cerbos 0.2.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 93f2bb2c6e0ffb8fc9e59238a36388b706ae790057473f62c51b181a30c1ec93
-  data.tar.gz: 91e8c713dac8b1f7f89245b53463f3f8098af17ade471249d10c0fae5e4cabfe
+  metadata.gz: e1c86d3d658d13d5226bad856d440ce3a511e260fb7c7a1d0df57ab6c1368584
+  data.tar.gz: b776cb441ca8011e80c43fa2647aa36e7640873290086c3b04cd6233b0192f4c
 SHA512:
-  metadata.gz: 2224efcc85af2a8238c946f44d853985cd3ce5d9b5c0c913992eaad7b738bc196c2fc88f985ae3ea38b3d03f6c72dcc851af77586e2628b6f80773db6d49894e
-  data.tar.gz: 9ac45962052d139c904134eafb42dce8ac781af74a4041d22950ba4a997da1cf02e55e55462ff8237da0e916e56909822631dcc0be5a2873e933cbd6900a6e71
+  metadata.gz: b13e093563c7ad60ac1b524dffee33b22fb1d553b433d0927063ff61b4ba10b2aa3516ac309f03384848b40913776605ea7b922fce906d2c6dbe43f8c175dd19
+  data.tar.gz: '039c5611d71e663451ecb192efaa91fe63a09f81de902b21ec67dee270374170e0fd08db61eee9b3b43283bca8299cd362bccb16a010670e77f9017ecf0a5932'

data/CHANGELOG.md

@@ -1,6 +1,23 @@
 ## [Unreleased]
 No notable changes.
 
+## [0.5.0] - 2022-06-09
+### Added
+- Allow symbol keys in nested attributes hashes ([#28](https://github.com/cerbos/cerbos-sdk-ruby/pull/28))
+
+## [0.4.0] - 2022-06-03
+### Added
+- `on_validation_error` option to `Cerbos::Client#initialize` ([#22](https://github.com/cerbos/cerbos-sdk-ruby/pull/22))
+
+### Changed
+- Minor documentation fixes ([#21](https://github.com/cerbos/cerbos-sdk-ruby/pull/21))
+
+## [0.3.0] - 2022-05-13
+### Added
+- More helper methods ([#11](https://github.com/cerbos/cerbos-sdk-ruby/pull/11))
+  - `Cerbos::Client#allow?` for checking a single action on a resource
+  - `Cerbos::Output::CheckResources#allow_all?` and `Cerbos::Output::CheckResources::Result#allow_all?` for checking if all input actions were allowed
+
 ## [0.2.0] - 2022-05-12
 ### Changed
 - Increased `grpc` version requirement to 1.46+ to avoid [installing a native gem compiled for `x86_64-darwin` on `arm64-darwin`](https://github.com/grpc/grpc/issues/29100) ([#8](https://github.com/cerbos/cerbos-sdk-ruby/pull/8))
@@ -9,6 +26,9 @@ No notable changes.
 ### Added
 - Initial implementation of `Cerbos::Client` ([#2](https://github.com/cerbos/cerbos-sdk-ruby/pull/2))
 
-[Unreleased]: https://github.com/cerbos/cerbos-sdk-ruby/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/cerbos/cerbos-sdk-ruby/compare/v0.5.0...HEAD
+[0.5.0]: https://github.com/cerbos/cerbos-sdk-ruby/compare/v0.4.0...v0.5.0
+[0.4.0]: https://github.com/cerbos/cerbos-sdk-ruby/compare/v0.3.0...v0.4.0
+[0.3.0]: https://github.com/cerbos/cerbos-sdk-ruby/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/cerbos/cerbos-sdk-ruby/compare/v0.1.0...v0.2.0
 [0.1.0]: https://github.com/cerbos/cerbos-sdk-ruby/compare/4481009e9dec2e1e6a2df8ea2f828690ceabbefc...v0.1.0

data/README.md

@@ -53,3 +53,13 @@ decision.allow?("edit") # => false
 ```
 
 For more details, [see the `Client` documentation](https://www.rubydoc.info/gems/cerbos/Cerbos/Client).
+
+## Further reading
+
+- [API reference](https://www.rubydoc.info/gems/cerbos/Cerbos)
+- [Cerbos documentation](https://docs.cerbos.dev)
+
+## Get help
+
+- [Join the Cerbos community on Slack](http://go.cerbos.io/slack)
+- [Email us at help@cerbos.dev](mailto:help@cerbos.dev)

data/lib/cerbos/client.rb

@@ -9,9 +9,10 @@ module Cerbos
   class Client
     # Create a client for interacting with the Cerbos PDP server over gRPC.
     #
-    # @param target [String] Cerbos PDP server address (`"host", "host:port"`, or `"unix:/path/to/socket"`).
+    # @param target [String] Cerbos PDP server address (`"host"`, `"host:port"`, or `"unix:/path/to/socket"`).
     # @param tls [TLS, MutualTLS, false] gRPC connection encryption settings (`false` for plaintext).
     # @param grpc_channel_args [Hash{String, Symbol => String, Integer}] low-level settings for the gRPC channel (see [available keys in the gRPC documentation](https://grpc.github.io/grpc/core/group__grpc__arg__keys.html)).
