mecha_tenant 0.1.0

data/lib/mecha_tenant/controller.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module MechaTenant
+  module Controller
+    extend ActiveSupport::Concern
+
+    included do
+      if respond_to?(:helper_method)
+        helper_method :tenant_scope
+      end
+    end
+
+    class_methods do
+      def skip_tenant_enforcement!(only: nil, except: nil, reason:)
+        if reason.nil? || !reason.is_a?(String) || reason.strip.empty?
+          raise ArgumentError, "skip_tenant_enforcement! requires a non-empty 'reason:' string"
+        end
+
+        @mecha_tenant_skip_rules ||= []
+        rule = {
+          only: only ? Array(only).map(&:to_s) : nil,
+          except: except ? Array(except).map(&:to_s) : nil,
+          reason: reason.strip
+        }.freeze
+        @mecha_tenant_skip_rules << rule
+      end
+
+      def own_tenant_enforcement_rules
+        @mecha_tenant_skip_rules || []
+      end
+
+      def tenant_enforcement_rules
+        inherited = if superclass.respond_to?(:tenant_enforcement_rules)
+          superclass.tenant_enforcement_rules
+        else
+          []
+        end
+        inherited + own_tenant_enforcement_rules
+      end
+
+      def reset_tenant_enforcement_rules!
+        @mecha_tenant_skip_rules = []
+      end
+
+      def tenant_enforcement_skipped_for?(action_name)
+        !tenant_enforcement_reason_for(action_name).nil?
+      end
+
+      def tenant_enforcement_reason_for(action_name)
+        act = action_name.to_s
+        tenant_enforcement_rules.reverse_each do |rule|
+          if rule[:only]
+            return rule[:reason] if rule[:only].include?(act)
+          elsif rule[:except]
+            return rule[:reason] unless rule[:except].include?(act)
+          else
+            return rule[:reason]
+          end
+        end
+        nil
+      end
+    end
+
+    def tenant_scope(model_class)
+      tenant_method = MechaTenant.configuration.tenant_method
+      tenant = respond_to?(tenant_method, true) ? send(tenant_method) : nil
+      scope = MechaTenant.registry.scope_for(model_class, tenant)
+      @_mecha_tenant_scoped_models ||= []
+      @_mecha_tenant_scoped_models << model_class.to_s
+      scope
+    end
+
+    def mecha_tenant_scoped_models
+      @_mecha_tenant_scoped_models || []
+    end
+  end
+end

data/lib/mecha_tenant/errors.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module MechaTenant
+  module Errors
+    class Error < StandardError; end
+    class ConfigurationError < Error; end
+    class UnregisteredModelError < Error; end
+    class GlobalModelScopeError < Error; end
+    class TenantMissingError < Error; end
+    class UnscopedQueryError < Error; end
+  end
+
+  Error = Errors::Error
+  ConfigurationError = Errors::ConfigurationError
+  UnregisteredModelError = Errors::UnregisteredModelError
+  GlobalModelScopeError = Errors::GlobalModelScopeError
+  TenantMissingError = Errors::TenantMissingError
+  UnscopedQueryError = Errors::UnscopedQueryError
+end

