Cerbos v0.19.0

Highlights

The PlanResources API now validates requests using schemas to flag any invalid or unknown attributes. Similar to the CheckResources API, the schema enforcement level defined in the configuration file determines whether invalid requests are processed with warnings or completely rejected.

This release also includes several fixes to the PlanResources output to simplify the plan produced for expressions that make use of higher-order functions like in and exists. The AST produced for logical operators like and and or is now more consistent regardless of the operator used as well.

Distributed traces can now be exported to collectors that support OTLP by using the new otlp exporter. Thanks to community member @rcrowe for contributing this feature.

Changelog

Bug Fixes

• Avoid short-circuit when expressions access non-existent attributes ( #1056)

• Handle missing scopes in playground validate API ( #1042)

• Transform &&/|| to and/or in ASTs ( #1021)

• Transform maps to lists for membership test ( #1032)

• Transform maps to lists in comprehension expressions ( #1044)

• Transform membership test in empty list to false ( #1059)

Enhancements

• Export traces via OTLP to a collector ( #1017)

• Output detailed index build errors when the number of errors is low ( #1038)

• Validate schemas when planning queries ( #1013)

Documentation

• Add AWS Cognito integration demo docs ( #1037)

• Updating customer logos ( #1054)

• Use analogy to explain derived roles ( #1015)

Chores

• Add function to compile a set of files ( #1046)

• Bump version to 0.19.0

• Fix confdocs panic when no struct tag is provided ( #1020)

• Fix flaky query plan test by sorting map keys in deterministic order ( #1043)

• Fix flaky update store test ( #1045)