cerbos 0.13.0 → 0.14.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +25 -1
- data/cerbos.gemspec +3 -3
- data/lib/cerbos/input/aux_data.rb +13 -3
- data/lib/cerbos/input.rb +5 -0
- data/lib/cerbos/output/check_resources.rb +8 -2
- data/lib/cerbos/protobuf/cerbos/cloud/apikey/v1/apikey_pb.rb +6 -1
- data/lib/cerbos/protobuf/cerbos/cloud/apikey/v1/apikey_services_pb.rb +2 -0
- data/lib/cerbos/protobuf/cerbos/cloud/auth/v1/auth_pb.rb +24 -0
- data/lib/cerbos/protobuf/cerbos/engine/v1/engine_pb.rb +1 -1
- data/lib/cerbos/protobuf/cerbos/request/v1/request_pb.rb +1 -1
- data/lib/cerbos/version.rb +1 -1
- metadata +8 -7
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 05031d18d9cb50e6815c95d561eeb4874012af425633f2316dfc8f37bcd0c2be
|
|
4
|
+
data.tar.gz: 5918fb0ab135210871ee8c4a05bc105f28b234b193edfb13d84ba9e328fed310
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 26de39122b2f58ed68a7b047e70e0a3d14accd06c7c7853c58d1c356bdf51603fdf25e96e9fafdc46465194973051c0821c835bbd3e703947ca5fd58725eee3d
|
|
7
|
+
data.tar.gz: 18afc229b34ef55b51b1919fef5c0b7972883780d5a8652e3ea3e94fe7c5bc4b346717c48ba9c72ac1e32c1314d80c3926c3c474bd76f5b17bb60bc69b7bd3c0
|
data/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,28 @@
|
|
|
2
2
|
|
|
3
3
|
No notable changes.
|
|
4
4
|
|
|
5
|
+
## [0.14.0] - 2026-08-13
|
|
6
|
+
|
|
7
|
+
### Added
|
|
8
|
+
|
|
9
|
+
- `Cerbos::Input::AuxData#jwts` attribute supporting multiple JWTs in auxiliary data ([#360](https://github.com/cerbos/cerbos-sdk-ruby/pull/360))
|
|
10
|
+
|
|
11
|
+
Requires a policy decision point server running Cerbos 0.55+.
|
|
12
|
+
|
|
13
|
+
- `Cerbos::Output::CheckResources::Result::Output#error` attribute returning the error encountered when evaluating the output expression (if any) ([#331](https://github.com/cerbos/cerbos-sdk-ruby/pull/331))
|
|
14
|
+
|
|
15
|
+
Requires a policy decision point server running Cerbos 0.54+.
|
|
16
|
+
|
|
17
|
+
### Changed
|
|
18
|
+
|
|
19
|
+
- Require [`google-protobuf`] 3.25+ ([#314](https://github.com/cerbos/cerbos-sdk-ruby/pull/314))
|
|
20
|
+
|
|
21
|
+
- Require [`grpc`] 1.61+ ([#314](https://github.com/cerbos/cerbos-sdk-ruby/pull/314))
|
|
22
|
+
|
|
23
|
+
### Removed
|
|
24
|
+
|
|
25
|
+
- Support for Ruby 3.2 ([#310](https://github.com/cerbos/cerbos-sdk-ruby/pull/310))
|
|
26
|
+
|
|
5
27
|
## [0.13.0] - 2026-02-18
|
|
6
28
|
|
|
7
29
|
### Added
|
|
@@ -14,6 +36,7 @@ No notable changes.
|
|
|
14
36
|
|
|
15
37
|
Requires a policy decision point server running Cerbos 0.51+.
|
|
16
38
|
|
|
39
|
+
|
|
17
40
|
## [0.12.0] - 2025-08-12
|
|
18
41
|
|
|
19
42
|
### Added
|
|
@@ -131,7 +154,8 @@ No notable changes.
|
|
|
131
154
|
|
|
132
155
|
- Initial implementation of `Cerbos::Client` ([#2](https://github.com/cerbos/cerbos-sdk-ruby/pull/2))
|
|
133
156
|
|
|
134
|
-
[Unreleased]: https://github.com/cerbos/cerbos-sdk-ruby/compare/v0.
|
|
157
|
+
[Unreleased]: https://github.com/cerbos/cerbos-sdk-ruby/compare/v0.14.0...HEAD
|
|
158
|
+
[0.14.0]: https://github.com/cerbos/cerbos-sdk-ruby/compare/v0.13.0...v0.14.0
|
|
135
159
|
[0.13.0]: https://github.com/cerbos/cerbos-sdk-ruby/compare/v0.12.0...v0.13.0
|
|
136
160
|
[0.12.0]: https://github.com/cerbos/cerbos-sdk-ruby/compare/v0.11.0...v0.12.0
|
|
137
161
|
[0.11.0]: https://github.com/cerbos/cerbos-sdk-ruby/compare/v0.10.0...v0.11.0
|
data/cerbos.gemspec
CHANGED
|
@@ -31,8 +31,8 @@ Gem::Specification.new do |spec|
|
|
|
31
31
|
"yard_extensions.rb"
|
|
32
32
|
]
|
|
33
33
|
|
|
34
|
-
spec.required_ruby_version = ">= 3.
|
|
34
|
+
spec.required_ruby_version = ">= 3.3"
|
|
35
35
|
spec.add_dependency "concurrent-ruby", "~> 1.2"
|
|
36
|
-
spec.add_dependency "grpc", "~> 1.
|
|
37
|
-
spec.add_dependency "google-protobuf", ">= 3.
|
|
36
|
+
spec.add_dependency "grpc", "~> 1.61"
|
|
37
|
+
spec.add_dependency "google-protobuf", ">= 3.25", "< 5.0"
|
|
38
38
|
end
|
|
@@ -10,16 +10,26 @@ module Cerbos
|
|
|
10
10
|
# @return [nil] if not provided.
|
|
11
11
|
attr_reader :jwt
|
|
12
12
|
|
|
13
|
+
# Named JSON Web Tokens (JWTs) to use as auxiliary data sources.
|
|
14
|
+
#
|
|
15
|
+
# @return [Hash{String => JWT}]
|
|
16
|
+
attr_reader :jwts
|
|
17
|
+
|
|
13
18
|
# Specify auxiliary data sources.
|
|
14
19
|
#
|
|
15
|
-
# @param jwt [JWT, Hash, nil] a JSON Web Token (JWT) to use as an auxiliary data source.
|
|
16
|
-
|
|
20
|
+
# @param jwt [JWT, Hash, nil] a JSON Web Token (JWT) to use as an auxiliary data source (mutually exclusive with `jwts`).
|
|
21
|
+
# @param jwts [Hash{String, Symbol => JWT, Hash}] named JSON Web Tokens (JWTs) to use as auxiliary data sources (mutually exclusive with `jwts`).
