gitlab-glaz 0.0.2-aarch64-linux-gnu → 1.0.0-aarch64-linux-gnu

data/Cargo.toml

@@ -0,0 +1,15 @@
+# Root Cargo.toml - Defines the workspace
+[workspace]
+members = ["ext/*"]
+resolver = "2"
+
+[workspace.package]
+version = "1.0.0"
+edition = "2024"
+
+# Shared dependencies for all crates
+[workspace.dependencies]
+magnus = { version = "0.8.2", features = ["rb-sys"] }
+rb-sys = "0.9.128"
+glaz-module = { git = "https://gitlab.com/gitlab-org/auth/glaz.git", rev = "13a32ad3f0e6490384afb6ba6a3c3e2a6439901a" }
+glaz-roles = { git = "https://gitlab.com/gitlab-org/auth/glaz.git", rev = "13a32ad3f0e6490384afb6ba6a3c3e2a6439901a" }

data/README.md

@@ -3,68 +3,52 @@
 > [!WARNING]
 > This gem is currently designed entirely for internal use at GitLab.
 
-Ruby bindings for the [Glaz](https://gitlab.com/gitlab-org/auth/glaz) authorization engine. It wraps the Rust-backed `glaz-ruby` crate via [Magnus](https://github.com/matsadler/magnus) FFI, exposing the Glaz `CheckEngine` to Ruby without leaving the Ruby process.
-
-## Requirements
-
-- Ruby >= 3.1
-- Rust toolchain (for building the native extension)
+Ruby bindings for the [Glaz](https://gitlab.com/gitlab-org/auth/glaz) authorization engine. A thin [Magnus](https://github.com/matsadler/magnus) FFI extension exposes the Rust `glaz-module` engine to Ruby, so Cedar policy checks run in-process.
 
 ## Installation
 
-Add to your Gemfile:
+Requires Ruby >= 3.1 and a Rust toolchain. Add to your Gemfile:
 
 ```ruby
 gem 'gitlab-glaz', path: 'gems/gitlab-glaz'
 ```
 
-## Building
-
-The gem contains a Rust extension that must be compiled before use:
-
-```shell
-bundle exec rake compile
-```
-
-This compiles the Rust crate in `ext/glaz/` and places the resulting native library under `lib/glaz/`.
-
 ## Usage
 
 ```ruby
 require 'gitlab-glaz'
 
-# Use the Glaz CheckEngine via the compiled native extension
-```
+engine = Gitlab::Glaz::Engine.new(schema: cedar_schema, policies: cedar_policies)
 
-## Architecture
+engine.check_action(
+  subject_uuid: user_uuid,
+  object_uuid: project_uuid,
+  action: 'read_docs',
+  context: {}
+)
+# => { allowed: true, reason: 'permit_granted' }
 
-| Layer | Technology | Purpose |
-| ------- | ----------- | --------- |
-| Ruby API | `lib/gitlab-glaz.rb` | Entry point, loads the native extension |
-| FFI bridge | [Magnus](https://github.com/matsadler/magnus) + [rb-sys](https://github.com/oxidize-rb/rb-sys) | Bridges Ruby ↔ Rust |
-| Rust extension | `ext/glaz/` | Thin `#[magnus::init]` shim that delegates to `glaz-ruby` |
-| Core engine | [`glaz-ruby`](https://gitlab.com/gitlab-org/auth/glaz) | Rust crate implementing the Glaz authorization engine |
+# Swap the policy set at runtime; the previous set stays active if the
+# new source fails to parse or validate against the schema:
+engine.load_policies(new_cedar_policies)
+```
 
-## Development
+The schema is loaded once at construction and cannot change; build a new engine to use a new schema.
 
-The workspace root [`Cargo.toml`](Cargo.toml) declares all shared Rust dependencies. The extension crate lives in [`ext/glaz/`](ext/glaz/).
