legion-rbac 0.3.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 222914812dd7014e897e4aa3a6311ea7b4e8062c74ad1c532774f2f3c9e06fca
-  data.tar.gz: 30b265cf04e23b6456f839d5aeeeb47792751d3580f92b2085709b9f786388b5
+  metadata.gz: 1e31de28dec8d6ed48595581dae626ad860e9f7f3b5bf7bd40086d66edeca25a
+  data.tar.gz: ef15533a37dafea6e3783761405ea446d57cdfa55aca62816770e913aa0823e1
 SHA512:
-  metadata.gz: 5e9e541ca68dffe258a0766c0dbf58069faf39475ca94db674f38b8d33430dc04a14bf75b360ce1dc72807361a7d67f9bfff558541e3287ddf51a7325bf0a416
-  data.tar.gz: c327b53c9b782f461fc163aef47118c075f3367b9aa60585080faab7ebdf43c57092e580c86ea454a22c0ed5ecbd298a3027c442cc327988edd2dfe812047cb9
+  metadata.gz: 61dc20722e2fb34563fb06ec2f73b8db7c43e96450ff8ed7052ef3316827418b8896185a3d52ca6843ca620055ebae444090f4fb075f5740bbe521c30c900f86
+  data.tar.gz: 1154d70f8bbb2cee9e7b65414606d3bd5808b3f1822d40e02f1c5ca7b0896a6edd09e27534c7ab749ffaa0e3642ed99a08c00f19f169192d2803f5d7c9cf0822

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.3.1] - 2026-04-03
+
+### Fixed
+- `authorize!` and `authorize_execution!` now early-return when `rbac.enabled: false`, preventing NameError on missing RBAC models
+- `authorize!` and `authorize_execution!` respect `rbac.enforce: false` — logs denials but does not raise AccessDenied
+- `Store.db_available?` now also checks that `RbacRoleAssignment` model constant is defined before attempting DB queries
+
 ## [0.3.0] - 2026-04-02
 
 ### Changed

data/lib/legion/rbac/store.rb

@@ -9,7 +9,9 @@ module Legion
 
       class << self
         def db_available?
-          available = defined?(Legion::Data) ? Legion::Settings[:data]&.dig(:connected) == true : false
+          available = (defined?(Legion::Data) &&
+                      Legion::Settings[:data]&.dig(:connected) == true &&
+                      defined?(Legion::Data::Model::RbacRoleAssignment)) || false
           log.debug("RBAC store db_available=#{available}")
           available
         end

data/lib/legion/rbac/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Rbac
-    VERSION = '0.3.0'
+    VERSION = '0.3.1'
   end
 end

data/lib/legion/rbac.rb

@@ -78,6 +78,12 @@ module Legion
         Legion::Settings[:rbac]&.fetch(:enabled, true) != false
       end
 
+      def enforcing?
+        return true unless defined?(Legion::Settings)
+
+        Legion::Settings[:rbac]&.fetch(:enforce, true) != false
+      end
+
       def events_enabled?
         return false unless defined?(Legion::Events)
         return false unless defined?(Legion::Settings)
@@ -88,15 +94,22 @@ module Legion
       end
 
       def authorize!(principal:, action:, resource:, **)
+        return { allowed: true, reason: 'rbac disabled' } unless enabled?
+
         result = PolicyEngine.evaluate(principal: principal, action: action, resource: resource, **)
         log.info("RBAC authorize principal=#{principal.id} action=#{action} resource=#{resource} allowed=#{result[:allowed]}")
-        log.warn("RBAC authorize denied principal=#{principal.id} reason=#{result[:reason]}") unless result[:allowed]
-        raise AccessDenied, result unless result[:allowed]
+
+        unless result[:allowed]
+          log.warn("RBAC authorize denied principal=#{principal.id} reason=#{result[:reason]}")
+          raise AccessDenied, result if enforcing?
+        end
 
         result
       end
 
       def authorize_execution!(principal:, runner_class:, function:, target_team: nil, **)
+        return { allowed: true, reason: 'rbac disabled' } unless enabled?
+
         runner_path = build_runner_path(runner_class, function)
         log.info(
           "RBAC authorize_execution principal=#{principal.id} runner=#{runner_path} " \
@@ -109,8 +122,11 @@ module Legion
           target_team: target_team,
           **
         )
-        log.warn("RBAC authorize_execution denied principal=#{principal.id} reason=#{result[:reason]}") unless result[:allowed]
-        raise AccessDenied, result unless result[:allowed]
+
+        unless result[:allowed]
+          log.warn("RBAC authorize_execution denied principal=#{principal.id} reason=#{result[:reason]}")
+          raise AccessDenied, result if enforcing?
+        end
 
         result
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-rbac
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Esity