|
|
22
|
+
def initialize(jwt: nil, jwts: {})
|
|
17
23
|
@jwt = Input.coerce_optional(jwt, JWT)
|
|
24
|
+
@jwts = Input.coerce_map(jwts, JWT)
|
|
18
25
|
end
|
|
19
26
|
|
|
20
27
|
# @private
|
|
21
28
|
def to_protobuf
|
|
22
|
-
Protobuf::Cerbos::Request::V1::AuxData.new(
|
|
29
|
+
Protobuf::Cerbos::Request::V1::AuxData.new(
|
|
30
|
+
jwt: jwt&.to_protobuf,
|
|
31
|
+
jwts: jwts.transform_values(&:to_protobuf)
|
|
32
|
+
)
|
|
23
33
|
end
|
|
24
34
|
end
|
|
25
35
|
end
|
data/lib/cerbos/input.rb
CHANGED
|
@@ -25,6 +25,11 @@ module Cerbos
|
|
|
25
25
|
def self.coerce_array(values, to_class)
|
|
26
26
|
values.map { |value| coerce_required(value, to_class) }
|
|
27
27
|
end
|
|
28
|
+
|
|
29
|
+
# @private
|
|
30
|
+
def self.coerce_map(hash, to_class)
|
|
31
|
+
hash.map { |key, value| [key.to_s, coerce_required(value, to_class)] }.to_h
|
|
32
|
+
end
|
|
28
33
|
end
|
|
29
34
|
end
|
|
30
35
|
|
|
@@ -233,7 +233,7 @@ module Cerbos
|
|
|
233
233
|
end
|
|
234
234
|
|
|
235
235
|
# User-defined output from a policy rule evaluation.
|
|
236
|
-
CheckResources::Result::Output = Output.new_class(:action, :source, :value) do
|
|
236
|
+
CheckResources::Result::Output = Output.new_class(:action, :source, :value, :error) do
|
|
237
237
|
# @!attribute [r] action
|
|
238
238
|
# The action that was being evaluated when the output was produced.
|
|
239
239
|
#
|
|
@@ -251,11 +251,17 @@ module Cerbos
|
|
|
251
251
|
#
|
|
252
252
|
# @return [String, Numeric, Boolean, Array, Hash, nil]
|
|
253
253
|
|
|
254
|
+
# @!attribute [r] error
|
|
255
|
+
# Error encountered when evaluating the output expression (if any).
|
|
256
|
+
#
|
|
257
|
+
# @return [String, nil]
|
|
258
|
+
|
|
254
259
|
def self.from_protobuf(output_entry)
|
|
255
260
|
new(
|
|
256
261
|
action: output_entry.action,
|
|
257
262
|
source: output_entry.src,
|
|
258
|
-
value: output_entry.val&.to_ruby(true)
|
|
263
|
+
value: output_entry.val&.to_ruby(true),
|
|
264
|
+
error: output_entry.error.empty? ? nil : output_entry.error
|
|
259
265
|
)
|
|
260
266
|
end
|
|
261
267
|
end
|
|
@@ -5,11 +5,12 @@
|
|
|
5
5
|
require 'google/protobuf'
|
|
6
6
|
|
|
7
7
|
require 'cerbos/protobuf/buf/validate/validate_pb'
|
|
8
|
+
require 'cerbos/protobuf/cerbos/cloud/auth/v1/auth_pb'
|
|
8
9
|
require 'cerbos/protobuf/google/api/visibility_pb'
|
|
9
10
|
require 'google/protobuf/duration_pb'
|
|
10
11
|
|
|
11
12
|
|
|
12
|
-
descriptor_data = "\n#cerbos/cloud/apikey/v1/apikey.proto\x12\x16\x63\x65rbos.cloud.apikey.v1\x1a\x1b\x62uf/validate/validate.proto\x1a\x1bgoogle/api/visibility.proto\x1a\x1egoogle/protobuf/duration.proto\"n\n\x17IssueAccessTokenRequest\x12%\n\tclient_id\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x98\x01\x0cR\x08\x63lientId\x12,\n\rclient_secret\x18\x02 \x01(\tB\x07\xbaH\x04r\x02\x10\x01R\x0c\x63lientSecret\"\x88\x01\n\x18IssueAccessTokenResponse\x12*\n\x0c\x61\x63\x63\x65ss_token\x18\x01 \x01(\tB\x07\xbaH\x04r\x02\x10\x01R\x0b\x61\x63\x63\x65ssToken\x12@\n\nexpires_in\x18\x02 \x01(\x0b\x32\x19.google.protobuf.DurationB\x06\xbaH\x03\xc8\x01\x01R\
|
|
13
|
+
descriptor_data = "\n#cerbos/cloud/apikey/v1/apikey.proto\x12\x16\x63\x65rbos.cloud.apikey.v1\x1a\x1b\x62uf/validate/validate.proto\x1a\x1f\x63\x65rbos/cloud/auth/v1/auth.proto\x1a\x1bgoogle/api/visibility.proto\x1a\x1egoogle/protobuf/duration.proto\"n\n\x17IssueAccessTokenRequest\x12%\n\tclient_id\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x98\x01\x0cR\x08\x63lientId\x12,\n\rclient_secret\x18\x02 \x01(\tB\x07\xbaH\x04r\x02\x10\x01R\x0c\x63lientSecret\"\x88\x01\n\x18IssueAccessTokenResponse\x12*\n\x0c\x61\x63\x63\x65ss_token\x18\x01 \x01(\tB\x07\xbaH\x04r\x02\x10\x01R\x0b\x61\x63\x63\x65ssToken\x12@\n\nexpires_in\x18\x02 \x01(\x0b\x32\x19.google.protobuf.DurationB\x06\xbaH\x03\xc8\x01\x01R\texpiresIn\"\x17\n\x15RegisterDeviceRequest\"\x9f\x01\n\x16RegisterDeviceResponse\x12+\n\x10verification_url\x18\x01 \x01(\tH\x00R\x0fverificationUrl\x12\x46\n\x0c\x64\x65vice_token\x18\x02 \x01(\x0b\x32!.cerbos.cloud.auth.v1.DeviceTokenH\x00R\x0b\x64\x65viceTokenB\x10\n\x07message\x12\x05\xbaH\x02\x08\x01\"i\n\x19RefreshDeviceTokenRequest\x12L\n\x0c\x64\x65vice_token\x18\x01 \x01(\x0b\x32!.cerbos.cloud.auth.v1.DeviceTokenB\x06\xbaH\x03\xc8\x01\x01R\x0b\x64\x65viceToken\"j\n\x1aRefreshDeviceTokenResponse\x12L\n\x0c\x64\x65vice_token\x18\x01 \x01(\x0b\x32!.cerbos.cloud.auth.v1.DeviceTokenB\x06\xbaH\x03\xc8\x01\x01R\x0b\x64\x65viceToken2\x8c\x03\n\rApiKeyService\x12u\n\x10IssueAccessToken\x12/.cerbos.cloud.apikey.v1.IssueAccessTokenRequest\x1a\x30.cerbos.cloud.apikey.v1.IssueAccessTokenResponse\x12q\n\x0eRegisterDevice\x12-.cerbos.cloud.apikey.v1.RegisterDeviceRequest\x1a..cerbos.cloud.apikey.v1.RegisterDeviceResponse0\x01\x12{\n\x12RefreshDeviceToken\x12\x31.cerbos.cloud.apikey.v1.RefreshDeviceTokenRequest\x1a\x32.cerbos.cloud.apikey.v1.RefreshDeviceTokenResponse\x1a\x14\xfa\xd2\xe4\x93\x02\x0e\x12\x0c\x45XPERIMENTALB\x80\x01\n\x1e\x64\x65v.cerbos.api.cloud.v1.apikeyZAgithub.com/cerbos/cloud-api/genpb/cerbos/cloud/apikey/v1;apikeyv1\xaa\x02\x1a\x43\x65rbos.Api.Cloud.V1.ApiKeyb\x06proto3"
|
|
13
14
|
|
|
14
15
|
pool = ::Google::Protobuf::DescriptorPool.generated_pool
|
|
15
16
|
pool.add_serialized_file(descriptor_data)
|
|
@@ -20,6 +21,10 @@ module Cerbos::Protobuf::Cerbos
|
|
|
20
21
|
module V1
|
|
21
22
|
IssueAccessTokenRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.cloud.apikey.v1.IssueAccessTokenRequest").msgclass
|
|
22
23
|
IssueAccessTokenResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.cloud.apikey.v1.IssueAccessTokenResponse").msgclass
|
|
24
|
+
RegisterDeviceRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.cloud.apikey.v1.RegisterDeviceRequest").msgclass
|
|
25
|
+
RegisterDeviceResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.cloud.apikey.v1.RegisterDeviceResponse").msgclass
|
|
26
|
+
RefreshDeviceTokenRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.cloud.apikey.v1.RefreshDeviceTokenRequest").msgclass
|
|
27
|
+
RefreshDeviceTokenResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.cloud.apikey.v1.RefreshDeviceTokenResponse").msgclass
|
|
23
28
|
end
|
|
24
29
|
end
|
|
25
30
|
end
|
|
@@ -22,6 +22,8 @@ module Cerbos::Protobuf::Cerbos
|
|
|
22
22
|
self.service_name = 'cerbos.cloud.apikey.v1.ApiKeyService'
|
|
23
23
|
|
|
24
24
|
rpc :IssueAccessToken, ::Cerbos::Protobuf::Cerbos::Cloud::Apikey::V1::IssueAccessTokenRequest, ::Cerbos::Protobuf::Cerbos::Cloud::Apikey::V1::IssueAccessTokenResponse
|
|
25
|
+
rpc :RegisterDevice, ::Cerbos::Protobuf::Cerbos::Cloud::Apikey::V1::RegisterDeviceRequest, stream(::Cerbos::Protobuf::Cerbos::Cloud::Apikey::V1::RegisterDeviceResponse)
|
|
26
|
+
rpc :RefreshDeviceToken, ::Cerbos::Protobuf::Cerbos::Cloud::Apikey::V1::RefreshDeviceTokenRequest, ::Cerbos::Protobuf::Cerbos::Cloud::Apikey::V1::RefreshDeviceTokenResponse
