{"action":"created","issue":{"url":"https://api.github.com/repos/SamSaffron/message_bus/issues/63","labels_url":"https://api.github.com/repos/SamSaffron/message_bus/issues/63/labels{/name}","comments_url":"https://api.github.com/repos/SamSaffron/message_bus/issues/63/comments","events_url":"https://api.github.com/repos/SamSaffron/message_bus/issues/63/events","html_url":"https://github.com/SamSaffron/message_bus/issues/63","id":125703583,"number":63,"title":"Restrict subscription to a channel?","user":{"login":"namelessjon","id":2833,"avatar_url":"https://avatars.githubusercontent.com/u/2833?v=3","gravatar_id":"","url":"https://api.github.com/users/namelessjon","html_url":"https://github.com/namelessjon","followers_url":"https://api.github.com/users/namelessjon/followers","following_url":"https://api.github.com/users/namelessjon/following{/other_user}","gists_url":"https://api.github.com/users/namelessjon/gists{/gist_id}","starred_url":"https://api.github.com/users/namelessjon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/namelessjon/subscriptions","organizations_url":"https://api.github.com/users/namelessjon/orgs","repos_url":"https://api.github.com/users/namelessjon/repos","events_url":"https://api.github.com/users/namelessjon/events{/privacy}","received_events_url":"https://api.github.com/users/namelessjon/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-01-08T22:00:37Z","updated_at":"2016-01-10T04:52:56Z","closed_at":"2016-01-09T06:48:50Z","body":"Not sure on the best place to ask more support questions, but is there a way to restrict subscription to channel?\r\n\r\nI'm looking at using message_bus for a chat type application, but there's also some internal messaging that would ideally go over the message bus (there's a message bus, why not use it?). However, I can't see any way to stop a chat client from subscribing to one of these internal channels, except by running them on a different message bus (e.g. db 1) or giving the channels \"unguessable\" names.\r\n\r\nIs there something I'm missing?"},"comment":{"url":"https://api.github.com/repos/SamSaffron/message_bus/issues/comments/170314336","html_url":"https://github.com/SamSaffron/message_bus/issues/63#issuecomment-170314336","issue_url":"https://api.github.com/repos/SamSaffron/message_bus/issues/63","id":170314336,"user":{"login":"SamSaffron","id":5213,"avatar_url":"https://avatars.githubusercontent.com/u/5213?v=3","gravatar_id":"","url":"https://api.github.com/users/SamSaffron","html_url":"https://github.com/SamSaffron","followers_url":"https://api.github.com/users/SamSaffron/followers","following_url":"https://api.github.com/users/SamSaffron/following{/other_user}","gists_url":"https://api.github.com/users/SamSaffron/gists{/gist_id}","starred_url":"https://api.github.com/users/SamSaffron/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SamSaffron/subscriptions","organizations_url":"https://api.github.com/users/SamSaffron/orgs","repos_url":"https://api.github.com/users/SamSaffron/repos","events_url":"https://api.github.com/users/SamSaffron/events{/privacy}","received_events_url":"https://api.github.com/users/SamSaffron/received_events","type":"User","site_admin":false},"created_at":"2016-01-10T04:52:56Z","updated_at":"2016-01-10T04:52:56Z","body":"Yes, internal clients get all messages, only external clients get filtered\non group/user.\n\nThe way message bus is designed one HTTP endpoint takes care of N\nsubscriptions, securing at the HTTP endpoint is possible, but you would\nthen have an all or nothing type design. It is wasteful to be polling N\nendpoint for N channels.\n\nOn Sun, Jan 10, 2016 at 2:47 AM, Jon <notifications@github.com> wrote:\n\n> I agree entirely that opaque channel names are security through obscurity,\n> and that is definitely not my preferred solution.\n>\n> The solution you suggested seems to require remembering to publish every\n> internal message with the :internal group, or whatever, or it could\n> potentially leak, which does seem fragile (vs not authorizing external\n> subscription to the channel). Am I right in reading that 'internal' clients\n> (i.e. those directly using MessageBus.subscribe) automatically get all\n> messages, regardless of group/user id for the message? (I see no API for a\n> subscription only to messages from a particular group)\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/SamSaffron/message_bus/issues/63#issuecomment-170252990>\n> .\n>\n"}}