lex-identity-entra 0.4.0 → 0.5.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e6731d955e0a738ca12ad20875132f4b3e008e56313e20a8be750ecd5fc96942
-  data.tar.gz: 785a786e42520016f0e3220e646aefed11da78375b2e8870f872a7a0c71bfd07
+  metadata.gz: 85cdc120eb3f0b5d4d17c8e5a946cc6597ad05c4281f6b058a3782f9a868c139
+  data.tar.gz: 8f74ba8695ef29922d7a058453b7ca1726c458bd5630db3ac9ed0e921185afb8
 SHA512:
-  metadata.gz: bf3abe1ea0891638459bc7b5ed151d61a5346af07f2599bcede3af0a3f606f04853fd8b0320e3eb5584045243c1b047d3c84f43dbe218d7e95cf31d2a392892f
-  data.tar.gz: 66e861f841b907ca63e1dc452458930afdba359c0a99b042b11e523164d3c919159fca0117c8469094903932ba83ae5dcd0e5a329c43df72488c92054a4100a4
+  metadata.gz: cedb8ba0c30d800b9ec234d10fe40a67cacfcf21e320786cdb735ee6025cf23b59d90dc115a05d60ee32cf61791c46cf3328e5b00c4387602715419799659361
+  data.tar.gz: cb74ced2592eb80c0d3bf06576798d44c9531af4fcac3c4215926a0e018c6c2f6d892987149792692a9b53e1c700572f2c9c7a1456e6d2e5075e933ea23799a2

data/CHANGELOG.md

@@ -1,6 +1,29 @@
 # Changelog
 
-## [Unreleased]
+## [0.5.3] - 2026-07-15
+### Fixed
+- Fix token refresh dead-end: refresh when token exists regardless of authenticated? state
+
+## [0.5.2] - 2026-07-02
+
+### Fixed
+- Load delegated Vault token before canonical identity resolution (issue #4). `TokenManager` previously gated all Vault reads/writes on canonical identity availability, but `Delegated::Identity.resolve` needs the token to *produce* that identity — a bootstrap dependency cycle that left Vault-only tokens unrecoverable on a fresh process. Added a canonical-free bootstrap Vault key (derived from tenant id + client id) for delegated tokens: reads prefer the canonical key then fall back to bootstrap; writes go to the bootstrap key before resolution and to both the canonical and bootstrap keys after. Preserves the no-placeholder-path guarantee from 0.4.1; scoped to the delegated pattern, so application/workload/managed-identity token paths are unchanged.
+
+### Fixed
+- Align delegated Broker provider lookup with registration (issue #5). `TokenManager.from_broker` now requests the `:entra_delegated` provider name that `AuthValidator#register_broker` registers; previously it asked Broker for `:entra`, and because Broker provider names are exact keys the delegated token fallback missed the registered provider. Application, workload, and managed-identity token paths are unchanged.
+
+## [0.5.0] - 2026-07-02
+
+### Added
+- Opt-in `:mail` delegated scope category (`Mail.Read` + `Mail.Send` only) for the lex-outlook build (ADR-0005). Least privilege: excludes `Mail.ReadWrite`, `MailboxSettings.Read`, and `Mail.Read.Shared`. Not a member of the default-enabled `:microsoft_graph` category, so existing delegated/Teams installs are unaffected.
+
+### Note
+- Enabling `:mail` in `identity.entra.delegated.scopes.enabled_categories` changes the delegated `scope_fingerprint` and forces a **one-time re-consent** for that qualifier. This is expected behavior (least-privilege scope opt-in), not an error.
+
+## [0.4.1] - 2026-05-18
+
+### Fixed
+- Require resolved identity before vault operations; prevents 403 errors from writing to placeholder paths
 
 ## [0.4.0] - 2026-05-18
 

data/README.md

@@ -83,12 +83,19 @@ identity:
 | Category | Description |
 |----------|-------------|
 | `microsoft_graph` | Core Graph API: User.Read, Files, Devices, OpenID scopes |
+| `mail` | Mailbox access for lex-outlook: `Mail.Read` + `Mail.Send` only (opt-in) |
 | `teams` | Teams, Chat, Channel, OnlineMeetings, Presence, Activity |
 | `one_note` | OneNote notebook read/write |
 | `sharepoint` | SharePoint/OneDrive files and sites |
 | `azure_communication_services` | Teams calls and chat management |
 | `yammer` | Viva Engage / Yammer communities and conversations |
 
