legionio 1.4.43 → 1.4.44

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 51e90ef95b551c27c044e9f9dac0d784a529d4947835ec0d6501276f73281fb9
-  data.tar.gz: 533c1b9813327e486e33cb2c1d657907248517deb15935c68616a095be699280
+  metadata.gz: 16599e1c095434bfb65c5a5aa763cb821324e192f8e367cad1aff64fadec7e10
+  data.tar.gz: 2747877e468f15212ed3bbd19eaa287323d159a676a01e80e6b1ca11e0abed9b
 SHA512:
-  metadata.gz: 298d051c13e5e658eb572971863a7039d3c08bd168b40b2e6806a3139ccae7261ff29c916bb84ab34fd2fea6c2e6905615f8689e80f5a415feafe75cbf0f56c5
-  data.tar.gz: 1f0005c08f21b456e5d64923020e662efbe88a714514ad7bd27b59caa0efc05676551f8b87a150d0226aa1bc9237681d0688bb6b42f1430624ea5ba81e420903
+  metadata.gz: e522c7f831673baa38cf887b1493e78e7133d930f3e857b82fefddbeeffbcc88877e4d741330a222e744170bd0e5876ec08deca5c8a00d8dc6cc520fbd0f54dc
+  data.tar.gz: 802b45c5a8d13d79f0c52ac872080a6fde0e5b64bc7ee0f46a21fbdb5be56c23ddad2f6b242b535b9a862e13b446735cb57c44ac50a9a0b021a728c620defe20

data/.rubocop.yml

@@ -37,6 +37,7 @@ Metrics/BlockLength:
     - 'lib/legion/cli/schedule_command.rb'
     - 'lib/legion/cli/update_command.rb'
     - 'lib/legion/api/auth.rb'
+    - 'lib/legion/api/auth_worker.rb'
 
 Metrics/AbcSize:
   Max: 60

data/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Legion Changelog
 
+## [1.4.44] - 2026-03-17
+
+### Added
+- `POST /api/auth/worker-token`: Entra client credentials token exchange endpoint (validates client_credentials grant via JWKS, looks up worker by appid, issues scoped Legion worker JWT)
+- Auth middleware SKIP_PATHS now includes `/api/auth/token` and `/api/auth/worker-token`
+
 ## [1.4.43] - 2026-03-17
 
