legion-rbac 0.3.2 → 0.3.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6971b76fa8052ff121e686629a6abcf800d6819afbffe4fc0adcf146f9b00b1d
-  data.tar.gz: 97c808593590d1416dc799b3711fa0353d86f55307c16b71cde4ab5e704a093c
+  metadata.gz: edda9eb7ccd62c65b56a7a5cb8238553bf71eee38854090d5013a307f14072c7
+  data.tar.gz: 51d314a59df53ba27de952d355255829d6b8b3079980ad438094e72c323f1ce2
 SHA512:
-  metadata.gz: e6ef4dce9750b6de9544a49f12df5311f3a312a35ee46c89465f724b5ea0d02822bd9a8c23954665df498985a143913c4012f83401e8b0b12f776fd71e624eb2
-  data.tar.gz: 97bb68fae5dc33ac682461a12ef626ec8e5e392250ef11391381a9ad3212f587385648dcda982f6bcf2d9fc2bb601cdde9d699b58924da8bf4f7c73950164f54
+  metadata.gz: 5160cd7e44e30646efe4cbbb7de37598db334adbc9c4c26a55071146df85871743744da9e5ece3c9980a1dfe0ab7069dd968532bb56ded5b914f9b3ceef25300
+  data.tar.gz: 69d5006b1aaedbea32bacda5b4a071d79c3eac0090f62e66f095789d12f7310a956f92e9ba8ef3641673b4346a207a0e587650a27091b50d3bca785592a5cebc

data/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [0.3.4] - 2026-05-09
+
+### Removed
+- Unnecessary `defined?(Legion::Logging)` guards from route handlers — legion-logging is a hard gemspec dependency and always available
+
+## [0.3.3] - 2026-04-08
+
+### Added
+- `GroupRoleMapper` module: resolves RBAC roles from identity group memberships via exact-string `group_role_map` lookup; `enrich_principal` additive role enrichment; gated behind `Legion::Rbac.enabled?`
+- `group_role_map: {}` default added to `Settings.default` for Phase 7 configuration surface
+
+### Changed
+- RBAC middleware audit mode fix: `enabled=false` now full-bypasses (unchanged); `enabled=true, enforce=false` now runs `PolicyEngine` in dry-run mode and logs `[RBAC audit] would_deny` for any policy-denied request instead of bypassing entirely
+- Middleware principal resolution now reads `env['legion.rbac_principal']` first, falling back to `env['legion.principal']`, bridging Phase 7 Identity middleware handoff
+- Removed dead private `enforce?` method from middleware; callers now use `Legion::Rbac.enabled?` and `Legion::Rbac.enforcing?` directly to eliminate parallel implementations
+
 ## [0.3.2] - 2026-04-08
 
 ### Added

data/lib/legion/rbac/group_role_mapper.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module Legion
+  module Rbac
+    module GroupRoleMapper
+      # Resolve RBAC roles from group memberships using a configurable map.
+      #
+      # @param groups [Array<String>] group names or OIDs from identity provider
+      # @param group_role_map [Hash, nil] { group_name => role_name }; reads default_map when nil
+      # @return [Array<String>] resolved role names (may be empty)
+      #
+      # NOTE: v1 supports exact string match only. Regexp keys in group_role_map are NOT supported —
+      # JSON settings cannot represent Regexp objects. All map keys are compared via `to_s == to_s`.
+      # Pattern matching is deferred to Phase 9.
+      def self.resolve_roles(groups:, group_role_map: nil)
+        return [] unless Legion::Rbac.enabled?
+
+        map = group_role_map || default_map
+        return [] if groups.nil? || groups.empty? || map.empty?
+
+        normalized_map = {}
+        map.each do |key, role|
+          normalized_map[key.to_s] = role.to_s
+        end
+
+        roles = Set.new
+        groups.each do |group|
+          role = normalized_map[group.to_s]
+          roles << role if role
+        end
+        roles.to_a
+      end
+
+      # Enrich an RBAC principal hash with group-derived roles (additive, never removes).
+      #
+      # @param principal [Hash] from Identity::Request#to_rbac_principal
+      # @param groups [Array<String>] from identity provider
+      # @return [Hash] principal with :roles enriched
+      def self.enrich_principal(principal:, groups:)
+        return principal unless Legion::Rbac.enabled?
+
+        additional_roles = resolve_roles(groups: groups)
+        return principal if additional_roles.empty?
+
+        existing_roles = principal[:roles] || []
+        principal.merge(roles: (existing_roles + additional_roles).uniq)
+      end
+
+      def self.default_map
+        return {} unless defined?(Legion::Settings)
+
+        rbac_settings = Legion::Settings[:rbac]
+        rbac_settings&.dig(:group_role_map) || {}
+      end
+
+      private_class_method :default_map
+    end
+  end
+end

data/lib/legion/rbac/middleware.rb

@@ -47,47 +47,19 @@ module Legion
       end
 
       def call(env)
-        return @app.call(env) unless enforce?
+        return @app.call(env) unless Legion::Rbac.enabled?
 