+Schemas must declare `User` and `Resource` entities (checks build `User::"<subject_uuid>"` and `Resource::"<object_uuid>"` UIDs), and every action's context type must include `user_permissions: Set<Action>`, which the engine injects with the checked action.
 
-To build only the Rust extension:
+## Development
 
 ```shell
-cargo build --release
+bundle exec rake compile  # build the native extension (required before rspec)
+bundle exec rspec
 ```
 
-To run the full compile via Rake (used during gem installation):
-
-```shell
-bundle exec rake
-```
+The extension crate lives in [`ext/glaz/`](ext/glaz/); shared Rust dependencies are declared in the root [`Cargo.toml`](Cargo.toml).
 
 ## Releasing a new version
 
-To release a new version, create a merge request and use the `Release` template, following its instructions.
-Once merged, the new version with precompiled, native gems will automatically be published to RubyGems.
+Create a merge request using the `Release` template and follow its instructions. Once merged, precompiled native gems are published to RubyGems automatically.
 
 ## License
 

data/ext/glaz/Cargo.toml

@@ -9,4 +9,5 @@ crate-type = ["cdylib"]
 
 [dependencies]
 glaz-module = { workspace = true }
+glaz-roles = { workspace = true }
 magnus = { workspace = true }

data/ext/glaz/src/lib.rs

@@ -1,26 +1,48 @@
 use magnus::{Error, Ruby, prelude::*};
 
-#[magnus::wrap(class = "Glaz::Engine::CheckPermission")]
-struct CheckPermission {
+/// Thin 1:1 wrapper around `glaz_module::PermissionCheckEngine`. The engine
+/// starts empty; `load_schema` must be called before `load_policies`, and
+/// `check_action` fails with a RuntimeError until both are loaded.
+#[magnus::wrap(class = "Glaz::PermissionCheckEngine")]
+struct PermissionCheckEngine {
     engine: glaz_module::PermissionCheckEngine,
 }
 
-impl CheckPermission {
+impl PermissionCheckEngine {
     fn initialize(ruby: &Ruby) -> Result<Self, Error> {
-        glaz_module::PermissionCheckEngine::new()
-            .map(|engine| Self { engine })
-            .map_err(|e| Error::new(ruby.exception_runtime_error(), format!("{e}")))
+        let engine = glaz_module::PermissionCheckEngine::new().map_err(|e| map_error(ruby, e))?;
+
+        Ok(Self { engine })
+    }
+
+    /// Load the Cedar schema. Re-loading a schema drops the active policies,
+    /// so callers should load the schema exactly once, before any policies.
+    fn load_schema(ruby: &Ruby, rb_self: &Self, schema: String) -> Result<(), Error> {
+        rb_self
+            .engine
+            .load_schema(&schema)
+            .map_err(|e| map_error(ruby, e))
     }
 
-    fn check_permission(
+    /// Replace the active policy set with the given Cedar policy source,
+    /// validated against the loaded schema. On error the previous policies
+    /// remain active.
+    fn load_policies(ruby: &Ruby, rb_self: &Self, policies: String) -> Result<(), Error> {
+        rb_self
+            .engine
+            .load_policies(&policies)
+            .map_err(|e| map_error(ruby, e))
+    }
+
+    fn check_action(
         ruby: &Ruby,
-        rb_self: &CheckPermission,
+        rb_self: &Self,
         proto_bytes: magnus::RString,
     ) -> Result<magnus::RHash, Error> {
         let bytes = unsafe { proto_bytes.as_slice() };
         let result = rb_self
             .engine
-            .check_permission(bytes)
+            .check(bytes)
             .map_err(|e| map_error(ruby, e))?;
         let hash = ruby.hash_new();
         hash.aset(ruby.sym_new("allowed"), result.allowed)?;
@@ -29,10 +51,30 @@ impl CheckPermission {
     }
 }
 
+/// Return the default roles embedded in the extension at build time (parsed
+/// from glaz-roles' roles/**/*.yml) as an array of hashes shaped like
+/// `{ id: String, name: String, permissions: [String, ...] }`.