|
|
25
27
|
end
|
|
26
28
|
|
|
27
29
|
Stub = Service.rpc_stub_class
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
# Generated by the protocol buffer compiler. DO NOT EDIT!
|
|
3
|
+
# source: cerbos/cloud/auth/v1/auth.proto
|
|
4
|
+
|
|
5
|
+
require 'google/protobuf'
|
|
6
|
+
|
|
7
|
+
require 'cerbos/protobuf/buf/validate/validate_pb'
|
|
8
|
+
require 'google/protobuf/timestamp_pb'
|
|
9
|
+
|
|
10
|
+
|
|
11
|
+
descriptor_data = "\n\x1f\x63\x65rbos/cloud/auth/v1/auth.proto\x12\x14\x63\x65rbos.cloud.auth.v1\x1a\x1b\x62uf/validate/validate.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\xc9\x01\n\x0b\x44\x65viceToken\x12*\n\x0c\x61\x63\x63\x65ss_token\x18\x01 \x01(\tB\x07\xbaH\x04r\x02\x10\x01R\x0b\x61\x63\x63\x65ssToken\x12,\n\rrefresh_token\x18\x02 \x01(\tB\x07\xbaH\x04r\x02\x10\x01R\x0crefreshToken\x12\x41\n\nexpires_at\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x06\xbaH\x03\xc8\x01\x01R\texpiresAt\x12\x1d\n\ntoken_type\x18\x04 \x01(\tR\ttokenTypeB?Z=github.com/cerbos/cloud-api/genpb/cerbos/cloud/auth/v1;authv1b\x06proto3"
|
|
12
|
+
|
|
13
|
+
pool = ::Google::Protobuf::DescriptorPool.generated_pool
|
|
14
|
+
pool.add_serialized_file(descriptor_data)
|
|
15
|
+
|
|
16
|
+
module Cerbos::Protobuf::Cerbos
|
|
17
|
+
module Cloud
|
|
18
|
+
module Auth
|
|
19
|
+
module V1
|
|
20
|
+
DeviceToken = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("cerbos.cloud.auth.v1.DeviceToken").msgclass
|
|
21
|
+
end
|
|
22
|
+
end
|
|
23
|
+
end
|
|
24
|
+
end
|
|
@@ -10,7 +10,7 @@ require 'google/protobuf/struct_pb'
|
|
|
10
10
|
require 'cerbos/protobuf/protoc-gen-openapiv2/options/annotations_pb'
|
|
11
11
|
|
|
12
12
|
|
|
13
|
-
descriptor_data = "\n\x1d\x63\x65rbos/engine/v1/engine.proto\x12\x10\x63\x65rbos.engine.v1\x1a\x1b\x62uf/validate/validate.proto\x1a\x1fgoogle/api/field_behavior.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a.protoc-gen-openapiv2/options/annotations.proto\"\xbc\x06\n\x12PlanResourcesInput\x1a\xa5\x06\n\x08Resource\x12\x44\n\x04kind\x18\x01 \x01(\tB0\x92\x41 2\x0eResource kind.J\x0e\"album:object\"\xe0\x41\x02\xbaH\x07\xc8\x01\x01r\x02\x10\x01R\x04kind\x12\xb0\x01\n\x04\x61ttr\x18\x02 \x03(\x0b\x32\x37.cerbos.engine.v1.PlanResourcesInput.Resource.AttrEntryBc\x92\x41`2^Key-value pairs of contextual data about the resource that are known at a time of the request.R\x04\x61ttr\x12\xd0\x01\n\x0epolicy_version\x18\x03 \x01(\tB\xa8\x01\x92\x41\x93\x01\x32|The policy version to use to evaluate this request. If not specified, will default to the server-configured default version.J\t\"default\"\x8a\x01\x07^[\\w]*$\xe0\x41\x01\xbaH\x0br\t2\x07^[\\w]*$R\rpolicyVersion\x12\xfb\x01\n\x05scope\x18\x04 \x01(\tB\xe4\x01\x92\x41\xac\x01\x32}A dot-separated scope that describes the hierarchy this resource belongs to. This is used for determining policy inheritance.\x8a\x01*^(^$|\\.|[0-9a-zA-Z][\\w\\-]*(\\.\\w[\\w\\-]*)*)$\xe0\x41\x01\xbaH.r,2*^(^$|\\.|[0-9a-zA-Z][\\w\\-]*(\\.\\w[\\w\\-]*)*)$R\x05scope\x1aO\n\tAttrEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12,\n\x05value\x18\x02 \x01(\x0b\x32\x16.google.protobuf.ValueR\x05value:\x02\x38\x01\"\xa4\x06\n\x13PlanResourcesFilter\x12\xad\x01\n\x04kind\x18\x01 \x01(\x0e\x32*.cerbos.engine.v1.PlanResourcesFilter.KindBm\x92\x41j2hFilter kind. Defines whether the given action is always allowed, always denied or allowed conditionally.R\x04kind\x12\x9a\x01\n\tcondition\x18\x02 \x01(\x0b\x32\x38.cerbos.engine.v1.PlanResourcesFilter.Expression.OperandBB\x92\x41?2=Filter condition. Only populated if kind is KIND_CONDITIONAL.R\tcondition\x1a\xda\x02\n\nExpression\x12)\n\x08operator\x18\x01 \x01(\tB\r\x92\x41\n2\x08OperatorR\x08operator\x12T\n\x08operands\x18\x02 \x03(\x0b\x32\x38.cerbos.engine.v1.PlanResourcesFilter.Expression.OperandR\x08operands\x1a\xb3\x01\n\x07Operand\x12.\n\x05value\x18\x01 \x01(\x0b\x32\x16.google.protobuf.ValueH\x00R\x05value\x12R\n\nexpression\x18\x02 \x01(\x0b\x32\x30.cerbos.engine.v1.PlanResourcesFilter.ExpressionH\x00R\nexpression\x12\x1c\n\x08variable\x18\x03 \x01(\tH\x00R\x08variableB\x06\n\x04node:\x15\x92\x41\x12\n\x10\x32\x0e\x43\x45L expression\"c\n\x04Kind\x12\x14\n\x10KIND_UNSPECIFIED\x10\x00\x12\x17\n\x13KIND_ALWAYS_ALLOWED\x10\x01\x12\x16\n\x12KIND_ALWAYS_DENIED\x10\x02\x12\x14\n\x10KIND_CONDITIONAL\x10\x03\"\
|
|
13
|
+
descriptor_data = "\n\x1d\x63\x65rbos/engine/v1/engine.proto\x12\x10\x63\x65rbos.engine.v1\x1a\x1b\x62uf/validate/validate.proto\x1a\x1fgoogle/api/field_behavior.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a.protoc-gen-openapiv2/options/annotations.proto\"\xbc\x06\n\x12PlanResourcesInput\x1a\xa5\x06\n\x08Resource\x12\x44\n\x04kind\x18\x01 \x01(\tB0\x92\x41 2\x0eResource kind.J\x0e\"album:object\"\xe0\x41\x02\xbaH\x07\xc8\x01\x01r\x02\x10\x01R\x04kind\x12\xb0\x01\n\x04\x61ttr\x18\x02 \x03(\x0b\x32\x37.cerbos.engine.v1.PlanResourcesInput.Resource.AttrEntryBc\x92\x41`2^Key-value pairs of contextual data about the resource that are known at a time of the request.R\x04\x61ttr\x12\xd0\x01\n\x0epolicy_version\x18\x03 \x01(\tB\xa8\x01\x92\x41\x93\x01\x32|The policy version to use to evaluate this request. If not specified, will default to the server-configured default version.J\t\"default\"\x8a\x01\x07^[\\w]*$\xe0\x41\x01\xbaH\x0br\t2\x07^[\\w]*$R\rpolicyVersion\x12\xfb\x01\n\x05scope\x18\x04 \x01(\tB\xe4\x01\x92\x41\xac\x01\x32}A dot-separated scope that describes the hierarchy this resource belongs to. This is used for determining policy inheritance.