legionio 1.4.44 → 1.4.45

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 16599e1c095434bfb65c5a5aa763cb821324e192f8e367cad1aff64fadec7e10
-  data.tar.gz: 2747877e468f15212ed3bbd19eaa287323d159a676a01e80e6b1ca11e0abed9b
+  metadata.gz: 7915294130831737224c3d34264ee4687251f338b30ba1703ec5649cd045fff2
+  data.tar.gz: 2561c25ca2abfd8bd8cf6a154b29122f6157b8785ed376509b23b4a3b2fc38d2
 SHA512:
-  metadata.gz: e522c7f831673baa38cf887b1493e78e7133d930f3e857b82fefddbeeffbcc88877e4d741330a222e744170bd0e5876ec08deca5c8a00d8dc6cc520fbd0f54dc
-  data.tar.gz: 802b45c5a8d13d79f0c52ac872080a6fde0e5b64bc7ee0f46a21fbdb5be56c23ddad2f6b242b535b9a862e13b446735cb57c44ac50a9a0b021a728c620defe20
+  metadata.gz: 2129142bd86c0a7b39686d4f4c025eda3139296d1ee3a2d44ae5c80e67aa4ef85d5cbcca8424188028136cc1438946c5c6e717cb511b90d224394d49aa88d37a
+  data.tar.gz: e77f6aca567e9b3f6ba08509b928237771e85ff4433dc767ef24cf3f0113e8dda97d98491efab37846c5265657c5bf8071a41ec1cdbc4e791d58c88dc67b7be1

data/.rubocop.yml

@@ -38,6 +38,7 @@ Metrics/BlockLength:
     - 'lib/legion/cli/update_command.rb'
     - 'lib/legion/api/auth.rb'
     - 'lib/legion/api/auth_worker.rb'
+    - 'lib/legion/api/auth_human.rb'
 
 Metrics/AbcSize:
   Max: 60
@@ -48,9 +49,12 @@ Metrics/CyclomaticComplexity:
   Max: 15
   Exclude:
     - 'lib/legion/cli/chat_command.rb'
+    - 'lib/legion/api/auth_human.rb'
 
 Metrics/PerceivedComplexity:
   Max: 17
+  Exclude:
+    - 'lib/legion/api/auth_human.rb'
 
 Style/Documentation:
   Enabled: false

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Legion Changelog
 
+## [1.4.45] - 2026-03-17
+
+### Added
+- `GET /api/auth/authorize`: redirects to Entra authorization endpoint for browser-based OAuth2 login
+- `GET /api/auth/callback`: exchanges authorization code for tokens, validates id_token via JWKS, maps claims, issues Legion human JWT
+- Auth middleware SKIP_PATHS now includes `/api/auth/authorize` and `/api/auth/callback`
+
 ## [1.4.44] - 2026-03-17
 
