Manager Tools

Manager Tools

Three ways to administer a running broker; all of them speak the signed command protocol from Management Commands, so the admin token stays on the operator's machine.

Interactive CLI — npm run manager

A menu-driven console reading TYO_MQ_ADMIN_TOKEN from .env:

1.  Show auth settings              12. Approve request by id
2.  Enable global auth              13. Reject request by id
3.  Disable global auth             14. Revoke authorized client token
4.  Add realm                       15. Set or clear realm manager key
5.  Rename realm                    16. Set or clear realm pre-shared key
6.  Enable auth for realm           17. Set realm producer acceptance
7.  Disable auth for realm          18. Show live stats
8.  Verify admin token              19. List dead-letter queue
9.  Show next authorization request 20. Replay dead-letter message
10. Approve next request            21. Discard dead-letter message
11. Reject next request

"Add realm" asks whether the realm is ephemeral (disposable) and for its TTL — see Ephemeral Realms.

Flags / environment: -h host, -p port, -s protocol, --env-file, --token-env, or TYO_MQ_HOST / TYO_MQ_PORT / TYO_MQ_PROTOCOL.

Web manager UI — npm run manager:web

Serves a static single-page manager on http://127.0.0.1:8080/manager.html (-p to change the port). Point it at any reachable broker URL and paste the admin token (kept in browser localStorage; commands are signed client-side).

Main tab — realms (auth toggle, manager key generate/rotate/copy/clear, consumer pre-shared key, producer acceptance toggle; add-realm form with an Ephemeral checkbox + TTL, and an ephemeral · expires … pill on disposable realms — Ephemeral Realms), pending authorization requests (approve/reject with role), issued tokens with revocation, External Auth (validators listed per scope — global / realm / prefix — with edit and scoped remove; the Scope field takes a realm name, a prefix ending in :, or blank for global), and management API tokens.

Persistence tab — view and hot-swap the storage backend (memory/sqlite/redis/custom) and default TTL.

Observability tab — live stats (realms, producers/consumers online, subscriptions) and a dead-letter queue browser with per-entry Replay and Discard buttons.

Non-interactive helpers

Script	Purpose
npm run auth:admin	verify the admin token authenticates (AUTH_OK {realm:"*", role:"admin"})
npm run auth:request -- --realm r --role producer --client-id id --client-name name	submit an authorization request; prints the generated client token
npm run auth:manager -- next [--realm r]	show the oldest pending request
npm run auth:manager -- approve <request_id> --role <role>	approve
npm run auth:manager -- reject <request_id> --reason "..."	reject

auth:manager signs with TYO_MQ_ADMIN_TOKEN, or with TYO_MQ_REALM_MANAGER_KEY for realm-scoped operators.

Library access

Everything the tools do is available as library calls on require('tyo-mq').Authorization — see Management Commands and Authorization Requests.