gitlab-glaz 0.0.3-x86_64-linux-gnu → 1.0.0-x86_64-linux-gnu

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6fe05b2e696ed9f97735807520cf2603ca73f9d8ec916830673dca78989245e5
-  data.tar.gz: 4bcc357bab65524bd9e498540bcbb1c7e34bf1470573fb3b20a1ed84c95fbad9
+  metadata.gz: dfcae08928853d5919f115175a543775243e32ff7e37a46e2ac0ddb1d6bd1795
+  data.tar.gz: 1632f9fcfa5cd0334e3686b5b61dcb808b080545cceeb6986f47fcd8ad903fec
 SHA512:
-  metadata.gz: bd87e4f8e02706c8b0b75b9057650218ac65e06dd0512ff881a7f7d8772b633061069f5769d1ecec03312b72468060df3a2124b44c978ec48fcdcf2bdf7d4fbd
-  data.tar.gz: cd81e1212e718df87d768aa804547ac7fdc3685cb900a71a0a187e88a703f729ac21b22e5e6c4f12ecd99b229e61094a0b163bfbdc85d45ba1948e09541e2bdb
+  metadata.gz: 7ebe80491b18e91888fa8c4264dd38b51dba991b526161c7d615539d6bf65ae67414add414d09f910fdddeee4bec5100beaa0d5ac1075a04bef2af3dffb8de1b
+  data.tar.gz: ba98dd5097bf70272893f203665095f3590e5913fe65139be3f293c2e7b7fe0c6a2267f45aaa0424ac9496df88a8958b5d9d5604b11090b387aa2f4e5f724d67

data/Cargo.lock

@@ -244,10 +244,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
 dependencies = [
  "iana-time-zone",
- "js-sys",
  "num-traits",
  "serde",
- "wasm-bindgen",
  "windows-link",
 ]
 
@@ -465,47 +463,21 @@ dependencies = [
 
 [[package]]
 name = "glaz"
-version = "0.0.3"
+version = "1.0.0"
 dependencies = [
  "glaz-module",
- "magnus",
-]
-
-[[package]]
-name = "glaz-engine"
-version = "0.1.0"
-source = "git+https://gitlab.com/gitlab-org/auth/glaz.git?rev=e1100ed8d93b3db58627229b7c4e16e29905a3d0#e1100ed8d93b3db58627229b7c4e16e29905a3d0"
-dependencies = [
- "async-trait",
- "glaz-graph",
- "glaz-policy",
  "glaz-roles",
- "glaz-storage",
- "serde_json",
-]
-
-[[package]]
-name = "glaz-graph"
-version = "0.1.0"
-source = "git+https://gitlab.com/gitlab-org/auth/glaz.git?rev=e1100ed8d93b3db58627229b7c4e16e29905a3d0#e1100ed8d93b3db58627229b7c4e16e29905a3d0"
-dependencies = [
- "anyhow",
- "glaz-storage",
- "uuid",
+ "magnus",
 ]
 
 [[package]]
 name = "glaz-module"
 version = "0.1.0"
-source = "git+https://gitlab.com/gitlab-org/auth/glaz.git?rev=e1100ed8d93b3db58627229b7c4e16e29905a3d0#e1100ed8d93b3db58627229b7c4e16e29905a3d0"
+source = "git+https://gitlab.com/gitlab-org/auth/glaz.git?rev=13a32ad3f0e6490384afb6ba6a3c3e2a6439901a#13a32ad3f0e6490384afb6ba6a3c3e2a6439901a"
 dependencies = [
- "glaz-engine",
  "glaz-policy",
  "glaz-proto",
- "glaz-roles",
- "glaz-storage",
  "prost",
- "serde_json",
  "thiserror",
  "tokio",
  "uuid",
@@ -514,12 +486,11 @@ dependencies = [
 [[package]]
 name = "glaz-policy"
 version = "0.1.0"
-source = "git+https://gitlab.com/gitlab-org/auth/glaz.git?rev=e1100ed8d93b3db58627229b7c4e16e29905a3d0#e1100ed8d93b3db58627229b7c4e16e29905a3d0"
+source = "git+https://gitlab.com/gitlab-org/auth/glaz.git?rev=13a32ad3f0e6490384afb6ba6a3c3e2a6439901a#13a32ad3f0e6490384afb6ba6a3c3e2a6439901a"
 dependencies = [
  "async-trait",
  "cedar-policy",
- "glaz-roles",
- "glaz-storage",
+ "glaz-proto",
  "serde_json",
  "thiserror",
 ]
@@ -527,28 +498,21 @@ dependencies = [
 [[package]]
 name = "glaz-proto"
 version = "0.1.0"
-source = "git+https://gitlab.com/gitlab-org/auth/glaz.git?rev=e1100ed8d93b3db58627229b7c4e16e29905a3d0#e1100ed8d93b3db58627229b7c4e16e29905a3d0"
+source = "git+https://gitlab.com/gitlab-org/auth/glaz.git?rev=13a32ad3f0e6490384afb6ba6a3c3e2a6439901a#13a32ad3f0e6490384afb6ba6a3c3e2a6439901a"
 dependencies = [
  "prost",
  "prost-build",
+ "prost-types",
  "protoc-bin-vendored",
 ]
 