+    # @param on_validation_error [:return, :raise, #call] action to take when input fails schema validation (`:return` to return the validation errors in the response, `:raise` to raise {Error::ValidationFailed}, or a callback to invoke).
     # @param playground_instance [String, nil] identifier of the playground instance to use when prototyping against the hosted demo PDP.
     # @param timeout [Numeric, nil] timeout for gRPC calls, in seconds (`nil` to never time out).
     #
@@ -23,7 +24,15 @@ module Cerbos
     #
     # @example Connect to the hosted demo PDP to experiment [in the playground](https://play.cerbos.dev)
     #   client = Cerbos::Client.new("demo-pdp.cerbos.cloud", tls: Cerbos::TLS.new, playground_instance: "gE623b0180QlsG5a4QIN6UOZ6f3iSFW2")
-    def initialize(target, tls:, grpc_channel_args: {}, playground_instance: nil, timeout: nil)
+    #
+    # @example Raise an error when input fails schema validation
+    #   client = Cerbos::Client.new("localhost:3593", tls: false, on_validation_error: :raise)
+    #
+    # @example Invoke a callback when input fails schema validation
+    #   client = Cerbos::Client.new("localhost:3593", tls: false, on_validation_error: ->(validation_errors) { do_something_with validation_errors })
+    def initialize(target, tls:, grpc_channel_args: {}, on_validation_error: :return, playground_instance: nil, timeout: nil)
+      @on_validation_error = on_validation_error
+
       handle_errors do
         credentials = tls ? tls.to_channel_credentials : :this_channel_is_insecure
 
@@ -44,11 +53,37 @@ module Cerbos
       end
     end
 
+    # Check if a principal is allowed to perform an action on a resource.
+    #
+    # @param principal [Input::Principal, Hash] the principal to check.
+    # @param resource [Input::Resource, Hash] the resource to check.
+    # @param action [String] the action to check.
+    # @param aux_data [Input::AuxData, Hash, nil] auxiliary data.
+    # @param request_id [String] identifier for tracing the request.
+    #
+    # @return [Boolean]
+    #
+    # @example
+    #   client.allow?(
+    #     principal: {id: "user@example.com", roles: ["USER"]},
+    #     resource: {kind: "document", id: "1"},
+    #     action: "view"
+    #   ) # => true
+    def allow?(principal:, resource:, action:, aux_data: nil, request_id: SecureRandom.uuid)
+      check_resource(
+        principal: principal,
+        resource: resource,
+        actions: [action],
+        aux_data: aux_data,
+        request_id: request_id
+      ).allow?(action)
+    end
+
     # Check a principal's permissions on a resource.
     #
     # @param principal [Input::Principal, Hash] the principal to check.
     # @param resource [Input::Resource, Hash] the resource to check.
-    # @param actions [Input::Resource, Hash] the actions to check.
+    # @param actions [Array<String>] the actions to check.
     # @param aux_data [Input::AuxData, Hash, nil] auxiliary data.
     # @param include_metadata [Boolean] `true` to include additional metadata ({Output::CheckResources::Result::Metadata}) in the results.
     # @param request_id [String] identifier for tracing the request.
@@ -100,7 +135,7 @@ module Cerbos
     #     ]
     #   )
     #
-    #   result.allow?(resource: {kind: "document", id: "1"}, action: "view") # => true
+    #   decision.allow?(resource: {kind: "document", id: "1"}, action: "view") # => true
     def check_resources(principal:, resources:, aux_data: nil, include_metadata: false, request_id: SecureRandom.uuid)
       handle_errors do
         request = Protobuf::Cerbos::Request::V1::CheckResourcesRequest.new(
@@ -113,7 +148,9 @@ module Cerbos
 
         response = perform_request(@cerbos_service, :check_resources, request)
 
-        Output::CheckResources.from_protobuf(response)
+        Output::CheckResources.from_protobuf(response).tap do |output|
+          handle_validation_errors output
+        end
       end
     end
 
@@ -181,6 +218,17 @@ module Cerbos
       raise Error, error.message
     end
 
+    def handle_validation_errors(output)
+      return if @on_validation_error == :return
+
+      validation_errors = output.results.flat_map(&:validation_errors)
+      return if validation_errors.empty?
+
+      raise Error::ValidationFailed.new(validation_errors) if @on_validation_error == :raise
+
+      @on_validation_error.call validation_errors
+    end
+
     def perform_request(service, rpc, request)
       service.public_send(rpc, request)
     end

data/lib/cerbos/error.rb

@@ -3,6 +3,21 @@
 module Cerbos
   # Base type for errors thrown by the `cerbos` gem.
   class Error < StandardError
+    # Input failed schema validation.
+    class ValidationFailed < Error
+      # The validation errors that occurred.
