legion-crypt 1.5.2 → 1.5.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 01cec7ac57c7d5448b5fba4237fdccc9ac8099966a4a546e95dd4888d838604f
-  data.tar.gz: ac81d602c9fc34493aeabe3fdeadd12f01fb36f8c248ac44687166fd24d9a48d
+  metadata.gz: d834ae88ede665d60615cb9ae6eb4bda06060f85e2ed1bb965d8552a85b4f7cc
+  data.tar.gz: a2a06dd4523cea1ca8e3b93edebf96c1ab7214ce18f5cba0c7be0c8bfb047e46
 SHA512:
-  metadata.gz: dea3247dbaf00a49507ededcfdd72e9e3545485cbcec511657d2e2c602e03f2230c3c34e93108ae14ede71aa7a768a36573c3f852595444f2f6ed118a351bd8c
-  data.tar.gz: 011ac0f235a69f7655ab1237d2a87faf3d343de20ef1ffe1e9576b5a555e9c0e5d46dfc6d77dd137851835850e3877783c70f62a216c3dd1a4af9c3e080e9ed6
+  metadata.gz: f136dd1740169138a66a2d6167d799c721632ced3a637cebb16e80517408cb70f6d4ba71b875bddcae109e5f9f63a7da15926feda9bf0045d852f32b33f34feb
+  data.tar.gz: 1029cf89058f5edfab6276087c39510ffcb734065aa0e75abd34344457ac25075780677d9c7c46c11ab7ae9035fab862183ee394eb2f86961fa4154571bec618

data/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Legion::Crypt
 
+## [1.5.3] - 2026-04-06
+
+### Added
+- `JwksClient.prefetch!(url)` — fire-and-forget JWKS key fetch in background thread
+- `JwksClient.start_background_refresh!(url, interval:)` — `Concurrent::TimerTask` for hourly key refresh
+- `JwksClient.stop_background_refresh!` — stops background refresh timer task
+- `bootstrap_lease_ttl: 300` in vault defaults (5-minute TTL for bootstrap credentials)
+
+### Changed
+- `JwksClient.clear_cache` now also stops any running background refresh task
+
 ## [1.5.2] - 2026-04-03
 
 ### Fixed

data/legion-crypt.gemspec

@@ -25,6 +25,7 @@ Gem::Specification.new do |spec|
     'rubygems_mfa_required' => 'true'
   }
 
+  spec.add_dependency 'concurrent-ruby', '~> 1.3'
   spec.add_dependency 'ed25519', '~> 1.3'
   spec.add_dependency 'jwt', '>= 2.7'
   spec.add_dependency 'legion-logging', '>= 1.5.0'

data/lib/legion/crypt/jwks_client.rb

@@ -6,6 +6,7 @@ require 'json'
 require 'openssl'
 require 'jwt'
 require 'legion/logging/helper'
+require 'concurrent'
 
 module Legion
   module Crypt
@@ -56,7 +57,33 @@ module Legion
           raise Legion::Crypt::JWT::InvalidTokenError, "signing key not found: #{kid}"
         end
 
+        def prefetch!(jwks_url)
+          Thread.new do
+            fetch_keys(jwks_url)
+          rescue StandardError => e
+            log.debug "JWKS prefetch failed for #{jwks_url}: #{e.message}" if respond_to?(:log)
+          end
+        end
+
+        def start_background_refresh!(jwks_url, interval: CACHE_TTL)
+          stop_background_refresh!
+
+          @refresh_task = Concurrent::TimerTask.new(execution_interval: interval, run_now: false) do
+            fetch_keys(jwks_url)
+          rescue StandardError => e
+            log.debug "JWKS background refresh failed: #{e.message}" if respond_to?(:log)
+          end
+          @refresh_task.execute
+          log.info "JWKS background refresh started (interval=#{interval}s)" if respond_to?(:log)
+        end
+
+        def stop_background_refresh!
+          @refresh_task&.shutdown
+          @refresh_task = nil
+        end
+
         def clear_cache
+          stop_background_refresh!
           @cache_mutex.synchronize { @cache = {} }
           @locks_mutex.synchronize { @locks = {} }
           log.info 'JWKS cache cleared'

data/lib/legion/crypt/settings.rb

@@ -72,7 +72,8 @@ module Legion
             service_principal: nil,
             auth_path:         'auth/kerberos/login'
           },
-          clusters:            {}
+          clusters:            {},
+          bootstrap_lease_ttl: 300
         }
       end
     end

data/lib/legion/crypt/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Crypt
-    VERSION = '1.5.2'
+    VERSION = '1.5.3'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-crypt
 version: !ruby/object:Gem::Version
-  version: 1.5.2
+  version: 1.5.3
 platform: ruby
 authors:
 - Esity
@@ -9,6 +9,20 @@ bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: concurrent-ruby
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
 - !ruby/object:Gem::Dependency
   name: ed25519
   requirement: !ruby/object:Gem::Requirement