 [[package]]
 name = "glaz-roles"
 version = "0.1.0"
-source = "git+https://gitlab.com/gitlab-org/auth/glaz.git?rev=e1100ed8d93b3db58627229b7c4e16e29905a3d0#e1100ed8d93b3db58627229b7c4e16e29905a3d0"
-
-[[package]]
-name = "glaz-storage"
-version = "0.1.0"
-source = "git+https://gitlab.com/gitlab-org/auth/glaz.git?rev=e1100ed8d93b3db58627229b7c4e16e29905a3d0#e1100ed8d93b3db58627229b7c4e16e29905a3d0"
+source = "git+https://gitlab.com/gitlab-org/auth/glaz.git?rev=13a32ad3f0e6490384afb6ba6a3c3e2a6439901a#13a32ad3f0e6490384afb6ba6a3c3e2a6439901a"
 dependencies = [
- "async-trait",
- "chrono",
- "glaz-roles",
  "serde",
- "serde_json",
+ "serde_yaml",
  "thiserror",
  "uuid",
 ]
@@ -705,7 +669,7 @@ dependencies = [
  "ena",
  "itertools 0.14.0",
  "lalrpop-util",
- "petgraph",
+ "petgraph 0.7.1",
  "pico-args",
  "regex",
  "regex-syntax",
@@ -988,6 +952,17 @@ dependencies = [
  "indexmap 2.13.1",
 ]
 
+[[package]]
+name = "petgraph"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
+dependencies = [
+ "fixedbitset",
+ "hashbrown 0.15.5",
+ "indexmap 2.13.1",
+]
+
 [[package]]
 name = "phf_shared"
 version = "0.11.3"
@@ -1053,9 +1028,9 @@ dependencies = [
 
 [[package]]
 name = "prost"
-version = "0.13.5"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2796faa41db3ec313a31f7624d9286acf277b52de526150b7e69f3debf891ee5"
+checksum = "528ac67416ff8646872a3c02cad9cc4ee5dc9f9540c9b10771855c95cb2e5ae1"
 dependencies = [
  "bytes",
  "prost-derive",
@@ -1063,16 +1038,15 @@ dependencies = [
 
 [[package]]
 name = "prost-build"
-version = "0.13.5"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
+checksum = "03da047801ff44bb6a4d407d4860c05fd70bb81714e6b2f3812603d5b145b042"
 dependencies = [
  "heck",
- "itertools 0.14.0",
+ "itertools 0.13.0",
  "log",
  "multimap",
- "once_cell",
- "petgraph",
+ "petgraph 0.8.3",
  "prettyplease",
  "prost",
  "prost-types",
@@ -1083,12 +1057,12 @@ dependencies = [
 
 [[package]]
 name = "prost-derive"
-version = "0.13.5"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
+checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
 dependencies = [
  "anyhow",
- "itertools 0.14.0",
+ "itertools 0.13.0",
  "proc-macro2",
  "quote",
  "syn",
@@ -1096,9 +1070,9 @@ dependencies = [
 
