permissify-rb 0.5.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 03fdfddc37d49ba5df2d5ccd30c48b4c8c7e7a3b145a4c1a2f54f89021a5a84b
+  data.tar.gz: c3acf7eeb111944a9006753c2d2f00652519bbebcb27cd14c43d123221c89257
+SHA512:
+  metadata.gz: 63da49ac077f45b9d63c7febc3a399f9e2e30c807bbd0f34aa7d3522ee407f1596f3f422cd387b1ec133ebb5df37fd30ae0120138b9f78f5a40c3e6f31c6d442
+  data.tar.gz: 8dfda3541e0f8a4d863022d13ac5949748af54662155fbf005eecfa8c0e5b80a7f3ecfc3d309f94ef7586ab16becb308b661e95c5dd136d326d236512ccf2b71

data/CHANGELOG.md

@@ -0,0 +1,89 @@
+# Changelog
+
+All notable changes are recorded here. The release workflow refuses to publish
+a version with no entry — see RELEASING.md.
+
+Pre-1.0: minor versions may break, and the changelog says so when they do.
+
+## [0.5.0] - 2026-07-24
+
+Zero-config Rails Railtie.
+
+- First public release on RubyGems, as `permissify-rb` (the name `permissify`
+  belongs to an unrelated gem). `require "permissify"` and the `Permissify`
+  constant are unchanged; `lib/permissify-rb.rb` only requires `permissify`, so
+  `Bundler.require` works with `gem "permissify-rb"`.
+
+- `Permissify::Railtie` — loaded automatically when Rails is present (a conditional
+  require in `lib/permissify.rb`, so pure-Ruby hosts keep their stdlib-only footprint).
+  It removes all host loader glue:
+  - definitions live in `app/permissify/*.rb` (each calls `Permissify.define`);
+  - the directory is ignored by Zeitwerk (files register, they don't define constants);
+  - definitions register on boot and re-register on every reload via `to_prepare`;
+  - `permissify/rails` (the controller concern) is required automatically.
+  No initializer is needed. Mirrors the Predicate gem's Railtie so both load identically.
+
+## [0.4.0] - 2026-07-24
+
+Optional Predicate fact source.
+
+- `require "permissify/predicate"` → `Permissify::PredicateFactSource` — sources a
+  family of stable domain-validity facts from a Predicate entity through the
+  `FactSource` port, with no load-time dependency on the `predicate` gem (the entity
+  is injected). `facts:` declares the owned names; anything else returns `Missing` so
+  inline facts and other sources still win; an owned fact whose entity raises denies
+  observably with `:fact_error`.
+- Documents the split loudly: Predicate is a memoized *domain* layer beneath
+  authorization — for stable facts only, never for volatile roles/ownership.
+- Contract tests run with and without Predicate (a faithful `call(name, state)` stub),
+  including sourced-vs-inline parity.
+
+## [0.3.0] - 2026-07-24
+
+Optional Rails adapter.
+
+- `require "permissify/rails"` + `include Permissify::Controller` — an optional,
+  dependency-free controller concern:
+  - `permissify_authorize(resource, action:, resource_key:, environment:)` — raises
+    `NotAuthorized` on deny, returns the resource on allow.
+  - `permissify_scope(relation, …)` — delegates to `authorized_scope` (DB-level).
+  - `verify_permissify_authorized` / `verify_permissify_scoped` — after_action guards
+    that fail loud when an action forgot to authorize or scope.
+  - `permissify_actor` (defaults to `current_user`) and `permissify_environment` are
+    overridable; `permissify_resource_key` infers the registry key from the model name.
+  - Names are distinct from Pundit's so both can run side by side during a shadow migration.
+- Adapter tests run without booting Rails (a fake controller supplies the contract).
+
+- `EXAMPLES.md` — comprehensive, test-backed examples for every feature.
+- RDoc comments across the public API and an `rdoc` Rake task; generated API docs
+  build into `doc/` (gitignored) and are published to kuickr, not committed.
+
+## [0.2.0] - 2026-07-23
+
+Authorized scopes + fact-source parity.
+
+- `scope(:permission) { |actor, relation, environment| … }` DSL registration.
+- `Permissify.authorized_scope(actor:, action:, relation:, resource_key:)` — the
+  database-scope port. Delegates to the registered SQL-capable builder and raises
+  `NoScope` when none exists (never returns every row by default). Collections are
+  never filtered in Ruby as a security boundary.
+- FactSource parity test: the same permission yields the same decision whether a
+  fact is registered inline or supplied by a `FactSource` (the swap-the-source
+  guarantee), plus scope delegation and no-scope tests.
+
+## [0.1.0] - 2026-07-23
+
+Standalone core skeleton.
+
+- Ruby-only core, no Rails or Predicate runtime dependency.
+- `Permissify.define` DSL: `fact`, `permission`, explicit `action ... maps_to:`.
+- `Registry` (boot-time, synchronized) holds facts, permissions, action aliases.
+- Typed `DecisionContext` with `fact`, `all?`, `any?`, `none?` and a check trace.
+- Immutable structured `Decision` (`allowed`, `permission`, `reason`, `checks`,
+  `metadata`).
+- `FactSource` port (`fetch` + `Missing` sentinel + `Null` default).
+- Safety contracts: default-deny for unknown resource/action/permission/fact;
+  evaluation errors deny observably; no superuser bypass; no action fallback.
+- `Permissify.decide`, `allow?`, and `authorize!` (raises `NotAuthorized`).
+- Minitest suite covering allow/deny, unknown-*, missing-fact, error-denies,
+  no-superuser, duplicate-definition.