 ### Fixed

data/lib/legion/api/auth_worker.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+module Legion
+  class API < Sinatra::Base
+    module Routes
+      module AuthWorker
+        def self.registered(app)
+          register_worker_token_exchange(app)
+        end
+
+        def self.register_worker_token_exchange(app) # rubocop:disable Metrics/MethodLength
+          app.post '/api/auth/worker-token' do
+            body = parse_request_body
+            grant_type = body[:grant_type]
+            entra_token = body[:entra_token]
+
+            unless grant_type == 'client_credentials'
+              halt 400, json_error('unsupported_grant_type', 'grant_type must be client_credentials',
+                                   status_code: 400)
+            end
+
+            halt 400, json_error('missing_entra_token', 'entra_token is required', status_code: 400) unless entra_token
+
+            unless defined?(Legion::Crypt::JWT) && Legion::Crypt::JWT.respond_to?(:verify_with_jwks)
+              halt 501, json_error('jwks_validation_not_available',
+                                   'JWKS validation is not available', status_code: 501)
+            end
+
+            entra_settings = Routes::AuthWorker.resolve_entra_settings
+            tenant_id = entra_settings[:tenant_id]
+            unless tenant_id
+              halt 500, json_error('entra_tenant_not_configured',
+                                   'Entra tenant_id is not configured', status_code: 500)
+            end
+
+            jwks_url = "https://login.microsoftonline.com/#{tenant_id}/discovery/v2.0/keys"
+            issuer = "https://login.microsoftonline.com/#{tenant_id}/v2.0"
+
+            begin
+              claims = Legion::Crypt::JWT.verify_with_jwks(
+                entra_token, jwks_url: jwks_url, issuers: [issuer]
+              )
+            rescue Legion::Crypt::JWT::ExpiredTokenError
+              halt 401, json_error('token_expired', 'Entra token has expired', status_code: 401)
+            rescue Legion::Crypt::JWT::InvalidTokenError => e
+              halt 401, json_error('invalid_token', e.message, status_code: 401)
+            rescue Legion::Crypt::JWT::Error => e
+              halt 502, json_error('identity_provider_unavailable', e.message, status_code: 502)
+            end
+
+            app_id = claims[:appid] || claims[:azp] || claims['appid'] || claims['azp']
+            halt 401, json_error('invalid_token', 'missing appid claim', status_code: 401) unless app_id
+
+            halt 503, json_error('data_unavailable', 'legion-data not connected', status_code: 503) unless defined?(Legion::Data::Model::DigitalWorker)
+
+            worker = Legion::Data::Model::DigitalWorker.first(entra_app_id: app_id)
+            unless worker
+              halt 404, json_error('worker_not_found',
+                                   "no worker registered for entra_app_id #{app_id}", status_code: 404)
+            end
+
+            unless worker.lifecycle_state == 'active'
+              halt 403, json_error('worker_not_active',
+                                   "worker is in #{worker.lifecycle_state} state", status_code: 403)
+            end
+
+            ttl = 3600
+            token = Legion::API::Token.issue_worker_token(
+              worker_id: worker.worker_id, owner_msid: worker.owner_msid, ttl: ttl
+            )
+
+            json_response({
+                            access_token: token,
+                            token_type:   'Bearer',
+                            expires_in:   ttl,
+                            worker_id:    worker.worker_id,
+                            scope:        'worker'
+                          })
+          end
+        end
+
+        def self.resolve_entra_settings
+          return {} unless defined?(Legion::Settings)
+
+          identity = Legion::Settings[:identity]
+          entra = identity.is_a?(Hash) ? identity[:entra] : nil
+          return entra if entra.is_a?(Hash)
+
+          rbac = Legion::Settings[:rbac]
+          entra = rbac.is_a?(Hash) ? rbac[:entra] : nil
+          return entra if entra.is_a?(Hash)
+
+          {}
+        rescue StandardError
+          {}
+        end
+
+        class << self
+          private :register_worker_token_exchange
+        end
+      end
+    end
+  end
+end

data/lib/legion/api/middleware/auth.rb

@@ -4,7 +4,7 @@ module Legion
   class API < Sinatra::Base
     module Middleware
       class Auth
-        SKIP_PATHS      = %w[/api/health /api/ready /api/openapi.json /metrics].freeze
+        SKIP_PATHS      = %w[/api/health /api/ready /api/openapi.json /metrics /api/auth/token /api/auth/worker-token].freeze
         AUTH_HEADER     = 'HTTP_AUTHORIZATION'
         BEARER_PATTERN  = /\ABearer\s+(.+)\z/i
         API_KEY_HEADER  = 'HTTP_X_API_KEY'

data/lib/legion/api.rb

@@ -27,6 +27,7 @@ require_relative 'api/oauth'
 require_relative 'api/openapi'
 require_relative 'api/rbac'
 require_relative 'api/auth'
+require_relative 'api/auth_worker'
 require_relative 'api/audit'
 require_relative 'api/metrics'
 
@@ -98,6 +99,7 @@ module Legion
     register Routes::OAuth
     register Routes::Rbac
     register Routes::Auth
+    register Routes::AuthWorker
     register Routes::Audit
     register Routes::Metrics
 

data/lib/legion/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Legion
-  VERSION = '1.4.43'
+  VERSION = '1.4.44'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legionio
 version: !ruby/object:Gem::Version
-  version: 1.4.43
+  version: 1.4.44
 platform: ruby
 authors:
 - Esity
@@ -318,6 +318,7 @@ files:
 - lib/legion/api.rb
 - lib/legion/api/audit.rb
 - lib/legion/api/auth.rb
+- lib/legion/api/auth_worker.rb
 - lib/legion/api/chains.rb
 - lib/legion/api/coldstart.rb
 - lib/legion/api/events.rb