data/lib/mecha_tenant/matrix_test.rb

@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+
+unless defined?(ActionDispatch::IntegrationTest)
+  app_test_helper = File.join(Dir.pwd, "test/test_helper.rb")
+  require app_test_helper if File.exist?(app_test_helper)
+end
+require "mecha_tenant"
+
+module MechaTenant
+  class MatrixTest < ActionDispatch::IntegrationTest
+    setup do
+      if MechaTenant.configuration.test_setup
+        instance_exec(&MechaTenant.configuration.test_setup)
+      end
+    end
+
+    teardown do
+      if MechaTenant.configuration.test_teardown
+        instance_exec(&MechaTenant.configuration.test_teardown)
+      end
+    end
+
+    test "static model registry and controller AST audit passes with zero violations" do
+      result = MechaTenant::Auditor::Static.new.audit
+
+      assert_empty result.unmapped_models, "Found unmapped models missing from config/mecha_tenant.yml: #{result.unmapped_models.inspect}"
+      assert_empty result.dead_models, "Found dead models in config/mecha_tenant.yml: #{result.dead_models.inspect}"
+      assert_empty result.missing_scopes, "Found missing/invalid scopes: #{result.missing_scopes.inspect}"
+      assert_empty result.dead_skip_rules, "Found dead skip_tenant_enforcement! rules: #{result.dead_skip_rules.inspect}"
+      assert_empty result.violations, "Found controller AST tenant violations:\n" +
+        result.violations.map { |v| "  - #{v.file}:#{v.line} [#{v.controller}##{v.method_name}] #{v.message}" }.join("\n")
+      assert result.success?
+    end
+
+    test "static AST auditor deterministically catches naked model queries and invalid tenant_scope calls" do
+      auditor = MechaTenant::Auditor::Static.new
+      tenant_model = MechaTenant.registry.tenant_models.keys.first
+      global_model = MechaTenant.registry.global_models.keys.first
+      return unless tenant_model && global_model
+
+      bad_source = <<~RUBY
+        class VulnerableController < ApplicationController
+          def show
+            @msg = #{tenant_model}.find(params[:id])
+            @opt = tenant_scope(#{global_model}).first
+            @ok_const = #{tenant_model}::SOME_CONSTANT
+            @ok_scoped = tenant_scope(#{tenant_model}).find(params[:id])
+          end
+        end
+      RUBY
+
+      dummy_class = Class.new(ApplicationController) do
+        def self.name
+          "VulnerableController"
+        end
+
+        def show; end
+      end
+
+      res = auditor.audit_source(bad_source, controller_class: dummy_class, file_path: "app/controllers/vulnerable_controller.rb")
+      violations = res[:violations]
+
+      assert_equal 2, violations.size
+      assert_equal :naked_model_reference, violations[0].kind
+      assert_equal tenant_model, violations[0].model
+      assert_equal 3, violations[0].line
+
+      assert_equal :global_model_in_tenant_scope, violations[1].kind
+      assert_equal global_model, violations[1].model
+      assert_equal 4, violations[1].line
+    end
+
+    def self.define_tenant_matrix_tests!
+      return if @tenant_matrix_tests_defined
+      @tenant_matrix_tests_defined = true
+
+      # 1. One test per registered tenant model for scope isolation
+      MechaTenant.registry.tenant_models.each_key do |model_name|
+        test "behavioral tenant scope isolation for model #{model_name}" do
+          ctx_proc = MechaTenant.configuration.test_matrix_context
+          assert_not_nil ctx_proc, "MechaTenant.configuration.test_matrix_context must be configured for behavioral matrix testing"
+
+          ctx = instance_exec(&ctx_proc)
+          prober = MechaTenant::Auditor::Prober.new(self)
+          result = prober.probe_single_model_scope(
+            model_name,
+            victim: ctx[:victim],
+            attacker: ctx[:attacker],
+            victim_records: ctx[:victim_records]
+          )
+
+          assert result.success?, "Model scope isolation failed for #{model_name}:\n" +
+            result.scope_failures.map { |f| "  - [#{f.model}]: #{f.message}" }.join("\n")
+        end
+      end
+
+      # 2. One test per enforced parameterized (:id) route for cross-tenant IDOR protection
+      enforced_id_audits = MechaTenant::Auditor::Prober.collect_enforced_id_audits
+      enforced_id_audits.each do |audit|
+        test "behavioral IDOR route isolation for #{audit.verb} #{audit.path} (#{audit.controller}##{audit.action})" do
+          ctx_proc = MechaTenant.configuration.test_matrix_context
+          assert_not_nil ctx_proc, "MechaTenant.configuration.test_matrix_context must be configured for behavioral matrix testing"
+
+          ctx = instance_exec(&ctx_proc)
+          prober = MechaTenant::Auditor::Prober.new(self)
+          result = prober.probe_single_idor_route(
+            audit,
+            victim_records: ctx[:victim_records],
+            ui_auth: ctx[:ui_auth],
+            api_auth: ctx[:api_auth]
+          )
+
+          assert result.success?, "Cross-tenant IDOR route prober failed for #{audit.verb} #{audit.path}:\n" +
+            result.route_failures.map { |f| "  - #{f.route} [#{f.target_model}]: #{f.message}" }.join("\n")
+        end
+      end
+    end
+
+    define_tenant_matrix_tests!
+  end
+end