data/EXAMPLES.md

@@ -0,0 +1,443 @@
+# Permissify — Comprehensive Examples
+
+Concrete, runnable examples for every feature of Permissify. Each example maps to
+behavior covered by the automated tests in `test/` — `test/permissify_test.rb` and
+`test/scope_and_fact_source_test.rb`.
+
+Permissify answers one question — *can this **actor** perform this **action** on this
+**resource**?* — and returns one explicit, observable `Decision`. It is default-deny,
+has no superuser bypass, no generated `":#{action}able"` fallback, and needs no
+framework.
+
+## Table of Contents
+
+1. [Defining a resource](#1-defining-a-resource)
+2. [Making a decision](#2-making-a-decision)
+3. [The Decision object](#3-the-decision-object)
+4. [Boolean projection — `allow?`](#4-boolean-projection--allow)
+5. [Enforcement — `authorize!`](#5-enforcement--authorize)
+6. [Combinators — `all?` / `any?` / `none?`](#6-combinators--all--any--none)
+7. [Environment](#7-environment)
+8. [Authorized scopes — authorization as a query](#8-authorized-scopes--authorization-as-a-query)
+9. [The FactSource port](#9-the-factsource-port)
+10. [Safety contracts](#10-safety-contracts)
+
+---
+
+## Real-World Use Cases
+
+11. [Migrating a Pundit policy](#11-migrating-a-pundit-policy)
+12. [Optional Predicate as a domain-fact source](#12-optional-predicate-as-a-domain-fact-source)
+13. [Rails integration](#13-rails-integration)
+14. [Sourcing many domain facts — `PredicateFactSource`](#14-sourcing-many-domain-facts--predicatefactsource)
+
+---
+
+## 1. Defining a resource
+
+A resource is a bundle of named **facts**, **permissions** that compose those facts,
+and **actions** that alias to a permission. The DSL is evaluated at boot.
+
+```ruby
+Permissify.define(:article) do
+  fact(:draft) { |ctx| ctx.resource.status == "draft" }
+  fact(:owned) { |ctx| ctx.resource.user_id == ctx.actor.id }
+
+  permission(:editable) { |ctx| ctx.all?(:draft, :owned) }
+
+  action :edit,   maps_to: :editable
+  action :update, maps_to: :editable
+end
+```
+
+- `fact` blocks receive a `DecisionContext` and return a boolean.
+- `permission` blocks receive the same context and read facts via combinators.
+- `action ..., maps_to:` is the **only** way an action resolves to a permission —
+  there is no implicit `":#{action}able"` naming convention.
+- Duplicate fact / permission / action / scope names raise `Permissify::DefinitionError`
+  at definition time.
+
+---
+
+## 2. Making a decision
+
+```ruby
+article  = Struct.new(:status, :user_id).new("draft", 7)
+author   = Struct.new(:id).new(7)
+stranger = Struct.new(:id).new(9)
+
+Permissify.decide(actor: author,   action: :edit, resource: article, resource_key: :article).allowed?
+# => true
+
+Permissify.decide(actor: stranger, action: :edit, resource: article, resource_key: :article).allowed?
+# => false  (owned is false)
+```
+
+`resource_key` selects the definition; `resource` is the row/object under test;
+`action` is the verb. All four are required keywords.
+
+---
+
+## 3. The Decision object
+
+`decide` always returns an immutable `Permissify::Decision` — never a bare boolean,
+never `nil`.
+
+```ruby
+decision = Permissify.decide(actor: author, action: :edit, resource: article, resource_key: :article)
+
+decision.allowed?    # => true
+decision.denied?     # => false
+decision.permission  # => :editable
+decision.reason      # => :allowed        (or :denied, :unknown_action, :missing_fact, …)
+decision.checks      # => [[:all?, [:draft, :owned], true]]   trace of combinator calls
+decision.metadata    # => { resource_key: :article, action: :edit }
+
+decision.to_h
+# => { allowed: true, permission: :editable, reason: :allowed,
+#      checks: [...], metadata: { resource_key: :article, action: :edit } }
+```
+
+The `reason` distinguishes an ordinary policy `:denied` from a structural denial
+(`:unknown_resource`, `:unknown_action`, `:unknown_permission`, `:missing_fact`,
+`:fact_error`) — so a "no" is always explainable.
+
+---
+
+## 4. Boolean projection — `allow?`
+
+When you only need the yes/no:
+
+```ruby
+Permissify.allow?(actor: author, action: :edit, resource: article, resource_key: :article)
+# => true
+```
+
+`allow?` is exactly `decide(...).allowed?` — same arguments, same safety contract.
+
+---
+
+## 5. Enforcement — `authorize!`
+
+At an enforcement boundary, raise on deny. The `Decision` is attached to the error.
+
+```ruby
+begin
+  Permissify.authorize!(actor: stranger, action: :edit, resource: article, resource_key: :article)
+rescue Permissify::NotAuthorized => e
+  e.decision.reason      # => :denied
+  e.decision.permission  # => :editable
+end
+```
+
+On allow, `authorize!` returns the `Decision`.
+
+---
+
+## 6. Combinators — `all?` / `any?` / `none?`
+
+Inside a permission, read facts through combinators. Each call is recorded in
+`decision.checks`.
+
+```ruby
+Permissify.define(:document) do
+  fact(:published) { |ctx| ctx.resource.published }
+  fact(:owner)     { |ctx| ctx.resource.owner_id == ctx.actor.id }
+  fact(:locked)    { |ctx| ctx.resource.locked }
+
+  permission(:viewable)  { |ctx| ctx.any?(:published, :owner) }
+  permission(:editable)  { |ctx| ctx.all?(:owner) && ctx.none?(:locked) }
+
+  action :show, maps_to: :viewable
+  action :edit, maps_to: :editable
+end
+```
+
+- `all?(*facts)` — true when every fact is true.
+- `any?(*facts)` — true when at least one is true.
+- `none?(*facts)` — true when every fact is false.
+
+Facts are memoized per decision, so referencing the same fact twice evaluates it once.
+
+---
+
+## 7. Environment
+
+Pass request- or tenant-scoped context that facts can read, without stuffing it onto
+the actor or resource.
+
+```ruby
+Permissify.define(:report) do
+  fact(:same_tenant) { |ctx| ctx.resource.tenant_id == ctx.environment[:tenant_id] }
+  permission(:viewable) { |ctx| ctx.all?(:same_tenant) }
+  action :show, maps_to: :viewable
+end
+
+Permissify.decide(actor: user, action: :show, resource: report,
+                  resource_key: :report, environment: { tenant_id: 42 })
+```
+
+---
+
+## 8. Authorized scopes — authorization as a query
+
+For collections, never filter in Ruby. Register a scope builder and let the database
+do the narrowing. A missing scope raises `Permissify::NoScope` — it **never** returns
+every row by default.
+
+```ruby
+Permissify.define(:article) do
+  permission(:viewable) { |_ctx| true }
+  action :index, maps_to: :viewable
+
+  # builder receives (actor, relation, environment) and returns the narrowed relation
+  scope(:viewable) { |actor, relation, _env| relation.where(user_id: actor.id) }
+end
+
+Permissify.authorized_scope(actor: current_user, action: :index,
+                            relation: Article.all, resource_key: :article)
+# => Article.where(user_id: current_user.id)
+```
+
+`relation` is anything the host passes — an ActiveRecord relation in a Rails app, or a
+plain Array in a test — so the port stays framework-free:
+
+```ruby
+rows = [{ id: 1, owner_id: 7 }, { id: 2, owner_id: 9 }, { id: 3, owner_id: 7 }]
+Permissify.define(:row) do
+  permission(:viewable) { |_| true }
+  action :index, maps_to: :viewable
+  scope(:viewable) { |actor, relation, _env| relation.select { |r| r[:owner_id] == actor[:id] } }
+end
+
+Permissify.authorized_scope(actor: { id: 7 }, action: :index, relation: rows, resource_key: :row)
+# => [{ id: 1, owner_id: 7 }, { id: 3, owner_id: 7 }]
+```
+
+---
+
+## 9. The FactSource port
+
+Facts don't have to be defined inline. A `FactSource` supplies them externally — and
+the **same permission yields the same decision** whether a fact is inline or sourced
+(the swap-the-source guarantee).
+
+```ruby
+class MyFactSource
+  # return the boolean, or FactSource::Missing when this source doesn't know the fact
+  def fetch(name, ctx)
+    return ctx.resource[:owner_id] == ctx.actor[:id] if name == :owned
+
+    Permissify::FactSource::Missing
+  end
+end
+
+Permissify.define(:doc) do
+  permission(:editable) { |ctx| ctx.all?(:owned) }   # :owned is NOT defined inline
+  action :edit, maps_to: :editable
+end
+
