gitlab-glaz 0.0.3-aarch64-linux-gnu → 1.1.0-aarch64-linux-gnu

data/Cargo.toml

@@ -4,11 +4,14 @@ members = ["ext/*"]
 resolver = "2"
 
 [workspace.package]
-version = "0.0.3"
+version = "1.1.0"
 edition = "2024"
 
 # Shared dependencies for all crates
 [workspace.dependencies]
 magnus = { version = "0.8.2", features = ["rb-sys"] }
 rb-sys = "0.9.128"
-glaz-module = { git = "https://gitlab.com/gitlab-org/auth/glaz.git", rev = "e1100ed8d93b3db58627229b7c4e16e29905a3d0" }
+prost = "0.14"
+glaz-module = { git = "https://gitlab.com/gitlab-org/auth/glaz.git", rev = "af9019a186fbb42cede0ad5ba7496aff2f88cb41" }
+glaz-roles = { git = "https://gitlab.com/gitlab-org/auth/glaz.git", rev = "af9019a186fbb42cede0ad5ba7496aff2f88cb41" }
+glaz-proto = { git = "https://gitlab.com/gitlab-org/auth/glaz.git", rev = "af9019a186fbb42cede0ad5ba7496aff2f88cb41" }

data/README.md

@@ -3,68 +3,52 @@
 > [!WARNING]
 > This gem is currently designed entirely for internal use at GitLab.
 
-Ruby bindings for the [Glaz](https://gitlab.com/gitlab-org/auth/glaz) authorization engine. It wraps the Rust-backed `glaz-ruby` crate via [Magnus](https://github.com/matsadler/magnus) FFI, exposing the Glaz `CheckEngine` to Ruby without leaving the Ruby process.
-
-## Requirements
-
-- Ruby >= 3.1
-- Rust toolchain (for building the native extension)
+Ruby bindings for the [Glaz](https://gitlab.com/gitlab-org/auth/glaz) authorization engine. A thin [Magnus](https://github.com/matsadler/magnus) FFI extension exposes the Rust `glaz-module` engine to Ruby, so Cedar policy checks run in-process.
 
 ## Installation
 
-Add to your Gemfile:
+Requires Ruby >= 3.1 and a Rust toolchain. Add to your Gemfile:
 
 ```ruby
 gem 'gitlab-glaz', path: 'gems/gitlab-glaz'
 ```
 
-## Building
-
-The gem contains a Rust extension that must be compiled before use:
-
-```shell
-bundle exec rake compile
-```
-
-This compiles the Rust crate in `ext/glaz/` and places the resulting native library under `lib/glaz/`.
-
 ## Usage
 
 ```ruby
 require 'gitlab-glaz'
 
-# Use the Glaz CheckEngine via the compiled native extension
-```
+engine = Gitlab::Glaz::Engine.new(schema: cedar_schema, policies: cedar_policies)
 
-## Architecture
+engine.check_action(
+  subject_uuid: user_uuid,
+  object_uuid: project_uuid,
+  action: 'read_docs',
+  context: {}
+)
+# => { allowed: true, reason: 'permit_granted' }
 
-| Layer | Technology | Purpose |
-| ------- | ----------- | --------- |
-| Ruby API | `lib/gitlab-glaz.rb` | Entry point, loads the native extension |
-| FFI bridge | [Magnus](https://github.com/matsadler/magnus) + [rb-sys](https://github.com/oxidize-rb/rb-sys) | Bridges Ruby ↔ Rust |
-| Rust extension | `ext/glaz/` | Thin `#[magnus::init]` shim that delegates to `glaz-ruby` |
-| Core engine | [`glaz-ruby`](https://gitlab.com/gitlab-org/auth/glaz) | Rust crate implementing the Glaz authorization engine |
+# Swap the policy set at runtime; the previous set stays active if the
+# new source fails to parse or validate against the schema:
+engine.load_policies(new_cedar_policies)
+```
 
-## Development
+The schema is loaded once at construction and cannot change; build a new engine to use a new schema.