data/lib/mecha_tenant/railtie.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+require "rails/railtie"
+
+module MechaTenant
+  class Railtie < Rails::Railtie
+    rake_tasks do
+      load File.expand_path("../tasks/mecha_tenant.rake", __dir__)
+    end
+  end
+end

data/lib/mecha_tenant/registry.rb

@@ -0,0 +1,157 @@
+# frozen_string_literal: true
+
+require "yaml"
+
+module MechaTenant
+  class Registry
+    VALID_CLASSIFICATIONS = %w[tenant global].freeze
+
+    attr_reader :models, :tenant_root, :colorization
+
+    def initialize(config_path_or_hash = nil, scopes = {})
+      @scopes = scopes.transform_keys(&:to_s)
+      @models = {}
+      @tenant_root = "User"
+      @colorization = {}
+
+      if config_path_or_hash.is_a?(Hash)
+        load_from_hash(config_path_or_hash)
+      elsif config_path_or_hash
+        load_from_file(config_path_or_hash)
+      end
+    end
+
+    def load_from_file(path)
+      raise ConfigurationError, "Tenancy configuration file missing: #{path}" unless File.exist?(path)
+
+      data = begin
+        YAML.load_file(path)
+      rescue => e
+        raise ConfigurationError, "Invalid YAML syntax in #{path}: #{e.message}"
+      end
+
+      load_from_hash(data)
+    end
+
+    def load_from_hash(data)
+      unless data.is_a?(Hash) && data.key?("models") && data["models"].is_a?(Array)
+        raise ConfigurationError, "Tenancy config must have a top-level 'models' list"
+      end
+
+      @tenant_root = data["tenant_root"].to_s.strip if data["tenant_root"].present?
+      @models = {}
+
+      data["models"].each_with_index do |entry, idx|
+        validate_model_entry!(entry, idx)
+        model_name = entry["model"].strip
+        if @models.key?(model_name)
+          raise ConfigurationError, "Duplicate model entry '#{model_name}' in tenancy configuration"
+        end
+
+        @models[model_name] = {
+          model: model_name,
+          classification: entry["classification"].to_sym,
+          ownership: entry["ownership"]&.to_s&.strip,
+          notes: entry["notes"]&.to_s&.strip
+        }.freeze
+      end
+
+      if data["debug_colorization"].is_a?(Hash)
+        @colorization = data["debug_colorization"].transform_keys(&:to_sym).transform_values do |v|
+          v.to_s.sub(/^:/, "").to_sym
+        end
+      end
+
+      @models.freeze
+      self
+    end
+
+    def registered?(model_or_name)
+      @models.key?(normalize_model_name(model_or_name))
+    end
+
+    def model_entry(model_or_name)
+      @models[normalize_model_name(model_or_name)]
+    end
+
+    def tenant_model?(model_or_name)
+      entry = model_entry(model_or_name)
+      entry ? entry[:classification] == :tenant : false
+    end
+
+    def global_model?(model_or_name)
+      entry = model_entry(model_or_name)
+      entry ? entry[:classification] == :global : false
+    end
+
+    def tenant_models
+      @models.select { |_k, v| v[:classification] == :tenant }
+    end
+
+    def global_models
+      @models.select { |_k, v| v[:classification] == :global }
+    end
+
+    def scope_defined?(model_or_name)
+      @scopes.key?(normalize_model_name(model_or_name))
+    end
+
+    def scope_for(model_or_name, tenant)
+      name = normalize_model_name(model_or_name)
+      entry = @models[name]
+
+      if entry.nil?
+        raise UnregisteredModelError, "Model '#{name}' is not registered in MechaTenant configuration"
+      end
+
+      if entry[:classification] == :global
+        raise GlobalModelScopeError, "Model '#{name}' is classified as :global and cannot be queried via tenant_scope"
+      end
+
+      raise TenantMissingError, "Cannot resolve tenant_scope(#{name}) when current tenant is nil" if tenant.nil?
+
+      resolver = @scopes[name]
+      if resolver.nil?
+        raise ConfigurationError, "No scope resolver defined for tenant model '#{name}'"
+      end
+
+      resolver.call(tenant)
+    end
+
+    private
+
+    def normalize_model_name(model_or_name)
+      case model_or_name
+      when Class, Module
+        model_or_name.name.to_s
+      else
+        model_or_name.to_s
+      end
+    end
+
+    def validate_model_entry!(entry, idx)
+      unless entry.is_a?(Hash)
+        raise ConfigurationError, "Tenancy model entry at index #{idx} must be a Hash"
+      end
+
+      model_name = entry["model"]
+      unless model_name.is_a?(String) && !model_name.strip.empty?
+        raise ConfigurationError, "Tenancy model entry at index #{idx} must have a non-empty string for 'model'"
+      end
+
+      classification = entry["classification"]
+      unless classification.is_a?(String) && VALID_CLASSIFICATIONS.include?(classification)
+        raise ConfigurationError,
+              "Tenancy model '#{model_name}' at index #{idx} must have classification in #{VALID_CLASSIFICATIONS.inspect}, got #{classification.inspect}"
+      end
+
+      if classification == "tenant"
+        ownership = entry["ownership"]
+        unless ownership.is_a?(String) && !ownership.strip.empty?
+          raise ConfigurationError,
+                "Tenancy model '#{model_name}' (classification: tenant) must explicitly declare 'ownership'"
+        end
+      end
+    end
+  end
+end

