lex-identity 0.2.0 → 0.3.0

data/lib/legion/extensions/identity/helpers/provider.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module Legion
+  module Extensions
+    module Identity
+      module Helpers
+        module Provider
+          def identity_register(**)
+            if defined?(Legion::Identity::Resolver) && Legion::Identity::Resolver.respond_to?(:register)
+              Legion::Identity::Resolver.register(self)
+              :registered
+            elsif defined?(Legion::Identity) &&
+                  Legion::Identity.respond_to?(:pending_registrations) &&
+                  Legion::Identity.pending_registrations.respond_to?(:<<)
+              Legion::Identity.pending_registrations << self
+              :pending
+            else
+              :unavailable
+            end
+          end
+
+          def identity_build_lease(credential:, **attributes)
+            attributes = attributes.merge(provider: provider_name, credential: credential)
+            return attributes unless defined?(Legion::Identity::Lease)
+
+            Legion::Identity::Lease.new(**attributes)
+          end
+
+          def identity_register_credential(lease:, qualifier: :default, default: false, **)
+            unless defined?(Legion::Identity::Broker) && Legion::Identity::Broker.respond_to?(:register_provider)
+              raise 'Credential registration requires Legion::Identity::Broker'
+            end
+
+            Legion::Identity::Broker.register_provider(provider_name, provider: self, lease: lease, qualifier: qualifier, default: default)
+          end
+
+          def identity_credentials_available(**)
+            return [] unless defined?(Legion::Identity::Broker)
+
+            Legion::Identity::Broker.credentials_available(provider_name)
+          end
+
+          def identity_token_for(qualifier: nil, **)
+            return nil unless defined?(Legion::Identity::Broker)
+
+            Legion::Identity::Broker.token_for(provider_name, qualifier: qualifier, **)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/identity/runners/base/oauth.rb

