vaultkit 1.1.3 → 1.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: af2c38a3f1d8d8e52aab3cc44f48989e5d9fdb9f1c7bcfd60f980436068f0046
-  data.tar.gz: 8cf3f02c2e5ca5465659010588ccf4bed6e1d6fce77e8d20c1cd0f25c44bcbd6
+  metadata.gz: 64b133877fe2a21e147efaa74745e3322197ca6dda0ba89472d4fb61bd12d533
+  data.tar.gz: 83621550f7ae8fcb3b79fb3a67ba8bfffec44459c3e874c33894eefdcc8dfe24
 SHA512:
-  metadata.gz: c4b2128ae5279ffcaef15f76e15df4f545b9d30fd683e16e03c47b2d8ddd9461f21f86ede0669929711916c68a0c60043ed2c9b2a68bb64900df41b768232424
-  data.tar.gz: 75d5669946ca36e771ccb208099c7313baaadcf9195395b82874dc65ae0f084d31ed2940713c9730a30f131bfe9f2cc8f2b5fd390a24e8878a0e2a0dce68ed62
+  metadata.gz: 3d187229cc2d2e622fad6de0b48d4876d3de654bc20d949307c4d8b3ac74e6e5bdd0a73ef8b00b6dc2f0cc652aac1be04ccff889c961fe84994a2d228edc0a66
+  data.tar.gz: 522e340b74582402669aade2b1dc8d8581d8c1d1edd0409a07277522d1e564925a07c9d583d78766e581f957ccb8c03676332e1e513b1fc51040c051be07ec73

data/README.md

@@ -443,17 +443,19 @@ vkit approval:approve <REQUEST_ID> [--ttl SECONDS] [--notes "..."]
 ```
 
 **Options:**
-- `--ttl` — Grant lifetime in seconds (default: 3600)
+- `--ttl` — Grant lifetime in seconds. Defaults to the policy's TTL, which is also the maximum: a longer value is capped.
 - `--notes` — Approval notes (optional)
 
+When a request needs several approver roles, each role signs off separately. Until the last one has, `approve` prints the roles still waiting instead of a grant.
+
 **Examples:**
 ```bash
 # Basic approval
 vkit approval:approve 42
 