data/lib/mecha_tenant/version.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+module MechaTenant
+  VERSION = "0.1.0"
+  Version = VERSION
+end

data/lib/mecha_tenant.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require_relative "mecha_tenant/version"
+require_relative "mecha_tenant/errors"
+require_relative "mecha_tenant/configuration"
+require_relative "mecha_tenant/registry"
+require_relative "mecha_tenant/controller"
+require_relative "mecha_tenant/auditor/static"
+require_relative "mecha_tenant/auditor/prober"
+require_relative "mecha_tenant/railtie" if defined?(Rails::Railtie)
+
+module MechaTenant
+  class << self
+    def configuration
+      @configuration ||= Configuration.new
+    end
+
+    def configure
+      yield(configuration) if block_given?
+      reload!
+    end
+
+    def reset_configuration!
+      @configuration = Configuration.new
+      @registry = nil
+    end
+
+    def registry
+      @registry ||= Registry.new(configuration.config_path, configuration.scopes)
+    end
+
+    def reload!
+      @registry = Registry.new(configuration.config_path, configuration.scopes)
+    end
+  end
+end

data/lib/tasks/mecha_tenant.rake

@@ -0,0 +1,166 @@
+# frozen_string_literal: true
+
+require "tiny_color"
+require_relative "../mecha_tenant"
+
+class String
+  def dark_grey
+    respond_to?(:grey) ? grey : self
+  end unless method_defined?(:dark_grey)
+
+  def dark_gray
+    respond_to?(:gray) ? gray : self
+  end unless method_defined?(:dark_gray)
+end
+
+desc "Print all models and controller actions with their MechaTenant isolation controls"
+task mecha_tenant: :environment do
+  auditor = MechaTenant::Auditor::Static.new
+  result = auditor.audit
+  colors = MechaTenant.configuration.debug_colorization
+
+  colorize = ->(text, key) {
+    color = colors[key]
+    if color && text.respond_to?(color)
+      text.send(color)
+    else
+      text
+    end
+  }
+
+  puts "=== Model Tenancy Registry ==="
+  all_model_names = result.mapped_models.map { |m| m[:model] } + result.unmapped_models
+  max_model_len = [all_model_names.map(&:length).max || 5, 5].max
+  max_class_len = 14
+
+  puts sprintf("%-#{max_model_len}s  %-#{max_class_len}s  %s", "Model", "Classification", "Ownership")
+
+  result.mapped_models.each do |entry|
+    cls_sym = entry[:classification]
+    padded_model = sprintf("%-#{max_model_len}s", entry[:model])
+    padded_class = sprintf("%-#{max_class_len}s", cls_sym.to_s.upcase)
+    ownership = entry[:ownership] || (cls_sym == :global ? "(global/system)" : "-")
+
+    puts sprintf(
+      "%s  %s  %s",
+      colorize.call(padded_model, cls_sym),
+      colorize.call(padded_class, cls_sym),
+      ownership
+    )
+  end
+
+  result.unmapped_models.each do |model_name|
+    padded_model = sprintf("%-#{max_model_len}s", model_name)
+    padded_class = sprintf("%-#{max_class_len}s", "UNMAPPED")
+    puts sprintf(
+      "%s  %s  %s",
+      colorize.call(padded_model, :unmapped),
+      colorize.call(padded_class, :unmapped),
+      "MISSING FROM config/mecha_tenant.yml"
+    )
+  end
+
+  puts "\n=== Controller Action Tenancy Enforcement ==="
+  audits = result.action_audits
+  max_verb_len = [audits.map { |a| a.verb.to_s.length }.max || 4, 4].max
+  max_path_len = [audits.map { |a| a.path.to_s.length }.max || 11, 11].max
+  max_target_len = [audits.map { |a| "#{a.controller}##{a.action}".length }.max || 17, 17].max
+  max_status_len = 9
+
+  puts sprintf(
+    "%-#{max_verb_len}s  %-#{max_path_len}s  %-#{max_target_len}s  %-#{max_status_len}s  %s",
+    "Verb",
+    "URI Pattern",
+    "Controller#Action",
+    "Status",
+    "Scoping / Reason"
+  )
+
+  audits.each do |a|
+    padded_verb = sprintf("%-#{max_verb_len}s", a.verb)
