legion-rbac 0.2.7 → 0.2.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 345f210c7e7263e7d484a6ff6122dd1d9ac7d5bd4e00e93303924c50394493c9
-  data.tar.gz: 424af65233d1f63374d173e979df6bc0deb2b987c31a84569ed02c1447d1f7ff
+  metadata.gz: db6027eb10e80db5c7fce237a53e1640036d4d30e73e2e468029054843df5c4f
+  data.tar.gz: dd520f3dc81753b13bb29bf41bd664bbb0acdd789697a50649f93f77c68d3655
 SHA512:
-  metadata.gz: 672e559fbe46910f934899fa75bed1283ebccc62534f503d59f0f4b190c282042daa82571f33312ec64ccf88c823a98a0a9d2bfa3e753646d2586d05b754b9aa
-  data.tar.gz: ba2da7a5ce8a08dc9aa5343e8bc711f672be4350b9b0617b1689631e6b0b66d81513dede28cde136a571660ab1082d02df0afb6b043f51809024adb94752a9f1
+  metadata.gz: e56a6e0e93987b829f04ca89c907753d893ec9d6907d7cf8f29d011b92b82906b249abac00fe3951142589b6ba8cbd8308fe0fd57b9d5974c708e00b744585f3
+  data.tar.gz: 5d47a2e7805ae8fcd242c1a7bcf2f916063adf8517831ec06b198f77c145b4734eaa9b36d4ce8450eebe17d5ff47c852abd8288ae9da9f6e115780f9bb152f45

data/.github/CODEOWNERS

@@ -0,0 +1,7 @@
+# Auto-generated from team-config.yml
+# Team: core
+#
+# To apply: scripts/apply-codeowners.sh legion-rbac
+
+* @LegionIO/maintainers
+* @LegionIO/core

data/.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: bundler
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - "type:dependencies"
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - "type:dependencies"

data/.github/workflows/ci.yml

@@ -3,14 +3,32 @@ on:
   push:
     branches: [main]
   pull_request:
+  schedule:
+    - cron: '0 9 * * 1'
 
 jobs:
   ci:
     uses: LegionIO/.github/.github/workflows/ci.yml@main
 
+  lint:
+    uses: LegionIO/.github/.github/workflows/lint-patterns.yml@main
+
+  security:
+    uses: LegionIO/.github/.github/workflows/security-scan.yml@main
+
+  version-changelog:
+    uses: LegionIO/.github/.github/workflows/version-changelog.yml@main
+
+  dependency-review:
+    uses: LegionIO/.github/.github/workflows/dependency-review.yml@main
+
+  stale:
+    if: github.event_name == 'schedule'
+    uses: LegionIO/.github/.github/workflows/stale.yml@main
+
   release:
-    needs: ci
+    needs: [ci, lint]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     uses: LegionIO/.github/.github/workflows/release.yml@main
     secrets:
-      rubygems-api-key: ${{ secrets.RUBYGEMS_API_KEY }}
+      rubygems-api-key: ${{ secrets.RUBYGEMS_API_KEY }}

data/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [0.2.9] - 2026-03-31
+
+### Added
+- `Legion::Rbac::CapabilityAudit` module: static analysis of extension source code to detect dangerous patterns (`system`, `exec`, `Open3`, backticks, `eval`, `Net::HTTP`, `Faraday`, `File.write`, `FileUtils`) and map them to required capabilities (`shell_execute`, `code_eval`, `network_outbound`, `filesystem_write`). Blocks extensions with undeclared capabilities in enforce mode, warns in warn mode. Configurable via `rbac.capability_audit` settings.
+- `Legion::Rbac::CapabilityAudit::AuditResult` value object with `blocked?`, `undeclared`, `detected_capabilities`, `declared_capabilities`, and `to_h` conversion.
+- `Legion::Rbac::CapabilityRegistry` module: thread-safe registry tracking which extensions have which capabilities. `register`, `for_extension`, `extensions_with`, `audit_result_for`, `all`, `registered?`, `clear!` methods.
+- `Legion::Rbac::PolicyEngine.evaluate_capability`: runtime RBAC gating for capabilities — checks if a principal's roles grant or deny a specific capability, with deny-always-wins semantics and dry-run support.
+- `Legion::Rbac::Role#capability_allowed?`: per-role capability check (denial takes precedence over grant).
+- `capability_grants` and `capability_denials` fields on all four built-in roles: admin (all granted), supervisor (shell + network + filesystem, code_eval denied), worker (network + filesystem, shell + eval denied), governance-observer (all denied).
+- `Legion::Rbac.audit_extension`: convenience method that audits an extension and registers it in the CapabilityRegistry.
+- `Legion::Rbac.authorize_capability!`: raises `AccessDenied` when a principal lacks the required capability.
+- `rbac.capability_audit` settings: `enabled` (default true), `mode` (enforce/warn), `undeclared_policy` (block).
+- 43 new specs (159 total) covering all three phases of the capability enforcement system.
+
+## [0.2.8] - 2026-03-28
+
+### Added
+- `Legion::Rbac::Routes` self-registering Sinatra route module (`lib/legion/rbac/routes.rb`): extracts all `/api/rbac/*` route handlers from LegionIO. Self-registers with `Legion::API.register_library_routes('rbac', Routes)` during boot. Includes fallback helpers for standalone mounting.
+
 ## [0.2.7] - 2026-03-22
 