+> **Note on `:mail`** — the `mail` category is opt-in and is **not** part of the
+> default-enabled `microsoft_graph` set, so existing delegated installs see no scope
+> change. Adding `mail` to `identity.entra.delegated.scopes.enabled_categories` changes
+> the delegated `scope_fingerprint` and forces a **one-time re-consent** for that
+> qualifier on next boot. This is expected least-privilege behavior, not an error.
+
 ## Token storage
 
 | Backend | Path | Priority |

data/lib/legion/extensions/identity/entra/delegated/actors/auth_validator.rb

@@ -35,6 +35,8 @@ module Legion
                     attempt_browser_reauth
                   end
                 elsif previously_authenticated?
+                  raw_data = stored_token_data
+                  log.warn('Entra delegated token expired but refresh_token available — refresh may be stuck') if raw_data && raw_data[:refresh_token]
                   if Legion::Extensions::Identity::Entra::Helpers::TokenManager.scope_fingerprint_stale?(:delegated)
                     log.info('Entra delegated scope fingerprint changed, re-authenticating to acquire updated scopes')
                   else
@@ -140,6 +142,10 @@ module Legion
                 path = Legion::Extensions::Identity::Entra::Helpers::TokenManager.local_path(:delegated)
                 File.exist?(path)
               end
+
+              def stored_token_data
+                Legion::Extensions::Identity::Entra::Helpers::TokenManager.token_data(:delegated, refresh: false)
+              end
             end
           end
         end

data/lib/legion/extensions/identity/entra/delegated/actors/token_refresher.rb

@@ -27,18 +27,20 @@ module Legion
 
               def manual
                 log.debug('Delegated TokenRefresher tick')
-                unless Legion::Extensions::Identity::Entra::Helpers::TokenManager.authenticated?(:delegated)
-                  log.debug('No active delegated token, skipping refresh')
+                data = stored_raw_data
+
+                unless data && data[:refresh_token]
+                  log.debug('No stored delegated token with refresh_token, skipping refresh')
                   return
                 end
 
-                data = Legion::Extensions::Identity::Entra::Helpers::TokenManager.token_data(:delegated, refresh: false)
-                if data && !Legion::Extensions::Identity::Entra::Helpers::TokenManager.expired?(data)
+                unless Legion::Extensions::Identity::Entra::Helpers::TokenManager.expired?(data) ||
+                       Legion::Extensions::Identity::Entra::Helpers::TokenManager.scope_fingerprint_stale?(:delegated, data)
                   log.debug('Delegated token still valid')
                   return
                 end
 
-                log.info('Delegated token nearing expiry, refreshing')
+                log.info('Delegated token expired or stale, refreshing')
                 refreshed = Legion::Extensions::Identity::Entra::Helpers::TokenManager.token_data(:delegated, refresh: true)
                 if refreshed && !Legion::Extensions::Identity::Entra::Helpers::TokenManager.expired?(refreshed)
                   Legion::Extensions::Identity::Entra::Client.reset!(pattern: :delegated)
@@ -53,6 +55,12 @@ module Legion
 
               private
 
+              def stored_raw_data
+                Legion::Extensions::Identity::Entra::Helpers::TokenManager.from_vault_data(:delegated) ||
+                  Legion::Extensions::Identity::Entra::Helpers::TokenManager.from_local_data(:delegated) ||
+                  Legion::Extensions::Identity::Entra::Helpers::TokenManager.from_memory(:delegated)
+              end
+
               def attempt_browser_reauth
                 auth_settings = Legion::Extensions::Identity::Entra::Helpers::TokenManager.settings_auth
                 return unless auth_settings[:tenant_id] && auth_settings[:client_id]

data/lib/legion/extensions/identity/entra/delegated/runners/login.rb

@@ -32,7 +32,7 @@ module Legion
                 deadline = Time.now + timeout
                 current_interval = interval
 
