declarative_policy 2.1.0 → 2.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 05f875265a827bd025947cd0098d09804051cf0fa2c02857aa230e03d8554f02
-  data.tar.gz: 38452f2308ad61d9cf54bb604f68cbdd73cb75d342ea24a55c265ee708f588b4
+  metadata.gz: bf0b45880663f66032b9313af36819d078739f7430b53c9f182a4a8904acb443
+  data.tar.gz: c4e162b87f85d1008d5fa956f72f4745c4bb208b59796f95b472f4606504f295
 SHA512:
-  metadata.gz: 82ac859206da667fb45b59662aa9a35fb760f59179e0976f9e7ed9ffba92259ba271fa6732ec9b84e3e14e14961f1362fb13077deb7191c75436c83ef60ab342
-  data.tar.gz: c9e41debc20ab2ecc2dc8da44c2e782f50e58ec7d9cba23986c5494c7c00d334de82a3f6f2c9a5b35739a402ecc097f144cb05314ab8584f07aa46dab548b6c0
+  metadata.gz: 41f679b05618e46bfc952406e211ddbe8512a25b86c254f6c0793d1293a67689414149765ca2e12e1368462669d06685c4af603307661a674d1999475fa2e1e9
+  data.tar.gz: ab068e42451bf95c939eb5952fbb8319741927d123faedd1d2f9713323cee26e019632d053cef1eddc4fc88d937501c062f80ba982e3d183d5ff9bac60cdae81

data/doc/caching.md

@@ -148,9 +148,16 @@ The object only needs to implement the following methods:
 Obviously, a `HashMap` will work just fine, but so will a wrapper around a
 [`Concurrent::Map`](https://ruby-concurrency.github.io/concurrent-ruby/1.1.4/Concurrent/Map.html),
 or even a map that delegates to Redis with a TTL for each key, so long as the
-object supports these methods. Keys are never deleted by the library, and values
-are only computed if the key is not cached, so it is up to the application code
-to determine the life-time of each key.
+object supports these methods. Values are only computed if the key is not
+cached, so it is up to the application code to determine the life-time of each
+key.
+
+To remove keys, use `DeclarativePolicy.invalidate(cache, keys)`. It also makes
+the abilities that depended on those keys check again, and tells the library
+that scores used to order checks may have changed. Keys removed in any other
+way, such as by a TTL expiring, don't change a decision a policy has already
+made, and may make checks run in a less efficient order until the library
+next sees a change.
 
 Clearly, cache-invalidation is a hard problem. At GitLab we share a single cache
 object for each request - so any single request can freely request a permission

data/doc/optimization.md

@@ -124,7 +124,9 @@ their components.
 
 The evaluation of one rule results in updating the cache, so other rules might
 become cheaper, during policy evaluation. To take this into account, we re-score
-the set of rules on each iteration of the main loop.
+the set of rules on each iteration of the main loop. Each rule keeps its score
+until something it depends on changes, such as a condition being cached, so
+re-scoring is cheap.
 
 ## Consequences for the policy-writer
 

data/lib/declarative_policy/base.rb

@@ -6,6 +6,8 @@ module DeclarativePolicy
     # or :prevent actions. Used to look up which rules apply to
     # a given ability. See Base.ability_map
     class AbilityMap
+      EMPTY_ACTIONS = [].freeze
+
       attr_reader :map
 
       def initialize(map = {})
@@ -20,16 +22,31 @@ module DeclarativePolicy
         AbilityMap.new(@map.merge(other.map, &conflict_proc))
       end
 
+      # Does not add the ability if it is missing. An application may check
+      # abilities named by user input, and storing those would grow the map
+      # without limit.
       def actions(key)
-        @map[key] ||= []
+        @map[key] || EMPTY_ACTIONS
+      end
+
+      def key?(key)
+        @map.key?(key)
       end
 
       def enable(key, rule)
-        actions(key) << [:enable, rule]
+        rules_for(key) << [:enable, rule]
       end
 
       def prevent(key, rule)
-        actions(key) << [:prevent, rule]
+        rules_for(key) << [:prevent, rule]
+      end
+
+      private
+
+      # The writer's counterpart to #actions: this one does create the list,
+      # because a rule has to be appended to something.
+      def rules_for(key)
+        @map[key] ||= []
       end
     end
 