 ### Added

data/lib/legion/api/auth_human.rb

@@ -0,0 +1,134 @@
+# frozen_string_literal: true
+
+require 'net/http'
+require 'securerandom'
+
+module Legion
+  class API < Sinatra::Base
+    module Routes
+      module AuthHuman
+        def self.registered(app)
+          register_authorize(app)
+          register_callback(app)
+        end
+
+        def self.resolve_entra_settings
+          return {} unless defined?(Legion::Settings)
+
+          rbac = Legion::Settings[:rbac]
+          entra = rbac.is_a?(Hash) ? rbac[:entra] : nil
+          return entra if entra.is_a?(Hash)
+
+          {}
+        rescue StandardError
+          {}
+        end
+
+        def self.exchange_code(entra, code)
+          uri = URI("https://login.microsoftonline.com/#{entra[:tenant_id]}/oauth2/v2.0/token")
+          response = Net::HTTP.post_form(uri, {
+                                           'client_id'     => entra[:client_id],
+                                           'client_secret' => entra[:client_secret],
+                                           'code'          => code,
+                                           'redirect_uri'  => entra[:redirect_uri],
+                                           'grant_type'    => 'authorization_code'
+                                         })
+
+          return nil unless response.is_a?(Net::HTTPSuccess)
+
+          Legion::JSON.load(response.body)
+        rescue StandardError
+          nil
+        end
+
+        def self.register_authorize(app)
+          app.get '/api/auth/authorize' do
+            entra = Routes::AuthHuman.resolve_entra_settings
+            halt 500, json_error('entra_not_configured', 'Entra OAuth settings are missing', status_code: 500) unless entra[:tenant_id] && entra[:client_id]
+
+            state = Legion::Crypt::JWT.issue(
+              { nonce: SecureRandom.hex(16), purpose: 'oauth_state' },
+              ttl: 300
+            )
+
+            query = URI.encode_www_form({
+                                          'client_id'     => entra[:client_id],
+                                          'redirect_uri'  => entra[:redirect_uri],
+                                          'response_type' => 'code',
+                                          'scope'         => 'openid profile',
+                                          'state'         => state
+                                        })
+
+            redirect "https://login.microsoftonline.com/#{entra[:tenant_id]}/oauth2/v2.0/authorize?#{query}"
+          end
+        end
+
+        def self.register_callback(app) # rubocop:disable Metrics/AbcSize
+          app.get '/api/auth/callback' do
+            entra = Routes::AuthHuman.resolve_entra_settings
+            halt 500, json_error('entra_not_configured', 'Entra OAuth settings are missing', status_code: 500) unless entra[:tenant_id] && entra[:client_id]
+
+            halt 400, json_error('oauth_error', params[:error_description] || params[:error], status_code: 400) if params[:error]
+            halt 400, json_error('missing_code', 'authorization code is required', status_code: 400) unless params[:code]
+
+            if params[:state]
+              begin
+                Legion::Crypt::JWT.verify(params[:state])
+              rescue Legion::Crypt::JWT::Error
+                halt 400, json_error('invalid_state', 'CSRF state token is invalid or expired', status_code: 400)
+              end
+            end
+
+            token_response = Routes::AuthHuman.exchange_code(entra, params[:code])
+            halt 502, json_error('token_exchange_failed', 'Failed to exchange code for tokens', status_code: 502) unless token_response
+
+            id_token = token_response[:id_token] || token_response['id_token']
+            halt 502, json_error('no_id_token', 'Entra did not return an id_token', status_code: 502) unless id_token
+
+            jwks_url = "https://login.microsoftonline.com/#{entra[:tenant_id]}/discovery/v2.0/keys"
+            issuer = "https://login.microsoftonline.com/#{entra[:tenant_id]}/v2.0"
+
+            begin
+              claims = Legion::Crypt::JWT.verify_with_jwks(id_token, jwks_url: jwks_url, issuers: [issuer])
+            rescue Legion::Crypt::JWT::Error => e
+              halt 401, json_error('invalid_id_token', e.message, status_code: 401)
+            end
+
+            unless defined?(Legion::Rbac::EntraClaimsMapper)
+              halt 501, json_error('claims_mapper_not_available', 'EntraClaimsMapper is not loaded', status_code: 501)
+            end
+
+            mapped = Legion::Rbac::EntraClaimsMapper.map_claims(
+              claims,
+              role_map:     entra[:role_map] || Legion::Rbac::EntraClaimsMapper::DEFAULT_ROLE_MAP,
+              group_map:    entra[:group_map] || {},
+              default_role: entra[:default_role] || 'worker'
+            )
+
+            ttl = 28_800
+            token = Legion::API::Token.issue_human_token(
+              msid: mapped[:sub], name: mapped[:name], roles: mapped[:roles], ttl: ttl
+            )
+
+            if request.env['HTTP_ACCEPT']&.include?('application/json')
+              json_response({
+                              access_token: token,
+                              token_type:   'Bearer',
+                              expires_in:   ttl,
+                              roles:        mapped[:roles],
+                              name:         mapped[:name]
+                            })
+            else
+              redirect_url = entra[:success_redirect] || '/api/health'
+              redirect "#{redirect_url}#access_token=#{token}"
+            end
+          end
+        end
+
+        class << self
+          private :register_authorize, :register_callback
+        end
+      end
+    end
+  end
+end

data/lib/legion/api/middleware/auth.rb

@@ -4,7 +4,8 @@ module Legion
   class API < Sinatra::Base
     module Middleware
       class Auth
-        SKIP_PATHS      = %w[/api/health /api/ready /api/openapi.json /metrics /api/auth/token /api/auth/worker-token].freeze
+        SKIP_PATHS      = %w[/api/health /api/ready /api/openapi.json /metrics /api/auth/token /api/auth/worker-token
+                             /api/auth/authorize /api/auth/callback].freeze
         AUTH_HEADER     = 'HTTP_AUTHORIZATION'
         BEARER_PATTERN  = /\ABearer\s+(.+)\z/i
         API_KEY_HEADER  = 'HTTP_X_API_KEY'

data/lib/legion/api.rb

@@ -28,6 +28,7 @@ require_relative 'api/openapi'
 require_relative 'api/rbac'
 require_relative 'api/auth'
 require_relative 'api/auth_worker'
+require_relative 'api/auth_human'
 require_relative 'api/audit'
 require_relative 'api/metrics'
 
@@ -100,6 +101,7 @@ module Legion
     register Routes::Rbac
     register Routes::Auth
     register Routes::AuthWorker
+    register Routes::AuthHuman
     register Routes::Audit
     register Routes::Metrics
 

data/lib/legion/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Legion
-  VERSION = '1.4.44'
+  VERSION = '1.4.45'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legionio
 version: !ruby/object:Gem::Version
-  version: 1.4.44
+  version: 1.4.45
 platform: ruby
 authors:
 - Esity
@@ -318,6 +318,7 @@ files:
 - lib/legion/api.rb
 - lib/legion/api/audit.rb
 - lib/legion/api/auth.rb
+- lib/legion/api/auth_human.rb
 - lib/legion/api/auth_worker.rb
 - lib/legion/api/chains.rb
 - lib/legion/api/coldstart.rb