+    padded_path = sprintf("%-#{max_path_len}s", a.path)
+    padded_target = sprintf("%-#{max_target_len}s", "#{a.controller}##{a.action}")
+    padded_status = sprintf("%-#{max_status_len}s", a.status.to_s.upcase)
+
+    detail = case a.status
+    when :skipped
+      "SKIP: #{a.skip_reason}"
+    when :violation
+      "VIOLATION"
+    else
+      a.scopes_used.any? ? a.scopes_used.join(", ") : "(no model queries)"
+    end
+
+    puts sprintf(
+      "%s  %s  %s  %s  %s",
+      padded_verb,
+      colorize.call(padded_path, a.status),
+      padded_target,
+      colorize.call(padded_status, a.status),
+      detail
+    )
+  end
+end
+
+namespace :mecha_tenant do
+  namespace :verify do
+    desc "Statically verify model tenancy registry parity and strict controller lookup scoping"
+    task static: :environment do
+      puts "Running MechaTenant static model & controller AST audit..."
+      auditor = MechaTenant::Auditor::Static.new
+      result = auditor.audit
+
+      tenant_count = result.mapped_models.count { |m| m[:classification] == :tenant }
+      global_count = result.mapped_models.count { |m| m[:classification] == :global }
+      enforced_count = result.action_audits.count { |a| a.status == :enforced }
+      skipped_count = result.action_audits.count { |a| a.status == :skipped }
+
+      puts "  -> #{result.mapped_models.size} models registered (#{tenant_count} tenant, #{global_count} global)"
+      puts "  -> #{result.action_audits.size} controller routes audited (#{enforced_count} enforced, #{skipped_count} explicitly skipped)"
+
+      if result.unmapped_models.any?
+        puts "\nERROR: Found #{result.unmapped_models.size} unmapped model(s) missing from config/mecha_tenant.yml:".light_red
+        result.unmapped_models.each { |m| puts "  - #{m}" }
+      end
+
+      if result.dead_models.any?
+        puts "\nERROR: Found #{result.dead_models.size} dead/stale model(s) in config/mecha_tenant.yml:".light_red
+        result.dead_models.each { |m| puts "  - #{m}" }
+      end
+
+      if result.missing_scopes.any?
+        puts "\nERROR: Found #{result.missing_scopes.size} model scope configuration error(s):".light_red
+        result.missing_scopes.each { |err| puts "  - #{err}" }
+      end
+
+      if result.dead_skip_rules.any?
+        puts "\nERROR: Found #{result.dead_skip_rules.size} dead skip_tenant_enforcement! rule(s):".light_red
+        result.dead_skip_rules.each { |dr| puts "  - #{dr[:file]}: #{dr[:message]}" }
+      end
+
+      if result.violations.any?
+        puts "\nERROR: Found #{result.violations.size} unscoped model reference violation(s) in controllers:".light_red
+        result.violations.each do |v|
+          puts "  - #{v.file}:#{v.line} [#{v.controller}##{v.method_name}] #{v.message}"
+          puts "      #{v.snippet}"
+        end
+      end
+
+      if result.success?
+        puts "\n✓ Static tenant isolation audit passed: 0 unmapped models, 0 dead rules, 0 controller violations.".green
+      else
+        abort("\n✗ Static tenant isolation audit failed. Please resolve the errors above.")
+      end
+    end
+
+    desc "Run behavioral cross-tenant scope and IDOR route matrix test suite"
+    task behavioral: :environment do
+      puts "Running MechaTenant behavioral cross-tenant isolation matrix test suite..."
+      matrix_test_path = File.expand_path("../mecha_tenant/matrix_test.rb", __dir__)
+      system({ "MECHA_MATRIX_STANDALONE" => "1" }, "bin/rails", "test", matrix_test_path) || abort("Behavioral tenant verification failed.")
+    end
+  end
+
+  desc "Run both static AST/registry verification and behavioral cross-tenant IDOR verification"
+  task verify: %w[verify:static verify:behavioral]
+end

