34 lines
1.3 KiB
Plaintext
34 lines
1.3 KiB
Plaintext
# Certificate CN becomes the MQTT username — restrict each device to its own namespace.
|
|
pattern readwrite devices/%u/#
|
|
|
|
# Admin: brent
|
|
user brent
|
|
topic readwrite #
|
|
topic readwrite $SYS/#
|
|
|
|
# Admin: admin
|
|
user admin
|
|
topic readwrite #
|
|
topic readwrite $SYS/#
|
|
|
|
# Backend service: reads all device traffic, writes job acks back to devices,
|
|
# and publishes on behalf of the /sim simulator tool (devices/<serial>/log).
|
|
# Also ingests the SRS §3.4.2 ul/# namespace (app + device-direct) and writes the
|
|
# application-level acks back on ul/{orgId}/{clientClass}/{clientId}/ack.
|
|
user backend
|
|
topic read devices/#
|
|
topic write devices/+/jobs/ack
|
|
topic write devices/+/log
|
|
topic read ul/#
|
|
topic write ul/+/+/+/ack
|
|
|
|
# --- App-client namespace confinement (S2-a / SRS §3.4.2 Topic scheme) --------------
|
|
# The interim app credential uses username == orgId, so %u confines it to that tenant.
|
|
# The '+' clientId wildcard is the accepted Sprint 2 tradeoff: clients within one org share
|
|
# the credential and can see that org's ack topics until OIDC-derived per-client identity lands.
|
|
# Publish/read permissions are narrower than readwrite '#': only durable point input and acks.
|
|
pattern write ul/%u/app/+/log/points
|
|
pattern read ul/%u/app/+/ack
|
|
|
|
# testuser is a demo *device*: only the per-device pattern rule above applies
|