lex-identity-entra 0.5.3 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 85cdc120eb3f0b5d4d17c8e5a946cc6597ad05c4281f6b058a3782f9a868c139
-  data.tar.gz: 8f74ba8695ef29922d7a058453b7ca1726c458bd5630db3ac9ed0e921185afb8
+  metadata.gz: ea7d2caf79ed2c6025cbad1ee6daae0a5f5250aada92cf26f42c71bf8e849680
+  data.tar.gz: 3f7afe033551273e7ebe6345c40e24f824529b0f4df79a1f3e7677002dcb006c
 SHA512:
-  metadata.gz: cedb8ba0c30d800b9ec234d10fe40a67cacfcf21e320786cdb735ee6025cf23b59d90dc115a05d60ee32cf61791c46cf3328e5b00c4387602715419799659361
-  data.tar.gz: cb74ced2592eb80c0d3bf06576798d44c9531af4fcac3c4215926a0e018c6c2f6d892987149792692a9b53e1c700572f2c9c7a1456e6d2e5075e933ea23799a2
+  metadata.gz: 55af5175673b2d9371c0e1d8b8ff03479299e7425b8f6f79b88b941e2b31bcb44069f026bcae90d898a87a7a6511b69a2c0618279ed73b1ac6631369d9733db2
+  data.tar.gz: fc672dfff7aa30a9325b7046752f5cdefe737f39b5e8bb69066657c0873d2f8ae600bf758a2ad42fcc382cb5a47467090e074931581486124e89eb52b66dd53b

data/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [0.6.0] - 2026-09-25
+### Changed
+- **Breaking**: Vault token persistence is now opt-in in both directions. New per-pattern settings `identity.entra.<pattern>.token.vault_read_enabled` and `vault_write_enabled`, both defaulting to `false`. With the defaults, Entra tokens are never read from or written to Vault. Set the flags explicitly to restore 0.5.x Vault behavior (each direction is independent).
+- **Breaking**: Removed local disk token persistence (`~/.legionio/tokens/entra_<qualifier>.json`) and its `local_token_path` setting. Tokens are held in-memory by default and in Vault only when explicitly opted in — nothing is ever written to disk. In the default configuration tokens no longer survive a process restart: re-auth via `auto_authenticate` or `legion lex exec entra auth login`.
+- Upgrades from 0.5.x: tokens that exist only in Vault are not read by default (expect a one-time re-auth, or set `vault_read_enabled: true`), and stale on-disk token files are no longer read or written.
+
+## [0.5.4] - 2026-08-04
+### Fixed
+- Stop writing delegated Entra tokens to bootstrap Vault paths. Token persistence now uses only the canonical `users/<identity>/entra/<qualifier>/auth` Vault path and falls back to local disk until a canonical identity is available.
+
 ## [0.5.3] - 2026-07-15
 ### Fixed
 - Fix token refresh dead-end: refresh when token exists regardless of authenticated? state

data/README.md

@@ -7,7 +7,7 @@ and workload identity authentication patterns.
 ## Features
 
 - **Delegated auth** — OAuth2 PKCE browser flow with local callback server; device-code fallback
-- **Token persistence** — Vault-first (`kv/data/users/<identity>/entra/<qualifier>/auth`), disk fallback, in-memory fallback; disk file deleted once Vault write succeeds
+- **Token persistence** — in-memory by default; Vault (`kv/data/users/<identity>/entra/<qualifier>/auth`) reading and writing are separate opt-ins via `vault_read_enabled` / `vault_write_enabled`. Tokens are never written to local disk
 - **Scope fingerprinting** — MD5 fingerprint of active scopes stored with token; any scope change forces re-authentication on next boot
 - **Identity integration** — `AuthValidator` upgrades `Legion::Identity::Process` via `Resolver.upgrade!` and registers with `Legion::Identity::Broker` for cross-extension token access
 - **Application credentials** — client credentials flow for service-to-service auth
@@ -36,6 +36,8 @@ identity:
         auto_authenticate: false   # set true to open browser automatically at boot
         callback_timeout: 120
       token:
+        vault_read_enabled: false   # set true to read the token from Vault
+        vault_write_enabled: false  # set true to write the token to Vault
         refresh_buffer: 60
         refresh_interval: 900
       scopes:
@@ -98,11 +100,10 @@ identity:
 