@@ -0,0 +1,140 @@
+# frozen_string_literal: true
+
+require 'legion/extensions/identity/helpers/oauth'
+require 'legion/extensions/identity/helpers/browser'
+require 'legion/extensions/identity/helpers/callback_server'
+require 'legion/extensions/identity/helpers/pkce'
+require 'securerandom'
+require 'legion/logging'
+
+module Legion
+  module Extensions
+    module Identity
+      module Runners
+        module Oauth
+          extend self
+          extend Legion::Extensions::Identity::Helpers::Oauth
+          extend Legion::Extensions::Identity::Helpers::Browser
+          extend Legion::Extensions::Identity::Helpers::Pkce
+
+          DEVICE_CODE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code'
+
+          def browser_login(authorization_endpoint:, token_endpoint:, client_id:, scope:, callback_port: 0, callback_timeout: 120, **)
+            unless callback_timeout.is_a?(Numeric) && callback_timeout.real? && callback_timeout.finite? && callback_timeout.positive?
+              raise ArgumentError, 'callback_timeout must be positive and finite'
+            end
+
+            return { error: 'browser_unavailable', description: 'Interactive browser login requires a graphical session' } unless browser_gui_available?
+
+            begin
+              pkce = pkce_generate
+              state = SecureRandom.hex(32)
+              server = Legion::Extensions::Identity::Helpers::CallbackServer.new(port: callback_port)
+              redirect_uri = server.redirect_uri
+              url = oauth_authorize_url(authorization_endpoint: authorization_endpoint, client_id: client_id,
+                                        redirect_uri: redirect_uri, scope: scope, state: state,
+                                        code_challenge: pkce[:code_challenge], code_challenge_method: pkce[:code_challenge_method])
+              if browser_open(url: url)
+                callback = server.wait_for_callback(state: state, timeout: callback_timeout)
+                if callback[:error]
+                  callback
+                else
+                  exchange_code(token_endpoint: token_endpoint, client_id: client_id, code: callback[:code],
+                                redirect_uri: redirect_uri, code_verifier: pkce[:code_verifier], scope: scope)
+                end
+              else
+                { error: 'browser_launch_failed', description: 'Unable to launch the browser' }
+              end
+            rescue StandardError => e
+              oauth_runner_error(operation: 'identity.oauth.browser_login', exception: e)
+            ensure
+              server&.shutdown
+            end
+          end
+
+          def request_device_code(device_authorization_endpoint:, client_id:, scope:, **)
+            result = oauth_post(endpoint: device_authorization_endpoint,
+                                form:     { client_id: client_id, scope: scope })
+            oauth_runner_result(result: result, required_key: :device_code)
+          rescue StandardError => e
+            oauth_runner_error(operation: 'identity.oauth.request_device_code', exception: e)
+          end
+
+          def exchange_code(token_endpoint:, client_id:, code:, redirect_uri:, code_verifier:, scope: nil, **)
+            form = {
+              grant_type: 'authorization_code', client_id: client_id, code: code,
+              redirect_uri: redirect_uri, code_verifier: code_verifier
+            }
+            form[:scope] = scope unless scope.nil?
+            result = oauth_post(endpoint: token_endpoint, form: form)
+            oauth_runner_result(result: result, required_key: :access_token)
+          rescue StandardError => e
+            oauth_runner_error(operation: 'identity.oauth.exchange_code', exception: e)
+          end
+
+          def refresh_token(token_endpoint:, client_id:, refresh_token:, scope: nil, **)
+            form = { grant_type: 'refresh_token', client_id: client_id, refresh_token: refresh_token }
+            form[:scope] = scope unless scope.nil?
+            result = oauth_post(endpoint: token_endpoint, form: form)
+            oauth_runner_result(result: result, required_key: :access_token)
+          rescue StandardError => e
+            oauth_runner_error(operation: 'identity.oauth.refresh_token', exception: e)
+          end
+
+          def poll_device_code(token_endpoint:, client_id:, device_code:, interval: 5, timeout: 300, **)
+            raise ArgumentError, 'interval must be positive' unless interval.positive?
+            raise ArgumentError, 'timeout must not be negative' if timeout.negative?
+
+            deadline = oauth_monotonic_now + timeout
+            current_interval = interval
+            outcome = { error: 'timeout', description: "Device code flow timed out after #{timeout}s" }
+            begin
+              while (remaining = deadline - oauth_monotonic_now).positive?
+                result = oauth_post(endpoint:        token_endpoint,
+                                    form:            { grant_type: DEVICE_CODE_GRANT, client_id: client_id, device_code: device_code },
+                                    open_timeout:    [remaining, 5].min,
+                                    request_timeout: [remaining, 15].min)
+                if result[:error] == 'slow_down'
+                  current_interval += 5
+                elsif result[:error] != 'authorization_pending'
+                  outcome = oauth_runner_result(result: result, required_key: :access_token)
+                  break
+                end
+                sleep_for = [current_interval, deadline - oauth_monotonic_now].min
+                break if sleep_for <= 0
+
+                sleep(sleep_for)
+              end
+
+              outcome
+            rescue StandardError => e
+              oauth_runner_error(operation: 'identity.oauth.poll_device_code', exception: e)
+            end
+          end
+
+          private
+
+          def oauth_runner_result(result:, required_key:)
+            return { error: result[:error].to_s, description: (result[:error_description] || result[:description]).to_s } if result[:error]
+            unless result[required_key].is_a?(String) && !result[required_key].empty?
+              return { error: 'invalid_response', description: "OAuth response did not include #{required_key}" }
+            end
+
+            { result: result }
+          end
+
+          def oauth_runner_error(operation:, exception:)
+            sanitized = StandardError.new("OAuth runner failed (#{exception.class})")
+            sanitized.set_backtrace(exception.backtrace)
+            handle_exception(sanitized, level: :error, operation: operation)
+            { error: 'request_failed', description: exception.message }
+          end
+
+          def oauth_monotonic_now
+            ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/identity/version.rb

@@ -3,7 +3,7 @@
 module Legion
   module Extensions
     module Identity
-      VERSION = '0.2.0'
+      VERSION = '0.3.0'
     end
   end
 end

data/lib/legion/extensions/identity.rb

@@ -1,24 +1,18 @@
 # frozen_string_literal: true
 
+require 'legion/logging'
 require 'legion/extensions/identity/version'
-require 'legion/extensions/identity/helpers/dimensions'
-require 'legion/extensions/identity/helpers/fingerprint'
-require 'legion/extensions/identity/helpers/vault_secrets'
-require 'legion/extensions/identity/runners/identity'
-require 'legion/extensions/identity/runners/entra'
-require 'legion/extensions/identity/actors/orphan_check'
+require 'legion/extensions/identity/helpers/provider'
 
 module Legion
   module Extensions
     module Identity
-      extend Legion::Extensions::Core if Legion::Extensions.const_defined? :Core
+      extend Legion::Extensions::Core if Legion::Extensions.const_defined?(:Core, false)
+
+      def self.identity_provider? = false
+      def self.remote_invocable? = false
+      def self.transport_required? = false
+      def self.crypt_required? = false
     end
   end
 end
-
-if defined?(Legion::Data::Local)
-  Legion::Data::Local.register_migrations(
-    name: :identity,
-    path: File.join(__dir__, 'identity', 'local_migrations')
-  )
-end

