optify-config 1.23.2 → 1.24.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fadc349edb550af2e368cedcc7f780a2161d5792d3ade921330152d07f929d06
-  data.tar.gz: dc6102db73935e39aa616d3b343ca26cd25aca80747e593febc9b105c2131ed3
+  metadata.gz: f295ac7d00dec19d6aac47bdd92452ec0768181e482a24fdcc5de2d85900df31
+  data.tar.gz: 9429b9927048c2fb85c7343a839b78947212ba6192091852d9a30bcbd8078420
 SHA512:
-  metadata.gz: 8ee7afa6b34837298f6e799535a30072a21a3576a6e6034ba02585973876d0fb0149df4f8b5075a6f38e781af4f18d11077b126d22e547ca4430c77a2e9fa9aa
-  data.tar.gz: ac4f7dc243e5e9ef479ae781d52c9d7e8af6549b5e974b672cf5b7925202b5236face81216b9a089561f0129aaffe7f96cf5b7b51cc8fd0ac4825e1f5b541bab
+  metadata.gz: 3225dcc9006955335b31f0cfa934c97c9460fad48b2adfc5521a2a21597047f9057fc057c6f9699660d4bdee4346b0d827e73e7bd7a1af338cb9f974cde0d42c
+  data.tar.gz: 80247e4b63f23e9625365c39e725dbfe4976135a08ec7ec8c497c0be3bbf197ea5437448971b181c1b6255c13198341790f0f4dc003bb0056423f76592cf7881

data/ext/optify_ruby/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "optify_ruby"
-version = "0.24.3"
+version = "0.25.0"
 edition = "2021"
 
 description = "optify bindings for Ruby"
@@ -22,6 +22,6 @@ crate-type = ["cdylib"]
 [dependencies]
 magnus = "0.8.2"
 # Can't put a relative path here because then others can't install the source gem: https://github.com/juharris/optify/pull/176
-optify = "1.3.3"
+optify = "1.4.0"
 rb-sys = { version = "0.9.124", default-features = false, features = ["ruby-static"] }
 serde_json = "1.0.149"

data/ext/optify_ruby/src/lib.rs

@@ -17,18 +17,29 @@ use crate::preferences::MutGetOptionsPreferences;
 mod preferences;
 
 const UNKNOWN_FEATURE_PATTERN: &str = "is not a known feature.";
+const POLICY_DENIED_PATTERN: &str = "is not permitted to use feature";
 
 fn get_unknown_feature_error(ruby: &Ruby) -> Result<ExceptionClass, magnus::Error> {
     let module: RModule = ruby.class_object().const_get("Optify")?;
     module.const_get("UnknownFeatureError")
 }
 
+fn get_policy_denied_error(ruby: &Ruby) -> Result<ExceptionClass, magnus::Error> {
+    let module: RModule = ruby.class_object().const_get("Optify")?;
+    module.const_get("PolicyDeniedError")
+}
+
 fn map_feature_error(ruby: &Ruby, error: String) -> magnus::Error {
     if error.contains(UNKNOWN_FEATURE_PATTERN) {
         match get_unknown_feature_error(ruby) {
             Ok(exception_class) => magnus::Error::new(exception_class, error),
             Err(_) => magnus::Error::new(ruby.exception_runtime_error(), error),
         }
+    } else if error.contains(POLICY_DENIED_PATTERN) {
+        match get_policy_denied_error(ruby) {
+            Ok(exception_class) => magnus::Error::new(exception_class, error),
+            Err(_) => magnus::Error::new(ruby.exception_runtime_error(), error),
+        }
     } else {
         magnus::Error::new(ruby.exception_runtime_error(), error)
     }
@@ -115,6 +126,19 @@ impl WrappedOptionsProvider {
         }
     }
 
+    fn check_policies(
+        ruby: &Ruby,
+        rb_self: &Self,
+        requester: String,
+        feature_names: Vec<String>,
+    ) -> Result<(), magnus::Error> {
+        rb_self
+            .0
+            .borrow()
+            .check_policies(&requester, &feature_names, None)
+            .map_err(|e| map_feature_error(ruby, e))
+    }
+
     fn get_aliases(&self) -> Vec<String> {
         self.0.borrow().get_aliases()
     }
@@ -291,6 +315,13 @@ impl WrappedOptionsProvider {
         self.0.borrow().has_conditions(&canonical_feature_name)
     }
 
