# MQTT topic ACLs — first-pass static per-role credentials.
#
# Topic taxonomy:
#   private/user/{userId}/notifications  - direct-to-user notifications
#   role/{roleName}/alerts               - role-broadcast alerts
#   module/{module}/events               - CRUD/live-update events for a module's list views
#   broadcast/system                     - app-wide announcements
#
# LIMITATION (documented, not silent): static per-role credentials give
# role-level topic isolation only, not per-user isolation. A `role_user`
# connection can read another user's `private/user/{id}/notifications`
# topic if it subscribes to the wildcard below. Per-user isolation requires
# a JWT-validating auth plugin (e.g. mosquitto-go-auth) mapping topics to
# the authenticated user's own id — deferred as a follow-up.

# Backend service account: full publish access (it is the only publisher).
user laravel_publisher
topic readwrite #

# Super Admin / Admin role: read everything relevant to admin operations.
user role_admin
topic read broadcast/system
topic read role/admin/alerts
topic read module/+/events
topic read private/+/notifications

# Manager role: module events + its own role alerts + system broadcasts.
user role_manager
topic read broadcast/system
topic read role/manager/alerts
topic read module/+/events
topic read private/+/notifications

# Standard user role: system broadcasts + its own role alerts only.
user role_user
topic read broadcast/system
topic read role/user/alerts
topic read private/+/notifications