@attraccess/plugin-rabbitmq 0.1.0-nightly.1076.1 → 0.1.0-nightly.1079.1

package/dist/index.js

@@ -34,17 +34,14 @@ __export(plugin_exports, {
 });
 module.exports = __toCommonJS(plugin_exports);
 var import_plugins_backend_sdk3 = require("@attraccess/plugins-backend-sdk");
-var import_common7 = require("@nestjs/common");
+var import_common5 = require("@nestjs/common");
 
-// backend/rabbitmq-detection.controller.ts
+// backend/detection/service.ts
 var import_plugins_backend_sdk = require("@attraccess/plugins-backend-sdk");
-var import_common2 = require("@nestjs/common");
-
-// backend/rabbitmq-detection.service.ts
 var import_common = require("@nestjs/common");
 var import_node_crypto2 = require("node:crypto");
 
-// backend/rabbitmq-management-transport.ts
+// backend/management/transport.ts
 var import_node_crypto = require("node:crypto");
 var import_node_https = require("node:https");
 var import_node_net = require("node:net");
@@ -175,7 +172,7 @@ function describeManagementError(error, timeoutMs) {
   }
 }
 
-// backend/rabbitmq-detection.service.ts
+// backend/detection/service.ts
 var PLUGIN_CONTEXT = /* @__PURE__ */ Symbol.for("attraccess.plugin.context");
 var CACHE_TTL_MS = 6e4;
 var PROBE_TIMEOUT_MS = 5e3;
@@ -302,8 +299,6 @@ RabbitmqDetectionService = __decorateClass([
   (0, import_common.Injectable)(),
   __decorateParam(0, (0, import_common.Inject)(PLUGIN_CONTEXT))
 ], RabbitmqDetectionService);
-
-// backend/rabbitmq-detection.controller.ts
 var RabbitmqDetectionController = class {
   // esbuild does not emit decorator metadata, so Nest cannot infer constructor
   // types for injection — always inject by an explicit token.
@@ -315,18 +310,18 @@ var RabbitmqDetectionController = class {
   }
 };
 __decorateClass([
-  (0, import_common2.Get)("detection/:mqttServerId"),
-  __decorateParam(0, (0, import_common2.Param)("mqttServerId", import_common2.ParseIntPipe)),
-  __decorateParam(1, (0, import_common2.Query)("refresh"))
+  (0, import_common.Get)("detection/:mqttServerId"),
+  __decorateParam(0, (0, import_common.Param)("mqttServerId", import_common.ParseIntPipe)),
+  __decorateParam(1, (0, import_common.Query)("refresh"))
 ], RabbitmqDetectionController.prototype, "detect", 1);
 RabbitmqDetectionController = __decorateClass([
   (0, import_plugins_backend_sdk.Auth)("resources.update"),
-  (0, import_common2.Controller)("rabbitmq"),
-  __decorateParam(0, (0, import_common2.Inject)(RabbitmqDetectionService))
+  (0, import_common.Controller)("rabbitmq"),
+  __decorateParam(0, (0, import_common.Inject)(RabbitmqDetectionService))
 ], RabbitmqDetectionController);
 
-// backend/rabbitmq-management-client.ts
-var import_common3 = require("@nestjs/common");
+// backend/management/client.ts
+var import_common2 = require("@nestjs/common");
 var REQUEST_TIMEOUT_MS = 1e4;
 var RabbitmqManagementClient = class {
   // Builds the management API base URL from the generic MQTT config (same
@@ -343,9 +338,9 @@ var RabbitmqManagementClient = class {
     try {
       response = await managementRequest(config, `${base}/api${path}`, method, body, REQUEST_TIMEOUT_MS);
     } catch (error) {
-      throw new import_common3.HttpException(
+      throw new import_common2.HttpException(
         `Cannot reach the RabbitMQ management API at ${base}: ${describeManagementError(error, REQUEST_TIMEOUT_MS)}`,
-        import_common3.HttpStatus.BAD_GATEWAY
+        import_common2.HttpStatus.BAD_GATEWAY
       );
     }
     if (!response.ok) {
@@ -360,26 +355,26 @@ var RabbitmqManagementClient = class {
     const upstream = await this.parseErrorBody(response);
     const reason = upstream?.reason || upstream?.error || "";
     if (response.status === 401) {
-      return new import_common3.HttpException(
+      return new import_common2.HttpException(
         "The RabbitMQ management API rejected the configured MQTT server credentials (401). Check the username/password configured for this MQTT server.",
-        import_common3.HttpStatus.BAD_GATEWAY
+        import_common2.HttpStatus.BAD_GATEWAY
       );
     }
     if (response.status === 403 || /not.?authori[sz]ed/i.test(reason)) {
-      return new import_common3.HttpException(
+      return new import_common2.HttpException(
         'The configured MQTT server user lacks management privileges on RabbitMQ. User management requires a user with the "administrator" tag.',
-        import_common3.HttpStatus.BAD_GATEWAY
+        import_common2.HttpStatus.BAD_GATEWAY
       );
     }
     if (response.status === 404) {
-      return new import_common3.HttpException("Not found on the RabbitMQ side.", import_common3.HttpStatus.NOT_FOUND);
+      return new import_common2.HttpException("Not found on the RabbitMQ side.", import_common2.HttpStatus.NOT_FOUND);
     }
     if (response.status === 400) {
-      return new import_common3.HttpException("RabbitMQ rejected the request.", import_common3.HttpStatus.BAD_REQUEST);
+      return new import_common2.HttpException("RabbitMQ rejected the request.", import_common2.HttpStatus.BAD_REQUEST);
     }
-    return new import_common3.HttpException(
+    return new import_common2.HttpException(
       `RabbitMQ management API request failed (HTTP ${response.status}).`,
-      import_common3.HttpStatus.BAD_GATEWAY
+      import_common2.HttpStatus.BAD_GATEWAY
     );
   }
   async parseBody(response) {
@@ -390,9 +385,9 @@ var RabbitmqManagementClient = class {
     try {
       return JSON.parse(text);
     } catch {
-      throw new import_common3.HttpException(
+      throw new import_common2.HttpException(
         "The RabbitMQ management API returned a response that is not valid JSON.",
-        import_common3.HttpStatus.BAD_GATEWAY
+        import_common2.HttpStatus.BAD_GATEWAY
       );
     }
   }
@@ -405,15 +400,12 @@ var RabbitmqManagementClient = class {
   }
 };
 RabbitmqManagementClient = __decorateClass([
-  (0, import_common3.Injectable)()
+  (0, import_common2.Injectable)()
 ], RabbitmqManagementClient);
 
