legion-rbac 0.3.5 → 0.3.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2c62ae3d8b8ed4b7285f13ecc1e5d90d79f343cf98a4d56a342af761aba03185
-  data.tar.gz: f705bad75d3d459e82463c50d3110df25e847d36f2e092e88e10ae545ba67cac
+  metadata.gz: 661aa1753cf4b4bc9ab854c5f0c3b70862718cb36ffab5ad395bb3f0b784ec18
+  data.tar.gz: 584b14c5cb4d084c160ef5b12015d15c06dbdea1f6eefa5a28b4d7a42237f818
 SHA512:
-  metadata.gz: c7d12ee4a0eaac6ea80132816a429dac7621253a4d720ef69dceaedcf1a00b63af70f0004b4c3e1bbec3f48ff9c8e8eb34eee8f0365e3abbd6a96b94c86727c4
-  data.tar.gz: 7f62612de461d2339ea9d70c9de87d5b8cc601622986a51ae3dfa02a22ac78d709b46dbc4ff5ad7cd78d8418f6ee2defa9912d9d2cc187ddb48a8f0541305fbf
+  metadata.gz: 5f93ebba6bc19cad6876baa1124190689c09d3b3c053422f27eb8688c25216224d848aae90e313fc638a7caea07bd303f853a0d15a7ea84a8c1383e13e9a379e
+  data.tar.gz: 3c3f61943d75c2241797147091b313cf2355dea9d309227c2a62acf80126902b5186297a41bf02c14ee5cf10e6c7ab0676728e7e65ae138b83e1b2b404461170

data/.github/workflows/ci.yml

@@ -8,13 +8,17 @@ on:
 
 jobs:
   ci:
-    uses: LegionIO/.github/.github/workflows/ci.yml@main
+    uses: LegionIO/.github/.github/workflows/ci.yml@e0fc7364b73f446d4cb9bdc162a66ed34bf0daa7
+    with:
+      companion-gems: ${{ github.event_name == 'pull_request' && '{"legion-settings":{"repository":"LegionIO/legion-settings","ref":"8e73a9ef3c13958e3e1e7fc98532e41283159706"}}' || '{}' }}
 
   lint:
     uses: LegionIO/.github/.github/workflows/lint-patterns.yml@main
 
   security:
-    uses: LegionIO/.github/.github/workflows/security-scan.yml@main
+    uses: LegionIO/.github/.github/workflows/security-scan.yml@e0fc7364b73f446d4cb9bdc162a66ed34bf0daa7
+    with:
+      companion-gems: ${{ github.event_name == 'pull_request' && '{"legion-settings":{"repository":"LegionIO/legion-settings","ref":"8e73a9ef3c13958e3e1e7fc98532e41283159706"}}' || '{}' }}
 
   version-changelog:
     uses: LegionIO/.github/.github/workflows/version-changelog.yml@main

data/.gitignore

@@ -10,3 +10,4 @@
 /.idea/
 *.key
 .rspec_status
+*.gem

data/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## [0.3.6] - 2026-11-01
+
+### Fixed
+- Register RBAC security defaults at load and read live Settings for enablement, enforcement, capability audits, and group mappings without optional-Settings fallbacks.
+
 ## [0.3.5] - 2026-10-30
 
 ### Fixed

data/Gemfile

@@ -3,6 +3,11 @@
 source 'https://rubygems.org'
 
 gemspec
+
+companion_root = File.directory?(File.expand_path('.ci-dependencies', __dir__)) ? '.ci-dependencies' : '..'
+settings_path = File.expand_path("#{companion_root}/legion-settings", __dir__)
+gem 'legion-settings', path: settings_path if File.directory?(settings_path)
+
 group :test do
   gem 'legion-logging'
   gem 'rake'

data/README.md

@@ -108,7 +108,7 @@ legion rbac check user-1 runners/lex-http/* --action execute --roles worker
 
 ## Configuration
 
-Default roles are defined in settings under `rbac.roles`. Custom roles can be added via settings merge or config files.
+Loading `legion/rbac` registers security defaults in `Legion::Settings[:rbac]`. Custom roles can be added under `rbac.roles` via settings merge or config files. Runtime enablement, enforcement, capability-audit policy, and group-role mappings read the live tree: `enabled: false` disables RBAC, while `enforce: false` retains evaluation and reports `would_deny` without blocking. After a full `Legion::Settings.reset!`, explicitly register RBAC defaults again before setup.
 
