Upgrading to Cerbos 0.14.0 :: Cerbos Authorization Management Platform // Documentation

Upgrading to Cerbos 0.14.0

This release introduces matrix tests for policy tests and existing test files require minor changes to be compatible with the new test runner.

`input` section

resource field has been replaced with a list field named resources that must contain one or more resources to use as input to the test.
A new list field named principals has been added to define the list of principals to be used as input to the test.
requestID field has been removed.

`expected` section

resource is a new, required field that must be populated to indicate which resource is being referred to in the expectation.
Only resource and principal combinations that are expected to produce an ALLOW result needs to be defined in the expected section. If no pair is defined, it is assumed to produce a DENY result.

Example: Converting an Existing Test to the New Format

Before Cerbos 0.14.0 After Cerbos 0.14.0

yaml --- name: AlbumObjectTestSuite resources: alicia_private_album: kind: "album:object" attr: owner: "alicia" id: "XX125" public: false flagged: false principals: alicia: id: "alicia" roles: ["user"] bradley: id: "bradley" roles: ["user"] maria: id: "maria" roles: ["moderator", "user"] tests: - name: View album input: actions: ["view"] resource: alicia_private_album expected: - principal: alicia actions: view: EFFECT_ALLOW - principal: bradley actions: view: EFFECT_DENY - principal: maria actions: view: EFFECT_DENY yaml --- name: AlbumObjectTestSuite resources: alicia_private_album: kind: "album:object" attr: owner: "alicia" id: "XX125" public: false flagged: false principals: alicia: id: "alicia" roles: ["user"] bradley: id: "bradley" roles: ["user"] maria: id: "maria" roles: ["moderator", "user"] tests: - name: View album input: actions: ["view"] principals: ["alicia", "bradley", "maria"] resources: ["alicia_private_album"] expected: - principal: alicia actions: view: EFFECT_ALLOW

Before Cerbos 0.14.0	After Cerbos 0.14.0
yaml<br>---<br>name: AlbumObjectTestSuite<br>resources:<br> alicia_private_album:<br> kind: "album:object"<br> attr:<br> owner: "alicia"<br> id: "XX125"<br> public: false<br> flagged: false<br>principals:<br> alicia:<br> id: "alicia"<br> roles: ["user"]<br> bradley:<br> id: "bradley"<br> roles: ["user"]<br> maria:<br> id: "maria"<br> roles: ["moderator", "user"]<br>tests:<br> - name: View album<br> input:<br> actions: ["view"]<br> resource: alicia_private_album<br> expected:<br> - principal: alicia<br> actions:<br> view: EFFECT_ALLOW<br> - principal: bradley<br> actions:<br> view: EFFECT_DENY<br> - principal: maria<br> actions:<br> view: EFFECT_DENY<br>	yaml<br>---<br>name: AlbumObjectTestSuite<br>resources:<br> alicia_private_album:<br> kind: "album:object"<br> attr:<br> owner: "alicia"<br> id: "XX125"<br> public: false<br> flagged: false<br>principals:<br> alicia:<br> id: "alicia"<br> roles: ["user"]<br> bradley:<br> id: "bradley"<br> roles: ["user"]<br> maria:<br> id: "maria"<br> roles: ["moderator", "user"]<br>tests:<br> - name: View album<br> input:<br> actions: ["view"]<br> principals: ["alicia", "bradley", "maria"]<br> resources: ["alicia_private_album"]<br> expected:<br> - principal: alicia<br> actions:<br> view: EFFECT_ALLOW<br>

Upgrading to Cerbos 0.14.0

input section

expected section

Example: Converting an Existing Test to the New Format

`input` section

`expected` section