data/spec/support/provider_contract.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+RSpec.shared_examples 'identity provider contract' do
+  let(:canonical_name) { 'example-user' }
+
+  it 'exposes provider metadata with contract types' do
+    provider = identity_provider
+
+    expect(provider.provider_name).to be_a(Symbol)
+    expect(%i[auth profile fallback]).to include(provider.provider_type)
+    expect(provider.priority).to be_a(Numeric)
+    expect(provider.trust_weight).to be_a(Numeric)
+    expect(provider.capabilities).to be_an(Array)
+    expect(provider.capabilities).to all(be_a(Symbol))
+
+    trust_levels = if defined?(Legion::Identity::Trust) && Legion::Identity::Trust.respond_to?(:levels)
+                     Legion::Identity::Trust.levels
+                   else
+                     %i[verified authenticated configured cached unverified]
+                   end
+    expect(trust_levels).to include(provider.trust_level)
+  end
+
+  it 'uses the core resolution call contract' do
+    provider = identity_provider
+    result = case provider.provider_type
+             when :profile
+               if provider.respond_to?(:resolve_all)
+                 provider.resolve_all(canonical_name: canonical_name)
+               else
+                 provider.resolve(canonical_name: canonical_name)
+               end
+             when :auth, :fallback
+               provider.resolve
+             end
+
+    expect(result).to be_nil.or be_a(Hash)
+    next if result.nil?
+
+    if %i[auth fallback].include?(provider.provider_type)
+      expect(result).to include(:canonical_name, :kind, :source)
+      expect(result[:canonical_name]).to match(/\A[a-z0-9][a-z0-9_-]*\z/)
+      expect(result[:kind]).not_to be_nil
+      expect(result[:source]).not_to be_nil
+    else
+      expect(result).not_to have_key(:canonical_name)
+    end
+  end
+end

metadata

@@ -1,78 +1,112 @@
 --- !ruby/object:Gem::Specification
 name: lex-identity
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
-- Esity
+- LegionIO
 bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: sequel
+  name: faraday
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: legion-cache
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '5.70'
-  type: :development
+        version: 1.3.0
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '5.70'
+        version: 1.3.0
 - !ruby/object:Gem::Dependency
-  name: sqlite3
+  name: legion-json
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.0'
-  type: :development
+        version: 1.2.1
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.0'
-description: Human partner identity modeling and behavioral entropy for brain-modeled
-  agentic AI
-email:
-- matthewdiverson@gmail.com
+        version: 1.2.1
+- !ruby/object:Gem::Dependency
+  name: legion-logging
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.5.3
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.5.3
+- !ruby/object:Gem::Dependency
+  name: legion-settings
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.3.14
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.3.14
+description: Base extension gem for shared behavior across LegionIO identity provider
+  extensions.
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
 - Gemfile
+- LICENSE
+- README.md
 - lex-identity.gemspec
 - lib/legion/extensions/identity.rb
-- lib/legion/extensions/identity/actors/orphan_check.rb
-- lib/legion/extensions/identity/client.rb
-- lib/legion/extensions/identity/helpers/dimensions.rb
-- lib/legion/extensions/identity/helpers/fingerprint.rb
-- lib/legion/extensions/identity/helpers/vault_secrets.rb
-- lib/legion/extensions/identity/local_migrations/20260316000030_create_fingerprint.rb
-- lib/legion/extensions/identity/runners/entra.rb
-- lib/legion/extensions/identity/runners/identity.rb
+- lib/legion/extensions/identity/helpers/browser.rb
+- lib/legion/extensions/identity/helpers/callback_server.rb
+- lib/legion/extensions/identity/helpers/oauth.rb
+- lib/legion/extensions/identity/helpers/pkce.rb
+- lib/legion/extensions/identity/helpers/provider.rb
+- lib/legion/extensions/identity/runners/base/oauth.rb
 - lib/legion/extensions/identity/version.rb
-- spec/legion/extensions/identity/actors/orphan_check_spec.rb
-- spec/legion/extensions/identity/client_spec.rb
-- spec/legion/extensions/identity/helpers/dimensions_spec.rb
-- spec/legion/extensions/identity/helpers/fingerprint_spec.rb
-- spec/legion/extensions/identity/runners/entra_spec.rb
-- spec/legion/extensions/identity/runners/identity_spec.rb
-- spec/local_persistence_spec.rb
-- spec/spec_helper.rb
+- spec/support/provider_contract.rb
 homepage: https://github.com/LegionIO/lex-identity
 licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/LegionIO/lex-identity
   source_code_uri: https://github.com/LegionIO/lex-identity
-  documentation_uri: https://github.com/LegionIO/lex-identity
-  changelog_uri: https://github.com/LegionIO/lex-identity
+  documentation_uri: https://github.com/LegionIO/lex-identity/blob/main/README.md
+  changelog_uri: https://github.com/LegionIO/lex-identity/blob/main/CHANGELOG.md
   bug_tracker_uri: https://github.com/LegionIO/lex-identity/issues
   rubygems_mfa_required: 'true'
 rdoc_options: []
@@ -91,5 +125,5 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 3.6.9
 specification_version: 4
-summary: LEX Identity
+summary: Shared LegionIO identity extension base
 test_files: []