+Permissify.decide(actor: { id: 7 }, action: :edit, resource: { owner_id: 7 },
+                  resource_key: :doc, fact_source: MyFactSource.new).allowed?
+# => true
+```
+
+The default `FactSource::Null` returns `Missing` for everything; a fact that is neither
+inline nor sourced raises `MissingFact`, which denies with reason `:missing_fact`.
+
+---
+
+## 10. Safety contracts
+
+Everything unknown, and every evaluation error, **denies** — observably.
+
+```ruby
+# Unknown resource
+Permissify.decide(actor: u, action: :edit, resource: r, resource_key: :nope).reason
+# => :unknown_resource
+
+# Unknown action (no matching `action ..., maps_to:`)
+Permissify.decide(actor: u, action: :teleport, resource: r, resource_key: :article).reason
+# => :unknown_action
+
+# A fact that raises does not blow up the request — it denies
+Permissify.define(:brittle) do
+  fact(:boom) { |_| raise "kaboom" }
+  permission(:editable) { |ctx| ctx.all?(:boom) }
+  action :edit, maps_to: :editable
+end
+Permissify.decide(actor: u, action: :edit, resource: r, resource_key: :brittle).reason
+# => :fact_error
+
+# No superuser bypass, no ":#{action}able" fallback — an action only resolves through
+# an explicit `action ..., maps_to:` mapping.
+```
+
+---
+
+## 11. Migrating a Pundit policy
+
+A real StockLive path. Pundit is **data-modelled** — one policy class per record, a
+method per controller action, role checks repeated. Permissify is **domain-modelled** —
+named facts and permissions, composed once.
+
+```ruby
+# BEFORE — Pundit: 14 methods, two repeated role checks
+class ContactPolicy < ApplicationPolicy
+  def index?   = user.assessor?
+  # …9 more, all user.assessor?…
+  def destroy? = user.assessor? && user.staff?
+  def approve? = user.assessor? && user.staff?
+  class Scope < Scope
+    def resolve = scope.where(user: user)
+  end
+end
+
+# AFTER — Permissify: two facts, two permissions, explicit aliases + scope
+Permissify.define(:contact) do
+  fact(:assessor) { |ctx| ctx.actor.assessor? }
+  fact(:staff)    { |ctx| ctx.actor.staff? }
+
+  permission(:viewable)   { |ctx| ctx.all?(:assessor) }
+  permission(:manageable) { |ctx| ctx.all?(:assessor, :staff) }
+
+  action :index,   maps_to: :viewable
+  action :destroy, maps_to: :manageable
+  action :approve, maps_to: :manageable
+
+  scope(:viewable) { |actor, relation, _env| relation.where(user: actor) }
+end
+```
+
+The 14 repeated `user.assessor?` collapse into one named fact; the `assessor? && staff?`
+guards become one `:manageable` permission; the Pundit `Scope` becomes an explicit
+`authorized_scope`.
+
+---
+
+## 12. Optional Predicate as a domain-fact source
+
+Permissify needs no other library. But where a **domain-validity** rule already lives in
+[Predicate](https://github.com/StockLive-Group/predicate) — stable facts that are safe to
+memoize — Permissify can read its result as a plain fact. Authorization stays fresh; the
+domain rule stays where it belongs.
+
+```ruby
+# Domain layer (Predicate) — "is this article complete?" is a property of the article,
+# not of authorization. Memoized because it is stable.
+Predicate.define(:article) do
+  content_complete { |s| is_present?(s[:title]) && is_present?(s[:body]) && s[:media_ids].any? }
+end
+
+# Authorization layer (Permissify) — reads the domain result as one fact
+Permissify.define(:article) do
+  fact(:complete) do |ctx|
+    Predicate.for(:article).call(:content_complete,
+      title: ctx.resource.title, body: ctx.resource.body, media_ids: ctx.resource.media_ids)
+  end
+  fact(:owner) { |ctx| ctx.resource.user_id == ctx.actor.id }
+
+  permission(:publishable) { |ctx| ctx.all?(:owner, :complete) }
+  action :publish, maps_to: :publishable
+end
+```
+
+Predicate is an *optional* domain layer beneath authorization — never a required
+dependency, and never the store for volatile authz facts (those stay plain Ruby, and
+fresh).
+
+---
+
+## 13. Rails integration
+
+The core needs no framework. In a Rails app, adding the gem is enough — a Railtie loads
+automatically (only when Rails is present, so pure-Ruby hosts stay stdlib-only) and gives
+you **zero-config** wiring:
+
+- Drop resource definitions in `app/permissify/*.rb` (each calls `Permissify.define`). The
+  Railtie ignores that directory in Zeitwerk and registers the files on boot and on every
+  reload — **no initializer, no loader glue**.
+- `Permissify::Controller` is required for you; just include it.
+
+```ruby
+# app/permissify/contact.rb  — registered automatically, no initializer needed
+Permissify.define(:contact) do
+  fact(:assessor) { |ctx| ctx.actor.assessor? }
+  permission(:viewable) { |ctx| ctx.all?(:assessor) }
+  action :index, maps_to: :viewable
+  scope(:viewable) { |actor, relation, _env| relation.where(user: actor) }
+end
+```
+
+```ruby
+class ApplicationController < ActionController::Base
+  include Permissify::Controller
+  verify_permissify_authorized          # fail loud if an action forgot to authorize
+  rescue_from Permissify::NotAuthorized, with: :forbidden
+
+  private
+
+  def forbidden = head(:forbidden)
+end
+
+class ContactsController < ApplicationController
+  def show
+    @contact = permissify_authorize(Contact.find(params[:id]))   # raises on deny
+  end
+
+  def index
+    @contacts = permissify_scope(Contact.all)                    # DB-level narrowing
+  end
+end
+```
+
+- `permissify_authorize(resource, action:, resource_key:, environment:)` — returns the
+  resource on allow (so it wraps an assignment), raises `NotAuthorized` on deny. `action`
+  defaults to the controller `action_name`; `resource_key` is inferred from the model name
+  (`Contact` → `:contact`, `LivestockType` → `:livestock_type`) unless given.
+- `permissify_scope(relation, …)` — delegates to `authorized_scope`; raises `NoScope` when
+  the resource has no registered scope.
+- `verify_permissify_authorized` / `verify_permissify_scoped` — after_action guards so a
+  forgotten authorization fails loud instead of passing open.
+- Override `permissify_actor` (defaults to `current_user`) and `permissify_environment`
+  (defaults to `{}`) to change the subject or supply tenant/request context.
+
+The method names are deliberately distinct from Pundit's (`authorize`, `policy_scope`,
+`verify_authorized`) so both can run side by side during a shadow migration.
+
+---
+
+## 14. Sourcing many domain facts — `PredicateFactSource`
+
+Section 12 reads a single Predicate result inline. When several **stable domain facts**
+come from one Predicate entity, `require "permissify/predicate"` and wire them through the
+`FactSource` port instead of writing a block per fact.
+
+```ruby
+source = Permissify::PredicateFactSource.new(
+  entity: Predicate.for(:article),        # responds to call(name, state) -> boolean
+  facts:  [:content_complete, :media_ready],
+  state:  ->(ctx) { { title: ctx.resource.title, body: ctx.resource.body,
+                      media_ids: ctx.resource.media_ids } }
+)
+
+Permissify.define(:article) do
+  fact(:owner) { |ctx| ctx.resource.user_id == ctx.actor.id }   # volatile → inline, fresh
+  permission(:publishable) { |ctx| ctx.all?(:owner, :content_complete) }
+  action :publish, maps_to: :publishable
+end
+
+Permissify.decide(actor: user, action: :publish, resource: article,
+                  resource_key: :article, fact_source: source)
+```
+
+- `facts:` declares exactly which names this source owns; any other name returns `Missing`,
+  so inline facts (like `:owner`) and other sources still win.
+- An owned fact whose Predicate entity raises denies observably with `:fact_error` — never a
+  silent allow. A fact neither inline nor owned denies with `:missing_fact`.
+- The entity is injected, so there is **no load-time dependency** on the `predicate` gem;
+  the adapter is testable with a stub and degrades safely when Predicate isn't wired.
+
+**Use it only for stable facts.** Predicate always memoizes, so volatile authorization facts
+(roles, ownership) must stay inline and fresh — Predicate is a domain layer *beneath*
+authorization, never a store for authz state.