-# With custom TTL and notes
+# With a shorter TTL and notes
 vkit approval:approve 42 \
-  --ttl 7200 \
+  --ttl 1800 \
   --notes "Approved for Q4 analysis. Limited to aggregate data only."
 ```
 

data/lib/vkit/cli/base_cli.rb

@@ -71,7 +71,7 @@ module Vkit
       end
 
       desc "approval:approve ID", "Approve a pending request"
-      option :ttl, type: :numeric, default: 3600
+      option :ttl, type: :numeric, desc: "Grant lifetime in seconds (default and maximum: the policy's TTL)"
       define_method("approval:approve") do |id|
         Commands::ApprovalCommand.new.call_approve(
           id: id,

data/lib/vkit/cli/commands/approval_command.rb

@@ -1,13 +1,12 @@
 # frozen_string_literal: true
 
 require "json"
+require_relative "approval_roles"
 
 module Vkit
   module CLI
     module Commands
       class ApprovalCommand < BaseCommand
-        DEFAULT_TTL = 3600
-
         def call_list(state: "pending")
           with_auth do
             user = credential_store.user
@@ -28,8 +27,11 @@ module Vkit
               puts "🆔  #{r["id"]}"
               puts "📂  Dataset:    #{r["dataset"]}"
               puts "📄  Fields:     #{Array(r["fields"]).join(', ')}"
-              puts "👤  Requester:  #{r["requester_email"]}"
-              puts "🔐  Required:   #{r["approver_role"] || 'n/a'}"
+              puts "👤  Requester:  #{r["requester"] || r["requester_email"]}"
+              puts "🔐  Required:   #{ApprovalRoles.describe(ApprovalRoles.required_roles(r))}"
+              if r["state"] == "pending" && Array(r["approved_roles"]).any?
+                puts "⏳  Waiting on: #{ApprovalRoles.describe(ApprovalRoles.outstanding_roles(r))}"
+              end
               puts "⚙️   Status:     #{r["state"].capitalize}"
               puts "🔑  Grant Ref:  #{r["grant_ref"] || 'n/a'}" if r["state"] == "approved"
               puts "💬  Reason:     #{r["reason"]}"
@@ -39,19 +41,29 @@ module Vkit
           end
         end
 
-        def call_approve(id:, ttl_seconds: DEFAULT_TTL)
+        # Without ttl_seconds the grant lasts as long as the policy allows; the
+        # control plane caps a longer request at the policy's TTL.
+        def call_approve(id:, ttl_seconds: nil)
           with_auth do
             user = credential_store.user
             org  = user["organization_slug"]
 
+            body = ttl_seconds.nil? ? {} : { ttl_seconds: ttl_seconds }
             res = authenticated_client.post(
               "/api/v1/orgs/#{org}/approvals/#{id}/approve",
-              body: { ttl_seconds: ttl_seconds }
+              body: body
             )
 
-            puts "✅ Approved request #{id}"
-            puts "   → Grant Ref: #{res["grant_ref"] || res["grant_id"]}"
-            puts "   → Expires:   #{res["expires_at"]}"
+            if res["status"] == "pending"
+              puts "✍️  Signed off on request #{id}"
+              puts "   → Approved by: #{ApprovalRoles.describe(Array(res["approved_roles"]))}"
+              puts "   → Waiting on:  #{ApprovalRoles.describe(Array(res["outstanding_roles"]))}"
+              puts "   The grant is issued once every role has approved."
+            else
+              puts "✅ Approved request #{id}"
+              puts "   → Grant Ref: #{res["grant_ref"] || res["grant_id"]}"
+              puts "   → Expires:   #{res["expires_at"]}"
+            end
           end
         end
 

data/lib/vkit/cli/commands/approval_roles.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Vkit
+  module CLI
+    module Commands
+      # Approver roles as the control plane reports them. A request can need a
+      # sign-off from several roles (approver_roles); outstanding_roles are the
+      # ones still missing. Older control planes send only approver_role.
+      module ApprovalRoles
+        module_function
+
+        def required_roles(approval)
+          roles = Array(approval["approver_roles"])
+          return roles if roles.any?
+
+          approval["approver_role"].to_s.split(",").map(&:strip).reject(&:empty?)
+        end
+
+        def outstanding_roles(approval)
+          return Array(approval["outstanding_roles"]) if approval.key?("outstanding_roles")
+
+          approval["state"].to_s == "pending" ? required_roles(approval) : []
+        end
+
+        def describe(roles, fallback: "n/a")
+          roles.empty? ? fallback : roles.join(", ")
+        end
+      end
+    end
+  end
+end

data/lib/vkit/cli/commands/approval_watch_command.rb

@@ -2,6 +2,7 @@
 
 require "json"
 require "time"
+require_relative "approval_roles"
 
 module Vkit
   module CLI
@@ -99,6 +100,8 @@ module Vkit
             fields: a["fields"],
             requester: a["requester"],
             approver_role: a["approver_role"],
+            approver_roles: ApprovalRoles.required_roles(a),
+            outstanding_roles: ApprovalRoles.outstanding_roles(a),
             created_at: a["created_at"]
           }
         end
@@ -110,7 +113,10 @@ module Vkit
           puts "Dataset:   #{a["dataset"]}"
           puts "Fields:    #{Array(a["fields"]).join(", ")}"
           puts "Requester: #{a["requester"]}"
-          puts "Role Req:  #{a["approver_role"] || "any"}"
+          puts "Role Req:  #{ApprovalRoles.describe(ApprovalRoles.required_roles(a), fallback: "any")}"
+          if Array(a["approved_roles"]).any?
+            puts "Waiting:   #{ApprovalRoles.describe(ApprovalRoles.outstanding_roles(a))}"
+          end
           puts "Created:   #{format_time(a["created_at"])}"
           puts
           puts "▶ Approve: vkit approval approve #{a["id"]}"

data/lib/vkit/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Vkit
-  VERSION = "1.1.3"
+  VERSION = "1.1.4"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: vaultkit
 version: !ruby/object:Gem::Version
-  version: 1.1.3
+  version: 1.1.4
 platform: ruby
 authors:
 - Nnamdi Ogundu
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-27 00:00:00.000000000 Z
+date: 2026-10-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -58,6 +58,7 @@ files:
 - lib/vkit/cli/commands/agent_tokens_list_command.rb
 - lib/vkit/cli/commands/agent_tokens_revoke_command.rb
 - lib/vkit/cli/commands/approval_command.rb
+- lib/vkit/cli/commands/approval_roles.rb
 - lib/vkit/cli/commands/approval_watch_command.rb
 - lib/vkit/cli/commands/base_command.rb
 - lib/vkit/cli/commands/datasource_command.rb