legionio 1.7.21 → 1.7.25

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f1c44047319bdcf02eb061d73517101f695f380d976cb65ad9e2a0d2afb824b2
-  data.tar.gz: e756182d3fdfea35882961412f7d3093884d7477954c3b67d2037039ad310189
+  metadata.gz: d65ff77ca667361b558a97d1da1c3d5d2b1090bb4aad5559532406cd18e781a7
+  data.tar.gz: 7583822cc4cf804703b8a733be36bb711d1cae70724a49dc98cafea6583268ab
 SHA512:
-  metadata.gz: 1178b2efaadc7801e37a68fd556add983eede7acd3f01dd1c744b029c8e048dc7ac681db0b578fc545419ca8d4f447cc518d3f7d5c2b351323350c1ae9ea908c
-  data.tar.gz: c9f34008bef206a7108cbc4013213342c4bc25fa6396884fec1e471b3b6d46d7110027214a0829c05a0d59d59c348fad8726d089c03ffbb1b40ce5f7d9de10a7
+  metadata.gz: 06f7712d8c9c6e944890ba2c55efbdf3463a6c39e906017cede6d3401215de9144e7c916c39c8b981e8f6ea6646a5439bcc10a399443fe7642b3ab06e3ef2c7a
+  data.tar.gz: 5e5819fc7973e9cb6de4b64e88c40b74d033fd666c4b9585726a3b1e87b9468f6cf4759fed226a9c3a7bc755a10b9267403dcd001d2c10f08b7aaf36e6264812

data/CHANGELOG.md

@@ -1,6 +1,28 @@
 # Legion Changelog
 
-## [Unreleased]
+## [1.7.25] - 2026-04-06
+
+### Added
+- Wire Format Phase 3 Group 2: `Identity::Request::SOURCE_NORMALIZATION` constant — maps middleware-emitted source values (`:api_key`, `:local`, `:jwt`, `:kerberos`, `:system`) to canonical credential enum at `from_auth_context` construction time
+- Wire Format Phase 3 Group 2: `response_meta` in `API::Helpers` now includes `caller` block (`canonical_name`, `kind`, `source`) when the request is authenticated and `env['legion.principal']` is set by `Identity::Middleware`
+- Wire Format Phase 3 Group 2: `POST /api/llm/inference` wires `to_caller_hash` from the authenticated principal into the pipeline `caller:` field, replacing the hardcoded `{ type: :user, credential: :api }` fallback
+
+## [1.7.24] - 2026-04-06
+
+### Fixed
+- `Routes::Events` SSE stream: qualify `stream_queue` call with `Routes::Events.` to fix NoMethodError on Legion::API instance
+
+### Added
+- `Identity::Process.source` accessor — exposes provider source in identity hash (Wire Format Phase 3)
+- `source:` key in `Identity::Process.identity_hash`, `bind!`, `bind_fallback!`, and `EMPTY_STATE`
+
+## [1.7.22] - 2026-04-06
+### Added
+- Elastic APM integration for Sinatra API via `elastic-apm` gem
+- Full APM config under `api.elastic_apm` settings: server_url, api_key, secret_token, api_buffer_size, api_request_size, api_request_time, capture_body, capture_headers, capture_env, disable_send, enabled, environment, hostname, ignore_url_patterns, pool_size, service_name, service_node_name, service_version, sample_rate
+- `setup_apm` / `shutdown_apm` lifecycle in Service (boot, shutdown, reload)
+- `ElasticAPM::Middleware` wired into API when available
+- Health/ready endpoints excluded from APM tracing by default
 
 ## [1.7.21] - 2026-04-06
 ### Fixed

data/lib/legion/api/default_settings.rb

@@ -13,7 +13,8 @@ module Legion
           puma:            puma_defaults,
           bind_retries:    3,
           bind_retry_wait: 2,
-          tls:             tls_defaults
+          tls:             tls_defaults,
+          elastic_apm:     elastic_apm_defaults
         }
       end
 