 
-The workspace root [`Cargo.toml`](Cargo.toml) declares all shared Rust dependencies. The extension crate lives in [`ext/glaz/`](ext/glaz/).
+Schemas must declare `User` and `Resource` entities (checks build `User::"<subject_uuid>"` and `Resource::"<object_uuid>"` UIDs), and every action's context type must include `permissions: Set<Action>`, which the engine injects with the checked action.
 
-To build only the Rust extension:
+## Development
 
 ```shell
-cargo build --release
+bundle exec rake compile  # build the native extension (required before rspec)
+bundle exec rspec
 ```
 
-To run the full compile via Rake (used during gem installation):
-
-```shell
-bundle exec rake
-```
+The extension crate lives in [`ext/glaz/`](ext/glaz/); shared Rust dependencies are declared in the root [`Cargo.toml`](Cargo.toml).
 
 ## Releasing a new version
 
-To release a new version, create a merge request and use the `Release` template, following its instructions.
-Once merged, the new version with precompiled, native gems will automatically be published to RubyGems.
+Create a merge request using the `Release` template and follow its instructions. Once merged, precompiled native gems are published to RubyGems automatically.
 
 ## License
 

data/ext/glaz/Cargo.toml

@@ -9,4 +9,7 @@ crate-type = ["cdylib"]
 
 [dependencies]
 glaz-module = { workspace = true }
+glaz-proto = { workspace = true }
+glaz-roles = { workspace = true }
 magnus = { workspace = true }
+prost = { workspace = true }

data/ext/glaz/src/lib.rs

@@ -1,26 +1,49 @@
 use magnus::{Error, Ruby, prelude::*};
+use prost::Message;
 
-#[magnus::wrap(class = "Glaz::Engine::CheckPermission")]
-struct CheckPermission {
+/// Thin 1:1 wrapper around `glaz_module::PermissionCheckEngine`. The engine
+/// starts empty; `load_schema` must be called before `load_policies`, and
+/// `check_action` fails with a RuntimeError until both are loaded.
+#[magnus::wrap(class = "Glaz::PermissionCheckEngine")]
+struct PermissionCheckEngine {
     engine: glaz_module::PermissionCheckEngine,
 }
 
-impl CheckPermission {
+impl PermissionCheckEngine {
     fn initialize(ruby: &Ruby) -> Result<Self, Error> {
-        glaz_module::PermissionCheckEngine::new()
-            .map(|engine| Self { engine })
-            .map_err(|e| Error::new(ruby.exception_runtime_error(), format!("{e}")))
+        let engine = glaz_module::PermissionCheckEngine::new().map_err(|e| map_error(ruby, e))?;
+
+        Ok(Self { engine })
     }
 
-    fn check_permission(
+    /// Load the Cedar schema. Re-loading a schema drops the active policies,
+    /// so callers should load the schema exactly once, before any policies.
+    fn load_schema(ruby: &Ruby, rb_self: &Self, schema: String) -> Result<(), Error> {
+        rb_self
+            .engine
+            .load_schema(&schema)
+            .map_err(|e| map_error(ruby, e))
+    }
+
+    /// Replace the active policy set with the given Cedar policy source,
+    /// validated against the loaded schema. On error the previous policies
+    /// remain active.