-// backend/rabbitmq-users.controller.ts
+// backend/users/service.ts
 var import_plugins_backend_sdk2 = require("@attraccess/plugins-backend-sdk");
-var import_common5 = require("@nestjs/common");
-
-// backend/rabbitmq-users.service.ts
-var import_common4 = require("@nestjs/common");
+var import_common3 = require("@nestjs/common");
 var PLUGIN_CONTEXT2 = /* @__PURE__ */ Symbol.for("attraccess.plugin.context");
 var RabbitmqUsersService = class {
   constructor(context, client) {
@@ -460,7 +452,7 @@ var RabbitmqUsersService = class {
     const existing = await this.findUser(config, username);
     const password = dto.password?.length ? dto.password : void 0;
     if (!existing && !password) {
-      throw new import_common4.HttpException("Password is required when creating a new user.", import_common4.HttpStatus.BAD_REQUEST);
+      throw new import_common3.HttpException("Password is required when creating a new user.", import_common3.HttpStatus.BAD_REQUEST);
     }
     const body = { tags: (dto.tags ?? this.normalizeTags(existing?.tags)).join(",") };
     if (password) {
@@ -480,9 +472,9 @@ var RabbitmqUsersService = class {
     this.assertValidName(username, "Username");
     const config = await this.requireConfig(mqttServerId);
     if (config.username !== null && config.username === username) {
-      throw new import_common4.HttpException(
+      throw new import_common3.HttpException(
         "Refusing to delete the user the MQTT server connection is configured with.",
-        import_common4.HttpStatus.BAD_REQUEST
+        import_common3.HttpStatus.BAD_REQUEST
       );
     }
     await this.client.request(config, "DELETE", `/users/${encodeURIComponent(username)}`);
@@ -520,7 +512,7 @@ var RabbitmqUsersService = class {
     try {
       return await this.client.request(config, "GET", `/users/${encodeURIComponent(username)}`);
     } catch (error) {
-      if (error instanceof import_common4.HttpException && error.getStatus() === import_common4.HttpStatus.NOT_FOUND) {
+      if (error instanceof import_common3.HttpException && error.getStatus() === import_common3.HttpStatus.NOT_FOUND) {
         return null;
       }
       throw error;
@@ -529,7 +521,7 @@ var RabbitmqUsersService = class {
   async requireConfig(mqttServerId) {
     const config = await this.context.getMqttServerConfig(mqttServerId);
     if (!config) {
-      throw new import_common4.HttpException("MQTT server not found.", import_common4.HttpStatus.NOT_FOUND);
+      throw new import_common3.HttpException("MQTT server not found.", import_common3.HttpStatus.NOT_FOUND);
     }
     return config;
   }
@@ -544,20 +536,18 @@ var RabbitmqUsersService = class {
   }
   assertValidName(value, label) {
     if (typeof value !== "string" || value.trim().length === 0) {
-      throw new import_common4.HttpException(`${label} must not be empty.`, import_common4.HttpStatus.BAD_REQUEST);
+      throw new import_common3.HttpException(`${label} must not be empty.`, import_common3.HttpStatus.BAD_REQUEST);
     }
     if (value.length > 255) {
-      throw new import_common4.HttpException(`${label} must be at most 255 characters.`, import_common4.HttpStatus.BAD_REQUEST);
+      throw new import_common3.HttpException(`${label} must be at most 255 characters.`, import_common3.HttpStatus.BAD_REQUEST);
     }
   }
 };
 RabbitmqUsersService = __decorateClass([
-  (0, import_common4.Injectable)(),
-  __decorateParam(0, (0, import_common4.Inject)(PLUGIN_CONTEXT2)),
-  __decorateParam(1, (0, import_common4.Inject)(RabbitmqManagementClient))
+  (0, import_common3.Injectable)(),
+  __decorateParam(0, (0, import_common3.Inject)(PLUGIN_CONTEXT2)),
+  __decorateParam(1, (0, import_common3.Inject)(RabbitmqManagementClient))
 ], RabbitmqUsersService);
-
-// backend/rabbitmq-users.controller.ts
 var RabbitmqUsersController = class {
   // esbuild does not emit decorator metadata, so Nest cannot infer constructor
   // types for injection — always inject by an explicit token.
@@ -575,53 +565,52 @@ var RabbitmqUsersController = class {
   }
   setPermissions(mqttServerId, username, dto) {
     if (!dto || typeof dto.vhost !== "string") {
-      throw new import_common5.HttpException("A vhost is required.", import_common5.HttpStatus.BAD_REQUEST);
+      throw new import_common3.HttpException("A vhost is required.", import_common3.HttpStatus.BAD_REQUEST);
     }
     return this.users.setPermissions(mqttServerId, username, dto);
   }
   clearPermissions(mqttServerId, username, vhost) {
     if (typeof vhost !== "string" || vhost.length === 0) {
-      throw new import_common5.HttpException("A vhost query parameter is required.", import_common5.HttpStatus.BAD_REQUEST);
+      throw new import_common3.HttpException("A vhost query parameter is required.", import_common3.HttpStatus.BAD_REQUEST);
     }
     return this.users.clearPermissions(mqttServerId, username, vhost);
   }
 };
 __decorateClass([
-  (0, import_common5.Get)("users/:mqttServerId"),
-  __decorateParam(0, (0, import_common5.Param)("mqttServerId", import_common5.ParseIntPipe))
+  (0, import_common3.Get)("users/:mqttServerId"),
+  __decorateParam(0, (0, import_common3.Param)("mqttServerId", import_common3.ParseIntPipe))
 ], RabbitmqUsersController.prototype, "list", 1);
 __decorateClass([
-  (0, import_common5.Put)("users/:mqttServerId/:username"),
-  __decorateParam(0, (0, import_common5.Param)("mqttServerId", import_common5.ParseIntPipe)),
-  __decorateParam(1, (0, import_common5.Param)("username")),
-  __decorateParam(2, (0, import_common5.Body)())
+  (0, import_common3.Put)("users/:mqttServerId/:username"),
+  __decorateParam(0, (0, import_common3.Param)("mqttServerId", import_common3.ParseIntPipe)),
+  __decorateParam(1, (0, import_common3.Param)("username")),
+  __decorateParam(2, (0, import_common3.Body)())
 ], RabbitmqUsersController.prototype, "upsert", 1);
 __decorateClass([
-  (0, import_common5.Delete)("users/:mqttServerId/:username"),
-  __decorateParam(0, (0, import_common5.Param)("mqttServerId", import_common5.ParseIntPipe)),
-  __decorateParam(1, (0, import_common5.Param)("username"))
+  (0, import_common3.Delete)("users/:mqttServerId/:username"),
+  __decorateParam(0, (0, import_common3.Param)("mqttServerId", import_common3.ParseIntPipe)),
+  __decorateParam(1, (0, import_common3.Param)("username"))
 ], RabbitmqUsersController.prototype, "remove", 1);
 __decorateClass([
-  (0, import_common5.Put)("users/:mqttServerId/:username/permissions"),
-  __decorateParam(0, (0, import_common5.Param)("mqttServerId", import_common5.ParseIntPipe)),
-  __decorateParam(1, (0, import_common5.Param)("username")),
-  __decorateParam(2, (0, import_common5.Body)())
+  (0, import_common3.Put)("users/:mqttServerId/:username/permissions"),
+  __decorateParam(0, (0, import_common3.Param)("mqttServerId", import_common3.ParseIntPipe)),
+  __decorateParam(1, (0, import_common3.Param)("username")),
+  __decorateParam(2, (0, import_common3.Body)())
 ], RabbitmqUsersController.prototype, "setPermissions", 1);
 __decorateClass([
-  (0, import_common5.Delete)("users/:mqttServerId/:username/permissions"),
-  __decorateParam(0, (0, import_common5.Param)("mqttServerId", import_common5.ParseIntPipe)),
-  __decorateParam(1, (0, import_common5.Param)("username")),
-  __decorateParam(2, (0, import_common5.Query)("vhost"))
+  (0, import_common3.Delete)("users/:mqttServerId/:username/permissions"),
+  __decorateParam(0, (0, import_common3.Param)("mqttServerId", import_common3.ParseIntPipe)),
+  __decorateParam(1, (0, import_common3.Param)("username")),
+  __decorateParam(2, (0, import_common3.Query)("vhost"))
 ], RabbitmqUsersController.prototype, "clearPermissions", 1);
 RabbitmqUsersController = __decorateClass([
   (0, import_plugins_backend_sdk2.Auth)("resources.update"),
-  (0, import_common5.Controller)("rabbitmq"),
-  __decorateParam(0, (0, import_common5.Inject)(RabbitmqUsersService))
+  (0, import_common3.Controller)("rabbitmq"),
+  __decorateParam(0, (0, import_common3.Inject)(RabbitmqUsersService))
 ], RabbitmqUsersController);
 
-// backend/rabbitmq-credential-provisioning.provider.ts
-var import_crypto = require("crypto");
-var import_common6 = require("@nestjs/common");
+// backend/credentials/provider.ts
+var import_common4 = require("@nestjs/common");
 
 // ../../../node_modules/.pnpm/async-mutex@0.5.0/node_modules/async-mutex/index.mjs
 var E_TIMEOUT = new Error("timeout while waiting for mutex to become available");
@@ -829,7 +818,31 @@ var Mutex = class {
   }
 };
 
