gitlab-glaz 1.1.0-x86_64-linux-gnu → 1.2.0-x86_64-linux-gnu

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d51c259be1ee44e6031e4332046464960f1e1de3a1fa0bef1b8d39e38ec059c5
-  data.tar.gz: 2b4af81dc8c9203fbef19b6390329f2d89bf1fbf328361ba7d8fcd9a3871164b
+  metadata.gz: 24a3708d49ed5271fea42025fc4d8086db8b5679b0bcd3e4dc6f15610d2a8603
+  data.tar.gz: ac11da8b7ed2a3ff5ccadfd93132ebc2d520617deb578b625125851d5548218f
 SHA512:
-  metadata.gz: 364dae4bf9594fdc62499995685c49c96fb1b35612b53271a1a8c0495125bcbab3fb464db140e13b716627f3b80b6c913c41f7eccd123781cc1d46ff1ccf90d1
-  data.tar.gz: 2ec8bcf06b3a2de2dcb195b5de58cb5dea40ace6ce15ccd70e6d9901319f76edad95c166128be52c1c65366c610e5b84a37e8ab0034c77fab69dce1d0c420b98
+  metadata.gz: a347f4a6fa0a8ee1c97ee1bbb4848cd6bf7e752415b5c95c456373db0d06d346298e3573b02103833d85f79e94d1da01ca0736e6da75173c7349958658d0bff7
+  data.tar.gz: 5094c7e30096ad612e07fcbae2ffc05337664931f98316136fbb6bcbdc268567018c59c13906a4f0ff0b5eceb9a72079756a7d569ca3a997c99b1f801c17da3f

data/Cargo.lock

@@ -646,7 +646,7 @@ dependencies = [
 
 [[package]]
 name = "glaz"
-version = "1.1.0"
+version = "1.2.0"
 dependencies = [
  "glaz-module",
  "glaz-proto",
@@ -1716,18 +1716,18 @@ checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
 
 [[package]]
 name = "rb-sys"
-version = "0.9.128"
+version = "0.9.130"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45ca28513560e56cfb79a62b1fce363c73af170a182024ce880c77ee9429920a"
+checksum = "02faf625bb10ba893e3ae620f19c9fb1b5f8fcae0fe4eb86bb3f2230fad75edb"
 dependencies = [
  "rb-sys-build",
 ]
 
 [[package]]
 name = "rb-sys-build"
-version = "0.9.128"
+version = "0.9.130"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce04b2c55eff3a21aaa623fcc655d94373238e72cac6b3e1a3641ff31649f99a"
+checksum = "05be6f9c86fe5482808162826f6c047d093b3670582296c770de1d94f8066694"
 dependencies = [
  "bindgen",
  "lazy_static",

data/Cargo.toml

@@ -4,7 +4,7 @@ members = ["ext/*"]
 resolver = "2"
 
 [workspace.package]
-version = "1.1.0"
+version = "1.2.0"
 edition = "2024"
 