metadata

@@ -0,0 +1,99 @@
+--- !ruby/object:Gem::Specification
+name: mecha_tenant
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Jeff Lunt
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: activesupport
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.0'
+- !ruby/object:Gem::Dependency
+  name: prism
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: tiny_color
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: MechaTenant enforces strict tenant isolation in Rails applications via
+  a YAML model classification registry, explicit tenant_scope helpers, Prism AST static
+  analysis of controllers, and behavioral IDOR route probing.
+email:
+- jefflunt@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- README.md
+- Rakefile
+- lib/mecha_tenant.rb
+- lib/mecha_tenant/auditor/prober.rb
+- lib/mecha_tenant/auditor/static.rb
+- lib/mecha_tenant/configuration.rb
+- lib/mecha_tenant/controller.rb
+- lib/mecha_tenant/errors.rb
+- lib/mecha_tenant/matrix_test.rb
+- lib/mecha_tenant/railtie.rb
+- lib/mecha_tenant/registry.rb
+- lib/mecha_tenant/version.rb
+- lib/tasks/mecha_tenant.rake
+homepage: https://github.com/jefflunt/mecha_tenant
+licenses:
+- MIT
+metadata: {}
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.2.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.16
+specification_version: 4
+summary: Closed-by-default multi-tenant model registry, AST controller auditing, and
+  IDOR probing for Rails
+test_files: []