-// backend/rabbitmq-credential-provisioning.provider.ts
+// backend/credentials/provider.ts
+var import_crypto = require("crypto");
+function escapeRegex(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function mqttFilterToRegex(filter) {
+  const terminalMultiLevel = filter.endsWith("/#");
+  const prefix = terminalMultiLevel ? filter.slice(0, -2) : filter;
+  const translated = prefix.split("/").map((segment) => {
+    if (segment === "+") {
+      return "[^.]+";
+    }
+    if (segment === "#") {
+      return ".*";
+    }
+    return segment.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  }).join("\\.");
+  return terminalMultiLevel ? `${translated}(?:\\..*)?` : translated;
+}
+function mqttFiltersToRegex(filters) {
+  if (filters.length === 0) {
+    return "$(?!)";
+  }
+  return `^(?:${filters.map(mqttFilterToRegex).join("|")})$`;
+}
 var _RabbitmqCredentialProvisioningProvider = class _RabbitmqCredentialProvisioningProvider {
   constructor(context) {
     __publicField(this, "context", context);
@@ -839,46 +852,114 @@ var _RabbitmqCredentialProvisioningProvider = class _RabbitmqCredentialProvision
     __publicField(this, "detection");
     this.detection = new RabbitmqDetectionService(context);
   }
-  async supports(config) {
-    return (await this.detection.detect(config.id)).isRabbitMQ;
+  assertNotManagementUser(config, username) {
+    if (config.username === username) {
+      throw new import_common4.BadRequestException("Refusing to modify the MQTT server management identity.");
+    }
   }
-  provision(request2) {
-    return this.writeCredential(request2);
+  assertName(value, label) {
+    if (typeof value !== "string" || value.trim().length === 0 || value.length > 255) {
+      throw new import_common4.BadRequestException(`${label} must be a non-empty string no longer than 255 characters.`);
+    }
   }
-  rotate(request2) {
-    return this.writeCredential(request2);
+  assertTopicFilter(filter) {
+    if (filter.includes(".")) {
+      throw new import_common4.BadRequestException("RabbitMQ MQTT topic policies cannot contain dots.");
+    }
+    const segments = filter.split("/");
+    for (const [index, segment] of segments.entries()) {
+      if (segment.includes("+") && segment !== "+" || segment.includes("#") && (segment !== "#" || index !== segments.length - 1)) {
+        throw new import_common4.BadRequestException(
+          "MQTT wildcards must occupy a complete topic level, and # must be the final level."
+        );
+      }
+    }
   }
-  async revoke(request2) {
+  assertRequest(request2) {
+    this.assertName(request2.identity, "Identity");
     this.assertName(request2.username, "Username");
-    const config = await this.requireConfig(request2.mqttServerId);
-    this.assertNotManagementUser(config, request2.username);
+    this.assertName(request2.vhost, "Vhost");
+    if (!Array.isArray(request2.topicPolicy.publish) || !Array.isArray(request2.topicPolicy.subscribe)) {
+      throw new import_common4.BadRequestException("Publish and subscribe topic policies must be arrays.");
+    }
+    for (const filter of [...request2.topicPolicy.publish, ...request2.topicPolicy.subscribe]) {
+      if (typeof filter !== "string" || filter.length === 0 || filter.length > 1024) {
+        throw new import_common4.BadRequestException("MQTT topic filters must be non-empty strings no longer than 1024 characters.");
+      }
+      this.assertTopicFilter(filter);
+    }
+  }
+  async requireConfig(mqttServerId) {
+    const config = await this.context.getMqttServerConfig(mqttServerId);
+    if (!config) {
+      throw new import_common4.BadRequestException("MQTT server not found.");
+    }
+    return config;
+  }
+  async failAfterRollback(error, rollback) {
+    const results = await Promise.allSettled(rollback.map((operation) => operation()));
+    const failures = results.filter((result) => result.status === "rejected").map((result) => result.reason);
+    if (failures.length > 0) {
+      throw new AggregateError([error, ...failures], "Credential provisioning failed and rollback was incomplete.");
+    }
+    throw error;
+  }
+  async restorePermission(config, path, permissions) {
+    await this.client.request(config, permissions ? "PUT" : "DELETE", path, permissions ?? void 0);
+  }
+  async restorePermissions(config, vhost, username, permissions, topicPermissions) {
+    const results = await Promise.allSettled([
+      this.restorePermission(config, `/permissions/${vhost}/${username}`, permissions),
+      this.restorePermission(config, `/topic-permissions/${vhost}/${username}`, topicPermissions)
+    ]);
+    const failures = results.filter((result) => result.status === "rejected").map((result) => result.reason);
+    if (failures.length > 0) {
+      throw new AggregateError(failures, "Failed to restore RabbitMQ permissions.");
+    }
+  }
+  async getOptional(config, path) {
     try {
-      await this.client.request(config, "DELETE", `/users/${encodeURIComponent(request2.username)}`);
+      return await this.client.request(config, "GET", path);
     } catch (error) {
-      if (error instanceof import_common6.HttpException && error.getStatus() === import_common6.HttpStatus.NOT_FOUND) return;
+      if (error instanceof import_common4.HttpException && error.getStatus() === import_common4.HttpStatus.NOT_FOUND) {
+        return null;
+      }
       throw error;
     }
   }
-  async writeCredential(request2) {
-    this.assertRequest(request2);
-    const config = await this.requireConfig(request2.mqttServerId);
-    this.assertNotManagementUser(config, request2.username);
-    const lockKey = `${config.id}:${request2.vhost}`;
-    let lock = _RabbitmqCredentialProvisioningProvider.vhostLocks.get(lockKey);
-    if (!lock) {
-      lock = { mutex: new Mutex(), users: 0 };
-      _RabbitmqCredentialProvisioningProvider.vhostLocks.set(lockKey, lock);
-    }
-    lock.users += 1;
+  async getTopicPermissions(config, vhost, username) {
+    return this.getOptional(config, `/topic-permissions/${vhost}/${username}`);
+  }
+  async getPermissions(config, vhost, username) {
+    return this.getOptional(config, `/permissions/${vhost}/${username}`);
+  }
+  async exists(config, path) {
     try {
-      return await lock.mutex.runExclusive(() => this.writeCredentialLocked(request2, config));
-    } finally {
-      lock.users -= 1;
-      if (lock.users === 0 && _RabbitmqCredentialProvisioningProvider.vhostLocks.get(lockKey) === lock) {
-        _RabbitmqCredentialProvisioningProvider.vhostLocks.delete(lockKey);
+      await this.client.request(config, "GET", path);
+      return true;
+    } catch (error) {
+      if (error instanceof import_common4.HttpException && error.getStatus() === import_common4.HttpStatus.NOT_FOUND) {
+        return false;
       }
+      throw error;
     }
   }
+  async userExists(config, username) {
+    return this.exists(config, `/users/${username}`);
+  }
+  async writePermissions(config, request2, vhost, username) {
+    const subscriptionQueue = `mqtt-subscription-${escapeRegex(request2.identity)}.*`;
+    await this.client.request(config, "PUT", `/permissions/${vhost}/${username}`, {
+      configure: `^${subscriptionQueue}$`,
+      write: `^(amq\\.topic|${subscriptionQueue})$`,
+      read: `^(amq\\.topic|${subscriptionQueue})$`
+    });
+    await this.client.request(config, "PUT", `/topic-permissions/${vhost}/${username}`, {
+      exchange: "amq.topic",
+      write: mqttFiltersToRegex(request2.topicPolicy.publish),
+      read: mqttFiltersToRegex(request2.topicPolicy.subscribe)
+    });
+  }
   async writeCredentialLocked(request2, config) {
     const password = (0, import_crypto.randomBytes)(24).toString("base64url");
     const vhost = encodeURIComponent(request2.vhost);
@@ -915,140 +996,49 @@ var _RabbitmqCredentialProvisioningProvider = class _RabbitmqCredentialProvision
       password
     };
   }
-  async writePermissions(config, request2, vhost, username) {
-    const subscriptionQueue = `mqtt-subscription-${escapeRegex(request2.identity)}.*`;
-    await this.client.request(config, "PUT", `/permissions/${vhost}/${username}`, {
-      configure: `^${subscriptionQueue}$`,
-      write: `^(amq\\.topic|${subscriptionQueue})$`,
-      read: `^(amq\\.topic|${subscriptionQueue})$`
-    });
-    await this.client.request(config, "PUT", `/topic-permissions/${vhost}/${username}`, {
-      exchange: "amq.topic",
-      write: mqttFiltersToRegex(request2.topicPolicy.publish),
-      read: mqttFiltersToRegex(request2.topicPolicy.subscribe)
-    });
-  }
-  async userExists(config, username) {
-    return this.exists(config, `/users/${username}`);
-  }
-  async exists(config, path) {
+  async writeCredential(request2) {
+    this.assertRequest(request2);
+    const config = await this.requireConfig(request2.mqttServerId);
+    this.assertNotManagementUser(config, request2.username);
+    const lockKey = `${config.id}:${request2.vhost}`;
+    let lock = _RabbitmqCredentialProvisioningProvider.vhostLocks.get(lockKey);
+    if (!lock) {
+      lock = { mutex: new Mutex(), users: 0 };
+      _RabbitmqCredentialProvisioningProvider.vhostLocks.set(lockKey, lock);
+    }
+    lock.users += 1;
     try {
-      await this.client.request(config, "GET", path);
-      return true;
-    } catch (error) {
-      if (error instanceof import_common6.HttpException && error.getStatus() === import_common6.HttpStatus.NOT_FOUND) {
-        return false;
+      return await lock.mutex.runExclusive(() => this.writeCredentialLocked(request2, config));
+    } finally {
+      lock.users -= 1;
+      if (lock.users === 0 && _RabbitmqCredentialProvisioningProvider.vhostLocks.get(lockKey) === lock) {
+        _RabbitmqCredentialProvisioningProvider.vhostLocks.delete(lockKey);
       }
-      throw error;
     }
   }
-  async getPermissions(config, vhost, username) {
-    return this.getOptional(config, `/permissions/${vhost}/${username}`);
-  }
-  async getTopicPermissions(config, vhost, username) {
-    return this.getOptional(config, `/topic-permissions/${vhost}/${username}`);
-  }
-  async getOptional(config, path) {
+  async revoke(request2) {
+    this.assertName(request2.username, "Username");
+    const config = await this.requireConfig(request2.mqttServerId);
+    this.assertNotManagementUser(config, request2.username);
     try {
-      return await this.client.request(config, "GET", path);
+      await this.client.request(config, "DELETE", `/users/${encodeURIComponent(request2.username)}`);
     } catch (error) {
-      if (error instanceof import_common6.HttpException && error.getStatus() === import_common6.HttpStatus.NOT_FOUND) {
-        return null;
-      }
+      if (error instanceof import_common4.HttpException && error.getStatus() === import_common4.HttpStatus.NOT_FOUND) return;
       throw error;
     }
   }
-  async restorePermissions(config, vhost, username, permissions, topicPermissions) {
-    const results = await Promise.allSettled([
-      this.restorePermission(config, `/permissions/${vhost}/${username}`, permissions),
-      this.restorePermission(config, `/topic-permissions/${vhost}/${username}`, topicPermissions)
-    ]);
-    const failures = results.filter((result) => result.status === "rejected").map((result) => result.reason);
-    if (failures.length > 0) {
-      throw new AggregateError(failures, "Failed to restore RabbitMQ permissions.");
-    }
-  }
-  async restorePermission(config, path, permissions) {
-    await this.client.request(config, permissions ? "PUT" : "DELETE", path, permissions ?? void 0);
-  }
-  async failAfterRollback(error, rollback) {
-    const results = await Promise.allSettled(rollback.map((operation) => operation()));
-    const failures = results.filter((result) => result.status === "rejected").map((result) => result.reason);
-    if (failures.length > 0) {
-      throw new AggregateError([error, ...failures], "Credential provisioning failed and rollback was incomplete.");
-    }
-    throw error;
-  }
-  async requireConfig(mqttServerId) {
-    const config = await this.context.getMqttServerConfig(mqttServerId);
-    if (!config) {
-      throw new import_common6.BadRequestException("MQTT server not found.");
-    }
-    return config;
-  }
-  assertRequest(request2) {
-    this.assertName(request2.identity, "Identity");
-    this.assertName(request2.username, "Username");
-    this.assertName(request2.vhost, "Vhost");
-    if (!Array.isArray(request2.topicPolicy.publish) || !Array.isArray(request2.topicPolicy.subscribe)) {
-      throw new import_common6.BadRequestException("Publish and subscribe topic policies must be arrays.");
-    }
-    for (const filter of [...request2.topicPolicy.publish, ...request2.topicPolicy.subscribe]) {
-      if (typeof filter !== "string" || filter.length === 0 || filter.length > 1024) {
-        throw new import_common6.BadRequestException("MQTT topic filters must be non-empty strings no longer than 1024 characters.");
-      }
-      this.assertTopicFilter(filter);
-    }
-  }
-  assertTopicFilter(filter) {
-    if (filter.includes(".")) {
-      throw new import_common6.BadRequestException("RabbitMQ MQTT topic policies cannot contain dots.");
-    }
-    const segments = filter.split("/");
-    for (const [index, segment] of segments.entries()) {
-      if (segment.includes("+") && segment !== "+" || segment.includes("#") && (segment !== "#" || index !== segments.length - 1)) {
-        throw new import_common6.BadRequestException(
-          "MQTT wildcards must occupy a complete topic level, and # must be the final level."
-        );
-      }
-    }
+  rotate(request2) {
+    return this.writeCredential(request2);
   }
-  assertName(value, label) {
-    if (typeof value !== "string" || value.trim().length === 0 || value.length > 255) {
-      throw new import_common6.BadRequestException(`${label} must be a non-empty string no longer than 255 characters.`);
-    }
+  provision(request2) {
+    return this.writeCredential(request2);
   }
-  assertNotManagementUser(config, username) {
-    if (config.username === username) {
-      throw new import_common6.BadRequestException("Refusing to modify the MQTT server management identity.");
-    }
+  async supports(config) {
+    return (await this.detection.detect(config.id)).isRabbitMQ;
   }
 };
 __publicField(_RabbitmqCredentialProvisioningProvider, "vhostLocks", /* @__PURE__ */ new Map());
 var RabbitmqCredentialProvisioningProvider = _RabbitmqCredentialProvisioningProvider;
-function mqttFiltersToRegex(filters) {
-  if (filters.length === 0) {
-    return "$(?!)";
-  }
-  return `^(?:${filters.map(mqttFilterToRegex).join("|")})$`;
-}
-function mqttFilterToRegex(filter) {
-  const terminalMultiLevel = filter.endsWith("/#");
-  const prefix = terminalMultiLevel ? filter.slice(0, -2) : filter;
-  const translated = prefix.split("/").map((segment) => {
-    if (segment === "+") {
-      return "[^.]+";
-    }
-    if (segment === "#") {
-      return ".*";
-    }
-    return segment.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  }).join("\\.");
-  return terminalMultiLevel ? `${translated}(?:\\..*)?` : translated;
-}
-function escapeRegex(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
 