\x8a\x01*^(^$|\\.|[0-9a-zA-Z][\\w\\-]*(\\.\\w[\\w\\-]*)*)$\xe0\x41\x01\xbaH.r,2*^(^$|\\.|[0-9a-zA-Z][\\w\\-]*(\\.\\w[\\w\\-]*)*)$R\x05scope\x1aO\n\tAttrEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12,\n\x05value\x18\x02 \x01(\x0b\x32\x16.google.protobuf.ValueR\x05value:\x02\x38\x01\"\xa4\x06\n\x13PlanResourcesFilter\x12\xad\x01\n\x04kind\x18\x01 \x01(\x0e\x32*.cerbos.engine.v1.PlanResourcesFilter.KindBm\x92\x41j2hFilter kind. Defines whether the given action is always allowed, always denied or allowed conditionally.R\x04kind\x12\x9a\x01\n\tcondition\x18\x02 \x01(\x0b\x32\x38.cerbos.engine.v1.PlanResourcesFilter.Expression.OperandBB\x92\x41?2=Filter condition. Only populated if kind is KIND_CONDITIONAL.R\tcondition\x1a\xda\x02\n\nExpression\x12)\n\x08operator\x18\x01 \x01(\tB\r\x92\x41\n2\x08OperatorR\x08operator\x12T\n\x08operands\x18\x02 \x03(\x0b\x32\x38.cerbos.engine.v1.PlanResourcesFilter.Expression.OperandR\x08operands\x1a\xb3\x01\n\x07Operand\x12.\n\x05value\x18\x01 \x01(\x0b\x32\x16.google.protobuf.ValueH\x00R\x05value\x12R\n\nexpression\x18\x02 \x01(\x0b\x32\x30.cerbos.engine.v1.PlanResourcesFilter.ExpressionH\x00R\nexpression\x12\x1c\n\x08variable\x18\x03 \x01(\tH\x00R\x08variableB\x06\n\x04node:\x15\x92\x41\x12\n\x10\x32\x0e\x43\x45L expression\"c\n\x04Kind\x12\x14\n\x10KIND_UNSPECIFIED\x10\x00\x12\x17\n\x13KIND_ALWAYS_ALLOWED\x10\x01\x12\x16\n\x12KIND_ALWAYS_DENIED\x10\x02\x12\x14\n\x10KIND_CONDITIONAL\x10\x03\"\xf8\x03\n\x0bOutputEntry\x12\x65\n\x03src\x18\x01 \x01(\tBS\x92\x41P2)Rule that matched to produce this output.J#\"resource.expense.v1/acme#rule-001\"R\x03src\x12u\n\x03val\x18\x02 \x01(\x0b\x32\x16.google.protobuf.ValueBK\x92\x41H27Dynamic output, determined by user defined rule output.J\r\"some_string\"R\x03val\x12\x63\n\x06\x61\x63tion\x18\x03 \x01(\tBK\x92\x41H2>Action that was being evaluated when this output was produced.J\x06\"view\"R\x06\x61\x63tion\x12\xa5\x01\n\x05\x65rror\x18\x04 \x01(\tB\x8e\x01\x92\x41\x8a\x01\x32tError encountered when evaluating the output expression (if any). `val` will not be set if an error was encountered.J\x12\"division by zero\"R\x05\x65rror\"\xad\x07\n\x08Resource\x12^\n\x04kind\x18\x01 \x01(\tBJ\x92\x41:2)Name of the resource kind being accessed.J\r\"album:photo\"\xe0\x41\x02\xbaH\x07\xc8\x01\x01r\x02\x10\x01R\x04kind\x12\xd0\x01\n\x0epolicy_version\x18\x02 \x01(\tB\xa8\x01\x92\x41\x93\x01\x32|The policy version to use to evaluate this request. If not specified, will default to the server-configured default version.J\t\"default\"\x8a\x01\x07^[\\w]*$\xe0\x41\x01\xbaH\x0br\t2\x07^[\\w]*$R\rpolicyVersion\x12\x46\n\x02id\x18\x03 \x01(\tB6\x92\x41&2\x1bID of the resource instanceJ\x07\"XX125\"\xe0\x41\x02\xbaH\x07\xc8\x01\x01r\x02\x10\x01R\x02id\x12\xc9\x01\n\x04\x61ttr\x18\x04 \x03(\x0b\x32$.cerbos.engine.v1.Resource.AttrEntryB\x8e\x01\x92\x41\x7f\x32\x64Kay-value pairs of contextual data about this resource that should be used during policy evaluation.J\x17{\"owner\": \"bugs_bunny\"}\xbaH\t\x9a\x01\x06\"\x04r\x02\x10\x01R\x04\x61ttr\x12\x88\x02\n\x05scope\x18\x05 \x01(\tB\xf1\x01\x92\x41\xb9\x01\x32}A dot-separated scope that describes the hierarchy this resource belongs to. This is used for determining policy inheritance.J\x0b\"acme.corp\"\x8a\x01*^(^$|\\.|[0-9a-zA-Z][\\w\\-]*(\\.\\w[\\w\\-]*)*)$\xe0\x41\x01\xbaH.r,2*^(^$|\\.|[0-9a-zA-Z][\\w\\-]*(\\.\\w[\\w\\-]*)*)$R\x05scope\x1aO\n\tAttrEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12,\n\x05value\x18\x02 \x01(\x0b\x32\x16.google.protobuf.ValueR\x05value:\x02\x38\x01\"\xb1\x08\n\tPrincipal\x12\x43\n\x02id\x18\x01 \x01(\tB3\x92\x41#2\x13ID of the principalJ\x0c\"bugs_bunny\"\xe0\x41\x02\xbaH\x07\xc8\x01\x01r\x02\x10\x01R\x02id\x12\xd0\x01\n\x0epolicy_version\x18\x02 \x01(\tB\xa8\x01\x92\x41\x93\x01\x32|The policy version to use to evaluate this request. If not specified, will default to the server-configured default version.J\t\"default\"\x8a\x01\x07^[\\w]*$\xe0\x41\x01\xbaH\x0br\t2\x07^[\\w]*$R\rpolicyVersion\x12\x87\x01\n\x05roles\x18\x03 \x03(\tBq\x92\x41X2FRoles assigned to this principal from your identity management system.J\x08[\"user\"]\xa8\x01\x01\xb0\x01\x01\xe0\x41\x02\xbaH\x10\xc8\x01\x01\x92\x01\n\x08\x01\x18\x01\"\x04r\x02\x10\x01R\x05roles\x12\xc9\x01\n\x04\x61ttr\x18\x04 \x03(\x0b\x32%.cerbos.engine.v1.Principal.AttrEntryB\x8d\x01\x92\x41~2eKey-value pairs of contextual data about this principal that should be used during policy evaluation.J\x15{\"beta_tester\": true}\xbaH\t\x9a\x01\x06\"\x04r\x02\x10\x01R\x04\x61ttr\x12\x89\x02\n\x05scope\x18\x05 \x01(\tB\xf2\x01\x92\x41\xba\x01\x32~A dot-separated scope that describes the hierarchy this principal belongs to. This is used for determining policy inheritance.J\x0b\"acme.corp\"\x8a\x01*^(^$|\\.|[0-9a-zA-Z][\\w\\-]*(\\.\\w[\\w\\-]*)*)$\xe0\x41\x01\xbaH.r,2*^(^$|\\.|[0-9a-zA-Z][\\w\\-]*(\\.\\w[\\w\\-]*)*)$R\x05scope\x1aO\n\tAttrEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12,\n\x05value\x18\x02 \x01(\x0b\x32\x16.google.protobuf.ValueR\x05value:\x02\x38\x01:Y\x92\x41V\nT2RA person or application attempting to perform the actions on the set of resources.Bo\n\x18\x64\x65v.cerbos.api.v1.engineZ<github.com/cerbos/cerbos/api/genpb/cerbos/engine/v1;enginev1\xaa\x02\x14\x43\x65rbos.Api.V1.Engineb\x06proto3"