+    fn load_policies(ruby: &Ruby, rb_self: &Self, policies: String) -> Result<(), Error> {
+        rb_self
+            .engine
+            .load_policies(&policies)
+            .map_err(|e| map_error(ruby, e))
+    }
+
+    fn check_action(
         ruby: &Ruby,
-        rb_self: &CheckPermission,
+        rb_self: &Self,
         proto_bytes: magnus::RString,
     ) -> Result<magnus::RHash, Error> {
         let bytes = unsafe { proto_bytes.as_slice() };
         let result = rb_self
             .engine
-            .check_permission(bytes)
+            .check(bytes)
             .map_err(|e| map_error(ruby, e))?;
         let hash = ruby.hash_new();
         hash.aset(ruby.sym_new("allowed"), result.allowed)?;
@@ -29,10 +52,93 @@ impl CheckPermission {
     }
 }
 
+/// Thin 1:1 wrapper around `glaz_module::GovernPolicyCheckEngine`, the Rego
+/// governance evaluator. Stateless between calls; both methods take an
+/// encoded `glaz.govern.v1.EvaluateGovernPolicyRequest`. `evaluate` raises
+/// on failure (matching `PermissionCheckEngine`'s convention) and returns
+/// the encoded `EvaluateGovernPolicyResponse` on success — `ArgumentError`
+/// for bad policy/input, `RuntimeError` for an engine-side fault, see
+/// `map_error`; `debug_evaluate` is infallible and carries failures in-band
+/// in its JSON response instead, since it's a raw debugging escape hatch.
+///
+/// Registered as `Glaz::Native::GovernPolicyEngine` (not
+/// `Glaz::GovernPolicyEngine`) specifically to avoid colliding, in name,
+/// with the polished `Gitlab::Glaz::GovernPolicyEngine` wrapper — this
+/// class is raw FFI plumbing; prefer the wrapper unless you specifically
+/// need `debug_evaluate`.
+#[magnus::wrap(class = "Glaz::Native::GovernPolicyEngine")]
+struct GovernPolicyEngine {
+    engine: glaz_module::GovernPolicyCheckEngine,
+}
+
+impl GovernPolicyEngine {
+    fn initialize() -> Self {
+        Self {
+            engine: glaz_module::GovernPolicyCheckEngine::new(),
+        }
+    }
+
+    /// Evaluate using the request's `query` field. `query` must be
+    /// non-blank; a blank query is reported in-band as an error rather than
+    /// falling back to discovery (use `evaluate` for that).
+    fn debug_evaluate(
+        ruby: &Ruby,
+        rb_self: &Self,
+        proto_bytes: magnus::RString,
+    ) -> Result<magnus::RString, Error> {
+        let bytes = unsafe { proto_bytes.as_slice() };
+        let response = rb_self.engine.debug_evaluate(bytes);
+        Ok(ruby.str_from_slice(&response))
+    }
+
+    /// Evaluate by auto-discovering the policy's `violation`, `deny`,
+    /// and/or `allow` rules. The request's `query` field is ignored.
+    ///
+    /// Raises on any evaluation failure rather than returning an in-band
+    /// error, matching `PermissionCheckEngine#check_action`'s convention.
+    /// `map_error` raises `ArgumentError` for malformed protobuf, invalid
+    /// policy, oversized documents, undefined results, or an unrecognized
+    /// result shape - all caller-fixable - and `RuntimeError` for an
+    /// engine-side fault (e.g. the Rego evaluation time budget was
+    /// exceeded), which is not.
+    fn evaluate(
+        ruby: &Ruby,
+        rb_self: &Self,
+        proto_bytes: magnus::RString,
+    ) -> Result<magnus::RString, Error> {
+        let bytes = unsafe { proto_bytes.as_slice() };
+        let response = rb_self
+            .engine
+            .evaluate(bytes)
+            .map_err(|e| map_error(ruby, e))?;
+        Ok(ruby.str_from_slice(&response.encode_to_vec()))
+    }
+}
+
+/// Return the default roles embedded in the extension at build time (parsed
+/// from glaz-roles' roles/**/*.yml) as an array of hashes shaped like
+/// `{ id: String, name: String, permissions: [String, ...] }`.
