declarative_policy 2.1.0 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 05f875265a827bd025947cd0098d09804051cf0fa2c02857aa230e03d8554f02
-  data.tar.gz: 38452f2308ad61d9cf54bb604f68cbdd73cb75d342ea24a55c265ee708f588b4
+  metadata.gz: 735e59059f970e9e39c6fc37b1d97f7b20c030a472ca287cb95d4503a168c3a3
+  data.tar.gz: e4bd527d1ab32d86a77666e9b0c175a2e5c1cc8d4627b94fa3d01eb8c6dc6e10
 SHA512:
-  metadata.gz: 82ac859206da667fb45b59662aa9a35fb760f59179e0976f9e7ed9ffba92259ba271fa6732ec9b84e3e14e14961f1362fb13077deb7191c75436c83ef60ab342
-  data.tar.gz: c9e41debc20ab2ecc2dc8da44c2e782f50e58ec7d9cba23986c5494c7c00d334de82a3f6f2c9a5b35739a402ecc097f144cb05314ab8584f07aa46dab548b6c0
+  metadata.gz: 65796bc8d62ce7648433adba6feb99e78e2fff32c27902318a8394973fad38a8b7a476b8a13806178c8d4b20f8f5385e398336c2872a6c58122d213c8d864fbb
+  data.tar.gz: 4ab6e8f55e9efadbf2169bd4b385ec8620fdca8247cfcc1b977fc3ac5fb02f045fb1616caef9878fd0e92f37f6a98c0a58b04f458c9b2c67aec98d4b22545b99

data/lib/declarative_policy/base.rb

@@ -6,6 +6,8 @@ module DeclarativePolicy
     # or :prevent actions. Used to look up which rules apply to
     # a given ability. See Base.ability_map
     class AbilityMap
+      EMPTY_ACTIONS = [].freeze
+
       attr_reader :map
 
       def initialize(map = {})
@@ -20,16 +22,31 @@ module DeclarativePolicy
         AbilityMap.new(@map.merge(other.map, &conflict_proc))
       end
 
+      # Does not add the ability if it is missing. An application may check
+      # abilities named by user input, and storing those would grow the map
+      # without limit.
       def actions(key)
-        @map[key] ||= []
+        @map[key] || EMPTY_ACTIONS
+      end
+
+      def key?(key)
+        @map.key?(key)
       end
 
       def enable(key, rule)
-        actions(key) << [:enable, rule]
+        rules_for(key) << [:enable, rule]
       end
 
       def prevent(key, rule)
-        actions(key) << [:prevent, rule]
+        rules_for(key) << [:prevent, rule]
+      end
+
+      private
+
+      # The writer's counterpart to #actions: this one does create the list,
+      # because a rule has to be appended to something.
+      def rules_for(key)
+        @map[key] ||= []
       end
     end
 
@@ -51,18 +68,25 @@ module DeclarativePolicy
       end
     end
 
+    # Counts declarations across all policies, so the caches below can tell
+    # that something was declared since they were built. Without it a policy
+    # loaded or reopened later would be seen with an out of date set of rules.
+    @definition_generation = 0
+
     class << self
       # The `own_ability_map` vs `ability_map` distinction is used so that
       # the data structure is properly inherited - with subclasses recursively
       # merging their parent class.
       #
       # This pattern is also used for conditions, global_actions, and delegations.
+      #
+      # The combined result is cached because rebuilding it is expensive, and
+      # every policy object would otherwise redo it, once per subject when
+      # authorizing a batch.
       def ability_map
-        if self == Base
-          own_ability_map
-        else
-          superclass.ability_map.merge(own_ability_map)
-        end
+        return own_ability_map if self == Base
+
+        memoized_definition(:ability_map) { superclass.ability_map.merge(own_ability_map) }
       end
 
       def own_ability_map
@@ -71,11 +95,9 @@ module DeclarativePolicy
 
       # an inheritable map of conditions, by name
       def conditions
-        if self == Base
-          own_conditions
-        else
-          superclass.conditions.merge(own_conditions)
-        end
+        return own_conditions if self == Base
+
+        memoized_definition(:conditions) { superclass.conditions.merge(own_conditions) }
       end
 
       def own_conditions
@@ -86,11 +108,9 @@ module DeclarativePolicy
       # stored in `ability_map` because they aren't indexed by a particular
       # ability.
       def global_actions
-        if self == Base
-          own_global_actions
-        else
-          superclass.global_actions + own_global_actions
-        end
+        return own_global_actions if self == Base
+
+        memoized_definition(:global_actions) { superclass.global_actions + own_global_actions }
       end
 
       def own_global_actions
@@ -100,28 +120,37 @@ module DeclarativePolicy
       # an inheritable map of delegations, indexed by name (which may be
       # autogenerated)
       def delegations
-        if self == Base
-          own_delegations
-        else
-          superclass.delegations.merge(own_delegations)
-        end
+        return own_delegations if self == Base
+
+        memoized_definition(:delegations) { superclass.delegations.merge(own_delegations) }
       end
 