+    fn get_policies_json(&self, canonical_feature_name: String) -> Option<String> {
+        self.0
+            .borrow()
+            .get_policies(&canonical_feature_name)
+            .map(|p| serde_json::to_string(&p).unwrap())
+    }
+
     fn map_feature_names(
         ruby: &Ruby,
         rb_self: &Self,
@@ -380,6 +411,19 @@ impl WrappedOptionsWatcher {
         }
     }
 
+    fn check_policies(
+        ruby: &Ruby,
+        rb_self: &Self,
+        requester: String,
+        feature_names: Vec<String>,
+    ) -> Result<(), magnus::Error> {
+        rb_self
+            .0
+            .borrow()
+            .check_policies(&requester, &feature_names, None)
+            .map_err(|e| map_feature_error(ruby, e))
+    }
+
     fn get_aliases(&self) -> Vec<String> {
         self.0.borrow().get_aliases()
     }
@@ -552,6 +596,13 @@ impl WrappedOptionsWatcher {
         self.0.borrow().has_conditions(&canonical_feature_name)
     }
 
+    fn get_policies_json(&self, canonical_feature_name: String) -> Option<String> {
+        self.0
+            .borrow()
+            .get_policies(&canonical_feature_name)
+            .map(|p| serde_json::to_string(&p).unwrap())
+    }
+
     fn last_modified(&self) -> std::time::SystemTime {
         self.0.borrow().last_modified()
     }
@@ -607,6 +658,7 @@ fn init(ruby: &Ruby) -> Result<(), magnus::Error> {
     let module = ruby.define_module("Optify")?;
 
     module.define_error("UnknownFeatureError", ruby.exception_standard_error())?;
+    module.define_error("PolicyDeniedError", ruby.exception_standard_error())?;
 
     let builder_class = module.define_class("OptionsProviderBuilder", ruby.class_object())?;
 
@@ -636,6 +688,10 @@ fn init(ruby: &Ruby) -> Result<(), magnus::Error> {
         ),
     )?;
     provider_class.define_method("aliases", method!(WrappedOptionsProvider::get_aliases, 0))?;
+    provider_class.define_private_method(
+        "_check_policies",
+        method!(WrappedOptionsProvider::check_policies, 2),
+    )?;
     provider_class.define_method("features", method!(WrappedOptionsProvider::get_features, 0))?;
     provider_class.define_method(
         "features_and_aliases",
@@ -695,6 +751,10 @@ fn init(ruby: &Ruby) -> Result<(), magnus::Error> {
         "get_feature_metadata_json",
         method!(WrappedOptionsProvider::get_feature_metadata_json, 1),
     )?;
+    provider_class.define_private_method(
+        "get_policies_json",
+        method!(WrappedOptionsProvider::get_policies_json, 1),
+    )?;
 
     let get_options_preferences_class =
         module.define_class("GetOptionsPreferences", ruby.class_object())?;
@@ -757,6 +817,22 @@ fn init(ruby: &Ruby) -> Result<(), magnus::Error> {
         "skip_feature_name_conversion",
         method!(MutGetOptionsPreferences::skip_feature_name_conversion, 0),
     )?;
+    get_options_preferences_class.define_method(
+        "requester=",
+        method!(MutGetOptionsPreferences::set_requester, 1),
+    )?;
+    get_options_preferences_class.define_method(
+        "requester",
+        method!(MutGetOptionsPreferences::get_requester, 0),
+    )?;
+    get_options_preferences_class.define_method(
+        "raise_if_policy_denied=",
+        method!(MutGetOptionsPreferences::set_raise_if_policy_denied, 1),
+    )?;
+    get_options_preferences_class.define_method(
+        "raise_if_policy_denied",
+        method!(MutGetOptionsPreferences::get_raise_if_policy_denied, 0),
+    )?;
 
