Failed to subscribe to Private Updates

[tpharaoh]

I am trying to figure out where the issue is, I can't get private updates to my subscriber.

On login I send a jwt

$key = Key\InMemory::plainText('!ChangeMe!'); // don't forget to set this parameter! Test value: !ChangeMe!
        $configuration = Configuration::forSymmetricSigner(new Sha256(), $key);
            $path = [
              'http://localhost/api/raw_datas/*'
            ];


        $token = $configuration->builder()
            ->withClaim('mercure', ['subscribe' => $path

            ]) // can also be a URI template, or *
            ->getToken($configuration->signer(), $configuration->signingKey())
            ->toString();

        $data['mercureToken'] = $token;

I have an entity which sends the private updates when a new row is added, below is an example:

{"level":"info","ts":1637671722.7986138,"logger":"http.handlers.mercure","msg":"Update published","update":{"id":"urn:uuid:fcb8518c-5b11-4e7b-87d7-64430e25360f","type":"","retry":0,"topics":["http://localhost/api/raw_datas/93"],"private":true},"remote_addr":"11.75.178.192:61592"}
{"level":"info","ts":1637671722.798698,"logger":"http.log.access","msg":"handled request","request":{"remote_addr":"11.75.178.192:61592","proto":"HTTP/2.0","method":"POST","host":"mercure.domain.fi","uri":"/.well-known/mercure","headers":{"User-Agent":["Symfony HttpClient/Curl"],"Accept-Encoding":["gzip"],"Content-Length":["2103"],"Content-Type":["application/x-www-form-urlencoded"],"Accept":["*/*"],"Authorization":["Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXJjdXJlIjp7InB1Ymxpc2giOlsiKiJdfX0.obDjwCgqtPuIvwBlTxUEmibbBf0zypKCNzNKP7Op2UM"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","proto_mutual":true,"server_name":"mercure.domain.fi"}},"common_log":"11.75.178.192 - - [23/Nov/2021:12:48:42 +0000] \"POST /.well-known/mercure HTTP/2.0\" 200 45","duration":0.00360974,"size":45,"status":200,"resp_headers":{"Server":["Caddy"],"X-Frame-Options":["DENY"],"X-Content-Type-Options":["nosniff"],"X-Xss-Protection":["1; mode=block"],"Content-Security-Policy":["default-src 'self' mercure.rocks cdn.jsdelivr.net"]}}

On the VueJS front end, I use Yaffle/EventSource to add the JWT token

  const url = new URL('https://mercure.domain.fi/.well-known/mercure');
    
    url.searchParams.append('topic', 'http://localhost/api/raw_datas/*');
    
    const EventSource = EventSourcePolyfill;
    const eventSource = new EventSource(url,{
          
          headers: {
              
              'Authorization': 'Bearer ' + store.mercureToken.value
          }
      });
    eventSource.onmessage = e => console.log(e.data); // do something with the payload

It subscribes. The token shows, only thing I see is the token is in handle.request, and not in new subscriber. Is that normal?

