20220893943

Committed 12 Dec 2025 04:21PM UTC coverage: 85.114% (+0.2%) from 84.896%

Build # 20220893943

Build Type

push

github

Committed by

web-flow

Commit Message

[CHANGED] MQTT: Permissions to "$MQTT." are now implicit (#7637)

When the server has to create a subscription for a JetStream consumer
(in case of QoS1/2), it would do it with a `$MQTT_sub.` prefix. This
then required users to explicitly add this subject prefix when users had
subscribe permissions.
In more complex setups, there would likely be other permissions to be
granted.

Since the server already checks that a MQTT client is allowed to publish
or subscribe on a given topic/subject based on the user's permissions
set, then the internal need to subscribe to a `$MQTT_sub.xxx` subject
should not be checked. In other words, the server would not create a
subscription on that internal subject if the user is not allowed to
subscribe on "foo" for instance.

So the change in this PR implicitly allows MQTT clients (not regular
NATS core clients) or non client connections (say routes, leaf, etc..)
to pub/sub on any "$MQTT." prefixed subject. Note that the change still
allows "deny" clause to be applied in case the user would want to
explicitly restrict some of the MQTT related subjects to be exchanged.

Signed-off-by: Ivan Kozlovic <ivan@synadia.com>

Run Details

74468 of 87492 relevant lines covered (85.11%)

331102.24 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

54.4

/src/github.com/nats-io/nats-server/server/jetstream_errors_generated.go

Source Not Available

The file "src/github.com/nats-io/nats-server/server/jetstream_errors_generated.go" isn't available on github. Either it's been removed, or the repo root directory needs to be updated.

nats-io / nats-server / 20220893943

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source Not Available

Source File
Press 'n' to go to next uncovered line, 'b' for previous