legion-data 1.10.6 → 1.10.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 861fe6533a77e8819c03400430f32ddb420a7cfa29e042b3c86734f6d7fd57bc
-  data.tar.gz: 48fe377db280cad64c5e9331926a24319a44c78c96eeb9aa7e2c6aa038a77024
+  metadata.gz: 869153710ece6717285edf2de7483f4c9f5fe5b493837681b80d05b77b014971
+  data.tar.gz: 2813fd707f0f7a80858802046b7ba2a2f23611f94a1515c66e5c7a5db1771dd6
 SHA512:
-  metadata.gz: 3850a5774dbc1de772fd8a2b4762dddc9da3164e9cff32b5f02b946f7608dba551394bcb3b2aa90590f038199f33da655957c74896ff74419e840a4769b7008e
-  data.tar.gz: 006b1ed6fd955a876dabfa6875fa075eb8abfec1aa59467b3411e36e3ce32752735277b4013ba908db280cb98a4c152bb91e14563be55c41d6ff53778c3f944a
+  metadata.gz: 41aff7bbce675a95d8a2ec6683eb0350decde2cf66854971b0c43fed1d4a09bdc50563e922bfe29d5a01660c522d579be7f2719495150d136ba262f433ba4ac4
+  data.tar.gz: c766be4f0a13cf3ac3dc91e305d275742d5c49206ec90819631d05739137fb1c9eadbc550feeef1d6e635961ec8bf439b9b5fc19dfc334d1798859573d87902a

data/.rubocop.yml

@@ -23,13 +23,6 @@ Naming/VariableNumber:
     - lib/legion/data/connection.rb
 Legion/Framework/EagerSequelModel:
   Enabled: false
-# TaxonomyEnum validates LLM lane taxonomy (:tier/:type/:circuit_state). In
-# these paths `type:` is a Sequel column type (e.g. foreign_key type: :uuid) or
-# the extract API (type: :auto/:text) — not LLM taxonomy — so the cop misfires.
-Legion/Llm/TaxonomyEnum:
-  Exclude:
-    - 'lib/legion/data/migrations/**/*'
-    - 'spec/**/*'
 Metrics/BlockLength:
   Max: 100
   Exclude:
@@ -37,6 +30,8 @@ Metrics/BlockLength:
     - 'lib/legion/data/migrations/*'
 ThreadSafety/ClassInstanceVariable:
   Enabled: false
+Legion/Llm/TaxonomyEnum:
+  Enabled: false
 ThreadSafety/ClassAndModuleAttributes:
   Enabled: false
 Metrics/AbcSize:

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Legion::Data Changelog
 
+## [1.10.8] - 2026-07-23
+### Fixed
+- Detect auth failures (`role does not exist`, `password authentication failed`) on Sequel pool connections and trigger immediate Vault lease reissue via LeaseManager instead of retrying dead credentials forever. 30-second cooldown prevents reissue storms during bulk credential rotation.
+
+## [1.10.7] - 2026-07-15
+### Fixed
+- Fail loud with actionable error when unresolved lease:// credentials reach connection
+
 ## [1.10.6] - 2026-07-03
 
 ### Changed

data/lib/legion/data/auth_failure_handler.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require 'legion/logging/helper'
+
+module Legion
+  module Data
+    module AuthFailureHandler
+      extend Legion::Logging::Helper
+
+      AUTH_FAILURE_PATTERNS = [
+        /role .* does not exist/i,
+        /password authentication failed/i,
+        /authentication failed/i,
+        /no pg_hba\.conf entry/i,
+        /permission denied for table/i,
+        /permission denied for relation/i
+      ].freeze
+
+      REISSUE_COOLDOWN = 30
+
+      @last_reissue_at = nil
+      @mutex = Mutex.new
+
+      module SequelHook
+        def connect(server)
+          super
+        rescue StandardError => e
+          Legion::Data::AuthFailureHandler.handle(e)
+          raise
+        end
+
+        def raise_error(exception, opts = Sequel::OPTS)
+          Legion::Data::AuthFailureHandler.handle(exception)
+          super
+        end
+      end
+
+      class << self
+        def install(sequel_db)
+          sequel_db.singleton_class.prepend(SequelHook)
+        end
+
+        def handle(error)
+          return unless auth_failure?(error)
+          return if on_cooldown?
+
+          request_reissue(error)
+        end
+
+        def auth_failure?(error)
+          message = error.message.to_s
+          AUTH_FAILURE_PATTERNS.any? { |pattern| message.match?(pattern) }
+        end
+
+        def on_cooldown?
+          @mutex.synchronize do
+            return false unless @last_reissue_at
+
+            (Time.now - @last_reissue_at) < REISSUE_COOLDOWN
+          end
+        end
+
+        def request_reissue(error, adapter: :postgresql)
+          @mutex.synchronize { @last_reissue_at = Time.now }
+          log.error("Legion::Data auth failure detected: #{error.message} — requesting lease reissue")
+
+          return unless defined?(Legion::Crypt::LeaseManager)
+
+          Legion::Crypt::LeaseManager.instance.reissue_lease(adapter)
+        rescue StandardError => e
+          handle_exception(e, level: :error, handled: true, operation: :auth_failure_reissue)
+        end
+
+        def reset!
+          @mutex.synchronize { @last_reissue_at = nil }
+        end
+      end
+    end
+  end
+end

data/lib/legion/data/connection.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'legion/logging/helper'
+require 'legion/data/auth_failure_handler'
 
 require 'fileutils'
 require 'sequel'
@@ -10,6 +11,10 @@ module Legion
     module Connection
       ADAPTERS = %i[sqlite mysql2 postgres].freeze
 
