Permissions for request/reply requester

[jorinvo]

Hi, I am struggling to understand how to set the permissions for a user that should be allowed to send req/rep requests.
The publish part makes sense, but then the user needs subscribe permissions to _INBOX.> which allows it to listen to all responses, not only responses to its own requests.
I saw the allow_responses option, but that is for the replier user, not the responder.

Also for context: I am using jetstream Publish via the Go client, which under the hood uses req/rep. To get the ACK, you need the subscribe permissions. Took me a bit to figure that out.

Thanks 🙂

[Jarema]

Hey.

User does not need to subscsribe to _INBOX.>, but rather _INBOX.mux_token.*, but that of course does not address the issue you're mentioning.

You can configure custom inbox.
This example should address your issue:
https://natsbyexample.com/examples/auth/private-inbox/cli

[jorinvo]

Thanks for replying Jarema!

Setting a custom inbox looks promising, but it would require the client to know about what to set this option to and I would have to establish a convention of what that looks like. Also from my research it doesn't seem to be widely supported by client libraries. Ideally I would like the server to set this.

I should mention I am using nats-server from Go. If there is a way for me to set the client's inbox name from Go, that would work.

[Jarema]

This should be settable in every major client, and if in any it's not - just let me know here.

For go, use this.

EDIT: To give you some explanation why server cannot do this:
request-reply is based on sub to INBOX subject and sending publish with reply.
Server cannot control on which subject client is expecting responses.

[jorinvo]

Since I am not implementing the clients this means I will have to tell users that they have to specify a custom inbox if they want to use Jetstream publish. Otherwise they have to use a classic publish without getting an ACK. Because I will not give users permissions to listen to all inbox subjects.
Is that correct?
And thank you for the Go reference!

[Jarema]

Yes, it is correct.
However, be careful with using core NATS publish with JetStream, as that can put quite some pressure on the server (as Core NATS is capable of publishing around 10 million messages per second).

Setting the inbox is a one-liner. Should not be a big issue.

[jorinvo]

Thanks a lot Jarema, appreciate your help 🙏