vaultkit 1.1.2 → 1.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3456c9f8d7b3cc72f05f8df11dd96b19fa2c0b75d8986b30b30dba0cbc3850cc
-  data.tar.gz: a091815e8709a21725abc52a60bac32d957df0ef01ff6548c7fbe021e703031c
+  metadata.gz: 64b133877fe2a21e147efaa74745e3322197ca6dda0ba89472d4fb61bd12d533
+  data.tar.gz: 83621550f7ae8fcb3b79fb3a67ba8bfffec44459c3e874c33894eefdcc8dfe24
 SHA512:
-  metadata.gz: 844e0a3dfb18ced29085459b25188d2210e48f3483dea584c62dfaf1d7a04f000634fdcc19e2548142dad99bdfcfd2a079874cbccccc358c7beb2dccf2e5104d
-  data.tar.gz: 6558f370240fc0eb86b867a4f8ad1e0c54f71a642125509d9622ebecfa0ae7bc3ad3751e08d50e5b481933ddd2ee222a634f4fe03666f18c9300357c01c409ad
+  metadata.gz: 3d187229cc2d2e622fad6de0b48d4876d3de654bc20d949307c4d8b3ac74e6e5bdd0a73ef8b00b6dc2f0cc652aac1be04ccff889c961fe84994a2d228edc0a66
+  data.tar.gz: 522e340b74582402669aade2b1dc8d8581d8c1d1edd0409a07277522d1e564925a07c9d583d78766e581f957ccb8c03676332e1e513b1fc51040c051be07ec73

data/README.md

@@ -443,17 +443,19 @@ vkit approval:approve <REQUEST_ID> [--ttl SECONDS] [--notes "..."]
 ```
 
 **Options:**
-- `--ttl` — Grant lifetime in seconds (default: 3600)
+- `--ttl` — Grant lifetime in seconds. Defaults to the policy's TTL, which is also the maximum: a longer value is capped.
 - `--notes` — Approval notes (optional)
 
+When a request needs several approver roles, each role signs off separately. Until the last one has, `approve` prints the roles still waiting instead of a grant.
+
 **Examples:**
 ```bash
 # Basic approval
 vkit approval:approve 42
 