+      #
+      # @return [Array<Output::CheckResources::Result::ValidationError>]
+      attr_reader :validation_errors
+
+      # @private
+      def initialize(validation_errors)
+        super "Input failed schema validation"
+
+        @validation_errors = validation_errors
+      end
+    end
+
     # An error indicating an unsuccessful gRPC operation.
     class NotOK < Error
       # The gRPC status code.
@@ -33,7 +48,7 @@ module Cerbos
 
       # @private
       def initialize(code:, details:, metadata: {})
-        super("gRPC error #{code}: #{details}")
+        super "gRPC error #{code}: #{details}"
 
         @code = code
         @details = details

data/lib/cerbos/input/attributes.rb

@@ -22,7 +22,20 @@ module Cerbos
 
       # @private
       def to_protobuf
-        @attributes.transform_values { |value| Google::Protobuf::Value.from_ruby(value) }
+        @attributes.transform_values { |value| Google::Protobuf::Value.from_ruby(deep_stringify_keys(value)) }
+      end
+
+      private
+
+      def deep_stringify_keys(object)
+        case object
+        when Hash
+          object.each_with_object({}) { |(key, value), result| result[key.to_s] = deep_stringify_keys(value) }
+        when Array
+          object.map { |value| deep_stringify_keys(value) }
+        else
+          object
+        end
       end
     end
   end

data/lib/cerbos/input/resource_query.rb

@@ -43,7 +43,7 @@ module Cerbos
 
       # @private
       def to_protobuf
-        Protobuf::Cerbos::Engine::V1::PlanResourcesRequest::Resource.new(
+        Protobuf::Cerbos::Engine::V1::PlanResourcesInput::Resource.new(
           kind: kind,
           attr: attributes.to_protobuf,
           policy_version: policy_version,

data/lib/cerbos/output/check_resources.rb

@@ -23,7 +23,7 @@ module Cerbos
         )
       end
 
-      # Check the policy decision was that an action should be allowed for a resource.
+      # Check if the policy decision was that an action should be allowed for a resource.
       #
       # @param resource [Input::Resource, Hash] the resource search criteria (see {#find_result}).
       # @param action [String] the action to check.
@@ -34,6 +34,16 @@ module Cerbos
         find_result(resource)&.allow?(action)
       end
 
+      # Check if the policy decision was that all input actions should be allowed for a resource.
+      #
+      # @param resource [Input::Resource, Hash] the resource search criteria (see {#find_result}).
+      #
+      # @return [Boolean]
+      # @return [nil] if the resource is not present in the results.
+      def allow_all?(resource)
+        find_result(resource)&.allow_all?
+      end
+
       # Find an item from {#results} by resource.
       #
       # @param resource [Input::Resource, Hash] the resource search criteria. `kind` and `id` are required; `policy_version` and `scope` may also be provided if needed to distinguish between multiple results for the same `kind` and `id`.
@@ -95,6 +105,13 @@ module Cerbos
         actions[action]&.eql?(:EFFECT_ALLOW)
       end
 
+      # Check if the policy decision was that all input actions should be allowed for the resource.
+      #
+      # @return [Boolean]
+      def allow_all?
+        actions.each_value.all? { |effect| effect == :EFFECT_ALLOW }
+      end
+
       # List the actions that should be allowed for the resource.
       #
       # @return [Array<String>]

data/lib/cerbos/protobuf/cerbos/audit/v1/audit_pb.rb

@@ -23,6 +23,20 @@ Google::Protobuf::DescriptorPool.generated_pool.build do
       repeated :inputs, :message, 4, "cerbos.engine.v1.CheckInput", json_name: "inputs"
       repeated :outputs, :message, 5, "cerbos.engine.v1.CheckOutput", json_name: "outputs"
       optional :error, :string, 6, json_name: "error"
+      oneof :method do
+        optional :check_resources, :message, 7, "cerbos.audit.v1.DecisionLogEntry.CheckResources", json_name: "checkResources"
+        optional :plan_resources, :message, 8, "cerbos.audit.v1.DecisionLogEntry.PlanResources", json_name: "planResources"
+      end
+    end
+    add_message "cerbos.audit.v1.DecisionLogEntry.CheckResources" do
+      repeated :inputs, :message, 1, "cerbos.engine.v1.CheckInput", json_name: "inputs"
+      repeated :outputs, :message, 2, "cerbos.engine.v1.CheckOutput", json_name: "outputs"
+      optional :error, :string, 3, json_name: "error"
+    end
+    add_message "cerbos.audit.v1.DecisionLogEntry.PlanResources" do
+      optional :input, :message, 1, "cerbos.engine.v1.PlanResourcesInput", json_name: "input"
+      optional :output, :message, 2, "cerbos.engine.v1.PlanResourcesOutput", json_name: "output"
+      optional :error, :string, 3, json_name: "error"
     end
     add_message "cerbos.audit.v1.MetaValues" do
       repeated :values, :string, 1, json_name: "values"
@@ -41,6 +55,8 @@ module Cerbos::Protobuf::Cerbos
     module V1
       AccessLogEntry = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.audit.v1.AccessLogEntry").msgclass
       DecisionLogEntry = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.audit.v1.DecisionLogEntry").msgclass
+      DecisionLogEntry::CheckResources = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.audit.v1.DecisionLogEntry.CheckResources").msgclass
