# Copyright 2016 Apcera Inc. All rights reserved.

listen: 127.0.0.1:2442

authorization {
  # Our role based permissions.

  # Admin can do anything.
  ADMIN = {
    publish = ">"
    subscribe = ">"
  }

  # Can do requests on req.foo or req.bar, and subscribe to anything
  # that is a response, e.g. _INBOX.*
  #
  # Notice that authorization filters can be singletons or arrays.
  REQUESTOR = {
    publish = ["req.foo", "req.bar"]
    subscribe = "_INBOX.*"
  }

  # Default permissions if none presented. e.g. Joe below.
  DEFAULT_PERMISSIONS = {
    publish = "SANDBOX.*"
    subscribe = ["PUBLIC.>", "_INBOX.>"]
  }

  # This is to benchmark pub performance.
  BENCH = {
    publish = "a"
  }

  # Just foo for testing
  PASS: $2a$10$UHR6GhotWhpLsKtVP0/i6.Nh9.fuY73cWjLoJjb2sKT8KISBcUW5q

  # Users listed with permissions.
  users = [
    {user: alice, password: $PASS, permissions: $ADMIN}
    {user: bob,   password: $PASS, permissions: $REQUESTOR}
    {user: bench, password: $PASS, permissions: $BENCH}
    {user: joe,   password: $PASS}
  ]
}