Cerbos v0.40.0 :: Cerbos Authorization Management Platform // Documentation

Cerbos v0.40.0

Highlights

Constants are a new way of defining structured, constant values that can be referenced in policy conditions. They differ from Variables in two ways:

This release includes several enhancements to the policy testing framework to help reduce repetition, increase readability and increase reliability.

Multiple principals and/or resources can be referenced in a test expectation instead of just a single principal and a resource. This helps get rid of repetition and reduces the verbosity of test cases.

Before After
yaml<br> - name: Multiple principals and resources<br> input:<br> principals:<br> - bev<br> - barb<br> resources:<br> - leave_request<br> - cancelled_leave_request<br> actions:<br> - edit<br> - view<br> auxData: myJWT<br> expected:<br> - principal: bev<br> resource: leave_request<br> actions:<br> edit: EFFECT_ALLOW<br> view: EFFECT_ALLOW<br> - principal: bev<br> resource: cancelled_leave_request<br> actions:<br> edit: EFFECT_ALLOW<br> view: EFFECT_ALLOW<br> - principal: barb<br> resource: leave_request<br> actions:<br> edit: EFFECT_ALLOW<br> view: EFFECT_ALLOW<br> - principal: barb<br> resource: cancelled_leave_request<br> actions:<br> edit: EFFECT_ALLOW<br> view: EFFECT_ALLOW<br>
 yaml<br> - name: Multiple principals and resources<br> input:<br> principals:<br> - bev<br> - barb<br> resources:<br> - leave_request<br> - cancelled_leave_request<br> actions:<br> - edit<br> - view<br> expected:<br> - principals:<br> - bev<br> - barb<br> resources:<br> - leave_request<br> - cancelled_leave_request<br> actions:<br> edit: EFFECT_ALLOW<br> view: EFFECT_ALLOW<br>

Test fixtures now allow creating groups of principals or resources. These grouped principals or resources can be referenced by their group name in the test cases to further avoid duplication and make tests more readable.

principalGroups:
  managers:
    - bev
    - barb

resourceGroups:
  all_leave_requests:
    - leave_request
    - cancelled_leave_request

tests:
  - name: Grouped principals and resources
    input:
      principalGroups:
        - managers
      resourceGroups:
        - all_leave_requests
      actions:
        - edit
        - view
    expected:
      - principalGroups:
          - managers
        resources:
          - all_leave_requests
        actions:
          edit: EFFECT_ALLOW
          view: EFFECT_ALLOW

Tests that exercise policies with time-based conditions must define the value of now at the test suite level or at individual test case level. This ensures that tests are not flaky depending on the time of day the tests are run.

This is the last Cerbos release with support for SQL Server as a policy storage backend. It will be removed in the next release of Cerbos. This is due to low uptake and the lack of resources and expertise to maintain and support it going forward.

This release also includes several updates related to the experimental role policy feature. That feature is still at alpha level and is not recommended for production use.

Changelog

Bug Fixes

Features

Enhancements

Documentation

Chores