@@ -51,18 +68,25 @@ module DeclarativePolicy
       end
     end
 
+    # Counts declarations across all policies, so the caches below can tell
+    # that something was declared since they were built. Without it a policy
+    # loaded or reopened later would be seen with an out of date set of rules.
+    @definition_generation = 0
+
     class << self
       # The `own_ability_map` vs `ability_map` distinction is used so that
       # the data structure is properly inherited - with subclasses recursively
       # merging their parent class.
       #
       # This pattern is also used for conditions, global_actions, and delegations.
+      #
+      # The combined result is cached because rebuilding it is expensive, and
+      # every policy object would otherwise redo it, once per subject when
+      # authorizing a batch.
       def ability_map
-        if self == Base
-          own_ability_map
-        else
-          superclass.ability_map.merge(own_ability_map)
-        end
+        return own_ability_map if self == Base
+
+        memoized_definition(:ability_map) { superclass.ability_map.merge(own_ability_map) }
       end
 
       def own_ability_map
@@ -71,11 +95,9 @@ module DeclarativePolicy
 
       # an inheritable map of conditions, by name
       def conditions
-        if self == Base
-          own_conditions
-        else
-          superclass.conditions.merge(own_conditions)
-        end
+        return own_conditions if self == Base
+
+        memoized_definition(:conditions) { superclass.conditions.merge(own_conditions) }
       end
 
       def own_conditions
@@ -86,11 +108,9 @@ module DeclarativePolicy
       # stored in `ability_map` because they aren't indexed by a particular
       # ability.
       def global_actions
-        if self == Base
-          own_global_actions
-        else
-          superclass.global_actions + own_global_actions
-        end
+        return own_global_actions if self == Base
+
+        memoized_definition(:global_actions) { superclass.global_actions + own_global_actions }
       end
 
       def own_global_actions
@@ -100,28 +120,37 @@ module DeclarativePolicy
       # an inheritable map of delegations, indexed by name (which may be
       # autogenerated)
       def delegations
-        if self == Base
-          own_delegations
-        else
-          superclass.delegations.merge(own_delegations)
-        end
+        return own_delegations if self == Base
+
+        memoized_definition(:delegations) { superclass.delegations.merge(own_delegations) }
       end
 
       def own_delegations
         @own_delegations ||= {}
       end
 
+      # How many declarations (conditions, rules, delegations) have been made
+      # across all policies so far. Save this value and compare it later to
+      # tell whether any policy has been defined or reopened since.
+      def definition_generation
+        Base.instance_variable_get(:@definition_generation)
+      end
+
+      # Clears the cached results for every policy class. Declaration methods
+      # like condition and enable_when call this for you; call it yourself
+      # only if you write to own_conditions and friends directly.
+      def invalidate_definitions!
+        Base.instance_variable_set(:@definition_generation, definition_generation + 1)
+      end
+
       # all the [rule, action] pairs that apply to a particular ability.
       # we combine the specific ones looked up in ability_map with the global
       # ones, filtering out any global actions that have excepted this ability.
       def configuration_for(ability)
-        applicable_globals = global_actions.filter_map do |(action, rule, exceptions)|
-          next if exceptions&.include?(ability)
-
-          [action, rule]
-        end
+        return build_configuration_for(ability) unless ability_map.key?(ability)
 
-        ability_map.actions(ability) + applicable_globals
+        configurations = memoized_definition(:configurations) { {} }
+        configurations[ability] ||= build_configuration_for(ability)
       end
 
       ### declaration methods ###
@@ -140,6 +169,7 @@ module DeclarativePolicy
         # rubocop: enable GitlabSecurity/PublicSend
 
         own_delegations[name] = delegation_block
+        invalidate_definitions!
       end
 
       # Declare that the given abilities should not be read from delegates.
@@ -202,6 +232,7 @@ module DeclarativePolicy
         condition = Condition.new(condition_name, condition_options(opts), &value)
 
         own_conditions[condition_name] = condition
+        invalidate_definitions!
 
         define_method(:"#{condition_name}?") { condition(condition_name).pass? }
       end
@@ -213,10 +244,12 @@ module DeclarativePolicy
       # symbol indicating :prevent or :enable.
       def enable_when(abilities, rule)
         abilities.each { |a| own_ability_map.enable(a, rule) }
+        invalidate_definitions!
       end
 
       def prevent_when(abilities, rule)
         abilities.each { |a| own_ability_map.prevent(a, rule) }
+        invalidate_definitions!
       end
 