     let watcher_builder_class =
         module.define_class("OptionsWatcherBuilder", ruby.class_object())?;
@@ -784,6 +860,10 @@ fn init(ruby: &Ruby) -> Result<(), magnus::Error> {
         function!(WrappedOptionsWatcher::build_from_directories_with_schema, 2),
     )?;
     watcher_class.define_method("aliases", method!(WrappedOptionsWatcher::get_aliases, 0))?;
+    watcher_class.define_private_method(
+        "_check_policies",
+        method!(WrappedOptionsWatcher::check_policies, 2),
+    )?;
     watcher_class.define_method("features", method!(WrappedOptionsWatcher::get_features, 0))?;
     watcher_class.define_method(
         "features_and_aliases",
@@ -847,6 +927,10 @@ fn init(ruby: &Ruby) -> Result<(), magnus::Error> {
         "get_feature_metadata_json",
         method!(WrappedOptionsWatcher::get_feature_metadata_json, 1),
     )?;
+    watcher_class.define_private_method(
+        "get_policies_json",
+        method!(WrappedOptionsWatcher::get_policies_json, 1),
+    )?;
 
     Ok(())
 }

data/ext/optify_ruby/src/preferences.rs

@@ -71,4 +71,22 @@ impl MutGetOptionsPreferences {
     pub fn skip_feature_name_conversion(&self) -> bool {
         self.0.borrow().skip_feature_name_conversion
     }
+
+    // Requester Section
+    pub fn set_requester(&self, requester: Option<String>) {
+        self.0.borrow_mut().requester = requester;
+    }
+
+    pub fn get_requester(&self) -> Option<String> {
+        self.0.borrow().requester.clone()
+    }
+
+    // Policy Section
+    pub fn set_raise_if_policy_denied(&self, value: bool) {
+        self.0.borrow_mut().raise_if_policy_denied = value;
+    }
+
+    pub fn get_raise_if_policy_denied(&self) -> bool {
+        self.0.borrow().raise_if_policy_denied
+    }
 }

data/lib/optify_ruby/policies.rb

@@ -0,0 +1,33 @@
+# typed: true
+# frozen_string_literal: true
+
+require 'sorbet-runtime'
+
+require 'optify-from_hash'
+
+module Optify
+  # The policy for the requester identifier passed via preferences.
+  #
+  # Either `allow` or `block` will be set, not both.
+  # - `allow`: only the listed requesters may use the feature; can be empty.
+  # - `block`: the listed requesters may not use the feature; all others are allowed.
+  class RequesterPolicy < FromHashable
+    extend T::Sig
+
+    sig { returns(T.nilable(T::Set[String])) }
+    attr_reader :allow
+
+    sig { returns(T.nilable(T::Set[String])) }
+    attr_reader :block
+  end
+
+  # Policies that restrict access to a feature based on values in the request's preferences.
+  #
+  # See https://github.com/juharris/optify#policies for details.
+  class Policies < FromHashable
+    extend T::Sig
+
+    sig { returns(T.nilable(RequesterPolicy)) }
+    attr_reader :requester
+  end
+end

data/lib/optify_ruby/provider_module.rb

@@ -5,9 +5,27 @@ require 'json'
 require 'lru_redux'
 require 'sorbet-runtime'
 
+require_relative './policies'
+
 module Optify
   # @!visibility private
-  module ProviderModule
+  module ProviderModule # rubocop:disable Metrics/ModuleLength
+    #: (String, Array[String], ?CacheOptions?) -> void
+    def check_policies(requester, feature_names, cache_options = nil)
+      if cache_options
+        init unless @cache
+        ProviderModule._cache_getset(
+          @cache, #: as !nil
+          [:check_policies, feature_names, requester],
+          cache_options.on_cache_event,
+        ) do
+          _check_policies(requester, feature_names)
+        end
+      else
+        _check_policies(requester, feature_names)
+      end
+    end
+
     #: [T] (LruRedux::Cache | Hash[Array[untyped], T], Array[untyped], (^(Array[untyped] key, T value, bool is_cache_hit) -> void)?) { -> T } -> T
     def self._cache_getset(cache, cache_key, on_cache_event, &block)
       is_cache_hit = true #: bool
@@ -69,6 +87,14 @@ module Optify
       OptionsMetadata.from_hash(JSON.parse(metadata_json))
     end
 
+    #: (String canonical_feature_name) -> Optify::Policies?
+    def get_policies(canonical_feature_name)
+      policies_json = get_policies_json(canonical_feature_name)
+      return nil if policies_json.nil?
+
+      Policies.from_hash(JSON.parse(policies_json))
+    end
+
     private
 