+      DecisionLogEntry::PlanResources = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.audit.v1.DecisionLogEntry.PlanResources").msgclass
       MetaValues = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.audit.v1.MetaValues").msgclass
       Peer = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.audit.v1.Peer").msgclass
     end

data/lib/cerbos/protobuf/cerbos/engine/v1/engine_pb.rb

@@ -13,20 +13,69 @@ require 'cerbos/protobuf/validate/validate_pb'
 
 Google::Protobuf::DescriptorPool.generated_pool.build do
   add_file("cerbos/engine/v1/engine.proto", :syntax => :proto3) do
-    add_message "cerbos.engine.v1.PlanResourcesRequest" do
+    add_message "cerbos.engine.v1.PlanResourcesInput" do
       optional :request_id, :string, 1, json_name: "requestId"
       optional :action, :string, 2, json_name: "action"
       optional :principal, :message, 3, "cerbos.engine.v1.Principal", json_name: "principal"
-      optional :resource, :message, 4, "cerbos.engine.v1.PlanResourcesRequest.Resource", json_name: "resource"
+      optional :resource, :message, 4, "cerbos.engine.v1.PlanResourcesInput.Resource", json_name: "resource"
       optional :aux_data, :message, 5, "cerbos.engine.v1.AuxData", json_name: "auxData"
       optional :include_meta, :bool, 6, json_name: "includeMeta"
     end
-    add_message "cerbos.engine.v1.PlanResourcesRequest.Resource" do
+    add_message "cerbos.engine.v1.PlanResourcesInput.Resource" do
       optional :kind, :string, 1, json_name: "kind"
       map :attr, :string, :message, 2, "google.protobuf.Value"
       optional :policy_version, :string, 3, json_name: "policyVersion"
       optional :scope, :string, 4, json_name: "scope"
     end
+    add_message "cerbos.engine.v1.PlanResourcesAst" do
+      optional :filter_ast, :message, 1, "cerbos.engine.v1.PlanResourcesAst.Node", json_name: "filterAst"
+    end
+    add_message "cerbos.engine.v1.PlanResourcesAst.Node" do
+      oneof :node do
+        optional :logical_operation, :message, 1, "cerbos.engine.v1.PlanResourcesAst.LogicalOperation", json_name: "logicalOperation"
+        optional :expression, :message, 2, "google.api.expr.v1alpha1.CheckedExpr", json_name: "expression"
+      end
+    end
+    add_message "cerbos.engine.v1.PlanResourcesAst.LogicalOperation" do
+      optional :operator, :enum, 1, "cerbos.engine.v1.PlanResourcesAst.LogicalOperation.Operator", json_name: "operator"
+      repeated :nodes, :message, 2, "cerbos.engine.v1.PlanResourcesAst.Node", json_name: "nodes"
+    end
+    add_enum "cerbos.engine.v1.PlanResourcesAst.LogicalOperation.Operator" do
+      value :OPERATOR_UNSPECIFIED, 0
+      value :OPERATOR_AND, 1
+      value :OPERATOR_OR, 2
+      value :OPERATOR_NOT, 3
+    end
+    add_message "cerbos.engine.v1.PlanResourcesFilter" do
+      optional :kind, :enum, 1, "cerbos.engine.v1.PlanResourcesFilter.Kind", json_name: "kind"
+      optional :condition, :message, 2, "cerbos.engine.v1.PlanResourcesFilter.Expression.Operand", json_name: "condition"
+    end
+    add_message "cerbos.engine.v1.PlanResourcesFilter.Expression" do
+      optional :operator, :string, 1, json_name: "operator"
+      repeated :operands, :message, 2, "cerbos.engine.v1.PlanResourcesFilter.Expression.Operand", json_name: "operands"
+    end
+    add_message "cerbos.engine.v1.PlanResourcesFilter.Expression.Operand" do
+      oneof :node do
+        optional :value, :message, 1, "google.protobuf.Value", json_name: "value"
+        optional :expression, :message, 2, "cerbos.engine.v1.PlanResourcesFilter.Expression", json_name: "expression"
+        optional :variable, :string, 3, json_name: "variable"
+      end
+    end
+    add_enum "cerbos.engine.v1.PlanResourcesFilter.Kind" do
+      value :KIND_UNSPECIFIED, 0
+      value :KIND_ALWAYS_ALLOWED, 1
+      value :KIND_ALWAYS_DENIED, 2
+      value :KIND_CONDITIONAL, 3
+    end
+    add_message "cerbos.engine.v1.PlanResourcesOutput" do
+      optional :request_id, :string, 1, json_name: "requestId"
+      optional :action, :string, 2, json_name: "action"
+      optional :kind, :string, 3, json_name: "kind"
+      optional :policy_version, :string, 4, json_name: "policyVersion"
+      optional :scope, :string, 5, json_name: "scope"
+      optional :filter, :message, 6, "cerbos.engine.v1.PlanResourcesFilter", json_name: "filter"
+      optional :filter_debug, :string, 7, json_name: "filterDebug"
+    end
     add_message "cerbos.engine.v1.CheckInput" do
       optional :request_id, :string, 1, json_name: "requestId"
       optional :resource, :message, 2, "cerbos.engine.v1.Resource", json_name: "resource"
@@ -46,30 +95,6 @@ Google::Protobuf::DescriptorPool.generated_pool.build do
       optional :policy, :string, 2, json_name: "policy"
       optional :scope, :string, 3, json_name: "scope"
     end
-    add_message "cerbos.engine.v1.PlanResourcesOutput" do
-      optional :request_id, :string, 1, json_name: "requestId"
-      optional :action, :string, 2, json_name: "action"
-      optional :kind, :string, 3, json_name: "kind"
-      optional :policy_version, :string, 4, json_name: "policyVersion"
-      optional :scope, :string, 5, json_name: "scope"
