legion-rbac 0.3.3 → 0.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2805fec42a72b9618d9790becf4439f3fba5bbe3af5f60f4fd6ce22b230ca4b6
-  data.tar.gz: b4648e10753c56aec63c122f765a00cc545fe6626a3fcd25a344fa829df5e615
+  metadata.gz: 2c62ae3d8b8ed4b7285f13ecc1e5d90d79f343cf98a4d56a342af761aba03185
+  data.tar.gz: f705bad75d3d459e82463c50d3110df25e847d36f2e092e88e10ae545ba67cac
 SHA512:
-  metadata.gz: 2f1a104089a800dbfd7fdd6e062f24cef9205aed00c0accd543deee71327705b5f20dbb259f0cf9c579a67df5046b441ecdf1cfa33f84e485105f4b2fb18c4b9
-  data.tar.gz: 76c1c1466a6956c8406626c414173476181c2b936675aee21e6b7590afd7eb5021b4718c1db3dc01b1ee27f016039673387b54cfbf44933be7915b1c0e22e0ff
+  metadata.gz: c7d12ee4a0eaac6ea80132816a429dac7621253a4d720ef69dceaedcf1a00b63af70f0004b4c3e1bbec3f48ff9c8e8eb34eee8f0365e3abbd6a96b94c86727c4
+  data.tar.gz: 7f62612de461d2339ea9d70c9de87d5b8cc601622986a51ae3dfa02a22ac78d709b46dbc4ff5ad7cd78d8418f6ee2defa9912d9d2cc187ddb48a8f0541305fbf

data/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [0.3.5] - 2026-10-30
+
+### Fixed
+- Deliver authorization decisions and policy-change audit events through the Core event bus keyword payload contract instead of losing events to a rescued argument error.
+
+## [0.3.4] - 2026-05-09
+
+### Removed
+- Unnecessary `defined?(Legion::Logging)` guards from route handlers — legion-logging is a hard gemspec dependency and always available
+
 ## [0.3.3] - 2026-04-08
 
 ### Added

data/README.md

@@ -90,6 +90,12 @@ result = Legion::Rbac::PolicyEngine.evaluate(principal: principal, action: :read
 # => { allowed: true, reason: "...", would_deny: false }
 ```
 
+### Audit Events
+
+When the optional Core `Legion::Events` bus is loaded and `rbac.emit_events` is enabled, subscribers receive `rbac.granted` and `rbac.denied` decisions with principal, resource/capability, enforcement and request-correlation context. Dry-run denials still emit `rbac.denied` with `would_deny: true`; authorization remains nonblocking.
+
+Successful policy mutations emit `rbac.policy_changed` with the actor, target record and request correlation. RBAC 0.3.5 uses Core's keyword payload contract, so these notifications reach ordinary `Legion::Events.on` subscribers rather than being lost to an argument error. Event-delivery failures are logged without changing the authorization decision.
+
 ### CLI
 
 ```bash

data/lib/legion/rbac/permission.rb

@@ -34,8 +34,8 @@ module Legion
       def self.pattern_to_regex(pattern)
         parts = pattern.split('/').map do |segment|
           case segment
-          when '*'  then '.*'
-          when '+'  then '[^/]+'
+          when '*' then '.*'
+          when '+' then '[^/]+'
           else Regexp.escape(segment)
           end
         end
@@ -80,8 +80,8 @@ module Legion
       def self.pattern_to_regex(pattern)
         parts = pattern.split('/').map do |segment|
           case segment
-          when '*'  then '.*'
-          when '+'  then '[^/]+'
+          when '*' then '.*'
+          when '+' then '[^/]+'
           else Regexp.escape(segment)
           end
         end

data/lib/legion/rbac/policy_engine.rb

@@ -393,7 +393,7 @@ module Legion
           enforce:        context[:enforce],
           reason:         result[:reason]
         }.merge(context[:event_context]).compact
-        Legion::Events.emit(event_name, payload)
+        Legion::Events.emit(event_name, **payload)
       rescue StandardError => e
         handle_exception(e, level: :warn, operation: 'rbac.policy_engine.emit_decision_event', event: event_name)
       end