 // backend/plugin.ts
 var PLUGIN_CONTEXT3 = /* @__PURE__ */ Symbol.for("attraccess.plugin.context");
@@ -1064,8 +1054,8 @@ var RabbitmqService = class {
   }
 };
 RabbitmqService = __decorateClass([
-  (0, import_common7.Injectable)(),
-  __decorateParam(0, (0, import_common7.Inject)(PLUGIN_CONTEXT3))
+  (0, import_common5.Injectable)(),
+  __decorateParam(0, (0, import_common5.Inject)(PLUGIN_CONTEXT3))
 ], RabbitmqService);
 var RabbitmqController = class {
   // esbuild does not emit decorator metadata, so Nest cannot infer constructor
@@ -1078,12 +1068,12 @@ var RabbitmqController = class {
   }
 };
 __decorateClass([
-  (0, import_common7.Get)("status")
+  (0, import_common5.Get)("status")
 ], RabbitmqController.prototype, "status", 1);
 RabbitmqController = __decorateClass([
   (0, import_plugins_backend_sdk3.Auth)("resources.update"),
-  (0, import_common7.Controller)("rabbitmq"),
-  __decorateParam(0, (0, import_common7.Inject)(RabbitmqService))
+  (0, import_common5.Controller)("rabbitmq"),
+  __decorateParam(0, (0, import_common5.Inject)(RabbitmqService))
 ], RabbitmqController);
 var RabbitmqPluginModule = class {
 };

package/frontend/{__federation_expose_Plugin-CZ3ZqxcO.js → __federation_expose_Plugin-5jDTnovW.js}