 ### Changed

data/CLAUDE.md

@@ -2,7 +2,7 @@
 
 **Parent**: `/Users/miverso2/rubymine/legion/CLAUDE.md`
 **GitHub**: https://github.com/LegionIO/legion-rbac
-**Version**: 0.2.2
+**Version**: 0.2.7
 
 Optional RBAC gem for LegionIO. Vault-style flat policy model with deny-always-wins semantics.
 

data/Gemfile

@@ -9,5 +9,6 @@ group :test do
   gem 'rspec'
   gem 'rspec_junit_formatter'
   gem 'rubocop'
+  gem 'rubocop-legion'
   gem 'simplecov'
 end

data/README.md

@@ -2,7 +2,7 @@
 
 Role-based access control for LegionIO, following Vault-style flat policy patterns.
 
-**Version**: 0.2.2
+**Version**: 0.2.9
 
 ## Features
 
@@ -53,6 +53,36 @@ principal.profile       # => { first_name: "Jane", last_name: "Doe", ... }
 Legion::Rbac.authorize_execution!(principal: principal, runner_class: 'Legion::Extensions::LexHttp::Runners::Request', function: :get)
 ```
 
+### Capability Audit (Extension Security)
+
+Audit an extension's source code for dangerous patterns and enforce capability declarations:
+
+```ruby
+result = Legion::Rbac.audit_extension(
+  extension_name: 'lex-codegen',
+  source_path: '/path/to/lex-codegen/lib',
+  declared_capabilities: [:shell_execute, :filesystem_write]
+)
+result.blocked?               # => false (all capabilities declared)
+result.detected_capabilities  # => [:shell_execute, :filesystem_write]
+
+# Query the capability registry
+Legion::Rbac::CapabilityRegistry.for_extension('lex-codegen')
+# => [:filesystem_write, :shell_execute]
+
+Legion::Rbac::CapabilityRegistry.extensions_with(:shell_execute)
+# => ["lex-codegen", "lex-exec"]
+```
+
+### Capability Authorization
+
+Check if a principal's role allows a specific capability:
+
+```ruby
+Legion::Rbac.authorize_capability!(principal: principal, capability: :shell_execute, extension_name: 'lex-codegen')
+# Raises AccessDenied if the principal's role denies shell_execute
+```
+
 ### Dry-Run Check
 