-      optional :filter, :message, 6, "cerbos.engine.v1.PlanResourcesOutput.Node", json_name: "filter"
-    end
-    add_message "cerbos.engine.v1.PlanResourcesOutput.Node" do
-      oneof :node do
-        optional :logical_operation, :message, 1, "cerbos.engine.v1.PlanResourcesOutput.LogicalOperation", json_name: "logicalOperation"
-        optional :expression, :message, 2, "google.api.expr.v1alpha1.CheckedExpr", json_name: "expression"
-      end
-    end
-    add_message "cerbos.engine.v1.PlanResourcesOutput.LogicalOperation" do
-      optional :operator, :enum, 1, "cerbos.engine.v1.PlanResourcesOutput.LogicalOperation.Operator", json_name: "operator"
-      repeated :nodes, :message, 2, "cerbos.engine.v1.PlanResourcesOutput.Node", json_name: "nodes"
-    end
-    add_enum "cerbos.engine.v1.PlanResourcesOutput.LogicalOperation.Operator" do
-      value :OPERATOR_UNSPECIFIED, 0
-      value :OPERATOR_AND, 1
-      value :OPERATOR_OR, 2
-      value :OPERATOR_NOT, 3
-    end
     add_message "cerbos.engine.v1.Resource" do
       optional :kind, :string, 1, json_name: "kind"
       optional :policy_version, :string, 2, json_name: "policyVersion"
@@ -143,15 +168,20 @@ end
 module Cerbos::Protobuf::Cerbos
   module Engine
     module V1
-      PlanResourcesRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.PlanResourcesRequest").msgclass
-      PlanResourcesRequest::Resource = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.PlanResourcesRequest.Resource").msgclass
+      PlanResourcesInput = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.PlanResourcesInput").msgclass
+      PlanResourcesInput::Resource = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.PlanResourcesInput.Resource").msgclass
+      PlanResourcesAst = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.PlanResourcesAst").msgclass
+      PlanResourcesAst::Node = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.PlanResourcesAst.Node").msgclass
+      PlanResourcesAst::LogicalOperation = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.PlanResourcesAst.LogicalOperation").msgclass
+      PlanResourcesAst::LogicalOperation::Operator = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.PlanResourcesAst.LogicalOperation.Operator").enummodule
+      PlanResourcesFilter = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.PlanResourcesFilter").msgclass
+      PlanResourcesFilter::Expression = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.PlanResourcesFilter.Expression").msgclass
+      PlanResourcesFilter::Expression::Operand = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.PlanResourcesFilter.Expression.Operand").msgclass
+      PlanResourcesFilter::Kind = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.PlanResourcesFilter.Kind").enummodule
+      PlanResourcesOutput = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.PlanResourcesOutput").msgclass
       CheckInput = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.CheckInput").msgclass
       CheckOutput = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.CheckOutput").msgclass
       CheckOutput::ActionEffect = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.CheckOutput.ActionEffect").msgclass
-      PlanResourcesOutput = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.PlanResourcesOutput").msgclass
-      PlanResourcesOutput::Node = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.PlanResourcesOutput.Node").msgclass
-      PlanResourcesOutput::LogicalOperation = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.PlanResourcesOutput.LogicalOperation").msgclass
-      PlanResourcesOutput::LogicalOperation::Operator = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.PlanResourcesOutput.LogicalOperation.Operator").enummodule
       Resource = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.Resource").msgclass
       Principal = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.Principal").msgclass
       AuxData = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.engine.v1.AuxData").msgclass

data/lib/cerbos/protobuf/cerbos/request/v1/request_pb.rb

@@ -19,7 +19,7 @@ Google::Protobuf::DescriptorPool.generated_pool.build do
       optional :request_id, :string, 1, json_name: "requestId"
       optional :action, :string, 2, json_name: "action"
       optional :principal, :message, 3, "cerbos.engine.v1.Principal", json_name: "principal"
-      optional :resource, :message, 4, "cerbos.engine.v1.PlanResourcesRequest.Resource", json_name: "resource"
+      optional :resource, :message, 4, "cerbos.engine.v1.PlanResourcesInput.Resource", json_name: "resource"
       optional :aux_data, :message, 5, "cerbos.request.v1.AuxData", json_name: "auxData"
       optional :include_meta, :bool, 6, json_name: "includeMeta"
     end

data/lib/cerbos/protobuf/cerbos/response/v1/response_pb.rb

@@ -5,10 +5,10 @@ require 'google/protobuf'
 
 require 'cerbos/protobuf/cerbos/audit/v1/audit_pb'
 require 'cerbos/protobuf/cerbos/effect/v1/effect_pb'
+require 'cerbos/protobuf/cerbos/engine/v1/engine_pb'
 require 'cerbos/protobuf/cerbos/policy/v1/policy_pb'
 require 'cerbos/protobuf/cerbos/schema/v1/schema_pb'
 require 'google/protobuf/empty_pb'