+fn roles(ruby: &Ruby) -> Result<magnus::RArray, Error> {
+    let array = ruby.ary_new();
+    for role in glaz_roles::default_roles() {
+        let hash = ruby.hash_new();
+        hash.aset(ruby.sym_new("id"), role.id.to_string())?;
+        hash.aset(ruby.sym_new("name"), role.name)?;
+        let permissions = ruby.ary_new();
+        for permission in &role.permissions {
+            permissions.push(permission.as_str())?;
+        }
+        hash.aset(ruby.sym_new("permissions"), permissions)?;
+        array.push(hash)?;
+    }
+    Ok(array)
+}
+
 fn map_error(ruby: &Ruby, e: glaz_module::GlazError) -> Error {
     use glaz_module::GlazError::*;
     match e {
         InvalidArgument(_) => Error::new(ruby.exception_arg_error(), format!("{e}")),
+        NotInitialized(_) => Error::new(ruby.exception_runtime_error(), format!("{e}")),
         Runtime(_) => Error::new(ruby.exception_runtime_error(), format!("{e}")),
     }
 }
@@ -40,12 +146,31 @@ fn map_error(ruby: &Ruby, e: glaz_module::GlazError) -> Error {
 #[magnus::init]
 fn init(ruby: &Ruby) -> Result<(), Error> {
     let glaz = ruby.define_module("Glaz")?;
-    let engine = glaz.define_module("Engine")?;
-    let class = engine.define_class("CheckPermission", ruby.class_object())?;
-    class.define_singleton_method("new", magnus::function!(CheckPermission::initialize, 0))?;
+    glaz.define_singleton_method("roles", magnus::function!(roles, 0))?;
+    let class = glaz.define_class("PermissionCheckEngine", ruby.class_object())?;
+    class.define_singleton_method(
+        "new",
+        magnus::function!(PermissionCheckEngine::initialize, 0),
+    )?;
+    class.define_method(
+        "load_schema",
+        magnus::method!(PermissionCheckEngine::load_schema, 1),
+    )?;
+    class.define_method(
+        "load_policies",
+        magnus::method!(PermissionCheckEngine::load_policies, 1),
+    )?;
     class.define_method(
-        "check_permission",
-        magnus::method!(CheckPermission::check_permission, 1),
+        "check_action",
+        magnus::method!(PermissionCheckEngine::check_action, 1),
+    )?;
+    let native = glaz.define_module("Native")?;
+    let govern = native.define_class("GovernPolicyEngine", ruby.class_object())?;
+    govern.define_singleton_method("new", magnus::function!(GovernPolicyEngine::initialize, 0))?;
+    govern.define_method(
+        "debug_evaluate",
+        magnus::method!(GovernPolicyEngine::debug_evaluate, 1),
     )?;
+    govern.define_method("evaluate", magnus::method!(GovernPolicyEngine::evaluate, 1))?;
     Ok(())
 }

data/lib/gitlab/glaz/engine.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Gitlab
+  module Glaz
+    # Wraps a native Glaz::PermissionCheckEngine instance.
+    #
+    # The Cedar schema is fixed for the lifetime of the engine: it is loaded
+    # exactly once at construction and cannot be re-loaded; build a new Engine
+    # to change it. The policy set can be replaced at any time with
+    # #load_policies.
+    #
+    # Schemas must declare `User` and `Resource` entity types and declare
+    # each checkable action with `appliesTo { principal: [User], resource:
+    # [Resource], ... }`, because the engine builds `User::"<subject_uuid>"` and
+    # `Resource::"<object_uuid>"` entity UIDs for every check. The engine also
+    # injects `permissions` (a Set<Action> containing the checked action)
+    # into the Cedar context, so an action's declared context type must include
+    # `permissions: Set<Action>` alongside any custom attributes.
+    class Engine
+      # @param schema [String] Cedar schema source (`.cedarschema` DSL).
+      # @param policies [String] Cedar policy source, validated against the
+      #   schema; ArgumentError is raised when either does not parse or the
+      #   policies do not validate.