 ```ruby

data/lib/legion/rbac/capability_audit.rb

@@ -0,0 +1,143 @@
+# frozen_string_literal: true
+
+module Legion
+  module Rbac
+    module CapabilityAudit
+      PATTERN_TO_CAPABILITY = {
+        /\bKernel\.system\b|\bsystem\s*\(/     => :shell_execute,
+        /\bKernel\.exec\b|\bexec\s*\(/         => :shell_execute,
+        /\bOpen3\b/                            => :shell_execute,
+        /`[^`]+`/                              => :shell_execute,
+        /\bIO\.popen\b/                        => :shell_execute,
+        /\bKernel\.eval\b|\beval\s*\(/         => :code_eval,
+        /\bNet::HTTP\b/                        => :network_outbound,
+        /\bFaraday\b/                          => :network_outbound,
+        /\bHTTParty\b/                         => :network_outbound,
+        /\bFile\.(write|open|delete|rename)\b/ => :filesystem_write,
+        /\bFileUtils\b/                        => :filesystem_write
+      }.freeze
+
+      class AuditResult
+        attr_reader :extension_name, :detected_capabilities, :declared_capabilities,
+                    :undeclared, :allowed, :reason
+
+        def initialize(extension_name:, detected:, declared:, allowed:, reason: nil)
+          @extension_name = extension_name
+          @detected_capabilities = detected.uniq.sort
+          @declared_capabilities = declared.map(&:to_sym).uniq.sort
+          @undeclared = (@detected_capabilities - @declared_capabilities).sort
+          @allowed = allowed
+          @reason = reason
+        end
+
+        def blocked?
+          !@allowed
+        end
+
+        def to_h
+          hash = {
+            extension_name:        @extension_name,
+            allowed:               @allowed,
+            detected_capabilities: @detected_capabilities,
+            declared_capabilities: @declared_capabilities,
+            undeclared:            @undeclared
+          }
+          hash[:reason] = @reason if @reason
+          hash
+        end
+      end
+
+      class << self
+        def audit(extension_name:, source_path:, declared_capabilities: [])
+          return skip_result(extension_name, 'capability audit disabled') unless enabled?
+
+          return skip_result(extension_name, 'no source path') unless source_path && Dir.exist?(source_path.to_s)
+
+          detected = scan_source(source_path)
+          declared_syms = Array(declared_capabilities).map(&:to_sym)
+          undeclared = (detected.uniq - declared_syms)
+
+          if undeclared.empty?
+            AuditResult.new(
+              extension_name: extension_name,
+              detected:       detected,
+              declared:       declared_syms,
+              allowed:        true
+            )
+          else
+            handle_undeclared(extension_name, detected, declared_syms, undeclared)
+          end
+        end
+
+        def enabled?
+          settings = capability_audit_settings
+          settings[:enabled] != false
+        end
+
+        def mode
+          settings = capability_audit_settings
+          (settings[:mode] || 'enforce').to_s
+        end
+
+        private
+
+        def scan_source(source_path)
+          capabilities = []
+          Dir.glob(File.join(source_path, '**', '*.rb')).each do |file|
+            File.foreach(file) do |line|
+              PATTERN_TO_CAPABILITY.each do |pattern, capability|
+                capabilities << capability if line.match?(pattern)
+              end
+            end
+          end
+          capabilities.uniq
+        end
+
+        def handle_undeclared(extension_name, detected, declared, undeclared)
+          if mode == 'warn'
+            log_warning(extension_name, undeclared)
+            AuditResult.new(
+              extension_name: extension_name,
+              detected:       detected,
+              declared:       declared,
+              allowed:        true,
+              reason:         "undeclared capabilities (warn mode): #{undeclared.join(', ')}"
+            )
+          else
+            AuditResult.new(
+              extension_name: extension_name,
+              detected:       detected,
+              declared:       declared,
+              allowed:        false,
+              reason:         "undeclared capabilities: #{undeclared.join(', ')}"
+            )
+          end
+        end
+
+        def log_warning(extension_name, undeclared)
+          return unless defined?(Legion::Logging)
+
+          Legion::Logging.warn(
+            "CapabilityAudit: #{extension_name} uses undeclared capabilities: #{undeclared.join(', ')}"
+          )
+        end
+
+        def skip_result(extension_name, reason)
+          AuditResult.new(
+            extension_name: extension_name,
+            detected:       [],
+            declared:       [],
+            allowed:        true,
+            reason:         reason
+          )
+        end
+
+        def capability_audit_settings
+          return {} unless defined?(Legion::Settings)
+
+          Legion::Settings[:rbac]&.dig(:capability_audit) || {}
+        end
+      end
+    end
+  end
+end

data/lib/legion/rbac/capability_registry.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+require 'monitor'
+
+module Legion
+  module Rbac
+    module CapabilityRegistry
+      class << self
+        def register(extension_name, capabilities:, audit_result: nil)
+          mon.synchronize do
+            entries[extension_name.to_s] = {
+              capabilities:  Array(capabilities).map(&:to_sym).uniq,
+              audit_result:  audit_result,
+              registered_at: Time.now
+            }
+          end
+        end
+
+        def for_extension(extension_name)
+          mon.synchronize do
+            entry = entries[extension_name.to_s]
+            entry ? entry[:capabilities] : []
+          end
+        end
+
+        def extensions_with(capability)
+          cap_sym = capability.to_sym
+          mon.synchronize do
+            entries.select { |_, entry| entry[:capabilities].include?(cap_sym) }.keys
+          end
+        end
+
+        def audit_result_for(extension_name)
+          mon.synchronize do
+            entry = entries[extension_name.to_s]
+            entry&.dig(:audit_result)
+          end
+        end
+
+        def all
+          mon.synchronize { entries.dup }
+        end
+
+        def registered?(extension_name)
+          mon.synchronize { entries.key?(extension_name.to_s) }
+        end
+
+        def clear!
+          mon.synchronize { @entries = {} }
+        end
+
+        private
+
+        def entries
+          @entries ||= {}
+        end
+
+        def mon
+          @mon ||= Monitor.new
+        end
+      end
+    end
+  end
+end