+fn roles(ruby: &Ruby) -> Result<magnus::RArray, Error> {
+    let array = ruby.ary_new();
+    for role in glaz_roles::default_roles() {
+        let hash = ruby.hash_new();
+        hash.aset(ruby.sym_new("id"), role.id.to_string())?;
+        hash.aset(ruby.sym_new("name"), role.name)?;
+        let permissions = ruby.ary_new();
+        for permission in &role.permissions {
+            permissions.push(permission.as_str())?;
+        }
+        hash.aset(ruby.sym_new("permissions"), permissions)?;
+        array.push(hash)?;
+    }
+    Ok(array)
+}
+
 fn map_error(ruby: &Ruby, e: glaz_module::GlazError) -> Error {
     use glaz_module::GlazError::*;
     match e {
         InvalidArgument(_) => Error::new(ruby.exception_arg_error(), format!("{e}")),
+        NotInitialized(_) => Error::new(ruby.exception_runtime_error(), format!("{e}")),
         Runtime(_) => Error::new(ruby.exception_runtime_error(), format!("{e}")),
     }
 }
@@ -40,12 +82,23 @@ fn map_error(ruby: &Ruby, e: glaz_module::GlazError) -> Error {
 #[magnus::init]
 fn init(ruby: &Ruby) -> Result<(), Error> {
     let glaz = ruby.define_module("Glaz")?;
-    let engine = glaz.define_module("Engine")?;
-    let class = engine.define_class("CheckPermission", ruby.class_object())?;
-    class.define_singleton_method("new", magnus::function!(CheckPermission::initialize, 0))?;
+    glaz.define_singleton_method("roles", magnus::function!(roles, 0))?;
+    let class = glaz.define_class("PermissionCheckEngine", ruby.class_object())?;
+    class.define_singleton_method(
+        "new",
+        magnus::function!(PermissionCheckEngine::initialize, 0),
+    )?;
+    class.define_method(
+        "load_schema",
+        magnus::method!(PermissionCheckEngine::load_schema, 1),
+    )?;
+    class.define_method(
+        "load_policies",
+        magnus::method!(PermissionCheckEngine::load_policies, 1),
+    )?;
     class.define_method(
-        "check_permission",
-        magnus::method!(CheckPermission::check_permission, 1),
+        "check_action",
+        magnus::method!(PermissionCheckEngine::check_action, 1),
     )?;
     Ok(())
 }

data/lib/gitlab/glaz/engine.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Gitlab
+  module Glaz
+    # Wraps a native Glaz::PermissionCheckEngine instance.
+    #
+    # The Cedar schema is fixed for the lifetime of the engine: it is loaded
+    # exactly once at construction and cannot be re-loaded; build a new Engine
+    # to change it. The policy set can be replaced at any time with
+    # #load_policies.
+    #
+    # Schemas must declare `User` and `Resource` entity types and declare
+    # each checkable action with `appliesTo { principal: [User], resource:
+    # [Resource], ... }`, because the engine builds `User::"<subject_uuid>"` and
+    # `Resource::"<object_uuid>"` entity UIDs for every check. The engine also
+    # injects `user_permissions` (a Set<Action> containing the checked action)
+    # into the Cedar context, so an action's declared context type must include
+    # `user_permissions: Set<Action>` alongside any custom attributes.
+    class Engine
+      # @param schema [String] Cedar schema source (`.cedarschema` DSL).
+      # @param policies [String] Cedar policy source, validated against the
+      #   schema; ArgumentError is raised when either does not parse or the
+      #   policies do not validate.
+      def initialize(schema:, policies:)
+        @native = ::Glaz::PermissionCheckEngine.new
+        @native.load_schema(schema)
+        @native.load_policies(policies)
+      end
+
+      # Replace the active policy set with the given Cedar policy source,
+      # validated against the engine's schema. Raises ArgumentError when the
+      # source does not parse or validate; the previous policies then remain
+      # active. The swap is atomic with respect to concurrent checks.