data/lib/legion/rbac/routes.rb

@@ -146,7 +146,7 @@ module Legion
 
       def self.register_check(app)
         app.post '/api/rbac/check' do
-          Legion::Logging.debug "API: POST /api/rbac/check params=#{params.keys}" if defined?(Legion::Logging)
+          Legion::Logging.debug "API: POST /api/rbac/check params=#{params.keys}"
           return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
 
           body = parse_request_body
@@ -163,12 +163,12 @@ module Legion
           )
           json_response(result)
         rescue StandardError => e
-          Legion::Logging.error "API POST /api/rbac/check: #{e.class} — #{e.message}" if defined?(Legion::Logging)
+          Legion::Logging.error "API POST /api/rbac/check: #{e.class} — #{e.message}"
           json_error('rbac_error', e.message, status_code: 500)
         end
       end
 
-      def self.register_assignments(app) # rubocop:disable Metrics/AbcSize,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
+      def self.register_assignments(app) # rubocop:disable Metrics/AbcSize
         app.get '/api/rbac/assignments' do
           return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
           return json_error('db_unavailable', 'legion-data not connected', status_code: 503) unless Legion::Rbac::Store.db_available?
@@ -181,7 +181,7 @@ module Legion
         end
 
         app.post '/api/rbac/assignments' do
-          Legion::Logging.debug "API: POST /api/rbac/assignments params=#{params.keys}" if defined?(Legion::Logging)
+          Legion::Logging.debug "API: POST /api/rbac/assignments params=#{params.keys}"
           return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
           return json_error('db_unavailable', 'legion-data not connected', status_code: 503) unless Legion::Rbac::Store.db_available?
 
@@ -194,13 +194,13 @@ module Legion
             granted_by:     current_owner_msid || 'api',
             expires_at:     parse_optional_time(body[:expires_at], field: 'expires_at')
           )
-          Legion::Logging.info "API: created RBAC assignment #{record.id} role=#{body[:role]} principal=#{body[:principal_id]}" if defined?(Legion::Logging)
+          Legion::Logging.info "API: created RBAC assignment #{record.id} role=#{body[:role]} principal=#{body[:principal_id]}"
           emit_rbac_policy_changed('assignment.created', 'role_assignment', record.values)
           json_response(record.values, status_code: 201)
         rescue Legion::Rbac::Routes::InvalidTimestamp => e
           json_error('validation_error', e.message, status_code: 422)
         rescue Sequel::ValidationFailed => e
-          Legion::Logging.warn "API POST /api/rbac/assignments returned 422: #{e.message}" if defined?(Legion::Logging)
+          Legion::Logging.warn "API POST /api/rbac/assignments returned 422: #{e.message}"
           json_error('validation_error', e.message, status_code: 422)
         end
 
@@ -213,7 +213,7 @@ module Legion
 
           snapshot = record.values.dup
           record.destroy
-          Legion::Logging.info "API: deleted RBAC assignment #{params[:id]}" if defined?(Legion::Logging)
+          Legion::Logging.info "API: deleted RBAC assignment #{params[:id]}"
           emit_rbac_policy_changed('assignment.deleted', 'role_assignment', snapshot)
           json_response({ deleted: true })
         end
@@ -230,7 +230,7 @@ module Legion
         end
 
         app.post '/api/rbac/grants' do
-          Legion::Logging.debug "API: POST /api/rbac/grants params=#{params.keys}" if defined?(Legion::Logging)
+          Legion::Logging.debug "API: POST /api/rbac/grants params=#{params.keys}"
           return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
           return json_error('db_unavailable', 'legion-data not connected', status_code: 503) unless Legion::Rbac::Store.db_available?
 
