Is it possible to create/update ACLs on-fly?

[afshin-pir-GGL]

Hi

Is it possible that I manually change and update ACLs at runtime? My question is about library itself right now, but it was great if mqttv5-cli also could achieve it via mqttv5 acl command.

[fabracht]

Hi,
Yes, both are possible. The AclManager exposes async methods to mutate rules while the broker is running, without restarting it. The CLI's acl subcommand manages an ACL file on disk (acl.txt) rather than a running broker's in-memory state. It supports add, remove, list, check, role-add, role-remove, role-list, assign, unassign, user-roles. You can check the CLI-USAGE.md document for details on how to do it.
If a running broker was started with --acl-file acl.txt, editing it via mqttv5 acl should update the broker's live rules.

[afshin-pir-GGL]

@fabracht
Hi,
Thanks for the update.
Based on what you mentioned, I have tested cli and it does not work with changes inside acl file unless you manually send HUB signal to the broker to reload config. The reason is obvious. The hot reload part of code tracks changes inside config file, but not inside acl (or other linked files like passwords). Since adding acls changes acl file and not config file, it will not be caught by hot reloading.
It will be great if we could add internal files to the tracking list. I may try to raise a PR for it if I could.

Best Regards,
Afshin

[fabracht]

You're right. The watcher only tracked the config file, so edits to the linked ACL, password, and SCRAM files weren't detected on their own. You had to touch the config or send SIGHUP.

Fixed on main in #144. HotReloadManager now also watches the acl_file, password_file, and scram_file from the running config, compares each file's content hash, and reloads the auth provider when one changes. Editing acl.txt is picked up within the watcher interval without SIGHUP.

Released in mqtt5 0.38.5.

[afshin-pir-GGL]

Thanks a lot for the implementation. :)