gitlab-labkit 4.3.0 → 4.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 63bc67bcb0041f919748393e6ace8e96d29bcd88e2c5b0e08b8baad8968670b1
-  data.tar.gz: 5bd9b55ece983433e125c7cd087030d740647101a48e9af1f97f1aa68ed51db4
+  metadata.gz: f25b6fb5022dbe4d1740df490b991da48f8d2d9432926a0c23ec41dcc566b1c0
+  data.tar.gz: 8e1fb5578809e9a87726e95d181fec9426c67c64aa5862e1ab6afd08d4ac5d20
 SHA512:
-  metadata.gz: 61d298ae9cb7c584d6e9979fbdb25fc112b705a8f1c0022825192e2759356408cbe6c03caf339ae5140220e325dc90532f24775a1f76decf1eb1547269cf3aba
-  data.tar.gz: 3755c6de56d994d081210d1cae48430d9938420c6ac33932ce672f3c20eee86457742ce75966bbd2163c09807a4b4e4c72e82579f8eba262e25cb1b79204ce1f
+  metadata.gz: dad133ba83a3e8e9b60825936befc9af2586bc80685b227c0517553c32681bd89ac42c0c9c2d7d68b3dd5865e2f54672ca4882711f7b71d92f67442af98abbb7
+  data.tar.gz: d0c781167401e351f2c0989cbdbb2d761886cc5f27b723d96d99228f33bb1a4f04b52af3669c8c655b512378f37842c09d920628abb9284212bf17a1e57d9b9e

data/lib/labkit/rate_limit/README.md

@@ -174,10 +174,17 @@ A `match` hash gates whether a rule applies. Each value is normalised through
 | `Regexp`          | `re`     | `match: { endpoint: %r{\A/api/} }`                     |
 | `{ eq: <value> }` | `eq`     | `match: { method: { eq: "POST" } }` (YAML-friendly)    |
 | `{ re: <source> }`| `re`     | `match: { endpoint: { re: '\A/api/' } }` (YAML-friendly) |
+| `{ oneOf: <Array> }` | `oneOf` | `match: { user: { oneOf: ["7", "42"] } }` (YAML-friendly) |
 
 `re` coerces the identifier value via `#to_s` before matching, so it can be
 used against non-String values (e.g. matching a 503 status against `{ re: '^5' }`).
 
+`oneOf` is set membership via `Set#include?` (`eql?`/`hash` equality, no
+coercion): it agrees with `eq` for Strings, Symbols, booleans, nil, and
+same-class numerics, but cross-type numerics differ (`1 == 1.0`, yet
+`{ oneOf: [1] }` does not match `1.0`). A bare Array is rejected; membership must
+be spelled `{ oneOf: [...] }` explicitly.
+
 Glob and prefix matchers are intentionally out of scope.
 
 ### Evaluation flow

data/lib/labkit/rate_limit/matcher.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "set"
+
 module Labkit
   module RateLimit
     # Matcher is the internal representation of a single key/value predicate in
@@ -11,6 +13,14 @@ module Labkit
     #   - a Regexp instance                              -> :re matcher (Ruby convenience)
     #   - { eq: <value> }                                -> :eq matcher (canonical, YAML-compatible)
     #   - { re: <String|Regexp> }                        -> :re matcher (canonical, YAML-compatible)
+    #   - { oneOf: <Array> }                             -> :oneOf matcher (set membership, YAML-compatible)
+    #
+    # A bare Array is rejected rather than treated as :oneOf, so a value that
+    # was meant as a single matcher hash but arrived as an Array fails loudly
+    # instead of silently becoming a membership test.
+    #
+    # :oneOf membership is Set#include? (eql?/hash equality), not :eq's ==, so
+    # cross-type numerics differ (1 == 1.0, but {oneOf: [1]} does not match 1.0).
     #
     # Hash-key naming follows the metrics-catalog selector pattern. Glob,
     # prefix, and other matcher kinds are intentionally out of scope here; see
@@ -20,7 +30,7 @@ module Labkit
     # the regex, so callers can match non-String identifier values such as
     # Integer status codes (e.g. {status: { re: "^5" }} against status: 503).
     class Matcher < Data.define(:type, :value)
-      KNOWN_HASH_KEYS = %i[eq re].freeze
+      KNOWN_HASH_KEYS = %i[eq re oneOf].freeze
       MAX_REGEX_SOURCE_LENGTH = 200
       ERROR_INSPECT_LIMIT = 80
 
@@ -42,18 +52,14 @@ module Labkit
         when Hash
           from_hash(input)
         when Array
-          raise ArgumentError,
-            "rate-limit match value must be a single-key Hash like {re: \"...\"} or {eq: ...}, got #{truncate_for_error(input)}"
+          raise ArgumentError, invalid_shape_error(input)
         else
           new(type: :eq, value: input)
         end
       end
 
       def self.from_hash(input)
-        if input.size != 1
-          raise ArgumentError,
-            "rate-limit match value must be a single-key Hash like {re: \"...\"} or {eq: ...}, got #{truncate_for_error(input)}"
-        end
+        raise ArgumentError, invalid_shape_error(input) if input.size != 1
 
         type, source = input.first
         type_sym = type.to_sym
@@ -71,6 +77,13 @@ module Labkit
         case type_sym
         when :eq
           new(type: :eq, value: source)
+        when :oneOf
+          unless source.is_a?(Array)
+            raise ArgumentError,
+              "rate-limit match value {oneOf: ...} must be an Array, got #{truncate_for_error(source)}"
+          end
+
+          new(type: :oneOf, value: Set.new(source).freeze)
         when :re
           if source.to_s.length > MAX_REGEX_SOURCE_LENGTH
             raise ArgumentError,
@@ -113,6 +126,12 @@ module Labkit
 
       private_class_method :with_match_timeout
 
+      def self.invalid_shape_error(input)
+        "rate-limit match value must be a single-key Hash like {re: \"...\"}, {eq: ...} or {oneOf: [...]}, " \
+          "got #{truncate_for_error(input)}"
+      end
+      private_class_method :invalid_shape_error
+
       def self.truncate_for_error(value)
         s = value.inspect
         s.length > ERROR_INSPECT_LIMIT ? "#{s[0, ERROR_INSPECT_LIMIT]}...(truncated)" : s
@@ -123,6 +142,8 @@ module Labkit
         case type
         when :eq
           value == identifier_value
+        when :oneOf
+          value.include?(identifier_value)
         when :re
           value.match?(identifier_value.to_s)
         else

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-labkit
 version: !ruby/object:Gem::Version
-  version: 4.3.0
+  version: 4.4.0
 platform: ruby
 authors:
 - Andrew Newdigate