data/LICENSE.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 StockLive-Group
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,71 @@
+# Permissify
+
+Activity-based authorization for Ruby. One explicit question, a structured
+answer, default-deny by construction. No framework required.
+
+```ruby
+Permissify.define(:article) do
+  fact(:draft) { |ctx| ctx.resource.status == "draft" }
+  fact(:owned) { |ctx| ctx.resource.user_id == ctx.actor.id }
+
+  permission(:editable) { |ctx| ctx.all?(:draft, :owned) }
+
+  action :edit, maps_to: :editable
+end
+
+decision = Permissify.decide(actor: user, action: :edit,
+                             resource: article, resource_key: :article)
+decision.allowed?   # => true / false
+decision.reason     # => :allowed / :denied / :unknown_action / :missing_fact / ...
+```
+
+## What it guarantees
+
+- **Default-deny.** Unknown resource, action, permission, or fact — and any
+  evaluation error — all deny. Nothing is allowed by omission.
+- **No superuser bypass.** Elevated access is an ordinary named fact used inside a
+  permission, so it is explainable and testable.
+- **No magic action fallback.** Action aliases are explicit and finite; there is
+  no generated `:"#{action}able"`.
+- **Structured decisions.** Every evaluation returns an immutable `Decision`
+  (`allowed`, `permission`, `reason`, `checks`, `metadata`). Booleans are
+  projections of it.
+- **Ruby-only core.** Rails and [Predicate](https://github.com/StockLive-Group/predicate)
+  are optional adapters, loaded only when their host constants are present.
+
+## FactSource
+
+Facts a definition does not register inline are resolved through a `FactSource`
+(`fetch(name, context)` → value or `FactSource::Missing`). A missing fact denies.
+Predicate integration is simply an alternative `FactSource`; swapping it must not
+change any decision.
+
+## Installation
+
+Published on RubyGems as `permissify-rb` (the name `permissify` belongs to an
+unrelated gem). The library is still required as `permissify`.
+
+```ruby
+# Gemfile
+gem "permissify-rb"
+```
+
+```ruby
+require "permissify"            # core
+require "permissify/rails"      # optional controller concern (auto-loaded under Rails)
+require "permissify/predicate"  # optional Predicate fact source
+```
+
+## Status
+
+`0.5.0` — the core (Registry, DSL, `DecisionContext`, `Decision`, `FactSource`,
+default-deny), database-level authorized scopes, the optional Rails controller
+adapter and zero-config Railtie, and the optional Predicate fact source are
+implemented and tested. See [CHANGELOG.md](CHANGELOG.md).
+
+```bash
+bundle install
+bundle exec rake    # boundary check, workflows, suite
+```
+
+Releases follow [RELEASING.md](RELEASING.md).