 ## Token storage
 
-| Backend | Path | Priority |
-|---------|------|----------|
-| HashiCorp Vault | `kv/data/users/<identity>/entra/delegated/auth` | 1 (preferred) |
-| Local disk | `~/.legionio/tokens/entra_delegated.json` | 2 (fallback, deleted when Vault succeeds) |
-| Memory | In-process store | 3 (runtime fallback) |
+| Backend | Path | When used |
+|---------|------|-----------|
+| HashiCorp Vault | `kv/data/users/<identity>/entra/delegated/auth` | Only when opted in: `vault_read_enabled` / `vault_write_enabled` (both default `false`) |
+| Memory | In-process store | Default persistence; tokens are never written to local disk |
 
 ## Identity provider contract
 

data/lib/legion/extensions/identity/entra/application.rb

@@ -32,10 +32,11 @@ module Legion
                 category_overrides: {}
               },
               token:   {
-                vault_path:       nil,
-                local_token_path: nil,
-                refresh_buffer:   60,
-                refresh_interval: 2700
+                vault_read_enabled:  false,
+                vault_write_enabled: false,
+                vault_path:          nil,
+                refresh_buffer:      60,
+                refresh_interval:    2700
               }
             }
           end

data/lib/legion/extensions/identity/entra/delegated/actors/auth_validator.rb

@@ -139,8 +139,7 @@ module Legion
               end
 
               def previously_authenticated?
-                path = Legion::Extensions::Identity::Entra::Helpers::TokenManager.local_path(:delegated)
-                File.exist?(path)
+                !stored_token_data.nil?
               end
 
               def stored_token_data

data/lib/legion/extensions/identity/entra/delegated/actors/token_refresher.rb

@@ -57,7 +57,6 @@ module Legion
 
               def stored_raw_data
                 Legion::Extensions::Identity::Entra::Helpers::TokenManager.from_vault_data(:delegated) ||
-                  Legion::Extensions::Identity::Entra::Helpers::TokenManager.from_local_data(:delegated) ||
                   Legion::Extensions::Identity::Entra::Helpers::TokenManager.from_memory(:delegated)
               end
 

data/lib/legion/extensions/identity/entra/delegated.rb

@@ -35,10 +35,11 @@ module Legion
                 category_overrides: {}
               },
               token:        {
-                vault_path:       nil,
-                local_token_path: nil,
-                refresh_buffer:   60,
-                refresh_interval: 900
+                vault_read_enabled:  false,
+                vault_write_enabled: false,
+                vault_path:          nil,
+                refresh_buffer:      60,
+                refresh_interval:    900
               },
               browser_auth: {
                 auto_authenticate:  false,

data/lib/legion/extensions/identity/entra/helpers/account_discovery.rb

@@ -16,19 +16,13 @@ module Legion
             include Legion::Extensions::Helpers::Lex if Legion::Extensions.const_defined?(:Helpers, false) &&
                                                         Legion::Extensions::Helpers.const_defined?(:Lex, false)
 
-            # Returns an array of qualifier symbols for which tokens exist locally.
+            # Returns an array of qualifier symbols for which tokens exist in-process.
             def discovered_qualifiers
-              (local_qualifiers + broker_qualifiers).uniq
+              (memory_qualifiers + broker_qualifiers).uniq
             end
 
