lex-identity-entra 0.3.0

data/lib/legion/extensions/identity/entra/client.rb

@@ -0,0 +1,181 @@
+# frozen_string_literal: true
+
+require 'concurrent-ruby'
+require 'faraday'
+require 'legion/extensions/identity/entra/helpers/scopes'
+require 'legion/extensions/identity/entra/helpers/scope_registry'
+require 'legion/extensions/identity/entra/helpers/token_manager'
+
+module Legion
+  module Extensions
+    module Identity
+      module Entra
+        class Client
+          GRAPH_BASE = 'https://graph.microsoft.com/v1.0'
+
+          @instances = Concurrent::Map.new
+          @registries = Concurrent::Map.new
+
+          class << self
+            def instance(pattern: :delegated)
+              @instances.compute_if_absent(pattern.to_sym) { client_class_for(pattern).new }
+            end
+
+            def graph(pattern: :delegated)
+              instance(pattern: pattern).connection
+            end
+
+            def registry(pattern: :delegated)
+              @registries.compute_if_absent(pattern.to_sym) do
+                Legion::Extensions::Identity::Entra::Helpers::ScopeRegistry.new(pattern: pattern)
+              end
+            end
+
+            def permitted?(scope, pattern: :delegated)
+              registry(pattern: pattern).permitted?(scope)
+            end
+
+            def permitted_all?(*scopes, pattern: :delegated)
+              registry(pattern: pattern).permitted_all?(*scopes)
+            end
+
+            def permitted_any?(*scopes, pattern: :delegated)
+              registry(pattern: pattern).permitted_any?(*scopes)
+            end
+
+            def denied_scopes(pattern: :delegated)
+              registry(pattern: pattern).denied
+            end
+
+            def reset!(pattern: nil)
+              if pattern
+                @instances.delete(pattern.to_sym)
+                @registries[pattern.to_sym]&.reset!
+              else
+                @instances.clear
+                @registries.each_value(&:reset!)
+              end
+            end
+
+            def authenticated?(pattern: :delegated)
+              Legion::Extensions::Identity::Entra::Helpers::TokenManager.authenticated?(pattern)
+            end
+
+            private
+
+            def client_class_for(pattern)
+              case pattern.to_sym
+              when :delegated        then Delegated::Client
+              when :application      then Application::Client
+              when :managed_identity then ManagedIdentity::Client
+              when :workload_identity then WorkloadIdentity::Client
+              else self
+              end
+            end
+          end
+
+          def initialize
+            @connection = Concurrent::AtomicReference.new(nil)
+            @access_token = Concurrent::AtomicReference.new(nil)
+          end
+
+          def pattern
+            raise NotImplementedError, "#{self.class} must define #pattern"
+          end
+
+          def connection
+            @connection.set(nil) if token_expired?
+            conn = @connection.get
+            return conn if conn
+
+            @connection.compare_and_set(nil, build_connection)
+            @connection.get
+          end
+
+          def get(path, params: {})
+            connection.get(path, params)
+          end
+
+          def post(path, body: {})
+            connection.post(path) do |req|
+              req.headers['Content-Type'] = 'application/json'
+              req.body = json_dump(body)
+            end
+          end
+
+          def patch(path, body: {})
+            connection.patch(path) do |req|
+              req.headers['Content-Type'] = 'application/json'
+              req.body = json_dump(body)
+            end
+          end
+
+          def delete(path)
+            connection.delete(path)
+          end
+
+          def access_token
+            @access_token.set(nil) if token_expired?
+            token = @access_token.get
+            return token if token
+
+            resolved = resolve_token
+            @access_token.compare_and_set(nil, resolved)
+            @access_token.get
+          end
+
+          private
+
+          def resolve_token
+            token = Legion::Extensions::Identity::Entra::Helpers::TokenManager.load_token(pattern)
+            if token
+              sync_registry_from_cache
+              return token
+            end
+
+            authenticate
+            Legion::Extensions::Identity::Entra::Helpers::TokenManager.load_token(pattern)
+          end
+
+          def sync_registry_from_cache
+            data = Legion::Extensions::Identity::Entra::Helpers::TokenManager.token_data(pattern, refresh: false)
+            return unless data&.dig(:scopes)
+
+            reg = Legion::Extensions::Identity::Entra::Client.registry(pattern: pattern)
+            reg.record_requested(Legion::Extensions::Identity::Entra::Helpers::Scopes.resolve(pattern: pattern))
+            reg.record_granted(data[:scopes])
+          end
+
+          def authenticate
+            raise NotImplementedError, "#{self.class} must implement #authenticate"
+          end
+
+          def build_connection
+            token = access_token
+            Faraday.new(url: GRAPH_BASE) do |f|
+              f.headers['Authorization'] = "Bearer #{token}"
+              f.headers['Accept'] = 'application/json'
+              f.options.open_timeout = 5
+              f.options.timeout = 30
+            end
+          end
+
+          def token_expired?