@@ -241,11 +241,11 @@ module Legion
             actions:        Array(body[:actions]).join(','),
             granted_by:     current_owner_msid || 'api'
           )
-          Legion::Logging.info "API: created RBAC grant #{record.id} team=#{body[:team]} pattern=#{body[:runner_pattern]}" if defined?(Legion::Logging)
+          Legion::Logging.info "API: created RBAC grant #{record.id} team=#{body[:team]} pattern=#{body[:runner_pattern]}"
           emit_rbac_policy_changed('runner_grant.created', 'runner_grant', record.values)
           json_response(record.values, status_code: 201)
         rescue Sequel::ValidationFailed => e
-          Legion::Logging.warn "API POST /api/rbac/grants returned 422: #{e.message}" if defined?(Legion::Logging)
+          Legion::Logging.warn "API POST /api/rbac/grants returned 422: #{e.message}"
           json_error('validation_error', e.message, status_code: 422)
         end
 
@@ -258,7 +258,7 @@ module Legion
 
           snapshot = record.values.dup
           record.destroy
-          Legion::Logging.info "API: deleted RBAC grant #{params[:id]}" if defined?(Legion::Logging)
+          Legion::Logging.info "API: deleted RBAC grant #{params[:id]}"
           emit_rbac_policy_changed('runner_grant.deleted', 'runner_grant', snapshot)
           json_response({ deleted: true })
         end
@@ -274,7 +274,7 @@ module Legion
         end
 
         app.post '/api/rbac/grants/cross-team' do
-          Legion::Logging.debug "API: POST /api/rbac/grants/cross-team params=#{params.keys}" if defined?(Legion::Logging)
+          Legion::Logging.debug "API: POST /api/rbac/grants/cross-team params=#{params.keys}"
           return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
           return json_error('db_unavailable', 'legion-data not connected', status_code: 503) unless Legion::Rbac::Store.db_available?
 
@@ -287,13 +287,13 @@ module Legion
             granted_by:     current_owner_msid || 'api',
             expires_at:     parse_optional_time(body[:expires_at], field: 'expires_at')
           )
-          Legion::Logging.info "API: created cross-team RBAC grant #{record.id} #{body[:source_team]}->#{body[:target_team]}" if defined?(Legion::Logging)
+          Legion::Logging.info "API: created cross-team RBAC grant #{record.id} #{body[:source_team]}->#{body[:target_team]}"
           emit_rbac_policy_changed('cross_team_grant.created', 'cross_team_grant', record.values)
           json_response(record.values, status_code: 201)
         rescue Legion::Rbac::Routes::InvalidTimestamp => e
           json_error('validation_error', e.message, status_code: 422)
         rescue Sequel::ValidationFailed => e
-          Legion::Logging.warn "API POST /api/rbac/grants/cross-team returned 422: #{e.message}" if defined?(Legion::Logging)
+          Legion::Logging.warn "API POST /api/rbac/grants/cross-team returned 422: #{e.message}"
           json_error('validation_error', e.message, status_code: 422)
         end
 
@@ -306,7 +306,7 @@ module Legion
 
           snapshot = record.values.dup
           record.destroy
-          Legion::Logging.info "API: deleted cross-team RBAC grant #{params[:id]}" if defined?(Legion::Logging)
+          Legion::Logging.info "API: deleted cross-team RBAC grant #{params[:id]}"
           emit_rbac_policy_changed('cross_team_grant.deleted', 'cross_team_grant', snapshot)
           json_response({ deleted: true })
         end
@@ -382,7 +382,7 @@ module Legion
 
           Legion::Events.emit(
             'rbac.policy_changed',
-            policy_change_payload(
+            **policy_change_payload(
               change_type:   change_type,
               target_type:   target_type,
               record_values: record_values,
@@ -390,8 +390,6 @@ module Legion
             )
           )
         rescue StandardError => e
-          return unless defined?(Legion::Logging)
-
           Legion::Logging.warn("API policy change event failed type=#{target_type} change=#{change_type} error=#{e.class}: #{e.message}")
         end
 

data/lib/legion/rbac/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Rbac
-    VERSION = '0.3.3'
+    VERSION = '0.3.5'
   end
 end

data/lib/legion/rbac.rb

@@ -87,10 +87,10 @@ module Legion
 
       def events_enabled?
         return false unless defined?(Legion::Events)
-        return false unless defined?(Legion::Settings)
 
         Legion::Settings[:rbac]&.fetch(:emit_events, true) != false
-      rescue StandardError
+      rescue StandardError => e
+        handle_exception(e, level: :warn, operation: 'rbac.events_enabled')
         false
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-rbac
 version: !ruby/object:Gem::Version
-  version: 0.3.3
+  version: 0.3.5
 platform: ruby
 authors:
 - Esity