Securing queues

The @secureTopic decorator protects your queue topics, ensuring that only authorized users can access your data stream messages.

The security function returns a boolean: true permits the request and false denies it.

To secure a Squid queue topic, use the @secureTopic decorator, passing the topic name and the type of action. The following code allows read and write access to a queue for the 'topic-name' topic:

TypeScript

Backend code

import { SquidService, secureTopic } from '@squidcloud/backend';

export class ExampleService extends SquidService {
  @secureTopic('topic-name', 'all')
  allowTopicAccess(): boolean {
    return true;
  }
}

Python

Backend code

from squidcloud_backend import SquidService, secure_topic


class ExampleService(SquidService):
    @secure_topic('topic-name', 'all')
    def allow_topic_access(self, context: dict) -> bool:
        return True

The action type can be 'read', 'write', or 'all'.

Securing topic message reads

When securing topic message reads, the security function passes a TopicReadContext (a dict in Python) which contains the integration ID and topic name for the topic messages the client wants to read. The following example secures the 'topic-name' topic such that only authenticated users can read topic messages:

TypeScript

Backend code

import { SquidService, secureTopic, TopicReadContext } from '@squidcloud/backend';

@secureTopic('topic-name', 'read')
allowTopicRead(context: TopicReadContext): boolean {
  console.log(context.topicName);

  return this.isAuthenticated();
}

Python

Backend code

from squidcloud_backend import SquidService, secure_topic


class ExampleService(SquidService):
    @secure_topic('topic-name', 'read')
    def allow_topic_read(self, context: dict) -> bool:
        print(context['topicName'])

        return self.is_authenticated()

Securing topic message writes

When securing topic message writes, the security function passes a TopicWriteContext<T> (T is the type of the message; in Python the context is a dict) which contains the integration ID, topic name, and array of topic messages the client wants to write. The following example shows how to secure writing to a topic such that if any messages contain 'bad word', the write is not permitted:

TypeScript

Backend code

import { SquidService, secureTopic, TopicWriteContext } from '@squidcloud/backend';

@secureTopic('topic-name', 'write')
allowTopicWrite(context: TopicWriteContext<string>): boolean {
  console.log(context.topicName);
  for (const message of context.messages) {
    console.log(message);
    if (message.includes('bad word')) {
      return false;
    }
  }
  return true;
}

Python

Backend code

from squidcloud_backend import SquidService, secure_topic


class ExampleService(SquidService):
    @secure_topic('topic-name', 'write')
    def allow_topic_write(self, context: dict) -> bool:
        print(context['topicName'])
        for message in context['messages']:
            print(message)
            if 'bad word' in message:
                return False
        return True

When using an Apache Kafka or Confluent integration, provide the integration ID as the third parameter of the decorator. The following example shows a security function for a queue with an integration ID of 'kafka-integration-id':

TypeScript

Backend code

import { SquidService, secureTopic } from '@squidcloud/backend';

export class ExampleService extends SquidService {
  @secureTopic('topic-name', 'all', 'kafka-integration-id')
  allowTopicAccess(): boolean {
    return true;
  }
}

Python

Backend code

from squidcloud_backend import SquidService, secure_topic


class ExampleService(SquidService):
    @secure_topic('topic-name', 'all', 'kafka-integration-id')
    def allow_topic_access(self, context: dict) -> bool:
        return True