data/lib/legion/rbac/config_loader.rb

@@ -9,11 +9,13 @@ module Legion
         roles_config ||= Legion::Settings[:rbac][:roles]
         roles_config.each_with_object({}) do |(name, config), index|
           index[name.to_sym] = Role.new(
-            name:        name,
-            description: config[:description] || '',
-            permissions: config[:permissions] || [],
-            deny:        config[:deny] || [],
-            cross_team:  config[:cross_team] || false
+            name:               name,
+            description:        config[:description] || '',
+            permissions:        config[:permissions] || [],
+            deny:               config[:deny] || [],
+            cross_team:         config[:cross_team] || false,
+            capability_grants:  config[:capability_grants] || [],
+            capability_denials: config[:capability_denials] || []
           )
         end
       end

data/lib/legion/rbac/policy_engine.rb

@@ -49,6 +49,44 @@ module Legion
         end
       end
 
+      def self.evaluate_capability(principal:, capability:, extension_name: nil, role_index: nil, enforce: nil)
+        role_index ||= Legion::Rbac.role_index || {}
+        enforce = Legion::Settings[:rbac][:enforce] if enforce.nil?
+
+        resolved_roles = resolve_roles(principal, role_index)
+
+        if resolved_roles.empty?
+          return build_capability_result(
+            allowed: false, reason: 'no roles assigned',
+            principal: principal, capability: capability,
+            extension_name: extension_name, enforce: enforce
+          )
+        end
+
+        denied = resolved_roles.any? { |role| role.capability_denials.include?(capability.to_sym) }
+        if denied
+          return build_capability_result(
+            allowed: false, reason: "capability #{capability} denied by role policy",
+            principal: principal, capability: capability,
+            extension_name: extension_name, enforce: enforce
+          )
+        end
+
+        granted = resolved_roles.any? { |role| role.capability_grants.include?(capability.to_sym) }
+        unless granted
+          return build_capability_result(
+            allowed: false, reason: "capability #{capability} not granted by any role",
+            principal: principal, capability: capability,
+            extension_name: extension_name, enforce: enforce
+          )
+        end
+
+        build_capability_result(
+          allowed: true, principal: principal, capability: capability,
+          extension_name: extension_name, enforce: enforce
+        )
+      end
+
       def self.build_result(allowed:, principal:, action:, resource:, enforce:, reason: nil)
         result = {
           allowed:      enforce ? allowed : true,
@@ -60,6 +98,18 @@ module Legion
         result[:would_deny] = true if !enforce && !allowed
         result
       end
+
+      def self.build_capability_result(allowed:, principal:, capability:, enforce:, extension_name: nil, reason: nil)
+        result = {
+          allowed:      enforce ? allowed : true,
+          capability:   capability.to_s,
+          principal_id: principal.id
+        }
+        result[:extension_name] = extension_name if extension_name
+        result[:reason] = reason if reason
+        result[:would_deny] = true if !enforce && !allowed
+        result
+      end
     end
   end
 end

data/lib/legion/rbac/role.rb

@@ -5,9 +5,11 @@ require 'legion/rbac/permission'
 module Legion
   module Rbac
     class Role
-      attr_reader :name, :description, :permissions, :deny_rules, :cross_team
+      attr_reader :name, :description, :permissions, :deny_rules, :cross_team,
+                  :capability_grants, :capability_denials
 
-      def initialize(name:, description: '', permissions: [], deny: [], cross_team: false)
+      def initialize(name:, description: '', permissions: [], deny: [], cross_team: false,
+                     capability_grants: [], capability_denials: [])
         @name = name.to_s
         @description = description
         @permissions = permissions.map do |p|
@@ -17,11 +19,20 @@ module Legion
           DenyRule.new(resource_pattern: d[:resource], above_level: d[:above_level])
         end
         @cross_team = cross_team
+        @capability_grants = Array(capability_grants).map(&:to_sym)
+        @capability_denials = Array(capability_denials).map(&:to_sym)
       end
 
       def cross_team?
         @cross_team == true
       end
+
+      def capability_allowed?(capability)
+        cap = capability.to_sym
+        return false if @capability_denials.include?(cap)
+
+        @capability_grants.include?(cap)
+      end
     end
   end
 end