|
|
14
14
|
|
|
15
15
|
pool = ::Google::Protobuf::DescriptorPool.generated_pool
|
|
16
16
|
pool.add_serialized_file(descriptor_data)
|
|
@@ -12,7 +12,7 @@ require 'google/protobuf/struct_pb'
|
|
|
12
12
|
require 'cerbos/protobuf/protoc-gen-openapiv2/options/annotations_pb'
|
|
13
13
|
|
|
14
14
|
|
|
15
|
-
descriptor_data = "\n\x1f\x63\x65rbos/request/v1/request.proto\x12\x11\x63\x65rbos.request.v1\x1a\x1b\x62uf/validate/validate.proto\x1a\x1b\x63\x65rbos/audit/v1/audit.proto\x1a\x1d\x63\x65rbos/engine/v1/engine.proto\x1a\x1fgoogle/api/field_behavior.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a.protoc-gen-openapiv2/options/annotations.proto\"\x8f\t\n\x14PlanResourcesRequest\x12\x96\x01\n\nrequest_id\x18\x01 \x01(\tBw\x92\x41t2JOptional application-specific ID useful for correlating logs for analysis.J&\"c2db17b8-4f9f-4fb1-acfd-9162a02be42b\"R\trequestId\x12`\n\x06\x61\x63tion\x18\x02 \x01(\tBH\x18\x01\x92\x41\x43\x32\x32\x41\x63tion to be applied to each resource in the list.J\r\"view:public\"R\x06\x61\x63tion\x12\xfb\x01\n\x07\x61\x63tions\x18\x07 \x03(\tB\xe0\x01\x92\x41\xca\x01\x32\xa3\x01List of actions to generate the query plan for. Mutually exclusive with the singular action field. Must contain at least one action and all actions must be unique.J\x1f[\"view:public\", \"edit:profile\"]\xb0\x01\x01\xbaH\x0f\x92\x01\x0c\x08\x00\x10\x14\x18\x01\"\x04r\x02\x10\x01R\x07\x61\x63tions\x12\x44\n\tprincipal\x18\x03 \x01(\x0b\x32\x1b.cerbos.engine.v1.PrincipalB\t\xe0\x41\x02\xbaH\x03\xc8\x01\x01R\tprincipal\x12T\n\x08resource\x18\x04 \x01(\x0b\x32-.cerbos.engine.v1.PlanResourcesInput.ResourceB\t\xe0\x41\x02\xbaH\x03\xc8\x01\x01R\x08resource\x12:\n\x08\x61ux_data\x18\x05 \x01(\x0b\x32\x1a.cerbos.request.v1.AuxDataB\x03\xe0\x41\x01R\x07\x61uxData\x12\x63\n\x0cinclude_meta\x18\x06 \x01(\x08\x42@\x92\x41=2;Opt to receive request processing metadata in the response.R\x0bincludeMeta\x12M\n\x0frequest_context\x18\x08 \x01(\x0b\x32\x1f.cerbos.audit.v1.RequestContextH\x00R\x0erequestContext\x88\x01\x01:\xdd\x01\x92\x41$\n\"2 PDP Resources Query Plan Request\xbaH\xb2\x01\x1a\xaf\x01\n\x1e\x65xclusiveFieldsActionOrActions\x12\x36\x45xactly one of \'action\' or \'actions\' field must be set\x1aUhas(this.action) && !has(this.actions) || !has(this.action) && size(this.actions) > 0B\x12\n\x10_request_context\"\x86\x05\n\x17\x43heckResourceSetRequest\x12\x96\x01\n\nrequest_id\x18\x01 \x01(\tBw\x92\x41t2JOptional application-specific ID useful for correlating logs for analysis.J&\"c2db17b8-4f9f-4fb1-acfd-9162a02be42b\"R\trequestId\x12\x8f\x01\n\x07\x61\x63tions\x18\x02 \x03(\tBu\x92\x41\\28List of actions being performed on the set of resources.J\x1a[\"view:public\", \"comment\"]\xa8\x01\x01\xb0\x01\x01\xe0\x41\x02\xbaH\x10\xc8\x01\x01\x92\x01\n\x08\x01\x18\x01\"\x04r\x02\x10\x01R\x07\x61\x63tions\x12\x44\n\tprincipal\x18\x03 \x01(\x0b\x32\x1b.cerbos.engine.v1.PrincipalB\t\xe0\x41\x02\xbaH\x03\xc8\x01\x01R\tprincipal\x12\x45\n\x08resource\x18\x04 \x01(\x0b\x32\x1e.cerbos.request.v1.ResourceSetB\t\xe0\x41\x02\xbaH\x03\xc8\x01\x01R\x08resource\x12\x63\n\x0cinclude_meta\x18\x05 \x01(\x08\x42@\x92\x41=2;Opt to receive request processing metadata in the response.R\x0bincludeMeta\x12:\n\x08\x61ux_data\x18\x06 \x01(\x0b\x32\x1a.cerbos.request.v1.AuxDataB\x03\xe0\x41\x01R\x07\x61uxData:\x12\x92\x41\x0f\n\r2\x0bPDP Request\"\x96\x08\n\x0bResourceSet\x12\x44\n\x04kind\x18\x01 \x01(\tB0\x92\x41 2\x0eResource kind.J\x0e\"album:object\"\xe0\x41\x02\xbaH\x07\xc8\x01\x01r\x02\x10\x01R\x04kind\x12\xd0\x01\n\x0epolicy_version\x18\x02 \x01(\tB\xa8\x01\x92\x41\x93\x01\x32|The policy version to use to evaluate this request. If not specified, will default to the server-configured default version.J\t\"default\"\x8a\x01\x07^[\\w]*$\xe0\x41\x01\xbaH\x0br\t2\x07^[\\w]*$R\rpolicyVersion\x12\xec\x02\n\tinstances\x18\x03 \x03(\x0b\x32-.cerbos.request.v1.ResourceSet.InstancesEntryB\x9e\x02\x92\x41\x8c\x02\x32mSet of resource instances to check. Each instance must be keyed by an application-specific unique identifier.J\x97\x01{\"XX125\":{\"attr\":{\"owner\":\"bugs_bunny\", \"public\": false, \"flagged\": false}}, \"XX225\":{\"attr\":{\"owner\":\"daffy_duck\", \"public\": true, \"flagged\": false}}}\xc8\x01\x01\xe0\x41\x02\xbaH\x08\xc8\x01\x01\x9a\x01\x02\x08\x01R\tinstances\x12\xfc\x01\n\x05scope\x18\x04 \x01(\tB\xe5\x01\x92\x41\xad\x01\x32~A dot-separated scope that describes the hierarchy these resources belong to. This is used for determining policy inheritance.\x8a\x01*^(^$|\\.|[0-9a-zA-Z][\\w\\-]*(\\.\\w[\\w\\-]*)*)$\xe0\x41\x01\xbaH.r,2*^(^$|\\.|[0-9a-zA-Z][\\w\\-]*(\\.