legion-data 1.10.7 → 1.10.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bc598e354968c28944d6e897feb5853d57987fed49eaf0cd16f319abcfbd8cf8
-  data.tar.gz: ebc17c4d4b8c49585bcdb0a49803c4988e8d55970ddde56b294746d810193f63
+  metadata.gz: 869153710ece6717285edf2de7483f4c9f5fe5b493837681b80d05b77b014971
+  data.tar.gz: 2813fd707f0f7a80858802046b7ba2a2f23611f94a1515c66e5c7a5db1771dd6
 SHA512:
-  metadata.gz: 7f36631ecd03c493fa2dfd3b347a4f16765b7900545d31306e4b73f0418a455a99c15ab55a8de83ad86c123befede09a222a67a6095f624923028c585ca9c7d0
-  data.tar.gz: 9a1783c655df6dce9c23a4a878645cf196e4463d0763d95c380029263a8deeccce7cfce8e66ede4843a04c68e8369232d8d4b785460bd70181d4ad1adcf1c01b
+  metadata.gz: 41aff7bbce675a95d8a2ec6683eb0350decde2cf66854971b0c43fed1d4a09bdc50563e922bfe29d5a01660c522d579be7f2719495150d136ba262f433ba4ac4
+  data.tar.gz: c766be4f0a13cf3ac3dc91e305d275742d5c49206ec90819631d05739137fb1c9eadbc550feeef1d6e635961ec8bf439b9b5fc19dfc334d1798859573d87902a

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Legion::Data Changelog
 
+## [1.10.8] - 2026-07-23
+### Fixed
+- Detect auth failures (`role does not exist`, `password authentication failed`) on Sequel pool connections and trigger immediate Vault lease reissue via LeaseManager instead of retrying dead credentials forever. 30-second cooldown prevents reissue storms during bulk credential rotation.
+
 ## [1.10.7] - 2026-07-15
 ### Fixed
 - Fail loud with actionable error when unresolved lease:// credentials reach connection

data/lib/legion/data/auth_failure_handler.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require 'legion/logging/helper'
+
+module Legion
+  module Data
+    module AuthFailureHandler
+      extend Legion::Logging::Helper
+
+      AUTH_FAILURE_PATTERNS = [
+        /role .* does not exist/i,
+        /password authentication failed/i,
+        /authentication failed/i,
+        /no pg_hba\.conf entry/i,
+        /permission denied for table/i,
+        /permission denied for relation/i
+      ].freeze
+
+      REISSUE_COOLDOWN = 30
+
+      @last_reissue_at = nil
+      @mutex = Mutex.new
+
+      module SequelHook
+        def connect(server)
+          super
+        rescue StandardError => e
+          Legion::Data::AuthFailureHandler.handle(e)
+          raise
+        end
+
+        def raise_error(exception, opts = Sequel::OPTS)
+          Legion::Data::AuthFailureHandler.handle(exception)
+          super
+        end
+      end
+
+      class << self
+        def install(sequel_db)
+          sequel_db.singleton_class.prepend(SequelHook)
+        end
+
+        def handle(error)
+          return unless auth_failure?(error)
+          return if on_cooldown?
+
+          request_reissue(error)
+        end
+
+        def auth_failure?(error)
+          message = error.message.to_s
+          AUTH_FAILURE_PATTERNS.any? { |pattern| message.match?(pattern) }
+        end
+
+        def on_cooldown?
+          @mutex.synchronize do
+            return false unless @last_reissue_at
+
+            (Time.now - @last_reissue_at) < REISSUE_COOLDOWN
+          end
+        end
+
+        def request_reissue(error, adapter: :postgresql)
+          @mutex.synchronize { @last_reissue_at = Time.now }
+          log.error("Legion::Data auth failure detected: #{error.message} — requesting lease reissue")
+
+          return unless defined?(Legion::Crypt::LeaseManager)
+
+          Legion::Crypt::LeaseManager.instance.reissue_lease(adapter)
+        rescue StandardError => e
+          handle_exception(e, level: :error, handled: true, operation: :auth_failure_reissue)
+        end
+
+        def reset!
+          @mutex.synchronize { @last_reissue_at = nil }
+        end
+      end
+    end
+  end
+end

data/lib/legion/data/connection.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'legion/logging/helper'
+require 'legion/data/auth_failure_handler'
 
 require 'fileutils'
 require 'sequel'
@@ -299,6 +300,7 @@ module Legion
           @sequel.opts[:password] = new_pass
 