-            def local_qualifiers
-              return [] unless File.directory?(Legion::Extensions::Identity::Entra::Helpers::TokenManager::TOKEN_DIR)
-
-              Dir.glob(File.join(Legion::Extensions::Identity::Entra::Helpers::TokenManager::TOKEN_DIR, 'entra_*.json')).filter_map do |path|
-                basename = File.basename(path, '.json')
-                match = basename.match(/\Aentra_(.+)\z/)
-                match[1].to_sym if match
-              end
+            def memory_qualifiers
+              Legion::Extensions::Identity::Entra::Helpers::TokenManager.memory_store.keys
             end
 
             def broker_qualifiers

data/lib/legion/extensions/identity/entra/helpers/token_manager.rb

@@ -2,7 +2,6 @@
 
 require 'concurrent'
 require 'digest'
-require 'fileutils'
 require 'time'
 
 module Legion
@@ -16,7 +15,6 @@ module Legion
             include Legion::Settings::Helper
             include Legion::JSON::Helper
 
-            TOKEN_DIR = File.join(Dir.home, '.legionio', 'tokens')
             REFRESH_BUFFER = 60
             MEMORY_STORE = Concurrent::Hash.new
 
@@ -34,20 +32,7 @@ module Legion
 
             def token_data(qualifier = :delegated, refresh: true)
               log.debug("TokenManager.token_data: qualifier=#{qualifier} refresh=#{refresh}")
-              vault_data = from_vault_data(qualifier)
-              other_data = vault_data || from_local_data(qualifier) || from_memory(qualifier)
-              if other_data && !vault_data && vault_available? && canonical_name_available?
-                log.info("TokenManager.token_data: backfilling #{qualifier} token to vault")
-                backfill_saved = save_to_vault(qualifier, access_token:      other_data[:access_token],
-                                                          refresh_token:     other_data[:refresh_token],
-                                                          expires_at:        other_data[:expires_at],
-                                                          scopes:            other_data[:scopes],
-                                                          tenant_id:         other_data[:tenant_id],
-                                                          client_id:         other_data[:client_id],
-                                                          scope_fingerprint: other_data[:scope_fingerprint])
-                delete_local(qualifier) if backfill_saved
-              end
-              data = other_data
+              data = from_vault_data(qualifier) || from_memory(qualifier)
               return nil unless data
 
               if scope_fingerprint_stale?(qualifier, data)
@@ -70,18 +55,10 @@ module Legion
               log.debug("TokenManager.save_token: qualifier=#{qualifier} expires_in=#{expires_in}")
               expires_at ||= Time.now + expires_in.to_i if expires_in
               fingerprint = current_scope_fingerprint(qualifier)
-              vault_saved = save_to_vault(qualifier, access_token: access_token, refresh_token: refresh_token,
-                                                     expires_at: expires_at, scopes: scopes,
-                                                     tenant_id: tenant_id, client_id: client_id,
-                                                     scope_fingerprint: fingerprint)
-              if vault_saved
-                delete_local(qualifier)
-              else
-                save_to_local(qualifier, access_token: access_token, refresh_token: refresh_token,
-                                         expires_at: expires_at, scopes: scopes,
-                                         tenant_id: tenant_id, client_id: client_id,
-                                         scope_fingerprint: fingerprint)
-              end
+              save_to_vault(qualifier, access_token: access_token, refresh_token: refresh_token,
+                                            expires_at: expires_at, scopes: scopes,
+                                            tenant_id: tenant_id, client_id: client_id,
+                                            scope_fingerprint: fingerprint)
               save_to_memory(qualifier, access_token: access_token, refresh_token: refresh_token,
                                         expires_at: expires_at, scopes: scopes,
                                         tenant_id: tenant_id, client_id: client_id,
@@ -89,13 +66,10 @@ module Legion
             end
 
             def from_vault_data(qualifier)
-              return nil unless vault_available?
+              return nil unless vault_read_enabled?(qualifier)
+              return nil unless vault_available? && canonical_name_available?
 
