legion-data 1.8.7 → 1.8.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c024ef1b3721cb1e28074204ecd06a6a5328f62893a3e9a8b835567d43e58db5
-  data.tar.gz: 26a90ff875dcf1068a8137fad8df8a0dde139103ac3068579c04ceec0dea410e
+  metadata.gz: 60b8f26149494282c49455aedc216eebf0db867fa359dea9404ca44d09ad9815
+  data.tar.gz: 4da8dfdb277d9ceda6807543f58c2804ae71f938056cff7f8bcd366c4bad9cae
 SHA512:
-  metadata.gz: 850e2cd3ee92c2a79156d0075b083bb88a4a4fc68ae6fb855ed12841034f406f7aa2a036e362522c2053473a42610afcf7f3cec10993996e530f31002f1c39d0
-  data.tar.gz: e28a09cc87139ab4e703845248651f6f2d0677a98173b99f25085ec69d196b2d4d059da42b847c3d950da6f86462fdb981eb750a5b60fe3bf7e4cfcf02c95f38
+  metadata.gz: ef647d212100c659d28847879153403ac1dd42c55c0cb9b1529fd1e17d73f029a912d23988f6701e59e4b25d326b8512cd89f0291bcc52a9e492e6fd4c85b055
+  data.tar.gz: '018844cceb163d4100cffcfa8ea1ed06b916889ca14111e9ca8398d9c3d2a045c9e9c4d73f735e8c22f681ccc834c23f732d08d68303973251c60085f5013c1b'

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Legion::Data Changelog
 
+## [1.8.8] - 2026-05-20
+
+### Added
+- `Legion::Data::Connection.reconnect_with_fresh_creds` — updates Sequel's internal connection opts with fresh credentials from `Legion::Settings[:data][:creds]` and reconnects the pool. Called by `LeaseManager#trigger_postgresql_reconnect` after Vault dynamic PostgreSQL lease rotation.
+
+### Fixed
+- Vault dynamic PostgreSQL credential rotation: after lease expiry, connections would fail with `PG::ConnectionBad: role "v-legionio-node-..." does not exist` because Sequel retained the original (revoked) credentials in `@opts`. The legacy fallback (`disconnect` + `test_connection`) was insufficient since it doesn't update stored credentials.
+
 ## [1.8.7] - 2026-05-17
 
 ### Added

data/lib/legion/data/connection.rb

@@ -267,6 +267,36 @@ module Legion
           log.info 'Legion::Data connection closed'
         end
 
+        def reconnect_with_fresh_creds
+          return false unless @sequel
+          return false if adapter == :sqlite
+
+          fresh_creds = Legion::Settings[:data][:creds]
+          return false unless fresh_creds.is_a?(Hash)
+
+          new_user = fresh_creds[:user] || fresh_creds[:username]
+          new_pass = fresh_creds[:password]
+
+          unless new_user && new_pass
+            log.error('reconnect_with_fresh_creds: no user/password in Settings[:data][:creds]')
+            return false
+          end
+
+          old_user = @sequel.opts[:user]
+          @sequel.opts[:user] = new_user
+          @sequel.opts[:password] = new_pass
+
+          @sequel.disconnect
+
+          @sequel.test_connection
+          log.info("reconnect_with_fresh_creds: rotated credentials (#{old_user} → #{new_user})")
+          true
+        rescue StandardError => e
+          handle_exception(e, level: :error, handled: true, operation: :reconnect_with_fresh_creds,
+                           old_user: old_user, new_user: new_user)
+          false
+        end
+
         def connect_with_replicas
           return unless adapter == :postgres
 

data/lib/legion/data/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Data
-    VERSION = '1.8.7'
+    VERSION = '1.8.8'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-data
 version: !ruby/object:Gem::Version
-  version: 1.8.7
+  version: 1.8.8
 platform: ruby
 authors:
 - Esity