Struct RbacConfig 

#[non_exhaustive]
pub struct RbacConfig {
    pub enabled: bool,
    pub roles: Vec<RoleConfig>,
    pub redaction_salt: Option<SecretString>,
}

Top-level RBAC configuration (deserializable from TOML).

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

enabled: bool

Master switch – when false, the RBAC middleware is not installed.

roles: Vec<RoleConfig>

Role definitions available to identities.

redaction_salt: Option<SecretString>

Optional stable HMAC key (any length) used to redact argument values in deny logs. When set, redacted hashes are stable across process restarts (useful for log correlation across deploys). When None, a random 32-byte key is generated per process at first use; redacted hashes change every restart.

The key is wrapped in SecretString so it never leaks via Debug/Display/serde and is zeroized on drop.

Implementations

impl RbacConfig

pub fn with_roles(roles: Vec<RoleConfig>) -> Self

Create an enabled RBAC config with the given roles.

Trait Implementations

impl Clone for RbacConfig

fn clone(&self) -> RbacConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RbacConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RbacConfig

fn default() -> RbacConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for RbacConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.