 [[package]]
 name = "prost-types"
-version = "0.13.5"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52c2c1bf36ddb1a1c396b3601a3cec27c2462e45f07c386894ec3ccf5332bd16"
+checksum = "f94967dc7688f3054c7fac87473ffae4cc4c3904800e2d9f5b857246d8963b0a"
 dependencies = [
  "prost",
 ]
@@ -1311,6 +1285,12 @@ version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
 [[package]]
 name = "same-file"
 version = "1.0.6"
@@ -1437,6 +1417,19 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "serde_yaml"
+version = "0.9.34+deprecated"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
+dependencies = [
+ "indexmap 2.13.1",
+ "itoa",
+ "ryu",
+ "serde",
+ "unsafe-libyaml",
+]
+
 [[package]]
 name = "sha3"
 version = "0.10.8"
@@ -1550,7 +1543,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom",
  "once_cell",
  "rustix",
  "windows-sys 0.61.2",
@@ -1720,6 +1712,12 @@ version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
 
+[[package]]
+name = "unsafe-libyaml"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
+
 [[package]]
 name = "uuid"
 version = "1.23.0"

data/Cargo.toml

@@ -4,11 +4,12 @@ members = ["ext/*"]
 resolver = "2"
 
 [workspace.package]
-version = "0.0.3"
+version = "1.0.0"
 edition = "2024"
 
 # Shared dependencies for all crates
 [workspace.dependencies]
 magnus = { version = "0.8.2", features = ["rb-sys"] }
 rb-sys = "0.9.128"
-glaz-module = { git = "https://gitlab.com/gitlab-org/auth/glaz.git", rev = "e1100ed8d93b3db58627229b7c4e16e29905a3d0" }
+glaz-module = { git = "https://gitlab.com/gitlab-org/auth/glaz.git", rev = "13a32ad3f0e6490384afb6ba6a3c3e2a6439901a" }
+glaz-roles = { git = "https://gitlab.com/gitlab-org/auth/glaz.git", rev = "13a32ad3f0e6490384afb6ba6a3c3e2a6439901a" }

data/README.md

@@ -3,68 +3,52 @@
 > [!WARNING]
 > This gem is currently designed entirely for internal use at GitLab.
 
-Ruby bindings for the [Glaz](https://gitlab.com/gitlab-org/auth/glaz) authorization engine. It wraps the Rust-backed `glaz-ruby` crate via [Magnus](https://github.com/matsadler/magnus) FFI, exposing the Glaz `CheckEngine` to Ruby without leaving the Ruby process.
-
-## Requirements
-
-- Ruby >= 3.1
-- Rust toolchain (for building the native extension)
+Ruby bindings for the [Glaz](https://gitlab.com/gitlab-org/auth/glaz) authorization engine. A thin [Magnus](https://github.com/matsadler/magnus) FFI extension exposes the Rust `glaz-module` engine to Ruby, so Cedar policy checks run in-process.
 
 ## Installation
 
-Add to your Gemfile:
+Requires Ruby >= 3.1 and a Rust toolchain. Add to your Gemfile:
 
 ```ruby
 gem 'gitlab-glaz', path: 'gems/gitlab-glaz'
 ```
 