data/lib/legion/rbac/routes.rb

@@ -0,0 +1,260 @@
+# frozen_string_literal: true
+
+# Self-registering route module for legion-rbac.
+# All routes previously defined in LegionIO/lib/legion/api/rbac.rb now live here
+# and are mounted via Legion::API.register_library_routes when legion-rbac boots.
+#
+# LegionIO/lib/legion/api/rbac.rb is preserved for backward compatibility but guards
+# its registration with defined?(Legion::Rbac::Routes) so double-registration is avoided.
+
+module Legion
+  module Rbac
+    module Routes
+      def self.registered(app)
+        app.helpers do # rubocop:disable Metrics/BlockLength
+          unless method_defined?(:parse_request_body)
+            define_method(:parse_request_body) do
+              raw = request.body.read
+              return {} if raw.nil? || raw.empty?
+
+              begin
+                parsed = Legion::JSON.load(raw)
+              rescue StandardError
+                halt 400, { 'Content-Type' => 'application/json' },
+                     Legion::JSON.dump({ error: { code: 'invalid_json', message: 'request body is not valid JSON' } })
+              end
+
+              unless parsed.respond_to?(:transform_keys)
+                halt 400, { 'Content-Type' => 'application/json' },
+                     Legion::JSON.dump({ error: { code:    'invalid_request_body',
+                                                  message: 'request body must be a JSON object' } })
+              end
+
+              parsed.transform_keys(&:to_sym)
+            end
+          end
+
+          unless method_defined?(:json_response)
+            define_method(:json_response) do |data, status_code: 200|
+              content_type :json
+              status status_code
+              Legion::JSON.dump({ data: data })
+            end
+          end
+
+          unless method_defined?(:json_error)
+            define_method(:json_error) do |code, message, status_code: 400|
+              content_type :json
+              status status_code
+              Legion::JSON.dump({ error: { code: code, message: message } })
+            end
+          end
+
+          unless method_defined?(:json_collection)
+            define_method(:json_collection) do |dataset|
+              content_type :json
+              Legion::JSON.dump({ data: dataset.all.map(&:values) })
+            end
+          end
+
+          unless method_defined?(:current_owner_msid)
+            define_method(:current_owner_msid) do
+              env['legion.owner_msid']
+            end
+          end
+        end
+
+        register_roles(app)
+        register_check(app)
+        register_assignments(app)
+        register_grants(app)
+        register_cross_team_grants(app)
+      end
+
+      def self.register_roles(app)
+        app.get '/api/rbac/roles' do
+          return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
+
+          roles = Legion::Rbac.role_index.transform_values do |role|
+            { name: role.name, description: role.description, cross_team: role.cross_team? }
+          end
+          json_response(roles)
+        end
+
+        app.get '/api/rbac/roles/:name' do
+          return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
+
+          role = Legion::Rbac.role_index[params[:name].to_sym]
+          halt 404, json_error('not_found', "Role #{params[:name]} not found", status_code: 404) unless role
+
+          json_response({
+                          name:        role.name,
+                          description: role.description,
+                          cross_team:  role.cross_team?,
+                          permissions: role.permissions.map { |p| { resource: p.resource_pattern, actions: p.actions } },
+                          deny_rules:  role.deny_rules.map { |d| { resource: d.resource_pattern, above_level: d.above_level } }
+                        })
+        end
+      end
+
+      def self.register_check(app)
+        app.post '/api/rbac/check' do
+          Legion::Logging.debug "API: POST /api/rbac/check params=#{params.keys}" if defined?(Legion::Logging)
+          return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
+
+          body = parse_request_body
+          principal = Legion::Rbac::Principal.new(
+            id:    body[:principal] || 'anonymous',
+            roles: body[:roles] || [],
+            team:  body[:team]
+          )
+          result = Legion::Rbac::PolicyEngine.evaluate(
+            principal: principal,
+            action:    body[:action] || 'read',
+            resource:  body[:resource] || '*',
+            enforce:   false
+          )
+          json_response(result)
+        rescue StandardError => e
+          Legion::Logging.error "API POST /api/rbac/check: #{e.class} — #{e.message}" if defined?(Legion::Logging)
+          json_error('rbac_error', e.message, status_code: 500)
+        end
+      end
+
+      def self.register_assignments(app) # rubocop:disable Metrics/AbcSize,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
+        app.get '/api/rbac/assignments' do
+          return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
+          return json_error('db_unavailable', 'legion-data not connected', status_code: 503) unless Legion::Rbac::Store.db_available?
+
+          dataset = Legion::Data::Model::RbacRoleAssignment.order(:id)
+          dataset = dataset.where(team: params[:team]) if params[:team]
+          dataset = dataset.where(role: params[:role]) if params[:role]
+          dataset = dataset.where(principal_id: params[:principal]) if params[:principal]
+          json_collection(dataset)
+        end
+
+        app.post '/api/rbac/assignments' do
+          Legion::Logging.debug "API: POST /api/rbac/assignments params=#{params.keys}" if defined?(Legion::Logging)
+          return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
+          return json_error('db_unavailable', 'legion-data not connected', status_code: 503) unless Legion::Rbac::Store.db_available?
+
+          body = parse_request_body
+          record = Legion::Data::Model::RbacRoleAssignment.create(
+            principal_type: body[:principal_type] || 'human',