data/lib/permissify/decision.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Permissify
+  # The immutable result of every evaluation. Boolean helpers (`can?`) are
+  # projections of this; enforcement (`authorize!`) reads its reason and checks.
+  # It carries only structured, safe identifiers — never arbitrary actor/resource
+  # attributes.
+  class Decision
+    attr_reader :permission, :reason, :checks, :metadata
+
+    # reason is one of:
+    #   :allowed :denied :unknown_resource :unknown_action
+    #   :unknown_permission :missing_fact :fact_error
+    def initialize(allowed:, permission:, reason:, checks: [], metadata: {})
+      @allowed    = allowed ? true : false
+      @permission = permission
+      @reason     = reason
+      @checks     = checks.freeze
+      @metadata   = metadata.freeze
+      freeze
+    end
+
+    def allowed? = @allowed
+    def denied?  = !@allowed
+
+    def to_h
+      { allowed: @allowed, permission: @permission, reason: @reason,
+        checks: @checks, metadata: @metadata }
+    end
+  end
+end

data/lib/permissify/decision_context.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module Permissify
+  # The typed input a permission/fact block evaluates against. It is explicit on
+  # purpose: it does not serialize the resource, inject magic keys, or hash object
+  # graphs. Facts read `actor`, `resource`, and `environment` directly, and compose
+  # other facts through `fact`, `all?`, `any?`, `none?`.
+  class DecisionContext
+    attr_reader :actor, :resource, :action, :environment
+
+    def initialize(actor:, resource:, action:, resource_def:, environment:, fact_source:)
+      @actor        = actor
+      @resource     = resource
+      @action       = action
+      @resource_def = resource_def
+      @environment  = environment
+      @fact_source  = fact_source
+      @cache        = {}
+      @checks       = []
+    end
+
+    # Resolve a named fact to a boolean. Inline-registered facts win; otherwise the
+    # FactSource is consulted, and an unresolvable fact raises MissingFact (which
+    # the pipeline turns into a default-deny). Results are memoized per context.
+    def fact(name)
+      key = name.to_sym
+      return @cache[key] if @cache.key?(key)
+
+      @cache[key] = compute(key)
+    end
+
+    def all?(*names)  = names.all? { |n| record(n) }
+    def any?(*names)  = names.any? { |n| record(n) }
+    def none?(*names) = names.none? { |n| record(n) }
+
+    # The ordered trace of composed checks, attached to the Decision.
+    def checks = @checks
+
+    private
+
+    def record(name)
+      result = fact(name)
+      @checks << { name: name.to_sym, result: result }
+      result
+    end
+
+    def compute(name)
+      block = @resource_def.facts[name]
+      if block
+        block.call(self) ? true : false
+      else
+        value = @fact_source.fetch(name, self)
+        raise MissingFact, name if value.equal?(FactSource::Missing)
+
+        value ? true : false
+      end
+    end
+  end
+end

data/lib/permissify/dsl.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module Permissify
+  # Evaluated (via instance_eval) inside `Permissify.define`. Every call writes an
+  # immutable entry into a ResourceDefinition. Duplicate names and missing blocks
+  # fail loudly at boot; there is no implicit behaviour.
+  class DSL
+    def initialize(definition)
+      @definition = definition
+    end
+
+    def fact(name, &block)
+      raise DefinitionError, "fact(:#{name}) requires a block" unless block
+
+      key = name.to_sym
+      guard_unique!(@definition.facts, key, "fact")
+      @definition.facts[key] = block
+    end
+
+    def permission(name, &block)
+      raise DefinitionError, "permission(:#{name}) requires a block" unless block
+
+      key = name.to_sym
+      guard_unique!(@definition.permissions, key, "permission")
+      @definition.permissions[key] = block
+    end
+
+    # Explicit, finite action aliases. There is no generated ":#{action}able"
+    # fallback — an unregistered action denies.
+    def action(name, maps_to:)
+      key = name.to_sym
+      guard_unique!(@definition.actions, key, "action alias")
+      @definition.actions[key] = maps_to.to_sym
+    end
+
+    # A SQL-capable scope for a permission: a block ->(actor, relation, environment)
+    # that returns a narrowed relation. authorized_scope requires one — collections
+    # are never filtered in Ruby as a security boundary.
+    def scope(permission_name, &block)
+      raise DefinitionError, "scope(:#{permission_name}) requires a block" unless block
+
+      key = permission_name.to_sym
+      guard_unique!(@definition.scopes, key, "scope")
+      @definition.scopes[key] = block
+    end
+
+    private
+
+    def guard_unique!(collection, key, kind)
+      return unless collection.key?(key)
+
+      raise DefinitionError, "duplicate #{kind} :#{key} on #{@definition.key}"
+    end
+  end
+end