@@ -105,6 +105,9 @@ var { createContext, useCallback: useCallback$2, useContext, useEffect: useEffec
 var contextKey = Symbol.for("attraccess.plugin.live-updates.context");
 var contexts = globalThis;
 contexts[contextKey] ??= createContext(null);
+var identityKey = Symbol.for("attraccess.plugin.live-updates.identity");
+var identities = globalThis;
+identities[identityKey] ??= createContext(null);
 //#endregion
 //#region ../../../libs/plugins-frontend-sdk/src/lib/frontend.standard-drawer.tsx
 var { DrawerBackdrop, DrawerContent, DrawerDialog } = await importShared("@heroui/react");
@@ -112,7 +115,7 @@ var { DrawerBackdrop, DrawerContent, DrawerDialog } = await importShared("@herou
 //#region ../../../libs/plugins-frontend-sdk/src/lib/frontend.standard-modal.tsx
 var { Modal: Modal$3, ModalBackdrop: ModalBackdrop$3, ModalContainer: ModalContainer$3, ModalDialog: ModalDialog$3 } = await importShared("@heroui/react");
 //#endregion
-//#region frontend/src/detection.ts
+//#region frontend/src/detection/detection.ts
 var { useCallback: useCallback$1, useEffect: useEffect$3, useState: useState$3 } = await importShared("react");
 var api$1 = createPluginApiClient("/api/rabbitmq/detection");
 function fetchDetection(mqttServerId, refresh) {
@@ -185,7 +188,7 @@ function useDetection(mqttServerId) {
 	};
 }
 //#endregion
-//#region frontend/src/RabbitmqListBadge.tsx
+//#region frontend/src/users/RabbitmqListBadge.tsx
 var { Chip: Chip$2 } = await importShared("@heroui/react");
 var { RabbitIcon: RabbitIcon$1 } = await importShared("lucide-react");
 function RabbitmqListBadge({ mqttServerId }) {
@@ -347,8 +350,8 @@ var useRabbitmqTranslations = () => useTranslations({
 	de: de_default
 }, { escapeValues: false });
 //#endregion
-//#region frontend/src/RabbitmqStatusPanel.tsx
-var { Alert: Alert$3, AlertContent: AlertContent$3, AlertDescription: AlertDescription$3, Button: Button$3, Card: Card$1, Chip: Chip$1, Spinner: Spinner$1 } = await importShared("@heroui/react");
+//#region frontend/src/detection/RabbitmqStatusPanel.tsx
+var { Alert: Alert$4, AlertContent: AlertContent$4, AlertDescription: AlertDescription$4, Button: Button$5, Card: Card$2, Chip: Chip$1, Spinner: Spinner$2 } = await importShared("@heroui/react");
 var { CheckCircle2Icon, RabbitIcon, RefreshCwIcon: RefreshCwIcon$1, XCircleIcon } = await importShared("lucide-react");
 function StatusRow({ ok, label, value }) {
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
@@ -369,10 +372,10 @@ function RabbitmqStatusPanel({ mqttServerId }) {
 	const { t } = useRabbitmqTranslations();
 	const { result, loading, refresh } = useDetection(mqttServerId);
 	if (!result?.isRabbitMQ) return null;
-	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Card$1, {
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Card$2, {
 		"data-cy": `rabbitmq-status-panel-${mqttServerId}`,
 		className: "rmq:w-full rmq:border rmq:border-default-200 rmq:dark:border-default-100",
-		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Card$1.Header, {
+		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Card$2.Header, {
 			className: "rmq:flex rmq:flex-row rmq:items-center rmq:justify-between rmq:gap-2",
 			children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 				className: "rmq:flex rmq:items-center rmq:gap-2",
@@ -389,7 +392,7 @@ function RabbitmqStatusPanel({ mqttServerId }) {
 						children: t("status.detected")
 					})
 				]
-			}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$3, {
+			}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$5, {
 				isIconOnly: true,
 				size: "sm",
 				variant: "ghost",
@@ -397,9 +400,9 @@ function RabbitmqStatusPanel({ mqttServerId }) {
 				"data-cy": `rabbitmq-status-refresh-${mqttServerId}`,
 				onPress: refresh,
 				isDisabled: loading,
-				children: loading ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Spinner$1, { size: "sm" }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(RefreshCwIcon$1, { className: "rmq:w-4 rmq:h-4" })
+				children: loading ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Spinner$2, { size: "sm" }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(RefreshCwIcon$1, { className: "rmq:w-4 rmq:h-4" })
 			})]
-		}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Card$1.Content, {
+		}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Card$2.Content, {
 			className: "rmq:flex rmq:flex-col rmq:gap-1",
 			children: [
 				/* @__PURE__ */ (0, import_jsx_runtime.jsx)(StatusRow, {
@@ -442,17 +445,17 @@ function RabbitmqStatusPanel({ mqttServerId }) {
 						children: result.managementApi || "—"
 					})]
 				}),
-				result.error && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$3, {
+				result.error && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$4, {
 					status: result.reachable ? "warning" : "danger",
 					className: "rmq:mt-2",
-					children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AlertContent$3, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AlertDescription$3, { children: result.error }) })
+					children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AlertContent$4, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AlertDescription$4, { children: result.error }) })
 				})
 			]
 		})]
 	});
 }
 //#endregion
-//#region frontend/src/users-api.ts
+//#region frontend/src/users/users-api.ts
 var DEFAULT_MQTT_PERMISSIONS = {
 	configure: "^mqtt-subscription-.*$",
 	write: "^(amq\\.topic|mqtt-subscription-.*)$",
@@ -484,8 +487,8 @@ function clearPermissions(mqttServerId, username, vhost) {
 	});
 }
 //#endregion
-//#region frontend/src/RabbitmqPermissionsModal.tsx
-var { Alert: Alert$2, AlertContent: AlertContent$2, AlertDescription: AlertDescription$2, Button: Button$2, Input: Input$1, Label: Label$1, Modal: Modal$2, ModalBackdrop: ModalBackdrop$2, ModalBody: ModalBody$2, ModalContainer: ModalContainer$2, ModalDialog: ModalDialog$2, ModalFooter: ModalFooter$2, ModalHeader: ModalHeader$2, ModalHeading: ModalHeading$2, TextField: TextField$1 } = await importShared("@heroui/react");
+//#region frontend/src/users/permissions/RabbitmqPermissionsModal.tsx
+var { Alert: Alert$3, AlertContent: AlertContent$3, AlertDescription: AlertDescription$3, Button: Button$4, Input: Input$1, Label: Label$1, Modal: Modal$2, ModalBackdrop: ModalBackdrop$2, ModalBody: ModalBody$2, ModalContainer: ModalContainer$2, ModalDialog: ModalDialog$2, ModalFooter: ModalFooter$2, ModalHeader: ModalHeader$2, ModalHeading: ModalHeading$2, TextField: TextField$1 } = await importShared("@heroui/react");
 var { PlusIcon: PlusIcon$1, Trash2Icon: Trash2Icon$1 } = await importShared("lucide-react");
 var { useEffect: useEffect$2, useState: useState$2 } = await importShared("react");
 function PermissionEditor({ row, busy, onChange, onSave, onRemove }) {
@@ -503,7 +506,7 @@ function PermissionEditor({ row, busy, onChange, onSave, onRemove }) {
 						" ",
 						/* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { children: row.vhost })
 					]
-				}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$2, {
+				}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$4, {
 					isIconOnly: true,
 					size: "sm",
 					variant: "ghost",
@@ -554,7 +557,7 @@ function PermissionEditor({ row, busy, onChange, onSave, onRemove }) {
 			}),
 			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 				className: "rmq:flex rmq:flex-wrap rmq:justify-end rmq:gap-2",
-				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$2, {
+				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$4, {
 					size: "sm",
 					variant: "ghost",
 					onPress: () => onChange({
@@ -564,7 +567,7 @@ function PermissionEditor({ row, busy, onChange, onSave, onRemove }) {
 					isDisabled: busy,
 					"data-cy": `rabbitmq-permissions-mqtt-defaults-button-${row.vhost}`,
 					children: t("permissions.defaults")
-				}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$2, {
+				}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$4, {
 					size: "sm",
 					variant: "primary",
 					onPress: onSave,
@@ -691,7 +694,7 @@ function RabbitmqPermissionsModal({ mqttServerId, isOpen, user, vhosts, onClose,
 									autoComplete: "off",
 									"data-cy": "rabbitmq-permissions-add-vhost-input"
 								})]
-							}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Button$2, {
+							}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Button$4, {
 								variant: "secondary",