+            principal_id:   body[:principal_id],
+            role:           body[:role],
+            team:           body[:team],
+            granted_by:     current_owner_msid || 'api',
+            expires_at:     body[:expires_at] ? Time.parse(body[:expires_at]) : nil
+          )
+          Legion::Logging.info "API: created RBAC assignment #{record.id} role=#{body[:role]} principal=#{body[:principal_id]}" if defined?(Legion::Logging)
+          json_response(record.values, status_code: 201)
+        rescue Sequel::ValidationFailed => e
+          Legion::Logging.warn "API POST /api/rbac/assignments returned 422: #{e.message}" if defined?(Legion::Logging)
+          json_error('validation_error', e.message, status_code: 422)
+        end
+
+        app.delete '/api/rbac/assignments/:id' do
+          return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
+          return json_error('db_unavailable', 'legion-data not connected', status_code: 503) unless Legion::Rbac::Store.db_available?
+
+          record = Legion::Data::Model::RbacRoleAssignment[params[:id].to_i]
+          halt 404, json_error('not_found', 'Assignment not found', status_code: 404) unless record
+
+          record.destroy
+          Legion::Logging.info "API: deleted RBAC assignment #{params[:id]}" if defined?(Legion::Logging)
+          json_response({ deleted: true })
+        end
+      end
+
+      def self.register_grants(app)
+        app.get '/api/rbac/grants' do
+          return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
+          return json_error('db_unavailable', 'legion-data not connected', status_code: 503) unless Legion::Rbac::Store.db_available?
+
+          dataset = Legion::Data::Model::RbacRunnerGrant.order(:id)
+          dataset = dataset.where(team: params[:team]) if params[:team]
+          json_collection(dataset)
+        end
+
+        app.post '/api/rbac/grants' do
+          Legion::Logging.debug "API: POST /api/rbac/grants params=#{params.keys}" if defined?(Legion::Logging)
+          return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
+          return json_error('db_unavailable', 'legion-data not connected', status_code: 503) unless Legion::Rbac::Store.db_available?
+
+          body = parse_request_body
+          record = Legion::Data::Model::RbacRunnerGrant.create(
+            team:           body[:team],
+            runner_pattern: body[:runner_pattern],
+            actions:        Array(body[:actions]).join(','),
+            granted_by:     current_owner_msid || 'api'
+          )
+          Legion::Logging.info "API: created RBAC grant #{record.id} team=#{body[:team]} pattern=#{body[:runner_pattern]}" if defined?(Legion::Logging)
+          json_response(record.values, status_code: 201)
+        rescue Sequel::ValidationFailed => e
+          Legion::Logging.warn "API POST /api/rbac/grants returned 422: #{e.message}" if defined?(Legion::Logging)
+          json_error('validation_error', e.message, status_code: 422)
+        end
+
+        app.delete '/api/rbac/grants/:id' do
+          return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
+          return json_error('db_unavailable', 'legion-data not connected', status_code: 503) unless Legion::Rbac::Store.db_available?
+
+          record = Legion::Data::Model::RbacRunnerGrant[params[:id].to_i]
+          halt 404, json_error('not_found', 'Grant not found', status_code: 404) unless record
+
+          record.destroy
+          Legion::Logging.info "API: deleted RBAC grant #{params[:id]}" if defined?(Legion::Logging)
+          json_response({ deleted: true })
+        end
+      end
+
+      def self.register_cross_team_grants(app)
+        app.get '/api/rbac/grants/cross-team' do
+          return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
+          return json_error('db_unavailable', 'legion-data not connected', status_code: 503) unless Legion::Rbac::Store.db_available?
+
+          dataset = Legion::Data::Model::RbacCrossTeamGrant.order(:id)
+          json_collection(dataset)
+        end
+
+        app.post '/api/rbac/grants/cross-team' do
+          Legion::Logging.debug "API: POST /api/rbac/grants/cross-team params=#{params.keys}" if defined?(Legion::Logging)
+          return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
+          return json_error('db_unavailable', 'legion-data not connected', status_code: 503) unless Legion::Rbac::Store.db_available?
+
+          body = parse_request_body
+          record = Legion::Data::Model::RbacCrossTeamGrant.create(
+            source_team:    body[:source_team],
+            target_team:    body[:target_team],
+            runner_pattern: body[:runner_pattern],
+            actions:        Array(body[:actions]).join(','),
+            granted_by:     current_owner_msid || 'api',
+            expires_at:     body[:expires_at] ? Time.parse(body[:expires_at]) : nil
+          )
+          Legion::Logging.info "API: created cross-team RBAC grant #{record.id} #{body[:source_team]}->#{body[:target_team]}" if defined?(Legion::Logging)
+          json_response(record.values, status_code: 201)
+        rescue Sequel::ValidationFailed => e
+          Legion::Logging.warn "API POST /api/rbac/grants/cross-team returned 422: #{e.message}" if defined?(Legion::Logging)
+          json_error('validation_error', e.message, status_code: 422)
+        end
+
+        app.delete '/api/rbac/grants/cross-team/:id' do
+          return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
+          return json_error('db_unavailable', 'legion-data not connected', status_code: 503) unless Legion::Rbac::Store.db_available?
+
+          record = Legion::Data::Model::RbacCrossTeamGrant[params[:id].to_i]
+          halt 404, json_error('not_found', 'Grant not found', status_code: 404) unless record
+
+          record.destroy
+          Legion::Logging.info "API: deleted cross-team RBAC grant #{params[:id]}" if defined?(Legion::Logging)
+          json_response({ deleted: true })
+        end
+      end
+
+      class << self
+        private :register_roles, :register_check, :register_assignments, :register_grants, :register_cross_team_grants
+      end
+    end
+  end
+end

data/lib/legion/rbac/settings.rb

@@ -12,7 +12,16 @@ module Legion
           static_assignments: [],
           route_permissions:  {},
           roles:              default_roles,
-          entra:              entra_defaults
+          entra:              entra_defaults,
+          capability_audit:   capability_audit_defaults
+        }
+      end
+
+      def self.capability_audit_defaults
+        {
+          enabled:           true,
+          mode:              'enforce',
+          undeclared_policy: 'block'
         }
       end
 
@@ -41,25 +50,27 @@ module Legion
 
       def self.worker_role
         {
-          description: 'Execute assigned runners within team scope',
-          permissions: [
+          description:        'Execute assigned runners within team scope',
+          permissions:        [
             { resource: 'runners/*', actions: %w[execute] },
             { resource: 'tasks/*', actions: %w[read create] },
             { resource: 'schedules/*', actions: %w[read] },
             { resource: 'workers/self', actions: %w[read] }
           ],
-          deny:        [
+          deny:               [
             { resource: 'runners/lex-extinction/*' },
             { resource: 'runners/lex-governance/*' },
             { resource: 'workers/*/lifecycle' }
-          ]
+          ],
+          capability_grants:  %w[network_outbound filesystem_write],
+          capability_denials: %w[shell_execute code_eval]
         }
       end
 
       def self.supervisor_role
         {
-          description: 'Manage workers and schedules within team scope',
-          permissions: [
+          description:        'Manage workers and schedules within team scope',
+          permissions:        [
             { resource: 'runners/*', actions: %w[execute] },
             { resource: 'tasks/*', actions: %w[read create delete] },
             { resource: 'schedules/*', actions: %w[read create update delete] },
@@ -67,28 +78,32 @@ module Legion
             { resource: 'extensions/*', actions: %w[read] },
             { resource: 'events/*', actions: %w[read] }
           ],
-          deny:        [
+          deny:               [
             { resource: 'runners/lex-extinction/escalate', above_level: 2 },
             { resource: 'workers/*/lifecycle/terminated' }
-          ]
+          ],
+          capability_grants:  %w[network_outbound filesystem_write shell_execute],
+          capability_denials: %w[code_eval]
         }
       end
 
       def self.admin_role
         {
-          description: 'Full access, cross-team capability',
-          permissions: [
+          description:        'Full access, cross-team capability',
+          permissions:        [
             { resource: '*', actions: %w[read create update delete execute manage] }
           ],
-          deny:        [],
-          cross_team:  true
+          deny:               [],
+          cross_team:         true,
+          capability_grants:  %w[shell_execute code_eval network_outbound filesystem_write],
+          capability_denials: []
         }
       end
 