-## Building
-
-The gem contains a Rust extension that must be compiled before use:
-
-```shell
-bundle exec rake compile
-```
-
-This compiles the Rust crate in `ext/glaz/` and places the resulting native library under `lib/glaz/`.
-
 ## Usage
 
 ```ruby
 require 'gitlab-glaz'
 
-# Use the Glaz CheckEngine via the compiled native extension
-```
+engine = Gitlab::Glaz::Engine.new(schema: cedar_schema, policies: cedar_policies)
 
-## Architecture
+engine.check_action(
+  subject_uuid: user_uuid,
+  object_uuid: project_uuid,
+  action: 'read_docs',
+  context: {}
+)
+# => { allowed: true, reason: 'permit_granted' }
 
-| Layer | Technology | Purpose |
-| ------- | ----------- | --------- |
-| Ruby API | `lib/gitlab-glaz.rb` | Entry point, loads the native extension |
-| FFI bridge | [Magnus](https://github.com/matsadler/magnus) + [rb-sys](https://github.com/oxidize-rb/rb-sys) | Bridges Ruby ↔ Rust |
-| Rust extension | `ext/glaz/` | Thin `#[magnus::init]` shim that delegates to `glaz-ruby` |
-| Core engine | [`glaz-ruby`](https://gitlab.com/gitlab-org/auth/glaz) | Rust crate implementing the Glaz authorization engine |
+# Swap the policy set at runtime; the previous set stays active if the
+# new source fails to parse or validate against the schema:
+engine.load_policies(new_cedar_policies)
+```
 
-## Development
+The schema is loaded once at construction and cannot change; build a new engine to use a new schema.
 
-The workspace root [`Cargo.toml`](Cargo.toml) declares all shared Rust dependencies. The extension crate lives in [`ext/glaz/`](ext/glaz/).
+Schemas must declare `User` and `Resource` entities (checks build `User::"<subject_uuid>"` and `Resource::"<object_uuid>"` UIDs), and every action's context type must include `user_permissions: Set<Action>`, which the engine injects with the checked action.
 
-To build only the Rust extension:
+## Development
 