       # we store global prevents (from `prevent_all`) separately,
@@ -225,10 +258,37 @@ module DeclarativePolicy
       # that should be excluded from the blanket prevent.
       def prevent_all_when(rule, except: nil)
         own_global_actions << [:prevent, rule, except]
+        invalidate_definitions!
       end
 
       private
 
+      def build_configuration_for(ability)
+        applicable_globals = global_actions.filter_map do |(action, rule, exceptions)|
+          next if exceptions&.include?(ability)
+
+          [action, rule]
+        end
+
+        (ability_map.actions(ability) + applicable_globals).freeze
+      end
+
+      # Caches this class's combined result (its own declarations plus its
+      # superclass's) until any policy anywhere declares something new.
+      def memoized_definition(name)
+        generation = Base.definition_generation
+
+        unless @memoized_definitions_at == generation
+          @definitions = {}
+          @memoized_definitions_at = generation
+        end
+
+        defs = @definitions
+        return defs[name] if defs.key?(name)
+
+        defs.store(name, yield)
+      end
+
       # retrieve and zero out the previously set options (used in .condition)
       def condition_options(opts)
         # The context_key distinguishes two conditions of the same name.
@@ -339,7 +399,11 @@ module DeclarativePolicy
     def cache(key)
       return @cache[key] if cached?(key)
 
-      @cache[key] = yield
+      # Advance the score epoch only once the value is stored: checks run by
+      # the block would otherwise keep scores that see the key as missing.
+      value = @cache[key] = yield
+      DeclarativePolicy.advance_score_epoch!
+      value
     end
 
     def cached?(key)
@@ -353,12 +417,21 @@ module DeclarativePolicy
       @_conditions ||= {}
       @_conditions[name] ||=
         begin
-          raise "invalid condition #{name}" unless self.class.conditions.key?(name)
+          definition = self.class.conditions[name]
+          raise "invalid condition #{name}" unless definition
 
-          ManifestCondition.new(self.class.conditions[name], self)
+          ManifestCondition.new(definition, self)
         end
     end
 
+    def user_cache_key
+      @user_cache_key ||= Cache.user_key(@user)
+    end
+
+    def subject_cache_key
+      @subject_cache_key ||= Cache.subject_key(@subject)
+    end
+
     # used in specs - returns true if there is no possible way for any action
     # to be allowed, determined only by the global :prevent_all rules.
     # Only considers global actions with no exceptions (a prevent_all with

data/lib/declarative_policy/condition.rb

@@ -7,7 +7,7 @@ module DeclarativePolicy
   # declaration. It holds on to the block to be instance_eval'd
   # on a context (instance of Base) later, via #compute.
   class Condition
-    attr_reader :name, :description, :scope, :manual_score, :context_key
+    attr_reader :name, :description, :scope, :manual_score, :context_key, :key
 
     VALID_SCOPES = %i[user_and_subject user subject global].freeze
     ALLOWED_SCOPES = VALID_SCOPES + %i[normal]
@@ -20,16 +20,13 @@ module DeclarativePolicy
       @description = opts.delete(:description)
       @context_key = opts[:context_key]
       @manual_score = opts.fetch(:score, nil)
+      @key = "#{@context_key}/#{@name}".freeze
     end
 
     def compute(context)
       !!context.instance_eval(&@compute)
     end
 
-    def key
-      "#{@context_key}/#{@name}"
-    end
-
     private
 
     def fetch_scope(options)
@@ -107,17 +104,17 @@ module DeclarativePolicy
         when :user    then "/dp/condition/#{@condition.key}/#{user_key}"
         when :subject then "/dp/condition/#{@condition.key}/#{subject_key}"
         else "/dp/condition/#{@condition.key}/#{user_key},#{subject_key}"
-        end
+        end.freeze
     end
 
     private
 
     def user_key
-      Cache.user_key(@context.user)
+      @context.user_cache_key
     end
 
     def subject_key
-      Cache.subject_key(@context.subject)
+      @context.subject_cache_key
     end
   end
 end

data/lib/declarative_policy/preferred_scope.rb

@@ -4,12 +4,16 @@ module DeclarativePolicy
   module PreferredScope
     PREFERRED_SCOPE_KEY = :'DeclarativePolicy.preferred_scope'
 