+      def load_policies(source)
+        @native.load_policies(source)
+      end
+
+      # Evaluate whether the subject may perform +action+ on the object.
+      #
+      # @param context [Hash] ABAC attributes made available to policies as the
+      #   Cedar context; must match the context type the schema declares for
+      #   the checked action.
+      # @return [Hash] { allowed: Boolean, reason: String }
+      def check_action(subject_uuid:, object_uuid:, action:, context: {})
+        request = ::Glaz::CheckRequest.encode(
+          ::Glaz::CheckRequest.new(
+            subject: ::Relationships::V1::Principal.new(id: subject_uuid),
+            action: action,
+            object: ::Relationships::V1::Object.new(id: object_uuid),
+            context: context.to_json
+          )
+        )
+
+        @native.check_action(request)
+      end
+    end
+  end
+end

data/lib/gitlab/glaz/version.rb

@@ -2,6 +2,6 @@
 
 module Gitlab
   module Glaz
-    VERSION = "0.0.2"
+    VERSION = "1.0.0"
   end
 end

data/lib/gitlab/glaz.rb

@@ -6,21 +6,20 @@ require "proto/service_pb"
 
 load_rust_extension
 
+require_relative "glaz/engine"
+
 module Gitlab
   module Glaz
     module_function
 
-    def check_permission(subject_uuid:, object_uuid:, permission:, context: {})
-      request = ::Glaz::CheckPermissionRequest.encode(
-        ::Glaz::CheckPermissionRequest.new(
-          subject: subject_uuid,
-          object: object_uuid,
-          permission: permission,
-          context: context.to_json
-        )
-      )
-
-      ::Glaz::Engine::CheckPermission.new.check_permission(request)
+    # Returns the default roles embedded in the native extension at build time,
+    # sourced from the glaz-roles crate's roles/**/*.yml definitions. Each entry
+    # is a hash: { id: String, name: String, permissions: Array<String> }.
+    def roles
+      @roles ||= ::Glaz.roles.each do |role|
+        role[:permissions].freeze
+        role.freeze
+      end.freeze
     end
   end
 end

data/lib/proto/relationships/relationships_pb.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: proto/relationships/relationships.proto
+
+require 'google/protobuf'
+
+require 'google/protobuf/timestamp_pb'
+
+
+descriptor_data = "\n\'proto/relationships/relationships.proto\x12\x10relationships.v1\x1a\x1fgoogle/protobuf/timestamp.proto\"\x14\n\x06Object\x12\n\n\x02id\x18\x01 \x01(\t\"\x17\n\tPrincipal\x12\n\n\x02id\x18\x01 \x01(\t\"\x12\n\x04Role\x12\n\n\x02id\x18\x01 \x01(\t\"Y\n\x08Identity\x12(\n\x06origin\x18\x01 \x01(\x0e\x32\x18.relationships.v1.Origin\x12\x11\n\torigin_id\x18\x02 \x01(\t\x12\x10\n\x08local_id\x18\x03 \x01(\t\"q\n\x07Subject\x12.