legion-settings 1.3.16 → 1.3.18

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4263d479bb6b10a4fad1e5e0337153a8ff3f4ae6ff29beaf1089968e70b15f0c
-  data.tar.gz: 3f760ac986406ee7bd6ea9bdad044674e9e591936a01db682c315e63c9d52dfd
+  metadata.gz: 6864083fb9f9f31a4019e85d6e1798afa56fc0bb53123b8388002024803bc11d
+  data.tar.gz: 843ad56f1af0c905c4f53335d20b4300513b97b82e8f1b65aaf971c7c21f7b7f
 SHA512:
-  metadata.gz: 3739c42b861c346d5e5915680bcd2a80277e9ecc77ca784106051003e7a03af6720e348a291c689b9f66ac5611bb4d74b41c24f5b5abbb1182493661d172bbfe
-  data.tar.gz: 2c1710786b2786c4ba263a7eb49d67701d20ad332245a99fa8fee2b28ce128faeffc0895efe52af0bc4512a4e2fc0dc068f0f2db71e0a6c3b8334bd664c8aaf0
+  metadata.gz: d1116e961f4b82d4d5380a27c3f798e45022b72792e44108eff17f1d5ad74b4a93d744e245690ef90895d2a320c862ee646fb4b72f0bf3bc3df218a0886549ed
+  data.tar.gz: 88ebea0500835477eb45550cb48e39b202c1c54eb8bddd6af9e09c93548ccf6864ca366bae9b3dd352c29d0b322c8c00f0949ad2ace90f2229ae8f7a7017c993

data/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Legion::Settings Changelog
 
+## [1.3.18] - 2026-03-24
+
+### Added
+- `Legion::Settings::Validators::Tls` — validates TLS settings blocks (transport, data, api, security) with warnings for weak verify modes, errors for insecure sslmode in production, and missing cert paths
+
+## [1.3.17] - 2026-03-24
+
+### Changed
+- `load` is now idempotent: reuses existing Loader, only sets `@loaded` when config files are provided, skips on subsequent calls unless `force: true`
+- `[]`, `dig`, `merge_settings`, `set_prop`, `validate!`, `resolve_secrets!`, `errors` now use lightweight `ensure_loader` (env vars only, no DNS bootstrap) instead of triggering full `load`
+- Module merges via `merge_settings` at require-time no longer trigger DNS bootstrap or create a new Loader
+
+### Added
+- `loaded?` class method to check if settings have been fully loaded with config files
+- `reset!` class method to clear all state (loader, schema, cross-validations) for testing
+- `ensure_loader` private method: creates minimal Loader with env vars only, no DNS bootstrap
+
 ## [1.3.16] - 2026-03-24
 
 ### Fixed

data/lib/legion/settings/validators/tls.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+module Legion
+  module Settings
+    module Validators
+      module Tls
+        TLS_BLOCKS = %i[transport data cache security api].freeze
+
+        class << self
+          def validate(settings)
+            warnings = []
+            errors   = []
+
+            validate_transport_tls(settings, warnings)
+            validate_data_tls(settings, warnings, errors)
+            validate_security_mtls(settings, warnings)
+            validate_api_tls(settings, warnings, errors)
+
+            { valid: errors.empty?, warnings: warnings, errors: errors }
+          end
+
+          private
+
+          def validate_transport_tls(settings, warnings)
+            tls = dig_tls(settings, :transport)
+            return unless tls[:enabled]
+
+            warnings << 'transport.tls: verify is none — peer verification disabled, connections are unauthenticated' if tls[:verify].to_s == 'none'
+
+            check_cert_path(tls[:cert], 'transport.tls.cert', warnings)
+            check_cert_path(tls[:key],  'transport.tls.key',  warnings)
+            check_cert_path(tls[:ca],   'transport.tls.ca',   warnings)
+          end
+
+          def validate_data_tls(settings, warnings, errors)
+            tls = dig_tls(settings, :data)
+            return unless tls[:enabled]
+
+            sslmode = tls[:sslmode].to_s
+            return if sslmode.empty? || sslmode == 'verify-full'
+
+            env = settings[:env].to_s
+            msg = "data.tls: sslmode '#{sslmode}' should be 'verify-full' to prevent MITM attacks"
+            if env == 'production'
+              errors << msg
+            else
+              warnings << msg
+            end
+          end
+
+          def validate_security_mtls(settings, warnings)
+            mtls = settings.dig(:security, :mtls) || {}
+            mtls = symbolize_keys(mtls)
+            return unless mtls[:enabled]
+
+            check_cert_path(mtls[:cert], 'security.mtls.cert', warnings)
+            check_cert_path(mtls[:key],  'security.mtls.key',  warnings)
+            check_cert_path(mtls[:ca],   'security.mtls.ca',   warnings)
+          end
+
+          def validate_api_tls(settings, _warnings, errors)
+            tls = dig_tls(settings, :api)
+            return unless tls[:enabled]
+
+            cert = tls[:cert]
+            key  = tls[:key]
+
+            errors << 'api.tls: enabled but api.tls.cert is not set' if cert.nil? || cert.to_s.empty?
+
+            errors << 'api.tls: enabled but api.tls.key is not set' if key.nil? || key.to_s.empty?
+          end
+
+          def dig_tls(settings, component)
+            raw = settings.dig(component, :tls) || {}
+            symbolize_keys(raw)
+          rescue StandardError
+            {}
+          end
+
+          def check_cert_path(path, label, warnings)
+            return if path.nil? || path.to_s.empty?
+            return if path.to_s.start_with?('vault://', 'env://', 'lease://')
+            return if ::File.exist?(path.to_s)
+
+            warnings << "#{label}: path '#{path}' does not exist"
+          end
+
+          def symbolize_keys(hash)
+            return {} unless hash.is_a?(Hash)
+
+            hash.each_with_object({}) { |(k, v), h| h[k.to_sym] = v }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/settings/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Settings
-    VERSION = '1.3.16'
+    VERSION = '1.3.18'
   end
 end