+    # Scores depend on the preferred scope (see ManifestCondition#score), so
+    # changing it advances the score epoch. The scope is per fiber but the
+    # epoch is not, so fibers sharing a cache with different scopes may see
+    # each other's scores. That can only change the order of checks.
     def with_preferred_scope(scope)
       old_scope = Thread.current[PREFERRED_SCOPE_KEY]
-      Thread.current[PREFERRED_SCOPE_KEY] = scope
+      self.preferred_scope = scope
       yield
     ensure
-      Thread.current[PREFERRED_SCOPE_KEY] = old_scope
+      self.preferred_scope = old_scope
     end
 
     def preferred_scope
@@ -25,7 +29,10 @@ module DeclarativePolicy
     end
 
     def preferred_scope=(scope)
+      return if Thread.current[PREFERRED_SCOPE_KEY] == scope
+
       Thread.current[PREFERRED_SCOPE_KEY] = scope
+      DeclarativePolicy.advance_score_epoch!
     end
   end
 end

data/lib/declarative_policy/runner.rb

@@ -5,12 +5,10 @@ require 'set'
 module DeclarativePolicy
   class Runner
     class State
-      attr_reader :called_conditions
-
       def initialize
         @enabled = false
         @prevented = false
-        @called_conditions = Set.new
+        @called = nil
       end
 
       def enable!
@@ -34,7 +32,31 @@ module DeclarativePolicy
       end
 
       def register(manifest_condition)
-        @called_conditions << manifest_condition.cache_key
+        called[manifest_condition.cache_key] = true
+      end
+
+      def called_conditions
+        return Set.new unless @called
+
+        Set.new(@called.keys)
+      end
+
+      def absorb(other)
+        return if other.equal?(self) || other.called_any.nil?
+
+        called.update(other.called_any)
+      end
+
+      protected
+
+      def called_any
+        @called
+      end
+
+      private
+
+      def called
+        @called ||= {}
       end
     end
 
@@ -44,6 +66,8 @@ module DeclarativePolicy
     def initialize(steps)
       @steps = steps
       @state = nil
+      @score = nil
+      @score_epoch = nil
     end
 
     # We make sure only to run any given Runner once,
@@ -56,13 +80,20 @@ module DeclarativePolicy
     # Delete the cached state - allowing this runner to be re-used if the facts have changed.
     def uncache!
       @state = nil
+      DeclarativePolicy.advance_score_epoch!
     end
 
-    # used by Rule::Ability. See #steps_by_score
+    # used by Rule::Ability. See #steps_by_score, and Step#score for how
+    # scores are kept.
     def score
       return 0 if cached?
 
-      steps.sum(&:score)
+      epoch = DeclarativePolicy.score_epoch
+      return @score if @score_epoch == epoch
+
+      @score = compute_score
+      @score_epoch = epoch
+      @score
     end
 
     def merge_runner(other)
@@ -81,7 +112,7 @@ module DeclarativePolicy
       run unless cached?
 
       parent_state = Thread.current[:declarative_policy_current_runner_state]
-      parent_state&.called_conditions&.merge(@state.called_conditions)
+      parent_state&.absorb(@state)
 
       @state.pass?
     end
@@ -93,19 +124,66 @@ module DeclarativePolicy
 
     private
 
+    # A run that raises part way through leaves no state behind, so the next
+    # check runs again rather than reading a half-finished decision.
+    #
+    # A runner counts as cached from the start of its run, which changes the
+    # score of every step that depends on it, so the score epoch advances
+    # when the run starts, and again when a failed run is discarded.
     def with_state
       @state = State.new
+      DeclarativePolicy.advance_score_epoch!
       old_runner_state = Thread.current[:declarative_policy_current_runner_state]
       Thread.current[:declarative_policy_current_runner_state] = @state
+      finished = false
 
       yield
+      finished = true
     ensure
       Thread.current[:declarative_policy_current_runner_state] = old_runner_state
+      uncache! unless finished
+    end
+
+    def compute_score
+      steps.sum(&:score)
     end
 