\n\x08identity\x18\x01 \x01(\x0b\x32\x1a.relationships.v1.IdentityH\x00\x12\x30\n\tprincipal\x18\x02 \x01(\x0b\x32\x1b.relationships.v1.PrincipalH\x00\x42\x04\n\x02id\"\xdf\x01\n\x0cRelationship\x12*\n\x07subject\x18\x01 \x01(\x0b\x32\x19.relationships.v1.Subject\x12(\n\x06object\x18\x02 \x01(\x0b\x32\x18.relationships.v1.Object\x12$\n\x04kind\x18\x03 \x01(\x0e\x32\x16.relationships.v1.Kind\x12$\n\x04role\x18\x04 \x01(\x0b\x32\x16.relationships.v1.Role\x12-\n\ttimestamp\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xb5\x01\n\x11RelationshipInput\x12*\n\x07subject\x18\x01 \x01(\x0b\x32\x19.relationships.v1.Subject\x12(\n\x06object\x18\x02 \x01(\x0b\x32\x18.relationships.v1.Object\x12$\n\x04kind\x18\x03 \x01(\x0e\x32\x16.relationships.v1.Kind\x12$\n\x04role\x18\x04 \x01(\x0b\x32\x16.relationships.v1.Role\"\x8d\x01\n\x0fRelationshipKey\x12*\n\x07subject\x18\x01 \x01(\x0b\x32\x19.relationships.v1.Subject\x12(\n\x06object\x18\x02 \x01(\x0b\x32\x18.relationships.v1.Object\x12$\n\x04kind\x18\x03 \x01(\x0e\x32\x16.relationships.v1.Kind*1\n\x04Kind\x12\x14\n\x10KIND_UNSPECIFIED\x10\x00\x12\x13\n\x0fKIND_ASSIGNMENT\x10\x01*N\n\x06Origin\x12\x16\n\x12ORIGIN_UNSPECIFIED\x10\x00\x12\x0f\n\x0bORIGIN_SELF\x10\x01\x12\x1b\n\x17ORIGIN_GITLAB_FEDERATED\x10\x02\x42\x34Z2gitlab.com/gitlab-org/auth/iam/proto/relationshipsb\x06proto3"
+
+pool = ::Google::Protobuf::DescriptorPool.generated_pool
+pool.add_serialized_file(descriptor_data)
+
+module Relationships
+  module V1
+    Object = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Object").msgclass
+    Principal = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Principal").msgclass
+    Role = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Role").msgclass
+    Identity = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Identity").msgclass
+    Subject = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Subject").msgclass
+    Relationship = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Relationship").msgclass
+    RelationshipInput = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.RelationshipInput").msgclass
+    RelationshipKey = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.RelationshipKey").msgclass
+    Kind = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Kind").enummodule
+    Origin = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Origin").enummodule
+  end
+end

data/lib/proto/service_pb.rb

@@ -1,11 +1,13 @@
 # frozen_string_literal: true
-
 # Generated by the protocol buffer compiler.  DO NOT EDIT!
-# source: service.proto
+# source: proto/service.proto
 
 require 'google/protobuf'
 
-descriptor_data = "\n\rservice.proto\x12\x04glaz\"?\n\x0e\x45xplainRequest\x12\x0f\n\x07subject\x18\x01 \x01(\t\x12\x0e\n\x06object\x18\x02 \x01(\t\x12\x0c\n\x04role\x18\x03 \x01(\x05\"2\n\x0f\x45xplainResponse\x12\x0f\n\x07\x61llowed\x18\x01 \x01(\x08\x12\x0e\n\x06reason\x18\x02 \x01(\t\"2\n\x0f\x45valuateRequest\x12\x0f\n\x07subject\x18\x01 \x01(\t\x12\x0e\n\x06object\x18\x02 \x01(\t\"3\n\x10\x45valuateResponse\x12\x0f\n\x07\x61llowed\x18\x01 \x01(\x08\x12\x0e\n\x06reason\x18\x02 \x01(\t\"^\n\x16\x43heckPermissionRequest\x12\x0f\n\x07subject\x18\x01 \x01(\t\x12\x0e\n\x06object\x18\x02 \x01(\t\x12\x12\n\npermission\x18\x03 \x01(\t\x12\x0f\n\x07\x63ontext\x18\x04 \x01(\t\":\n\x17\x43heckPermissionResponse\x12\x0f\n\x07\x61llowed\x18\x01 \x01(\x08\x12\x0e\n\x06reason\x18\x02 \x01(\t2\xd9\x01\n\x14\x41uthorizationService\x12\x36\n\x07\x45xplain\x12\x14.glaz.ExplainRequest\x1a\x15.glaz.ExplainResponse\x12\x39\n\x08\x45valuate\x12\x15.glaz.EvaluateRequest\x1a\x16.glaz.EvaluateResponse\x12N\n\x0f\x43heckPermission\x12\x1c.glaz.CheckPermissionRequest\x1a\x1d.glaz.CheckPermissionResponseb\x06proto3"
