lex-identity-entra 0.5.3 → 0.5.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 85cdc120eb3f0b5d4d17c8e5a946cc6597ad05c4281f6b058a3782f9a868c139
-  data.tar.gz: 8f74ba8695ef29922d7a058453b7ca1726c458bd5630db3ac9ed0e921185afb8
+  metadata.gz: a50147c3bd7a673e611e5191168b9ade2fe468041ad2b320fccba89dc267a999
+  data.tar.gz: a0889be0de3da89dedae7360058f0463ae8570a735b5f759750f74bf0e720974
 SHA512:
-  metadata.gz: cedb8ba0c30d800b9ec234d10fe40a67cacfcf21e320786cdb735ee6025cf23b59d90dc115a05d60ee32cf61791c46cf3328e5b00c4387602715419799659361
-  data.tar.gz: cb74ced2592eb80c0d3bf06576798d44c9531af4fcac3c4215926a0e018c6c2f6d892987149792692a9b53e1c700572f2c9c7a1456e6d2e5075e933ea23799a2
+  metadata.gz: bf3ff78771dc93dea6cb326c1577d6421382575e714eb4ef25ae67ca07cbeceab37f5b616dd9a611eea85e3ff31d868964878f85409ced0e8688510d3231e8d8
+  data.tar.gz: 74f7b159ecc89ba0e306273e3e6438b81d8cb1ad09c52d5e2f9c1fb1d6cf4de95e06de62317c8253c8a69b9bfd9cb365ca5785ffede017d0e365dfbfd9502e61

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## [0.5.4] - 2026-08-04
+### Fixed
+- Stop writing delegated Entra tokens to bootstrap Vault paths. Token persistence now uses only the canonical `users/<identity>/entra/<qualifier>/auth` Vault path and falls back to local disk until a canonical identity is available.
+
 ## [0.5.3] - 2026-07-15
 ### Fixed
 - Fix token refresh dead-end: refresh when token exists regardless of authenticated? state

data/lib/legion/extensions/identity/entra/helpers/token_manager.rb

@@ -89,13 +89,9 @@ module Legion
             end
 
             def from_vault_data(qualifier)
-              return nil unless vault_available?
+              return nil unless vault_available? && canonical_name_available?
 
-              # Prefer the canonical (post-resolution) path, then fall back to the
-              # bootstrap path so a fresh process can recover a Vault-only token
-              # before Legion::Identity::Process is resolved (issue #4).
-              read_vault_token(qualifier, vault_path(qualifier)) ||
-                read_vault_token(qualifier, bootstrap_vault_path(qualifier))
+              read_vault_token(qualifier, vault_path(qualifier))
             end
 
             def read_vault_token(qualifier, path)
@@ -125,26 +121,21 @@ module Legion
             def save_to_vault(qualifier, access_token:, refresh_token:, expires_at:,
                               scopes: nil, tenant_id: nil, client_id: nil, scope_fingerprint: nil)
               return unless vault_available?
+              return unless canonical_name_available?
 
-              # When canonical identity is resolved, write the canonical key (and
-              # alias to the bootstrap key so a later fresh process can recover it
-              # before resolution). Before resolution, fall back to the bootstrap
-              # key so we never write to a placeholder (anonymous) canonical path.
-              paths = [vault_path(qualifier), bootstrap_vault_path(qualifier)].compact.uniq
-              return if paths.empty?
+              path = vault_path(qualifier)
+              return unless path
 
               cluster = Legion::Crypt.respond_to?(:default_cluster_name) ? Legion::Crypt.default_cluster_name : 'vault'
-              paths.each do |path|
-                log.info("TokenManager.save_to_vault: writing to #{cluster} :: kv/data/#{path} qualifier=#{qualifier}")
-                vault_kv_client.write(path,
-                                      access_token:      access_token,
-                                      refresh_token:     refresh_token,
-                                      expires_at:        expires_at&.utc&.iso8601,
-                                      scopes:            scopes,
-                                      tenant_id:         tenant_id,
-                                      client_id:         client_id,
-                                      scope_fingerprint: scope_fingerprint)
-              end
+              log.info("TokenManager.save_to_vault: writing to #{cluster} :: kv/data/#{path} qualifier=#{qualifier}")
+              vault_kv_client.write(path,
+                                    access_token:      access_token,
+                                    refresh_token:     refresh_token,
+                                    expires_at:        expires_at&.utc&.iso8601,
+                                    scopes:            scopes,
+                                    tenant_id:         tenant_id,
+                                    client_id:         client_id,
+                                    scope_fingerprint: scope_fingerprint)
               log.info('TokenManager.save_to_vault: success')
               true
             rescue StandardError => e
@@ -305,26 +296,6 @@ module Legion
               "users/#{Legion::Identity::Process.canonical_name}/entra/#{qualifier}/auth"
             end
 
-            # Pre-resolution Vault key for delegated tokens, derived from stable
-            # inputs (tenant id + client id) that are available before canonical
-            # identity resolution. Lets a fresh process recover a Vault-only
-            # delegated token so it can resolve identity (issue #4). Scoped to
-            # delegated only — other patterns are unaffected.
-            def bootstrap_vault_path(qualifier)
-              return nil unless qualifier.to_sym == :delegated
-
-              auth = settings_auth
-              pattern_settings = auth[qualifier.to_sym]
-              return pattern_settings[:vault_path] if pattern_settings.is_a?(Hash) && pattern_settings[:vault_path]
-
-              tenant_id = auth[:tenant_id]
-              client_id = auth[:client_id]
-              return nil unless tenant_id && client_id
-
-              account = Digest::MD5.hexdigest("#{tenant_id}:#{client_id}")
-              "bootstrap/entra/#{qualifier}/#{account}/auth"
-            end
-
             def local_path(qualifier)
               auth = settings_auth
               pattern_settings = auth[qualifier.to_sym]

data/lib/legion/extensions/identity/entra/version.rb

@@ -4,7 +4,7 @@ module Legion
   module Extensions
     module Identity
       module Entra
-        VERSION = '0.5.3'
+        VERSION = '0.5.4'
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lex-identity-entra
 version: !ruby/object:Gem::Version
-  version: 0.5.3
+  version: 0.5.4
 platform: ruby
 authors:
 - Esity