data/lib/legion/extensions/identity/actors/orphan_check.rb

@@ -1,48 +0,0 @@
-# frozen_string_literal: true
-
-require 'legion/extensions/actors/every'
-
-module Legion
-  module Extensions
-    module Identity
-      module Actor
-        # Periodic orphan detection: scans active workers for disabled Entra apps
-        # or inactive owners. Runs every 4 hours by default.
-        # Requires legion-data for worker records.
-        class OrphanCheck < Legion::Extensions::Actors::Every
-          ORPHAN_CHECK_INTERVAL = 14_400 # 4 hours in seconds
-
-          def runner_class
-            Legion::Extensions::Identity::Runners::Entra
-          end
-
-          def runner_function
-            'check_orphans'
-          end
-
-          def time
-            ORPHAN_CHECK_INTERVAL
-          end
-
-          def enabled?
-            defined?(Legion::Data) && Legion::Settings[:data][:connected] != false
-          rescue StandardError
-            false
-          end
-
-          def use_runner?
-            false
-          end
-
-          def check_subtask?
-            false
-          end
-
-          def generate_task?
-            false
-          end
-        end
-      end
-    end
-  end
-end

data/lib/legion/extensions/identity/client.rb

@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-require 'legion/extensions/identity/helpers/dimensions'
-require 'legion/extensions/identity/helpers/fingerprint'
-require 'legion/extensions/identity/runners/identity'
-
-module Legion
-  module Extensions
-    module Identity
-      class Client
-        include Runners::Identity
-
-        def initialize(**)
-          @identity_fingerprint = Helpers::Fingerprint.new
-        end
-
-        private
-
-        attr_reader :identity_fingerprint
-      end
-    end
-  end
-end

data/lib/legion/extensions/identity/helpers/dimensions.rb

@@ -1,71 +0,0 @@
-# frozen_string_literal: true
-
-module Legion
-  module Extensions
-    module Identity
-      module Helpers
-        module Dimensions
-          # The 6 behavioral dimensions that constitute identity
-          IDENTITY_DIMENSIONS = %i[
-            communication_cadence
-            vocabulary_patterns
-            emotional_response
-            decision_patterns
-            contextual_consistency
-            temporal_patterns
-          ].freeze
-
-          # Entropy thresholds (from tick-loop-spec Phase 4)
-          HIGH_ENTROPY_THRESHOLD = 0.70
-          LOW_ENTROPY_THRESHOLD  = 0.20
-          OPTIMAL_ENTROPY_RANGE  = (0.20..0.70)
-
-          # EMA alpha for dimension updates
-          OBSERVATION_ALPHA = 0.1
-
-          module_function
-
-          def new_identity_model
-            IDENTITY_DIMENSIONS.to_h do |dim|
-              [dim, { mean: 0.5, variance: 0.1, observations: 0, last_observed: nil }]
-            end
-          end
-
-          def compute_entropy(observations, model)
-            return 0.5 if observations.empty?
-
-            divergences = IDENTITY_DIMENSIONS.filter_map do |dim|
-              obs = observations[dim]
-              next unless obs
-
-              baseline = model[dim]
-              next 0.0 unless baseline && baseline[:observations].positive?
-
-              # Weighted divergence from established baseline
-              (obs - baseline[:mean]).abs / [baseline[:variance].to_f, 0.1].max
-            end
-
-            return 0.5 if divergences.empty?
-
-            raw = divergences.sum / divergences.size
-            clamp(raw / 3.0) # normalize: divergence of 3.0 stddevs = entropy 1.0
-          end
-
-          def classify_entropy(entropy)
-            if entropy > HIGH_ENTROPY_THRESHOLD
-              :high_entropy
-            elsif entropy < LOW_ENTROPY_THRESHOLD
-              :low_entropy
-            else
-              :normal
-            end
-          end
-
-          def clamp(value, min = 0.0, max = 1.0)
-            value.clamp(min, max)
-          end
-        end
-      end
-    end
-  end
-end