 ```shell
-cargo build --release
+bundle exec rake compile  # build the native extension (required before rspec)
+bundle exec rspec
 ```
 
-To run the full compile via Rake (used during gem installation):
-
-```shell
-bundle exec rake
-```
+The extension crate lives in [`ext/glaz/`](ext/glaz/); shared Rust dependencies are declared in the root [`Cargo.toml`](Cargo.toml).
 
 ## Releasing a new version
 
-To release a new version, create a merge request and use the `Release` template, following its instructions.
-Once merged, the new version with precompiled, native gems will automatically be published to RubyGems.
+Create a merge request using the `Release` template and follow its instructions. Once merged, precompiled native gems are published to RubyGems automatically.
 
 ## License
 

data/ext/glaz/Cargo.toml

@@ -9,4 +9,5 @@ crate-type = ["cdylib"]
 
 [dependencies]
 glaz-module = { workspace = true }
+glaz-roles = { workspace = true }
 magnus = { workspace = true }

data/ext/glaz/src/lib.rs

@@ -1,26 +1,48 @@
 use magnus::{Error, Ruby, prelude::*};
 
-#[magnus::wrap(class = "Glaz::Engine::CheckPermission")]
-struct CheckPermission {
+/// Thin 1:1 wrapper around `glaz_module::PermissionCheckEngine`. The engine
+/// starts empty; `load_schema` must be called before `load_policies`, and
+/// `check_action` fails with a RuntimeError until both are loaded.
+#[magnus::wrap(class = "Glaz::PermissionCheckEngine")]
+struct PermissionCheckEngine {
     engine: glaz_module::PermissionCheckEngine,
 }
 
-impl CheckPermission {
+impl PermissionCheckEngine {
     fn initialize(ruby: &Ruby) -> Result<Self, Error> {
-        glaz_module::PermissionCheckEngine::new()
-            .map(|engine| Self { engine })
-            .map_err(|e| Error::new(ruby.exception_runtime_error(), format!("{e}")))
+        let engine = glaz_module::PermissionCheckEngine::new().map_err(|e| map_error(ruby, e))?;
+
+        Ok(Self { engine })
+    }
+
+    /// Load the Cedar schema. Re-loading a schema drops the active policies,
+    /// so callers should load the schema exactly once, before any policies.
+    fn load_schema(ruby: &Ruby, rb_self: &Self, schema: String) -> Result<(), Error> {
+        rb_self
+            .engine
+            .load_schema(&schema)
+            .map_err(|e| map_error(ruby, e))
     }
 
-    fn check_permission(
+    /// Replace the active policy set with the given Cedar policy source,
+    /// validated against the loaded schema. On error the previous policies
+    /// remain active.
+    fn load_policies(ruby: &Ruby, rb_self: &Self, policies: String) -> Result<(), Error> {
+        rb_self
+            .engine
+            .load_policies(&policies)
+            .map_err(|e| map_error(ruby, e))
+    }
+
+    fn check_action(
         ruby: &Ruby,
-        rb_self: &CheckPermission,
+        rb_self: &Self,
         proto_bytes: magnus::RString,
     ) -> Result<magnus::RHash, Error> {
         let bytes = unsafe { proto_bytes.as_slice() };
         let result = rb_self
             .engine
-            .check_permission(bytes)
+            .check(bytes)
             .map_err(|e| map_error(ruby, e))?;
         let hash = ruby.hash_new();
         hash.aset(ruby.sym_new("allowed"), result.allowed)?;
@@ -29,10 +51,30 @@ impl CheckPermission {
     }
 }
 
+/// Return the default roles embedded in the extension at build time (parsed
+/// from glaz-roles' roles/**/*.yml) as an array of hashes shaped like
+/// `{ id: String, name: String, permissions: [String, ...] }`.
+fn roles(ruby: &Ruby) -> Result<magnus::RArray, Error> {
+    let array = ruby.ary_new();
+    for role in glaz_roles::default_roles() {
+        let hash = ruby.hash_new();
+        hash.aset(ruby.sym_new("id"), role.id.to_string())?;
+        hash.aset(ruby.sym_new("name"), role.name)?;
+        let permissions = ruby.ary_new();
+        for permission in &role.permissions {
+            permissions.push(permission.as_str())?;
+        }
+        hash.aset(ruby.sym_new("permissions"), permissions)?;
+        array.push(hash)?;
+    }
+    Ok(array)
+}
+
 fn map_error(ruby: &Ruby, e: glaz_module::GlazError) -> Error {
     use glaz_module::GlazError::*;