         path = env['PATH_INFO']
-        if skip_path?(path)
-          log.debug("RBAC middleware bypass path=#{path} reason=skip_path")
-          return @app.call(env)
-        end
-        if invoke_route?(path)
-          log.debug("RBAC middleware bypass path=#{path} reason=invoke_route")
-          return @app.call(env)
-        end
+        return bypass(env, path, :skip_path) if skip_path?(path)
+        return bypass(env, path, :invoke_route) if invoke_route?(path)
 
-        principal = env['legion.principal']
-        unless principal
-          log.warn("RBAC middleware denied method=#{env['REQUEST_METHOD']} path=#{path} reason=unauthenticated")
-          return denied_response('unauthenticated')
-        end
+        principal = env['legion.rbac_principal'] || env['legion.principal']
+        return guard_missing(env, path, 'unauthenticated') unless principal
 
         perm = find_permission(env['REQUEST_METHOD'], path)
-        unless perm
-          log.warn("RBAC middleware denied method=#{env['REQUEST_METHOD']} path=#{path} reason=unmapped_route")
-          return denied_response('unmapped route')
-        end
-        perm = effective_permission(env, perm)
-        result = policy_result(env, principal, perm)
+        return guard_missing(env, path, 'unmapped route') unless perm
 
-        if result[:allowed]
-          log.info(
-            "RBAC middleware allowed principal=#{principal.id} method=#{env['REQUEST_METHOD']} " \
-            "path=#{path} resource=#{perm[:resource]} action=#{perm[:action]} " \
-            "target_team=#{env['legion.rbac.target_team'] || 'none'}"
-          )
-          @app.call(env)
-        else
-          log.warn(
-            "RBAC middleware denied principal=#{principal.id} method=#{env['REQUEST_METHOD']} " \
-            "path=#{path} resource=#{perm[:resource]} action=#{perm[:action]} " \
-            "target_team=#{env['legion.rbac.target_team'] || 'none'} reason=#{result[:reason]}"
-          )
-          denied_response(result[:reason])
-        end
+        dispatch_policy(env, principal, effective_permission(env, perm))
       rescue StandardError => e
         handle_exception(
           e,
@@ -128,14 +100,52 @@ module Legion
         nil
       end
 
-      def enforce?
-        return false unless defined?(Legion::Settings)
-        return false if Legion::Settings[:rbac]&.fetch(:enabled, true) == false
+      def bypass(env, path, reason)
+        log.debug("RBAC middleware bypass path=#{path} reason=#{reason}")
+        @app.call(env)
+      end
 
-        Legion::Settings[:rbac][:enforce]
-      rescue StandardError => e
-        handle_exception(e, level: :warn, operation: 'rbac.middleware.enforce')
-        true
+      def guard_missing(env, path, reason)
+        if Legion::Rbac.enforcing?
+          log.warn("RBAC middleware denied method=#{env['REQUEST_METHOD']} path=#{path} reason=#{reason.tr(' ', '_')}")
+          denied_response(reason)
+        else
+          audit_and_proceed(env, reason)
+        end
+      end
+
+      def dispatch_policy(env, principal, perm)
+        result = policy_result(env, principal, perm)
+        path = env['PATH_INFO']
+
+        if result[:would_deny]
+          log.info(
+            "[RBAC audit] would_deny: #{result[:reason]} principal=#{result[:principal_id]} " \
+            "action=#{result[:action]} resource=#{result[:resource]}"
+          )
+          @app.call(env)
+        elsif result[:allowed]
+          log.info(
+            "RBAC middleware allowed principal=#{principal.id} method=#{env['REQUEST_METHOD']} " \
+            "path=#{path} resource=#{perm[:resource]} action=#{perm[:action]} " \
+            "target_team=#{env['legion.rbac.target_team'] || 'none'}"
+          )
+          @app.call(env)
+        else
+          log.warn(
+            "RBAC middleware denied principal=#{principal.id} method=#{env['REQUEST_METHOD']} " \
+            "path=#{path} resource=#{perm[:resource]} action=#{perm[:action]} " \
+            "target_team=#{env['legion.rbac.target_team'] || 'none'} reason=#{result[:reason]}"
+          )
+          denied_response(result[:reason])
+        end
+      end
+
+      def audit_and_proceed(env, reason)
+        log.info(
+          "[RBAC audit] would_deny: #{reason} method=#{env['REQUEST_METHOD']} path=#{env['PATH_INFO']}"
+        )
+        @app.call(env)
       end
 
