legion-rbac 0.3.4 → 0.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: edda9eb7ccd62c65b56a7a5cb8238553bf71eee38854090d5013a307f14072c7
-  data.tar.gz: 51d314a59df53ba27de952d355255829d6b8b3079980ad438094e72c323f1ce2
+  metadata.gz: 2c62ae3d8b8ed4b7285f13ecc1e5d90d79f343cf98a4d56a342af761aba03185
+  data.tar.gz: f705bad75d3d459e82463c50d3110df25e847d36f2e092e88e10ae545ba67cac
 SHA512:
-  metadata.gz: 5160cd7e44e30646efe4cbbb7de37598db334adbc9c4c26a55071146df85871743744da9e5ece3c9980a1dfe0ab7069dd968532bb56ded5b914f9b3ceef25300
-  data.tar.gz: 69d5006b1aaedbea32bacda5b4a071d79c3eac0090f62e66f095789d12f7310a956f92e9ba8ef3641673b4346a207a0e587650a27091b50d3bca785592a5cebc
+  metadata.gz: c7d12ee4a0eaac6ea80132816a429dac7621253a4d720ef69dceaedcf1a00b63af70f0004b4c3e1bbec3f48ff9c8e8eb34eee8f0365e3abbd6a96b94c86727c4
+  data.tar.gz: 7f62612de461d2339ea9d70c9de87d5b8cc601622986a51ae3dfa02a22ac78d709b46dbc4ff5ad7cd78d8418f6ee2defa9912d9d2cc187ddb48a8f0541305fbf

data/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## [0.3.5] - 2026-10-30
+
+### Fixed
+- Deliver authorization decisions and policy-change audit events through the Core event bus keyword payload contract instead of losing events to a rescued argument error.
+
 ## [0.3.4] - 2026-05-09
 
 ### Removed

data/README.md

@@ -90,6 +90,12 @@ result = Legion::Rbac::PolicyEngine.evaluate(principal: principal, action: :read
 # => { allowed: true, reason: "...", would_deny: false }
 ```
 
+### Audit Events
+
+When the optional Core `Legion::Events` bus is loaded and `rbac.emit_events` is enabled, subscribers receive `rbac.granted` and `rbac.denied` decisions with principal, resource/capability, enforcement and request-correlation context. Dry-run denials still emit `rbac.denied` with `would_deny: true`; authorization remains nonblocking.
+
+Successful policy mutations emit `rbac.policy_changed` with the actor, target record and request correlation. RBAC 0.3.5 uses Core's keyword payload contract, so these notifications reach ordinary `Legion::Events.on` subscribers rather than being lost to an argument error. Event-delivery failures are logged without changing the authorization decision.
+
 ### CLI
 
 ```bash

data/lib/legion/rbac/permission.rb

@@ -34,8 +34,8 @@ module Legion
       def self.pattern_to_regex(pattern)
         parts = pattern.split('/').map do |segment|
           case segment
-          when '*'  then '.*'
-          when '+'  then '[^/]+'
+          when '*' then '.*'
+          when '+' then '[^/]+'
           else Regexp.escape(segment)
           end
         end
@@ -80,8 +80,8 @@ module Legion
       def self.pattern_to_regex(pattern)
         parts = pattern.split('/').map do |segment|
           case segment
-          when '*'  then '.*'
-          when '+'  then '[^/]+'
+          when '*' then '.*'
+          when '+' then '[^/]+'
           else Regexp.escape(segment)
           end
         end

data/lib/legion/rbac/policy_engine.rb

@@ -393,7 +393,7 @@ module Legion
           enforce:        context[:enforce],
           reason:         result[:reason]
         }.merge(context[:event_context]).compact
-        Legion::Events.emit(event_name, payload)
+        Legion::Events.emit(event_name, **payload)
       rescue StandardError => e
         handle_exception(e, level: :warn, operation: 'rbac.policy_engine.emit_decision_event', event: event_name)
       end

data/lib/legion/rbac/routes.rb

@@ -382,7 +382,7 @@ module Legion
 
           Legion::Events.emit(
             'rbac.policy_changed',
-            policy_change_payload(
+            **policy_change_payload(
               change_type:   change_type,
               target_type:   target_type,
               record_values: record_values,

data/lib/legion/rbac/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Rbac
-    VERSION = '0.3.4'
+    VERSION = '0.3.5'
   end
 end

data/lib/legion/rbac.rb

@@ -87,10 +87,10 @@ module Legion
 
       def events_enabled?
         return false unless defined?(Legion::Events)
-        return false unless defined?(Legion::Settings)
 
         Legion::Settings[:rbac]&.fetch(:emit_events, true) != false
-      rescue StandardError
+      rescue StandardError => e
+        handle_exception(e, level: :warn, operation: 'rbac.events_enabled')
         false
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-rbac
 version: !ruby/object:Gem::Version
-  version: 0.3.4
+  version: 0.3.5
 platform: ruby
 authors:
 - Esity