+      def initialize(schema:, policies:)
+        @native = ::Glaz::PermissionCheckEngine.new
+        @native.load_schema(schema)
+        @native.load_policies(policies)
+      end
+
+      # Replace the active policy set with the given Cedar policy source,
+      # validated against the engine's schema. Raises ArgumentError when the
+      # source does not parse or validate; the previous policies then remain
+      # active. The swap is atomic with respect to concurrent checks.
+      def load_policies(source)
+        @native.load_policies(source)
+      end
+
+      # Evaluate whether the subject may perform +action+ on the object.
+      #
+      # @param context [Hash] ABAC attributes made available to policies as the
+      #   Cedar context; must match the context type the schema declares for
+      #   the checked action.
+      # @return [Hash] { allowed: Boolean, reason: String }
+      def check_action(subject_uuid:, object_uuid:, action:, context: {})
+        request = ::Glaz::CheckRequest.encode(
+          ::Glaz::CheckRequest.new(
+            subject: ::Relationships::V1::Principal.new(id: subject_uuid),
+            action: action,
+            object: ::Relationships::V1::Object.new(id: object_uuid),
+            context: context.to_json
+          )
+        )
+
+        @native.check_action(request)
+      end
+    end
+  end
+end

data/lib/gitlab/glaz/govern_policy_engine.rb

@@ -0,0 +1,140 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Gitlab
+  module Glaz
+    # Wraps a native Glaz::Native::GovernPolicyEngine instance - the Rego
+    # governance policy evaluator.
+    #
+    # The evaluator is a pure function over its arguments: it performs no
+    # I/O, holds no state between calls, and executes no actions. The caller
+    # supplies the policy's Rego source and the assembled context document,
+    # and is responsible for executing the returned actions.
+    #
+    # +reasons+ and +actions+ are independent, not 1:1: +reasons+ reports why
+    # the policy matched - one entry per `violation`/`deny` element the
+    # policy produced; empty means it did not match - while +actions+
+    # reports what to enforce as a result. Actions are conceptually owned by
+    # the policy's configuration in the future central Policy Store, so any
+    # match currently yields a single synthesized block action regardless of
+    # how many reasons fired. +matched+ is a convenience boolean mirroring
+    # "+actions+ is non-empty", for callers who don't want to infer that
+    # from array emptiness themselves.
+    #
+    # #evaluate is the primary path: it always auto-discovers the policy's
+    # `violation`/`deny`/`allow` rules (the native +evaluate+ path), returns
+    # the hardened Hash shape described below on success, and raises on any
+    # evaluation failure - the native call itself raises ArgumentError for
+    # bad policy/input and RuntimeError for an engine-side fault; see
+    # #evaluate's own doc comment.
+    # #debug_evaluate is a separate, secondary method for debugging/testing a Rego query
+    # directly: it performs no violation/deny/allow interpretation, does
+    # not raise, and returns whatever the query evaluated to (plus any
+    # error, in-band) with no guarantee about its shape.
+    class GovernPolicyEngine
+      def initialize
+        @native = ::Glaz::Native::GovernPolicyEngine.new
+      end
+
+      # Evaluate a Rego governance policy against context.
+      #
+      # @param policy_rego [String] Rego policy text (max 64 KiB).
+      # @param context [Hash] the host-assembled context, passed to the
+      #   policy as the Rego `input` document (max 1 MiB as JSON).
+      # @param data [Hash] optional precomputed Rego `data` document (e.g.
+      #   cached settings or scan results). Top-level keys must not collide
+      #   with the policy's package path.
+      # @raise [ArgumentError] for a caller-fixable evaluation failure -
+      #   malformed policy, oversized documents, an unrecognized
+      #   violation/deny/allow shape, and so on.
+      # @raise [RuntimeError] for an engine-side fault, e.g. the Rego
+      #   evaluation time budget was exceeded - not the caller's fault.
+      #   Callers can rely on a successful return meaning the policy
+      #   evaluated cleanly; there is no in-band error to check.