     match e {
         InvalidArgument(_) => Error::new(ruby.exception_arg_error(), format!("{e}")),
+        NotInitialized(_) => Error::new(ruby.exception_runtime_error(), format!("{e}")),
         Runtime(_) => Error::new(ruby.exception_runtime_error(), format!("{e}")),
     }
 }
@@ -40,12 +82,23 @@ fn map_error(ruby: &Ruby, e: glaz_module::GlazError) -> Error {
 #[magnus::init]
 fn init(ruby: &Ruby) -> Result<(), Error> {
     let glaz = ruby.define_module("Glaz")?;
-    let engine = glaz.define_module("Engine")?;
-    let class = engine.define_class("CheckPermission", ruby.class_object())?;
-    class.define_singleton_method("new", magnus::function!(CheckPermission::initialize, 0))?;
+    glaz.define_singleton_method("roles", magnus::function!(roles, 0))?;
+    let class = glaz.define_class("PermissionCheckEngine", ruby.class_object())?;
+    class.define_singleton_method(
+        "new",
+        magnus::function!(PermissionCheckEngine::initialize, 0),
+    )?;
+    class.define_method(
+        "load_schema",
+        magnus::method!(PermissionCheckEngine::load_schema, 1),
+    )?;
+    class.define_method(
+        "load_policies",
+        magnus::method!(PermissionCheckEngine::load_policies, 1),
+    )?;
     class.define_method(
-        "check_permission",
-        magnus::method!(CheckPermission::check_permission, 1),
+        "check_action",
+        magnus::method!(PermissionCheckEngine::check_action, 1),
     )?;
     Ok(())
 }

data/lib/gitlab/glaz/engine.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Gitlab
+  module Glaz
+    # Wraps a native Glaz::PermissionCheckEngine instance.
+    #
+    # The Cedar schema is fixed for the lifetime of the engine: it is loaded
+    # exactly once at construction and cannot be re-loaded; build a new Engine
+    # to change it. The policy set can be replaced at any time with
+    # #load_policies.
+    #
+    # Schemas must declare `User` and `Resource` entity types and declare
+    # each checkable action with `appliesTo { principal: [User], resource:
+    # [Resource], ... }`, because the engine builds `User::"<subject_uuid>"` and
+    # `Resource::"<object_uuid>"` entity UIDs for every check. The engine also
+    # injects `user_permissions` (a Set<Action> containing the checked action)
+    # into the Cedar context, so an action's declared context type must include
+    # `user_permissions: Set<Action>` alongside any custom attributes.
+    class Engine
+      # @param schema [String] Cedar schema source (`.cedarschema` DSL).
+      # @param policies [String] Cedar policy source, validated against the
+      #   schema; ArgumentError is raised when either does not parse or the
+      #   policies do not validate.
+      def initialize(schema:, policies:)
+        @native = ::Glaz::PermissionCheckEngine.new
+        @native.load_schema(schema)
+        @native.load_policies(policies)
+      end
+
+      # Replace the active policy set with the given Cedar policy source,
+      # validated against the engine's schema. Raises ArgumentError when the
+      # source does not parse or validate; the previous policies then remain
+      # active. The swap is atomic with respect to concurrent checks.
+      def load_policies(source)
+        @native.load_policies(source)
+      end
+
+      # Evaluate whether the subject may perform +action+ on the object.
+      #
+      # @param context [Hash] ABAC attributes made available to policies as the
+      #   Cedar context; must match the context type the schema declares for
+      #   the checked action.
+      # @return [Hash] { allowed: Boolean, reason: String }
+      def check_action(subject_uuid:, object_uuid:, action:, context: {})
+        request = ::Glaz::CheckRequest.encode(
+          ::Glaz::CheckRequest.new(
+            subject: ::Relationships::V1::Principal.new(id: subject_uuid),
+            action: action,
+            object: ::Relationships::V1::Object.new(id: object_uuid),
+            context: context.to_json
+          )
+        )
+
+        @native.check_action(request)
+      end
+    end
+  end
+end

data/lib/gitlab/glaz/version.rb

@@ -2,6 +2,6 @@
 