-              # Prefer the canonical (post-resolution) path, then fall back to the
-              # bootstrap path so a fresh process can recover a Vault-only token
-              # before Legion::Identity::Process is resolved (issue #4).
-              read_vault_token(qualifier, vault_path(qualifier)) ||
-                read_vault_token(qualifier, bootstrap_vault_path(qualifier))
+              read_vault_token(qualifier, vault_path(qualifier))
             end
 
             def read_vault_token(qualifier, path)
@@ -110,41 +84,25 @@ module Legion
               nil
             end
 
-            def from_local_data(qualifier)
-              path = local_path(qualifier)
-              return nil unless File.exist?(path)
-
-              log.debug("TokenManager.from_local_data: reading #{path}")
-              normalize_token_data(json_load(File.read(path)))
-            rescue StandardError => e
-              handle_exception(e, level: :warn, operation: 'token_manager.from_local_data',
-                                  qualifier: qualifier, path: path)
-              nil
-            end
-
             def save_to_vault(qualifier, access_token:, refresh_token:, expires_at:,
                               scopes: nil, tenant_id: nil, client_id: nil, scope_fingerprint: nil)
+              return unless vault_write_enabled?(qualifier)
               return unless vault_available?
+              return unless canonical_name_available?
 
-              # When canonical identity is resolved, write the canonical key (and
-              # alias to the bootstrap key so a later fresh process can recover it
-              # before resolution). Before resolution, fall back to the bootstrap
-              # key so we never write to a placeholder (anonymous) canonical path.
-              paths = [vault_path(qualifier), bootstrap_vault_path(qualifier)].compact.uniq
-              return if paths.empty?
+              path = vault_path(qualifier)
+              return unless path
 
               cluster = Legion::Crypt.respond_to?(:default_cluster_name) ? Legion::Crypt.default_cluster_name : 'vault'
-              paths.each do |path|
-                log.info("TokenManager.save_to_vault: writing to #{cluster} :: kv/data/#{path} qualifier=#{qualifier}")
-                vault_kv_client.write(path,
-                                      access_token:      access_token,
-                                      refresh_token:     refresh_token,
-                                      expires_at:        expires_at&.utc&.iso8601,
-                                      scopes:            scopes,
-                                      tenant_id:         tenant_id,
-                                      client_id:         client_id,
-                                      scope_fingerprint: scope_fingerprint)
-              end
+              log.info("TokenManager.save_to_vault: writing to #{cluster} :: kv/data/#{path} qualifier=#{qualifier}")
+              vault_kv_client.write(path,
+                                    access_token:      access_token,
+                                    refresh_token:     refresh_token,
+                                    expires_at:        expires_at&.utc&.iso8601,
+                                    scopes:            scopes,
+                                    tenant_id:         tenant_id,
+                                    client_id:         client_id,
+                                    scope_fingerprint: scope_fingerprint)
               log.info('TokenManager.save_to_vault: success')
               true
             rescue StandardError => e
@@ -153,38 +111,6 @@ module Legion
               nil
             end
 
-            def save_to_local(qualifier, access_token:, refresh_token:, expires_at:,
-                              scopes: nil, tenant_id: nil, client_id: nil, scope_fingerprint: nil)
-              path = local_path(qualifier)
-              log.debug("TokenManager.save_to_local: writing #{path}")
-              FileUtils.mkdir_p(File.dirname(path))
-              File.write(path, json_dump({
-                                           access_token:      access_token,
-                                           refresh_token:     refresh_token,
-                                           expires_at:        expires_at&.utc&.iso8601,
-                                           scopes:            scopes,
-                                           tenant_id:         tenant_id,
-                                           client_id:         client_id,
-                                           scope_fingerprint: scope_fingerprint
-                                         }))
-              File.chmod(0o600, path)
-              log.debug('TokenManager.save_to_local: success')
-            rescue StandardError => e
-              handle_exception(e, level: :warn, operation: 'token_manager.save_to_local',
-                                  qualifier: qualifier, path: path)
-              nil
-            end
-
-            def delete_local(qualifier)
-              path = local_path(qualifier)
-              return unless File.exist?(path)
-
-              File.delete(path)
-              log.info("TokenManager.delete_local: removed #{path} (vault is authoritative)")
-            rescue StandardError => e
-              handle_exception(e, level: :warn, operation: 'token_manager.delete_local', qualifier: qualifier)
-            end
-
             def from_memory(qualifier)
               data = TokenManager.memory_store[qualifier.to_sym]
               return nil unless data
@@ -213,7 +139,7 @@ module Legion
             end
 
             def scope_fingerprint_stale?(qualifier, data = nil)
-              data ||= from_local_data(qualifier) || from_memory(qualifier)
+              data ||= from_memory(qualifier)
               return false unless data
 
               stored = data[:scope_fingerprint]
@@ -289,6 +215,14 @@ module Legion
               !load_token(qualifier).nil?
             end
 