     #: -> Hash[String, OptionsMetadata]

data/rbi/optify.rbi

@@ -7,6 +7,31 @@ module Optify
   class UnknownFeatureError < StandardError
   end
 
+  # The policy for the requester identifier passed via preferences.
+  #
+  # Either `allow` or `block` will be set, not both.
+  # - `allow`: only the listed requesters may use the feature; can be empty.
+  # - `block`: the listed requesters may not use the feature; all others are allowed.
+  class RequesterPolicy < FromHashable
+    sig { returns(T.nilable(T::Set[String])) }
+    attr_reader :allow
+
+    sig { returns(T.nilable(T::Set[String])) }
+    attr_reader :block
+  end
+
+  # Policies that restrict access to a feature based on values in the request's preferences.
+  #
+  # See https://github.com/juharris/optify#policies for details.
+  class Policies < FromHashable
+    sig { returns(T.nilable(RequesterPolicy)) }
+    attr_reader :requester
+  end
+
+  # Raised when a requester is not permitted to use a feature due to its policies.
+  class PolicyDeniedError < StandardError
+  end
+
   # DEPRECATED: Use `Optify::FromHashable` instead.
   # A base class for classes from configuration files.
   # Classes that derive from this can easily be used with `Optify::OptionsProvider.get_options`
@@ -162,6 +187,22 @@ module Optify
 
     sig { returns(T::Boolean) }
     def skip_feature_name_conversion; end
+
+    # The requester identifier to use for policy enforcement.
+    # If not set, policy checks are bypassed.
+    sig { params(value: T.nilable(String)).void }
+    def requester=(value); end
+
+    sig { returns(T.nilable(String)) }
+    def requester; end
+
+    # When `true`, raises `PolicyDeniedError` if a feature is not permitted for the requester.
+    # When `false` (default), denied features are silently filtered out.
+    sig { params(value: T::Boolean).void }
+    def raise_if_policy_denied=(value); end
+
+    sig { returns(T::Boolean) }
+    def raise_if_policy_denied; end
   end
 
   # A registry of features that provides configurations.
@@ -233,6 +274,19 @@ module Optify
   # Some of the methods shown within this module are implemented in Rust
   # and are declared in this common module to avoid duplicate declarations in different classes.
   module ProviderModule
+    # Checks policies for a list of features for the given requester.
+    # Returns `nil` if there are no policy issues (or no policies defined).
+    # Raises `Optify::PolicyDeniedError` if any of the features are not allowed for the requester.
+    sig do
+      params(
+        requester: String,
+        feature_names: T::Array[String],
+        cache_options: T.nilable(CacheOptions),
+      )
+        .returns(T.nilable(String))
+    end
+    def check_policies(requester, feature_names, cache_options = nil); end
+
     # @param canonical_feature_name [String] A canonical feature name
     # @return Whether the feature has conditions.
     sig { params(canonical_feature_name: String).returns(T::Boolean) }
@@ -358,8 +412,22 @@ module Optify
     end
     def map_feature_names(feature_names, preferences); end
 
+    # @return The policies for the feature, or `nil` if the feature has no policies.
+    sig { params(canonical_feature_name: String).returns(T.nilable(Optify::Policies)) }
+    def get_policies(canonical_feature_name); end
+
     private
 
+    # Rust implementation.
+    sig do
+      params(
+        requester: String,
+        feature_names: T::Array[String],
+      )
+        .returns(T.nilable(String))
+    end
+    def _check_policies(requester, feature_names); end
+
     # Map aliases or canonical feature names (perhaps derived from a file names) to the canonical feature names.
     # Canonical feature names map to themselves.
     # This implementation calls the Rust implementation directly.
@@ -372,6 +440,10 @@ module Optify
     # @return The metadata for the feature.
     sig { params(canonical_feature_name: String).returns(T.nilable(String)) }
     def get_feature_metadata_json(canonical_feature_name); end
+
+    # @return The policies for the feature as JSON, or `nil` if the feature has no policies.
+    sig { params(canonical_feature_name: String).returns(T.nilable(String)) }
+    def get_policies_json(canonical_feature_name); end
   end
 