 								onPress: addVhost,
 								isDisabled: newVhost.trim().length === 0,
@@ -699,14 +702,14 @@ function RabbitmqPermissionsModal({ mqttServerId, isOpen, user, vhosts, onClose,
 								children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(PlusIcon$1, { className: "rmq:w-4 rmq:h-4" }), t("permissions.add")]
 							})]
 						}),
-						error && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$2, {
+						error && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$3, {
 							status: "danger",
 							"data-cy": "rabbitmq-permissions-error-alert",
-							children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AlertContent$2, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AlertDescription$2, { children: tMessage(error) }) })
+							children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AlertContent$3, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AlertDescription$3, { children: tMessage(error) }) })
 						})
 					]
 				}),
-				/* @__PURE__ */ (0, import_jsx_runtime.jsx)(ModalFooter$2, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$2, {
+				/* @__PURE__ */ (0, import_jsx_runtime.jsx)(ModalFooter$2, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$4, {
 					variant: "secondary",
 					onPress: onClose,
 					"data-cy": "rabbitmq-permissions-close-button",
@@ -717,13 +720,9 @@ function RabbitmqPermissionsModal({ mqttServerId, isOpen, user, vhosts, onClose,
 	});
 }
 //#endregion
-//#region frontend/src/RabbitmqUserFormModal.tsx
-var { Alert: Alert$1, AlertContent: AlertContent$1, AlertDescription: AlertDescription$1, Button: Button$1, Checkbox, Form, Input, Label, Modal: Modal$1, ModalBackdrop: ModalBackdrop$1, ModalBody: ModalBody$1, ModalContainer: ModalContainer$1, ModalDialog: ModalDialog$1, ModalFooter: ModalFooter$1, ModalHeader: ModalHeader$1, ModalHeading: ModalHeading$1, TextField } = await importShared("@heroui/react");
+//#region frontend/src/users/useRabbitmqUserFormModalState.tsx
 var { useEffect: useEffect$1, useState: useState$1 } = await importShared("react");
-function parseTags(value) {
-	return value.split(",").map((tag) => tag.trim()).filter((tag) => tag.length > 0);
-}
-function RabbitmqUserFormModal({ mqttServerId, isOpen, user, vhosts, onClose, onSaved }) {
+function useRabbitmqUserFormModalState({ mqttServerId, isOpen, user, vhosts, onClose, onSaved }) {
 	const { t, tMessage } = useRabbitmqTranslations();
 	const isEdit = user !== null;
 	const [username, setUsername] = useState$1("");
@@ -775,6 +774,42 @@ function RabbitmqUserFormModal({ mqttServerId, isOpen, user, vhosts, onClose, on
 			setSaving(false);
 		}
 	};
+	return {
+		t,
+		tMessage,
+		isEdit,
+		username,
+		setUsername,
+		password,
+		setPassword,
+		tags,
+		setTags,
+		grantMqttDefaults,
+		setGrantMqttDefaults,
+		vhost,
+		setVhost,
+		saving,
+		error,
+		handleSubmit,
+		mqttServerId,
+		isOpen,
+		user,
+		vhosts,
+		onClose
+	};
+}
+//#endregion
+//#region frontend/src/users/RabbitmqUserFormModal.tsx
+var { Alert: Alert$2, AlertContent: AlertContent$2, AlertDescription: AlertDescription$2, Button: Button$3, Checkbox, Form, Input, Label, Modal: Modal$1, ModalBackdrop: ModalBackdrop$1, ModalBody: ModalBody$1, ModalContainer: ModalContainer$1, ModalDialog: ModalDialog$1, ModalFooter: ModalFooter$1, ModalHeader: ModalHeader$1, ModalHeading: ModalHeading$1, TextField } = await importShared("@heroui/react");
+function RabbitmqUserFormModal({ mqttServerId, isOpen, user, vhosts, onClose, onSaved }) {
+	const { t, tMessage, isEdit, username, setUsername, password, setPassword, tags, setTags, grantMqttDefaults, setGrantMqttDefaults, vhost, setVhost, saving, error, handleSubmit } = useRabbitmqUserFormModalState({
+		mqttServerId,
+		isOpen,
+		user,
+		vhosts,
+		onClose,
+		onSaved
+	});
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Modal$1, {
 		isOpen,
 		onOpenChange: (open) => {
@@ -854,18 +889,18 @@ function RabbitmqUserFormModal({ mqttServerId, isOpen, user, vhosts, onClose, on
 								})
 							]
 						}),
-						error && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$1, {
+						error && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$2, {
 							status: "danger",
 							"data-cy": "rabbitmq-user-form-error-alert",
-							children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AlertContent$1, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AlertDescription$1, { children: tMessage(error) }) })
+							children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AlertContent$2, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AlertDescription$2, { children: tMessage(error) }) })
 						})
 					]
-				}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(ModalFooter$1, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$1, {
+				}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(ModalFooter$1, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$3, {
 					variant: "secondary",
 					onPress: onClose,
 					"data-cy": "rabbitmq-user-form-cancel-button",
 					children: t("common.cancel")
-				}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$1, {
+				}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$3, {
 					variant: "primary",
 					type: "submit",
 					isPending: saving,
@@ -876,28 +911,13 @@ function RabbitmqUserFormModal({ mqttServerId, isOpen, user, vhosts, onClose, on
 		}) })
 	});
 }
+function parseTags(value) {
+	return value.split(",").map((tag) => tag.trim()).filter((tag) => tag.length > 0);
+}
 //#endregion
-//#region frontend/src/RabbitmqUserPanel.tsx
-var { Alert, AlertContent, AlertDescription, Button, Card, Chip, Modal, ModalBackdrop, ModalBody, ModalContainer, ModalDialog, ModalFooter, ModalHeader, ModalHeading, Spinner, Table, TableBody, TableCell, TableColumn, TableContent, TableHeader, TableRow, TableScrollContainer } = await importShared("@heroui/react");
-var { KeyRoundIcon, PencilIcon, PlusIcon, RefreshCwIcon, Trash2Icon, UsersIcon } = await importShared("lucide-react");
+//#region frontend/src/users/useRabbitmqUserPanelState.tsx
 var { useCallback, useEffect, useRef, useState } = await importShared("react");
-function PermissionChips({ user }) {
-	const { t } = useRabbitmqTranslations();
-	if (user.permissions.length === 0) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", {
-		className: "rmq:text-xs rmq:text-default-400",
-		children: t("users.none")
-	});
-	return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
-		className: "rmq:flex rmq:flex-wrap rmq:gap-1",
-		children: user.permissions.map((permission) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Chip, {
-			size: "sm",
-			variant: "soft",
-			title: t("permissions.summary", { ...permission }),
-			children: permission.vhost
-		}, permission.vhost))
-	});
-}
-function RabbitmqUserPanel({ mqttServerId }) {
+function useRabbitmqUserPanelState({ mqttServerId }) {
 	const { t, tMessage, language } = useRabbitmqTranslations();
 	const { result } = useDetection(mqttServerId);
 	const [data, setData] = useState(null);
@@ -916,6 +936,20 @@ function RabbitmqUserPanel({ mqttServerId }) {
 			mounted.current = false;
 		};
 	}, []);
+	const confirmDelete = async () => {
+		if (!userToDelete) return;
+		setDeleting(true);
+		setDeleteError(null);
+		try {
+			await deleteUser(mqttServerId, userToDelete.name);
+			setUserToDelete(null);
+			reload();
+		} catch (err) {
+			setDeleteError(err instanceof Error ? err.message : { key: "users.deleteError" });
+		} finally {
+			setDeleting(false);
+		}
+	};
 	const reload = useCallback(async () => {
 		setLoading(true);
 		setLoadError(null);
@@ -935,83 +969,161 @@ function RabbitmqUserPanel({ mqttServerId }) {
 	useEffect(() => {
 		if (manageable) reload();
 	}, [manageable, reload]);
-	if (!manageable) return null;
-	const confirmDelete = async () => {
-		if (!userToDelete) return;
-		setDeleting(true);
-		setDeleteError(null);
-		try {
-			await deleteUser(mqttServerId, userToDelete.name);
-			setUserToDelete(null);
-			reload();
-		} catch (err) {
-			setDeleteError(err instanceof Error ? err.message : { key: "users.deleteError" });
-		} finally {
-			setDeleting(false);
-		}
+	return {
+		t,
+		tMessage,
+		language,
+		data,
+		loading,
+		loadError,
+		formOpen,
+		setFormOpen,
+		formUser,
+		setFormUser,
+		permissionsUser,
+		setPermissionsUser,
+		userToDelete,
+		setUserToDelete,
+		deleting,
+		setDeleting,
+		deleteError,
+		setDeleteError,
+		reload,
+		manageable,
