ACL interface design

[zmstone]

posting an example config here to trigger questions and discussions.
It is in HOCON (JSON equivalent) format.
Same JSON serves both reading from config and handling management API POSTs

[
	{principal_filters: [{username: "^superuser$"}] # regex
	 topic_filters: ["#"]
	 operations: [pub, sub]
	 control: allow
	}
	{# principal_filters: #  apply to all clients if there is no filter
	 topic_filters: ["foo/%c/#"]  # general rule to allow all clients to subscribe foo/<client-id>/#
	 operations: [sub],
	 control: allow
	}
	{principal_filters: [{clientid: "^mydevice-v1-.*"}] # lookup db only when client id has prefix 'mydevice-'
	 controller:
		{id: emqx_acl_postgres
	  	 type: postgres
	  	 host: "postgres.local.host:5432"
	  	 username: emqx_acl_controller_user
	  	 password: secret
	  	 database: emqx
	  	 query: "select topic_filter,control from mydevices where clientid='%c' operation='%o' order by sort_key"
	  	 # query results in pairs like [{"foo/bar/#", allow}, {"foo/bar/$sens/#", deny}]
		}
	}
	{principal_filters: [{clientid: "^mydevice-v2-.*"}, {ipaddr, "10.0.2.0/24"}]
	 controller:
		{id: emqx_acl_http
	  	 type: http
	  	 host: "http://acl.local.host:5432"
	  	 params: "access=%A,username=%u,clientid=%c,ipaddr=%a,topic=%t,mountpoint=%m"
	  	 # return http 200 and "ignore" in HTML body to continue the chain,
	  	 # return http 200 to allow
	  	 # return 403 to deny 
		}
	}
	# the last rule is to deny all other accesses
	{topic_filters: ["#"]
	 operations: [pub, sub],
	 control: deny
	}
]

NOTE 1: A rule chain, but not a tree, is not to make it too complicated.
NOTE 2: Empty result from DB query means continue applying the tail of the chain.

[zmstone]

@dsilletti @gbrehmer you guys seem to be using ACL plugins ?
could you share some ideas or comments ?

[gbrehmer]

We are only using internal ACL rules because a simple config met all our requirements:

• each device can only pubsub on device specific topics (topic prefix with placeholders home/+/+/%u/#)
• internal service account can access all device messages and some internal topics
• admin pubsub for broker internal topics + dashboard can subscribe

We would prefer fast ACL checks, so probably Postgres will never be used for this (only for user/pw check) in our case.
We didn't changed the acl rules since the beginning :) all fine (4 years ago no other broker has such a simple, powerful (placeholder support) and fast acl check I know about)

[zmstone]

@gbrehmer Thank you.
controller rules are optional in the chain.
The internal acl.conf functionality will be kept, but in a more interface-able representation (JSON),
because currently a node needs restart to reload the rules.

ADD: With the new config/API, we'll support dynamic reloading.