       def own_delegations
         @own_delegations ||= {}
       end
 
+      # How many declarations (conditions, rules, delegations) have been made
+      # across all policies so far. Save this value and compare it later to
+      # tell whether any policy has been defined or reopened since.
+      def definition_generation
+        Base.instance_variable_get(:@definition_generation)
+      end
+
+      # Clears the cached results for every policy class. Declaration methods
+      # like condition and enable_when call this for you; call it yourself
+      # only if you write to own_conditions and friends directly.
+      def invalidate_definitions!
+        Base.instance_variable_set(:@definition_generation, definition_generation + 1)
+      end
+
       # all the [rule, action] pairs that apply to a particular ability.
       # we combine the specific ones looked up in ability_map with the global
       # ones, filtering out any global actions that have excepted this ability.
       def configuration_for(ability)
-        applicable_globals = global_actions.filter_map do |(action, rule, exceptions)|
-          next if exceptions&.include?(ability)
-
-          [action, rule]
-        end
+        return build_configuration_for(ability) unless ability_map.key?(ability)
 
-        ability_map.actions(ability) + applicable_globals
+        configurations = memoized_definition(:configurations) { {} }
+        configurations[ability] ||= build_configuration_for(ability)
       end
 
       ### declaration methods ###
@@ -140,6 +169,7 @@ module DeclarativePolicy
         # rubocop: enable GitlabSecurity/PublicSend
 
         own_delegations[name] = delegation_block
+        invalidate_definitions!
       end
 
       # Declare that the given abilities should not be read from delegates.
@@ -202,6 +232,7 @@ module DeclarativePolicy
         condition = Condition.new(condition_name, condition_options(opts), &value)
 
         own_conditions[condition_name] = condition
+        invalidate_definitions!
 
         define_method(:"#{condition_name}?") { condition(condition_name).pass? }
       end
@@ -213,10 +244,12 @@ module DeclarativePolicy
       # symbol indicating :prevent or :enable.
       def enable_when(abilities, rule)
         abilities.each { |a| own_ability_map.enable(a, rule) }
+        invalidate_definitions!
       end
 
       def prevent_when(abilities, rule)
         abilities.each { |a| own_ability_map.prevent(a, rule) }
+        invalidate_definitions!
       end
 
       # we store global prevents (from `prevent_all`) separately,
@@ -225,10 +258,37 @@ module DeclarativePolicy
       # that should be excluded from the blanket prevent.
       def prevent_all_when(rule, except: nil)
         own_global_actions << [:prevent, rule, except]
+        invalidate_definitions!
       end
 
       private
 
+      def build_configuration_for(ability)
+        applicable_globals = global_actions.filter_map do |(action, rule, exceptions)|
+          next if exceptions&.include?(ability)
+
+          [action, rule]
+        end
+
+        (ability_map.actions(ability) + applicable_globals).freeze
+      end
+
+      # Caches this class's combined result (its own declarations plus its
+      # superclass's) until any policy anywhere declares something new.
+      def memoized_definition(name)
+        generation = Base.definition_generation
+
+        unless @memoized_definitions_at == generation
+          @definitions = {}
+          @memoized_definitions_at = generation
+        end
+
+        defs = @definitions
+        return defs[name] if defs.key?(name)
+
+        defs.store(name, yield)
+      end
+
       # retrieve and zero out the previously set options (used in .condition)
       def condition_options(opts)
         # The context_key distinguishes two conditions of the same name.
@@ -353,12 +413,21 @@ module DeclarativePolicy
       @_conditions ||= {}
       @_conditions[name] ||=
         begin
-          raise "invalid condition #{name}" unless self.class.conditions.key?(name)
+          definition = self.class.conditions[name]
+          raise "invalid condition #{name}" unless definition
 
-          ManifestCondition.new(self.class.conditions[name], self)
+          ManifestCondition.new(definition, self)
         end
     end
 
+    def user_cache_key
+      @user_cache_key ||= Cache.user_key(@user)
+    end
+
+    def subject_cache_key
+      @subject_cache_key ||= Cache.subject_key(@subject)
+    end
+
     # used in specs - returns true if there is no possible way for any action
     # to be allowed, determined only by the global :prevent_all rules.
     # Only considers global actions with no exceptions (a prevent_all with

data/lib/declarative_policy/condition.rb

@@ -7,7 +7,7 @@ module DeclarativePolicy
   # declaration. It holds on to the block to be instance_eval'd
   # on a context (instance of Base) later, via #compute.
   class Condition
-    attr_reader :name, :description, :scope, :manual_score, :context_key
+    attr_reader :name, :description, :scope, :manual_score, :context_key, :key
 
