v2.4.1

Author: ARyaskov

.github/workflows/ci.yml

@@ -15,14 +15,14 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node: ["24"]
+        node: ["24", "26"]
     steps:
       - uses: actions/checkout@v4
 
+      # Version comes from the root package.json `packageManager` field.
       - name: Set up pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 9
           run_install: false
 
       - name: Set up Node.js
@@ -56,7 +56,6 @@ jobs:
       - name: Set up pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 9
           run_install: false
 
       - uses: actions/setup-node@v4

docs/access-control.md

@@ -7,7 +7,9 @@ ACL restricts which callers can invoke which methods on which topics. It is eval
 ```ts
 interface AccessControlConfig {
   rules?: AccessRule[]
-  allowAllByDefault?: boolean        // default: true (when no rules match)
+  // Default: true with no rules, FALSE once any rule exists (secure default).
+  // Set explicitly to opt out.
+  allowAllByDefault?: boolean
   logDenied?: boolean
   jwtVerifier?: (token: string) => Promise<VerifiedClaims | null>
 }
@@ -37,7 +39,8 @@ export class UserController { ... }
 
 Semantics:
 
-- If `rules` is empty, `allowAllByDefault` (default `true`) decides
+- **Deny by default once rules exist.** When at least one rule is configured and `allowAllByDefault` is not set, any `(topic, method)` matched by no rule is **denied**. Set `allowAllByDefault: true` to restore the permissive behaviour. With no rules at all, everything is allowed.
+- Built-in `nevo.*` methods (contract, health probes) stay reachable under the deny-default; an explicit matching `deny` rule still blocks them.
 - Multiple rules can match a given `(topic, method)` — `deny` always wins over `allow`
 - Wildcards `"*"` match any value
 

docs/basics-nats.md

@@ -104,13 +104,18 @@ createNatsMicroservice({
 
 ## Subjects & wildcards
 
-Subjects use dot-separated names (`user.created`, `orders.paid.eu-west`). The `@Signal` value is sent verbatim as the subject. NATS wildcards `*` (one token) and `>` (rest) are supported in subscription patterns:
+Pub/sub messages travel on method-scoped subjects: `publish("user", "user.updated", …)` goes to `user-events.sub.user.updated`, and `subscribe("user", "user.updated", …)` subscribes to exactly that subject — NATS filters server-side, so subscribers no longer receive (and discard) the whole service stream. The `@vN` version suffix is stripped from the subject; a subscriber of the base method receives every version.
+
+NATS wildcards `*` (one token) and `>` (rest) work natively in the method position, and an empty method subscribes to everything the service publishes:
 
 ```ts
-await this.subscribe("user", "user.*", {}, (msg) => { ... })
-await this.subscribeWildcard("orders.>", (msg, ctx) => { ... })
+await this.subscribe("user", "user.*", {}, (msg) => { ... })   // user.created, user.updated, …
+await this.subscribe("user", "", {}, (msg) => { ... })          // every published method
+await this.subscribeWildcard("orders.>", (msg, ctx) => { ... }) // raw subject pattern
 ```
 
+> **Upgrading from ≤2.4:** publishers and subscribers must run the same version — older peers used the bare `<service>-events.sub` subject. JetStream streams capturing pub/sub traffic need their subject filter widened to `<service>-events.sub.>`.
+
 ## JetStream-backed `ack: true`
 
 When you subscribe with `{ ack: true }` Nevo upgrades the subscription to a durable JetStream consumer with manual ack. Use this for at-least-once semantics:

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riaskov/nevo-messaging",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "description": "Microservices messaging framework for NestJS with NATS/Kafka/SocketIO/HTTP transport, MessagePack, retry/circuit-breaker, OTel, schema validation, DLQ, idempotency, saga, outbox, metrics, health, DevTools",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

src/common/access-control.ts

@@ -106,12 +106,25 @@ function compile(config: AccessControlConfig): CompiledAcl {
   const cached = COMPILED.get(config)
   if (cached) return cached
 
+  // Secure default: once any rule exists, unmatched methods are DENIED unless
+  // allowAllByDefault is explicitly true. A config with no rules stays open.
+  const hasRules = (config.rules?.length ?? 0) > 0
+  const allowAllByDefault = config.allowAllByDefault ?? !hasRules
+  if (hasRules && config.allowAllByDefault === undefined) {
+    try {
+      getDefaultLogger().warn(
+        { event: "acl.implicit_default_deny" },
+        "[NevoMessaging][ACL] rules are configured without allowAllByDefault; methods not matched by any rule are DENIED. Set allowAllByDefault: true to opt out."
+      )
+    } catch {}
+  }
+
   const compiled: CompiledAcl = {
     globalDefault: [],
     byTopic: new Map(),
     byMethod: new Map(),
     byTopicMethod: new Map(),
-    allowAllByDefault: config.allowAllByDefault !== false,
+    allowAllByDefault,
     logDenied: config.logDenied !== false,
     jwtVerifier: config.jwtVerifier
   }
@@ -171,7 +184,9 @@ export function isAccessAllowed(config: AccessControlConfig | undefined, topic:
   if (mRules) candidates.push(...mRules)
   if (compiled.globalDefault.length) candidates.push(...compiled.globalDefault)
 
-  if (candidates.length === 0) return compiled.allowAllByDefault
+  // Built-in introspection methods (contract, health) stay reachable under the
+  // deny-default; an explicit matching rule still overrides this.
+  if (candidates.length === 0) return compiled.allowAllByDefault || method.startsWith("nevo.")
 
   // Deny is authoritative: a matching deny in any candidate rule wins over any allow.
   for (const rule of candidates) {

src/common/base.client.ts

@@ -186,11 +186,21 @@ export abstract class BaseMessagingClient {
     return this.codec.decode<T>(data)
   }
 
+  private readonly inflightCounts = new Map<string, number>()
+
+  private bumpInflight(key: string, labels: Record<string, string>, delta: number): void {
+    const next = Math.max(0, (this.inflightCounts.get(key) ?? 0) + delta)
+    if (next === 0) this.inflightCounts.delete(key)
+    else this.inflightCounts.set(key, next)
+    this.metrics.setGauge(NEVO_METRIC_NAMES.inflight, labels, next)
+  }
+
   protected async withClientPipeline<T>(serviceName: string, method: string, fn: () => Promise<T>, resilience?: CompiledResilience): Promise<T> {
     const key = `${serviceName}:${method}`
     // Version-stripped label so `foo@v1`/`foo@v2` don't split into separate series.
     const methodName = methodLabel(method)
-    this.metrics.setGauge(NEVO_METRIC_NAMES.inflight, { service: serviceName, method: methodName }, 1)
+    const labels = { service: serviceName, method: methodName }
+    this.bumpInflight(key, labels, 1)
     try {
       return await runClientPipeline<T>(
         this.circuitBreaker,
@@ -203,7 +213,7 @@ export abstract class BaseMessagingClient {
         resilience
       )
     } finally {
-      this.metrics.setGauge(NEVO_METRIC_NAMES.inflight, { service: serviceName, method: methodName }, 0)
+      this.bumpInflight(key, labels, -1)
     }
   }