-# With custom TTL and notes
+# With a shorter TTL and notes
 vkit approval:approve 42 \
-  --ttl 7200 \
+  --ttl 1800 \
   --notes "Approved for Q4 analysis. Limited to aggregate data only."
 ```
 

data/lib/vkit/cli/base_cli.rb

@@ -71,7 +71,7 @@ module Vkit
       end
 
       desc "approval:approve ID", "Approve a pending request"
-      option :ttl, type: :numeric, default: 3600
+      option :ttl, type: :numeric, desc: "Grant lifetime in seconds (default and maximum: the policy's TTL)"
       define_method("approval:approve") do |id|
         Commands::ApprovalCommand.new.call_approve(
           id: id,

data/lib/vkit/cli/commands/approval_command.rb

@@ -1,13 +1,12 @@
 # frozen_string_literal: true
 
 require "json"
+require_relative "approval_roles"
 
 module Vkit
   module CLI
     module Commands
       class ApprovalCommand < BaseCommand
-        DEFAULT_TTL = 3600
-
         def call_list(state: "pending")
           with_auth do
             user = credential_store.user
@@ -28,8 +27,11 @@ module Vkit
               puts "🆔  #{r["id"]}"
               puts "📂  Dataset:    #{r["dataset"]}"
               puts "📄  Fields:     #{Array(r["fields"]).join(', ')}"
-              puts "👤  Requester:  #{r["requester_email"]}"
-              puts "🔐  Required:   #{r["approver_role"] || 'n/a'}"
+              puts "👤  Requester:  #{r["requester"] || r["requester_email"]}"
+              puts "🔐  Required:   #{ApprovalRoles.describe(ApprovalRoles.required_roles(r))}"
+              if r["state"] == "pending" && Array(r["approved_roles"]).any?
+                puts "⏳  Waiting on: #{ApprovalRoles.describe(ApprovalRoles.outstanding_roles(r))}"
+              end
               puts "⚙️   Status:     #{r["state"].capitalize}"
               puts "🔑  Grant Ref:  #{r["grant_ref"] || 'n/a'}" if r["state"] == "approved"
               puts "💬  Reason:     #{r["reason"]}"
@@ -39,19 +41,29 @@ module Vkit
           end
         end
 
-        def call_approve(id:, ttl_seconds: DEFAULT_TTL)
+        # Without ttl_seconds the grant lasts as long as the policy allows; the
+        # control plane caps a longer request at the policy's TTL.
+        def call_approve(id:, ttl_seconds: nil)
           with_auth do
             user = credential_store.user
             org  = user["organization_slug"]
 
+            body = ttl_seconds.nil? ? {} : { ttl_seconds: ttl_seconds }
             res = authenticated_client.post(
               "/api/v1/orgs/#{org}/approvals/#{id}/approve",
-              body: { ttl_seconds: ttl_seconds }
+              body: body
             )
 
-            puts "✅ Approved request #{id}"
-            puts "   → Grant Ref: #{res["grant_ref"] || res["grant_id"]}"
-            puts "   → Expires:   #{res["expires_at"]}"
+            if res["status"] == "pending"
+              puts "✍️  Signed off on request #{id}"
+              puts "   → Approved by: #{ApprovalRoles.describe(Array(res["approved_roles"]))}"
+              puts "   → Waiting on:  #{ApprovalRoles.describe(Array(res["outstanding_roles"]))}"
+              puts "   The grant is issued once every role has approved."
+            else
+              puts "✅ Approved request #{id}"
+              puts "   → Grant Ref: #{res["grant_ref"] || res["grant_id"]}"
+              puts "   → Expires:   #{res["expires_at"]}"
+            end
           end
         end
 

data/lib/vkit/cli/commands/approval_roles.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Vkit
+  module CLI
+    module Commands
+      # Approver roles as the control plane reports them. A request can need a
+      # sign-off from several roles (approver_roles); outstanding_roles are the
+      # ones still missing. Older control planes send only approver_role.
+      module ApprovalRoles
+        module_function
+
+        def required_roles(approval)
+          roles = Array(approval["approver_roles"])
+          return roles if roles.any?
+
+          approval["approver_role"].to_s.split(",").map(&:strip).reject(&:empty?)
+        end
+
+        def outstanding_roles(approval)
+          return Array(approval["outstanding_roles"]) if approval.key?("outstanding_roles")
+
+          approval["state"].to_s == "pending" ? required_roles(approval) : []
+        end
+
+        def describe(roles, fallback: "n/a")
+          roles.empty? ? fallback : roles.join(", ")
+        end
+      end
+    end
+  end
+end

data/lib/vkit/cli/commands/approval_watch_command.rb

@@ -2,6 +2,7 @@
 
 require "json"
 require "time"
+require_relative "approval_roles"
 
 module Vkit
   module CLI
@@ -99,6 +100,8 @@ module Vkit
             fields: a["fields"],
             requester: a["requester"],
             approver_role: a["approver_role"],
+            approver_roles: ApprovalRoles.required_roles(a),
+            outstanding_roles: ApprovalRoles.outstanding_roles(a),
             created_at: a["created_at"]
           }
         end
@@ -110,7 +113,10 @@ module Vkit
           puts "Dataset:   #{a["dataset"]}"
           puts "Fields:    #{Array(a["fields"]).join(", ")}"
           puts "Requester: #{a["requester"]}"
-          puts "Role Req:  #{a["approver_role"] || "any"}"
+          puts "Role Req:  #{ApprovalRoles.describe(ApprovalRoles.required_roles(a), fallback: "any")}"
+          if Array(a["approved_roles"]).any?
+            puts "Waiting:   #{ApprovalRoles.describe(ApprovalRoles.outstanding_roles(a))}"
+          end
           puts "Created:   #{format_time(a["created_at"])}"
           puts
           puts "▶ Approve: vkit approval approve #{a["id"]}"

data/lib/vkit/cli/commands/login_command.rb

@@ -75,6 +75,10 @@ module Vkit
                 token: body["token"],
                 user: body["user"]
               }
+            when 403
+              # The browser sign-in was rejected (e.g. not invited, email not
+              # verified); the control plane returns the reason.
+              raise login_rejection_message(res)
             when 410
               raise "Login session expired"
             when 404
@@ -85,6 +89,13 @@ module Vkit
           end
         end        
 
+        def login_rejection_message(res)
+          body = JSON.parse(res.body.to_s)
+          body["message"] || body["error"] || "Sign-in was rejected"
+        rescue JSON::ParserError
+          "Sign-in was rejected"
+        end
+
         def password_flow(client)
           email = @email || prompt("Email")
           password = prompt_password("Password")

data/lib/vkit/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Vkit
-  VERSION = "1.1.2"
+  VERSION = "1.1.4"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: vaultkit
 version: !ruby/object:Gem::Version
-  version: 1.1.2
+  version: 1.1.4
 platform: ruby
 authors:
 - Nnamdi Ogundu
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-29 00:00:00.000000000 Z
+date: 2026-10-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -58,6 +58,7 @@ files:
 - lib/vkit/cli/commands/agent_tokens_list_command.rb
 - lib/vkit/cli/commands/agent_tokens_revoke_command.rb
 - lib/vkit/cli/commands/approval_command.rb
+- lib/vkit/cli/commands/approval_roles.rb
 - lib/vkit/cli/commands/approval_watch_command.rb
 - lib/vkit/cli/commands/base_command.rb
 - lib/vkit/cli/commands/datasource_command.rb
@@ -139,7 +140,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.10
+rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
 summary: VaultKit CLI