data/lib/permissify/errors.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module Permissify
+  # Base class for every error raised by Permissify.
+  class Error < StandardError; end
+
+  # Raised at registration time for an invalid definition (duplicate name,
+  # missing block, bad alias).
+  class DefinitionError < Error; end
+
+  # Raised internally when a referenced fact cannot be resolved. It is caught by
+  # the decision pipeline and converted into a default-deny Decision — it never
+  # escapes as a silent allow.
+  class MissingFact < Error
+    attr_reader :name
+
+    def initialize(name)
+      @name = name.to_sym
+      super("missing fact: #{@name}")
+    end
+  end
+
+  # Raised by `authorize!` when a decision denies. The full Decision is attached
+  # so callers/rescue handlers can inspect the reason and checks.
+  class NotAuthorized < Error
+    attr_reader :decision
+
+    def initialize(decision)
+      @decision = decision
+      super("not authorized: #{decision.permission} (#{decision.reason})")
+    end
+  end
+
+  # Raised by authorized_scope when no SQL-capable scope builder is registered for
+  # the resolved permission. Missing scopes fail loud — never a fallback to all rows.
+  class NoScope < Error
+    def initialize(resource_key, target)
+      super("no authorized_scope registered for #{resource_key}##{target}")
+    end
+  end
+end

data/lib/permissify/fact_source.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Permissify
+  # A FactSource supplies named facts the DSL did not register inline. It responds
+  # to `fetch(name, context)` and returns a value, or `FactSource::Missing` when it
+  # cannot supply the fact. A missing fact denies the decision — it is never a
+  # silent allow. Predicate integration is just an alternative FactSource.
+  module FactSource
+    # Sentinel meaning "this source cannot answer that fact".
+    Missing = Object.new
+    def Missing.inspect = "Permissify::FactSource::Missing"
+    def Missing.to_s = inspect
+    Missing.freeze
+
+    # Default source: answers nothing, so any fact not registered inline denies.
+    class Null
+      def fetch(_name, _context)
+        Missing
+      end
+    end
+  end
+end

data/lib/permissify/predicate.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+require_relative "../permissify"
+
+module Permissify
+  # Optional adapter: source a family of facts from a Predicate entity through the
+  # FactSource port, without a load-time dependency on the `predicate` gem.
+  #
+  # Predicate ALWAYS memoizes, so this belongs to STABLE domain-validity facts —
+  # "is this article complete?", "does this lot have media?" — never to volatile
+  # authorization facts like roles or ownership, which must stay fresh as inline
+  # facts. Predicate is a domain layer *beneath* authorization; Permissify reads its
+  # result as a plain boolean and still owns the decision.
+  #
+  #   source = Permissify::PredicateFactSource.new(
+  #     entity: Predicate.for(:article),          # responds to call(name, state) -> bool
+  #     facts:  [:content_complete],              # the facts this source owns
+  #     state:  ->(ctx) { { title: ctx.resource.title, body: ctx.resource.body,
+  #                          media_ids: ctx.resource.media_ids } }
+  #   )
+  #
+  #   Permissify.decide(actor:, action:, resource:, resource_key:, fact_source: source)
+  #
+  # The entity is injected (never looked up here), so the adapter is fully testable
+  # with a stub and works whether or not Predicate is installed.
+  class PredicateFactSource
+    # +entity+:: any object responding to +call(fact_name, state_hash) -> boolean+
+    #            (exactly +Predicate.for(:x)+).
+    # +facts+::  the fact names this source owns. A name outside this set returns
+    #            FactSource::Missing so inline facts and other sources still win.
+    # +state+::  a callable +(context) -> Hash+ building the Predicate state from the
+    #            DecisionContext (reads +context.resource+, +context.actor+, …).
+    def initialize(entity:, facts:, state:)
+      @entity = entity
+      @facts  = Array(facts).map(&:to_sym)
+      @state  = state
+    end
+
+    # Return the boolean for an owned fact, or FactSource::Missing for anything else.
+    # An error raised by the entity for an owned fact propagates — the decision
+    # pipeline converts it into a default-deny with reason :fact_error.
+    def fetch(name, context)
+      key = name.to_sym
+      return FactSource::Missing unless @facts.include?(key)
+
+      @entity.call(key, @state.call(context)) ? true : false
+    end
+  end
+end