     VALID_SCOPES = %i[user_and_subject user subject global].freeze
     ALLOWED_SCOPES = VALID_SCOPES + %i[normal]
@@ -20,16 +20,13 @@ module DeclarativePolicy
       @description = opts.delete(:description)
       @context_key = opts[:context_key]
       @manual_score = opts.fetch(:score, nil)
+      @key = "#{@context_key}/#{@name}".freeze
     end
 
     def compute(context)
       !!context.instance_eval(&@compute)
     end
 
-    def key
-      "#{@context_key}/#{@name}"
-    end
-
     private
 
     def fetch_scope(options)
@@ -107,17 +104,17 @@ module DeclarativePolicy
         when :user    then "/dp/condition/#{@condition.key}/#{user_key}"
         when :subject then "/dp/condition/#{@condition.key}/#{subject_key}"
         else "/dp/condition/#{@condition.key}/#{user_key},#{subject_key}"
-        end
+        end.freeze
     end
 
     private
 
     def user_key
-      Cache.user_key(@context.user)
+      @context.user_cache_key
     end
 
     def subject_key
-      Cache.subject_key(@context.subject)
+      @context.subject_cache_key
     end
   end
 end

data/lib/declarative_policy/runner.rb

@@ -5,12 +5,10 @@ require 'set'
 module DeclarativePolicy
   class Runner
     class State
-      attr_reader :called_conditions
-
       def initialize
         @enabled = false
         @prevented = false
-        @called_conditions = Set.new
+        @called = nil
       end
 
       def enable!
@@ -34,7 +32,31 @@ module DeclarativePolicy
       end
 
       def register(manifest_condition)
-        @called_conditions << manifest_condition.cache_key
+        called[manifest_condition.cache_key] = true
+      end
+
+      def called_conditions
+        return Set.new unless @called
+
+        Set.new(@called.keys)
+      end
+
+      def absorb(other)
+        return if other.equal?(self) || other.called_any.nil?
+
+        called.update(other.called_any)
+      end
+
+      protected
+
+      def called_any
+        @called
+      end
+
+      private
+
+      def called
+        @called ||= {}
       end
     end
 
@@ -81,7 +103,7 @@ module DeclarativePolicy
       run unless cached?
 
       parent_state = Thread.current[:declarative_policy_current_runner_state]
-      parent_state&.called_conditions&.merge(@state.called_conditions)
+      parent_state&.absorb(@state)
 
       @state.pass?
     end
@@ -175,49 +197,53 @@ module DeclarativePolicy
         return
       end
 
-      remaining_steps = Set.new(@steps)
-      remaining_enablers, remaining_preventers = remaining_steps.partition(&:enable?).map { |s| Set.new(s) }
+      remaining = @steps.uniq
+      enablers_left = remaining.count(&:enable?)
+      preventers_only = false
 
       loop do
         if @state.enabled?
           # Once we set this, we never need to unset it, because a single
           # prevent will stop this from being enabled
-          remaining_steps = remaining_preventers
-        elsif remaining_enablers.empty?
+          unless preventers_only
+            remaining.reject!(&:enable?)
+            preventers_only = true
+          end
+        elsif enablers_left.zero?
           # if the permission hasn't yet been enabled and we only have
           # prevent steps left, we short-circuit the state here
           @state.prevent!
           return unless debugging
         end
 
-        return if remaining_steps.empty?
+        return if remaining.empty?
 
-        next_step, lowest_score = next_step_and_score(remaining_steps)
-
-        [remaining_steps, remaining_enablers, remaining_preventers].each do |set|
-          set.delete(next_step)
-        end
+        lowest_index, lowest_score = cheapest_step(remaining)
+        step = remaining.delete_at(lowest_index)
+        enablers_left -= 1 if step.enable?
 
-        yield next_step, lowest_score
+        yield step, lowest_score
       end
     end
 
-    def next_step_and_score(remaining_steps)
+    def cheapest_step(remaining)
       lowest_score = Float::INFINITY
-      next_step = nil
+      lowest_index = 0
+      index = 0
 
-      remaining_steps.each do |step|
-        score = step.score
+      while index < remaining.size
+        score = remaining[index].score
 
         if score < lowest_score
-          next_step = step
           lowest_score = score
+          lowest_index = index
+          break if score.zero?
         end
 
-        break if lowest_score.zero?
+        index += 1
       end
 
-      [next_step, lowest_score]
+      [lowest_index, lowest_score]
     end
 
     # Formatter for debugging output.

data/lib/declarative_policy/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DeclarativePolicy
-  VERSION = '2.1.0'
+  VERSION = '2.2.0'
 end

data/lib/declarative_policy.rb

@@ -37,7 +37,7 @@ module DeclarativePolicy
       policies = cache.select { |k, _| k.is_a?(String) && k.start_with?('/dp/policy/') }
 
       policies.each_value do |policy|
-        policy.runners.each do |runner|
+        policy.runners.each_value do |runner|
           runner.uncache! if keys.intersect?(runner.dependencies)
         end
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: declarative_policy
 version: !ruby/object:Gem::Version
-  version: 2.1.0
+  version: 2.2.0
 platform: ruby
 authors:
 - group::authorization
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-03-13 00:00:00.000000000 Z
+date: 2026-09-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: benchmark-ips