action_policy-authzen 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: b3423a534be53692df47668240b045ffed8324f03d71ddf36053d701096c6f70
+  data.tar.gz: afccffd23b80d3048fdbf3b8fbc37f7440e8976e947dd6a7c40c58d2abe8aee9
+SHA512:
+  metadata.gz: 81022906cf5c83fbfc760fcd951ea658e462b4b706c9dee32a8b9136a21f39a2376d213d83e539ea6b681f31d8a798c2af90444ae909191476c9bc910e4909f7
+  data.tar.gz: e465c8a1dffce6f77041d83373e4235338f45017864e89cea361476d9e211b0d5fb1f806ed174a15eb6819c3e7f8c2ebcff7b9d23903a879300d0865475925b8

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 kajisha
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,225 @@
+# action_policy-authzen
+
+Use OpenID AuthZEN authorization services from Action Policy rules and scopes.
+This Ruby gem is a **PEP-side client** for Authorization API 1.0: single and batch
+evaluation, subject/resource/action search, pagination, and PDP discovery.
+It is not a PDP server or an OpenID Certified implementation.
+
+See [conformance and limitations](docs/conformance.md) and
+[official scenario coverage](docs/official-scenarios.md).
+
+## Installation
+
+Requires Ruby 3.3 or later. This gem has not yet been published to RubyGems.
+Until release, use a local checkout:
+
+```ruby
+gem "action_policy-authzen", path: "/path/to/action_policy-authzen"
+```
+
+For development:
+
+```sh
+bundle install
+bundle exec rake test
+```
+
+## Action Policy integration
+
+```ruby
+require "action_policy/authzen"
+
+class DocumentPolicy < ActionPolicy::Base
+  include ActionPolicy::AuthZEN::Policy
+
+  def show?
+    authzen_allowed?(
+      subject: {type: "user", id: user.id.to_s},
+      action: "reader",
+      resource: {type: "document", id: record.id.to_s}
+    )
+  end
+end
+
+client = ActionPolicy::AuthZEN::Client.new(
+  endpoint: ENV.fetch("AUTHZEN_EVALUATION_URL"),
+  headers: {"Authorization" => "Bearer #{ENV.fetch('AUTHZEN_TOKEN')}"},
+  open_timeout: 2,
+  read_timeout: 5
+)
+
+policy = DocumentPolicy.new(document, user: current_user, authzen_client: client)
+policy.apply(:show?)
+```
+
+In a Rails controller, pass the client through Action Policy's authorization context:
+
+```ruby
+authorize! document, to: :show?, context: {authzen_client: client}
+```
+
+Map entity types, IDs, and actions explicitly. There is no automatic mapping from
+`show?` to `reader`. With OpenFGA, `action.name` must match a model relation.
+Entity `properties` and request `context` are supported; construct them from
+trusted application data.
+
+## Decisions and errors
+
+`allowed?(subject:, action:, resource:, context: nil)` returns a boolean.
+`evaluate(...)` returns a Hash with string keys, including optional decision
+context. Applications must interpret obligations; `allowed?` does not execute them.
+
+The client requires HTTP 200, JSON content, and boolean decisions. Failures raise:
+
+| Exception | Meaning |
+| --- | --- |
+| `ActionPolicy::AuthZEN::HTTPError` | Non-200 response, including redirects; exposes `status` |
+| `ActionPolicy::AuthZEN::InvalidResponse` | Invalid JSON, decision, context, search result, or metadata |
+| `ActionPolicy::AuthZEN::TransportError` | Connection, TLS, or timeout failure |
+| `ActionPolicy::AuthZEN::UnsupportedEndpoint` | Optional endpoint missing from discovered metadata |
+| `ArgumentError` | Invalid request, URL, or timeout |
+
+Exceptions propagate through policies. Never convert a transport failure into an
+allow decision: deny access or report service unavailability. The client does not
+follow redirects or retry requests. Error messages omit response bodies and
+authentication headers.
+
+HTTPS and certificate/hostname verification are enabled by default. Configure a
+private CA with `ca_file: "/path/to/ca.pem"`. Use `allow_http: true` only for local
+tests, and configure the authentication required by your production PDP.
+
+The gem adds no cache. Action Policy's rule caching still applies; consider policy
+instance lifetime and cache settings when permissions change.
+
+## Discovery and endpoints
+
+`endpoint:` specifies a single evaluation URL. Use `base_url:` for all APIs or
+discover the PDP's advertised endpoints:
+
+```ruby
+client = ActionPolicy::AuthZEN::Client.new(base_url: "https://pdp.example.com/tenant")
+
+client = ActionPolicy::AuthZEN::Client.discover(
+  base_url: "https://pdp.example.com/tenant",
+  headers: {"Authorization" => "Bearer #{ENV.fetch('AUTHZEN_TOKEN')}"}
+)
+client.metadata
+```
+
+Discovery requests `/.well-known/authzen-configuration/tenant`, checks exact PDP
+identity and endpoint URLs, and installs the advertised endpoints. Missing optional
+endpoints raise `UnsupportedEndpoint`. Without discovery, `base_url:` uses standard
+paths. Override individual URLs with
+`endpoints: {evaluations: "https://pdp.example.com/custom/batch"}`.
+
+Cross-origin discovery endpoints require an explicit