data/lib/legion/settings.rb

@@ -16,25 +16,40 @@ module Legion
       attr_accessor :loader
 
       def load(options = {})
-        @loader = Legion::Settings::Loader.new
-        @loader.load_env
-        @loader.load_dns_bootstrap
+        has_config = options[:config_file] || options[:config_dir] || options[:config_dirs]&.any?
+
+        # Already fully loaded with config files — skip unless forced
+        return @loader if @loaded && !options[:force]
+
+        # Create Loader once; reuse for subsequent calls (preserves module merges)
+        if @loader.nil? || options[:force]
+          @loader = Legion::Settings::Loader.new
+          @loader.load_env
+          @loader.load_dns_bootstrap
+        end
+
         @loader.load_file(options[:config_file]) if options[:config_file]
         @loader.load_directory(options[:config_dir]) if options[:config_dir]
         options[:config_dirs]&.each do |directory|
           @loader.load_directory(directory)
         end
+
+        @loaded = true if has_config
         logger.info("Settings loaded from #{@loader.loaded_files.size} files")
         @loader
       end
 
+      def loaded?
+        @loaded == true
+      end
+
       def get(options = {})
         @loader || @loader = load(options)
       end
 
       def [](key)
         logger.info('Legion::Settings was not loading, auto loading now!') if @loader.nil?
-        @loader = load if @loader.nil?
+        ensure_loader
         @loader[key]
       rescue NoMethodError, TypeError => e
         Legion::Logging.debug("Legion::Settings#[] key=#{key} failed: #{e.message}") if defined?(Legion::Logging)
@@ -42,7 +57,7 @@ module Legion
       end
 
       def dig(*keys)
-        @loader = load if @loader.nil?
+        ensure_loader
         @loader.dig(*keys)
       rescue NoMethodError, TypeError => e
         Legion::Logging.debug("Legion::Settings#dig keys=#{keys.inspect} failed: #{e.message}") if defined?(Legion::Logging)
@@ -50,12 +65,12 @@ module Legion
       end
 
       def set_prop(key, value)
-        @loader = load if @loader.nil?
+        ensure_loader
         @loader[key] = value
       end
 
       def merge_settings(key, hash)
-        @loader = load if @loader.nil?
+        ensure_loader
         thing = {}
         thing[key.to_sym] = hash
         @loader.load_module_settings(thing)
@@ -90,7 +105,7 @@ module Legion
       end
 
       def validate!
-        @loader = load if @loader.nil?
+        ensure_loader
         revalidate_all_modules
         run_cross_validations
         detect_unknown_keys
@@ -108,7 +123,7 @@ module Legion
       end
 
       def resolve_secrets!
-        @loader = load if @loader.nil?
+        ensure_loader
         require 'legion/settings/resolver'
         Resolver.resolve_secrets!(@loader.to_hash)
         logger.debug('Secret resolution complete')
@@ -119,10 +134,17 @@ module Legion
       end
 
       def errors
-        @loader = load if @loader.nil?
+        ensure_loader
         @loader.errors
       end
 
+      def reset!
+        @loader = nil
+        @loaded = nil
+        @schema = nil
+        @cross_validations = nil
+      end
+
       def logger
         @logger = if ::Legion.const_defined?('Logging')
                     ::Legion::Logging
@@ -138,6 +160,14 @@ module Legion
 
       private
 
+      def ensure_loader
+        return @loader if @loader
+
+        @loader = Legion::Settings::Loader.new
+        @loader.load_env
+        @loader
+      end
+
       def cross_validations
         @cross_validations ||= []
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-settings
 version: !ruby/object:Gem::Version
-  version: 1.3.16
+  version: 1.3.18
 platform: ruby
 authors:
 - Esity
@@ -57,6 +57,7 @@ files:
 - lib/legion/settings/resolver.rb
 - lib/legion/settings/schema.rb
 - lib/legion/settings/validation_error.rb
+- lib/legion/settings/validators/tls.rb
 - lib/legion/settings/version.rb
 - sonar-project.properties
 homepage: https://github.com/LegionIO/legion-settings