\\w[\\w\\-]*)*)$R\x05scope\x1a^\n\x0eInstancesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x36\n\x05value\x18\x02 \x01(\x0b\x32 .cerbos.request.v1.AttributesMapR\x05value:\x02\x38\x01: \x92\x41\x1d\n\x1b\x32\x19Set of resources to check\"\xc1\x02\n\rAttributesMap\x12\xa9\x01\n\x04\x61ttr\x18\x01 \x03(\x0b\x32*.cerbos.request.v1.AttributesMap.AttrEntryBi\x92\x41\x66\x32\x64Key-value pairs of contextual data about this instance that should be used during policy evaluation.R\x04\x61ttr\x1aO\n\tAttrEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12,\n\x05value\x18\x02 \x01(\x0b\x32\x16.google.protobuf.ValueR\x05value:\x02\x38\x01:3\x92\x41\x30\n.2,Unique identifier for the resource instance.\"\xe3\x06\n\x19\x43heckResourceBatchRequest\x12\x96\x01\n\nrequest_id\x18\x01 \x01(\tBw\x92\x41t2JOptional application-specific ID useful for correlating logs for analysis.J&\"c2db17b8-4f9f-4fb1-acfd-9162a02be42b\"R\trequestId\x12\x44\n\tprincipal\x18\x02 \x01(\x0b\x32\x1b.cerbos.engine.v1.PrincipalB\t\xe0\x41\x02\xbaH\x03\xc8\x01\x01R\tprincipal\x12\xbf\x02\n\tresources\x18\x03 \x03(\x0b\x32\x37.cerbos.request.v1.CheckResourceBatchRequest.BatchEntryB\xe7\x01\x92\x41\xd5\x01\x32\x1eList of resources and actions.J\xac\x01[{\"actions\":[\"view\",\"comment\"], \"resource\":{\"kind\":\"album:object\",\"policyVersion\":\"default\",\"id\":\"XX125\",\"attr\":{\"owner\":\"bugs_bunny\", \"public\": false, \"flagged\": false}}}]\xa8\x01\x01\xb0\x01\x01\xe0\x41\x02\xbaH\x08\xc8\x01\x01\x92\x01\x02\x08\x01R\tresources\x12\x35\n\x08\x61ux_data\x18\x04 \x01(\x0b\x32\x1a.cerbos.request.v1.AuxDataR\x07\x61uxData\x1a\xd9\x01\n\nBatchEntry\x12\x87\x01\n\x07\x61\x63tions\x18\x01 \x03(\tBm\x92\x41T20List of actions being performed on the resource.J\x1a[\"view:public\", \"comment\"]\xa8\x01\x01\xb0\x01\x01\xe0\x41\x02\xbaH\x10\xc8\x01\x01\x92\x01\n\x08\x01\x18\x01\"\x04r\x02\x10\x01R\x07\x61\x63tions\x12\x41\n\x08resource\x18\x02 \x01(\x0b\x32\x1a.cerbos.engine.v1.ResourceB\t\xe0\x41\x02\xbaH\x03\xc8\x01\x01R\x08resource:\x12\x92\x41\x0f\n\r2\x0bPDP Request\"\xaa\x08\n\x15\x43heckResourcesRequest\x12\x96\x01\n\nrequest_id\x18\x01 \x01(\tBw\x92\x41t2JOptional application-specific ID useful for correlating logs for analysis.J&\"c2db17b8-4f9f-4fb1-acfd-9162a02be42b\"R\trequestId\x12X\n\x0cinclude_meta\x18\x02 \x01(\x08\x42\x35\x92\x41\x32\x32\x30\x41\x64\x64 request processing metadata to the response.R\x0bincludeMeta\x12\x44\n\tprincipal\x18\x03 \x01(\x0b\x32\x1b.cerbos.engine.v1.PrincipalB\t\xe0\x41\x02\xbaH\x03\xc8\x01\x01R\tprincipal\x12\xbe\x02\n\tresources\x18\x04 \x03(\x0b\x32\x36.cerbos.request.v1.CheckResourcesRequest.ResourceEntryB\xe7\x01\x92\x41\xd5\x01\x32\x1eList of resources and actions.J\xac\x01[{\"actions\":[\"view\",\"comment\"], \"resource\":{\"kind\":\"album:object\",\"policyVersion\":\"default\",\"id\":\"XX125\",\"attr\":{\"owner\":\"bugs_bunny\", \"public\": false, \"flagged\": false}}}]\xa8\x01\x01\xb0\x01\x01\xe0\x41\x02\xbaH\x08\xc8\x01\x01\x92\x01\x02\x08\x01R\tresources\x12\x35\n\x08\x61ux_data\x18\x05 \x01(\x0b\x32\x1a.cerbos.request.v1.AuxDataR\x07\x61uxData\x12M\n\x0frequest_context\x18\x06 \x01(\x0b\x32\x1f.cerbos.audit.v1.RequestContextH\x00R\x0erequestContext\x88\x01\x01\x1a\xdc\x01\n\rResourceEntry\x12\x87\x01\n\x07\x61\x63tions\x18\x01 \x03(\tBm\x92\x41T20List of actions being performed on the resource.J\x1a[\"view:public\", \"comment\"]\xa8\x01\x01\xb0\x01\x01\xe0\x41\x02\xbaH\x10\xc8\x01\x01\x92\x01\n\x08\x01\x18\x01\"\x04r\x02\x10\x01R\x07\x61\x63tions\x12\x41\n\x08resource\x18\x02 \x01(\x0b\x32\x1a.cerbos.engine.v1.ResourceB\t\xe0\x41\x02\xbaH\x03\xc8\x01\x01R\x08resource:\x1e\x92\x41\x1b\n\x19\x32\x17\x43heck resources requestB\x12\n\x10_request_context\"\
|
|
15
|
+
descriptor_data = "\n\x1f\x63\x65rbos/request/v1/request.proto\x12\x11\x63\x65rbos.request.v1\x1a\x1b\x62uf/validate/validate.proto\x1a\x1b\x63\x65rbos/audit/v1/audit.proto\x1a\x1d\x63\x65rbos/engine/v1/engine.proto\x1a\x1fgoogle/api/field_behavior.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a.protoc-gen-openapiv2/options/annotations.proto\"\x8f\t\n\x14PlanResourcesRequest\x12\x96\x01\n\nrequest_id\x18\x01 \x01(\tBw\x92\x41t2JOptional application-specific ID useful for correlating logs for analysis.J&\"c2db17b8-4f9f-4fb1-acfd-9162a02be42b\"R\trequestId\x12`\n\x06\x61\x63tion\x18\x02 \x01(\tBH\x18\x01\x92\x41\x43\x32\x32\x41\x63tion to be applied to each resource in the list.J\r\"view:public\"R\x06\x61\x63tion\x12\xfb\x01\n\x07\x61\x63tions\x18\x07 \x03(\tB\xe0\x01\x92\x41\xca\x01\x32\xa3\x01List of actions to generate the query plan for. Mutually exclusive with the singular action field. Must contain at least one action and all actions must be unique.J\x1f[\"view:public\", \"edit:profile\"]\xb0\x01\x01\xbaH\x0f\x92\x01\x0c\x08\x00\x10\x14\x18\x01\"\x04r\x02\x10\x01R\x07\x61\x63tions\x12\x44\n\tprincipal\x18\x03 \x01(\x0b\x32\x1b.cerbos.engine.v1.PrincipalB\t\xe0\x41\x02\xbaH\x03\xc8\x01\x01R\tprincipal\x12T\n\x08resource\x18\x04 \x01(\x0b\x32-.cerbos.engine.v1.PlanResourcesInput.ResourceB\t\xe0\x41\x02\xbaH\x03\xc8\x01\x01R\x08resource\x12:\n\x08\x61ux_data\x18\x05 \x01(\x0b\x32\x1a.cerbos.request.v1.AuxDataB\x03\xe0\x41\x01R\x07\x61uxData\x12\x63\n\x0cinclude_meta\x18\x06 \x01(\x08\x42@\x92\x41=2;Opt to receive request processing