-require 'google/protobuf/struct_pb'
 require 'cerbos/protobuf/protoc-gen-openapiv2/options/annotations_pb'
 
 Google::Protobuf::DescriptorPool.generated_pool.build do
@@ -18,30 +18,9 @@ Google::Protobuf::DescriptorPool.generated_pool.build do
       optional :action, :string, 2, json_name: "action"
       optional :resource_kind, :string, 3, json_name: "resourceKind"
       optional :policy_version, :string, 4, json_name: "policyVersion"
-      optional :filter, :message, 5, "cerbos.response.v1.PlanResourcesResponse.Filter", json_name: "filter"
+      optional :filter, :message, 5, "cerbos.engine.v1.PlanResourcesFilter", json_name: "filter"
       optional :meta, :message, 6, "cerbos.response.v1.PlanResourcesResponse.Meta", json_name: "meta"
     end
-    add_message "cerbos.response.v1.PlanResourcesResponse.Expression" do
-      optional :operator, :string, 1, json_name: "operator"
-      repeated :operands, :message, 2, "cerbos.response.v1.PlanResourcesResponse.Expression.Operand", json_name: "operands"
-    end
-    add_message "cerbos.response.v1.PlanResourcesResponse.Expression.Operand" do
-      oneof :node do
-        optional :value, :message, 1, "google.protobuf.Value", json_name: "value"
-        optional :expression, :message, 2, "cerbos.response.v1.PlanResourcesResponse.Expression", json_name: "expression"
-        optional :variable, :string, 3, json_name: "variable"
-      end
-    end
-    add_message "cerbos.response.v1.PlanResourcesResponse.Filter" do
-      optional :kind, :enum, 1, "cerbos.response.v1.PlanResourcesResponse.Filter.Kind", json_name: "kind"
-      optional :condition, :message, 2, "cerbos.response.v1.PlanResourcesResponse.Expression.Operand", json_name: "condition"
-    end
-    add_enum "cerbos.response.v1.PlanResourcesResponse.Filter.Kind" do
-      value :KIND_UNSPECIFIED, 0
-      value :KIND_ALWAYS_ALLOWED, 1
-      value :KIND_ALWAYS_DENIED, 2
-      value :KIND_CONDITIONAL, 3
-    end
     add_message "cerbos.response.v1.PlanResourcesResponse.Meta" do
       optional :filter_debug, :string, 1, json_name: "filterDebug"
       optional :matched_scope, :string, 2, json_name: "matchedScope"
@@ -189,10 +168,6 @@ module Cerbos::Protobuf::Cerbos
   module Response
     module V1
       PlanResourcesResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.response.v1.PlanResourcesResponse").msgclass
-      PlanResourcesResponse::Expression = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.response.v1.PlanResourcesResponse.Expression").msgclass
-      PlanResourcesResponse::Expression::Operand = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.response.v1.PlanResourcesResponse.Expression.Operand").msgclass
-      PlanResourcesResponse::Filter = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.response.v1.PlanResourcesResponse.Filter").msgclass
-      PlanResourcesResponse::Filter::Kind = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.response.v1.PlanResourcesResponse.Filter.Kind").enummodule
       PlanResourcesResponse::Meta = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.response.v1.PlanResourcesResponse.Meta").msgclass
       CheckResourceSetResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.response.v1.CheckResourceSetResponse").msgclass
       CheckResourceSetResponse::ActionEffectMap = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.response.v1.CheckResourceSetResponse.ActionEffectMap").msgclass

data/lib/cerbos/protobuf/cerbos/telemetry/v1/telemetry_pb.rb

@@ -7,93 +7,117 @@ require 'google/protobuf/duration_pb'
 
 Google::Protobuf::DescriptorPool.generated_pool.build do
   add_file("cerbos/telemetry/v1/telemetry.proto", :syntax => :proto3) do
-    add_message "cerbos.telemetry.v1.Ping" do
+    add_message "cerbos.telemetry.v1.ServerLaunch" do
       optional :version, :string, 1, json_name: "version"
-      optional :source, :message, 2, "cerbos.telemetry.v1.Ping.Source", json_name: "source"
-      optional :features, :message, 3, "cerbos.telemetry.v1.Ping.Features", json_name: "features"
-      optional :stats, :message, 4, "cerbos.telemetry.v1.Ping.Stats", json_name: "stats"
+      optional :source, :message, 2, "cerbos.telemetry.v1.ServerLaunch.Source", json_name: "source"
+      optional :features, :message, 3, "cerbos.telemetry.v1.ServerLaunch.Features", json_name: "features"
+      optional :stats, :message, 4, "cerbos.telemetry.v1.ServerLaunch.Stats", json_name: "stats"
     end
-    add_message "cerbos.telemetry.v1.Ping.Cerbos" do
+    add_message "cerbos.telemetry.v1.ServerLaunch.Cerbos" do
       optional :version, :string, 1, json_name: "version"
       optional :commit, :string, 2, json_name: "commit"
       optional :build_date, :string, 3, json_name: "buildDate"
       optional :module_version, :string, 4, json_name: "moduleVersion"
       optional :module_checksum, :string, 5, json_name: "moduleChecksum"
     end
-    add_message "cerbos.telemetry.v1.Ping.Source" do
-      optional :cerbos, :message, 1, "cerbos.telemetry.v1.Ping.Cerbos", json_name: "cerbos"
+    add_message "cerbos.telemetry.v1.ServerLaunch.Source" do
+      optional :cerbos, :message, 1, "cerbos.telemetry.v1.ServerLaunch.Cerbos", json_name: "cerbos"