+`trusted_origins: ["https://other-pdp.example.com"]` allowlist before credentials
+can be forwarded. Optional `signed_metadata` is ignored; only plain JSON metadata
+is used, without any claim of signature verification.
+
+## Batch evaluation
+
+```ruby
+result = client.evaluations(
+  subject: {type: "user", id: "anne"},
+  resource: {type: "document", id: "roadmap"},
+  evaluations: [{action: "reader"}, {action: "writer"}],
+  options: {evaluations_semantic: "execute_all"}
+)
+decisions = result.fetch("evaluations").map { |entry| entry.fetch("decision") }
+```
+
+Supported semantics are `execute_all`, `deny_on_first_deny`, and
+`permit_on_first_permit`. Response cardinality, boolean types, and short-circuit
+positions are validated. Individual context is preserved. Per-item values replace
+top-level defaults as **whole objects**, not merged sub-fields.
+
+Absent or empty `evaluations` requests a single evaluation using the defaults.
+Depending on the PDP, the response contains a single `decision` or a one-element
+`evaluations` array. Nonempty requests always require an `evaluations` response.
+
+In policies, use `authzen_evaluations(...)`. Do not return its Hash as a boolean
+rule result; explicitly aggregate individual decisions with `all?` or `any?` as
+appropriate.
+
+## Search and pagination
+
+```ruby
+client.search_subjects(subject: {type: "user"}, action: "reader",
+  resource: {type: "document", id: "roadmap"})
+client.search_actions(subject: {type: "user", id: "anne"},
+  resource: {type: "document", id: "roadmap"})
+
+client.each_resource(subject: {type: "user", id: "anne"}, action: "reader",
+  resource: {type: "document"}, page: {limit: 100}).each do |resource|
+  puts resource.fetch("id")
+end
+```
+
+`search_subjects`, `search_resources`, and `search_actions` return one response
+Hash. `each_subject`, `each_resource`, and `each_action` accept a block or return
+an Enumerator. They preserve query conditions and follow opaque tokens, rejecting
+token cycles and malformed responses. Results are not deduplicated; reauthorize
+before acting because permissions may change after a search.
+
+Policy helpers use the `authzen_` prefix and are private. For example:
+
+```ruby
+scope_for :array do |records|
+  ids = authzen_each_resource(subject: {type: "user", id: user.id.to_s},
+    action: "reader", resource: {type: "document"}).map { |entry| entry.fetch("id") }
+  records.select { |record| ids.include?(record.id.to_s) }
+end
+```
+
+Consider result size before collecting IDs in memory or constructing database scopes.
+
+## Integration tests
+
+Use isolated test services, never production PDPs. OpenFGA 1.21.0 runs with
+`--experimentals=authzen`, in-memory storage, and a loopback HTTP port:
+
+```sh
+docker compose up -d
+OPENFGA_URL=http://127.0.0.1:18080 bundle exec rake integration
+docker compose down
+```
+
+Tests create and remove their own store, model, and tuples through OpenFGA's native
+API, then verify AuthZEN decisions and native Check parity. Client evaluation URLs
+include the store, for example
+`http://127.0.0.1:18080/stores/STORE_ID/access/v1/evaluation`. Pass the model ID in
+`headers: {"Openfga-Authorization-Model-Id" => model_id}` and enable `allow_http`
+for this local setup. Experimental APIs may change; test versions are pinned.
+
+Linux x86_64 runners download pinned official binaries, start a local PDP, run its
+tests, and stop the process. They require installed gems, `curl`, `unzip`, and
+`sha256sum`:
+
+```sh
+bash script/test-opa
+bash script/test-topaz
+bash script/test-opa official
+```
+
+OPA AuthZEN plugin 0.8.0 is a separate OPA extension. It covers all APIs,
+short-circuit evaluation, and paginated searches. Topaz 0.33.20 ignores
+short-circuit options; tests check that the client rejects those responses.
+Its unpaginated search is permitted by the official scenario.
+
+OPA uses `OPA_PORT` (default `18181`). Topaz uses `TOPAZ_URL` (default
+`http://127.0.0.1:18383`) and `TOPAZ_GRPC` (default `127.0.0.1:19292`). Logs and
+test data remain under `/tmp/action-policy-authzen-*`. Tests skip only when their
+PDP URL is unset; unavailable configured services fail the tests.
+
+The `official` runner uses a separate fixture based on the pinned OpenID AuthZEN
+WG scenario. [Case IDs, source provenance, and exclusions](docs/official-scenarios.md)
+are recorded explicitly. These are project-owned tests, not a run of the official
+conformance suite or a certification. CI includes all three PDPs and the scenario runner.
+
+## License
+
+[MIT](LICENSE.txt), the same license as
+[Action Policy](https://github.com/palkan/action_policy/blob/v0.7.7/LICENSE.txt).
+Vendored Topaz test fixtures retain their Apache-2.0 license and attribution in
+`test/fixtures/topaz/LICENSE` and `test/fixtures/topaz/PROVENANCE.md`.

