39 lines
1.5 KiB
Plaintext
39 lines
1.5 KiB
Plaintext
# MQTT topic ACLs — first-pass static per-role credentials.
|
|
#
|
|
# Topic taxonomy:
|
|
# private/user/{userId}/notifications - direct-to-user notifications
|
|
# role/{roleName}/alerts - role-broadcast alerts
|
|
# module/{module}/events - CRUD/live-update events for a module's list views
|
|
# broadcast/system - app-wide announcements
|
|
#
|
|
# LIMITATION (documented, not silent): static per-role credentials give
|
|
# role-level topic isolation only, not per-user isolation. A `role_user`
|
|
# connection can read another user's `private/user/{id}/notifications`
|
|
# topic if it subscribes to the wildcard below. Per-user isolation requires
|
|
# a JWT-validating auth plugin (e.g. mosquitto-go-auth) mapping topics to
|
|
# the authenticated user's own id — deferred as a follow-up.
|
|
|
|
# Backend service account: full publish access (it is the only publisher).
|
|
user laravel_publisher
|
|
topic readwrite #
|
|
|
|
# Super Admin / Admin role: read everything relevant to admin operations.
|
|
user role_admin
|
|
topic read broadcast/system
|
|
topic read role/admin/alerts
|
|
topic read module/+/events
|
|
topic read private/+/notifications
|
|
|
|
# Manager role: module events + its own role alerts + system broadcasts.
|
|
user role_manager
|
|
topic read broadcast/system
|
|
topic read role/manager/alerts
|
|
topic read module/+/events
|
|
topic read private/+/notifications
|
|
|
|
# Standard user role: system broadcasts + its own role alerts only.
|
|
user role_user
|
|
topic read broadcast/system
|
|
topic read role/user/alerts
|
|
topic read private/+/notifications
|