+      # @return [Hash] `{ matched: Boolean, actions: Array<Hash>, reasons:
+      #   Array<Hash> }`. `matched` is `true` exactly when `actions`
+      #   (equivalently `reasons`) is non-empty - a convenience so callers
+      #   don't have to infer "did the policy fire" from array emptiness.
+      #   It is not itself an allow/deny decision: today every action is
+      #   `"block"`, so `matched` and "should deny" coincide, but a future
+      #   Policy Store action type (e.g. `"log"`) could match without
+      #   implying denial - check `actions` for enforcement decisions. Each
+      #   action is `{ action_type: String, message: String | nil, params:
+      #   Hash }`; each reason is `{ message: String | nil, details: Hash
+      #   }`. Empty +actions+ means the policy allows the operation.
+      def evaluate(policy_rego:, context:, data: {})
+        encoded = ::Glaz::Govern::V1::EvaluateGovernPolicyRequest.encode(
+          ::Glaz::Govern::V1::EvaluateGovernPolicyRequest.new(
+            policy_rego: policy_rego,
+            input_json: context.to_json,
+            data_json: data.nil? || data.empty? ? "" : data.to_json
+          )
+        )
+
+        response = ::Glaz::Govern::V1::EvaluateGovernPolicyResponse.decode(
+          @native.evaluate(encoded)
+        )
+
+        {
+          matched: response.matched,
+          reasons: response.reasons.map { |reason| reason_hash(reason) },
+          actions: response.actions.map { |action| action_hash(action) }
+        }
+      end
+
+      # Evaluate a Rego query directly, with no `violation`/`deny`/`allow`
+      # interpretation. A debugging/testing escape hatch for exercising a
+      # policy's Rego directly; prefer #evaluate for the primary path.
+      # Unlike #evaluate, this does not raise on failure - +error+ stays
+      # in-band, since this method is meant for inspecting raw results
+      # (including failures) while developing a policy, not for production
+      # decision-making.
+      #
+      # @param policy_rego [String] Rego policy text (max 64 KiB).
+      # @param context [Hash] the host-assembled context, passed to the
+      #   policy as the Rego `input` document (max 1 MiB as JSON).
+      # @param query [String] Rego query to evaluate (e.g.
+      #   "data.mypackage.violation"); must not be blank.
+      # @param data [Hash] optional precomputed Rego `data` document.
+      # @return [Hash] `{ result: Object, error: String | nil }` - `result`
+      #   is exactly whatever `query` evaluated to (parsed JSON), with no
+      #   guarantee about its shape. A non-nil `error` means evaluation
+      #   failed; `result` is then `nil`.
+      def debug_evaluate(policy_rego:, context:, query:, data: {})
+        encoded = ::Glaz::Govern::V1::EvaluateGovernPolicyDebugRequest.encode(
+          ::Glaz::Govern::V1::EvaluateGovernPolicyDebugRequest.new(
+            policy_rego: policy_rego,
+            query: query.to_s,
+            input_json: context.to_json,
+            data_json: data.nil? || data.empty? ? "" : data.to_json
+          )
+        )
+
+        response = JSON.parse(@native.debug_evaluate(encoded), symbolize_names: true)
+
+        {
+          result: response[:result],
+          error: response[:error].nil? || response[:error].empty? ? nil : response[:error]
+        }
+      end
+
+      private
+
+      def action_hash(action)
+        {
+          action_type: action.action_type,
+          message: action.message.empty? ? nil : action.message,
+          params: JSON.parse(action.params_json)
+        }
+      end
+
+      def reason_hash(reason)
+        {
+          message: reason.message.empty? ? nil : reason.message,
+          details: JSON.parse(reason.details_json)
+        }
+      end
+    end
+  end
+end

data/lib/gitlab/glaz/version.rb

@@ -2,6 +2,6 @@
 
 module Gitlab
   module Glaz
-    VERSION = "0.0.3"
+    VERSION = "1.1.0"
   end
 end

data/lib/gitlab/glaz.rb

@@ -3,24 +3,33 @@
 require_relative "glaz/version"
 require_relative 'glaz/loader'
 require "proto/service_pb"
+require "proto/govern_pb"
 
 load_rust_extension
 
+require_relative "glaz/engine"
+require_relative "glaz/govern_policy_engine"
+
 module Gitlab
   module Glaz
     module_function
 
-    def check_permission(subject_uuid:, object_uuid:, permission:, context: {})
-      request = ::Glaz::CheckPermissionRequest.encode(
-        ::Glaz::CheckPermissionRequest.new(
-          subject: subject_uuid,
-          object: object_uuid,
-          permission: permission,
-          context: context.to_json
-        )
-      )
+    # Returns the default roles embedded in the native extension at build time,
+    # sourced from the glaz-roles crate's roles/**/*.yml definitions. Each entry
+    # is a hash: { id: String, name: String, permissions: Array<String> }.