data/docs/conformance.md

@@ -0,0 +1,81 @@
+# AuthZEN 1.0 scope and verification
+
+The target is [Authorization API 1.0 Final (January 11, 2026)](https://openid.net/specs/authorization-api-1_0.html).
+This library is a **PEP-side client** for Action Policy, not a PDP server or an
+officially certified implementation.
+
+## API coverage
+
+| Specification | Client API | Coverage |
+| --- | --- | --- |
+| Section 6: evaluation | `evaluate`, `allowed?` | Allow/deny, properties, context, malformed responses, transport failures |
+| Section 7: batch evaluation | `evaluations` | Defaults, whole-object replacement, empty arrays, all three semantics, short-circuit position, individual errors |
+| Section 8.4: subject search | `search_subjects`, `each_subject` | Type-only search target and result validation |
+| Section 8.5: resource search | `search_resources`, `each_resource` | Type-only search target and Action Policy scopes |
+| Section 8.6: action search | `search_actions`, `each_action` | Requests without action, result name validation |
+| Section 8.2: pagination | `page:`, `each_*` | Opaque tokens, zero limit, empty pages, termination, cycles, immutable query |
+| Section 9: discovery | `Client.discover`, `configuration`, `metadata` | Tenant paths, exact identity, advertised URLs, absent optional endpoints |
+| Section 10: transport | All methods | JSON objects, HTTP 200, Content-Type, X-Request-ID, TLS certificate and hostname verification |
+
+Policy helpers add the `authzen_` prefix to instance methods, except the
+client-only `metadata` reader. Decisions must be booleans. Invalid or partial
+responses are never interpreted as authorization. Unknown response fields are
+preserved but do not influence decisions.
+
+## Optional features and boundaries
+
+- **Signed metadata:** intentionally unsupported. Section 9.1.3 permits a PEP to ignore `signed_metadata`; the client validates plain JSON metadata only.
+- **Capabilities:** exposed as metadata, not automatically implemented. Unsupported pagination extension keys are rejected; use standard `page.properties` for implementation-specific attributes.
+- **Authentication:** outside the specification's scope. Supply bearer tokens or other headers through `headers:`; token issuance and renewal belong to the application.
+- **HTTPS:** required by default. `allow_http: true` is an explicit local-test exception. `ca_file:` configures a trusted CA without disabling verification.
+- **Discovery:** cross-origin endpoints require `trusted_origins:`. Missing advertised optional endpoints raise `UnsupportedEndpoint`; nondiscovery configurations use standard paths.
+- **Search:** not an atomic permission snapshot. Deduplication and reauthorization before an operation belong to the application.
+- **Decision context:** preserved, including reasons, errors, and obligations. Application-specific obligations are not executed automatically.
+
+## PDP targets
+
+- [OpenFGA 1.21.0](https://github.com/openfga/openfga/releases/tag/v1.21.0): tested with `authzen` enabled. Native APIs provision stores/models/tuples; AuthZEN exercises evaluation, batch, all searches, and discovery. Its [documented lack of pagination](https://openfga.dev/docs/interacting/authzen) is not used as pagination evidence.
+- [OPA AuthZEN plugin 0.8.0](https://github.com/kanywst/opa-authzen-plugin/tree/v0.8.0): a separate extension, not stock OPA. Tested across all six endpoints, all batch semantics, paginated searches, reauthorization, and Action Policy integration. The Linux x86_64 runner pins the binary SHA-256.
+- [Topaz 0.33.20](https://github.com/aserto-dev/topaz/releases/tag/v0.33.20): all endpoints and `execute_all` work. It ignores short-circuit options; tests verify client rejection. Returning all search results despite `limit`, with an empty token, is permitted by scenario c-4-5-4 and is not itself nonconformance.
+- Cerbos and Keycloak were investigated, but all three locally testable search endpoints were not established, so they were not selected for full-API testing.
+
+## Verification evidence
+
+The [official scenario matrix](official-scenarios.md) separates applicable client
+checks from PDP-only requirements and unsupported optional features.
+
+Recorded baseline on September 22, 2026, using Ruby 3.2.1:
+
+| Target | Tests | Assertions | Result |
+| --- | ---: | ---: | --- |
+| Unit HTTP/TLS, including scenario regressions | 65 | 237 | Passed |
+| OpenFGA 1.21.0 | 4 | 23 | Passed |
+| OPA AuthZEN plugin 0.8.0 | 3 | 35 | Passed |
+| Official WG scenario / OPA plugin 0.8.0 | 35 | 152 | Passed using a project-owned runner |
+| Topaz 0.33.20 | 7 | 25 | Passed, including known-incompatibility checks |
+
+These PDP tests used official release binaries locally. Topaz Compose and GitHub
+Actions were not executed in that environment because Docker was unavailable.
+Ruby/shell syntax and gem build checks passed. The minimum supported Ruby version
+is now 3.3, and CI is configured for Ruby 3.3, 3.4, and 4.0. The Ruby 3.2.1 results
+are historical evidence, not verification on the currently supported versions.
+
+`bundle exec rake test` uses local HTTP/TLS servers for valid and malformed
+responses, short-circuit positions, pagination, metadata, and certificate failures.
+`bundle exec rake integration` uses `OPENFGA_URL`, `TOPAZ_URL`, `OPA_URL`, and
+`OFFICIAL_PDP_URL`. The official fixture needs a separate PDP process/port from
+the basic OPA fixture. Only unset URLs skip tests; configured service failures fail.
+
+Interop results are not official certification or a guarantee of compatibility
+with every PDP.
+
+After the documentation translation and client cleanup, Ruby 3.2.1 verification
+passed 66 unit tests / 253 assertions, 35 official-scenario tests / 152 assertions,
+and 3 OPA integration tests / 35 assertions, with no failures, errors, or skips.
+Ruby/shell/YAML syntax and gem build checks also passed. OpenFGA, Topaz, and GitHub
+Actions were not rerun for this cleanup; their results above are earlier evidence.
+
+After raising the minimum Ruby version to 3.3, local verification on Ruby 3.3.5
+passed 66 unit tests / 253 assertions with no failures, errors, or skips. Ruby
+requirement checks, workflow YAML parsing, and gem build also passed. PDP
+integration tests and the Ruby 3.4/4.0 CI jobs were not rerun for this change.