{"level":"info","ts":1637672544.7301142,"logger":"http.handlers.mercure","msg":"Subscriber disconnected","subscriber":{"id":"urn:uuid:67ea2cf4-50cf-4480-857d-76ef23a74acc","last_event_id":"","remote_addr":"85.75.178.192:54095","topic_selectors":["http://localhost/api/raw_datas/*"],"topics":["http://localhost/api/raw_datas/*","https://example.com/users/dunglas"]}}
{"level":"info","ts":1637672544.7301977,"logger":"http.log.access","msg":"handled request","request":{"remote_addr":"85.75.178.192:54095","proto":"HTTP/2.0","method":"GET","host":"mercure.domain.fi","uri":"/.well-known/mercure?topic=http%3A%2F%2Flocalhost%2Fapi%2Fraw_datas%2F*&topic=https%3A%2F%2Fexample.com%2Fusers%2Fdunglas","headers":{"Origin":["http://localhost:8080"],"Sec-Fetch-Dest":["empty"],"Accept-Encoding":["gzip, deflate, br"],"Sec-Gpc":["1"],"Authorization":["Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJtZXJjdXJlIjp7InN1YnNjcmliZSI6WyJodHRwOi8vbG9jYWxob3N0L2FwaS9yYXdfZGF0YXMvKiJdfX0.z6I3IApnTcJ1caaITEtaGv-gCPM4KUj-JLMSAjZlyVo"],"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36"],"Referer":["http://localhost:8080/"],"Accept-Language":["en-US,en;q=0.9"],"Accept":["text/event-stream"],"Sec-Fetch-Mode":["cors"],"Sec-Ch-Ua":["\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\""],"Sec-Ch-Ua-Platform":["\"macOS\""],"Sec-Fetch-Site":["cross-site"],"Sec-Ch-Ua-Mobile":["?0"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","proto_mutual":true,"server_name":"mercure.domain.fi"}},"common_log":"85.75.178.192 - - [23/Nov/2021:13:02:24 +0000] \"GET /.well-known/mercure?topic=http%3A%2F%2Flocalhost%2Fapi%2Fraw_datas%2F*&topic=https%3A%2F%2Fexample.com%2Fusers%2Fdunglas HTTP/2.0\" 200 2","duration":47.335029145,"size":2,"status":200,"resp_headers":{"Access-Control-Allow-Credentials":["true"],"Expire":["0"],"X-Accel-Buffering":["no"],"X-Frame-Options":["DENY"],"X-Xss-Protection":["1; mode=block"],"Content-Security-Policy":["default-src 'self' mercure.rocks cdn.jsdelivr.net"],"Connection":["keep-alive"],"Content-Type":["text/event-stream"],"Cache-Control":["private, no-cache, no-store, must-revalidate, max-age=0"],"Pragma":["no-cache"],"Server":["Caddy"],"X-Content-Type-Options":["nosniff"],"Access-Control-Allow-Origin":["*"]}}
{"level":"info","ts":1637672546.2951877,"logger":"http.log.access","msg":"handled request","request":{"remote_addr":"85.75.178.192:54095","proto":"HTTP/2.0","method":"OPTIONS","host":"mercure.domain.fi","uri":"/.well-known/mercure?topic=http%3A%2F%2Flocalhost%2Fapi%2Fraw_datas%2F*&topic=https%3A%2F%2Fexample.com%2Fusers%2Fdunglas","headers":{"Accept-Encoding":["gzip, deflate, br"],"Accept":["*/*"],"Access-Control-Request-Method":["GET"],"Origin":["http://localhost:8080"],"Sec-Fetch-Mode":["cors"],"Sec-Fetch-Site":["cross-site"],"Sec-Fetch-Dest":["empty"],"Referer":["http://localhost:8080/"],"Access-Control-Request-Headers":["authorization"],"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36"],"Accept-Language":["en-US,en;q=0.9"],"Sec-Gpc":["1"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","proto_mutual":true,"server_name":"mercure.domain.fi"}},"common_log":"85.75.178.192 - - [23/Nov/2021:13:02:26 +0000] \"OPTIONS /.well-known/mercure?topic=http%3A%2F%2Flocalhost%2Fapi%2Fraw_datas%2F*&topic=https%3A%2F%2Fexample.com%2Fusers%2Fdunglas HTTP/2.0\" 200 0","duration":0.000135783,"size":0,"status":200,"resp_headers":{"Server":["Caddy"],"X-Frame-Options":["DENY"],"X-Content-Type-Options":["nosniff"],"X-Xss-Protection":["1; mode=block"],"Content-Security-Policy":["default-src 'self' mercure.rocks cdn.jsdelivr.net"],"Access-Control-Allow-Headers":["Authorization"],"Access-Control-Allow-Credentials":["true"],"Access-Control-Allow-Origin":["*"]}}
{"level":"info","ts":1637672546.374491,"logger":"http.handlers.mercure","msg":"New subscriber","subscriber":{"id":"urn:uuid:f9e8c08d-cd6f-4d10-853e-75bcf10e6ce8","last_event_id":"","remote_addr":"85.75.178.192:54095","topic_selectors":["http://localhost/api/raw_datas/*"],"topics":["http://localhost/api/raw_datas/*","https://example.com/users/dunglas"]}}
{"level":"info","ts":1637672547.329528,"logger":"http.handlers.mercure","msg":"Subscriber disconnected","subscriber":{"id":"urn:uuid:68fa3ad0-2699-4852-9131-054696af0d0c","last_event_id":"","remote_addr":"85.75.178.192:54095","topic_selectors":["http://localhost/api/raw_datas/*"],"topics":["http://localhost/api/raw_datas/*","https://example.com/users/dunglas"]}}
{"level":"info","ts":1637672547.3296108,"logger":"http.log.access","msg":"handled request","request":{"remote_addr":"85.75.178.192:54095","proto":"HTTP/2.0","method":"GET","host":"mercure.domain.fi","uri":"/.well-known/mercure?topic=http%3A%2F%2Flocalhost%2Fapi%2Fraw_datas%2F*&topic=https%3A%2F%2Fexample.com%2Fusers%2Fdunglas","headers":{"Sec-Ch-Ua-Mobile":["?0"],"Sec-Gpc":["1"],"Origin":["http://localhost:8080"],"Sec-Fetch-Site":["cross-site"],"Sec-Ch-Ua":["\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", \"Google Chrome\";v=\"96\""],"Sec-Ch-Ua-Platform":["\"macOS\""],"Sec-Fetch-Mode":["cors"],"Sec-Fetch-Dest":["empty"],"Accept-Encoding":["gzip, deflate, br"],"Authorization":["Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJtZXJjdXJlIjp7InN1YnNjcmliZSI6WyJodHRwOi8vbG9jYWxob3N0L2FwaS9yYXdfZGF0YXMvKiJdfX0.z6I3IApnTcJ1caaITEtaGv-gCPM4KUj-JLMSAjZlyVo"],"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36"],"Accept-Language":["en-US,en;q=0.9"],"Accept":["text/event-stream"],"Referer":["http://localhost:8080/"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","proto_mutual":true,"server_name":"mercure.domain.fi"}},"common_log":"85.75.178.192 - - [23/Nov/2021:13:02:27 +0000] \"GET /.well-known/mercure?topic=http%3A%2F%2Flocalhost%2Fapi%2Fraw_datas%2F*&topic=https%3A%2F%2Fexample.com%2Fusers%2Fdunglas HTTP/2.0\" 200 2","duration":46.966630725,"size":2,"status":200,"resp_headers":{"Pragma":["no-cache"],"X-Content-Type-Options":["nosniff"],"X-Xss-Protection":["1; mode=block"],"Content-Security-Policy":["default-src 'self' mercure.rocks cdn.jsdelivr.net"],"X-Frame-Options":["DENY"],"Access-Control-Allow-Origin":["*"],"Expire":["0"],"X-Accel-Buffering":["no"],"Server":["Caddy"],"Access-Control-Allow-Credentials":["true"],"Connection":["keep-alive"],"Content-Type":["text/event-stream"],"Cache-Control":["private, no-cache, no-store, must-revalidate, max-age=0"]}}