+            data = Legion::Extensions::Identity::Entra::Helpers::TokenManager.token_data(pattern, refresh: false)
+            return true unless data
+
+            Legion::Extensions::Identity::Entra::Helpers::TokenManager.expired?(data)
+          end
+
+          def registry
+            Legion::Extensions::Identity::Entra::Client.registry(pattern: pattern)
+          end
+
+          def auth_settings
+            Legion::Extensions::Identity::Entra::Helpers::TokenManager.settings_auth
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/identity/entra/delegated/actors/auth_validator.rb

@@ -0,0 +1,149 @@
+# frozen_string_literal: true
+
+module Legion
+  module Extensions
+    module Identity
+      module Entra
+        module Delegated
+          module Actor
+            class AuthValidator < Legion::Extensions::Actors::Once
+              def runner_class    = self.class
+              def runner_function = 'manual'
+              def use_runner?     = false
+              def check_subtask?  = false
+              def generate_task?  = false
+
+              def delay
+                9.0
+              end
+
+              def enabled? # rubocop:disable Legion/Extension/ActorEnabledSideEffects
+                true
+              end
+
+              def manual
+                log.info('Entra Delegated AuthValidator starting')
+                client = Legion::Extensions::Identity::Entra::Client.instance(pattern: :delegated)
+
+                if Legion::Extensions::Identity::Entra::Helpers::TokenManager.authenticated?(:delegated)
+                  token = client.access_token
+                  if token
+                    log.info('Entra delegated auth valid')
+                    upgrade_identity
+                  elsif auto_authenticate?
+                    log.info('Entra delegated token expired, attempting browser re-auth')
+                    attempt_browser_reauth
+                  end
+                elsif previously_authenticated?
+                  if Legion::Extensions::Identity::Entra::Helpers::TokenManager.scope_fingerprint_stale?(:delegated)
+                    log.info('Entra delegated scope fingerprint changed, re-authenticating to acquire updated scopes')
+                  else
+                    log.info('Entra delegated token file found but expired, attempting re-auth')
+                  end
+                  attempt_browser_reauth
+                elsif auto_authenticate?
+                  log.info('auto_authenticate enabled, opening browser for initial auth')
+                  attempt_browser_reauth
+                else
+                  log.debug('No Entra delegated auth configured, skipping')
+                end
+                log.info('Entra Delegated AuthValidator complete')
+              rescue StandardError => e
+                log.error("AuthValidator: #{e.message}")
+              end
+
+              private
+
+              def attempt_browser_reauth
+                auth_settings = Legion::Extensions::Identity::Entra::Helpers::TokenManager.settings_auth
+                unless auth_settings[:tenant_id] && auth_settings[:client_id]
+                  log.warn('Cannot re-auth: missing tenant_id or client_id')
+                  return false
+                end
+
+                scopes = Legion::Extensions::Identity::Entra::Helpers::Scopes.resolve(pattern: :delegated)
+                browser = Legion::Extensions::Identity::Entra::Helpers::BrowserAuth.new(
+                  tenant_id: auth_settings[:tenant_id],
+                  client_id: auth_settings[:client_id],
+                  scopes:    scopes
+                )
+
+                result = browser.authenticate
+                if result[:error]
+                  log.error("Browser auth error: #{result[:error]} - #{result[:description]}")
+                  return false
+                end
+
+                body = result[:result]
+                Legion::Extensions::Identity::Entra::Helpers::TokenManager.save_token(
+                  :delegated,
+                  access_token:  body[:access_token],
+                  refresh_token: body[:refresh_token],
+                  expires_in:    body[:expires_in],
+                  scopes:        body[:scope] || scopes,
+                  tenant_id:     auth_settings[:tenant_id],
+                  client_id:     auth_settings[:client_id]
+                )
+                Legion::Extensions::Identity::Entra::Client.reset!(pattern: :delegated)
+                upgrade_identity
+                log.info('Entra delegated auth restored via browser')
+                true
+              rescue StandardError => e
+                log.error("Browser re-auth failed: #{e.message}")
+                false
+              end
+
+              def upgrade_identity
+                return unless defined?(Legion::Identity::Resolver)
+
+                identity_module = Legion::Extensions::Identity::Entra::Delegated::Identity
+                result = identity_module.resolve
+                unless result
+                  log.warn('AuthValidator.upgrade_identity: resolve returned nil, skipping upgrade')
+                  return
+                end
+
+                Legion::Identity::Resolver.upgrade!(identity_module, result)