data/docs/official-scenarios.md

@@ -0,0 +1,103 @@
+# Official AuthZEN scenario coverage
+
+## Pinned source
+
+- [OpenID AuthZEN WG Certification Scenario](https://github.com/openid/authzen/blob/6ed00bad5daa8f6eef6f2aef1f124442beeb8382/certification/authorization-api-1_0-scenario.md)
+- Repository: `openid/authzen`
+- Commit: `6ed00bad5daa8f6eef6f2aef1f124442beeb8382`
+- File: `certification/authorization-api-1_0-scenario.md`
+- SHA-256: `dc6846304169f32077c2f4a74a0912fff2df734a20999762b0055e15ac8ce534`
+- Retrieved: September 22, 2026
+
+These are **project-owned PEP interoperability and regression tests based on the
+official scenario**, not results from the OpenID Foundation Java conformance
+suite. The scenario targets PDPs; PDP responsibilities are not counted as PEP passes.
+
+The normative reference is [Authorization API 1.0 Final](https://openid.net/specs/authorization-api-1_0.html).
+The scenario revision is pinned to prevent silent changes to expectations.
+References use upstream `c-...` anchors rather than rendered section numbers.
+
+## Running the tests
+
+```sh
+bundle exec rake test
+bash script/test-opa official
+```
+
+The second command downloads a checksum-pinned OPA AuthZEN plugin 0.8.0 binary for
+Linux x86_64 and loads a dedicated Rego fixture implementing the eight decision
+rules and S1-S6. It is separate from the basic OPA fixture. The runner stops its
+process on exit and is included in the CI OPA job.
+
+For an existing test PDP loaded with the same fixture:
+
+```sh
+OFFICIAL_PDP_URL=http://127.0.0.1:18181 bundle exec ruby -Itest test/integration/official_scenario_test.rb
+```
+
+Only an unset URL skips tests. This runner additionally checks OPA's multipage
+support, so an external PDP must support pagination too, although the official
+scenario allows it to be absent. Local HTTP integration and TLS unit tests are
+separate evidence.
+
+The September 22, 2026 baseline on Ruby 3.2.1 recorded **35 integration tests / 152
+assertions**, with no failures, errors, or skips. All 31 JSON request fixtures were
+checked for structural equality with the pinned source. Scenario-specific unit
+checks passed **12 tests / 46 assertions**; the full unit baseline was **65 tests /
+237 assertions**. These counts are not official case or certification pass counts.
+
+## Coverage matrix
+
+- **Live:** official requests and expected results exercised through the gem against the dedicated OPA fixture.
+- **PEP:** corresponding client-side input/response checks, not execution of the official PDP test.
+- **Out of scope:** PDP server behavior, excluded from this gem's pass count.
+- **Partial:** tested subset with exclusions stated explicitly.
+
+`I` means `test/integration/official_scenario_test.rb`; `U` means
+`test/official_scenario_test.rb`. Their test names retain case IDs. Other references
+name existing regression tests under `test/`.
+
+| Official ID | Coverage | Evidence and boundary |
+| --- | --- | --- |
+| c-1-4 / c-1-5 | Live | I: eight decision rules and S1-S6; test-only policy |
+| c-2-1 / c-3-1 / c-4-1 | Live / PEP | I; `search_test.rb#test_each_search_uses_its_own_schema_and_path`; `discovery_test.rb#test_discovered_client_uses_advertised_nonstandard_urls` |
+| c-2-2-1 through c-2-2-8 | Live | I: allow, deny, context, and entity properties |
+| c-2-2-9 | Out of scope | PDP ignores unknown top-level request fields. The typed client has no API to send them. U checks that unknown response fields do not affect decisions |
+| c-2-3-1 / c-2-3-2 | PEP | U: decision presence/type and context shape/preservation; malformed JSON in `client_test.rb#test_rejects_non_boolean_or_missing_decisions` |
+| c-2-4-1 / c-2-4-2 / c-2-4-6 | PEP | U: missing fields/sub-fields and invalid types rejected before HTTP. PDP generation of HTTP 400 is out of scope |
+| c-2-4-3 / c-2-4-4 / c-2-4-5 | Out of scope | PDP handling of invalid Content-Type, malformed JSON, and empty bodies. The gem generates JSON objects. Received HTTP 400 is covered by `client_test.rb#test_http_errors_and_redirects_never_authorize` |
+| c-2-5-1 | Partial | U: explicit X-Request-ID sent. Server echo is not checked; the client does not expose response headers |
+| c-2-5-2 | Out of scope | PDP acceptance without a request ID. Client-generated IDs are tested in `client_test.rb#test_serializes_authzen_request_and_preserves_endpoint_and_headers` |
+| c-2-6 | Live | I: repeated identical fixture requests |
+| c-3-2-1 through c-3-2-7 | Live | I: independent items, defaults, properties, context inheritance, whole-object replacement |
+| c-3-3-1 through c-3-3-4 | Live / PEP | I and U: decision order, count, and types; top-level decision does not override individual results |
+| c-3-4-1 | Partial | U: preserve individual false/error responses. The official resource-less item is rejected by client input validation, not sent to a PDP |
+| c-3-4-2 / c-3-4-3 | Live / PEP | I: absent/empty evaluations; `evaluations_test.rb#test_absent_and_empty_evaluations_support_single_response` accepts a single decision or one-element array |
+| c-4-2-1 through c-4-2-4 | Live | I: subject search, context, ignored target ID, resource properties |
+| c-4-3-1 through c-4-3-4 | Live | I: resource search, context, ignored target ID, subject properties |
+| c-4-4-1 through c-4-4-3 | Live | I: action search, context, properties |
+| c-4-5-1 / c-4-5-2 | Live | I: limit and opaque token, with additional multipage checks |
+| c-4-5-3 | Live / PEP | I; `search_test.rb#test_invalid_search_responses_are_rejected`: page/token/count/total types and termination |
+| c-4-5-4 | PEP | U: accept unpaginated results, absent page, empty token, and ignored limit |
+| c-4-6-1 / c-4-6-2 | Live | I: empty results for unknown identifiers/types |
+| c-4-7-1 / c-4-7-2 | PEP | U: required search fields/sub-fields rejected before HTTP. PDP generation of HTTP 400 is out of scope |
+| c-5 | Partial | `tls_test.rb`: CA/hostname verification and explicit HTTP opt-in. U: JSON and ID. PDP unknown-field handling and header echo are out of scope |
+| c-6-1 | PEP | `discovery_test.rb#test_configuration_inserts_well_known_before_tenant_path`: GET and tenant path |
+| c-6-2 / c-6-3 | PEP | `discovery_test.rb#test_malformed_metadata_is_rejected` and `test_discovery_rejects_non_json_content_type`: required values, URLs, JSON types |
+| c-6-4 / c-6-5 | Partial | `discovery_test.rb`: optional endpoints/capabilities, exact identity, unknown fields. Signed metadata is intentionally unsupported, not verified |
+| c-6-6 | PEP | U: discovery 404 raises; an explicit nondiscovery configuration can use default paths |
+
+## Adaptations and limits
+
+- **Pagination is optional (c-4-5-4).** Ignoring `limit` and returning all results with an empty token is permitted. This describes Topaz's search behavior, independently of its short-circuit incompatibility.
+- **Stable pagination query:** the c-4-5-2 example omits the initial `limit`; our follow-up preserves all values except the token, following Final Section 8.2.1.
+- **Search matching:** official expectations require inclusion, not an exact result set. Adding context or a search-target ID must also leave the baseline results unchanged.
+- **Signed metadata:** the PDP scenario includes signature checks; this PEP intentionally does not implement the optional feature, as allowed by Final Section 9.1.3.
+- **Suite boundary:** this matrix maps the pinned WG scenario, not every GitLab conformance-suite module.
+
+## Updating the source
+
+Update the commit and SHA-256, compare added/removed `c-...` anchors, request JSON,
+and expected results, then update the matrix and tests or record a coverage gap.
+Run CI before claiming new coverage. Tests never fetch expectations from `main`
+at runtime.