metadata in the response.R\x0bincludeMeta\x12M\n\x0frequest_context\x18\x08 \x01(\x0b\x32\x1f.cerbos.audit.v1.RequestContextH\x00R\x0erequestContext\x88\x01\x01:\xdd\x01\x92\x41$\n\"2 PDP Resources Query Plan Request\xbaH\xb2\x01\x1a\xaf\x01\n\x1e\x65xclusiveFieldsActionOrActions\x12\x36\x45xactly one of \'action\' or \'actions\' field must be set\x1aUhas(this.action) && !has(this.actions) || !has(this.action) && size(this.actions) > 0B\x12\n\x10_request_context\"\x86\x05\n\x17\x43heckResourceSetRequest\x12\x96\x01\n\nrequest_id\x18\x01 \x01(\tBw\x92\x41t2JOptional application-specific ID useful for correlating logs for analysis.J&\"c2db17b8-4f9f-4fb1-acfd-9162a02be42b\"R\trequestId\x12\x8f\x01\n\x07\x61\x63tions\x18\x02 \x03(\tBu\x92\x41\\28List of actions being performed on the set of resources.J\x1a[\"view:public\", \"comment\"]\xa8\x01\x01\xb0\x01\x01\xe0\x41\x02\xbaH\x10\xc8\x01\x01\x92\x01\n\x08\x01\x18\x01\"\x04r\x02\x10\x01R\x07\x61\x63tions\x12\x44\n\tprincipal\x18\x03 \x01(\x0b\x32\x1b.cerbos.engine.v1.PrincipalB\t\xe0\x41\x02\xbaH\x03\xc8\x01\x01R\tprincipal\x12\x45\n\x08resource\x18\x04 \x01(\x0b\x32\x1e.cerbos.request.v1.ResourceSetB\t\xe0\x41\x02\xbaH\x03\xc8\x01\x01R\x08resource\x12\x63\n\x0cinclude_meta\x18\x05 \x01(\x08\x42@\x92\x41=2;Opt to receive request processing metadata in the response.R\x0bincludeMeta\x12:\n\x08\x61ux_data\x18\x06 \x01(\x0b\x32\x1a.cerbos.request.v1.AuxDataB\x03\xe0\x41\x01R\x07\x61uxData:\x12\x92\x41\x0f\n\r2\x0bPDP Request\"\x96\x08\n\x0bResourceSet\x12\x44\n\x04kind\x18\x01 \x01(\tB0\x92\x41 2\x0eResource kind.J\x0e\"album:object\"\xe0\x41\x02\xbaH\x07\xc8\x01\x01r\x02\x10\x01R\x04kind\x12\xd0\x01\n\x0epolicy_version\x18\x02 \x01(\tB\xa8\x01\x92\x41\x93\x01\x32|The policy version to use to evaluate this request. If not specified, will default to the server-configured default version.J\t\"default\"\x8a\x01\x07^[\\w]*$\xe0\x41\x01\xbaH\x0br\t2\x07^[\\w]*$R\rpolicyVersion\x12\xec\x02\n\tinstances\x18\x03 \x03(\x0b\x32-.cerbos.request.v1.ResourceSet.InstancesEntryB\x9e\x02\x92\x41\x8c\x02\x32mSet of resource instances to check. Each instance must be keyed by an application-specific unique identifier.J\x97\x01{\"XX125\":{\"attr\":{\"owner\":\"bugs_bunny\", \"public\": false, \"flagged\": false}}, \"XX225\":{\"attr\":{\"owner\":\"daffy_duck\", \"public\": true, \"flagged\": false}}}\xc8\x01\x01\xe0\x41\x02\xbaH\x08\xc8\x01\x01\x9a\x01\x02\x08\x01R\tinstances\x12\xfc\x01\n\x05scope\x18\x04 \x01(\tB\xe5\x01\x92\x41\xad\x01\x32~A dot-separated scope that describes the hierarchy these resources belong to. This is used for determining policy inheritance.\x8a\x01*^(^$|\\.|[0-9a-zA-Z][\\w\\-]*(\\.\\w[\\w\\-]*)*)$\xe0\x41\x01\xbaH.r,2*^(^$|\\.|[0-9a-zA-Z][\\w\\-]*(\\.\\w[\\w\\-]*)*)$R\x05scope\x1a^\n\x0eInstancesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x36\n\x05value\x18\x02 \x01(\x0b\x32 .cerbos.request.v1.AttributesMapR\x05value:\x02\x38\x01: \x92\x41\x1d\n\x1b\x32\x19Set of resources to check\"\xc1\x02\n\rAttributesMap\x12\xa9\x01\n\x04\x61ttr\x18\x01 \x03(\x0b\x32*.cerbos.request.v1.AttributesMap.AttrEntryBi\x92\x41\x66\x32\x64Key-value pairs of contextual data about this instance that should be used during policy evaluation.R\x04\x61ttr\x1aO\n\tAttrEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12,\n\x05value\x18\x02 \x01(\x0b\x32\x16.google.protobuf.ValueR\x05value:\x02\x38\x01:3\x92\x41\x30\n.2,Unique identifier for the resource instance.\"\xe3\x06\n\x19\x43heckResourceBatchRequest\x12\x96\x01\n\nrequest_id\x18\x01 \x01(\tBw\x92\x41t2JOptional application-specific ID useful for correlating logs for analysis.J&\"c2db17b8-4f9f-4fb1-acfd-9162a02be42b\"R\trequestId\x12\x44\n\tprincipal\x18\x02 \x01(\x0b\x32\x1b.cerbos.engine.v1.PrincipalB\t\xe0\x41\x02\xbaH\x03\xc8\x01\x01R\tprincipal\x12\xbf\x02\n\tresources\x18\x03 \x03(\x0b\x32\x37.cerbos.request.v1.CheckResourceBatchRequest.BatchEntryB\xe7\x01\x92\x41\xd5\x01\x32\x1eList of resources and actions.J\xac\x01[{\"actions\":[\"view\",\"comment\"], \"resource\":{\"kind\":\"album:object\",\"policyVersion\":\"default\",\"id\":\"XX125\",\"attr\":{\"owner\":\"bugs_bunny\", \"public\": false, \"flagged\": false}}}]\xa8\x01\x01\xb0\x01\x01\xe0\x41\x02\xbaH\x08\xc8\x01\x01\x92\x01\x02\x08\x01R\tresources\x12\x35\n\x08\x61ux_data\x18\x04 \x01(\x0b\x32\x1a.cerbos.request.v1.AuxDataR\x07\x61uxData\x1a\xd9\x01\n\nBatchEntry\x12\x87\x01\n\x07\x61\x63tions\x18\x01 \x03(\tBm\x92\x41T20List of actions being performed on the resource.J\x1a[\"view:public\", \"comment\"]\xa8\x01\x01\xb0\x01\x01\xe0\x41\x02\xbaH\x10\xc8\x01\x01\x92\x01\n\x08\x01\x18\x01\"\x04r\x02\x10\x01R\x07\x61\x63tions\x12\x41\n\x08resource\x18\x02 \x01(\x0b\x32\x1a.cerbos.engine.v1.ResourceB\t\xe0\x41\x02\xbaH\x03\xc8\x01\x01R\x08resource:\x12\x92\x41\x0f\n\r2\x0bPDP Request\"\xaa\x08\n\x15\x43heckResourcesRequest\x12\x96\x01\n\nrequest_id\x18\x01 \x01(\tBw\x92\x41t2JOptional application-specific ID useful for correlating logs for analysis.J&\"c2db17b8-4f9f-4fb1-acfd-9162a02be42b\"R\trequestId\x12X\n\x0cinclude_meta\x18\x02 \x01(\x08\x42\x35\x92\x41\x32\x32\x30\x41\x64\x64 request processing metadata to the