+		mqttServerId,
+		confirmDelete
 	};
+}
+//#endregion
+//#region frontend/src/users/RabbitmqUserPanelCardHeader.tsx
+var { Button: Button$2, Card: Card$1, Spinner: Spinner$1 } = await importShared("@heroui/react");
+var { PlusIcon, RefreshCwIcon, UsersIcon } = await importShared("lucide-react");
+function RabbitmqUserPanelCardHeader({ t, reload, loading, mqttServerId, setFormUser, setFormOpen }) {
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Card$1.Header, {
+		className: "rmq:flex rmq:flex-row rmq:items-center rmq:justify-between rmq:gap-2",
+		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+			className: "rmq:flex rmq:items-center rmq:gap-2",
+			children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(UsersIcon, { className: "rmq:w-5 rmq:h-5 rmq:text-accent-soft-foreground" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", {
+				className: "rmq:text-base rmq:font-semibold rmq:text-default-700",
+				children: t("users.title")
+			})]
+		}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+			className: "rmq:flex rmq:items-center rmq:gap-2",
+			children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$2, {
+				isIconOnly: true,
+				size: "sm",
+				variant: "ghost",
+				"aria-label": t("users.reload"),
+				onPress: () => void reload(),
+				isDisabled: loading,
+				"data-cy": `rabbitmq-user-panel-reload-${mqttServerId}`,
+				children: loading ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Spinner$1, { size: "sm" }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(RefreshCwIcon, { className: "rmq:w-4 rmq:h-4" })
+			}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Button$2, {
+				size: "sm",
+				variant: "primary",
+				onPress: () => {
+					setFormUser(null);
+					setFormOpen(true);
+				},
+				"data-cy": `rabbitmq-user-panel-create-button-${mqttServerId}`,
+				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(PlusIcon, { className: "rmq:w-4 rmq:h-4" }), t("users.add")]
+			})]
+		})]
+	});
+}
+//#endregion
+//#region frontend/src/users/RabbitmqUserPanelModalBackdrop.tsx
+var { Alert: Alert$1, AlertContent: AlertContent$1, AlertDescription: AlertDescription$1, Button: Button$1, ModalBackdrop, ModalBody, ModalContainer, ModalDialog, ModalFooter, ModalHeader, ModalHeading } = await importShared("@heroui/react");
+function RabbitmqUserPanelModalBackdrop({ t, userToDelete, deleteError, tMessage, confirmDelete, deleting }) {
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ModalBackdrop, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ModalContainer, {
+		size: "sm",
+		children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ModalDialog, { children: ({ close }) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)(ModalHeader, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ModalHeading, { children: t("users.deleteTitle") }) }),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(ModalBody, {
+				className: "rmq:flex rmq:flex-col rmq:gap-3",
+				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: t("users.deleteDescription", { name: userToDelete?.name }) }), deleteError && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$1, {
+					status: "danger",
+					"data-cy": "rabbitmq-user-delete-error-alert",
+					children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AlertContent$1, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AlertDescription$1, { children: tMessage(deleteError) }) })
+				})]
+			}),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(ModalFooter, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$1, {
+				variant: "secondary",
+				onPress: close,
+				"data-cy": "rabbitmq-user-delete-cancel-button",
+				children: t("common.cancel")
+			}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$1, {
+				variant: "danger",
+				onPress: () => void confirmDelete(),
+				isPending: deleting,
+				"data-cy": "rabbitmq-user-delete-confirm-button",
+				children: t("common.delete")
+			})] })
+		] }) })
+	}) });
+}
+//#endregion
+//#region frontend/src/users/RabbitmqUserPanel.tsx
+var { Alert, AlertContent, AlertDescription, Button, Card, Chip, Modal, Spinner, Table, TableBody, TableCell, TableColumn, TableContent, TableHeader, TableRow, TableScrollContainer } = await importShared("@heroui/react");
+var { KeyRoundIcon, PencilIcon, Trash2Icon } = await importShared("lucide-react");
+function PermissionChips({ user }) {
+	const { t } = useRabbitmqTranslations();
+	if (user.permissions.length === 0) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", {
+		className: "rmq:text-xs rmq:text-default-400",
+		children: t("users.none")
+	});
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+		className: "rmq:flex rmq:flex-wrap rmq:gap-1",
+		children: user.permissions.map((permission) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Chip, {
+			size: "sm",
+			variant: "soft",
+			title: t("permissions.summary", { ...permission }),
+			children: permission.vhost
+		}, permission.vhost))
+	});
+}
+function RabbitmqUserPanel({ mqttServerId }) {
+	const model = useRabbitmqUserPanelState({ mqttServerId });
+	if (!model.manageable) return null;
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Card, {
 		"data-cy": `rabbitmq-user-panel-${mqttServerId}`,
 		className: "rmq:w-full rmq:border rmq:border-default-200 rmq:dark:border-default-100",
 		children: [
-			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Card.Header, {
-				className: "rmq:flex rmq:flex-row rmq:items-center rmq:justify-between rmq:gap-2",
-				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
-					className: "rmq:flex rmq:items-center rmq:gap-2",
-					children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(UsersIcon, { className: "rmq:w-5 rmq:h-5 rmq:text-accent-soft-foreground" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", {
-						className: "rmq:text-base rmq:font-semibold rmq:text-default-700",
-						children: t("users.title")
-					})]
-				}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
-					className: "rmq:flex rmq:items-center rmq:gap-2",
-					children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button, {
-						isIconOnly: true,
-						size: "sm",
-						variant: "ghost",
-						"aria-label": t("users.reload"),
-						onPress: () => void reload(),
-						isDisabled: loading,
-						"data-cy": `rabbitmq-user-panel-reload-${mqttServerId}`,
-						children: loading ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Spinner, { size: "sm" }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(RefreshCwIcon, { className: "rmq:w-4 rmq:h-4" })
-					}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Button, {
-						size: "sm",
-						variant: "primary",
-						onPress: () => {
-							setFormUser(null);
-							setFormOpen(true);
-						},
-						"data-cy": `rabbitmq-user-panel-create-button-${mqttServerId}`,
-						children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(PlusIcon, { className: "rmq:w-4 rmq:h-4" }), t("users.add")]
-					})]
-				})]
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)(RabbitmqUserPanelCardHeader, {
+				t: model.t,
+				reload: model.reload,
+				loading: model.loading,
+				mqttServerId,
+				setFormUser: model.setFormUser,
+				setFormOpen: model.setFormOpen
 			}),
 			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Card.Content, {
 				className: "rmq:flex rmq:flex-col rmq:gap-3",
 				children: [
-					loadError && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert, {
+					model.loadError && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert, {
 						status: "danger",
 						"data-cy": "rabbitmq-user-panel-error-alert",
-						children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AlertContent, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AlertDescription, { children: tMessage(loadError) }) })
+						children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AlertContent, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AlertDescription, { children: model.tMessage(model.loadError) }) })
 					}),
-					!data && !loadError && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+					!model.data && !model.loadError && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
 						className: "rmq:flex rmq:items-center rmq:justify-center rmq:p-4",
 						children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Spinner, { "data-cy": "rabbitmq-user-panel-loading-spinner" })
 					}),
