nats.rs icon indicating copy to clipboard operation
nats.rs copied to clipboard

Subscription Violation not returned as Subcribe error

Open bella-wmi opened this issue 7 months ago • 2 comments

Observed behavior

Im expirementing with the auth callout and setting permissions for clients connecting to my nats-server. The following setup is happening:

  1. Im creating a client and connecting to the server with the following nats claims:
User claims nats: UserClaimsNats { publish: NatsSubjectPermissions { allow: ["_INBOX.>"], deny: [] }, subscribe: NatsSubjectPermissions { allow: ["allowed_subject"], deny: [] }, jwt_type: "user", version: 2 }
  1. The nats connections is created without 'Authorization Violation Errors'
  2. Im subscribing to a subject that is not allowed:
let _testsubscribe = nats_client
        .subscribe("this.is.not.allowed")
        .await
        .unwrap();
  1. Nats logs returning:
[1] 2024/07/04 09:56:26.024888 [TRC] 172.20.0.6:37146 - cid:619 - <<- [SUB this.is.not.allowed 1]
[1] 2024/07/04 09:56:26.024914 [TRC] 172.20.0.6:37146 - cid:619 - ->> [-ERR Permissions Violation for Subscription to "this.is.not.allowed"]
[1] 2024/07/04 09:56:26.024936 [ERR] 172.20.0.6:37146 - cid:619 - Subscription Violation - User "system_account_test_client", Subject "this.is.not.allowed", SID 1
[1] 2024/07/04 09:56:26.026861 [DBG] 172.20.0.6:37146 - cid:619 - Client connection closed: Client Closed
  1. unwarp() call on subcribe is not triggering a panic and the code continues.

Expected behavior

I would expect the subscribe to return an error in this case an the unwrap to trigger a warning.

Server and client version

nats-server: v2.10.16

Host environment

No response

Steps to reproduce

No response

bella-wmi avatar Jul 04 '24 09:07 bella-wmi