lex-identity-entra 0.4.1 → 0.5.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e7177778379b280a2ad07bec74ee53d23cde1a1836d0cd383147c7b698eee92b
-  data.tar.gz: f94406e11d549ee543ccbc4c5355e8f2f0f6c3dd33627536b05c4a98664d7e39
+  metadata.gz: a50147c3bd7a673e611e5191168b9ade2fe468041ad2b320fccba89dc267a999
+  data.tar.gz: a0889be0de3da89dedae7360058f0463ae8570a735b5f759750f74bf0e720974
 SHA512:
-  metadata.gz: 1ed5170ea80a10cdb6794d35b9ea89b0ad8a74abf8bbadd75be3615679e218d85a8473b83abc8c9aa9c03b79a565befbda5afe52633ca9f6aa0f0c053993a56a
-  data.tar.gz: ae42e1bc9f07607d20f810ce84f7ba0ce78ec8f10768105d85b92e4e214a91da1b5d58d2b89be1cc9c69fe1263a8ffe0736fd9ed7c8ca5a6a0a78361947bba47
+  metadata.gz: bf3ff78771dc93dea6cb326c1577d6421382575e714eb4ef25ae67ca07cbeceab37f5b616dd9a611eea85e3ff31d868964878f85409ced0e8688510d3231e8d8
+  data.tar.gz: 74f7b159ecc89ba0e306273e3e6438b81d8cb1ad09c52d5e2f9c1fb1d6cf4de95e06de62317c8253c8a69b9bfd9cb365ca5785ffede017d0e365dfbfd9502e61

data/CHANGELOG.md

@@ -1,6 +1,28 @@
 # Changelog
 
-## [Unreleased]
+## [0.5.4] - 2026-08-04
+### Fixed
+- Stop writing delegated Entra tokens to bootstrap Vault paths. Token persistence now uses only the canonical `users/<identity>/entra/<qualifier>/auth` Vault path and falls back to local disk until a canonical identity is available.
+
+## [0.5.3] - 2026-07-15
+### Fixed
+- Fix token refresh dead-end: refresh when token exists regardless of authenticated? state
+
+## [0.5.2] - 2026-07-02
+
+### Fixed
+- Load delegated Vault token before canonical identity resolution (issue #4). `TokenManager` previously gated all Vault reads/writes on canonical identity availability, but `Delegated::Identity.resolve` needs the token to *produce* that identity — a bootstrap dependency cycle that left Vault-only tokens unrecoverable on a fresh process. Added a canonical-free bootstrap Vault key (derived from tenant id + client id) for delegated tokens: reads prefer the canonical key then fall back to bootstrap; writes go to the bootstrap key before resolution and to both the canonical and bootstrap keys after. Preserves the no-placeholder-path guarantee from 0.4.1; scoped to the delegated pattern, so application/workload/managed-identity token paths are unchanged.
+
+### Fixed
+- Align delegated Broker provider lookup with registration (issue #5). `TokenManager.from_broker` now requests the `:entra_delegated` provider name that `AuthValidator#register_broker` registers; previously it asked Broker for `:entra`, and because Broker provider names are exact keys the delegated token fallback missed the registered provider. Application, workload, and managed-identity token paths are unchanged.
+
+## [0.5.0] - 2026-07-02
+
+### Added
+- Opt-in `:mail` delegated scope category (`Mail.Read` + `Mail.Send` only) for the lex-outlook build (ADR-0005). Least privilege: excludes `Mail.ReadWrite`, `MailboxSettings.Read`, and `Mail.Read.Shared`. Not a member of the default-enabled `:microsoft_graph` category, so existing delegated/Teams installs are unaffected.
+
+### Note
+- Enabling `:mail` in `identity.entra.delegated.scopes.enabled_categories` changes the delegated `scope_fingerprint` and forces a **one-time re-consent** for that qualifier. This is expected behavior (least-privilege scope opt-in), not an error.
 
 ## [0.4.1] - 2026-05-18
 

data/README.md

@@ -83,12 +83,19 @@ identity:
 | Category | Description |
 |----------|-------------|
 | `microsoft_graph` | Core Graph API: User.Read, Files, Devices, OpenID scopes |
+| `mail` | Mailbox access for lex-outlook: `Mail.Read` + `Mail.Send` only (opt-in) |
 | `teams` | Teams, Chat, Channel, OnlineMeetings, Presence, Activity |
 | `one_note` | OneNote notebook read/write |
 | `sharepoint` | SharePoint/OneDrive files and sites |
 | `azure_communication_services` | Teams calls and chat management |
 | `yammer` | Viva Engage / Yammer communities and conversations |
 