@@ -31,6 +32,33 @@ module Legion
           enabled: false
         }
       end
+
+      def self.elastic_apm_defaults
+        {
+          enabled:                  false,
+          server_url:               'http://localhost:8200',
+          api_key:                  nil,
+          secret_token:             nil,
+          api_buffer_size:          256,
+          api_request_size:         '750kb',
+          api_request_time:         '10s',
+          capture_body:             'off',
+          capture_headers:          true,
+          capture_env:              true,
+          disable_send:             false,
+          environment:              nil,
+          hostname:                 nil,
+          ignore_url_patterns:      %w[/api/health /api/ready],
+          pool_size:                1,
+          service_name:             'LegionIO',
+          service_node_name:        nil,
+          service_version:          nil,
+          sample_rate:              1.0,
+          verify_server_cert:       true,
+          central_config:           true,
+          span_frames_min_duration: '5ms'
+        }
+      end
     end
   end
 end

data/lib/legion/api/events.rb

@@ -90,7 +90,7 @@ module Legion
               end
 
               stream do |out|
-                stream_queue(out: out, queue: queue, listener: listener)
+                Routes::Events.stream_queue(out: out, queue: queue, listener: listener)
               end
             end
 

data/lib/legion/api/helpers.rb

@@ -173,10 +173,23 @@ module Legion
       private
 
       def response_meta
-        {
+        meta = {
           timestamp: Time.now.utc.iso8601,
           node:      Legion::Settings[:client][:name]
         }
+
+        if authenticated? && defined?(Legion::Identity::Request)
+          req = env['legion.principal']
+          if req
+            meta[:caller] = {
+              canonical_name: req.canonical_name,
+              kind:           req.kind,
+              source:         req.source
+            }
+          end
+        end
+
+        meta
       end
 
       def page_limit

data/lib/legion/api/llm.rb

@@ -280,12 +280,19 @@ module Legion
             require 'legion/llm/pipeline/request' unless defined?(Legion::LLM::Pipeline::Request)
             require 'legion/llm/pipeline/executor' unless defined?(Legion::LLM::Pipeline::Executor)
 
+            principal  = defined?(Legion::Identity::Request) && env['legion.principal']
+            caller_ctx = if principal
+                           principal.to_caller_hash
+                         else
+                           { requested_by: { identity: caller_identity, type: :user, credential: :api } }
+                         end
+
             req = Legion::LLM::Pipeline::Request.build(
               messages:        messages,
               system:          body[:system],
               routing:         { provider: provider, model: model },
               tools:           tool_classes,
-              caller:          { requested_by: { identity: caller_identity, type: :user, credential: :api } },
+              caller:          caller_ctx,
               conversation_id: body[:conversation_id],
               metadata:        { requested_tools: requested_tools },
               stream:          streaming,

data/lib/legion/api/middleware/request_logger.rb

@@ -10,19 +10,64 @@ module Legion
 
         def call(env)
           method_path = "#{env['REQUEST_METHOD']} #{env['PATH_INFO']}"
-          Legion::Logging.info "[api][request-start] #{method_path}"
+          client_info = build_client_info(env)
+          Legion::Logging.info "[api][request-start] #{method_path} #{client_info}"
           start = ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
           status, headers, body = @app.call(env)
           duration = ((::Process.clock_gettime(::Process::CLOCK_MONOTONIC) - start) * 1000).round(2)
 
           level = duration > 5000 ? :warn : :info
-          Legion::Logging.send(level, "[api] #{method_path} #{status} #{duration}ms")
+          Legion::Logging.send(level, "[api] #{method_path} #{status} #{duration}ms #{client_info}")
           [status, headers, body]
         rescue StandardError => e
           duration = ((::Process.clock_gettime(::Process::CLOCK_MONOTONIC) - start) * 1000).round(2)
-          Legion::Logging.error "[api] #{method_path} 500 #{duration}ms - #{e.message}"
+          Legion::Logging.error "[api] #{method_path} 500 #{duration}ms #{client_info} - #{e.message}"
           raise
         end
+
+        private
+
+        def build_client_info(env)
+          ip = env['HTTP_X_FORWARDED_FOR'] || env['REMOTE_ADDR'] || '-'
+          ua = env['HTTP_USER_AGENT'] || '-'
+          origin = env['HTTP_ORIGIN'] || '-'
+          referer = env['HTTP_REFERER'] || '-'
+          auth = env['HTTP_AUTHORIZATION'] ? 'Bearer(present)' : 'none'
+          content_type = env['CONTENT_TYPE'] || '-'
+          content_length = env['CONTENT_LENGTH'] || '-'
+          query = env['QUERY_STRING'] && env['QUERY_STRING'].empty? ? nil : env['QUERY_STRING']
+
+          parts = [
+            "ip=#{ip}",
+            "ua=#{ua}",
+            "origin=#{origin}",
+            "referer=#{referer}",
+            "auth=#{auth}",
+            "content_type=#{content_type}",
+            "content_length=#{content_length}"
+          ]
+          parts << "query=#{query}" if query
+          parts.join(' ')
+        end
+
+        def peek_body(env)
+          input = env['rack.input']
+          return '-' unless input.respond_to?(:read) && input.respond_to?(:rewind)
+
+          begin
+            input.rewind
+            raw = input.read(1024)
+            raw.to_s.gsub(/\s+/, ' ')[0, 512]
+          rescue StandardError
+            '-'
+          ensure
+            begin
+              input.rewind
+            rescue StandardError
+              nil
+            end
+          end
+        end
       end
     end
   end