+    def roles
+      @roles ||= ::Glaz.roles.each do |role|
+        role[:permissions].freeze
+        role.freeze
+      end.freeze
+    end
 
-      ::Glaz::Engine::CheckPermission.new.check_permission(request)
+    # Returns the shared Gitlab::Glaz::GovernPolicyEngine instance, memoized
+    # across calls. Evaluate Rego governance policies via
+    # +govern_policy_engine.evaluate+; see GovernPolicyEngine#evaluate for
+    # the full contract.
+    def govern_policy_engine
+      @govern_policy_engine ||= GovernPolicyEngine.new
     end
   end
 end

data/lib/proto/govern_pb.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: proto/govern.proto
+
+require 'google/protobuf'
+
+
+descriptor_data = "\n\x12proto/govern.proto\x12\x0eglaz.govern.v1\"Y\n\x1b\x45valuateGovernPolicyRequest\x12\x13\n\x0bpolicy_rego\x18\x01 \x01(\t\x12\x12\n\ninput_json\x18\x02 \x01(\t\x12\x11\n\tdata_json\x18\x03 \x01(\t\"m\n EvaluateGovernPolicyDebugRequest\x12\x13\n\x0bpolicy_rego\x18\x01 \x01(\t\x12\r\n\x05query\x18\x02 \x01(\t\x12\x12\n\ninput_json\x18\x03 \x01(\t\x12\x11\n\tdata_json\x18\x04 \x01(\t\"I\n\x0cGovernAction\x12\x13\n\x0b\x61\x63tion_type\x18\x01 \x01(\t\x12\x0f\n\x07message\x18\x02 \x01(\t\x12\x13\n\x0bparams_json\x18\x03 \x01(\t\"5\n\x0cGovernReason\x12\x0f\n\x07message\x18\x01 \x01(\t\x12\x14\n\x0c\x64\x65tails_json\x18\x02 \x01(\t\"\x8d\x01\n\x1c\x45valuateGovernPolicyResponse\x12-\n\x07\x61\x63tions\x18\x01 \x03(\x0b\x32\x1c.glaz.govern.v1.GovernAction\x12-\n\x07reasons\x18\x02 \x03(\x0b\x32\x1c.glaz.govern.v1.GovernReason\x12\x0f\n\x07matched\x18\x03 \x01(\x08\x62\x06proto3"
+
+pool = ::Google::Protobuf::DescriptorPool.generated_pool
+pool.add_serialized_file(descriptor_data)
+
+module Glaz
+  module Govern
+    module V1
+      EvaluateGovernPolicyRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.EvaluateGovernPolicyRequest").msgclass
+      EvaluateGovernPolicyDebugRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.EvaluateGovernPolicyDebugRequest").msgclass
+      GovernAction = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.GovernAction").msgclass
+      GovernReason = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.GovernReason").msgclass
+      EvaluateGovernPolicyResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.EvaluateGovernPolicyResponse").msgclass
+    end
+  end
+end

data/lib/proto/relationships/relationships_pb.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: proto/relationships/relationships.proto
+
+require 'google/protobuf'
+
+require 'google/protobuf/timestamp_pb'
+
+
