consumer: add acl role for every consumer - #3965
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Existing consumers are not migrated on normal upgrades because reconciliation is incorrectly gated by the initialization flag.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Adds Mosquitto ACL role lifecycle management for consumers.
Changes:
- Creates consumer access/write roles at startup and creation.
- Removes roles when consumers are deleted.
File summaries
| File | Description |
|---|---|
mosquitto_dynsec.py |
Reconciles consumer ACL roles during initialization. |
command.py |
Manages roles when consumers are added or removed. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| for consumer in SubData.consumer_data.values(): | ||
| add_acl_role("consumer-<id>-access", consumer.num) | ||
| if consumer.data.module is not None and consumer.data.module.type == "mqtt": | ||
| add_acl_role("consumer-<id>-write-access", consumer.num) |
There was a problem hiding this comment.
🟡 Changes recommended
The new role provisioning exposes unscoped commands that permit cross-consumer modifications.
Get a fresh assessment by requesting another Copilot review.
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 2
- Review effort level: Balanced
| Pub().pub("openWB/set/command/max_id/hierarchy", new_id) | ||
| # add ACL roles for consumer access, if user management is active | ||
| if SubData.system_data["system"].data["security"]["user_management_active"]: | ||
| add_acl_role("consumer-<id>-access", new_id) |
There was a problem hiding this comment.
Die Ankerkung ist korrekt. Eigentlich wäre bei sämtlichen Commands, welche nur einzelne Komponenten, Ladepunkte, etc. betreffen die ID im Topic erforderlich, um mit ACLs arbeiten zu können.
Das sollte in einem folgenden PR umgesetzt werden.
| self._loop_all_received_topics(upgrade) | ||
| self._append_datastore_version(148) | ||
|
|
||
| def upgrade_datastore_149(self) -> None: |
fcb338f to
c1acaca
Compare
| Pub().pub("openWB/set/command/max_id/hierarchy", new_id) | ||
| # add ACL roles for consumer access, if user management is active | ||
| if SubData.system_data["system"].data["security"]["user_management_active"]: | ||
| add_acl_role("consumer-<id>-access", new_id) |
There was a problem hiding this comment.
Die Ankerkung ist korrekt. Eigentlich wäre bei sämtlichen Commands, welche nur einzelne Komponenten, Ladepunkte, etc. betreffen die ID im Topic erforderlich, um mit ACLs arbeiten zu können.
Das sollte in einem folgenden PR umgesetzt werden.
c1acaca to
a185d12
Compare
No description provided.