 ## Requirements
 

data/legion-rbac.gemspec

@@ -28,5 +28,5 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency 'legion-json', '>= 1.2.0'
   spec.add_dependency 'legion-logging', '>= 1.5.0'
-  spec.add_dependency 'legion-settings', '>= 1.3.12'
+  spec.add_dependency 'legion-settings', '>= 1.4.5'
 end

data/lib/legion/rbac/capability_audit.rb

@@ -100,13 +100,11 @@ module Legion
         end
 
         def enabled?
-          settings = capability_audit_settings
-          settings[:enabled] != false
+          Legion::Settings[:rbac][:capability_audit][:enabled] != false
         end
 
         def mode
-          settings = capability_audit_settings
-          (settings[:mode] || 'enforce').to_s
+          Legion::Settings[:rbac][:capability_audit][:mode].to_s
         end
 
         private
@@ -161,12 +159,6 @@ module Legion
             reason:         reason
           )
         end
-
-        def capability_audit_settings
-          return {} unless defined?(Legion::Settings)
-
-          Legion::Settings[:rbac]&.dig(:capability_audit) || {}
-        end
       end
     end
   end

data/lib/legion/rbac/group_role_mapper.rb

@@ -6,7 +6,7 @@ module Legion
       # Resolve RBAC roles from group memberships using a configurable map.
       #
       # @param groups [Array<String>] group names or OIDs from identity provider
-      # @param group_role_map [Hash, nil] { group_name => role_name }; reads default_map when nil
+      # @param group_role_map [Hash, nil] { group_name => role_name }; reads live settings when nil
       # @return [Array<String>] resolved role names (may be empty)
       #
       # NOTE: v1 supports exact string match only. Regexp keys in group_role_map are NOT supported —
@@ -15,7 +15,7 @@ module Legion
       def self.resolve_roles(groups:, group_role_map: nil)
         return [] unless Legion::Rbac.enabled?
 
-        map = group_role_map || default_map
+        map = group_role_map || Legion::Settings[:rbac][:group_role_map]
         return [] if groups.nil? || groups.empty? || map.empty?
 
         normalized_map = {}
@@ -45,15 +45,6 @@ module Legion
         existing_roles = principal[:roles] || []
         principal.merge(roles: (existing_roles + additional_roles).uniq)
       end
-
-      def self.default_map
-        return {} unless defined?(Legion::Settings)
-
-        rbac_settings = Legion::Settings[:rbac]
-        rbac_settings&.dig(:group_role_map) || {}
-      end
-
-      private_class_method :default_map
     end
   end
 end

data/lib/legion/rbac/settings.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'legion/logging'
+require 'legion/settings'
 
 module Legion
   module Rbac
@@ -136,3 +137,5 @@ module Legion
     end
   end
 end
+
+Legion::Settings.register_library(:rbac, Legion::Rbac::Settings.default)

data/lib/legion/rbac/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Rbac
-    VERSION = '0.3.5'
+    VERSION = '0.3.6'
   end
 end

data/lib/legion/rbac.rb

@@ -55,7 +55,6 @@ module Legion
 
       def setup
         log.info 'Legion::Rbac setup started'
-        Legion::Settings.merge_settings(:rbac, Legion::Rbac::Settings.default)
         unless enabled?
           update_role_index(EMPTY_ROLE_INDEX, connected: false)
           log.info 'Legion::Rbac disabled via settings'
@@ -74,21 +73,17 @@ module Legion
       end
 
       def enabled?
-        return true unless defined?(Legion::Settings)
-
-        Legion::Settings[:rbac]&.fetch(:enabled, true) != false
+        Legion::Settings[:rbac][:enabled] != false
       end
 
       def enforcing?
-        return true unless defined?(Legion::Settings)
-
-        Legion::Settings[:rbac]&.fetch(:enforce, true) != false
+        Legion::Settings[:rbac][:enforce] != false
       end
 
       def events_enabled?
         return false unless defined?(Legion::Events)
 
-        Legion::Settings[:rbac]&.fetch(:emit_events, true) != false
+        Legion::Settings[:rbac][:emit_events] != false
       rescue StandardError => e
         handle_exception(e, level: :warn, operation: 'rbac.events_enabled')
         false

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-rbac
 version: !ruby/object:Gem::Version
-  version: 0.3.5
+  version: 0.3.6
 platform: ruby
 authors:
 - Esity
@@ -43,14 +43,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.3.12
+        version: 1.4.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.3.12
+        version: 1.4.5
 description: Role-based access control for LegionIO with team scoping and policy enforcement
 email:
 - matthewdiverson@gmail.com