yes-core 2.3.0 → 2.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '06386ad1e1b30ddacbb4afaf392632875023650518041e3914178427039f91f5'
-  data.tar.gz: af40c3f3d98c611ce0653dfb0c0e2e2193376feb1ed0aeba69d43827fd6a09f9
+  metadata.gz: a67f053c3f41a210b9efa97b11c975194c9af6578ca5b4ba5f6de062031621c2
+  data.tar.gz: 9491e1f3a769af3131ca2b70d5c03746401f78adb6513868abdab14f219334a7
 SHA512:
-  metadata.gz: e956ac8483b7a53f13009356536c221f92dc2dd6d88f6137ca4d1e6305a7c239a2870484197469243c14dca6552983d0004b263147ad6642d94c17611415cfd6
-  data.tar.gz: 5ac3c8ea889ddf9a01efc1ac645a35c9d394736f351e1f98d9ca1dc0f5550094ded103ba424f2a8df07f24d46a082948a69e719aab3aa330d18736d0815de17a
+  metadata.gz: ae85c83e3178ff406651ef1f42c2fd3a4e54326f6a58290e2aa1ac4fa9dd73cff7d957124d20257809b379b5afb3ea39a441d835c04a43eb940c4fb1557df673
+  data.tar.gz: 7bd2ff74f1549b45c76ce29559486222b754652b59bc2d1488e8e528130784521f04f21151f562f96c0b801c8fbf5827c99d75b99515d1a46abae61c4e9ede42

data/CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## [2.4.0] - 2026-09-07
+- See root CHANGELOG.md for details.
+
 ## [2.3.0] - 2026-09-03
 - See root CHANGELOG.md for details.
 

data/lib/yes/core/authorization/cerbos_client_provider.rb

@@ -5,6 +5,10 @@ module Yes
     module Authorization
       # Provides a shared Cerbos client instance for authorizer classes.
       #
+      # One client (and therefore one gRPC channel) is kept per process. `Cerbos::Client` is
+      # thread-safe, but a gRPC channel must not be shared across a fork, so the client is
+      # rebuilt in each forked worker.
+      #
       # @example Including in a class with class-level methods
       #   class MyAuthorizer
       #     class << self
@@ -12,14 +16,47 @@ module Yes
       #     end
       #   end
       module CerbosClientProvider
+        class << self
+          # @return [Cerbos::Client] the process-wide Cerbos client
+          def client
+            mutex.synchronize do
+              reset! unless @client_pid == Process.pid
+              @client ||= build_client
+            end
+          end
+
+          # Drops the memoized client so the next call builds a new one (used after a fork and
+          # in tests).
+          # @return [void]
+          def reset!
+            @client = nil
+            @client_pid = Process.pid
+          end
+
+          private
+
+          # @return [Mutex]
+          def mutex
+            @mutex ||= Mutex.new
+          end
+
+          # @return [Cerbos::Client] client configured from Yes::Core configuration
+          def build_client
+            config = Yes::Core.configuration
+
+            Cerbos::Client.new(
+              config.cerbos_url,
+              tls: config.cerbos_tls,
+              grpc_channel_args: config.cerbos_grpc_channel_args
+            )
+          end
+        end
+
         private
 
-        # @return [Cerbos::Client] Cerbos client configured from Yes::Core configuration
+        # @return [Cerbos::Client] the process-wide Cerbos client
         def cerbos_client
-          Cerbos::Client.new(
-            Yes::Core.configuration.cerbos_url,
-            tls: Yes::Core.configuration.cerbos_tls
-          )
+          CerbosClientProvider.client
         end
       end
     end

data/lib/yes/core/authorization/cerbos_grpc_retry_policy.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+module Yes
+  module Core
+    module Authorization
+      # Default gRPC channel arguments for the Cerbos client.
+      #
+      # A Cerbos PDP pod that is killed or restarting fails an in-flight check with gRPC status
+      # `UNAVAILABLE` ("Stream removed", "Connection refused"). gRPC retries such calls
+      # transparently when the channel carries a retry policy in its service config, so the
+      # caller never sees a `Cerbos::Error::Unavailable` for a blip that a second attempt on a
+      # healthy pod would have answered.
+      #
+      # @see https://grpc.io/docs/guides/retry/
+      module CerbosGrpcRetryPolicy
+        SERVICE_NAME = 'cerbos.svc.v1.CerbosService'
+        MAX_ATTEMPTS = 4
+        INITIAL_BACKOFF = '0.1s'
+        MAX_BACKOFF = '1s'
+        BACKOFF_MULTIPLIER = 2
+        RETRYABLE_STATUS_CODES = %w[UNAVAILABLE].freeze
+
+        ENABLE_RETRIES_ARG = 'grpc.enable_retries'
+        SERVICE_CONFIG_ARG = 'grpc.service_config'
+
+        class << self
+          # @return [Hash{String => Integer, String}] channel arguments for `Cerbos::Client.new`
+          def channel_args
+            {
+              ENABLE_RETRIES_ARG => 1,
+              SERVICE_CONFIG_ARG => service_config.to_json
+            }
+          end
+
+          # @return [Hash] gRPC service config with the retry policy for the Cerbos service
+          def service_config
+            {
+              methodConfig: [
+                {
+                  name: [{ service: SERVICE_NAME }],
+                  retryPolicy: {
+                    maxAttempts: MAX_ATTEMPTS,
+                    initialBackoff: INITIAL_BACKOFF,
+                    maxBackoff: MAX_BACKOFF,
+                    backoffMultiplier: BACKOFF_MULTIPLIER,
+                    retryableStatusCodes: RETRYABLE_STATUS_CODES
+                  }
+                }
+              ]
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/yes/core/configuration.rb

@@ -45,6 +45,10 @@ module Yes
       # @return [Boolean] Whether to use TLS for Cerbos connections (default: true)
       attr_accessor :cerbos_tls
 
+      # @return [Hash{String => String, Integer}] low-level gRPC channel arguments for the Cerbos client
+      #   (default: {Authorization::CerbosGrpcRetryPolicy.channel_args}, which retries UNAVAILABLE calls)
+      attr_accessor :cerbos_grpc_channel_args
+
       # @return [Boolean] Whether to include metadata in Cerbos command authorizer responses
       attr_accessor :cerbos_commands_authorizer_include_metadata
 
@@ -112,6 +116,7 @@ module Yes
         }
         @cerbos_url = ENV.fetch('CERBOS_URL', 'cerbos-cluster-ip-service:3593')
         @cerbos_tls = true
+        @cerbos_grpc_channel_args = Authorization::CerbosGrpcRetryPolicy.channel_args
         @cerbos_commands_authorizer_include_metadata = false
         @cerbos_read_authorizer_include_metadata = false
         @cerbos_read_authorizer_actions = %w[read]

data/lib/yes/core/version.rb

@@ -2,6 +2,6 @@
 
 module Yes
   module Core
-    VERSION = '2.3.0'
+    VERSION = '2.4.0'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yes-core
 version: !ruby/object:Gem::Version
-  version: 2.3.0
+  version: 2.4.0
 platform: ruby
 authors:
 - Nico Ritsche
@@ -222,6 +222,7 @@ files:
 - lib/yes/core/aggregate/shared_read_model_rebuilder.rb
 - lib/yes/core/authentication_error.rb
 - lib/yes/core/authorization/cerbos_client_provider.rb
+- lib/yes/core/authorization/cerbos_grpc_retry_policy.rb
 - lib/yes/core/authorization/command_authorizer.rb
 - lib/yes/core/authorization/command_cerbos_authorizer.rb
 - lib/yes/core/authorization/lookup_cache.rb