data/lib/action_policy/authzen/client.rb

@@ -0,0 +1,501 @@
+require "json"
+require "net/http"
+require "securerandom"
+require "uri"
+
+module ActionPolicy
+  module AuthZEN
+    class Error < StandardError; end
+    class TransportError < Error; end
+    class InvalidResponse < Error; end
+    class UnsupportedEndpoint < Error; end
+
+    class HTTPError < Error
+      attr_reader :status
+
+      def initialize(status)
+        @status = status
+        super("AuthZEN request returned HTTP #{status}")
+      end
+    end
+
+    class Client
+      DEFAULT_PATHS = {
+        evaluation: "/access/v1/evaluation",
+        evaluations: "/access/v1/evaluations",
+        search_subject: "/access/v1/search/subject",
+        search_resource: "/access/v1/search/resource",
+        search_action: "/access/v1/search/action"
+      }.freeze
+
+      METADATA_ENDPOINTS = {
+        evaluation: "access_evaluation_endpoint",
+        evaluations: "access_evaluations_endpoint",
+        search_subject: "search_subject_endpoint",
+        search_resource: "search_resource_endpoint",
+        search_action: "search_action_endpoint"
+      }.freeze
+
+      EVALUATION_SEMANTICS = %w[execute_all deny_on_first_deny permit_on_first_permit].freeze
+
+      attr_reader :metadata
+
+      def self.discover(base_url:, metadata_url: nil, trusted_origins: [], **options)
+        unless (options.keys & %i[endpoint endpoints metadata discovered]).empty?
+          raise ArgumentError, "discovery endpoints must come from PDP metadata"
+        end
+        new(base_url: base_url, metadata_url: metadata_url, trusted_origins: trusted_origins, **options).tap(&:configuration)
+      end
+
+      def initialize(endpoint: nil, base_url: nil, endpoints: {}, metadata_url: nil,
+        headers: {}, open_timeout: 2, read_timeout: 5, ca_file: nil, trusted_origins: [], allow_http: false)
+        raise ArgumentError, "base_url or endpoint is required" if endpoint.nil? && base_url.nil?
+
+        @allow_http = allow_http == true
+        @base_url = base_url.nil? ? nil : parse_base_url(base_url, "base_url")
+        @pdp_identifier = base_url&.dup&.freeze
+        @metadata_url = metadata_url.nil? ? nil : parse_endpoint(metadata_url, "metadata_url")
+        @endpoints = {}
+        @endpoints[:evaluation] = parse_endpoint(endpoint, "endpoint") unless endpoint.nil?
+        endpoints.each do |operation, value|
+          key = operation.to_sym
+          raise ArgumentError, "unknown AuthZEN endpoint #{operation.inspect}" unless DEFAULT_PATHS.key?(key)
+
+          @endpoints[key] = parse_endpoint(value, "endpoints[#{operation.inspect}]")
+        end
+
+        @headers = headers.dup.freeze
+        @open_timeout = positive_timeout(open_timeout)
+        @read_timeout = positive_timeout(read_timeout)
+        @ca_file = ca_file
+        @metadata = nil
+        @trusted_origins = trusted_origins.map { |origin| normalize_origin(origin) }.freeze
+        @discovered = false
+      rescue URI::InvalidURIError
+        raise ArgumentError, "AuthZEN URLs must be absolute HTTP(S) URLs"
+      end
+
+      def evaluate(subject:, action:, resource:, context: nil)
+        result = post(:evaluation, evaluation_payload(subject: subject, action: action, resource: resource, context: context))
+        validate_decision(result, "AuthZEN response")
+        result
+      end
+
+      def allowed?(**request)
+        evaluate(**request).fetch("decision")
+      end
+
+      def evaluations(evaluations: nil, subject: nil, action: nil, resource: nil, context: nil, options: nil)
+        payload = evaluations_payload(evaluations: evaluations, subject: subject, action: action,
+          resource: resource, context: context, options: options)
+        result = post(:evaluations, payload)
+        single_request = evaluations.nil? || evaluations.empty?
+        count = single_request ? 1 : evaluations.length
+        semantic = payload.dig("options", "evaluations_semantic") || "execute_all"
+        validate_evaluations_response(result, count, semantic, single_request: single_request)
+        result
+      end
+
+      def search_subjects(subject:, action:, resource:, context: nil, page: nil)
+        search(:search_subject, :subject, subject: subject, action: action, resource: resource,
+          context: context, page: page)
+      end
+
+      def search_resources(subject:, action:, resource:, context: nil, page: nil)
+        search(:search_resource, :resource, subject: subject, action: action, resource: resource,
+          context: context, page: page)
+      end
+
+      def search_actions(subject:, resource:, context: nil, page: nil)
+        search(:search_action, :action, subject: subject, resource: resource, context: context, page: page)
+      end
+
+      def each_subject(**request)
+        return enum_for(:each_subject, **request) unless block_given?
+
+        each_search(:search_subjects, request) { |entity| yield entity }
+      end
+
+      def each_resource(**request)
+        return enum_for(:each_resource, **request) unless block_given?
+
+        each_search(:search_resources, request) { |entity| yield entity }
+      end
+
+      def each_action(**request)
+        return enum_for(:each_action, **request) unless block_given?
+
+        each_search(:search_actions, request) { |entity| yield entity }
+      end
+
+      def configuration
+        base = base_url
+        raise ArgumentError, "configuration discovery requires base_url" if base.nil?
+
+        response = get(metadata_uri(base))
+        raise HTTPError, response.code.to_i unless response.code == "200"
+        validate_json_content_type(response, "AuthZEN metadata response")
+
+        metadata = parse_json_object(response.body, "Invalid AuthZEN metadata JSON response")
+        validate_metadata(metadata, base)
+        endpoints = METADATA_ENDPOINTS.each_with_object({}) do |(operation, key), configured|
+          configured[operation] = parse_endpoint(metadata.fetch(key), key) if metadata.key?(key)
+        end
+        @endpoints = endpoints
+        @discovered = true
+        @metadata = metadata
+      end
+
+      private
+
+      attr_reader :base_url
+
+      def positive_timeout(value)
+        unless value.is_a?(Numeric) && value.positive? && value.finite?
+          raise ArgumentError, "timeouts must be positive finite numbers"
+        end
+        value
+      end
+
+      def evaluation_payload(subject:, action:, resource:, context:)
+        payload = {
+          "subject" => object(subject, %w[type id], "subject"),
+          "action" => object(action_value(action), %w[name], "action"),
+          "resource" => object(resource, %w[type id], "resource")
+        }
+        payload["context"] = hash_object(context, "context") unless context.nil?
+        payload
+      end
+
+      def evaluations_payload(evaluations:, subject:, action:, resource:, context:, options:)
+        payload = {}
+        payload["subject"] = object(subject, %w[type id], "subject") unless subject.nil?
+        payload["action"] = object(action_value(action), %w[name], "action") unless action.nil?
+        payload["resource"] = object(resource, %w[type id], "resource") unless resource.nil?
+        payload["context"] = hash_object(context, "context") unless context.nil?