data/lib/legion/api.rb

@@ -222,5 +222,7 @@ module Legion
 
     use Legion::API::Middleware::RequestLogger
     use Legion::Rbac::Middleware if defined?(Legion::Rbac::Middleware)
+    use ElasticAPM::Middleware if defined?(ElasticAPM::Middleware) &&
+                                  Legion::Settings.dig(:api, :elastic_apm, :enabled)
   end
 end

data/lib/legion/identity/process.rb

@@ -11,6 +11,7 @@ module Legion
         id:             nil,
         canonical_name: nil,
         kind:           nil,
+        source:         nil,
         persistent:     false,
         groups:         [].freeze,
         metadata:       {}.freeze
@@ -53,11 +54,16 @@ module Legion
           @state.get[:persistent] == true
         end
 
+        def source
+          @state.get[:source]
+        end
+
         def identity_hash
           {
             id:             id,
             canonical_name: canonical_name,
             kind:           kind,
+            source:         source,
             mode:           mode,
             queue_prefix:   queue_prefix,
             resolved:       resolved?,
@@ -69,10 +75,12 @@ module Legion
 
         def bind!(provider, identity_hash)
           @provider = provider
+          provider_source = provider.respond_to?(:provider_name) ? provider.provider_name : nil
           @state.set({
                        id:             identity_hash[:id],
                        canonical_name: identity_hash[:canonical_name],
                        kind:           identity_hash[:kind],
+                       source:         identity_hash.key?(:source) ? identity_hash[:source] : provider_source,
                        persistent:     identity_hash.fetch(:persistent, true),
                        groups:         Array(identity_hash[:groups]).compact.freeze,
                        metadata:       identity_hash[:metadata].is_a?(Hash) ? identity_hash[:metadata].dup.freeze : {}.freeze
@@ -86,6 +94,7 @@ module Legion
                        id:             nil,
                        canonical_name: user,
                        kind:           :human,
+                       source:         :system,
                        persistent:     false,
                        groups:         [].freeze,
                        metadata:       {}.freeze

data/lib/legion/identity/request.rb

@@ -3,6 +3,19 @@
 module Legion
   module Identity
     class Request
+      # Maps middleware-emitted source values to the canonical credential enum.
+      # :local is emitted by Middleware#system_principal for unauthenticated loopback
+      # requests and must normalize to :system to maintain audit trail consistency.
+      # :jwt is intentionally kept distinct — JWT is the transport, not the provider.
+      # Entra-specific identification requires issuer inspection (Phase 7 concern).
+      SOURCE_NORMALIZATION = {
+        api_key:  :api,
+        jwt:      :jwt,
+        kerberos: :kerberos,
+        local:    :system,
+        system:   :system
+      }.freeze
+
       attr_reader :principal_id, :canonical_name, :kind, :groups, :source, :metadata
 
       def initialize(principal_id:, canonical_name:, kind:, groups: [], source: nil, metadata: {}) # rubocop:disable Metrics/ParameterLists
@@ -10,7 +23,7 @@ module Legion
         @canonical_name = canonical_name
         @kind           = kind
         @groups         = groups.freeze
-        @source         = source
+        @source         = SOURCE_NORMALIZATION.fetch(source&.to_sym, source)
         @metadata       = metadata.freeze
         freeze
       end
@@ -23,16 +36,19 @@ module Legion
 