+      UNRESOLVED_URI_PATTERN = %r{\A(?:vault|env|lease)://}
+
+      class UnresolvedCredentialError < StandardError; end
+
       GENERIC_KEYS = %i[max_connections pool_timeout preconnect single_threaded test name].freeze
 
       ADAPTER_KEYS = {
@@ -171,6 +176,9 @@ module Legion
                       attempted_adapter = adapter
                       begin
                         ::Sequel.connect(connection_opts_for(adapter: attempted_adapter, opts: opts))
+                      rescue UnresolvedCredentialError => e
+                        handle_exception(e, level: :fatal, handled: false, operation: :data_connect)
+                        raise
                       rescue StandardError => e
                         raise unless dev_fallback?
 
@@ -292,6 +300,7 @@ module Legion
           @sequel.opts[:password] = new_pass
 
           @sequel.disconnect
+          expire_all_pooled_connections
 
           @sequel.test_connection
           log.info("reconnect_with_fresh_creds: rotated credentials (#{old_user} → #{new_user})")
@@ -302,6 +311,16 @@ module Legion
           false
         end
 
+        def expire_all_pooled_connections
+          pool = @sequel.pool
+          return unless pool.instance_variable_defined?(:@connection_expiration_timestamps)
+
+          timestamps = pool.instance_variable_get(:@connection_expiration_timestamps)
+          timestamps.each_key { |conn| timestamps[conn] = [0, 0].freeze }
+        rescue StandardError => e
+          handle_exception(e, level: :warn, handled: true, operation: :expire_all_pooled_connections)
+        end
+
         def connect_with_replicas
           return unless adapter == :postgres
 
@@ -390,10 +409,22 @@ module Legion
             conn_host = actual[:host] || '127.0.0.1'
             conn_port = actual[:port]
             conn_db   = actual[:database] || actual[:db]
-            log.info "Connected to #{adapter}://#{conn_user}@#{conn_host}:#{conn_port}/#{conn_db}"
+            lease_id  = current_lease_id
+            msg = "Connected to #{adapter}://#{conn_user}@#{conn_host}:#{conn_port}/#{conn_db}"
+            msg += " lease_id=#{lease_id}" if lease_id
+            log.info msg
           end
         end
 
+        def current_lease_id
+          return unless defined?(Legion::Crypt::LeaseManager)
+
+          Legion::Crypt::LeaseManager.instance.active_leases.dig(:postgresql, :lease_id)
+        rescue StandardError => e
+          handle_exception(e, level: :warn, handled: true, operation: :current_lease_id)
+          nil
+        end
+
         def dev_fallback?
           data_settings = Legion::Settings[:data]
           data_settings[:dev_mode] == true && data_settings[:dev_fallback] != false
@@ -410,10 +441,23 @@ module Legion
 
         def connection_opts_for(adapter:, opts:)
           connection_opts = opts.merge(adapter: adapter, **creds_builder)
+          validate_no_unresolved_uris!(connection_opts)
           connection_opts[:preconnect] = false if adapter != :sqlite && dev_fallback?
           connection_opts
         end
 
+        def validate_no_unresolved_uris!(connection_opts)
+          %i[user username password].each do |key|
+            value = connection_opts[key]
+            next unless value.is_a?(String) && value.match?(UNRESOLVED_URI_PATTERN)
+
+            raise UnresolvedCredentialError,
+                  "Legion::Data cannot connect: settings[:data][:creds][:#{key}] is still " \
+                  "an unresolved URI placeholder (#{value}). The settings resolver failed to " \
+                  'resolve this lease — check that Legion::Crypt and Vault are available at boot.'
+          end
+        end
+
         def sequel_opts
           data = Legion::Settings[:data]
           opts = {}
@@ -588,10 +632,18 @@ module Legion
             @sequel.extension(:connection_expiration)
             @sequel.pool.connection_expiration_timeout = data[:connection_expiration_timeout]
           end
+
+          install_auth_failure_hook
         rescue StandardError => e
           handle_exception(e, level: :warn, handled: true, operation: :configure_extensions, adapter: adapter)
         end
 
+        def install_auth_failure_hook
+          Legion::Data::AuthFailureHandler.install(@sequel)
+        rescue StandardError => e
+          handle_exception(e, level: :warn, handled: true, operation: :install_auth_failure_hook)
+        end
+
         def build_data_logger
           tagged = if defined?(Legion::Logging::TaggedLogger) && respond_to?(:tagged_logger_settings, true)
                      Legion::Logging::TaggedLogger.new(

data/lib/legion/data/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Data
-    VERSION = '1.10.6'
+    VERSION = '1.10.8'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-data
 version: !ruby/object:Gem::Version
-  version: 1.10.6
+  version: 1.10.8
 platform: ruby
 authors:
 - Esity
@@ -124,6 +124,7 @@ files:
 - lib/legion/data/archiver.rb
 - lib/legion/data/audit_log_hash_chain.rb
 - lib/legion/data/audit_record.rb
+- lib/legion/data/auth_failure_handler.rb
 - lib/legion/data/connection.rb
 - lib/legion/data/encryption/cipher.rb
 - lib/legion/data/encryption/key_provider.rb