Struct RbacConfig 

#[non_exhaustive]
pub struct RbacConfig {
    pub enabled: bool,
    pub roles: Vec<RoleConfig>,
    pub allow_operation_matching: AllowOperationMatching,
    pub global_deny: Vec<String>,
    pub redaction_salt: Option<SecretString>,
}

Top-level RBAC configuration (deserializable from TOML).

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

enabled: bool

Master switch – when false, the RBAC middleware is not installed.

roles: Vec<RoleConfig>

Role definitions available to identities.

allow_operation_matching: AllowOperationMatching

How RoleConfig::allow entries are matched. Defaults to AllowOperationMatching::Legacy (exact match) so that enabling glob support is always a deliberate operator decision.

global_deny: Vec<String>

Server-wide operation kill switch, evaluated before any role is consulted and applied regardless of what a role’s allow grants – including allow = ["*"].

Entries are always glob-matched, independent of RbacConfig::allow_operation_matching. This list can only ever remove capability, never add it.

Two scope limits apply. It is gated on RbacConfig::enabled: when RBAC is disabled every check short-circuits to RbacDecision::Allow before the kill switch is consulted. And it governs invocation only – like the rest of this engine it is enforced on tools/call, so a denied tool may still appear in a tools/list response unless the handler filters it.

redaction_salt: Option<SecretString>

Optional stable HMAC key (any length) used to redact argument values in deny logs. When set, redacted hashes are stable across process restarts (useful for log correlation across deploys). When None, a random 32-byte key is generated per process at first use; redacted hashes change every restart.

The key is wrapped in SecretString so it never leaks via Debug/Display/serde and is zeroized on drop.

Implementations

impl RbacConfig

pub fn with_roles(roles: Vec<RoleConfig>) -> Self

Create an enabled RBAC config with the given roles.

pub fn with_global_deny(self, global_deny: Vec<String>) -> Self

Set the server-wide operation kill switch. Entries are glob-matched.

pub fn with_allow_operation_matching(self, mode: AllowOperationMatching) -> Self

Opt into glob matching for RoleConfig::allow entries.

impl RbacConfig

pub fn apply_env_overrides( &mut self, ) -> Result<Vec<EnvOverride>, RmcpServerKitError>

Applies RMCP_SERVER_KIT__RBAC__* environment overrides.

Supports direct redaction_salt and _FILE secret indirection. Report entries for the secret target always redact the value. File-based secrets are treated as text: exactly one terminal line ending is removed (\r\n, \n, or \r) while other whitespace is preserved.

Errors

Returns RmcpServerKitError::Config when both direct and file-based salt variables are set or when the _FILE target cannot be read.

Examples

The full config-file pipeline lives in examples/config_file_server.rs.

use rmcp_server_kit::rbac::RbacConfig;

let mut rbac = RbacConfig::default();
// Do not set process env in doctests: rustdoc examples share a process.
let report = rbac.apply_env_overrides()?;
let _secret_targets: Vec<&str> = report
    .iter()
    .filter(|entry| entry.value.is_none())
    .map(|entry| entry.target_field.as_str())
    .collect();

Trait Implementations

impl Clone for RbacConfig

fn clone(&self) -> RbacConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RbacConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RbacConfig

fn default() -> RbacConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for RbacConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.