     def flatten_steps!
-      @steps = @steps.flat_map { |s| s.flattened(@steps) }
+      roots = @steps.size > RootSteps::MAX_SCANNED_STEPS ? RootSteps.new(@steps) : @steps
+      @steps = @steps.flat_map { |s| s.flattened(roots) }
+    end
+
+    # The steps being flattened, for Step#flattened to tell whether a step is
+    # among them. A faster stand-in for Array#include?, which compares every
+    # step with Step#==. Rules and policies don't define ==, so comparing
+    # them by identity gives the same answer. The index is built on first
+    # use, since only `can?` rules need it.
+    class RootSteps
+      # Up to this many steps, scanning the array is cheaper than building
+      # the index.
+      MAX_SCANNED_STEPS = 8
+
+      def initialize(steps)
+        @steps = steps
+        @index = nil
+      end
+
+      def include?(step)
+        actions = index[step.rule]&.[](step.context)
+
+        actions ? actions.include?(step.action) : false
+      end
+
+      private
+
+      def index
+        @index ||= @steps.each_with_object({}.compare_by_identity) do |step, by_rule|
+          by_context = (by_rule[step.rule] ||= {}.compare_by_identity)
+          (by_context[step.context] ||= []) << step.action
+        end
+      end
     end
+    private_constant :RootSteps
 
     # This method implements the semantic of "one enable and no prevents".
     # It relies on #steps_by_score for the main loop, and updates @state
@@ -158,7 +236,7 @@ module DeclarativePolicy
     # So! The way we sort here involves re-scoring at every step. This
     # is by necessity quadratic, but most of the time the number of steps
     # will be low. But just in case, if the number of steps exceeds 50,
-    # we print a warning and fall back to a static sort.
+    # we fall back to a static sort.
     #
     # For each step, we yield the step object along with the computed score
     # for debugging purposes.
@@ -166,8 +244,6 @@ module DeclarativePolicy
       flatten_steps!
 
       if @steps.size > 50
-        warn "DeclarativePolicy: large number of steps (#{steps.size}), falling back to static sort"
-
         @steps.map { |s| [s.score, s] }.sort_by { |(score, _)| score }.each do |(score, step)|
           yield step, score
         end
@@ -175,49 +251,53 @@ module DeclarativePolicy
         return
       end
 
-      remaining_steps = Set.new(@steps)
-      remaining_enablers, remaining_preventers = remaining_steps.partition(&:enable?).map { |s| Set.new(s) }
+      remaining = @steps.uniq
+      enablers_left = remaining.count(&:enable?)
+      preventers_only = false
 
       loop do
         if @state.enabled?
           # Once we set this, we never need to unset it, because a single
           # prevent will stop this from being enabled
-          remaining_steps = remaining_preventers
-        elsif remaining_enablers.empty?
+          unless preventers_only
+            remaining.reject!(&:enable?)
+            preventers_only = true
+          end
+        elsif enablers_left.zero?
           # if the permission hasn't yet been enabled and we only have
           # prevent steps left, we short-circuit the state here
           @state.prevent!
           return unless debugging
         end
 
-        return if remaining_steps.empty?
+        return if remaining.empty?
 
-        next_step, lowest_score = next_step_and_score(remaining_steps)
-
-        [remaining_steps, remaining_enablers, remaining_preventers].each do |set|
-          set.delete(next_step)
-        end
+        lowest_index, lowest_score = cheapest_step(remaining)
+        step = remaining.delete_at(lowest_index)
+        enablers_left -= 1 if step.enable?
 
-        yield next_step, lowest_score
+        yield step, lowest_score
       end
     end
 
-    def next_step_and_score(remaining_steps)
+    def cheapest_step(remaining)
       lowest_score = Float::INFINITY
-      next_step = nil
+      lowest_index = 0
+      index = 0
 
-      remaining_steps.each do |step|
-        score = step.score
+      while index < remaining.size
+        score = remaining[index].score
 
         if score < lowest_score
-          next_step = step
           lowest_score = score
+          lowest_index = index
+          break if score.zero?
         end
 
-        break if lowest_score.zero?
+        index += 1
       end
 
-      [next_step, lowest_score]
+      [lowest_index, lowest_score]
     end
 
     # Formatter for debugging output.

data/lib/declarative_policy/step.rb

@@ -13,6 +13,8 @@ module DeclarativePolicy
       @context = context
       @rule = rule
       @action = action
+      @score = nil
+      @score_epoch = nil
     end
 