+require 'proto/relationships/relationships_pb'
+
+
+descriptor_data = "\n\x13proto/service.proto\x12\x04glaz\x1a\'proto/relationships/relationships.proto\"?\n\x0e\x45xplainRequest\x12\x0f\n\x07subject\x18\x01 \x01(\t\x12\x0e\n\x06object\x18\x02 \x01(\t\x12\x0c\n\x04role\x18\x03 \x01(\x05\"2\n\x0f\x45xplainResponse\x12\x0f\n\x07\x61llowed\x18\x01 \x01(\x08\x12\x0e\n\x06reason\x18\x02 \x01(\t\"2\n\x0f\x45valuateRequest\x12\x0f\n\x07subject\x18\x01 \x01(\t\x12\x0e\n\x06object\x18\x02 \x01(\t\"3\n\x10\x45valuateResponse\x12\x0f\n\x07\x61llowed\x18\x01 \x01(\x08\x12\x0e\n\x06reason\x18\x02 \x01(\t\"\xbe\x01\n\x0c\x43heckRequest\x12,\n\x07subject\x18\x01 \x01(\x0b\x32\x1b.relationships.v1.Principal\x12\x0e\n\x06\x61\x63tion\x18\x02 \x01(\t\x12(\n\x06object\x18\x03 \x01(\x0b\x32\x18.relationships.v1.Object\x12\x35\n\rrelationships\x18\x04 \x03(\x0b\x32\x1e.relationships.v1.Relationship\x12\x0f\n\x07\x63ontext\x18\x05 \x01(\t\"0\n\rCheckResponse\x12\x0f\n\x07\x61llowed\x18\x01 \x01(\x08\x12\x0e\n\x06reason\x18\x02 \x01(\t2\xbb\x01\n\x14\x41uthorizationService\x12\x36\n\x07\x45xplain\x12\x14.glaz.ExplainRequest\x1a\x15.glaz.ExplainResponse\x12\x39\n\x08\x45valuate\x12\x15.glaz.EvaluateRequest\x1a\x16.glaz.EvaluateResponse\x12\x30\n\x05\x43heck\x12\x12.glaz.CheckRequest\x1a\x13.glaz.CheckResponseb\x06proto3"
 
 pool = ::Google::Protobuf::DescriptorPool.generated_pool
 pool.add_serialized_file(descriptor_data)
@@ -15,6 +17,6 @@ module Glaz
   ExplainResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.ExplainResponse").msgclass
   EvaluateRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.EvaluateRequest").msgclass
   EvaluateResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.EvaluateResponse").msgclass
-  CheckPermissionRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.CheckPermissionRequest").msgclass
-  CheckPermissionResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.CheckPermissionResponse").msgclass
+  CheckRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.CheckRequest").msgclass
+  CheckResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.CheckResponse").msgclass
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-glaz
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 1.0.0
 platform: aarch64-linux-gnu
 authors:
 - group::authorization
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-06-02 00:00:00.000000000 Z
+date: 2026-07-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: google-protobuf
@@ -88,6 +88,8 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- Cargo.lock
+- Cargo.toml
 - LICENSE
 - README.md
 - ext/glaz/Cargo.toml
@@ -99,8 +101,10 @@ files:
 - lib/gitlab/glaz/3.3/glaz.so
 - lib/gitlab/glaz/3.4/glaz.so
 - lib/gitlab/glaz/4.0/glaz.so
+- lib/gitlab/glaz/engine.rb
 - lib/gitlab/glaz/loader.rb
 - lib/gitlab/glaz/version.rb
+- lib/proto/relationships/relationships_pb.rb
 - lib/proto/service_pb.rb
 homepage: https://gitlab.com/gitlab-org/ruby/gems/gitlab-glaz
 licenses: