legion-rbac 0.3.0 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 222914812dd7014e897e4aa3a6311ea7b4e8062c74ad1c532774f2f3c9e06fca
-  data.tar.gz: 30b265cf04e23b6456f839d5aeeeb47792751d3580f92b2085709b9f786388b5
+  metadata.gz: 6971b76fa8052ff121e686629a6abcf800d6819afbffe4fc0adcf146f9b00b1d
+  data.tar.gz: 97c808593590d1416dc799b3711fa0353d86f55307c16b71cde4ab5e704a093c
 SHA512:
-  metadata.gz: 5e9e541ca68dffe258a0766c0dbf58069faf39475ca94db674f38b8d33430dc04a14bf75b360ce1dc72807361a7d67f9bfff558541e3287ddf51a7325bf0a416
-  data.tar.gz: c327b53c9b782f461fc163aef47118c075f3367b9aa60585080faab7ebdf43c57092e580c86ea454a22c0ed5ecbd298a3027c442cc327988edd2dfe812047cb9
+  metadata.gz: e6ef4dce9750b6de9544a49f12df5311f3a312a35ee46c89465f724b5ea0d02822bd9a8c23954665df498985a143913c4012f83401e8b0b12f776fd71e624eb2
+  data.tar.gz: 97bb68fae5dc33ac682461a12ef626ec8e5e392250ef11391381a9ad3212f587385648dcda982f6bcf2d9fc2bb601cdde9d699b58924da8bf4f7c73950164f54

data/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [0.3.2] - 2026-04-08
+
+### Added
+- `client_id: nil` default added to Entra settings block for explicit Azure AD app registration tracking
+
+## [0.3.1] - 2026-04-03
+
+### Fixed
+- `authorize!` and `authorize_execution!` now early-return when `rbac.enabled: false`, preventing NameError on missing RBAC models
+- `authorize!` and `authorize_execution!` respect `rbac.enforce: false` — logs denials but does not raise AccessDenied
+- `Store.db_available?` now also checks that `RbacRoleAssignment` model constant is defined before attempting DB queries
+
 ## [0.3.0] - 2026-04-02
 
 ### Changed

data/CLAUDE.md

@@ -2,7 +2,7 @@
 
 **Parent**: `/Users/miverso2/rubymine/legion/CLAUDE.md`
 **GitHub**: https://github.com/LegionIO/legion-rbac
-**Version**: 0.2.7
+**Version**: 0.3.2
 
 Optional RBAC gem for LegionIO. Vault-style flat policy model with deny-always-wins semantics.
 
@@ -29,6 +29,9 @@ lib/legion/rbac/policy_engine.rb # Core evaluator
 lib/legion/rbac/team_scope.rb   # Cross-team access validation
 lib/legion/rbac/store.rb        # Dual-mode data access
 lib/legion/rbac/middleware.rb              # Rack middleware
+lib/legion/rbac/routes.rb                 # Sinatra REST API routes for RBAC management
+lib/legion/rbac/capability_registry.rb    # Per-extension capability declarations and querying
+lib/legion/rbac/capability_audit.rb       # Source code scanning for dangerous patterns; enforces declared capabilities
 lib/legion/rbac/entra_claims_mapper.rb    # Entra ID claims -> Legion roles
 lib/legion/rbac/kerberos_claims_mapper.rb # Kerberos principal + AD groups -> Legion roles
 ```

data/README.md

@@ -2,7 +2,7 @@
 
 Role-based access control for LegionIO, following Vault-style flat policy patterns.
 
-**Version**: 0.2.9
+**Version**: 0.3.2
 
 ## Features
 

data/lib/legion/rbac/settings.rb

@@ -47,6 +47,7 @@ module Legion
         log.debug('RBAC Entra defaults requested')
         {
           tenant_id:    nil,
+          client_id:    nil,
           role_map:     {
             'Legion.Admin'      => 'admin',
             'Legion.Supervisor' => 'supervisor',

data/lib/legion/rbac/store.rb

@@ -9,7 +9,9 @@ module Legion
 
       class << self
         def db_available?
-          available = defined?(Legion::Data) ? Legion::Settings[:data]&.dig(:connected) == true : false
+          available = (defined?(Legion::Data) &&
+                      Legion::Settings[:data]&.dig(:connected) == true &&
+                      defined?(Legion::Data::Model::RbacRoleAssignment)) || false
           log.debug("RBAC store db_available=#{available}")
           available
         end

data/lib/legion/rbac/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Rbac
-    VERSION = '0.3.0'
+    VERSION = '0.3.2'
   end
 end

data/lib/legion/rbac.rb

@@ -78,6 +78,12 @@ module Legion
         Legion::Settings[:rbac]&.fetch(:enabled, true) != false
       end
 
+      def enforcing?
+        return true unless defined?(Legion::Settings)
+
+        Legion::Settings[:rbac]&.fetch(:enforce, true) != false
+      end
+
       def events_enabled?
         return false unless defined?(Legion::Events)
         return false unless defined?(Legion::Settings)
@@ -88,15 +94,22 @@ module Legion
       end
 
       def authorize!(principal:, action:, resource:, **)
+        return { allowed: true, reason: 'rbac disabled' } unless enabled?
+
         result = PolicyEngine.evaluate(principal: principal, action: action, resource: resource, **)
         log.info("RBAC authorize principal=#{principal.id} action=#{action} resource=#{resource} allowed=#{result[:allowed]}")
-        log.warn("RBAC authorize denied principal=#{principal.id} reason=#{result[:reason]}") unless result[:allowed]
-        raise AccessDenied, result unless result[:allowed]
+
+        unless result[:allowed]
+          log.warn("RBAC authorize denied principal=#{principal.id} reason=#{result[:reason]}")
+          raise AccessDenied, result if enforcing?
+        end
 
         result
       end
 
       def authorize_execution!(principal:, runner_class:, function:, target_team: nil, **)
+        return { allowed: true, reason: 'rbac disabled' } unless enabled?
+
         runner_path = build_runner_path(runner_class, function)
         log.info(
           "RBAC authorize_execution principal=#{principal.id} runner=#{runner_path} " \
@@ -109,8 +122,11 @@ module Legion
           target_team: target_team,
           **
         )
-        log.warn("RBAC authorize_execution denied principal=#{principal.id} reason=#{result[:reason]}") unless result[:allowed]
-        raise AccessDenied, result unless result[:allowed]
+
+        unless result[:allowed]
+          log.warn("RBAC authorize_execution denied principal=#{principal.id} reason=#{result[:reason]}")
+          raise AccessDenied, result if enforcing?
+        end
 
         result
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-rbac
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.2
 platform: ruby
 authors:
 - Esity