-					data && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Table, {
+					model.data && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Table, {
 						"data-cy": "rabbitmq-user-panel-table",
 						children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(TableScrollContainer, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TableContent, {
-							"aria-label": t("users.title"),
+							"aria-label": model.t("users.title"),
 							children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TableHeader, { children: [
 								/* @__PURE__ */ (0, import_jsx_runtime.jsx)(TableColumn, {
 									isRowHeader: true,
-									children: t("users.username")
+									children: model.t("users.username")
 								}),
-								/* @__PURE__ */ (0, import_jsx_runtime.jsx)(TableColumn, { children: t("users.tags") }),
-								/* @__PURE__ */ (0, import_jsx_runtime.jsx)(TableColumn, { children: t("users.access") }),
-								/* @__PURE__ */ (0, import_jsx_runtime.jsx)(TableColumn, { children: t("users.actions") })
+								/* @__PURE__ */ (0, import_jsx_runtime.jsx)(TableColumn, { children: model.t("users.tags") }),
+								/* @__PURE__ */ (0, import_jsx_runtime.jsx)(TableColumn, { children: model.t("users.access") }),
+								/* @__PURE__ */ (0, import_jsx_runtime.jsx)(TableColumn, { children: model.t("users.actions") })
 							] }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(TableBody, {
-								items: data.users,
-								dependencies: [language],
+								items: model.data.users,
+								dependencies: [model.language],
 								children: (user) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TableRow, {
 									id: user.name,
 									children: [
@@ -1021,7 +1133,7 @@ function RabbitmqUserPanel({ mqttServerId }) {
 										}),
 										/* @__PURE__ */ (0, import_jsx_runtime.jsx)(TableCell, { children: user.tags.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", {
 											className: "rmq:text-xs rmq:text-default-400",
-											children: t("users.none")
+											children: model.t("users.none")
 										}) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
 											className: "rmq:flex rmq:flex-wrap rmq:gap-1",
 											children: user.tags.map((tag) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Chip, {
@@ -1039,10 +1151,10 @@ function RabbitmqUserPanel({ mqttServerId }) {
 													isIconOnly: true,
 													size: "sm",
 													variant: "ghost",
-													"aria-label": t("users.edit", { name: user.name }),
+													"aria-label": model.t("users.edit", { name: user.name }),
 													onPress: () => {
-														setFormUser(user);
-														setFormOpen(true);
+														model.setFormUser(user);
+														model.setFormOpen(true);
 													},
 													"data-cy": `rabbitmq-user-edit-button-${user.name}`,
 													children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(PencilIcon, { className: "rmq:w-4 rmq:h-4" })
@@ -1051,8 +1163,8 @@ function RabbitmqUserPanel({ mqttServerId }) {
 													isIconOnly: true,
 													size: "sm",
 													variant: "ghost",
-													"aria-label": t("users.permissions", { name: user.name }),
-													onPress: () => setPermissionsUser(user),
+													"aria-label": model.t("users.permissions", { name: user.name }),
+													onPress: () => model.setPermissionsUser(user),
 													"data-cy": `rabbitmq-user-permissions-button-${user.name}`,
 													children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(KeyRoundIcon, { className: "rmq:w-4 rmq:h-4" })
 												}),
@@ -1060,10 +1172,10 @@ function RabbitmqUserPanel({ mqttServerId }) {
 													isIconOnly: true,
 													size: "sm",
 													variant: "ghost",
-													"aria-label": t("users.delete", { name: user.name }),
+													"aria-label": model.t("users.delete", { name: user.name }),
 													onPress: () => {
-														setDeleteError(null);
-														setUserToDelete(user);
+														model.setDeleteError(null);
+														model.setUserToDelete(user);
 													},
 													"data-cy": `rabbitmq-user-delete-button-${user.name}`,
 													children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Trash2Icon, { className: "rmq:w-4 rmq:h-4 rmq:text-danger" })
@@ -1079,52 +1191,27 @@ function RabbitmqUserPanel({ mqttServerId }) {
 			}),
 			/* @__PURE__ */ (0, import_jsx_runtime.jsx)(RabbitmqUserFormModal, {
 				mqttServerId,
-				isOpen: formOpen,
-				user: formUser,
-				vhosts: data?.vhosts ?? [],
-				onClose: () => setFormOpen(false),
-				onSaved: () => void reload()
+				isOpen: model.formOpen,
+				user: model.formUser,
+				vhosts: model.data?.vhosts ?? [],
+				onClose: () => model.setFormOpen(false),
+				onSaved: () => void model.reload()
 			}),
 			/* @__PURE__ */ (0, import_jsx_runtime.jsx)(RabbitmqPermissionsModal, {
 				mqttServerId,
-				isOpen: permissionsUser !== null,
-				user: permissionsUser,
-				vhosts: data?.vhosts ?? [],
-				onClose: () => setPermissionsUser(null),
-				onSaved: () => void reload()
+				isOpen: model.permissionsUser !== null,
+				user: model.permissionsUser,
+				vhosts: model.data?.vhosts ?? [],
+				onClose: () => model.setPermissionsUser(null),
+				onSaved: () => void model.reload()
 			}),
 			/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Modal, {
-				isOpen: userToDelete !== null,
+				isOpen: model.userToDelete !== null,
 				onOpenChange: (open) => {
-					if (!open) setUserToDelete(null);
+					if (!open) model.setUserToDelete(null);
 				},
 				"data-cy": `rabbitmq-user-delete-modal-${mqttServerId}`,
-				children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ModalBackdrop, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ModalContainer, {
-					size: "sm",
-					children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ModalDialog, { children: ({ close }) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
-						/* @__PURE__ */ (0, import_jsx_runtime.jsx)(ModalHeader, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ModalHeading, { children: t("users.deleteTitle") }) }),
-						/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(ModalBody, {
-							className: "rmq:flex rmq:flex-col rmq:gap-3",
-							children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: t("users.deleteDescription", { name: userToDelete?.name }) }), deleteError && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert, {
-								status: "danger",
-								"data-cy": "rabbitmq-user-delete-error-alert",
-								children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AlertContent, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AlertDescription, { children: tMessage(deleteError) }) })
-							})]
-						}),
-						/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(ModalFooter, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button, {
-							variant: "secondary",
-							onPress: close,
-							"data-cy": "rabbitmq-user-delete-cancel-button",
-							children: t("common.cancel")
-						}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button, {
-							variant: "danger",
-							onPress: () => void confirmDelete(),
-							isPending: deleting,
-							"data-cy": "rabbitmq-user-delete-confirm-button",
-							children: t("common.delete")
-						})] })
-					] }) })
-				}) })
+				children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(RabbitmqUserPanelModalBackdrop, { ...model })
 			})
 		]
 	});

package/frontend/remoteEntry.js

@@ -75,7 +75,7 @@ var exportSet = /* @__PURE__ */ new Set([
 ]);
 var moduleMap = { "./plugin": () => {
 	dynamicLoadingCss(["style.css"], false, "./plugin");
-	return __federation_import("./__federation_expose_Plugin-CZ3ZqxcO.js").then((module) => Object.keys(module).every((item) => exportSet.has(item)) ? () => module.default : () => module);
+	return __federation_import("./__federation_expose_Plugin-5jDTnovW.js").then((module) => Object.keys(module).every((item) => exportSet.has(item)) ? () => module.default : () => module);
 } };
 var seen = {};
 var dynamicLoadingCss = (cssFilePaths, dontAppendStylesToHead, exposeItemName) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@attraccess/plugin-rabbitmq",
-  "version": "0.1.0-nightly.1076.1",
+  "version": "0.1.0-nightly.1079.1",
   "description": "Official Attraccess integration for RabbitMQ.",
   "license": "AGPL-3.0-only",
   "repository": {