gitlab-glaz 1.1.0 → 2.0.0

data/lib/gitlab/glaz/govern_policy_engine.rb

@@ -1,138 +1,345 @@
 # frozen_string_literal: true
 
 require "json"
+require "uri"
 
 module Gitlab
   module Glaz
-    # Wraps a native Glaz::Native::GovernPolicyEngine instance - the Rego
-    # governance policy evaluator.
+    # Wraps a native Glaz::Native::GovernPolicyEngine - the Rego governance
+    # policy evaluator.
     #
-    # The evaluator is a pure function over its arguments: it performs no
-    # I/O, holds no state between calls, and executes no actions. The caller
-    # supplies the policy's Rego source and the assembled context document,
-    # and is responsible for executing the returned actions.
+    # Evaluation is trigger-keyed: the caller supplies an event trigger and
+    # the context document, and the engine fetches the applicable policies
+    # from the Policy Store REST API named at construction. Authentication
+    # is per request (+store_authorization+ on #evaluate), never per engine
+    # and never from the environment. The engine executes no actions; the
+    # caller does.
     #
-    # +reasons+ and +actions+ are independent, not 1:1: +reasons+ reports why
-    # the policy matched - one entry per `violation`/`deny` element the
-    # policy produced; empty means it did not match - while +actions+
-    # reports what to enforce as a result. Actions are conceptually owned by
-    # the policy's configuration in the future central Policy Store, so any
-    # match currently yields a single synthesized block action regardless of
-    # how many reasons fired. +matched+ is a convenience boolean mirroring
-    # "+actions+ is non-empty", for callers who don't want to infer that
-    # from array emptiness themselves.
+    # #validate and #debug_evaluate never touch the store, so an engine
+    # built without one (the Policy Store itself) still serves them and
+    # fails #evaluate closed with an ArgumentError.
     #
-    # #evaluate is the primary path: it always auto-discovers the policy's
-    # `violation`/`deny`/`allow` rules (the native +evaluate+ path), returns
-    # the hardened Hash shape described below on success, and raises on any
-    # evaluation failure - the native call itself raises ArgumentError for
-    # bad policy/input and RuntimeError for an engine-side fault; see
-    # #evaluate's own doc comment.
-    # #debug_evaluate is a separate, secondary method for debugging/testing a Rego query
-    # directly: it performs no violation/deny/allow interpretation, does
-    # not raise, and returns whatever the query evaluated to (plus any
-    # error, in-band) with no guarantee about its shape.
+    # #evaluate releases the GVL around the store lookup. It cannot be
+    # interrupted from Ruby until it returns, which is bounded by the
+    # lookup timeouts plus the batch evaluation. Instances are safe to
+    # share across threads and across a fork.
     class GovernPolicyEngine
-      def initialize
-        @native = ::Glaz::Native::GovernPolicyEngine.new
+      # Argument checks, raising ArgumentError instead of letting a
+      # Google::Protobuf::TypeError or JSON error escape from the wire layer.
+      #
+      # @api private
+      module Validation
+        module_function
+
+        INVALID_STORE_BASE_URL_MESSAGE = "store_base_url must be an http(s) URL naming the Policy Store REST API " \
+          "root (e.g. \"https://gitlab.com/api/v4\"), without credentials, query or fragment, and with a port " \
+          "in 1..65535"
+        private_constant :INVALID_STORE_BASE_URL_MESSAGE
+
+        def store_base_url!(url)
+          string!(url, "store_base_url")
+
+          parsed = begin
+            URI.parse(url)
+          rescue URI::Error
+            nil
+          end
+          raise ArgumentError, INVALID_STORE_BASE_URL_MESSAGE unless valid_store_base_url?(parsed)
+
+          -url
+        end
+
+        def string!(value, name)
+          raise ArgumentError, "#{name} must be a String; got #{value.class}" unless value.is_a?(String)
+
+          value
+        end
+
+        # The message never echoes +value+: it is a credential.
+        def store_authorization!(value)
+          return value.to_s if value.nil? || value.is_a?(String)
