Auto-tools/Projects/Pulse: Difference between revisions

Since exchange and queue permissions go together, we'll need exchange and queue naming conventions mixed with restrictive permissions.  Each publishing user, in addition to being restricted to a particular vhost, will also be restricted to a particular set of exchange names.  For example, the BuildBot publisher will have permissions of <code>"^org.mozilla.exchange.build*" "^org.mozilla.exchange.build*" "^org.mozilla.exchange.build*"</code>.  Similarly, we'll need a name convention for queues, e.g. org.mozilla.queue.<username>.<applabel>.  This will both prevent consumer users from writing to exchanges as well as prevent them from consuming from the queues of other users (we may have to have certain restrictions on characters allowed in usernames to prevent possible collisions, e.g. disallow periods).  For convenience, if a consumer creates a nondurable queue, mozillapulse can assign a random suffix to the user's standard queue name prefix, i.e. org.mozilla.queue.<username>.<random string>, since the user wouldn't be able to create nor access a completely random server-assigned name.

With this security model, we technically don't really need vhosts, since the names of the queues and exchanges the users can use are so specific.  There may still be a benefit in allowing apps to use the same queue name for different exchanges, though, which would be possible if each exchange had its own vhost.  The downside is that you cannot specify "all vhosts" when setting a user's permissions, so they would either have to list all vhosts they want to use when creating the user in PulseGuardian, and be able to update that list later, or PulseGuardian or some other app would have to automatically add new permissions to all users when a vhost is created.