-                loop do
+                while Time.now <= deadline
                   body = oauth_post(tenant_id, 'oauth2/v2.0/token',
                                     grant_type:  'urn:ietf:params:oauth:grant-type:device_code',
                                     client_id:   client_id,
@@ -44,10 +44,6 @@ module Legion
 
                   case body[:error]
                   when 'authorization_pending'
-                    if Time.now > deadline
-                      log.warn("Login.poll_device_code: timed out after #{timeout}s")
-                      return { error: 'timeout', description: "Device code flow timed out after #{timeout}s" }
-                    end
                     sleep(current_interval)
                   when 'slow_down'
                     current_interval += 5
@@ -57,6 +53,9 @@ module Legion
                     return { error: body[:error], description: body[:error_description] }
                   end
                 end
+
+                log.warn("Login.poll_device_code: timed out after #{timeout}s")
+                { error: 'timeout', description: "Device code flow timed out after #{timeout}s" }
               rescue StandardError => e
                 handle_exception(e, level: :error, operation: 'delegated.login.poll_device_code')
                 { error: 'request_failed', description: e.message }

data/lib/legion/extensions/identity/entra/delegated/scopes.rb

@@ -24,6 +24,22 @@ module Legion
                 CallTranscripts.Read.All
                 Channel.ReadBasic.All
               ],
+              # Opt-in mailbox access for the signed-in user (lex-outlook, ADR-0005).
+              # Least privilege: Mail.Read + Mail.Send ONLY. Deliberately excludes
+              # Mail.ReadWrite (create/update/delete/move), MailboxSettings.Read
+              # (auto-reply/timezone/working-hours), and Mail.Read.Shared — no v1
+              # lex-outlook runner needs them, so they are deferred to a later
+              # fingerprint-changing edit when a runner actually requires them.
+              #
+              # NOT a member of :microsoft_graph, so existing delegated/Teams
+              # installs see no scope change and no forced re-consent. Enabling
+              # :mail in identity.entra.delegated.scopes.enabled_categories changes
+              # the delegated scope_fingerprint and forces a one-time re-consent for
+              # that qualifier — expected behavior, not an error (see README).
+              mail:                         %w[
+                Mail.Read
+                Mail.Send
+              ],
               teams:                        %w[
                 Chat.Create
                 Chat.Read

data/lib/legion/extensions/identity/entra/helpers/callback_server.rb

@@ -56,7 +56,7 @@ module Legion
             private
 
             def listen
-              loop do
+              until @result
                 client = @server.accept
                 request_line = client.gets
                 drain_headers(client)
@@ -64,7 +64,6 @@ module Legion
 
                 client.print "HTTP/1.1 200 OK\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n#{RESPONSE_HTML}"
                 client.close
-                break if @result
               end
             rescue IOError # rubocop:disable Legion/RescueLogging/NoCapture
               nil
@@ -76,10 +75,8 @@ module Legion
             end
 
             def drain_headers(client)
-              loop do
-                line = client.gets
-                break if line.nil? || line.strip.empty?
-              end
+              line = client.gets
+              line = client.gets until line.nil? || line.strip.empty?
             end
 
             def capture_callback(request_line)

data/lib/legion/extensions/identity/entra/helpers/token_manager.rb

@@ -51,6 +51,10 @@ module Legion
               return nil unless data
 
               if scope_fingerprint_stale?(qualifier, data)
+                if refresh && data[:refresh_token]
+                  log.info("TokenManager.token_data: scope fingerprint mismatch for #{qualifier}, attempting refresh with current scopes")
+                  return refresh_token(qualifier, data)
+                end
                 log.info("TokenManager.token_data: scope fingerprint mismatch for #{qualifier}, forcing re-auth")
                 return nil
               end
@@ -85,15 +89,24 @@ module Legion
             end
 
             def from_vault_data(qualifier)
-              return nil unless vault_available? && canonical_name_available?
+              return nil unless vault_available?
+
+              # Prefer the canonical (post-resolution) path, then fall back to the
+              # bootstrap path so a fresh process can recover a Vault-only token
+              # before Legion::Identity::Process is resolved (issue #4).
+              read_vault_token(qualifier, vault_path(qualifier)) ||
+                read_vault_token(qualifier, bootstrap_vault_path(qualifier))
+            end
+
+            def read_vault_token(qualifier, path)
+              return nil unless path
 
-              path = vault_path(qualifier)
               log.debug("TokenManager.from_vault_data: reading kv/#{path}")
               result = vault_kv_client.read(path)
               normalize_token_data(result&.data)
             rescue StandardError => e
               handle_exception(e, level: :warn, operation: 'token_manager.from_vault_data',
-                                  qualifier: qualifier)
+                                  qualifier: qualifier, path: path)
               nil
             end
 
@@ -112,19 +125,26 @@ module Legion
             def save_to_vault(qualifier, access_token:, refresh_token:, expires_at:,
                               scopes: nil, tenant_id: nil, client_id: nil, scope_fingerprint: nil)
               return unless vault_available?
-              return unless canonical_name_available?
 