+
+          raise ArgumentError, "store_authorization must be nil or a String; got a #{value.class}"
+        end
+
+        # The native side takes a u64 of milliseconds.
+        def timeout!(value, name)
+          return value if value.nil? || (value.is_a?(Integer) && value.positive? && value.bit_length <= 64)
+
+          raise ArgumentError, "#{name} must be nil or a positive Integer of at most 64 bits; got #{value.inspect}"
+        end
+
+        def json!(document, name)
+          raise ArgumentError, "#{name} must be a Hash; got #{document.class}" unless document.is_a?(Hash)
+
+          JSON.generate(document)
+        rescue JSON::JSONError => e
+          raise ArgumentError, "#{name} must serialize to JSON; #{e.message}"
+        end
+
+        def presence(string)
+          string.nil? || string.empty? ? nil : string
+        end
+
+        def valid_store_base_url?(parsed_uri)
+          parsed_uri.is_a?(URI::HTTP) && !parsed_uri.host.to_s.empty? &&
+            parsed_uri.userinfo.nil? && parsed_uri.query.nil? && parsed_uri.fragment.nil? &&
+            parsed_uri.port.between?(1, 65_535)
+        end
+      end
+      private_constant :Validation
+
+      # Serializes .shared against .policy_store_url=: without it, a .shared
+      # call that read the old URL could finish after a reconfiguration and
+      # leave an engine for the old store memoized.
+      CONFIGURATION_LOCK = Mutex.new
+      private_constant :CONFIGURATION_LOCK
+
+      class << self
+        # @return [GovernPolicyEngine] a process-wide engine for
+        #   +.policy_store_url+, built on first access and memoized until
+        #   +.policy_store_url=+ next reconfigures it.
+        # @raise [ArgumentError] if +GLAZ_POLICY_STORE_URL+ is set but is not
+        #   a valid Policy Store REST API root.
+        def shared
+          CONFIGURATION_LOCK.synchronize { @shared ||= new(store_base_url: policy_store_url) }
+        end
+
+        # @return [String, nil] the Policy Store REST API root the next
+        #   +.shared+ call builds its engine with: an explicitly assigned URL
+        #   (see +.policy_store_url=+) takes precedence, otherwise
+        #   +GLAZ_POLICY_STORE_URL+; a blank value counts as unset (+nil+).
+        def policy_store_url
+          @policy_store_url || Validation.presence(ENV["GLAZ_POLICY_STORE_URL"]&.strip)
+        end
+
+        # Point the shared engine at a Policy Store REST API root; the next
+        # .shared call rebuilds it. +nil+ falls back to the environment variable.
+        #
+        # @raise [ArgumentError] when +url+ is neither nil nor an http(s) URL
+        #   without credentials, query or fragment.
+        def policy_store_url=(url)
+          validated = url.nil? ? nil : Validation.store_base_url!(url)
+          CONFIGURATION_LOCK.synchronize do
+            @policy_store_url = validated
+            @shared = nil
+          end
+        end
+      end
+
+      # @return [String, nil] the Policy Store REST API root; nil for an
+      #   engine with no store.
+      attr_reader :store_base_url
+
+      # @param store_base_url [String, nil] the Policy Store REST API root,
+      #   e.g. `"https://gitlab.com/api/v4"`; the lookup performs
+      #   `GET {store_base_url}/organizations/{id}/security/policy_store?trigger_type={trigger}`.
+      #   Redirects are never followed; `ALL_PROXY`/`HTTPS_PROXY`/`HTTP_PROXY`
+      #   and `NO_PROXY` apply. +nil+ builds an engine with no store.
+      # @param connect_timeout_ms [Integer, nil] lookup connect timeout
+      #   (default 500 ms).
+      # @param timeout_ms [Integer, nil] lookup total timeout (default 2 s).
+      # @raise [ArgumentError] for an invalid URL, or a timeout that is
+      #   neither nil nor a positive 64-bit Integer.
+      def initialize(store_base_url: nil, connect_timeout_ms: nil, timeout_ms: nil)
+        @store_base_url = store_base_url.nil? ? nil : Validation.store_base_url!(store_base_url)
+        @connect_timeout_ms = Validation.timeout!(connect_timeout_ms, "connect_timeout_ms")
+        @timeout_ms = Validation.timeout!(timeout_ms, "timeout_ms")
+        @pid = Process.pid
+        @rebuild_lock = Mutex.new
+        @native = build_native
       end
 