       optional :os, :string, 2, json_name: "os"
       optional :arch, :string, 3, json_name: "arch"
       optional :num_cpus, :uint32, 4, json_name: "numCpus"
     end
-    add_message "cerbos.telemetry.v1.Ping.Features" do
-      optional :audit, :message, 1, "cerbos.telemetry.v1.Ping.Features.Audit", json_name: "audit"
-      optional :schema, :message, 2, "cerbos.telemetry.v1.Ping.Features.Schema", json_name: "schema"
-      optional :admin_api, :message, 3, "cerbos.telemetry.v1.Ping.Features.AdminApi", json_name: "adminApi"
-      optional :storage, :message, 4, "cerbos.telemetry.v1.Ping.Features.Storage", json_name: "storage"
+    add_message "cerbos.telemetry.v1.ServerLaunch.Features" do
+      optional :audit, :message, 1, "cerbos.telemetry.v1.ServerLaunch.Features.Audit", json_name: "audit"
+      optional :schema, :message, 2, "cerbos.telemetry.v1.ServerLaunch.Features.Schema", json_name: "schema"
+      optional :admin_api, :message, 3, "cerbos.telemetry.v1.ServerLaunch.Features.AdminApi", json_name: "adminApi"
+      optional :storage, :message, 4, "cerbos.telemetry.v1.ServerLaunch.Features.Storage", json_name: "storage"
     end
-    add_message "cerbos.telemetry.v1.Ping.Features.Audit" do
+    add_message "cerbos.telemetry.v1.ServerLaunch.Features.Audit" do
       optional :enabled, :bool, 1, json_name: "enabled"
       optional :backend, :string, 2, json_name: "backend"
     end
-    add_message "cerbos.telemetry.v1.Ping.Features.Schema" do
+    add_message "cerbos.telemetry.v1.ServerLaunch.Features.Schema" do
       optional :enforcement, :string, 1, json_name: "enforcement"
     end
-    add_message "cerbos.telemetry.v1.Ping.Features.AdminApi" do
+    add_message "cerbos.telemetry.v1.ServerLaunch.Features.AdminApi" do
       optional :enabled, :bool, 1, json_name: "enabled"
     end
-    add_message "cerbos.telemetry.v1.Ping.Features.Storage" do
+    add_message "cerbos.telemetry.v1.ServerLaunch.Features.Storage" do
       optional :driver, :string, 1, json_name: "driver"
       oneof :store do
-        optional :disk, :message, 2, "cerbos.telemetry.v1.Ping.Features.Storage.Disk", json_name: "disk"
-        optional :git, :message, 3, "cerbos.telemetry.v1.Ping.Features.Storage.Git", json_name: "git"
-        optional :blob, :message, 4, "cerbos.telemetry.v1.Ping.Features.Storage.Blob", json_name: "blob"
+        optional :disk, :message, 2, "cerbos.telemetry.v1.ServerLaunch.Features.Storage.Disk", json_name: "disk"
+        optional :git, :message, 3, "cerbos.telemetry.v1.ServerLaunch.Features.Storage.Git", json_name: "git"
+        optional :blob, :message, 4, "cerbos.telemetry.v1.ServerLaunch.Features.Storage.Blob", json_name: "blob"
       end
     end
-    add_message "cerbos.telemetry.v1.Ping.Features.Storage.Disk" do
+    add_message "cerbos.telemetry.v1.ServerLaunch.Features.Storage.Disk" do
       optional :watch, :bool, 1, json_name: "watch"
     end
-    add_message "cerbos.telemetry.v1.Ping.Features.Storage.Git" do
+    add_message "cerbos.telemetry.v1.ServerLaunch.Features.Storage.Git" do
       optional :protocol, :string, 1, json_name: "protocol"
       optional :auth, :bool, 2, json_name: "auth"
       optional :poll_interval, :message, 3, "google.protobuf.Duration", json_name: "pollInterval"
     end
-    add_message "cerbos.telemetry.v1.Ping.Features.Storage.Blob" do
+    add_message "cerbos.telemetry.v1.ServerLaunch.Features.Storage.Blob" do
       optional :provider, :string, 1, json_name: "provider"
       optional :poll_interval, :message, 2, "google.protobuf.Duration", json_name: "pollInterval"
     end
-    add_message "cerbos.telemetry.v1.Ping.Stats" do
-      optional :policy, :message, 1, "cerbos.telemetry.v1.Ping.Stats.Policy", json_name: "policy"
-      optional :schema, :message, 2, "cerbos.telemetry.v1.Ping.Stats.Schema", json_name: "schema"
+    add_message "cerbos.telemetry.v1.ServerLaunch.Stats" do
+      optional :policy, :message, 1, "cerbos.telemetry.v1.ServerLaunch.Stats.Policy", json_name: "policy"
+      optional :schema, :message, 2, "cerbos.telemetry.v1.ServerLaunch.Stats.Schema", json_name: "schema"
     end
-    add_message "cerbos.telemetry.v1.Ping.Stats.Policy" do
+    add_message "cerbos.telemetry.v1.ServerLaunch.Stats.Policy" do
       map :count, :string, :uint32, 1
       map :avg_rule_count, :string, :double, 2
       map :avg_condition_count, :string, :double, 3
     end
-    add_message "cerbos.telemetry.v1.Ping.Stats.Schema" do
+    add_message "cerbos.telemetry.v1.ServerLaunch.Stats.Schema" do
       optional :count, :uint32, 1, json_name: "count"
     end
+    add_message "cerbos.telemetry.v1.ServerStop" do
+      optional :version, :string, 1, json_name: "version"
+      optional :uptime, :message, 2, "google.protobuf.Duration", json_name: "uptime"
+      optional :requests_total, :uint64, 3, json_name: "requestsTotal"
+    end
+    add_message "cerbos.telemetry.v1.Event" do
+      oneof :data do
+        optional :api_activity, :message, 1, "cerbos.telemetry.v1.Event.ApiActivity", json_name: "apiActivity"
+      end
+    end
+    add_message "cerbos.telemetry.v1.Event.CountStat" do
+      optional :key, :string, 1, json_name: "key"
