cerbos 0.5.0

Rust SDK for working with Cerbos: an open core, language-agnostic, scalable authorization solution
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162

// Copyright 2021-2025 Zenauth Ltd.
// SPDX-License-Identifier: Apache-2.0

use std::collections::HashMap;
use std::{borrow::Cow, path::Path};

use certs::CerbosTestTlsConfig;
use testcontainers::{
    core::{ContainerPort, Mount, WaitFor},
    Image,
};

pub mod certs;

pub struct CerbosContainer {
    image_name: String,
    image_tag: String,
    volume_mounts: Vec<Mount>,
    environment_vars: HashMap<String, String>,
    ports: Vec<ContainerPort>,
    cmd: Vec<String>,
}

impl Default for CerbosContainer {
    fn default() -> Self {
        let environment_vars =
            HashMap::from([("CERBOS_NO_TELEMETRY".to_string(), "1".to_string())]);
        Self {
            image_name: "ghcr.io/cerbos/cerbos".to_string(),
            image_tag: "latest".to_string(),
            volume_mounts: vec![],
            environment_vars,
            ports: vec![3592.into(), 3593.into()],
            cmd: vec![],
        }
    }
}

impl CerbosContainer {
    pub fn with_image_name<S>(self, image_name: S) -> Self
    where
        S: Into<String>,
    {
        Self {
            image_name: image_name.into(),
            ..self
        }
    }
    const CERT_PATH: &str = "/certs/";
    pub fn with_tls_config(mut self, config: &CerbosTestTlsConfig) -> Self {
        self.volume_mounts.push(Mount::bind_mount(
            config.get_temp_dir().path().to_string_lossy(),
            Self::CERT_PATH,
        ));
        Self::prepend_cmd_with_server(&mut self.cmd);
        self.cmd.push(
            "--set=server.tls.cert=".to_string() + Self::CERT_PATH + CerbosTestTlsConfig::CERT_NAME,
        );
        self.cmd.push(
            "--set=server.tls.key=".to_string() + Self::CERT_PATH + CerbosTestTlsConfig::CERT_KEY,
        );
        self
    }
    pub fn with_image_tag<S>(self, image_tag: S) -> Self
    where
        S: Into<String>,
    {
        Self {
            image_tag: image_tag.into(),
            ..self
        }
    }

    pub fn with_extra_volume_mounts<S, I>(mut self, mounts: I) -> Self
    where
        S: Into<String>,
        I: IntoIterator<Item = (S, S)>,
    {
        mounts.into_iter().for_each(|(k, v)| {
            self.volume_mounts
                .push(Mount::bind_mount(k.into(), v.into()))
        });
        self
    }

    pub fn with_environment_vars<S, I>(self, vars: I) -> Self
    where
        S: Into<String>,
        I: IntoIterator<Item = (S, S)>,
    {
        Self {
            environment_vars: vars
                .into_iter()
                .map(|(k, v)| (k.into(), v.into()))
                .collect(),
            ..self
        }
    }

    const CONFIG_PATH: &str = "/config/";

    fn prepend_cmd_with_server(cmd: &mut Vec<String>) {
        if cmd.is_empty() {
            cmd.push("server".to_string());
        }
    }
    pub fn with_config_path(mut self, config: &Path) -> Self {
        Self::prepend_cmd_with_server(&mut self.cmd);
        let filename = config.file_name().unwrap();
        self.cmd
            .push("--config=".to_string() + Self::CONFIG_PATH + filename.to_str().unwrap());
        self.volume_mounts.push(Mount::bind_mount(
            config.parent().unwrap().to_string_lossy(),
            Self::CONFIG_PATH,
        ));
        self
    }

    pub fn with_sqlite_in_memory_storage(mut self) -> Self {
        Self::prepend_cmd_with_server(&mut self.cmd);
        self.cmd.push("--set=storage.driver=sqlite3".to_string());
        self.cmd
            .push("--set=storage.sqlite3.dsn=:memory:".to_string());
        self
    }

    pub fn debug(self) -> Self {
        println!("{:?}, {:?}", self.cmd, self.volume_mounts);
        self
    }
}

impl Image for CerbosContainer {
    fn name(&self) -> &str {
        &self.image_name
    }

    fn tag(&self) -> &str {
        &self.image_tag
    }

    fn expose_ports(&self) -> &[ContainerPort] {
        &self.ports
    }

    fn mounts(&self) -> impl IntoIterator<Item = &testcontainers::core::Mount> {
        &self.volume_mounts
    }

    fn env_vars(
        &self,
    ) -> impl IntoIterator<Item = (impl Into<Cow<'_, str>>, impl Into<Cow<'_, str>>)> {
        self.environment_vars.iter()
    }

    fn ready_conditions(&self) -> Vec<testcontainers::core::WaitFor> {
        vec![WaitFor::message_on_stdout("Starting HTTP server")]
    }
    fn cmd(&self) -> impl IntoIterator<Item = impl Into<Cow<'_, str>>> {
        self.cmd.iter()
    }
}