+        payload["options"] = hash_object(options, "options") unless options.nil?
+
+        semantic = payload.dig("options", "evaluations_semantic") || "execute_all"
+        unless EVALUATION_SEMANTICS.include?(semantic)
+          raise ArgumentError, "options.evaluations_semantic must be execute_all, deny_on_first_deny, or permit_on_first_permit"
+        end
+
+        unless evaluations.nil? || evaluations.is_a?(Array)
+          raise ArgumentError, "evaluations must be an array"
+        end
+
+        if evaluations.nil? || evaluations.empty?
+          %w[subject action resource].each do |key|
+            raise ArgumentError, "#{key} is required when evaluations is absent or empty" unless payload.key?(key)
+          end
+          payload["evaluations"] = [] unless evaluations.nil?
+          return payload
+        end
+
+        payload["evaluations"] = evaluations.each_with_index.map do |evaluation, index|
+          normalized = hash_object(evaluation, "evaluations[#{index}]")
+          item = {}
+          item["subject"] = object(normalized["subject"], %w[type id], "evaluations[#{index}].subject") if normalized.key?("subject")
+          item["action"] = object(action_value(normalized["action"]), %w[name], "evaluations[#{index}].action") if normalized.key?("action")
+          item["resource"] = object(normalized["resource"], %w[type id], "evaluations[#{index}].resource") if normalized.key?("resource")
+          item["context"] = hash_object(normalized["context"], "evaluations[#{index}].context") if normalized.key?("context")
+
+          effective = payload.merge(item)
+          %w[subject action resource].each do |key|
+            raise ArgumentError, "evaluations[#{index}].#{key} or top-level #{key} is required" unless effective.key?(key)
+          end
+          item
+        end
+        payload
+      end
+
+      def action_value(value)
+        value.is_a?(String) ? {"name" => value} : value
+      end
+
+      def object(value, required, label)
+        normalized = hash_object(value, label)
+        required.each do |key|
+          unless normalized[key].is_a?(String)
+            raise ArgumentError, "#{label}.#{key} must be a string"
+          end
+        end
+        if normalized.key?("properties") && !normalized["properties"].is_a?(Hash)
+          raise ArgumentError, "#{label}.properties must be an object"
+        end
+        normalized
+      end
+
+      def hash_object(value, label)
+        raise ArgumentError, "#{label} must be an object" unless value.is_a?(Hash)
+
+        value.transform_keys(&:to_s)
+      end
+
+      def page_object(value)
+        page = hash_object(value, "page")
+        unless (page.keys - %w[token limit properties]).empty?
+          raise ArgumentError, "unsupported page extension; use page.properties for implementation-specific attributes"
+        end
+        raise ArgumentError, "page.token must be a string" if page.key?("token") && !page["token"].is_a?(String)
+        unless !page.key?("limit") || (page["limit"].is_a?(Integer) && page["limit"] >= 0)
+          raise ArgumentError, "page.limit must be a non-negative integer"
+        end
+        raise ArgumentError, "page.properties must be an object" if page.key?("properties") && !page["properties"].is_a?(Hash)
+
+        page
+      end
+
+      def post(operation, payload)
+        uri = endpoint_for(operation)
+        request = Net::HTTP::Post.new(uri, @headers)
+        request["Content-Type"] = "application/json"
+        request["Accept"] = "application/json"
+        request["X-Request-ID"] ||= SecureRandom.uuid
+        request.body = JSON.generate(payload)
+        response = perform(uri, request)
+        raise HTTPError, response.code.to_i unless response.code == "200"
+        validate_json_content_type(response, "AuthZEN response")
+
+        parse_json_object(response.body, "Invalid AuthZEN JSON response")
+      end
+
+      def get(uri)
+        request = Net::HTTP::Get.new(uri, @headers)
+        request["Accept"] = "application/json"
+        request["X-Request-ID"] ||= SecureRandom.uuid
+        perform(uri, request)
+      end
+
+      def parse_json_object(body, message)
+        result = JSON.parse(body)
+        raise InvalidResponse, "#{message}: root must be an object" unless result.is_a?(Hash)
+
+        result
+      rescue JSON::ParserError, TypeError => error
+        raise InvalidResponse, message, cause: error
+      end
+
+      def perform(uri, request)
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = uri.scheme == "https"
+        http.ca_file = @ca_file if @ca_file
+        http.open_timeout = @open_timeout
+        http.read_timeout = @read_timeout
+        http.write_timeout = @read_timeout
+        http.max_retries = 0
+        http.start { |connection| connection.request(request) }
+      rescue Timeout::Error, SocketError, SystemCallError, IOError, OpenSSL::SSL::SSLError, Net::ProtocolError => error
+        raise TransportError, "AuthZEN request failed (#{error.class})", cause: error
+      end
+
+      def endpoint_for(operation)
+        return @endpoints.fetch(operation) if @endpoints.key?(operation)
+        if @discovered
+          metadata_key = METADATA_ENDPOINTS.fetch(operation)
+          raise UnsupportedEndpoint, "AuthZEN #{operation} endpoint is unsupported by discovered metadata (missing #{metadata_key})"
+        end
+        raise ArgumentError, "#{operation} endpoint requires base_url or explicit endpoints[:#{operation}]" if @base_url.nil?
+
+        append_path(@base_url, DEFAULT_PATHS.fetch(operation))
+      end
+
+      def parse_endpoint(value, label)
+        raise ArgumentError, "#{label} must be a URL string" unless value.is_a?(String)
+        uri = URI.parse(value)
+        unless uri.is_a?(URI::HTTP) && uri.host && !uri.host.empty? && !uri.userinfo && !uri.fragment
+          raise ArgumentError, "#{label} must be an absolute HTTP(S) URL without credentials or fragment"
+        end
+        if uri.scheme != "https" && !@allow_http
+          raise ArgumentError, "#{label} requires HTTPS; allow_http: true is for local testing"
+        end
+
+        uri
+      end
+
+      def parse_base_url(value, label)
+        uri = parse_endpoint(value, label)
+        raise ArgumentError, "#{label} must not contain a query" if uri.query
+
+        uri
+      end
+
+      def append_path(uri, path)
+        copy = uri.dup
+        prefix = copy.path.to_s.sub(%r{/+\z}, "")
+        copy.path = "#{prefix}#{path}"
+        copy.query = nil
+        copy
+      end
+
+      def metadata_uri(base)
+        return @metadata_url if @metadata_url
+
+        copy = base.dup
+        path = copy.path.to_s
+        copy.path = "/.well-known/authzen-configuration#{path}"
+        copy.query = nil
+        copy
+      end
+
+      def validate_decision(result, label)
+        unless result.is_a?(Hash) && [true, false].include?(result["decision"])
+          raise InvalidResponse, "#{label} must contain a boolean decision"
+        end
+        if result.key?("context") && !result["context"].is_a?(Hash)
+          raise InvalidResponse, "#{label} context must be an object"
+        end
+      end
+
+      def validate_evaluations_response(result, expected_count, semantic, single_request:)