+      optional :count, :uint64, 2, json_name: "count"
+    end
+    add_message "cerbos.telemetry.v1.Event.ApiActivity" do
+      optional :version, :string, 1, json_name: "version"
+      optional :uptime, :message, 2, "google.protobuf.Duration", json_name: "uptime"
+      repeated :method_calls, :message, 3, "cerbos.telemetry.v1.Event.CountStat", json_name: "methodCalls"
+      repeated :user_agents, :message, 4, "cerbos.telemetry.v1.Event.CountStat", json_name: "userAgents"
+    end
   end
 end
 
 module Cerbos::Protobuf::Cerbos
   module Telemetry
     module V1
-      Ping = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.Ping").msgclass
-      Ping::Cerbos = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.Ping.Cerbos").msgclass
-      Ping::Source = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.Ping.Source").msgclass
-      Ping::Features = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.Ping.Features").msgclass
-      Ping::Features::Audit = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.Ping.Features.Audit").msgclass
-      Ping::Features::Schema = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.Ping.Features.Schema").msgclass
-      Ping::Features::AdminApi = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.Ping.Features.AdminApi").msgclass
-      Ping::Features::Storage = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.Ping.Features.Storage").msgclass
-      Ping::Features::Storage::Disk = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.Ping.Features.Storage.Disk").msgclass
-      Ping::Features::Storage::Git = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.Ping.Features.Storage.Git").msgclass
-      Ping::Features::Storage::Blob = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.Ping.Features.Storage.Blob").msgclass
-      Ping::Stats = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.Ping.Stats").msgclass
-      Ping::Stats::Policy = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.Ping.Stats.Policy").msgclass
-      Ping::Stats::Schema = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.Ping.Stats.Schema").msgclass
+      ServerLaunch = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.ServerLaunch").msgclass
+      ServerLaunch::Cerbos = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.ServerLaunch.Cerbos").msgclass
+      ServerLaunch::Source = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.ServerLaunch.Source").msgclass
+      ServerLaunch::Features = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.ServerLaunch.Features").msgclass
+      ServerLaunch::Features::Audit = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.ServerLaunch.Features.Audit").msgclass
+      ServerLaunch::Features::Schema = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.ServerLaunch.Features.Schema").msgclass
+      ServerLaunch::Features::AdminApi = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.ServerLaunch.Features.AdminApi").msgclass
+      ServerLaunch::Features::Storage = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.ServerLaunch.Features.Storage").msgclass
+      ServerLaunch::Features::Storage::Disk = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.ServerLaunch.Features.Storage.Disk").msgclass
+      ServerLaunch::Features::Storage::Git = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.ServerLaunch.Features.Storage.Git").msgclass
+      ServerLaunch::Features::Storage::Blob = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.ServerLaunch.Features.Storage.Blob").msgclass
+      ServerLaunch::Stats = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.ServerLaunch.Stats").msgclass
+      ServerLaunch::Stats::Policy = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.ServerLaunch.Stats.Policy").msgclass
+      ServerLaunch::Stats::Schema = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.ServerLaunch.Stats.Schema").msgclass
+      ServerStop = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.ServerStop").msgclass
+      Event = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.Event").msgclass
+      Event::CountStat = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.Event.CountStat").msgclass
+      Event::ApiActivity = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.telemetry.v1.Event.ApiActivity").msgclass
     end
   end
 end

data/lib/cerbos/version.rb

@@ -2,5 +2,5 @@
 
 module Cerbos
   # Current version of the `cerbos` gem.
-  VERSION = "0.2.0"
+  VERSION = "0.5.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cerbos
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Cerbos
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-05-12 00:00:00.000000000 Z
+date: 2022-06-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: grpc
@@ -81,7 +81,7 @@ licenses:
 metadata:
   bug_tracker_uri: https://github.com/cerbos/cerbos-sdk-ruby/issues
   changelog_uri: https://github.com/cerbos/cerbos-sdk-ruby/blob/main/CHANGELOG.md
-  documentation_uri: https://www.rubydoc.info/gems/cerbos/0.2.0
+  documentation_uri: https://www.rubydoc.info/gems/cerbos/0.5.0
   homepage_uri: https://github.com/cerbos/cerbos-sdk-ruby
   source_code_uri: https://github.com/cerbos/cerbos-sdk-ruby
   rubygems_mfa_required: 'true'