Struct RbacConfig 

#[non_exhaustive]
pub struct RbacConfig {
    pub enabled: bool,
    pub roles: Vec<RoleConfig>,
    pub redaction_salt: Option<SecretString>,
}

Top-level RBAC configuration (deserializable from TOML).

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

enabled: bool

Master switch – when false, the RBAC middleware is not installed.

roles: Vec<RoleConfig>

Role definitions available to identities.

redaction_salt: Option<SecretString>

Optional stable HMAC key (any length) used to redact argument values in deny logs. When set, redacted hashes are stable across process restarts (useful for log correlation across deploys). When None, a random 32-byte key is generated per process at first use; redacted hashes change every restart.

The key is wrapped in SecretString so it never leaks via Debug/Display/serde and is zeroized on drop.

Implementations

impl RbacConfig

pub fn with_roles(roles: Vec<RoleConfig>) -> Self

Create an enabled RBAC config with the given roles.

impl RbacConfig

pub fn apply_env_overrides( &mut self, ) -> Result<Vec<EnvOverride>, RmcpServerKitError>

Applies RMCP_SERVER_KIT__RBAC__* environment overrides.

Supports direct redaction_salt and _FILE secret indirection. Report entries for the secret target always redact the value. File-based secrets are treated as text: exactly one terminal line ending is removed (\r\n, \n, or \r) while other whitespace is preserved.

Errors

Returns RmcpServerKitError::Config when both direct and file-based salt variables are set or when the _FILE target cannot be read.

Examples

The full config-file pipeline lives in examples/config_file_server.rs.

use rmcp_server_kit::rbac::RbacConfig;

let mut rbac = RbacConfig::default();
// Do not set process env in doctests: rustdoc examples share a process.
let report = rbac.apply_env_overrides()?;
let _secret_targets: Vec<&str> = report
    .iter()
    .filter(|entry| entry.value.is_none())
    .map(|entry| entry.target_field.as_str())
    .collect();

Trait Implementations

impl Clone for RbacConfig

fn clone(&self) -> RbacConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RbacConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RbacConfig

fn default() -> RbacConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for RbacConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.