+        if single_request && !result.key?("evaluations")
+          validate_decision(result, "AuthZEN evaluations response")
+          return
+        end
+
+        evaluations = result["evaluations"]
+        raise InvalidResponse, "AuthZEN evaluations response must contain evaluations array" unless evaluations.is_a?(Array)
+        evaluations.each_with_index { |decision, index| validate_decision(decision, "AuthZEN evaluations[#{index}]") }
+        validate_evaluations_cardinality(evaluations, expected_count, semantic)
+      end
+
+      def validate_evaluations_cardinality(evaluations, expected_count, semantic)
+        actual_count = evaluations.length
+        case semantic
+        when "execute_all"
+          raise InvalidResponse, "AuthZEN evaluations response must contain #{expected_count} results" unless actual_count == expected_count
+        when "deny_on_first_deny"
+          validate_short_circuit(evaluations, expected_count, false, semantic)
+        when "permit_on_first_permit"
+          validate_short_circuit(evaluations, expected_count, true, semantic)
+        end
+      end
+
+      def validate_short_circuit(evaluations, expected_count, stop_decision, semantic)
+        raise InvalidResponse, "AuthZEN evaluations response must not be empty" if evaluations.empty?
+        raise InvalidResponse, "AuthZEN evaluations response has too many results" if evaluations.length > expected_count
+        evaluations[0...-1].each do |decision|
+          if decision["decision"] == stop_decision
+            raise InvalidResponse, "AuthZEN #{semantic} response short-circuited after an invalid decision"
+          end
+        end
+        unless evaluations.length == expected_count || evaluations.last["decision"] == stop_decision
+          raise InvalidResponse, "AuthZEN #{semantic} response must stop on #{stop_decision}"
+        end
+      end
+
+      def search(operation, result_kind, **request)
+        payload = search_payload(operation, **request)
+        result = post(operation, payload)
+        expected_type = payload.dig(result_kind.to_s, "type") unless result_kind == :action
+        validate_search_response(result, result_kind, expected_type)
+        result
+      end
+
+      def search_payload(operation, subject: nil, action: nil, resource: nil, context: nil, page: nil)
+        payload = {
+          "subject" => object(subject, operation == :search_subject ? %w[type] : %w[type id], "subject"),
+          "resource" => object(resource, operation == :search_resource ? %w[type] : %w[type id], "resource")
+        }
+        payload["action"] = object(action_value(action), %w[name], "action") unless operation == :search_action
+        payload["context"] = hash_object(context, "context") unless context.nil?
+        payload["page"] = page_object(page) unless page.nil?
+        payload
+      end
+
+      def validate_search_response(result, result_kind, expected_type)
+        results = result["results"]
+        raise InvalidResponse, "AuthZEN search response must contain results array" unless results.is_a?(Array)
+
+        results.each_with_index do |entity, index|
+          object(entity, result_kind == :action ? %w[name] : %w[type id], "results[#{index}]")
+          if expected_type && entity["type"] != expected_type
+            raise InvalidResponse, "AuthZEN search returned a different entity type"
+          end
+        end
+        raise InvalidResponse, "AuthZEN search response context must be an object" if result.key?("context") && !result["context"].is_a?(Hash)
+        validate_response_page(result["page"]) if result.key?("page")
+      rescue ArgumentError => error
+        raise InvalidResponse, error.message
+      end
+
+      def validate_response_page(page)
+        raise InvalidResponse, "AuthZEN search response page must be an object" unless page.is_a?(Hash)
+        raise InvalidResponse, "AuthZEN search response page.next_token must be a string" unless page["next_token"].is_a?(String)
+        if page.key?("properties") && !page["properties"].is_a?(Hash)
+          raise InvalidResponse, "AuthZEN search response page.properties must be an object"
+        end
+        %w[count total].each do |key|
+          next unless page.key?(key)
+          raise InvalidResponse, "AuthZEN search response page.#{key} must be a non-negative integer" unless page[key].is_a?(Integer) && page[key] >= 0
+        end
+      end
+
+      def each_search(method_name, request)
+        snapshot = deep_copy(request)
+        seen_tokens = {}
+        loop do
+          response = public_send(method_name, **snapshot)
+          response.fetch("results").each { |entity| yield entity }
+          next_token = response.fetch("page", {})["next_token"]
+          break if next_token.nil? || next_token.empty?
+          raise InvalidResponse, "AuthZEN pagination repeated next_token" if seen_tokens[next_token]
+
+          seen_tokens[next_token] = true
+          page = snapshot[:page] || snapshot["page"] || {}
+          page = deep_copy(page).merge(token: next_token)
+          snapshot = snapshot.merge(page: page)
+        end
+      end
+
+      def deep_copy(value)
+        Marshal.load(Marshal.dump(value))
+      end
+
+      def validate_metadata(metadata, base)
+        pdp = metadata["policy_decision_point"]
+        unless pdp.is_a?(String) && pdp == @pdp_identifier
+          raise InvalidResponse, "AuthZEN metadata policy_decision_point must exactly match #{@pdp_identifier}"
+        end
+
+        parse_base_url(pdp, "policy_decision_point metadata")
+        evaluation = metadata["access_evaluation_endpoint"]
+        raise InvalidResponse, "AuthZEN metadata requires access_evaluation_endpoint" unless evaluation.is_a?(String)
+
+        METADATA_ENDPOINTS.each_value do |key|
+          next unless metadata.key?(key)
+          raise InvalidResponse, "AuthZEN metadata #{key} must be a string" unless metadata[key].is_a?(String)
+          uri = parse_endpoint(metadata[key], "#{key} metadata")
+          unless same_origin?(uri, base) || @trusted_origins.include?(origin(uri))
+            raise InvalidResponse, "AuthZEN metadata endpoint #{key} is not on a trusted origin"
+          end
+        end
+
+        if metadata.key?("capabilities")
+          unless metadata["capabilities"].is_a?(Array) && metadata["capabilities"].all? { |capability| capability.is_a?(String) }
+            raise InvalidResponse, "AuthZEN metadata capabilities must be an array of strings"
+          end
+        end
+      rescue ArgumentError, URI::InvalidURIError => error
+        raise InvalidResponse, error.message
+      end
+
+      def validate_json_content_type(response, label)
+        content_type = response["content-type"].to_s.split(";", 2).first.to_s.strip.downcase
+        raise InvalidResponse, "#{label} Content-Type must be application/json" unless content_type == "application/json"
+      end
+
+      def same_origin?(left, right)
+        origin(left) == origin(right)
+      end
+
+      def normalize_origin(value)
+        origin(parse_endpoint(value, "trusted_origins"))
+      end
+
+      def origin(uri)
+        "#{uri.scheme}://#{uri.host}:#{uri.port}"
+      end
+    end
+  end
+end