 # Shared dependencies for all crates

data/ext/glaz/src/lib.rs

@@ -53,13 +53,18 @@ impl PermissionCheckEngine {
 }
 
 /// Thin 1:1 wrapper around `glaz_module::GovernPolicyCheckEngine`, the Rego
-/// governance evaluator. Stateless between calls; both methods take an
-/// encoded `glaz.govern.v1.EvaluateGovernPolicyRequest`. `evaluate` raises
-/// on failure (matching `PermissionCheckEngine`'s convention) and returns
-/// the encoded `EvaluateGovernPolicyResponse` on success — `ArgumentError`
-/// for bad policy/input, `RuntimeError` for an engine-side fault, see
+/// governance evaluator. Stateless between calls; `evaluate` raises on
+/// failure (matching `PermissionCheckEngine`'s convention) and returns the
+/// encoded `EvaluateGovernPolicyResponse` on success — `ArgumentError` for
+/// bad policy/input, `RuntimeError` for an engine-side fault, see
 /// `map_error`; `debug_evaluate` is infallible and carries failures in-band
-/// in its JSON response instead, since it's a raw debugging escape hatch.
+/// in its JSON response instead, since it's a raw debugging escape hatch;
+/// `validate` is also infallible — policy errors are returned as
+/// `Ok(valid: false, errors: [...])` so the Policy Store can surface
+/// actionable feedback without treating a user mistake as an exceptional
+/// condition; a malformed protobuf payload raises `ArgumentError`, while
+/// internal engine failures (`NotInitialized`, `Runtime`) raise
+/// `RuntimeError` via `map_error`.
 ///
 /// Registered as `Glaz::Native::GovernPolicyEngine` (not
 /// `Glaz::GovernPolicyEngine`) specifically to avoid colliding, in name,
@@ -113,6 +118,25 @@ impl GovernPolicyEngine {
             .map_err(|e| map_error(ruby, e))?;
         Ok(ruby.str_from_slice(&response.encode_to_vec()))
     }
+
+    /// Parse and compile a Rego policy without evaluating it against input.
+    ///
+    /// Infallible for policy errors: parse failures and oversized input are
+    /// returned in-band as `{ valid: false, errors: [...] }` rather than
+    /// raised. Only a malformed protobuf payload raises `ArgumentError`; an
+    /// internal engine fault raises `RuntimeError` via `map_error`.
+    fn validate(
+        ruby: &Ruby,
+        rb_self: &Self,
+        proto_bytes: magnus::RString,
+    ) -> Result<magnus::RString, Error> {
+        let bytes = unsafe { proto_bytes.as_slice() };
+        let response = rb_self
+            .engine
+            .validate(bytes)
+            .map_err(|e| map_error(ruby, e))?;
+        Ok(ruby.str_from_slice(&response.encode_to_vec()))
+    }
 }
 
 /// Return the default roles embedded in the extension at build time (parsed
@@ -172,5 +196,6 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
         magnus::method!(GovernPolicyEngine::debug_evaluate, 1),
     )?;
     govern.define_method("evaluate", magnus::method!(GovernPolicyEngine::evaluate, 1))?;
+    govern.define_method("validate", magnus::method!(GovernPolicyEngine::validate, 1))?;
     Ok(())
 }

data/lib/gitlab/glaz/govern_policy_engine.rb

@@ -83,6 +83,39 @@ module Gitlab
         }
       end
 
+      # Validate a Rego policy at save time without evaluating it against input.
+      #
+      # Parses and compiles the policy source. A policy that fails to parse is
+      # not an error - it is returned as `{ valid: false, errors: [...] }` so
+      # the Policy Store can surface actionable feedback without treating a user
+      # mistake as an exceptional condition.
+      #
+      # @param policy_rego [String] Rego policy source text (UTF-8, max 64 KiB).
+      #   Must be a valid UTF-8 string; raises `Encoding::InvalidByteSequenceError`
+      #   if the string contains invalid byte sequences.
+      # @return [Hash] `{ valid: Boolean, errors: Array<Hash> }`.
+      #   `valid` is `true` when the policy parsed and compiled successfully.
+      #   `errors` is empty when valid; each entry is
+      #   `{ message: String, location: String }` where `location` is a
+      #   source-location hint in `"LINE:COL"` format (e.g. `"2:1"`) when the
+      #   engine surfaces one, or `""` when no separate location is available.
+      def validate(policy_rego:)
+        encoded = ::Glaz::Govern::V1::ValidateGovernPolicyRequest.encode(
+          ::Glaz::Govern::V1::ValidateGovernPolicyRequest.new(
+            policy_rego: policy_rego
+          )
+        )
+
+        response = ::Glaz::Govern::V1::ValidateGovernPolicyResponse.decode(
+          @native.validate(encoded)
+        )
+
+        {
+          valid: response.valid,
+          errors: response.errors.map { |e| { message: e.message, location: e.location } }
+        }
+      end
+
       # Evaluate a Rego query directly, with no `violation`/`deny`/`allow`
       # interpretation. A debugging/testing escape hatch for exercising a
       # policy's Rego directly; prefer #evaluate for the primary path.

data/lib/gitlab/glaz/version.rb

@@ -2,6 +2,6 @@
 
 module Gitlab
   module Glaz
-    VERSION = "1.1.0"
+    VERSION = "1.2.0"
   end
 end

data/lib/proto/govern_pb.rb

@@ -5,7 +5,7 @@
 require 'google/protobuf'
 