       def self.governance_observer_role
         {
-          description: 'Read-only visibility across all teams for audit and compliance',
-          permissions: [
+          description:        'Read-only visibility across all teams for audit and compliance',
+          permissions:        [
             { resource: 'workers/*', actions: %w[read] },
             { resource: 'tasks/*', actions: %w[read] },
             { resource: 'events/*', actions: %w[read] },
@@ -96,8 +111,10 @@ module Legion
             { resource: 'extensions/*', actions: %w[read] },
             { resource: 'runners/lex-governance/*', actions: %w[read execute] }
           ],
-          deny:        [],
-          cross_team:  true
+          deny:               [],
+          cross_team:         true,
+          capability_grants:  [],
+          capability_denials: %w[shell_execute code_eval network_outbound filesystem_write]
         }
       end
     end

data/lib/legion/rbac/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Rbac
-    VERSION = '0.2.7'
+    VERSION = '0.2.9'
   end
 end

data/lib/legion/rbac.rb

@@ -11,6 +11,9 @@ require 'legion/rbac/team_scope'
 require 'legion/rbac/store'
 require 'legion/rbac/entra_claims_mapper'
 require 'legion/rbac/middleware'
+require 'legion/rbac/routes'
+require 'legion/rbac/capability_audit'
+require 'legion/rbac/capability_registry'
 
 module Legion
   module Rbac
@@ -26,10 +29,20 @@ module Legion
     class << self
       attr_reader :role_index
 
+      def register_routes
+        return unless defined?(Legion::API) && Legion::API.respond_to?(:register_library_routes)
+
+        Legion::API.register_library_routes('rbac', Legion::Rbac::Routes)
+        Legion::Logging.debug 'Legion::Rbac routes registered with API' if defined?(Legion::Logging)
+      rescue StandardError => e
+        Legion::Logging.warn "Legion::Rbac route registration failed: #{e.message}" if defined?(Legion::Logging)
+      end
+
       def setup
         Legion::Settings.merge_settings(:rbac, Legion::Rbac::Settings.default)
         @role_index = ConfigLoader.load_roles
         Legion::Settings[:rbac][:connected] = true
+        register_routes
       end
 
       def shutdown
@@ -49,6 +62,31 @@ module Legion
         authorize!(principal: principal, action: :execute, resource: runner_path, **)
       end
 
+      def audit_extension(extension_name:, source_path:, declared_capabilities: [])
+        result = CapabilityAudit.audit(
+          extension_name:        extension_name,
+          source_path:           source_path,
+          declared_capabilities: declared_capabilities
+        )
+        CapabilityRegistry.register(
+          extension_name,
+          capabilities: result.detected_capabilities,
+          audit_result: result
+        )
+        result
+      end
+
+      def authorize_capability!(principal:, capability:, extension_name: nil)
+        result = PolicyEngine.evaluate_capability(
+          principal:      principal,
+          capability:     capability,
+          extension_name: extension_name
+        )
+        raise AccessDenied, result unless result[:allowed]
+
+        result
+      end
+
       private
 
       def build_runner_path(runner_class, function)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-rbac
 version: !ruby/object:Gem::Version
-  version: 0.2.7
+  version: 0.2.9
 platform: ruby
 authors:
 - Esity
@@ -47,6 +47,8 @@ extra_rdoc_files:
 - LICENSE
 - README.md
 files:
+- ".github/CODEOWNERS"
+- ".github/dependabot.yml"
 - ".github/workflows/ci.yml"
 - ".gitignore"
 - ".rspec"
@@ -59,6 +61,8 @@ files:
 - docs/implementation-plan.md
 - legion-rbac.gemspec
 - lib/legion/rbac.rb
+- lib/legion/rbac/capability_audit.rb
+- lib/legion/rbac/capability_registry.rb
 - lib/legion/rbac/config_loader.rb
 - lib/legion/rbac/entra_claims_mapper.rb
 - lib/legion/rbac/kerberos_claims_mapper.rb
@@ -67,6 +71,7 @@ files:
 - lib/legion/rbac/policy_engine.rb
 - lib/legion/rbac/principal.rb
 - lib/legion/rbac/role.rb
+- lib/legion/rbac/routes.rb
 - lib/legion/rbac/settings.rb
 - lib/legion/rbac/store.rb
 - lib/legion/rbac/team_scope.rb