# Topic ACL for the Internet Use Control MQTT plane (AGENTS.md §10 rule 6).
#
# Included by conf.d/webrestrict.conf, which is reached only over TLS on 8883.
# A device may read only its own config and write only its own status and
# telemetry. Without this, a child can publish a fake "unlocked" (TRANSPORT_
# DESIGN.md "Security").
#
# The MQTT username of a device IS its topic token: the middle level of its
# config topic. For restrict/harry_phone_2/config the account is
# `harry_phone_2`. List the tokens with:
#
#     docker exec webrestrict-control /app/control mqtt-clients
#
# and create the accounts with deploy/mosquitto/provision-clients.sh.

# The Control Service. It publishes every device's config and reads every
# device's reports. It cannot read configs and cannot write status or telemetry.
user control-service
topic write restrict/+/config
topic read restrict/+/status
topic read restrict/+/telemetry

# One rule set for every device. %u expands to the authenticated username, so a
# device is confined to its own topics by construction — no per-device edit is
# needed when a device is added.
pattern read restrict/%u/config
pattern write restrict/%u/status
pattern write restrict/%u/telemetry