Wildcard subscriptions with limited permissions

[formula349]

What I would like to do here doesn't seem possible currently. If I'm wrong please let me know.

My use case is allowing different users with different permissions to be able to subscribe to a wildcard subject to receive all subscription updates that they have subscribe permissions to without having to subscribe to each distinct subject.

For instance, there are 100 organizations with a subject of "org.{id}" and some users might have permissions to subscribe to all of those subjects, and others only permissions to some. Right now I have to create up to 100 different subscriptions to handle all of these subjects because I can't reliably use wildcards for the organization ID.

Now another requirement would be to watch for updates on sites within each organization which would have subjects like this: "org.{id}.site.{id}". Now the number of subscriptions is exponentially greater without wildcards.

I'd like to be able to subscribe to "org." and "org..site.*" and not get a permissions error when a user has limited access to those subjects.

Is this possible now or in the future?

[derekcollison]

You can allow ord.* but add in deny clauses for users for things they should not receive.

[formula349]

Good to know. I'll experiment with that, but it could end up being more complex or error-prone depending on the complexity.

I still think it would be great to allow wildcard subscriptions that only deliver authorized subjects. Is that something that can be considered?

[derekcollison]

If there is a natural grouping besides the org etc you can add class tokens and use those as well.

[formula349]

I can't find any info on class tokens in the documentation, so I'm not sure what you mean. Can you provide a link to explain class tokens?

[derekcollison]

Meaning let's say you have orders, and you have several states for them, created, updated, shipped, canceled. You can make those states a token in the subject and then it can be used for permissions.

Your use case may be more dynamic and wide then that but hopefully that gives you a sense of what we mean.