           @sequel.disconnect
+          expire_all_pooled_connections
 
           @sequel.test_connection
           log.info("reconnect_with_fresh_creds: rotated credentials (#{old_user} → #{new_user})")
@@ -309,6 +311,16 @@ module Legion
           false
         end
 
+        def expire_all_pooled_connections
+          pool = @sequel.pool
+          return unless pool.instance_variable_defined?(:@connection_expiration_timestamps)
+
+          timestamps = pool.instance_variable_get(:@connection_expiration_timestamps)
+          timestamps.each_key { |conn| timestamps[conn] = [0, 0].freeze }
+        rescue StandardError => e
+          handle_exception(e, level: :warn, handled: true, operation: :expire_all_pooled_connections)
+        end
+
         def connect_with_replicas
           return unless adapter == :postgres
 
@@ -397,10 +409,22 @@ module Legion
             conn_host = actual[:host] || '127.0.0.1'
             conn_port = actual[:port]
             conn_db   = actual[:database] || actual[:db]
-            log.info "Connected to #{adapter}://#{conn_user}@#{conn_host}:#{conn_port}/#{conn_db}"
+            lease_id  = current_lease_id
+            msg = "Connected to #{adapter}://#{conn_user}@#{conn_host}:#{conn_port}/#{conn_db}"
+            msg += " lease_id=#{lease_id}" if lease_id
+            log.info msg
           end
         end
 
+        def current_lease_id
+          return unless defined?(Legion::Crypt::LeaseManager)
+
+          Legion::Crypt::LeaseManager.instance.active_leases.dig(:postgresql, :lease_id)
+        rescue StandardError => e
+          handle_exception(e, level: :warn, handled: true, operation: :current_lease_id)
+          nil
+        end
+
         def dev_fallback?
           data_settings = Legion::Settings[:data]
           data_settings[:dev_mode] == true && data_settings[:dev_fallback] != false
@@ -608,10 +632,18 @@ module Legion
             @sequel.extension(:connection_expiration)
             @sequel.pool.connection_expiration_timeout = data[:connection_expiration_timeout]
           end
+
+          install_auth_failure_hook
         rescue StandardError => e
           handle_exception(e, level: :warn, handled: true, operation: :configure_extensions, adapter: adapter)
         end
 
+        def install_auth_failure_hook
+          Legion::Data::AuthFailureHandler.install(@sequel)
+        rescue StandardError => e
+          handle_exception(e, level: :warn, handled: true, operation: :install_auth_failure_hook)
+        end
+
         def build_data_logger
           tagged = if defined?(Legion::Logging::TaggedLogger) && respond_to?(:tagged_logger_settings, true)
                      Legion::Logging::TaggedLogger.new(

data/lib/legion/data/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Data
-    VERSION = '1.10.7'
+    VERSION = '1.10.8'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-data
 version: !ruby/object:Gem::Version
-  version: 1.10.7
+  version: 1.10.8
 platform: ruby
 authors:
 - Esity
@@ -124,6 +124,7 @@ files:
 - lib/legion/data/archiver.rb
 - lib/legion/data/audit_log_hash_chain.rb
 - lib/legion/data/audit_record.rb
+- lib/legion/data/auth_failure_handler.rb
 - lib/legion/data/connection.rb
 - lib/legion/data/encryption/cipher.rb
 - lib/legion/data/encryption/key_provider.rb