+                log.info("AuthValidator.upgrade_identity: identity upgraded canonical=#{result[:canonical_name]}")
+                register_broker
+              rescue StandardError => e
+                log.error("AuthValidator.upgrade_identity failed: #{e.message}")
+              end
+
+              def register_broker
+                return unless defined?(Legion::Identity::Broker)
+
+                identity_module = Legion::Extensions::Identity::Entra::Delegated::Identity
+                lease = identity_module.provide_token(qualifier: :delegated)
+                unless lease
+                  log.warn('AuthValidator.register_broker: provide_token returned nil, skipping broker registration')
+                  return
+                end
+
+                Legion::Identity::Broker.register_provider(
+                  :entra_delegated,
+                  provider:  identity_module,
+                  lease:     lease,
+                  qualifier: :delegated,
+                  default:   true
+                )
+                log.info('AuthValidator.register_broker: entra_delegated registered with broker qualifier=delegated')
+              rescue StandardError => e
+                log.error("AuthValidator.register_broker failed: #{e.message}")
+              end
+
+              def auto_authenticate?
+                Legion::Settings.dig(:identity, :entra, :delegated, :browser_auth, :auto_authenticate) == true
+              end
+
+              def previously_authenticated?
+                path = Legion::Extensions::Identity::Entra::Helpers::TokenManager.local_path(:delegated)
+                File.exist?(path)
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/identity/entra/delegated/actors/token_refresher.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+module Legion
+  module Extensions
+    module Identity
+      module Entra
+        module Delegated
+          module Actor
+            class TokenRefresher < Legion::Extensions::Actors::Every
+              DEFAULT_REFRESH_INTERVAL = 900
+
+              def runner_class    = self.class
+              def runner_function = 'manual'
+              def use_runner?     = false
+              def check_subtask?  = false
+              def generate_task?  = false
+              def run_now?        = false
+
+              def time
+                Legion::Settings.dig(:identity, :entra, :delegated, :token, :refresh_interval) ||
+                  DEFAULT_REFRESH_INTERVAL
+              end
+
+              def enabled? # rubocop:disable Legion/Extension/ActorEnabledSideEffects
+                true
+              end
+
+              def manual
+                log.debug('Delegated TokenRefresher tick')
+                unless Legion::Extensions::Identity::Entra::Helpers::TokenManager.authenticated?(:delegated)
+                  log.debug('No active delegated token, skipping refresh')
+                  return
+                end
+
+                data = Legion::Extensions::Identity::Entra::Helpers::TokenManager.token_data(:delegated, refresh: false)
+                if data && !Legion::Extensions::Identity::Entra::Helpers::TokenManager.expired?(data)
+                  log.debug('Delegated token still valid')
+                  return
+                end
+
+                log.info('Delegated token nearing expiry, refreshing')
+                refreshed = Legion::Extensions::Identity::Entra::Helpers::TokenManager.token_data(:delegated, refresh: true)
+                if refreshed && !Legion::Extensions::Identity::Entra::Helpers::TokenManager.expired?(refreshed)
+                  Legion::Extensions::Identity::Entra::Client.reset!(pattern: :delegated)
+                  log.info('Delegated token refreshed successfully')
+                else
+                  log.warn('Delegated token refresh failed, attempting browser re-auth')
+                  attempt_browser_reauth
+                end
+              rescue StandardError => e
+                log.error("Delegated TokenRefresher: #{e.message}")
+              end
+
+              private
+
+              def attempt_browser_reauth
+                auth_settings = Legion::Extensions::Identity::Entra::Helpers::TokenManager.settings_auth
+                return unless auth_settings[:tenant_id] && auth_settings[:client_id]
+
+                scopes = Legion::Extensions::Identity::Entra::Helpers::Scopes.resolve(pattern: :delegated)
+                browser = Legion::Extensions::Identity::Entra::Helpers::BrowserAuth.new(
+                  tenant_id: auth_settings[:tenant_id],
+                  client_id: auth_settings[:client_id],
+                  scopes:    scopes
+                )
+
+                result = browser.authenticate
+                body = result&.dig(:result)
+                return unless body&.dig(:access_token)
+
+                Legion::Extensions::Identity::Entra::Helpers::TokenManager.save_token(
+                  :delegated,
+                  access_token:  body[:access_token],
+                  refresh_token: body[:refresh_token],
+                  expires_in:    body[:expires_in],
+                  scopes:        body[:scope] || scopes,
+                  tenant_id:     auth_settings[:tenant_id],