 
-descriptor_data = "\n\x12proto/govern.proto\x12\x0eglaz.govern.v1\"Y\n\x1b\x45valuateGovernPolicyRequest\x12\x13\n\x0bpolicy_rego\x18\x01 \x01(\t\x12\x12\n\ninput_json\x18\x02 \x01(\t\x12\x11\n\tdata_json\x18\x03 \x01(\t\"m\n EvaluateGovernPolicyDebugRequest\x12\x13\n\x0bpolicy_rego\x18\x01 \x01(\t\x12\r\n\x05query\x18\x02 \x01(\t\x12\x12\n\ninput_json\x18\x03 \x01(\t\x12\x11\n\tdata_json\x18\x04 \x01(\t\"I\n\x0cGovernAction\x12\x13\n\x0b\x61\x63tion_type\x18\x01 \x01(\t\x12\x0f\n\x07message\x18\x02 \x01(\t\x12\x13\n\x0bparams_json\x18\x03 \x01(\t\"5\n\x0cGovernReason\x12\x0f\n\x07message\x18\x01 \x01(\t\x12\x14\n\x0c\x64\x65tails_json\x18\x02 \x01(\t\"\x8d\x01\n\x1c\x45valuateGovernPolicyResponse\x12-\n\x07\x61\x63tions\x18\x01 \x03(\x0b\x32\x1c.glaz.govern.v1.GovernAction\x12-\n\x07reasons\x18\x02 \x03(\x0b\x32\x1c.glaz.govern.v1.GovernReason\x12\x0f\n\x07matched\x18\x03 \x01(\x08\x62\x06proto3"
+descriptor_data = "\n\x12proto/govern.proto\x12\x0eglaz.govern.v1\"z\n\x1bEvaluateGovernPolicyRequest\x12\x1f\n\x0bpolicy_rego\x18\x01 \x01(\tR\npolicyRego\x12\x1d\n\ninput_json\x18\x02 \x01(\tR\tinputJson\x12\x1b\n\tdata_json\x18\x03 \x01(\tR\x08dataJson\"\x95\x01\n EvaluateGovernPolicyDebugRequest\x12\x1f\n\x0bpolicy_rego\x18\x01 \x01(\tR\npolicyRego\x12\x14\n\x05query\x18\x02 \x01(\tR\x05query\x12\x1d\n\ninput_json\x18\x03 \x01(\tR\tinputJson\x12\x1b\n\tdata_json\x18\x04 \x01(\tR\x08dataJson\"j\n\x0cGovernAction\x12\x1f\n\x0baction_type\x18\x01 \x01(\tR\nactionType\x12\x18\n\x07message\x18\x02 \x01(\tR\x07message\x12\x1f\n\x0bparams_json\x18\x03 \x01(\tR\nparamsJson\"K\n\x0cGovernReason\x12\x18\n\x07message\x18\x01 \x01(\tR\x07message\x12!\n\x0cdetails_json\x18\x02 \x01(\tR\x0bdetailsJson\"\xa8\x01\n\x1cEvaluateGovernPolicyResponse\x126\n\x07actions\x18\x01 \x03(\x0b2\x1c.glaz.govern.v1.GovernActionR\x07actions\x126\n\x07reasons\x18\x02 \x03(\x0b2\x1c.glaz.govern.v1.GovernReasonR\x07reasons\x12\x18\n\x07matched\x18\x03 \x01(\x08R\x07matched\">\n\x1bValidateGovernPolicyRequest\x12\x1f\n\x0bpolicy_rego\x18\x01 \x01(\tR\npolicyRego\"M\n\x15GovernValidationError\x12\x18\n\x07message\x18\x01 \x01(\tR\x07message\x12\x1a\n\x08location\x18\x02 \x01(\tR\x08location\"s\n\x1cValidateGovernPolicyResponse\x12\x14\n\x05valid\x18\x01 \x01(\x08R\x05valid\x12=\n\x06errors\x18\x02 \x03(\x0b2%.glaz.govern.v1.GovernValidationErrorR\x06errorsb\x06proto3"
 
 pool = ::Google::Protobuf::DescriptorPool.generated_pool
 pool.add_serialized_file(descriptor_data)
@@ -18,6 +18,9 @@ module Glaz
       GovernAction = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.GovernAction").msgclass
       GovernReason = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.GovernReason").msgclass
       EvaluateGovernPolicyResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.EvaluateGovernPolicyResponse").msgclass
+      ValidateGovernPolicyRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.ValidateGovernPolicyRequest").msgclass
+      GovernValidationError = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.GovernValidationError").msgclass
+      ValidateGovernPolicyResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.ValidateGovernPolicyResponse").msgclass
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-glaz
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.2.0
 platform: x86_64-linux-gnu
 authors:
 - group::authorization
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-08-24 00:00:00.000000000 Z
+date: 2026-09-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: google-protobuf