+            def vault_read_enabled?(qualifier)
+              Legion::Settings.dig(:identity, :entra, qualifier.to_sym, :token, :vault_read_enabled)
+            end
+
+            def vault_write_enabled?(qualifier)
+              Legion::Settings.dig(:identity, :entra, qualifier.to_sym, :token, :vault_write_enabled)
+            end
+
             def vault_available?
               defined?(Legion::Crypt) &&
                 Legion::Crypt.respond_to?(:vault_connected?) &&
@@ -305,34 +239,6 @@ module Legion
               "users/#{Legion::Identity::Process.canonical_name}/entra/#{qualifier}/auth"
             end
 
-            # Pre-resolution Vault key for delegated tokens, derived from stable
-            # inputs (tenant id + client id) that are available before canonical
-            # identity resolution. Lets a fresh process recover a Vault-only
-            # delegated token so it can resolve identity (issue #4). Scoped to
-            # delegated only — other patterns are unaffected.
-            def bootstrap_vault_path(qualifier)
-              return nil unless qualifier.to_sym == :delegated
-
-              auth = settings_auth
-              pattern_settings = auth[qualifier.to_sym]
-              return pattern_settings[:vault_path] if pattern_settings.is_a?(Hash) && pattern_settings[:vault_path]
-
-              tenant_id = auth[:tenant_id]
-              client_id = auth[:client_id]
-              return nil unless tenant_id && client_id
-
-              account = Digest::MD5.hexdigest("#{tenant_id}:#{client_id}")
-              "bootstrap/entra/#{qualifier}/#{account}/auth"
-            end
-
-            def local_path(qualifier)
-              auth = settings_auth
-              pattern_settings = auth[qualifier.to_sym]
-              return File.expand_path(pattern_settings[:local_token_path]) if pattern_settings.is_a?(Hash) && pattern_settings[:local_token_path]
-
-              File.join(TOKEN_DIR, "entra_#{qualifier}.json")
-            end
-
             def settings_auth
               identity_entra = Legion::Settings.dig(:identity, :entra) || {}
               auth = identity_entra[:auth].is_a?(Hash) ? identity_entra[:auth].dup : identity_entra.dup

data/lib/legion/extensions/identity/entra/managed_identity.rb

@@ -28,10 +28,11 @@ module Legion
                 category_overrides: {}
               },
               token:     {
-                vault_path:       nil,
-                local_token_path: nil,
-                refresh_buffer:   60,
-                refresh_interval: 2700
+                vault_read_enabled:  false,
+                vault_write_enabled: false,
+                vault_path:          nil,
+                refresh_buffer:      60,
+                refresh_interval:    2700
               }
             }
           end

data/lib/legion/extensions/identity/entra/version.rb

@@ -4,7 +4,7 @@ module Legion
   module Extensions
     module Identity
       module Entra
-        VERSION = '0.5.3'
+        VERSION = '0.6.0'
       end
     end
   end

data/lib/legion/extensions/identity/entra/workload_identity.rb

@@ -29,10 +29,11 @@ module Legion
                 category_overrides: {}
               },
               token:          {
-                vault_path:       nil,
-                local_token_path: nil,
-                refresh_buffer:   60,
-                refresh_interval: 2700
+                vault_read_enabled:  false,
+                vault_write_enabled: false,
+                vault_path:          nil,
+                refresh_buffer:      60,
+                refresh_interval:    2700
               }
             }
           end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lex-identity-entra
 version: !ruby/object:Gem::Version
-  version: 0.5.3
+  version: 0.6.0
 platform: ruby
 authors:
 - Esity