       # Builds a Request from a parsed auth claims hash with symbol keys:
       #   { sub:, name:, preferred_username:, kind:, groups:, source: }
+      # The source value is normalized via SOURCE_NORMALIZATION at construction time.
       def self.from_auth_context(claims_hash)
         raw_name = claims_hash[:name] || claims_hash[:preferred_username] || ''
         canonical = raw_name.to_s.strip.downcase.gsub('.', '-')
+        raw_source = claims_hash[:source]&.to_sym
+        normalized_source = SOURCE_NORMALIZATION.fetch(raw_source, raw_source)
 
         new(
           principal_id:   claims_hash[:sub],
           canonical_name: canonical,
           kind:           claims_hash[:kind] || :human,
           groups:         claims_hash[:groups] || [],
-          source:         claims_hash[:source]
+          source:         normalized_source
         )
       end
 

data/lib/legion/service.rb

@@ -327,21 +327,12 @@ module Legion
     end
 
     def setup_apm
-      apm_settings = Legion::Settings[:apm] || {}
+      apm_settings = Legion::Settings.dig(:api, :elastic_apm) || {}
       return unless apm_settings[:enabled]
 
       require 'elastic-apm'
 
-      config = {
-        service_name:            apm_settings[:service_name] || "legion-#{Legion::Settings[:client][:name]}",
-        server_url:              apm_settings[:server_url] || 'http://localhost:8200',
-        environment:             apm_settings[:environment] || Legion::Settings[:environment] || 'development',
-        secret_token:            apm_settings[:secret_token],
-        api_key:                 apm_settings[:api_key],
-        log_level:               apm_settings[:log_level]&.to_sym || Logger::WARN,
-        transaction_sample_rate: apm_settings[:sample_rate] || 1.0
-      }.compact
-
+      config = build_apm_config(apm_settings)
       ElasticAPM.start(**config)
       @apm_running = true
       log.info "Elastic APM started: server=#{config[:server_url]} service=#{config[:service_name]}"
@@ -1145,6 +1136,35 @@ module Legion
       }.compact
     end
 
+    def build_apm_config(apm)
+      {
+        server_url:               apm[:server_url] || 'http://localhost:8200',
+        api_key:                  apm[:api_key],
+        secret_token:             apm[:secret_token],
+        api_buffer_size:          apm[:api_buffer_size] || 256,
+        api_request_size:         apm[:api_request_size] || '750kb',
+        api_request_time:         apm[:api_request_time] || '10s',
+        capture_body:             apm.fetch(:capture_body, 'off'),
+        capture_headers:          apm.fetch(:capture_headers, true),
+        capture_env:              apm.fetch(:capture_env, true),
+        disable_send:             apm.fetch(:disable_send, false),
+        environment:              apm[:environment] || Legion::Settings[:environment] || 'development',
+        framework_name:           'LegionIO',
+        framework_version:        Legion::VERSION,
+        hostname:                 apm[:hostname] || Legion::Settings[:client][:name],
+        ignore_url_patterns:      apm[:ignore_url_patterns] || %w[/api/health /api/ready],
+        logger:                   Legion::Logging.log,
+        pool_size:                apm[:pool_size] || 1,
+        service_name:             apm[:service_name] || 'LegionIO',
+        service_node_name:        apm[:service_node_name] || Legion::Settings[:client][:name],
+        service_version:          apm[:service_version] || Legion::VERSION,
+        transaction_sample_rate:  apm[:sample_rate] || 1.0,
+        verify_server_cert:       apm.fetch(:verify_server_cert, true),
+        central_config:           apm.fetch(:central_config, true),
+        span_frames_min_duration: apm[:span_frames_min_duration]
+      }.compact
+    end
+
     def ssl_server_settings(tls_cfg, bind, port)
       return {} unless tls_cfg
 

data/lib/legion/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Legion
-  VERSION = '1.7.21'
+  VERSION = '1.7.25'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legionio
 version: !ruby/object:Gem::Version
-  version: 1.7.21
+  version: 1.7.25
 platform: ruby
 authors:
 - Esity