 module Gitlab
   module Glaz
-    VERSION = "0.0.3"
+    VERSION = "1.0.0"
   end
 end

data/lib/gitlab/glaz.rb

@@ -6,21 +6,20 @@ require "proto/service_pb"
 
 load_rust_extension
 
+require_relative "glaz/engine"
+
 module Gitlab
   module Glaz
     module_function
 
-    def check_permission(subject_uuid:, object_uuid:, permission:, context: {})
-      request = ::Glaz::CheckPermissionRequest.encode(
-        ::Glaz::CheckPermissionRequest.new(
-          subject: subject_uuid,
-          object: object_uuid,
-          permission: permission,
-          context: context.to_json
-        )
-      )
-
-      ::Glaz::Engine::CheckPermission.new.check_permission(request)
+    # Returns the default roles embedded in the native extension at build time,
+    # sourced from the glaz-roles crate's roles/**/*.yml definitions. Each entry
+    # is a hash: { id: String, name: String, permissions: Array<String> }.
+    def roles
+      @roles ||= ::Glaz.roles.each do |role|
+        role[:permissions].freeze
+        role.freeze
+      end.freeze
     end
   end
 end

data/lib/proto/relationships/relationships_pb.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: proto/relationships/relationships.proto
+
+require 'google/protobuf'
+
+require 'google/protobuf/timestamp_pb'
+
+
+descriptor_data = "\n\'proto/relationships/relationships.proto\x12\x10relationships.v1\x1a\x1fgoogle/protobuf/timestamp.proto\"\x14\n\x06Object\x12\n\n\x02id\x18\x01 \x01(\t\"\x17\n\tPrincipal\x12\n\n\x02id\x18\x01 \x01(\t\"\x12\n\x04Role\x12\n\n\x02id\x18\x01 \x01(\t\"Y\n\x08Identity\x12(\n\x06origin\x18\x01 \x01(\x0e\x32\x18.relationships.v1.Origin\x12\x11\n\torigin_id\x18\x02 \x01(\t\x12\x10\n\x08local_id\x18\x03 \x01(\t\"q\n\x07Subject\x12.\n\x08identity\x18\x01 \x01(\x0b\x32\x1a.relationships.v1.IdentityH\x00\x12\x30\n\tprincipal\x18\x02 \x01(\x0b\x32\x1b.relationships.v1.PrincipalH\x00\x42\x04\n\x02id\"\xdf\x01\n\x0cRelationship\x12*\n\x07subject\x18\x01 \x01(\x0b\x32\x19.relationships.v1.Subject\x12(\n\x06object\x18\x02 \x01(\x0b\x32\x18.relationships.v1.Object\x12$\n\x04kind\x18\x03 \x01(\x0e\x32\x16.relationships.v1.Kind\x12$\n\x04role\x18\x04 \x01(\x0b\x32\x16.relationships.v1.Role\x12-\n\ttimestamp\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xb5\x01\n\x11RelationshipInput\x12*\n\x07subject\x18\x01 \x01(\x0b\x32\x19.relationships.v1.Subject\x12(\n\x06object\x18\x02 \x01(\x0b\x32\x18.relationships.v1.Object\x12$\n\x04kind\x18\x03 \x01(\x0e\x32\x16.relationships.v1.Kind\x12$\n\x04role\x18\x04 \x01(\x0b\x32\x16.relationships.v1.Role\"\x8d\x01\n\x0fRelationshipKey\x12*\n\x07subject\x18\x01 \x01(\x0b\x32\x19.relationships.v1.Subject\x12(\n\x06object\x18\x02 \x01(\x0b\x32\x18.relationships.v1.Object\x12$\n\x04kind\x18\x03 \x01(\x0e\x32\x16.relationships.v1.Kind*1\n\x04Kind\x12\x14\n\x10KIND_UNSPECIFIED\x10\x00\x12\x13\n\x0fKIND_ASSIGNMENT\x10\x01*N\n\x06Origin\x12\x16\n\x12ORIGIN_UNSPECIFIED\x10\x00\x12\x0f\n\x0bORIGIN_SELF\x10\x01\x12\x1b\n\x17ORIGIN_GITLAB_FEDERATED\x10\x02\x42\x34Z2gitlab.com/gitlab-org/auth/iam/proto/relationshipsb\x06proto3"
+
+pool = ::Google::Protobuf::DescriptorPool.generated_pool
+pool.add_serialized_file(descriptor_data)
+
+module Relationships
+  module V1
+    Object = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Object").msgclass
+    Principal = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Principal").msgclass
+    Role = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Role").msgclass
+    Identity = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Identity").msgclass
+    Subject = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Subject").msgclass
+    Relationship = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Relationship").msgclass
+    RelationshipInput = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.RelationshipInput").msgclass
+    RelationshipKey = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.RelationshipKey").msgclass
+    Kind = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Kind").enummodule
+    Origin = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("relationships.v1.Origin").enummodule
+  end
+end