+                  client_id:     auth_settings[:client_id]
+                )
+                Legion::Extensions::Identity::Entra::Client.reset!(pattern: :delegated)
+                log.info('Delegated auth restored via browser re-auth')
+              rescue StandardError => e
+                log.error("Delegated browser re-auth failed: #{e.message}")
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/identity/entra/delegated/cli/auth.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+module Legion
+  module Extensions
+    module Identity
+      module Entra
+        module Delegated
+          module CLI
+            class Auth
+              def self.cli_alias = 'entra'
+
+              def self.descriptions
+                {
+                  login:  'Authenticate with Microsoft Entra via delegated OAuth',
+                  status: 'Show current Entra authentication state'
+                }
+              end
+
+              def login(tenant_id: nil, client_id: nil, scopes: nil, **)
+                settings = tenant_id && client_id ? {} : resolve_settings
+                tid = tenant_id || settings[:tenant_id] || ENV.fetch('AZURE_TENANT_ID', nil)
+                cid = client_id || settings[:client_id] || ENV.fetch('AZURE_CLIENT_ID', nil)
+                requested_scopes = scopes || settings.dig(:delegated, :scopes) || Helpers::BrowserAuth.default_scopes
+
+                unless tid && cid
+                  puts 'Error: tenant_id and client_id required (set identity.entra.auth, env vars, or pass as args)'
+                  return { error: 'missing_config' }
+                end
+
+                browser_auth = Helpers::BrowserAuth.new(tenant_id: tid, client_id: cid,
+                                                        scopes: requested_scopes, force_local_server: true)
+                result = browser_auth.authenticate
+                body = result&.dig(:result)
+
+                if body&.dig(:access_token)
+                  store_token(body, tenant_id: tid, client_id: cid, scopes: requested_scopes)
+                  puts 'Entra authenticated successfully.'
+                else
+                  puts 'Entra authentication failed or was cancelled.'
+                end
+
+                result
+              rescue StandardError => e
+                puts "Error: #{e.message}"
+                { error: 'login_failed', description: e.message }
+              end
+
+              def status
+                data = Helpers::TokenManager.token_data(:delegated, refresh: false)
+                if data && !Helpers::TokenManager.expired?(data)
+                  puts 'Entra: authenticated (delegated token present)'
+                  { result: { authenticated: true, expires_at: data[:expires_at]&.utc&.iso8601 } }
+                else
+                  puts 'Entra: not authenticated'
+                  { result: { authenticated: false } }
+                end
+              end
+
+              private
+
+              def resolve_settings
+                Helpers::TokenManager.settings_auth
+              end
+
+              def store_token(body, tenant_id:, client_id:, scopes:)
+                Helpers::TokenManager.save_token(
+                  :delegated,
+                  access_token:  body[:access_token],
+                  refresh_token: body[:refresh_token],
+                  expires_in:    body[:expires_in],
+                  scopes:        body[:scope] || scopes,
+                  tenant_id:     tenant_id,
+                  client_id:     client_id
+                )
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/identity/entra/delegated/client.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module Legion
+  module Extensions
+    module Identity
+      module Entra
+        module Delegated
+          class Client < Legion::Extensions::Identity::Entra::Client
+            def pattern = :delegated
+
+            private
+
+            def authenticate
+              settings = auth_settings
+              return unless settings[:tenant_id] && settings[:client_id]
+
+              requested = Legion::Extensions::Identity::Entra::Helpers::Scopes.resolve(pattern: :delegated)
+              registry.record_requested(requested)
+
+              browser = Legion::Extensions::Identity::Entra::Helpers::BrowserAuth.new(
+                tenant_id: settings[:tenant_id],
+                client_id: settings[:client_id],
+                scopes:    requested
+              )
+              result = browser.authenticate
+              body = result&.dig(:result)
+              return unless body&.dig(:access_token)
+
+              granted = body[:scope] || requested
+              registry.record_granted(granted)
+              Legion::Extensions::Identity::Entra::Helpers::TokenManager.save_token(
+                :delegated,
+                access_token:  body[:access_token],
+                refresh_token: body[:refresh_token],
+                expires_in:    body[:expires_in],
+                scopes:        granted,
+                tenant_id:     settings[:tenant_id],
+                client_id:     settings[:client_id]
+              )