-      # Evaluate a Rego governance policy against context.
+      # Evaluate every governance policy that applies to an event trigger.
+      # +context+ must carry the evaluation scope at `organization.id` as a
+      # resource path (e.g. `"organizations/1"`).
+      #
+      # @param trigger [String] the event, e.g. "deployment_requested".
+      # @param context [Hash] the Rego `input` document for every policy in
+      #   the batch (max 1 MiB as JSON).
+      # @param principal [String] who the decision is about, as an opaque
+      #   path-style identifier string (e.g. `"users/42"`); the caller owns
+      #   the naming scheme. Trimmed of surrounding whitespace; must not be
+      #   blank, contain a newline, or exceed 64 KiB once trimmed.
+      # @param resource [String] what the decision is about, as an opaque
+      #   path-style identifier string (e.g.
+      #   `"organizations/1/deployments/9"`). Same validation as
+      #   +principal+.
+      # @param data [Hash, nil] optional Rego `data` document shared by the
+      #   batch. It must not define a policy's own decision rules
+      #   (`violation`/`deny`/`allow`); the engine reports that on the
+      #   policy's +error+.
+      # @param store_authorization [String, nil] the `Authorization` header
+      #   value the lookup presents to the Policy Store, verbatim (target
+      #   scheme `"Bearer <jwt>"`). nil sends no header. Never logged or
+      #   echoed in errors.
+      # @raise [ArgumentError] for a caller fault: wrong argument types, a
+      #   document that does not serialize to JSON, a blank trigger, a blank
+      #   +principal+ or +resource+ (or one exceeding 64 KiB or carrying a
+      #   newline), missing organization scope, an oversized input document,
+      #   or an engine constructed without a store.
+      # @raise [RuntimeError] for a backend fault: the store lookup failed
+      #   or was rejected, or resolved more policies than the per-trigger
+      #   cap. Never an empty batch, which would read as "nothing to
+      #   enforce".
+      # @return [Hash] `{ decisions: Array<Hash>, undecided_policy_ids:
+      #   Array<Integer>, identifier: String }`. +decisions+ has one entry
+      #   per resolved, in-scope policy, in lookup order; empty means
+      #   nothing applies. Each decision is `{ policy_id: Integer, matched:
+      #   Boolean, actions: Array<Hash>, reasons: Array<Hash>, error: String
+      #   | nil }`; each action `{ action_type: String, message: String |
+      #   nil, params: Hash, gating: Boolean }`; each reason `{ message:
+      #   String | nil, details: Hash }`. +actions+ are exactly those the
+      #   store configured on the policy, emitted when it matched. A non-nil
+      #   +error+ means the policy could not be decided (broken, or over the
+      #   per-evaluation time budget); +matched+ is then false and its id is
+      #   listed in +undecided_policy_ids+. +identifier+ is the stable
+      #   decision identifier derived from (+principal+, +trigger+,
+      #   +resource+): the same subject always yields the same identifier,
+      #   so callers can key journaling, action deduplication, and approval
+      #   correlation on it.
       #
-      # @param policy_rego [String] Rego policy text (max 64 KiB).
-      # @param context [Hash] the host-assembled context, passed to the
-      #   policy as the Rego `input` document (max 1 MiB as JSON).
-      # @param data [Hash] optional precomputed Rego `data` document (e.g.
-      #   cached settings or scan results). Top-level keys must not collide
-      #   with the policy's package path.
-      # @raise [ArgumentError] for a caller-fixable evaluation failure -
-      #   malformed policy, oversized documents, an unrecognized
-      #   violation/deny/allow shape, and so on.
-      # @raise [RuntimeError] for an engine-side fault, e.g. the Rego
-      #   evaluation time budget was exceeded - not the caller's fault.
-      #   Callers can rely on a successful return meaning the policy
-      #   evaluated cleanly; there is no in-band error to check.
-      # @return [Hash] `{ matched: Boolean, actions: Array<Hash>, reasons:
-      #   Array<Hash> }`. `matched` is `true` exactly when `actions`
-      #   (equivalently `reasons`) is non-empty - a convenience so callers
-      #   don't have to infer "did the policy fire" from array emptiness.
-      #   It is not itself an allow/deny decision: today every action is
-      #   `"block"`, so `matched` and "should deny" coincide, but a future
-      #   Policy Store action type (e.g. `"log"`) could match without
-      #   implying denial - check `actions` for enforcement decisions. Each
-      #   action is `{ action_type: String, message: String | nil, params:
-      #   Hash }`; each reason is `{ message: String | nil, details: Hash
-      #   }`. Empty +actions+ means the policy allows the operation.
-      def evaluate(policy_rego:, context:, data: {})
+      #   Verdict: deny when any action is gating or any policy is
+      #   undecided, allow otherwise. +matched+ alone decides nothing.
+      def evaluate(trigger:, context:, principal:, resource:, data: nil, store_authorization: nil)
+        if @store_base_url.nil?
+          raise ArgumentError, "this engine has no Policy Store to resolve policies from: pass store_base_url: to " \
+            "Gitlab::Glaz::GovernPolicyEngine.new, or for the shared engine assign " \
+            "Gitlab::Glaz::GovernPolicyEngine.policy_store_url or set GLAZ_POLICY_STORE_URL " \
+            "(e.g. \"https://gitlab.com/api/v4\")"
+        end
+
         encoded = ::Glaz::Govern::V1::EvaluateGovernPolicyRequest.encode(
           ::Glaz::Govern::V1::EvaluateGovernPolicyRequest.new(
-            policy_rego: policy_rego,
-            input_json: context.to_json,
-            data_json: data.nil? || data.empty? ? "" : data.to_json
+            trigger: Validation.string!(trigger, "trigger"),
+            input_json: Validation.json!(context, "context"),
+            data_json: data.nil? ? "" : Validation.json!(data, "data"),
+            principal: Validation.string!(principal, "principal"),
+            resource: Validation.string!(resource, "resource"),
+            store_authorization: Validation.store_authorization!(store_authorization)
           )
         )
 
         response = ::Glaz::Govern::V1::EvaluateGovernPolicyResponse.decode(
-          @native.evaluate(encoded)
+          native.evaluate_policies(encoded)
+        )
+
+        {
+          decisions: response.decisions.map { |decision| decision_hash(decision) },
+          undecided_policy_ids: response.undecided_policy_ids.to_a,
+          identifier: response.identifier
+        }
+      end
+
+      # Parse and compile a Rego policy without evaluating it. A policy that
+      # fails to parse is not an error: it comes back as
+      # `{ valid: false, errors: [...] }` so the Policy Store can surface
+      # actionable feedback.
+      #
+      # @param policy_rego [String] Rego source (max 64 KiB).
+      # @raise [ArgumentError] when +policy_rego+ is not a String.
+      # @return [Hash] `{ valid: Boolean, errors: Array<Hash> }`; each error
+      #   is `{ message: String, location: String }` with +location+ in
+      #   `"LINE:COL"` format, or `""` when none is available.
+      def validate(policy_rego:)
+        encoded = ::Glaz::Govern::V1::ValidateGovernPolicyRequest.encode(
+          ::Glaz::Govern::V1::ValidateGovernPolicyRequest.new(
+            policy_rego: Validation.string!(policy_rego, "policy_rego")
+          )
+        )
+
+        response = ::Glaz::Govern::V1::ValidateGovernPolicyResponse.decode(
+          native.validate(encoded)
         )
 
         {
-          matched: response.matched,
-          reasons: response.reasons.map { |reason| reason_hash(reason) },
-          actions: response.actions.map { |action| action_hash(action) }
+          valid: response.valid,
+          errors: response.errors.map { |e| { message: e.message, location: e.location } }
         }
       end
 
       # Evaluate a Rego query directly, with no `violation`/`deny`/`allow`
-      # interpretation. A debugging/testing escape hatch for exercising a
-      # policy's Rego directly; prefer #evaluate for the primary path.
-      # Unlike #evaluate, this does not raise on failure - +error+ stays
-      # in-band, since this method is meant for inspecting raw results
-      # (including failures) while developing a policy, not for production
-      # decision-making.
+      # interpretation and no policy lookup. A debugging escape hatch for
+      # policy development: evaluation failures stay in-band on +error+
+      # rather than raising.
       #
-      # @param policy_rego [String] Rego policy text (max 64 KiB).
-      # @param context [Hash] the host-assembled context, passed to the
-      #   policy as the Rego `input` document (max 1 MiB as JSON).
-      # @param query [String] Rego query to evaluate (e.g.
-      #   "data.mypackage.violation"); must not be blank.
-      # @param data [Hash] optional precomputed Rego `data` document.
-      # @return [Hash] `{ result: Object, error: String | nil }` - `result`
-      #   is exactly whatever `query` evaluated to (parsed JSON), with no
-      #   guarantee about its shape. A non-nil `error` means evaluation
-      #   failed; `result` is then `nil`.
-      def debug_evaluate(policy_rego:, context:, query:, data: {})
+      # @param policy_rego [String] Rego source (max 64 KiB).
+      # @param context [Hash] the Rego `input` document (max 1 MiB as JSON).
+      # @param query [String] e.g. "data.mypackage.violation"; must not be
+      #   blank.
+      # @param data [Hash, nil] optional Rego `data` document, merged as
+      #   given.
+      # @raise [ArgumentError] for wrong argument types or a document that
+      #   does not serialize to JSON.
+      # @return [Hash] `{ result: Object, error: String | nil }`. +result+ is
+      #   whatever the query evaluated to (parsed JSON, String keys); nil
+      #   when +error+ is set.
+      def debug_evaluate(policy_rego:, context:, query:, data: nil)
         encoded = ::Glaz::Govern::V1::EvaluateGovernPolicyDebugRequest.encode(
           ::Glaz::Govern::V1::EvaluateGovernPolicyDebugRequest.new(
-            policy_rego: policy_rego,
-            query: query.to_s,
-            input_json: context.to_json,
-            data_json: data.nil? || data.empty? ? "" : data.to_json
+            policy_rego: Validation.string!(policy_rego, "policy_rego"),
+            query: Validation.string!(query, "query"),
+            input_json: Validation.json!(context, "context"),
+            data_json: data.nil? ? "" : Validation.json!(data, "data")
           )
         )
 
-        response = JSON.parse(@native.debug_evaluate(encoded), symbolize_names: true)
+        response = JSON.parse(native.debug_evaluate(encoded), max_nesting: false)
 
         {
-          result: response[:result],
-          error: response[:error].nil? || response[:error].empty? ? nil : response[:error]
+          result: response["result"],
+          error: Validation.presence(response["error"])
         }
       end
 
       private
 
+      # A forked child inherits the parent's engine and its pooled HTTP
+      # sockets, so the first call after a fork rebuilds it. The lock is only
+      # taken on that path, so concurrent first calls in the child (a Puma
+      # worker's request threads) share one rebuild. Ruby releases a mutex
+      # whose owner did not survive the fork, so the child cannot inherit it
+      # locked.
+      def native
+        return @native if @pid == Process.pid
+
+        @rebuild_lock.synchronize do
+          if @pid != Process.pid
+            @native = build_native
+            @pid = Process.pid
+          end
+        end
+        @native
+      end
+
+      def build_native
+        ::Glaz::Native::GovernPolicyEngine.new(@store_base_url, @connect_timeout_ms, @timeout_ms)
+      end
+
+      def decision_hash(decision)
+        {
+          policy_id: decision.policy_id,
+          matched: decision.matched,
+          actions: decision.actions.map { |action| action_hash(action) },
+          reasons: decision.reasons.map { |reason| reason_hash(reason) },
+          error: Validation.presence(decision.error)
+        }
+      end
+
+      # The native layer already bounds nesting, so parse without a limit.
       def action_hash(action)
         {
           action_type: action.action_type,
-          message: action.message.empty? ? nil : action.message,
-          params: JSON.parse(action.params_json)
+          message: Validation.presence(action.message),
+          params: JSON.parse(action.params_json, max_nesting: false),
+          gating: action.gating
         }
       end
 
       def reason_hash(reason)
         {
-          message: reason.message.empty? ? nil : reason.message,
-          details: JSON.parse(reason.details_json)
+          message: Validation.presence(reason.message),
+          details: JSON.parse(reason.details_json, max_nesting: false)
         }
       end
     end

data/lib/gitlab/glaz/version.rb

@@ -2,6 +2,6 @@
 
 module Gitlab
   module Glaz
-    VERSION = "1.1.0"
+    VERSION = "2.0.0"
   end
 end

data/lib/gitlab/glaz.rb

@@ -24,12 +24,12 @@ module Gitlab
       end.freeze
     end
 
-    # Returns the shared Gitlab::Glaz::GovernPolicyEngine instance, memoized
-    # across calls. Evaluate Rego governance policies via
-    # +govern_policy_engine.evaluate+; see GovernPolicyEngine#evaluate for
-    # the full contract.
+    # Returns GovernPolicyEngine.shared, the engine configured through
+    # GovernPolicyEngine.policy_store_url= / GLAZ_POLICY_STORE_URL. It is
+    # rebuilt when that configuration changes, so call this each time rather
+    # than caching the result.
     def govern_policy_engine
-      @govern_policy_engine ||= GovernPolicyEngine.new
+      GovernPolicyEngine.shared
     end
   end
 end

data/lib/proto/govern_pb.rb

@@ -5,7 +5,7 @@
 require 'google/protobuf'
 
 
-descriptor_data = "\n\x12proto/govern.proto\x12\x0eglaz.govern.v1\"Y\n\x1b\x45valuateGovernPolicyRequest\x12\x13\n\x0bpolicy_rego\x18\x01 \x01(\t\x12\x12\n\ninput_json\x18\x02 \x01(\t\x12\x11\n\tdata_json\x18\x03 \x01(\t\"m\n EvaluateGovernPolicyDebugRequest\x12\x13\n\x0bpolicy_rego\x18\x01 \x01(\t\x12\r\n\x05query\x18\x02 \x01(\t\x12\x12\n\ninput_json\x18\x03 \x01(\t\x12\x11\n\tdata_json\x18\x04 \x01(\t\"I\n\x0cGovernAction\x12\x13\n\x0b\x61\x63tion_type\x18\x01 \x01(\t\x12\x0f\n\x07message\x18\x02 \x01(\t\x12\x13\n\x0bparams_json\x18\x03 \x01(\t\"5\n\x0cGovernReason\x12\x0f\n\x07message\x18\x01 \x01(\t\x12\x14\n\x0c\x64\x65tails_json\x18\x02 \x01(\t\"\x8d\x01\n\x1c\x45valuateGovernPolicyResponse\x12-\n\x07\x61\x63tions\x18\x01 \x03(\x0b\x32\x1c.glaz.govern.v1.GovernAction\x12-\n\x07reasons\x18\x02 \x03(\x0b\x32\x1c.glaz.govern.v1.GovernReason\x12\x0f\n\x07matched\x18\x03 \x01(\x08\x62\x06proto3"
+descriptor_data = "\n\x12proto/govern.proto\x12\x0eglaz.govern.v1\"m\n EvaluateGovernPolicyDebugRequest\x12\x13\n\x0bpolicy_rego\x18\x01 \x01(\t\x12\r\n\x05query\x18\x02 \x01(\t\x12\x12\n\ninput_json\x18\x03 \x01(\t\x12\x11\n\tdata_json\x18\x04 \x01(\t\"Y\n\x0cGovernAction\x12\x13\n\x0b\x61\x63tion_type\x18\x01 \x01(\t\x12\x0f\n\x07message\x18\x02 \x01(\t\x12\x13\n\x0bparams_json\x18\x03 \x01(\t\x12\x0e\n\x06gating\x18\x04 \x01(\x08\"5\n\x0cGovernReason\x12\x0f\n\x07message\x18\x01 \x01(\t\x12\x14\n\x0c\x64\x65tails_json\x18\x02 \x01(\t\"2\n\x1bValidateGovernPolicyRequest\x12\x13\n\x0bpolicy_rego\x18\x01 \x01(\t\":\n\x15GovernValidationError\x12\x0f\n\x07message\x18\x01 \x01(\t\x12\x10\n\x08location\x18\x02 \x01(\t\"d\n\x1cValidateGovernPolicyResponse\x12\r\n\x05valid\x18\x01 \x01(\x08\x12\x35\n\x06\x65rrors\x18\x02 \x03(\x0b\x32%.glaz.govern.v1.GovernValidationError\"\x97\x01\n\x1b\x45valuateGovernPolicyRequest\x12\x0f\n\x07trigger\x18\x01 \x01(\t\x12\x12\n\ninput_json\x18\x02 \x01(\t\x12\x11\n\tdata_json\x18\x03 \x01(\t\x12\x11\n\tprincipal\x18\x04 \x01(\t\x12\x10\n\x08resource\x18\x05 \x01(\t\x12\x1b\n\x13store_authorization\x18\x06 \x01(\t\"]\n\x19ListGovernPoliciesRequest\x12\x0f\n\x07trigger\x18\x01 \x01(\t\x12\x12\n\ninput_json\x18\x02 \x01(\t\x12\x1b\n\x13store_authorization\x18\x03 \x01(\t\"\x97\x01\n\x13PolicyApplicability\x12\x11\n\tpolicy_id\x18\x01 \x01(\x04\x12\x0c\n\x04name\x18\x02 \x01(\t\x12\x34\n\rapplicability\x18\x03 \x01(\x0e\x32\x1d.glaz.govern.v1.Applicability\x12\x1a\n\x12missing_dimensions\x18\x04 \x03(\t\x12\r\n\x05\x65rror\x18\x05 \x01(\t\"S\n\x1aListGovernPoliciesResponse\x12\x35\n\x08policies\x18\x01 \x03(\x0b\x32#.glaz.govern.v1.PolicyApplicability\"\xa1\x01\n\x0ePolicyDecision\x12\x11\n\tpolicy_id\x18\x01 \x01(\x04\x12\x0f\n\x07matched\x18\x02 \x01(\x08\x12-\n\x07\x61\x63tions\x18\x03 \x03(\x0b\x32\x1c.glaz.govern.v1.GovernAction\x12-\n\x07reasons\x18\x04 \x03(\x0b\x32\x1c.glaz.govern.v1.GovernReason\x12\r\n\x05\x65rror\x18\x05 \x01(\t\"Q\n\x10GovernDiagnostic\x12,\n\x04kind\x18\x01 \x01(\x0e\x32\x1e.glaz.govern.v1.DiagnosticKind\x12\x0f\n\x07message\x18\x02 \x01(\t\"\xba\x01\n\x1c\x45valuateGovernPolicyResponse\x12\x31\n\tdecisions\x18\x01 \x03(\x0b\x32\x1e.glaz.govern.v1.PolicyDecision\x12\x1c\n\x14undecided_policy_ids\x18\x02 \x03(\x04\x12\x35\n\x0b\x64iagnostics\x18\x03 \x03(\x0b\x32 .glaz.govern.v1.GovernDiagnostic\x12\x12\n\nidentifier\x18\x04 \x01(\t*\x8a\x01\n\rApplicability\x12\x1d\n\x19\x41PPLICABILITY_UNSPECIFIED\x10\x00\x12\x19\n\x15\x41PPLICABILITY_APPLIES\x10\x01\x12 \n\x1c\x41PPLICABILITY_NOT_APPLICABLE\x10\x02\x12\x1d\n\x19\x41PPLICABILITY_MIGHT_APPLY\x10\x03*\x83\x01\n\x0e\x44iagnosticKind\x12\x1f\n\x1b\x44IAGNOSTIC_KIND_UNSPECIFIED\x10\x00\x12*\n&DIAGNOSTIC_KIND_INPUT_SCHEMA_VIOLATION\x10\x01\x12$\n DIAGNOSTIC_KIND_SCHEMA_NOT_FOUND\x10\x02\x42?Z=gitlab.com/gitlab-org/govern/glaz-client-go/governv1;governv1b\x06proto3"
 
 pool = ::Google::Protobuf::DescriptorPool.generated_pool
 pool.add_serialized_file(descriptor_data)
@@ -13,11 +13,21 @@ pool.add_serialized_file(descriptor_data)
 module Glaz
   module Govern
     module V1
-      EvaluateGovernPolicyRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.EvaluateGovernPolicyRequest").msgclass
       EvaluateGovernPolicyDebugRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.EvaluateGovernPolicyDebugRequest").msgclass
       GovernAction = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.GovernAction").msgclass
       GovernReason = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.GovernReason").msgclass
+      ValidateGovernPolicyRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.ValidateGovernPolicyRequest").msgclass
+      GovernValidationError = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.GovernValidationError").msgclass
+      ValidateGovernPolicyResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.ValidateGovernPolicyResponse").msgclass
+      EvaluateGovernPolicyRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.EvaluateGovernPolicyRequest").msgclass
+      ListGovernPoliciesRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.ListGovernPoliciesRequest").msgclass
+      PolicyApplicability = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.PolicyApplicability").msgclass
+      ListGovernPoliciesResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.ListGovernPoliciesResponse").msgclass
+      PolicyDecision = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.PolicyDecision").msgclass
+      GovernDiagnostic = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.GovernDiagnostic").msgclass
       EvaluateGovernPolicyResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.EvaluateGovernPolicyResponse").msgclass
+      Applicability = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.Applicability").enummodule
+      DiagnosticKind = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("glaz.govern.v1.DiagnosticKind").enummodule
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-glaz
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 2.0.0
 platform: ruby
 authors:
 - group::authorization
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-24 00:00:00.000000000 Z
+date: 2026-09-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: google-protobuf
@@ -116,14 +116,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.1'
+      version: '3.3'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.27
+rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
 summary: Ruby client for the GLAZ authorization engine