     # In the flattening process, duplicate steps may be generated in the
@@ -26,15 +28,17 @@ module DeclarativePolicy
     # we are sure to compute them in close to the optimal order.
     #
     # See also Rule#score, ManifestCondition#score, and Runner#steps_by_score.
+    #
+    # A score only changes when the score epoch does, so it is kept until
+    # then. The epoch is read before scoring, since scoring can run code that
+    # advances it.
     def score
-      # we slightly prefer the preventative actions
-      # since they are more likely to short-circuit
-      case @action
-      when :prevent
-        @rule.score(@context) * (7.0 / 8)
-      when :enable
-        @rule.score(@context)
-      end
+      epoch = DeclarativePolicy.score_epoch
+      return @score if @score_epoch == epoch
+
+      @score = compute_score
+      @score_epoch = epoch
+      @score
     end
 
     def with_action(action)
@@ -61,7 +65,19 @@ module DeclarativePolicy
         # in some cases. If we depend on an Ability (i.e. a `can?(...)` rule),
         # and that ability *only* has :enable actions (modulo some actions that
         # we already have taken care of), then its rules can be safely inlined.
-        steps = @context.runner(@rule.ability).steps.reject { |s| roots.include?(s) }
+        #
+        # Steps that are already in `roots` are skipped, since they run anyway.
+        # A :prevent step can only skip :prevent steps, because each :enable
+        # step it inlines would turn into a :prevent. For example, with
+        #
+        #   rule { member }.enable :read, :write
+        #   rule { can?(:read) }.prevent :write
+        #
+        # `enable when member` is already a step of :write, but inlining needs
+        # `prevent when member`, so it must not be skipped.
+        steps = @context.runner(@rule.ability).steps.reject do |s|
+          roots.include?(s) && !(prevent? && s.enable?)
+        end
 
         if steps.all?(&:enable?)
           # in the case that we are a :prevent step, each inlined step becomes
@@ -85,5 +101,18 @@ module DeclarativePolicy
     def repr
       "#{@action} when #{@rule.repr} (#{@context.repr})"
     end
+
+    private
+
+    def compute_score
+      # we slightly prefer the preventative actions
+      # since they are more likely to short-circuit
+      case @action
+      when :prevent
+        @rule.score(@context) * (7.0 / 8)
+      when :enable
+        @rule.score(@context)
+      end
+    end
   end
 end

data/lib/declarative_policy/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DeclarativePolicy
-  VERSION = '2.1.0'
+  VERSION = '2.3.0'
 end

data/lib/declarative_policy.rb

@@ -19,7 +19,23 @@ require_relative 'declarative_policy/configuration'
 module DeclarativePolicy
   extend PreferredScope
 
+  # Counts changes to anything a step's score depends on: a condition being
+  # cached, a runner starting or being uncached, and the preferred scope.
+  # Steps and runners keep their last score until this changes (see
+  # Step#score). It is shared by every thread. A change made elsewhere, or an
+  # update lost on a Ruby without a global lock, can only change the order of
+  # checks, not their result.
+  @score_epoch = 0
+
   class << self
+    # @api private
+    attr_reader :score_epoch
+
+    # @api private
+    def advance_score_epoch!
+      @score_epoch += 1
+    end
+
     def policy_for(user, subject, opts = {})
       cache = opts[:cache] || {}
       key = Cache.policy_key(user, subject)
@@ -37,12 +53,13 @@ module DeclarativePolicy
       policies = cache.select { |k, _| k.is_a?(String) && k.start_with?('/dp/policy/') }
 
       policies.each_value do |policy|
-        policy.runners.each do |runner|
+        policy.runners.each_value do |runner|
           runner.uncache! if keys.intersect?(runner.dependencies)
         end
       end
 
       invalidated_keys.each { |k| cache.delete(k) }
+      advance_score_epoch!
 
       nil
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: declarative_policy
 version: !ruby/object:Gem::Version
-  version: 2.1.0
+  version: 2.3.0
 platform: ruby
 authors:
 - group::authorization
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-03-13 00:00:00.000000000 Z
+date: 2026-10-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: benchmark-ips