-              path = vault_path(qualifier)
+              # When canonical identity is resolved, write the canonical key (and
+              # alias to the bootstrap key so a later fresh process can recover it
+              # before resolution). Before resolution, fall back to the bootstrap
+              # key so we never write to a placeholder (anonymous) canonical path.
+              paths = [vault_path(qualifier), bootstrap_vault_path(qualifier)].compact.uniq
+              return if paths.empty?
+
               cluster = Legion::Crypt.respond_to?(:default_cluster_name) ? Legion::Crypt.default_cluster_name : 'vault'
-              log.info("TokenManager.save_to_vault: writing to #{cluster} :: kv/data/#{path} qualifier=#{qualifier}")
-              vault_kv_client.write(path,
-                                    access_token:      access_token,
-                                    refresh_token:     refresh_token,
-                                    expires_at:        expires_at&.utc&.iso8601,
-                                    scopes:            scopes,
-                                    tenant_id:         tenant_id,
-                                    client_id:         client_id,
-                                    scope_fingerprint: scope_fingerprint)
+              paths.each do |path|
+                log.info("TokenManager.save_to_vault: writing to #{cluster} :: kv/data/#{path} qualifier=#{qualifier}")
+                vault_kv_client.write(path,
+                                      access_token:      access_token,
+                                      refresh_token:     refresh_token,
+                                      expires_at:        expires_at&.utc&.iso8601,
+                                      scopes:            scopes,
+                                      tenant_id:         tenant_id,
+                                      client_id:         client_id,
+                                      scope_fingerprint: scope_fingerprint)
+              end
               log.info('TokenManager.save_to_vault: success')
               true
             rescue StandardError => e
@@ -249,7 +269,7 @@ module Legion
               return nil unless defined?(Legion::Identity::Broker)
 
               log.debug("TokenManager.from_broker: requesting token for #{qualifier}")
-              token = Legion::Identity::Broker.token_for(:entra, qualifier: qualifier)
+              token = Legion::Identity::Broker.token_for(:entra_delegated, qualifier: qualifier)
               log.debug("TokenManager.from_broker: #{token ? 'received' : 'not available'}")
               token
             rescue StandardError => e
@@ -285,6 +305,26 @@ module Legion
               "users/#{Legion::Identity::Process.canonical_name}/entra/#{qualifier}/auth"
             end
 
+            # Pre-resolution Vault key for delegated tokens, derived from stable
+            # inputs (tenant id + client id) that are available before canonical
+            # identity resolution. Lets a fresh process recover a Vault-only
+            # delegated token so it can resolve identity (issue #4). Scoped to
+            # delegated only — other patterns are unaffected.
+            def bootstrap_vault_path(qualifier)
+              return nil unless qualifier.to_sym == :delegated
+
+              auth = settings_auth
+              pattern_settings = auth[qualifier.to_sym]
+              return pattern_settings[:vault_path] if pattern_settings.is_a?(Hash) && pattern_settings[:vault_path]
+
+              tenant_id = auth[:tenant_id]
+              client_id = auth[:client_id]
+              return nil unless tenant_id && client_id
+
+              account = Digest::MD5.hexdigest("#{tenant_id}:#{client_id}")
+              "bootstrap/entra/#{qualifier}/#{account}/auth"
+            end
+
             def local_path(qualifier)
               auth = settings_auth
               pattern_settings = auth[qualifier.to_sym]
@@ -354,7 +394,8 @@ module Legion
 
             def canonical_name_available?
               return false unless defined?(Legion::Identity::Process)
-              return false unless Legion::Identity::Process.respond_to?(:canonical_name)
+              return false unless Legion::Identity::Process.respond_to?(:resolved?) &&
+                                  Legion::Identity::Process.resolved?
 
               name = Legion::Identity::Process.canonical_name
               !name.nil? && !name.empty? && name != 'anonymous'

data/lib/legion/extensions/identity/entra/version.rb

@@ -4,7 +4,7 @@ module Legion
   module Extensions
     module Identity
       module Entra
-        VERSION = '0.4.0'
+        VERSION = '0.5.3'
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lex-identity-entra
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.3
 platform: ruby
 authors:
 - Esity