response.R\x0bincludeMeta\x12\x44\n\tprincipal\x18\x03 \x01(\x0b\x32\x1b.cerbos.engine.v1.PrincipalB\t\xe0\x41\x02\xbaH\x03\xc8\x01\x01R\tprincipal\x12\xbe\x02\n\tresources\x18\x04 \x03(\x0b\x32\x36.cerbos.request.v1.CheckResourcesRequest.ResourceEntryB\xe7\x01\x92\x41\xd5\x01\x32\x1eList of resources and actions.J\xac\x01[{\"actions\":[\"view\",\"comment\"], \"resource\":{\"kind\":\"album:object\",\"policyVersion\":\"default\",\"id\":\"XX125\",\"attr\":{\"owner\":\"bugs_bunny\", \"public\": false, \"flagged\": false}}}]\xa8\x01\x01\xb0\x01\x01\xe0\x41\x02\xbaH\x08\xc8\x01\x01\x92\x01\x02\x08\x01R\tresources\x12\x35\n\x08\x61ux_data\x18\x05 \x01(\x0b\x32\x1a.cerbos.request.v1.AuxDataR\x07\x61uxData\x12M\n\x0frequest_context\x18\x06 \x01(\x0b\x32\x1f.cerbos.audit.v1.RequestContextH\x00R\x0erequestContext\x88\x01\x01\x1a\xdc\x01\n\rResourceEntry\x12\x87\x01\n\x07\x61\x63tions\x18\x01 \x03(\tBm\x92\x41T20List of actions being performed on the resource.J\x1a[\"view:public\", \"comment\"]\xa8\x01\x01\xb0\x01\x01\xe0\x41\x02\xbaH\x10\xc8\x01\x01\x92\x01\n\x08\x01\x18\x01\"\x04r\x02\x10\x01R\x07\x61\x63tions\x12\x41\n\x08resource\x18\x02 \x01(\x0b\x32\x1a.cerbos.engine.v1.ResourceB\t\xe0\x41\x02\xbaH\x03\xc8\x01\x01R\x08resource:\x1e\x92\x41\x1b\n\x19\x32\x17\x43heck resources requestB\x12\n\x10_request_context\"\xde\x05\n\x07\x41uxData\x12\x30\n\x03jwt\x18\x01 \x01(\x0b\x32\x1e.cerbos.request.v1.AuxData.JWTR\x03jwt\x12\x9d\x01\n\x04jwts\x18\x02 \x03(\x0b\x32$.cerbos.request.v1.AuxData.JwtsEntryBc\x92\x41T20Named list of JWTs associated with this request.J {\"app\": {\"token\": \"JWT string\"}}\xbaH\t\x9a\x01\x06\"\x04r\x02\x10\x01R\x04jwts\x1a\xe9\x01\n\x03JWT\x12\x45\n\x05token\x18\x01 \x01(\tB/\x92\x41\x1f\x32\x1dJWT from the original request\xe0\x41\x02\xbaH\x07\xc8\x01\x01r\x02\x10\x01R\x05token\x12u\n\nkey_set_id\x18\x02 \x01(\tBW\x92\x41T2RKey ID to use when decoding the token (defined in the Cerbos server configuration)R\x08keySetId:$\x92\x41!\n\x1f\x32\x1dJWT from the original request\x1aW\n\tJwtsEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0b\x32\x1e.cerbos.request.v1.AuxData.JWTR\x05value:\x02\x38\x01:\xbb\x01\x92\x41\x43\n=2;Structured auxiliary data useful for evaluating the request2\x02{}\xbaHr\x1ap\n\x1a\x41uxData.only_one_jwt_field\x12.Only one of the jwt or jwts fields must be set\x1a\"!(has(this.jwt) && has(this.jwts))\"/\n\x11ServerInfoRequest:\x1a\x92\x41\x17\n\x15\x32\x13Server info requestBs\n\x19\x64\x65v.cerbos.api.v1.requestZ>github.com/cerbos/cerbos/api/genpb/cerbos/request/v1;requestv1\xaa\x02\x15\x43\x65rbos.Api.V1.Requestb\x06proto3"
|
|
16
16
|
|
|
17
17
|
pool = ::Google::Protobuf::DescriptorPool.generated_pool
|
|
18
18
|
pool.add_serialized_file(descriptor_data)
|
data/lib/cerbos/version.rb
CHANGED
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: cerbos
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.
|
|
4
|
+
version: 0.14.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Cerbos
|
|
@@ -29,21 +29,21 @@ dependencies:
|
|
|
29
29
|
requirements:
|
|
30
30
|
- - "~>"
|
|
31
31
|
- !ruby/object:Gem::Version
|
|
32
|
-
version: '1.
|
|
32
|
+
version: '1.61'
|
|
33
33
|
type: :runtime
|
|
34
34
|
prerelease: false
|
|
35
35
|
version_requirements: !ruby/object:Gem::Requirement
|
|
36
36
|
requirements:
|
|
37
37
|
- - "~>"
|
|
38
38
|
- !ruby/object:Gem::Version
|
|
39
|
-
version: '1.
|
|
39
|
+
version: '1.61'
|
|
40
40
|
- !ruby/object:Gem::Dependency
|
|
41
41
|
name: google-protobuf
|
|
42
42
|
requirement: !ruby/object:Gem::Requirement
|
|
43
43
|
requirements:
|
|
44
44
|
- - ">="
|
|
45
45
|
- !ruby/object:Gem::Version
|
|
46
|
-
version: 3.
|
|
46
|
+
version: '3.25'
|
|
47
47
|
- - "<"
|
|
48
48
|
- !ruby/object:Gem::Version
|
|
49
49
|
version: '5.0'
|
|
@@ -53,7 +53,7 @@ dependencies:
|
|
|
53
53
|
requirements:
|
|
54
54
|
- - ">="
|
|
55
55
|
- !ruby/object:Gem::Version
|
|
56
|
-
version: 3.
|
|
56
|
+
version: '3.25'
|
|
57
57
|
- - "<"
|
|
58
58
|
- !ruby/object:Gem::Version
|
|
59
59
|
version: '5.0'
|
|
@@ -116,6 +116,7 @@ files:
|
|
|
116
116
|
- lib/cerbos/protobuf/cerbos/audit/v1/audit_pb.rb
|
|
117
117
|
- lib/cerbos/protobuf/cerbos/cloud/apikey/v1/apikey_pb.rb
|
|
118
118
|
- lib/cerbos/protobuf/cerbos/cloud/apikey/v1/apikey_services_pb.rb
|
|
119
|
+
- lib/cerbos/protobuf/cerbos/cloud/auth/v1/auth_pb.rb
|
|
119
120
|
- lib/cerbos/protobuf/cerbos/cloud/store/v1/store_pb.rb
|
|
120
121
|
- lib/cerbos/protobuf/cerbos/cloud/store/v1/store_services_pb.rb
|
|
121
122
|
- lib/cerbos/protobuf/cerbos/effect/v1/effect_pb.rb
|
|
@@ -154,14 +155,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
|
154
155
|
requirements:
|
|
155
156
|
- - ">="
|
|
156
157
|
- !ruby/object:Gem::Version
|
|
157
|
-
version: 3.
|
|
158
|
+
version: '3.3'
|
|
158
159
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
|
159
160
|
requirements:
|
|
160
161
|
- - ">="
|
|
161
162
|
- !ruby/object:Gem::Version
|
|
162
163
|
version: '0'
|
|
163
164
|
requirements: []
|
|
164
|
-
rubygems_version: 4.0.
|
|
165
|
+
rubygems_version: 4.0.18
|
|
165
166
|
specification_version: 4
|
|
166
167
|
summary: Client library for authorization via Cerbos
|
|
167
168
|
test_files: []
|