Cerbos v0.16.0 :: Cerbos Authorization Management Platform // Documentation

Cerbos v0.16.0

This release consolidates the different Check APIs into a simpler API, promotes the query plan API to stable status, and adds exciting new features to the REPL to make policy development easier and more interactive.

Highlights

This release introduces a new RPC (API entrypoint) named CheckResources (REST: /api/check/resources) for performing access checks. This supersedes the existing CheckResourceSet (REST: /api/check) and CheckResourceBatch (REST: /api/check_resource_batch) RPCs and simplifies the Cerbos API surface by removing the need to understand the subtle differences between the different calls. The old RPCs have been deprecated and are planned for removal in a future release of Cerbos.

Filtering and selecting a set of items from a datastore while making sure that the logged in user has access to each element in the resultset is a common problem in many applications. Given a user and the action they wish to perform on a resource category, the Cerbos query plan API produces a datastore-agnostic representation of constraints that must be satisfied by the resource instances in order to comply with access rules defined in Cerbos policies. It was introduced as an unstable API in Cerbos 0.12.0 and in this release it is promoted to stable status. The new stable RPC is named PlanResources (REST: /api/plan/resources) and includes refinements to the representation format of complex expressions to make them simpler and easier to translate into programming language constructs. This is a breaking change for gRPC clients because the RPC has been renamed.

The Cerbos REPL gains the ability to load policies and interactively evaluate the conditions defined in them. This empowers policy authors to debug, develop, and test complex conditions with rapid feedback and no context switching. The REPL prompt is now smarter and is able to handle copy-pasting of large chunks of multi-line text without the need to explicitly escape newlines as well.

When no policies apply to a request, Cerbos produces a DENY response by default. This is now recorded in the engine traces so that policy tests can be debugged much more easily.

Changelog

Features

Enhancements

Documentation

Chores

Other