       def denied_response(reason)

data/lib/legion/rbac/routes.rb

@@ -146,7 +146,7 @@ module Legion
 
       def self.register_check(app)
         app.post '/api/rbac/check' do
-          Legion::Logging.debug "API: POST /api/rbac/check params=#{params.keys}" if defined?(Legion::Logging)
+          Legion::Logging.debug "API: POST /api/rbac/check params=#{params.keys}"
           return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
 
           body = parse_request_body
@@ -163,12 +163,12 @@ module Legion
           )
           json_response(result)
         rescue StandardError => e
-          Legion::Logging.error "API POST /api/rbac/check: #{e.class} — #{e.message}" if defined?(Legion::Logging)
+          Legion::Logging.error "API POST /api/rbac/check: #{e.class} — #{e.message}"
           json_error('rbac_error', e.message, status_code: 500)
         end
       end
 
-      def self.register_assignments(app) # rubocop:disable Metrics/AbcSize,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
+      def self.register_assignments(app) # rubocop:disable Metrics/AbcSize
         app.get '/api/rbac/assignments' do
           return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
           return json_error('db_unavailable', 'legion-data not connected', status_code: 503) unless Legion::Rbac::Store.db_available?
@@ -181,7 +181,7 @@ module Legion
         end
 
         app.post '/api/rbac/assignments' do
-          Legion::Logging.debug "API: POST /api/rbac/assignments params=#{params.keys}" if defined?(Legion::Logging)
+          Legion::Logging.debug "API: POST /api/rbac/assignments params=#{params.keys}"
           return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
           return json_error('db_unavailable', 'legion-data not connected', status_code: 503) unless Legion::Rbac::Store.db_available?
 
@@ -194,13 +194,13 @@ module Legion
             granted_by:     current_owner_msid || 'api',
             expires_at:     parse_optional_time(body[:expires_at], field: 'expires_at')
           )
-          Legion::Logging.info "API: created RBAC assignment #{record.id} role=#{body[:role]} principal=#{body[:principal_id]}" if defined?(Legion::Logging)
+          Legion::Logging.info "API: created RBAC assignment #{record.id} role=#{body[:role]} principal=#{body[:principal_id]}"
           emit_rbac_policy_changed('assignment.created', 'role_assignment', record.values)
           json_response(record.values, status_code: 201)
         rescue Legion::Rbac::Routes::InvalidTimestamp => e
           json_error('validation_error', e.message, status_code: 422)
         rescue Sequel::ValidationFailed => e
-          Legion::Logging.warn "API POST /api/rbac/assignments returned 422: #{e.message}" if defined?(Legion::Logging)
+          Legion::Logging.warn "API POST /api/rbac/assignments returned 422: #{e.message}"
           json_error('validation_error', e.message, status_code: 422)
         end
 
@@ -213,7 +213,7 @@ module Legion
 
           snapshot = record.values.dup
           record.destroy
-          Legion::Logging.info "API: deleted RBAC assignment #{params[:id]}" if defined?(Legion::Logging)
+          Legion::Logging.info "API: deleted RBAC assignment #{params[:id]}"
           emit_rbac_policy_changed('assignment.deleted', 'role_assignment', snapshot)
           json_response({ deleted: true })
         end
@@ -230,7 +230,7 @@ module Legion
         end
 
         app.post '/api/rbac/grants' do
-          Legion::Logging.debug "API: POST /api/rbac/grants params=#{params.keys}" if defined?(Legion::Logging)
+          Legion::Logging.debug "API: POST /api/rbac/grants params=#{params.keys}"
           return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
           return json_error('db_unavailable', 'legion-data not connected', status_code: 503) unless Legion::Rbac::Store.db_available?
 
