1
85%
main: 85%

Ran 13 Dec 2025 05:51AM UTC

Files 61

Run time 3s

Badge

Embed ▾

Committed 12 Dec 2025 04:21PM UTC coverage: 83.736% (-1.3%) from 85.056%

Job # 20187010333.1

Build Type

push

github

Committed by

web-flow

Commit Message

[CHANGED] MQTT: Permissions to "$MQTT." are now implicit (#7637)

When the server has to create a subscription for a JetStream consumer
(in case of QoS1/2), it would do it with a `$MQTT_sub.` prefix. This
then required users to explicitly add this subject prefix when users had
subscribe permissions.
In more complex setups, there would likely be other permissions to be
granted.

Since the server already checks that a MQTT client is allowed to publish
or subscribe on a given topic/subject based on the user's permissions
set, then the internal need to subscribe to a `$MQTT_sub.xxx` subject
should not be checked. In other words, the server would not create a
subscription on that internal subject if the user is not allowed to
subscribe on "foo" for instance.

So the change in this PR implicitly allows MQTT clients (not regular
NATS core clients) or non client connections (say routes, leaf, etc..)
to pub/sub on any "$MQTT." prefixed subject. Note that the change still
allows "deny" clause to be applied in case the user would want to
explicitly restrict some of the MQTT related subjects to be exchanged.

Signed-off-by: Ivan Kozlovic <ivan@synadia.com>

Run Details

73262 of 87492 relevant lines covered (83.74%)

329006.81 hits per line

nats-io / nats-server / 20187010333 / 1
85%
main: 85%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 20187010333.1

nats-io / nats-server / 20187010333 / 1 85% main: 85%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 20187010333.1

nats-io / nats-server / 20187010333 / 1
85%
main: 85%

README BADGES
x