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/identity/entra/delegated/hooks/auth.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+if defined?(Legion::Extensions::Hooks::Base)
+  module Legion
+    module Extensions
+      module Identity
+        module Entra
+          module Delegated
+            module Hooks
+              class Auth < Legion::Extensions::Hooks::Base # rubocop:disable Legion/Extension/HookMissingRunnerClass
+                mount '/callback'
+
+                def self.runner_class
+                  'Legion::Extensions::Identity::Entra::Delegated::Runners::Login'
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/identity/entra/delegated/identity.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+module Legion
+  module Extensions
+    module Identity
+      module Entra
+        module Delegated
+          module Identity
+            extend self
+            include Legion::Logging::Helper
+            include Legion::Settings::Helper
+
+            def provider_name  = :entra_delegated
+            def provider_type  = :auth
+            def priority       = 100
+            def trust_weight   = 40
+            def trust_level    = :verified
+            def capabilities   = %i[authenticate profile interactive outbound_auth]
+
+            def resolve
+              log.debug('Delegated::Identity.resolve: starting identity resolution')
+              token = find_cached_token
+              unless token
+                log.debug('Delegated::Identity.resolve: no cached token, cannot resolve')
+                return nil
+              end
+
+              profile = Legion::Extensions::Identity::Entra::Helpers::GraphClient.fetch_me(token)
+              unless profile
+                log.warn('Delegated::Identity.resolve: Graph /me returned nil')
+                return nil
+              end
+
+              canonical = profile[:on_premises_sam_account_name] || profile[:mail_nickname]
+              if canonical.nil? || canonical.empty?
+                log.warn('Delegated::Identity.resolve: no canonical name in profile')
+                return nil
+              end
+
+              log.info("Delegated::Identity.resolve: resolved identity canonical=#{normalize(canonical)}")
+              {
+                canonical_name:    normalize(canonical),
+                kind:              :human,
+                source:            :entra_delegated,
+                provider_identity: profile[:id],
+                profile:           profile,
+                employee_id:       profile[:employee_id]
+              }
+            end
+
+            def resolve_all
+              accounts = Legion::Extensions::Identity::Entra::Helpers::AccountDiscovery.resolve_all_accounts
+              return accounts unless accounts.empty?
+
+              result = resolve
+              result ? [result] : []
+            end
+
+            def refresh
+              log.debug('Delegated::Identity.refresh: attempting token refresh')
+              data = Legion::Extensions::Identity::Entra::Helpers::TokenManager.token_data(:delegated, refresh: true)
+              if data && !Legion::Extensions::Identity::Entra::Helpers::TokenManager.expired?(data)
+                Legion::Extensions::Identity::Entra::Client.reset!(pattern: :delegated)
+                log.info('Delegated::Identity.refresh: token refreshed successfully')
+                true
+              else
+                log.warn('Delegated::Identity.refresh: token refresh returned expired or nil data')
+                false
+              end
+            rescue StandardError => e
+              handle_exception(e, level: :warn, operation: 'delegated.identity.refresh')
+              false
+            end
+
+            def normalize(val)
+              str = val.to_s.downcase.strip
+              str = str.split('@', 2).first if str.include?('@')
+              str.gsub(/[^a-z0-9_-]/, '')
+            end
+
+            def provide_token(qualifier: :delegated)
+              token = find_cached_token(qualifier)
+              return nil unless token
+
+              data = Legion::Extensions::Identity::Entra::Helpers::TokenManager.token_data(qualifier, refresh: false)
+              build_lease(
+                provider:   :entra_delegated,
+                credential: token,
+                expires_at: data&.dig(:expires_at) || (Time.now + 3600),
+                renewable:  !data&.dig(:refresh_token).nil?,
+                metadata:   { qualifier: qualifier, scopes: data&.dig(:scopes) }.compact
+              )
+            end
+
+            private
+
+            def find_cached_token(qualifier = :delegated)
+              log.debug("Delegated::Identity.find_cached_token: qualifier=#{qualifier}")
+              Legion::Extensions::Identity::Entra::Helpers::TokenManager.load_token(qualifier)
+            rescue StandardError => e
+              handle_exception(e, level: :warn, operation: 'delegated.identity.find_cached_token',
+                                  qualifier: qualifier)
+              nil
+            end
+
+            def build_lease(**attrs)
+              return Legion::Identity::Lease.new(**attrs) if defined?(Legion::Identity::Lease)
+
+              attrs
+            end
+          end
+        end
+      end
+    end
+  end
+end