data/lib/permissify/rails.rb

@@ -0,0 +1,118 @@
+# frozen_string_literal: true
+
+require_relative "../permissify"
+
+module Permissify
+  # Optional Rails integration. It adds nothing to the core and imposes no runtime
+  # dependency — `require "permissify/rails"` only when a Rails app wants it, then:
+  #
+  #   class ApplicationController < ActionController::Base
+  #     include Permissify::Controller
+  #     verify_permissify_authorized   # fail loud if an action forgot to authorize
+  #   end
+  #
+  #   class ContactsController < ApplicationController
+  #     def show
+  #       @contact = permissify_authorize(Contact.find(params[:id]))   # raises on deny
+  #     end
+  #
+  #     def index
+  #       @contacts = permissify_scope(Contact.all)                    # DB-level narrowing
+  #     end
+  #   end
+  #
+  # The names are deliberately distinct from Pundit's (`authorize`, `policy_scope`,
+  # `verify_authorized`) so both can run side by side during a shadow migration —
+  # see the Pundit-eradication plan.
+  module Controller
+    def self.included(base)
+      base.extend(ClassMethods)
+    end
+
+    module ClassMethods
+      # Fail loud (after_action) if an action returned without calling
+      # permissify_authorize. A forgotten authorization must never pass silently.
+      def verify_permissify_authorized(**options)
+        after_action(:permissify_verify_authorized!, **options)
+      end
+
+      # Fail loud if an action returned without calling permissify_scope.
+      def verify_permissify_scoped(**options)
+        after_action(:permissify_verify_scoped!, **options)
+      end
+    end
+
+    # The subject under authorization. Defaults to +current_user+; override to
+    # authorize something else (an API token, an org membership, …).
+    def permissify_actor
+      current_user
+    end
+
+    # Request/tenant context passed to facts as +environment+. Override to supply
+    # tenant ids, feature flags, request metadata, etc. Defaults to empty.
+    def permissify_environment
+      {}
+    end
+
+    # Enforce authorization for +resource+. Returns +resource+ on allow so it can
+    # wrap an assignment; raises Permissify::NotAuthorized on deny (rescue it in the
+    # host, e.g. rescue_from Permissify::NotAuthorized).
+    #
+    # +action+::       defaults to the controller action_name
+    # +resource_key+:: defaults to an inferred key (see permissify_resource_key)
+    def permissify_authorize(resource, action: action_name, resource_key: nil, environment: nil)
+      @_permissify_authorized = true
+      Permissify.authorize!(
+        actor: permissify_actor,
+        action: action.to_sym,
+        resource: resource,
+        resource_key: resource_key || permissify_resource_key(resource),
+        environment: environment || permissify_environment
+      )
+      resource
+    end
+
+    # Narrow +relation+ to what the actor may see, at the database level. Delegates
+    # to Permissify.authorized_scope and raises Permissify::NoScope when the resource
+    # has no registered scope (it never returns every row by default).
+    def permissify_scope(relation, action: action_name, resource_key: nil, environment: nil)
+      @_permissify_scoped = true
+      Permissify.authorized_scope(
+        actor: permissify_actor,
+        action: action.to_sym,
+        relation: relation,
+        resource_key: resource_key || permissify_resource_key(relation),
+        environment: environment || permissify_environment
+      )
+    end
+
+    private
+
+    # Infer the registry key from a record, relation, or class by its model name:
+    # Contact => :contact, LivestockType => :livestock_type. Override for custom maps.
+    def permissify_resource_key(target)
+      name =
+        if target.respond_to?(:model_name)            then target.model_name.name
+        elsif target.class.respond_to?(:model_name)   then target.class.model_name.name
+        elsif target.is_a?(Module)                    then target.name
+        else                                               target.class.name
+        end
+      demodulized = name.to_s.split("::").last
+      demodulized.gsub(/([a-z\d])([A-Z])/, '\1_\2').gsub(/([A-Z]+)([A-Z][a-z])/, '\1_\2').downcase.to_sym
+    end
+
+    def permissify_verify_authorized!
+      return if @_permissify_authorized
+
+      raise Permissify::Error,
+            "#{self.class}##{action_name} returned without calling permissify_authorize"
+    end
+
+    def permissify_verify_scoped!
+      return if @_permissify_scoped
+
+      raise Permissify::Error,
+            "#{self.class}##{action_name} returned without calling permissify_scope"
+    end
+  end
+end

data/lib/permissify/railtie.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require "rails/railtie"
+require_relative "../permissify"
+require_relative "rails" # make Permissify::Controller available in Rails apps
+
+module Permissify
+  # Optional Rails integration, loaded automatically when Rails is present (see the
+  # conditional require at the bottom of lib/permissify.rb). It keeps host setup to
+  # zero — no initializer, no loader glue:
+  #
+  #   * drop definitions in app/permissify/*.rb (each calls Permissify.define)
+  #   * they register on boot and re-register on every code reload
+  #
+  # This mirrors the Predicate gem's Railtie so both frameworks load the same way.
+  class Railtie < Rails::Railtie
+    DEFINITIONS_DIR = "app/permissify"
+
+    # Definition files call Permissify.define and do NOT define constants matching
+    # their paths, so the main Zeitwerk autoloader must ignore the directory.
+    initializer "permissify.ignore_definitions", before: :set_autoload_paths do |app|
+      path = app.root.join(DEFINITIONS_DIR)
+      app.autoloaders.main.ignore(path) if path.exist?
+    end
+
+    # Register every definition on boot, and re-register on each reload. `load`
+    # (not `require`) so edits are picked up by Rails' reloader in development.
+    config.to_prepare do
+      Permissify.reset!
+      Dir[Rails.root.join(DEFINITIONS_DIR, "**", "*.rb")].sort.each { |file| load file }
+    end
+  end
+end

data/lib/permissify/registry.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Permissify
+  # The boot-time store of definitions. It holds, per resource key, the named
+  # facts, named permissions, and explicit action aliases. The DSL is only a
+  # registration script that writes here; the Registry has the authority.
+  # Mutation is synchronized and expected only at boot/reload boundaries.
+  class Registry
+    # One resource's registered facts, permissions, and action aliases.
+    class ResourceDefinition
+      attr_reader :key, :facts, :permissions, :actions, :scopes
+
+      def initialize(key)
+        @key         = key
+        @facts       = {}
+        @permissions = {}
+        @actions     = {}
+        @scopes      = {}
+      end
+    end
+
+    def initialize
+      @resources = {}
+      @mutex     = Mutex.new
+    end
+
+    def define(resource_key, &block)
+      raise DefinitionError, "define requires a block" unless block
+
+      key = resource_key.to_sym
+      @mutex.synchronize do
+        definition = (@resources[key] ||= ResourceDefinition.new(key))
+        DSL.new(definition).instance_eval(&block)
+      end
+      self
+    end
+
+    def resource(resource_key)
+      return nil unless resource_key
+
+      @resources[resource_key.to_sym]
+    end
+
+    def resource_keys = @resources.keys
+
+    def clear
+      @mutex.synchronize { @resources.clear }
+      self
+    end
+  end
+end

data/lib/permissify/version.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+module Permissify
+  # The gem version (semantic versioning).
+  VERSION = "0.5.0"
+end

data/lib/permissify-rb.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+# The gem is published as `permissify-rb`; Bundler.require loads this file by
+# that name. The library itself is `permissify` — this file must never do more
+# than require it.
+require "permissify"