data/lib/action_policy/authzen/policy.rb

@@ -0,0 +1,51 @@
+module ActionPolicy
+  module AuthZEN
+    module Policy
+      def self.included(base)
+        base.authorize :authzen_client
+      end
+
+      private
+
+      def authzen_configuration
+        authzen_client.configuration
+      end
+
+      def authzen_evaluate(**request)
+        authzen_client.evaluate(**request)
+      end
+
+      def authzen_evaluations(**request)
+        authzen_client.evaluations(**request)
+      end
+
+      def authzen_search_subjects(**request)
+        authzen_client.search_subjects(**request)
+      end
+
+      def authzen_search_resources(**request)
+        authzen_client.search_resources(**request)
+      end
+
+      def authzen_search_actions(**request)
+        authzen_client.search_actions(**request)
+      end
+
+      def authzen_each_subject(**request, &block)
+        authzen_client.each_subject(**request, &block)
+      end
+
+      def authzen_each_resource(**request, &block)
+        authzen_client.each_resource(**request, &block)
+      end
+
+      def authzen_each_action(**request, &block)
+        authzen_client.each_action(**request, &block)
+      end
+
+      def authzen_allowed?(subject:, action:, resource:, context: nil)
+        authzen_client.allowed?(subject: subject, action: action, resource: resource, context: context)
+      end
+    end
+  end
+end

data/lib/action_policy/authzen/version.rb

@@ -0,0 +1,5 @@
+module ActionPolicy
+  module AuthZEN
+    VERSION = "0.1.0"
+  end
+end

data/lib/action_policy/authzen.rb

@@ -0,0 +1,4 @@
+require "action_policy"
+require_relative "authzen/version"
+require_relative "authzen/client"
+require_relative "authzen/policy"

metadata

@@ -0,0 +1,104 @@
+--- !ruby/object:Gem::Specification
+name: action_policy-authzen
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- kajisha
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2026-09-22 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: action_policy
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.7.7
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.7.7
+- !ruby/object:Gem::Dependency
+  name: net-http
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.3'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.3'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: json
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.6'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.6'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+description: 
+email: 
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE.txt
+- README.md
+- docs/conformance.md
+- docs/official-scenarios.md
+- lib/action_policy/authzen.rb
+- lib/action_policy/authzen/client.rb
+- lib/action_policy/authzen/policy.rb
+- lib/action_policy/authzen/version.rb
+homepage: https://github.com/kajisha/action_policy-authzen
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.3'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.5.20
+signing_key: 
+specification_version: 4
+summary: AuthZEN authorization APIs for Action Policy
+test_files: []