+> **Note on `:mail`** — the `mail` category is opt-in and is **not** part of the
+> default-enabled `microsoft_graph` set, so existing delegated installs see no scope
+> change. Adding `mail` to `identity.entra.delegated.scopes.enabled_categories` changes
+> the delegated `scope_fingerprint` and forces a **one-time re-consent** for that
+> qualifier on next boot. This is expected least-privilege behavior, not an error.
+
 ## Token storage
 
 | Backend | Path | Priority |

data/lib/legion/extensions/identity/entra/delegated/actors/auth_validator.rb

@@ -35,6 +35,8 @@ module Legion
                     attempt_browser_reauth
                   end
                 elsif previously_authenticated?
+                  raw_data = stored_token_data
+                  log.warn('Entra delegated token expired but refresh_token available — refresh may be stuck') if raw_data && raw_data[:refresh_token]
                   if Legion::Extensions::Identity::Entra::Helpers::TokenManager.scope_fingerprint_stale?(:delegated)
                     log.info('Entra delegated scope fingerprint changed, re-authenticating to acquire updated scopes')
                   else
@@ -140,6 +142,10 @@ module Legion
                 path = Legion::Extensions::Identity::Entra::Helpers::TokenManager.local_path(:delegated)
                 File.exist?(path)
               end
+
+              def stored_token_data
+                Legion::Extensions::Identity::Entra::Helpers::TokenManager.token_data(:delegated, refresh: false)
+              end
             end
           end
         end

data/lib/legion/extensions/identity/entra/delegated/actors/token_refresher.rb

@@ -27,18 +27,20 @@ module Legion
 
               def manual
                 log.debug('Delegated TokenRefresher tick')
-                unless Legion::Extensions::Identity::Entra::Helpers::TokenManager.authenticated?(:delegated)
-                  log.debug('No active delegated token, skipping refresh')
+                data = stored_raw_data
+
+                unless data && data[:refresh_token]
+                  log.debug('No stored delegated token with refresh_token, skipping refresh')
                   return
                 end
 
-                data = Legion::Extensions::Identity::Entra::Helpers::TokenManager.token_data(:delegated, refresh: false)
-                if data && !Legion::Extensions::Identity::Entra::Helpers::TokenManager.expired?(data)
+                unless Legion::Extensions::Identity::Entra::Helpers::TokenManager.expired?(data) ||
+                       Legion::Extensions::Identity::Entra::Helpers::TokenManager.scope_fingerprint_stale?(:delegated, data)
                   log.debug('Delegated token still valid')
                   return
                 end
 
-                log.info('Delegated token nearing expiry, refreshing')
+                log.info('Delegated token expired or stale, refreshing')
                 refreshed = Legion::Extensions::Identity::Entra::Helpers::TokenManager.token_data(:delegated, refresh: true)
                 if refreshed && !Legion::Extensions::Identity::Entra::Helpers::TokenManager.expired?(refreshed)
                   Legion::Extensions::Identity::Entra::Client.reset!(pattern: :delegated)
@@ -53,6 +55,12 @@ module Legion
 
               private
 
+              def stored_raw_data
+                Legion::Extensions::Identity::Entra::Helpers::TokenManager.from_vault_data(:delegated) ||
+                  Legion::Extensions::Identity::Entra::Helpers::TokenManager.from_local_data(:delegated) ||
+                  Legion::Extensions::Identity::Entra::Helpers::TokenManager.from_memory(:delegated)
+              end
+
               def attempt_browser_reauth
                 auth_settings = Legion::Extensions::Identity::Entra::Helpers::TokenManager.settings_auth
                 return unless auth_settings[:tenant_id] && auth_settings[:client_id]

data/lib/legion/extensions/identity/entra/delegated/runners/login.rb

@@ -32,7 +32,7 @@ module Legion
                 deadline = Time.now + timeout
                 current_interval = interval
 
-                loop do
+                while Time.now <= deadline
                   body = oauth_post(tenant_id, 'oauth2/v2.0/token',
                                     grant_type:  'urn:ietf:params:oauth:grant-type:device_code',
                                     client_id:   client_id,
@@ -44,10 +44,6 @@ module Legion
 
                   case body[:error]
                   when 'authorization_pending'
-                    if Time.now > deadline
-                      log.warn("Login.poll_device_code: timed out after #{timeout}s")
-                      return { error: 'timeout', description: "Device code flow timed out after #{timeout}s" }
-                    end
                     sleep(current_interval)
                   when 'slow_down'
                     current_interval += 5
@@ -57,6 +53,9 @@ module Legion
                     return { error: body[:error], description: body[:error_description] }
                   end
                 end
+
+                log.warn("Login.poll_device_code: timed out after #{timeout}s")
+                { error: 'timeout', description: "Device code flow timed out after #{timeout}s" }
               rescue StandardError => e
                 handle_exception(e, level: :error, operation: 'delegated.login.poll_device_code')
                 { error: 'request_failed', description: e.message }

