       end
 
-      def read(path, type = 'legion', cluster_name: nil)
+      def read(path, type = nil, cluster_name: nil)
         full_path = type.nil? || type.empty? ? path : "#{type}/#{path}"
         log_read_context(full_path, cluster_name: cluster_name)
         lease = logical_client(cluster_name: cluster_name).read(full_path)

data/lib/legion/crypt/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Crypt
-    VERSION = '1.5.0'
+    VERSION = '1.5.1'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-crypt
 version: !ruby/object:Gem::Version
-  version: 1.5.0
+  version: 1.5.1
 platform: ruby
 authors:
 - Esity