   # Provides configurations based on keys and enabled feature names.

data/sig/optify.rbs

@@ -6,6 +6,24 @@ end
 class Optify::UnknownFeatureError < StandardError
 end
 
+# The policy for the requester identifier passed via preferences.
+#
+# Either `allow` or `block` will be set, not both.
+# - `allow`: only the listed requesters may use the feature; can be empty.
+# - `block`: the listed requesters may not use the feature; all others are allowed.
+class Optify::RequesterPolicy < FromHashable
+end
+
+# Policies that restrict access to a feature based on values in the request's preferences.
+#
+# See https://github.com/juharris/optify#policies for details.
+class Optify::Policies < FromHashable
+end
+
+# Raised when a requester is not permitted to use a feature due to its policies.
+class Optify::PolicyDeniedError < StandardError
+end
+
 # DEPRECATED: Use `Optify::FromHashable` instead.
 # A base class for classes from configuration files.
 # Classes that derive from this can easily be used with `Optify::OptionsProvider.get_options`
@@ -18,7 +36,10 @@ end
 
 # Options for caching.
 class Optify::CacheOptions
-  def initialize: () -> (^(::Array[untyped] key, untyped value, bool is_cache_hit) -> void)?
+  def initialize: () -> ::Set[String]?
+                | () -> ::Set[String]?
+                | () -> RequesterPolicy?
+                | () -> (^(::Array[untyped] key, untyped value, bool is_cache_hit) -> void)?
                 | (?on_cache_event: (^(::Array[untyped] key, untyped value, bool is_cache_hit) -> void)? on_cache_event) -> void
 end
 
@@ -100,6 +121,18 @@ class Optify::GetOptionsPreferences
   def skip_feature_name_conversion=: (bool value) -> void
 
   def skip_feature_name_conversion: () -> bool
+
+  # The requester identifier to use for policy enforcement.
+  # If not set, policy checks are bypassed.
+  def requester=: (String? value) -> void
+
+  def requester: () -> String?
+
+  # When `true`, raises `PolicyDeniedError` if a feature is not permitted for the requester.
+  # When `false` (default), denied features are silently filtered out.
+  def raise_if_policy_denied=: (bool value) -> void
+
+  def raise_if_policy_denied: () -> bool
 end
 
 # A registry of features that provides configurations.
@@ -149,6 +182,8 @@ end
 # Some of the methods shown within this module are implemented in Rust
 # and are declared in this common module to avoid duplicate declarations in different classes.
 module Optify::ProviderModule
+  def check_policies: (String requester, ::Array[String] feature_names, ?CacheOptions? cache_options) -> String?
+
   # @param canonical_feature_name [String] A canonical feature name
   # @return Whether the feature has conditions.
   def conditions?: (String canonical_feature_name) -> bool
@@ -200,6 +235,11 @@ module Optify::ProviderModule
 
   def map_feature_names: (::Array[String] feature_names, GetOptionsPreferences preferences) -> ::Array[String?]
 
+  # @return The policies for the feature, or `nil` if the feature has no policies.
+  def get_policies: (String canonical_feature_name) -> Optify::Policies?
+
+  def _check_policies: (String requester, ::Array[String] feature_names) -> String?
+
   # Map aliases or canonical feature names (perhaps derived from a file names) to the canonical feature names.
   # Canonical feature names map to themselves.
   # This implementation calls the Rust implementation directly.
@@ -210,6 +250,9 @@ module Optify::ProviderModule
 
   # @return The metadata for the feature.
   def get_feature_metadata_json: (String canonical_feature_name) -> String?
+
+  # @return The policies for the feature as JSON, or `nil` if the feature has no policies.
+  def get_policies_json: (String canonical_feature_name) -> String?
 end
 
 # Provides configurations based on keys and enabled feature names.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: optify-config
 version: !ruby/object:Gem::Version
-  version: 1.23.2
+  version: 1.24.0
 platform: ruby
 authors:
 - Justin D. Harris
@@ -193,6 +193,7 @@ files:
 - lib/optify_ruby/get_options_preferences.rb
 - lib/optify_ruby/implementation.rb
 - lib/optify_ruby/options_metadata.rb
+- lib/optify_ruby/policies.rb
 - lib/optify_ruby/provider_module.rb
 - lib/optify_ruby/watcher_implementation.rb
 - rbi/optify.rbi