data/lib/legion/extensions/identity/entra/delegated/scopes.rb

@@ -24,6 +24,22 @@ module Legion
                 CallTranscripts.Read.All
                 Channel.ReadBasic.All
               ],
+              # Opt-in mailbox access for the signed-in user (lex-outlook, ADR-0005).
+              # Least privilege: Mail.Read + Mail.Send ONLY. Deliberately excludes
+              # Mail.ReadWrite (create/update/delete/move), MailboxSettings.Read
+              # (auto-reply/timezone/working-hours), and Mail.Read.Shared — no v1
+              # lex-outlook runner needs them, so they are deferred to a later
+              # fingerprint-changing edit when a runner actually requires them.
+              #
+              # NOT a member of :microsoft_graph, so existing delegated/Teams
+              # installs see no scope change and no forced re-consent. Enabling
+              # :mail in identity.entra.delegated.scopes.enabled_categories changes
+              # the delegated scope_fingerprint and forces a one-time re-consent for
+              # that qualifier — expected behavior, not an error (see README).
+              mail:                         %w[
+                Mail.Read
+                Mail.Send
+              ],
               teams:                        %w[
                 Chat.Create
                 Chat.Read

data/lib/legion/extensions/identity/entra/helpers/callback_server.rb

@@ -56,7 +56,7 @@ module Legion
             private
 
             def listen
-              loop do
+              until @result
                 client = @server.accept
                 request_line = client.gets
                 drain_headers(client)
@@ -64,7 +64,6 @@ module Legion
 
                 client.print "HTTP/1.1 200 OK\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n#{RESPONSE_HTML}"
                 client.close
-                break if @result
               end
             rescue IOError # rubocop:disable Legion/RescueLogging/NoCapture
               nil
@@ -76,10 +75,8 @@ module Legion
             end
 
             def drain_headers(client)
-              loop do
-                line = client.gets
-                break if line.nil? || line.strip.empty?
-              end
+              line = client.gets
+              line = client.gets until line.nil? || line.strip.empty?
             end
 
             def capture_callback(request_line)

data/lib/legion/extensions/identity/entra/helpers/token_manager.rb

@@ -51,6 +51,10 @@ module Legion
               return nil unless data
 
               if scope_fingerprint_stale?(qualifier, data)
+                if refresh && data[:refresh_token]
+                  log.info("TokenManager.token_data: scope fingerprint mismatch for #{qualifier}, attempting refresh with current scopes")
+                  return refresh_token(qualifier, data)
+                end
                 log.info("TokenManager.token_data: scope fingerprint mismatch for #{qualifier}, forcing re-auth")
                 return nil
               end
@@ -87,13 +91,18 @@ module Legion
             def from_vault_data(qualifier)
               return nil unless vault_available? && canonical_name_available?
 
-              path = vault_path(qualifier)
+              read_vault_token(qualifier, vault_path(qualifier))
+            end
+
+            def read_vault_token(qualifier, path)
+              return nil unless path
+
               log.debug("TokenManager.from_vault_data: reading kv/#{path}")
               result = vault_kv_client.read(path)
               normalize_token_data(result&.data)
             rescue StandardError => e
               handle_exception(e, level: :warn, operation: 'token_manager.from_vault_data',
-                                  qualifier: qualifier)
+                                  qualifier: qualifier, path: path)
               nil
             end
 
@@ -115,6 +124,8 @@ module Legion
               return unless canonical_name_available?
 
               path = vault_path(qualifier)
+              return unless path
+
               cluster = Legion::Crypt.respond_to?(:default_cluster_name) ? Legion::Crypt.default_cluster_name : 'vault'
               log.info("TokenManager.save_to_vault: writing to #{cluster} :: kv/data/#{path} qualifier=#{qualifier}")
               vault_kv_client.write(path,
@@ -249,7 +260,7 @@ module Legion
               return nil unless defined?(Legion::Identity::Broker)
 
               log.debug("TokenManager.from_broker: requesting token for #{qualifier}")
-              token = Legion::Identity::Broker.token_for(:entra, qualifier: qualifier)
+              token = Legion::Identity::Broker.token_for(:entra_delegated, qualifier: qualifier)
               log.debug("TokenManager.from_broker: #{token ? 'received' : 'not available'}")
               token
             rescue StandardError => e

data/lib/legion/extensions/identity/entra/version.rb

@@ -4,7 +4,7 @@ module Legion
   module Extensions
     module Identity
       module Entra
-        VERSION = '0.4.1'
+        VERSION = '0.5.4'
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lex-identity-entra
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.5.4
 platform: ruby
 authors:
 - Esity