@@ -241,11 +241,11 @@ module Legion
             actions:        Array(body[:actions]).join(','),
             granted_by:     current_owner_msid || 'api'
           )
-          Legion::Logging.info "API: created RBAC grant #{record.id} team=#{body[:team]} pattern=#{body[:runner_pattern]}" if defined?(Legion::Logging)
+          Legion::Logging.info "API: created RBAC grant #{record.id} team=#{body[:team]} pattern=#{body[:runner_pattern]}"
           emit_rbac_policy_changed('runner_grant.created', 'runner_grant', record.values)
           json_response(record.values, status_code: 201)
         rescue Sequel::ValidationFailed => e
-          Legion::Logging.warn "API POST /api/rbac/grants returned 422: #{e.message}" if defined?(Legion::Logging)
+          Legion::Logging.warn "API POST /api/rbac/grants returned 422: #{e.message}"
           json_error('validation_error', e.message, status_code: 422)
         end
 
@@ -258,7 +258,7 @@ module Legion
 
           snapshot = record.values.dup
           record.destroy
-          Legion::Logging.info "API: deleted RBAC grant #{params[:id]}" if defined?(Legion::Logging)
+          Legion::Logging.info "API: deleted RBAC grant #{params[:id]}"
           emit_rbac_policy_changed('runner_grant.deleted', 'runner_grant', snapshot)
           json_response({ deleted: true })
         end
@@ -274,7 +274,7 @@ module Legion
         end
 
         app.post '/api/rbac/grants/cross-team' do
-          Legion::Logging.debug "API: POST /api/rbac/grants/cross-team params=#{params.keys}" if defined?(Legion::Logging)
+          Legion::Logging.debug "API: POST /api/rbac/grants/cross-team params=#{params.keys}"
           return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
           return json_error('db_unavailable', 'legion-data not connected', status_code: 503) unless Legion::Rbac::Store.db_available?
 
@@ -287,13 +287,13 @@ module Legion
             granted_by:     current_owner_msid || 'api',
             expires_at:     parse_optional_time(body[:expires_at], field: 'expires_at')
           )
-          Legion::Logging.info "API: created cross-team RBAC grant #{record.id} #{body[:source_team]}->#{body[:target_team]}" if defined?(Legion::Logging)
+          Legion::Logging.info "API: created cross-team RBAC grant #{record.id} #{body[:source_team]}->#{body[:target_team]}"
           emit_rbac_policy_changed('cross_team_grant.created', 'cross_team_grant', record.values)
           json_response(record.values, status_code: 201)
         rescue Legion::Rbac::Routes::InvalidTimestamp => e
           json_error('validation_error', e.message, status_code: 422)
         rescue Sequel::ValidationFailed => e
-          Legion::Logging.warn "API POST /api/rbac/grants/cross-team returned 422: #{e.message}" if defined?(Legion::Logging)
+          Legion::Logging.warn "API POST /api/rbac/grants/cross-team returned 422: #{e.message}"
           json_error('validation_error', e.message, status_code: 422)
         end
 
@@ -306,7 +306,7 @@ module Legion
 
           snapshot = record.values.dup
           record.destroy
-          Legion::Logging.info "API: deleted cross-team RBAC grant #{params[:id]}" if defined?(Legion::Logging)
+          Legion::Logging.info "API: deleted cross-team RBAC grant #{params[:id]}"
           emit_rbac_policy_changed('cross_team_grant.deleted', 'cross_team_grant', snapshot)
           json_response({ deleted: true })
         end
@@ -390,8 +390,6 @@ module Legion
             )
           )
         rescue StandardError => e
-          return unless defined?(Legion::Logging)
-
           Legion::Logging.warn("API policy change event failed type=#{target_type} change=#{change_type} error=#{e.class}: #{e.message}")
         end
 

data/lib/legion/rbac/settings.rb

@@ -18,6 +18,7 @@ module Legion
           default_local_role:   'admin',
           static_assignments:   [],
           route_permissions:    {},
+          group_role_map:       {},
           roles:                default_roles,
           entra:                entra_defaults,
           capability_audit:     capability_audit_defaults

data/lib/legion/rbac/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Rbac
-    VERSION = '0.3.2'
+    VERSION = '0.3.4'
   end
 end

data/lib/legion/rbac.rb

@@ -13,6 +13,7 @@ require 'legion/rbac/team_scope'
 require 'legion/rbac/store'
 require 'legion/rbac/kerberos_claims_mapper'
 require 'legion/rbac/entra_claims_mapper'
+require 'legion/rbac/group_role_mapper'
 require 'legion/rbac/middleware'
 require 'legion/rbac/routes'
 require 'legion/rbac/capability_audit'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-rbac
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.3.4
 platform: ruby
 authors:
 - Esity
@@ -79,6 +79,7 @@ files:
 - lib/legion/rbac/capability_registry.rb
 - lib/legion/rbac/config_loader.rb
 - lib/legion/rbac/entra_claims_mapper.rb
+- lib/legion/rbac/group_role_mapper.rb
 - lib/legion/rbac/kerberos_claims_mapper.rb
 - lib/legion/rbac/middleware.rb
 - lib/legion/rbac/permission.rb