data/lib/permissify.rb

@@ -0,0 +1,129 @@
+# frozen_string_literal: true
+
+require_relative "permissify/version"
+require_relative "permissify/errors"
+require_relative "permissify/fact_source"
+require_relative "permissify/decision"
+require_relative "permissify/decision_context"
+require_relative "permissify/registry"
+require_relative "permissify/dsl"
+
+# Permissify — activity-based authorization.
+#
+#   Permissify.define(:article) do
+#     fact(:draft)  { |ctx| ctx.resource.status == "draft" }
+#     fact(:owned)  { |ctx| ctx.resource.user_id == ctx.actor.id }
+#     permission(:editable) { |ctx| ctx.all?(:draft, :owned) }
+#     action :edit, maps_to: :editable
+#   end
+#
+#   decision = Permissify.decide(actor: user, action: :edit,
+#                                resource: article, resource_key: :article)
+#   decision.allowed?   # => true / false
+#
+# Safety contract: unknown resource / action / permission / fact and any
+# evaluation error all DENY. There is no superuser bypass and no generated
+# ":#{action}able" fallback — everything is explicit and observable.
+module Permissify
+  class << self
+    def registry
+      @registry ||= Registry.new
+    end
+
+    # Reset the global registry — for tests and dev reloads.
+    def reset!
+      @registry = Registry.new
+    end
+
+    # Register a resource's facts, permissions, and action aliases. The block is
+    # evaluated by the DSL; see Permissify::DSL for the available declarations.
+    def define(resource_key, &block)
+      registry.define(resource_key, &block)
+    end
+
+    # Evaluate one authorization question and return an immutable Decision.
+    #
+    # +actor+::        the subject performing the action
+    # +action+::       the verb, resolved to a permission via an action alias
+    # +resource+::     the object under test
+    # +resource_key+:: selects the registered definition
+    # +environment+::  optional request/tenant context facts may read
+    # +fact_source+::  optional external FactSource for facts not registered inline
+    #
+    # Unknown resource/action/permission/fact and any evaluation error all DENY,
+    # each with a distinct Decision#reason. Never returns a bare boolean or nil.
+    def decide(actor:, action:, resource:, resource_key:, environment: {}, fact_source: FactSource::Null.new)
+      resource_def = registry.resource(resource_key)
+      return deny(:unknown_resource, nil, resource_key: resource_key) unless resource_def
+
+      action_key      = action.to_sym
+      permission_name = resource_def.actions[action_key]
+      return deny(:unknown_action, nil, resource_key: resource_key, action: action_key) unless permission_name
+
+      permission_block = resource_def.permissions[permission_name]
+      return deny(:unknown_permission, permission_name, resource_key: resource_key) unless permission_block
+
+      context = DecisionContext.new(
+        actor: actor, resource: resource, action: action_key,
+        resource_def: resource_def, environment: environment, fact_source: fact_source
+      )
+
+      begin
+        allowed = permission_block.call(context) ? true : false
+      rescue MissingFact => e
+        return deny(:missing_fact, permission_name, checks: context.checks, missing: e.name)
+      rescue StandardError => e
+        return deny(:fact_error, permission_name, checks: context.checks, error: e.class.name)
+      end
+
+      Decision.new(
+        allowed: allowed,
+        permission: permission_name,
+        reason: allowed ? :allowed : :denied,
+        checks: context.checks,
+        metadata: { resource_key: resource_key, action: action_key }
+      )
+    end
+
+    # Convenience boolean projection of a decision.
+    def allow?(**kwargs)
+      decide(**kwargs).allowed?
+    end
+
+    # Enforcement: raises NotAuthorized (with the Decision attached) on deny.
+    def authorize!(**kwargs)
+      decision = decide(**kwargs)
+      raise NotAuthorized, decision unless decision.allowed?
+
+      decision
+    end
+
+    # Translate authorization into a database query. Delegates to a registered
+    # SQL-capable scope builder; raises NoScope if none exists (it never returns
+    # every row by default). The builder receives (actor, relation, environment)
+    # and returns the narrowed relation.
+    def authorized_scope(actor:, action:, relation:, resource_key:, environment: {})
+      resource_def = registry.resource(resource_key)
+      raise NoScope.new(resource_key, action) unless resource_def
+
+      permission_name = resource_def.actions[action.to_sym]
+      raise NoScope.new(resource_key, action) unless permission_name
+
+      builder = resource_def.scopes[permission_name]
+      raise NoScope.new(resource_key, permission_name) unless builder
+
+      builder.call(actor, relation, environment)
+    end
+
+    private
+
+    def deny(reason, permission, checks: [], **metadata)
+      Decision.new(allowed: false, permission: permission, reason: reason,
+                   checks: checks, metadata: metadata)
+    end
+  end
+end
+
+# Optional, zero-config Rails integration. Only loads when Rails is already
+# present, so the core keeps its stdlib-only footprint in pure-Ruby hosts.
+require_relative "permissify/railtie" if defined?(Rails::Railtie)

metadata

@@ -0,0 +1,66 @@
+--- !ruby/object:Gem::Specification
+name: permissify-rb
+version: !ruby/object:Gem::Version
+  version: 0.5.0
+platform: ruby
+authors:
+- StockLive
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies: []
+description: |
+  Permissify answers `actor.can?(:action, resource)` by evaluating small named
+  facts and permissions registered at boot, and returns a structured Decision.
+  The core depends only on the Ruby standard library; Rails and Predicate are
+  optional adapters loaded when their host constants are available.
+  API docs (RDoc): https://kuickr.co/stocklive/permissify-rdocs
+email:
+- developers@stocklive.com.au
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- EXAMPLES.md
+- LICENSE.txt
+- README.md
+- lib/permissify-rb.rb
+- lib/permissify.rb
+- lib/permissify/decision.rb
+- lib/permissify/decision_context.rb
+- lib/permissify/dsl.rb
+- lib/permissify/errors.rb
+- lib/permissify/fact_source.rb
+- lib/permissify/predicate.rb
+- lib/permissify/rails.rb
+- lib/permissify/railtie.rb
+- lib/permissify/registry.rb
+- lib/permissify/version.rb
+homepage: https://github.com/StockLive-Group/permissify
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/StockLive-Group/permissify
+  source_code_uri: https://github.com/StockLive-Group/permissify
+  changelog_uri: https://github.com/StockLive-Group/permissify/blob/main/CHANGELOG.md
+  documentation_uri: https://kuickr.co/stocklive/permissify-rdocs
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.1'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.20
+specification_version: 4
+summary: 'Activity-based authorization: one explicit decision, default-deny, no framework
+  required.'
+test_files: []