- Shipped
- October 19, 2026 at 12:23 AM UTC
- Author
- Kamo
- Commit
- 44e4aab
A god-mode window is a property of the session, not the member, and the STOMP authz calls to iot-service named only the member, so god in another org could not get live device/org updates. - WebSocketAuthInterceptor keeps the resolved *** id in the socket's session attributes (***Id; server-side only, never logged). - IotStompAuthz.allowDevice / allowOrg hand it to IotStompAuthzClient.device / org, which send it as X-Subscriber-Session on **************** and /org/{id}; no attribute, no header. The relay question is unchanged and the cache keys stay per (member, target). - IotSubscriptionRegistry keeps the id with each recorded subscription and its re-checks (access signal, 60 s sweep) carry it too: otherwise god's live view would be revoked by the first sweep after the cached allow expired, and with it a closed window is revoked as it should be.