+descriptor_data = "\n\'proto/relationships/relationships.proto\x12\x10relationships.v1\x1a\x1fgoogle/protobuf/timestamp.proto\"\x14\n\x06Object\x12\n\n\x02id\x18\x01 \x01(\t\"\x17\n\tPrincipal\x12\n\n\x02id\x18\x01 \x01(\t\"\x12\n\x04Role\x12\n\n\x02id\x18\x01 \x01(\t\"Y\n\x08Identity\x12(\n\x06origin\x18\x01 \x01(\x0e\x32\x18.relationships.v1.Origin\x12\x11\n\torigin_id\x18\x02 \x01(\t\x12\x10\n\x08local_id\x18\x03 \x01(\t\"q\n\x07Subject\x12.\n\x08identity\x18\x01 \x01(\x0b\x32\x1a.relationships.v1.IdentityH\x00\x12\x30\n\tprincipal\x18\x02 \x01(\x0b\x32\x1b.relationships.v1.PrincipalH\x00\x42\x04\n\x02id\"\xdf\x01\n\x0cRelationship\x12*\n\x07subject\x18\x01 \x01(\x0b\x32\x19.relationships.v1.Subject\x12(\n\x06object\x18\x02 \x01(\x0b\x32\x18.relationships.v1.Object\x12$\n\x04kind\x18\x03 \x01(\x0e\x32\x16.relationships.v1.Kind\x12$\n\x04role\x18\x04 \x01(\x0b\x32\x16.relationships.v1.Role\x12-\n\ttimestamp\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xb5\x01\n\x11RelationshipInput\x12*\n\x07subject\x18\x01 \x01(\x0b\x32\x19.relationships.v1.Subject\x12(\n\x06object\x18\x02 \x01(\x0b\x32\x18.relationships.v1.Object\x12$\n\x04kind\x18\x03 \x01(\x0e\x32\x16.relationships.v1.Kind\x12$\n\x04role\x18\x04 \x01(\x0b\x32\x16.relationships.v1.Role\"\x8d\x01\n\x0fRelationshipKey\x12*\n\x07subject\x18\x01 \x01(\x0b\x32\x19.relationships.v1.Subject\x12(\n\x06object\x18\x02 \x01(\x0b\x32\x18.relationships.v1.Object\x12$\n\x04kind\x18\x03 \x01(\x0e\x32\x16.relationships.v1.Kind*1\n\x04Kind\x12\x14\n\x10KIND_UNSPECIFIED\x10\x00\x12\x13\n\x0fKIND_ASSIGNMENT\x10\x01*N\n\x06Origin\x12\x16\n\x12ORIGIN_UNSPECIFIED\x10\x00\x12\x0f\n\x0bORIGIN_SELF\x10\x01\x12\x1b\n\x17ORIGIN_GITLAB_FEDERATED\x10\x02\x42\x34Z2gitlab.com/gitlab-org/auth/iam/proto/relationshipsb\x06proto3"
+
+pool = ::Google::Protobuf::DescriptorPool.generated_pool
+pool.add_serialized_file(descriptor_data)
+
+module Relationships
+  module V1
+    Object = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Object").msgclass
+    Principal = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Principal").msgclass
+    Role = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Role").msgclass
+    Identity = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Identity").msgclass
+    Subject = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Subject").msgclass
+    Relationship = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Relationship").msgclass
+    RelationshipInput = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.RelationshipInput").msgclass
+    RelationshipKey = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.RelationshipKey").msgclass
+    Kind = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Kind").enummodule
+    Origin = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Origin").enummodule
+  end
+end