[kolvin]

Hey @tpharaoh 👋

I think your issue is that your trying to use * inside the URL string 'http://localhost/api/raw_datas/*', i'm not sure if this is a valid URL template which violates this;

To receive updates marked as private, a subscriber MUST prove that it is authorized for at least one of the topics of this update. If the subscriber is not authorized to receive an update marked as private, it MUST NOT receive it.

Im not 100% but i wonder if http://localhost/api/raw_datas/{id} would work?

I have implemented private updates within a system and often refer to these sections mostly when i have any issues

• subscription
• topic selectors
• RFC on URI templating

[tpharaoh]

I'll give it a try, but on a index page (where is lists all rows in DB)... if entity has mercure it will send a private post even on new line in DB, thats why I assumed, obviously I would not yet know the ID. But maybe I should have used {id} I'll try tomorrow or monday, thanks for the feedback. Will report my findings

…

On Fri, 26 Nov 2021 at 21:55, Calvin Taylor ***@***.***> wrote: Hey @tpharaoh <https://github.com/tpharaoh> 👋 I think your issue is that your trying to use * inside the URL string ' http://localhost/api/raw_datas/*', i'm not sure if this is a valid URL template which violates this; To receive updates marked as private, a subscriber MUST prove that it is authorized for at least one of the topics of this update. If the subscriber is not authorized to receive an update marked as private, it MUST NOT receive it. Im not 100% but i wonder if http://localhost/api/raw_datas/{id} would work? I have implemented private updates within a system and often refer to these sections mostly when i have any issues - subscription <https://mercure.rocks/spec#subscribers> - topic selectors <https://mercure.rocks/spec#topic-selectors> - RFC on URI templating <https://datatracker.ietf.org/doc/html/rfc6570> — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#591 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAWLV7EHCFRQZBT6Q7RJTGDUN7Q3NANCNFSM5ITOVP2Q> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[tpharaoh]

Excellent.... you were right, the {id} was the key on server side!

$key = Key\InMemory::plainText('!ChangeMe!'); // don't forget to set this parameter! Test value: !ChangeMe!
        $configuration = Configuration::forSymmetricSigner(new Sha256(), $key);
        if(in_array('ROLE_ADMIN',$user->getRoles())){
            $path = [
              'http://localhost/api/raw_datas/{id}'
            ];
        }
$token = $configuration->builder()
            ->withClaim('mercure', ['subscribe' => $path

            ]) // can also be a URI template, or *
            ->getToken($configuration->signer(), $configuration->signingKey())
            ->toString();

[HenriqueDelben]

Hey, I'm experiencing the same problem but I just can't get around to fix it, I'm trying to reproduce the steps as mentioned in the docs but it doesnt work.

My Problem

Can't subscribe to private updates

Example

With the following publisher's JWS's payload:

{ "mercure": { "publish": [ "*" ] } }

And the following subscriber's JWS's payload:

{ "mercure": { "subscribe": [ "http://localhost/users/123/{?topic}" ] } }

I'm publishing to the HUB, like on this request:

As you can see, the canonical topic is http://localhost/orders/123 and alternate topic is http://localhost/users/123/?topic=http://localhost/orders/123

And I'm trying to subscribe to it, like on this request:

As mentioned in the docs:

The hub MUST check that at least one topic of the update to dispatch (canonical or alternate) matches at least one topic selector provided in mercure.subscribe.

So, paraphrasing it: the hub MUST check that at least one topic of the update (http://localhost/orders/123 OR http://localhost/users/123/?topic=http://localhost/orders/123) is matched by at least one topic selector provided (on this case is http://localhost/users/123/{?topic}). I already tested that this URI template matches by using mercure's own URI template tester. So I should be able to get it, shouldn't I ?

But I don't get any updates. Why?

Thank you in advance..... maybe there's something I'm not seeing

And also, if I repeat the same steps, making the same POST and GET requests with the same publisher's and subscriber's JWS, with the same parameters, except for the "private" param where I don't pass it at all, THEN the subscriber is able to get the updates. So this shows that for some reason, the URI template is not working (it's a question)? But if it's wrong, then why mercure's tester said it matched? Or I basically misunderstood ALL of it? LOL, I'm pissed

Edit 1: typo and completed the text

[dunglas]

@HenriqueDelben I wonder if it's not a URL-encoding problem. Could you try to properly urlencode() the value of your topic query parameter?