data/lib/proto/service_pb.rb

@@ -1,11 +1,13 @@
 # frozen_string_literal: true
-
 # Generated by the protocol buffer compiler.  DO NOT EDIT!
-# source: service.proto
+# source: proto/service.proto
 
 require 'google/protobuf'
 
-descriptor_data = "\n\rservice.proto\x12\x04glaz\"?\n\x0e\x45xplainRequest\x12\x0f\n\x07subject\x18\x01 \x01(\t\x12\x0e\n\x06object\x18\x02 \x01(\t\x12\x0c\n\x04role\x18\x03 \x01(\x05\"2\n\x0f\x45xplainResponse\x12\x0f\n\x07\x61llowed\x18\x01 \x01(\x08\x12\x0e\n\x06reason\x18\x02 \x01(\t\"2\n\x0f\x45valuateRequest\x12\x0f\n\x07subject\x18\x01 \x01(\t\x12\x0e\n\x06object\x18\x02 \x01(\t\"3\n\x10\x45valuateResponse\x12\x0f\n\x07\x61llowed\x18\x01 \x01(\x08\x12\x0e\n\x06reason\x18\x02 \x01(\t\"^\n\x16\x43heckPermissionRequest\x12\x0f\n\x07subject\x18\x01 \x01(\t\x12\x0e\n\x06object\x18\x02 \x01(\t\x12\x12\n\npermission\x18\x03 \x01(\t\x12\x0f\n\x07\x63ontext\x18\x04 \x01(\t\":\n\x17\x43heckPermissionResponse\x12\x0f\n\x07\x61llowed\x18\x01 \x01(\x08\x12\x0e\n\x06reason\x18\x02 \x01(\t2\xd9\x01\n\x14\x41uthorizationService\x12\x36\n\x07\x45xplain\x12\x14.glaz.ExplainRequest\x1a\x15.glaz.ExplainResponse\x12\x39\n\x08\x45valuate\x12\x15.glaz.EvaluateRequest\x1a\x16.glaz.EvaluateResponse\x12N\n\x0f\x43heckPermission\x12\x1c.glaz.CheckPermissionRequest\x1a\x1d.glaz.CheckPermissionResponseb\x06proto3"
+require 'proto/relationships/relationships_pb'
+
+
+descriptor_data = "\n\x13proto/service.proto\x12\x04glaz\x1a\'proto/relationships/relationships.proto\"?\n\x0e\x45xplainRequest\x12\x0f\n\x07subject\x18\x01 \x01(\t\x12\x0e\n\x06object\x18\x02 \x01(\t\x12\x0c\n\x04role\x18\x03 \x01(\x05\"2\n\x0f\x45xplainResponse\x12\x0f\n\x07\x61llowed\x18\x01 \x01(\x08\x12\x0e\n\x06reason\x18\x02 \x01(\t\"2\n\x0f\x45valuateRequest\x12\x0f\n\x07subject\x18\x01 \x01(\t\x12\x0e\n\x06object\x18\x02 \x01(\t\"3\n\x10\x45valuateResponse\x12\x0f\n\x07\x61llowed\x18\x01 \x01(\x08\x12\x0e\n\x06reason\x18\x02 \x01(\t\"\xbe\x01\n\x0c\x43heckRequest\x12,\n\x07subject\x18\x01 \x01(\x0b\x32\x1b.relationships.v1.Principal\x12\x0e\n\x06\x61\x63tion\x18\x02 \x01(\t\x12(\n\x06object\x18\x03 \x01(\x0b\x32\x18.relationships.v1.Object\x12\x35\n\rrelationships\x18\x04 \x03(\x0b\x32\x1e.relationships.v1.Relationship\x12\x0f\n\x07\x63ontext\x18\x05 \x01(\t\"0\n\rCheckResponse\x12\x0f\n\x07\x61llowed\x18\x01 \x01(\x08\x12\x0e\n\x06reason\x18\x02 \x01(\t2\xbb\x01\n\x14\x41uthorizationService\x12\x36\n\x07\x45xplain\x12\x14.glaz.ExplainRequest\x1a\x15.glaz.ExplainResponse\x12\x39\n\x08\x45valuate\x12\x15.glaz.EvaluateRequest\x1a\x16.glaz.EvaluateResponse\x12\x30\n\x05\x43heck\x12\x12.glaz.CheckRequest\x1a\x13.glaz.CheckResponseb\x06proto3"
 
 pool = ::Google::Protobuf::DescriptorPool.generated_pool
 pool.add_serialized_file(descriptor_data)
@@ -15,6 +17,6 @@ module Glaz
   ExplainResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.ExplainResponse").msgclass
   EvaluateRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.EvaluateRequest").msgclass
   EvaluateResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.EvaluateResponse").msgclass
-  CheckPermissionRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.CheckPermissionRequest").msgclass
-  CheckPermissionResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.CheckPermissionResponse").msgclass
+  CheckRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.CheckRequest").msgclass
+  CheckResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.CheckResponse").msgclass
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-glaz
 version: !ruby/object:Gem::Version
-  version: 0.0.3
+  version: 1.0.0
 platform: x86_64-linux-gnu
 authors:
 - group::authorization
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-06-10 00:00:00.000000000 Z
+date: 2026-07-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: google-protobuf
@@ -101,8 +101,10 @@ files:
 - lib/gitlab/glaz/3.3/glaz.so
 - lib/gitlab/glaz/3.4/glaz.so
 - lib/gitlab/glaz/4.0/glaz.so
+- lib/gitlab/glaz/engine.rb
 - lib/gitlab/glaz/loader.rb
 - lib/gitlab/glaz/version.rb
+- lib/proto/relationships/relationships_pb.rb
 - lib/proto/service_pb.rb
 homepage: https://gitlab.com/gitlab-org/ruby/gems/gitlab-glaz
 licenses: