gitlab-labkit 4.3.0 → 4.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 63bc67bcb0041f919748393e6ace8e96d29bcd88e2c5b0e08b8baad8968670b1
-  data.tar.gz: 5bd9b55ece983433e125c7cd087030d740647101a48e9af1f97f1aa68ed51db4
+  metadata.gz: 1e7ab6ac58c584a113159e7f42678f508078c83cdeb9a21c86a7f60a5c936b21
+  data.tar.gz: b4c3abaa02eafb546284dc68a08ba4443da4c1b13aa824c98f51e0dac3e749da
 SHA512:
-  metadata.gz: 61d298ae9cb7c584d6e9979fbdb25fc112b705a8f1c0022825192e2759356408cbe6c03caf339ae5140220e325dc90532f24775a1f76decf1eb1547269cf3aba
-  data.tar.gz: 3755c6de56d994d081210d1cae48430d9938420c6ac33932ce672f3c20eee86457742ce75966bbd2163c09807a4b4e4c72e82579f8eba262e25cb1b79204ce1f
+  metadata.gz: 1b032aa2876124669bf1eac1bc09cf67e79b4df4105e95fbc7d416132dd8d5bf1088c49e4c88b304e9a796e119edea60e4c2fae49a70aba050889a928b66b206
+  data.tar.gz: 91066213316a173023257e30507fdb8c7c0e4e0b360b91dd1efcafebbacd291c82f62e9470798aa86488ae991bb8f81b1c395856ee2e03b537e3ae5a244d78c3

data/.gitlab/CODEOWNERS

@@ -1 +1 @@
-* @reprazent @andrewn @mkaeppler @ayufan @hmerscher @d.barrett @splattael
+* @reprazent @andrewn @mkaeppler @ayufan @hmerscher @d.barrett @splattael @sankalp_gl @hardikgala @nindurkar @ashs2

data/CODEOWNERS

@@ -1,4 +1,4 @@
 # CODEOWNERS is used to lookup assignees for
 # Renovate Bot dependency change Merge Requests.
 # https://docs.renovatebot.com/configuration-options/#assigneesfromcodeowners
-* @reprazent @andrewn @mkaeppler @ayufan @hmerscher @d.barrett @splattael @e_forbes @M_Alvarez @mwoolf
+* @reprazent @andrewn @mkaeppler @ayufan @hmerscher @d.barrett @splattael @e_forbes @M_Alvarez @mwoolf @sankalp_gl @hardikgala @nindurkar @ashs2

data/lib/labkit/rate_limit/README.md

@@ -174,10 +174,17 @@ A `match` hash gates whether a rule applies. Each value is normalised through
 | `Regexp`          | `re`     | `match: { endpoint: %r{\A/api/} }`                     |
 | `{ eq: <value> }` | `eq`     | `match: { method: { eq: "POST" } }` (YAML-friendly)    |
 | `{ re: <source> }`| `re`     | `match: { endpoint: { re: '\A/api/' } }` (YAML-friendly) |
+| `{ oneOf: <Array> }` | `oneOf` | `match: { user: { oneOf: ["7", "42"] } }` (YAML-friendly) |
 
 `re` coerces the identifier value via `#to_s` before matching, so it can be
 used against non-String values (e.g. matching a 503 status against `{ re: '^5' }`).
 
+`oneOf` is set membership via `Set#include?` (`eql?`/`hash` equality, no
+coercion): it agrees with `eq` for Strings, Symbols, booleans, nil, and
+same-class numerics, but cross-type numerics differ (`1 == 1.0`, yet
+`{ oneOf: [1] }` does not match `1.0`). A bare Array is rejected; membership must
+be spelled `{ oneOf: [...] }` explicitly.
+
 Glob and prefix matchers are intentionally out of scope.
 
 ### Evaluation flow

data/lib/labkit/rate_limit/matcher.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "set"
+
 module Labkit
   module RateLimit
     # Matcher is the internal representation of a single key/value predicate in
@@ -11,6 +13,14 @@ module Labkit
     #   - a Regexp instance                              -> :re matcher (Ruby convenience)
     #   - { eq: <value> }                                -> :eq matcher (canonical, YAML-compatible)
     #   - { re: <String|Regexp> }                        -> :re matcher (canonical, YAML-compatible)
+    #   - { oneOf: <Array> }                             -> :oneOf matcher (set membership, YAML-compatible)
+    #
+    # A bare Array is rejected rather than treated as :oneOf, so a value that
+    # was meant as a single matcher hash but arrived as an Array fails loudly
+    # instead of silently becoming a membership test.
+    #
+    # :oneOf membership is Set#include? (eql?/hash equality), not :eq's ==, so
+    # cross-type numerics differ (1 == 1.0, but {oneOf: [1]} does not match 1.0).
     #
     # Hash-key naming follows the metrics-catalog selector pattern. Glob,
     # prefix, and other matcher kinds are intentionally out of scope here; see
@@ -20,7 +30,7 @@ module Labkit
     # the regex, so callers can match non-String identifier values such as
     # Integer status codes (e.g. {status: { re: "^5" }} against status: 503).
     class Matcher < Data.define(:type, :value)
-      KNOWN_HASH_KEYS = %i[eq re].freeze
+      KNOWN_HASH_KEYS = %i[eq re oneOf].freeze
       MAX_REGEX_SOURCE_LENGTH = 200
       ERROR_INSPECT_LIMIT = 80
 
@@ -29,11 +39,13 @@ module Labkit
       # unbounded elsewhere), and a timeout reaches Evaluator's fail-open
       # rescue, so the request goes unlimited.
       #
-      # 5ms is ~119x the slowest real match measured against GitLab's
-      # RackAttack path patterns on inputs up to 16KB (worst: 0.0419ms, none
-      # timed out). Re-measure if a rule ever needs nested quantifiers or
-      # backreferences, which are what make backtracking exponential.
-      MATCH_TIMEOUT_SECONDS = 0.005
+      # 50ms is a safety net against catastrophic backtracking, not a
+      # performance bound: real matches are far cheaper (median 0.087ms, worst
+      # 1.484ms across 6935 paths that timed out in production at 5ms). Those
+      # timeouts were wall-clock stalls, since Ruby counts real time and GC
+      # pauses on GitLab's git fleet have a p50 of ~72ms. Under 4x CPU
+      # oversubscription 50ms still fires on 0.16% of those matches, 5ms 1.33%.
+      MATCH_TIMEOUT_SECONDS = 0.05
 
       def self.build(input)
         case input
@@ -42,18 +54,14 @@ module Labkit
         when Hash
           from_hash(input)
         when Array
-          raise ArgumentError,
-            "rate-limit match value must be a single-key Hash like {re: \"...\"} or {eq: ...}, got #{truncate_for_error(input)}"
+          raise ArgumentError, invalid_shape_error(input)
         else
           new(type: :eq, value: input)
         end
       end
 
       def self.from_hash(input)
-        if input.size != 1
-          raise ArgumentError,
-            "rate-limit match value must be a single-key Hash like {re: \"...\"} or {eq: ...}, got #{truncate_for_error(input)}"
-        end
+        raise ArgumentError, invalid_shape_error(input) if input.size != 1
 
         type, source = input.first
         type_sym = type.to_sym
@@ -71,6 +79,13 @@ module Labkit
         case type_sym
         when :eq
           new(type: :eq, value: source)
+        when :oneOf
+          unless source.is_a?(Array)
+            raise ArgumentError,
+              "rate-limit match value {oneOf: ...} must be an Array, got #{truncate_for_error(source)}"
+          end
+
+          new(type: :oneOf, value: Set.new(source).freeze)
         when :re
           if source.to_s.length > MAX_REGEX_SOURCE_LENGTH
             raise ArgumentError,
@@ -113,6 +128,12 @@ module Labkit
 
       private_class_method :with_match_timeout
 
+      def self.invalid_shape_error(input)
+        "rate-limit match value must be a single-key Hash like {re: \"...\"}, {eq: ...} or {oneOf: [...]}, " \
+          "got #{truncate_for_error(input)}"
+      end
+      private_class_method :invalid_shape_error
+
       def self.truncate_for_error(value)
         s = value.inspect
         s.length > ERROR_INSPECT_LIMIT ? "#{s[0, ERROR_INSPECT_LIMIT]}...(truncated)" : s
@@ -123,6 +144,8 @@ module Labkit
         case type
         when :eq
           value == identifier_value
+        when :oneOf
+          value.include?(identifier_value)
         when :re
           value.match?(identifier_value.to_s)
         else

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-labkit
 version: !ruby/object:Gem::Version
-  version: 4.3.0
+  version: 4.4.1
 platform: ruby
 authors:
 - Andrew Newdigate