Initial commit

2026-08-13 20:20:47 +03:30
commit 78a0c832d7
33 changed files with 3399 additions and 0 deletions
--- a/pkg/amqp/amqp.go
+++ b/pkg/amqp/amqp.go
@@ -0,0 +1,323 @@
+package amqp
+
+import (
+	"errors"
+	"sync"
+	"time"
+
+	"github.com/rs/zerolog/log"
+	"github.com/streadway/amqp"
+)
+
+type AMQPSession struct {
+	connection      *amqp.Connection
+	channel         *amqp.Channel
+	done            chan bool
+	streamsReInit   []chan bool
+	ready           chan bool
+	notifyConnClose chan *amqp.Error
+	notifyChanClose chan *amqp.Error
+	notifyConfirm   chan amqp.Confirmation
+	isready         bool
+	mutex           sync.Mutex
+	mutexCh         sync.Mutex
+}
+
+const (
+	// When reconnecting to the server after connection failure
+	reconnectDelay = 5 * time.Second
+
+	// When setting up the channel after a channel exception
+	reInitDelay = 2 * time.Second
+
+	// When resending messages the server didn't confirm
+	resendDelay = 5 * time.Second
+)
+
+var (
+	errNotConnected  = errors.New("not connected to a server")
+	errAlreadyClosed = errors.New("already closed: not connected to the server")
+	errShutdown      = errors.New("session is shutting down")
+)
+
+// NewAMQPSession creates a new consumer state instance, and automatically
+// attempts to connect to the server.
+func NewAMQPSession(addr string) (*AMQPSession, error) {
+	session := AMQPSession{
+		ready:         make(chan bool, 1),
+		streamsReInit: make([]chan bool, 0),
+	}
+	go session.handleReconnect(addr)
+	return &session, nil
+}
+
+func (session *AMQPSession) waitChannelReady() {
+	session.mutex.Lock()
+
+	if !session.isready {
+		session.mutex.Unlock()
+		select {
+		case <-session.ready:
+			return
+		}
+	} else {
+		session.mutex.Unlock()
+	}
+}
+
+func (session *AMQPSession) setReady(ready bool) {
+	session.mutex.Lock()
+	session.isready = ready
+	session.mutex.Unlock()
+	if ready {
+		session.ready <- true
+	}
+}
+
+// connect will create a new AMQP connection
+func (session *AMQPSession) connect(addr string) (*amqp.Connection, error) {
+	conn, err := amqp.Dial(addr)
+
+	if err != nil {
+		return nil, err
+	}
+
+	session.changeConnection(conn)
+	log.Info().Msg("AMQP Connected to AMQP!")
+
+	return conn, nil
+}
+
+// handleReconnect will wait for a connection error on
+// notifyConnClose, and then continuously attempt to reconnect.
+func (session *AMQPSession) handleReconnect(addr string) {
+	for {
+		session.setReady(false)
+		log.Info().Msg("AMQP Attempting to connect")
+
+		conn, err := session.connect(addr)
+
+		if err != nil {
+			log.Info().Msg("AMQP Failed to connect. Retrying...")
+
+			select {
+			case <-session.done:
+				return
+			case <-time.After(reconnectDelay):
+			}
+			continue
+		}
+
+		if done := session.handleReInit(conn); done {
+			break
+		}
+	}
+	log.Fatal().Msg("AMQP stopped")
+}
+
+// handleReconnect will wait for a channel error
+// and then continuously attempt to re-initialize both channels
+func (session *AMQPSession) handleReInit(conn *amqp.Connection) bool {
+	for {
+		session.setReady(false)
+
+		err := session.init(conn)
+
+		if err != nil {
+			log.Info().Msg("AMQP Failed to initialize channel. Retrying...")
+
+			select {
+			case <-session.done:
+				log.Info().Msg("AMQP Connection closed. Done")
+				return true
+			case <-time.After(reInitDelay):
+			}
+			continue
+		}
+
+		select {
+		case <-session.done:
+			log.Info().Msg("AMQP Connection closed. Done")
+			return true
+		case <-session.notifyConnClose:
+			log.Info().Msg("AMQP Connection closed. Reconnecting...")
+			for _, ch := range session.streamsReInit {
+				ch <- true
+			}
+			return false
+		case <-session.notifyChanClose:
+			log.Info().Msg("AMQP Channel closed. Re-running init...")
+			for _, ch := range session.streamsReInit {
+				ch <- true
+			}
+		}
+	}
+}
+
+// init will initialize channel
+func (session *AMQPSession) init(conn *amqp.Connection) error {
+	ch, err := conn.Channel()
+
+	if err != nil {
+		return err
+	}
+
+	err = ch.Confirm(false)
+
+	if err != nil {
+		return err
+	}
+
+	session.changeChannel(ch)
+	session.setReady(true)
+	log.Info().Msg("AMQP Setup complete!")
+
+	return nil
+}
+
+// changeConnection takes a new connection to the queue,
+// and updates the close listener to reflect this.
+func (session *AMQPSession) changeConnection(connection *amqp.Connection) {
+	session.connection = connection
+	session.notifyConnClose = make(chan *amqp.Error)
+	session.connection.NotifyClose(session.notifyConnClose)
+}
+
+// changeChannel takes a new channel to the queue,
+// and updates the channel listeners to reflect this.
+func (session *AMQPSession) changeChannel(channel *amqp.Channel) {
+	session.mutexCh.Lock()
+	session.channel = channel
+	session.notifyChanClose = make(chan *amqp.Error)
+	session.notifyConfirm = make(chan amqp.Confirmation, 1)
+	session.channel.NotifyClose(session.notifyChanClose)
+	session.channel.NotifyPublish(session.notifyConfirm)
+	session.mutexCh.Unlock()
+}
+
+// Push will push data onto the queue, and wait for a confirm.
+// If no confirms are received until within the resendTimeout,
+// it continuously re-sends messages until a confirm is received.
+// This will block until the server sends a confirm. Errors are
+// only returned if the push action itself fails, see UnsafePush.
+func (session *AMQPSession) Push(ex, rt string, data []byte) error {
+	for {
+		err := session.UnsafePush(ex, rt, data)
+		if err != nil {
+			log.Info().Msg("AMQP Push failed. Retrying...")
+			select {
+			case <-session.done:
+				return errShutdown
+			case <-time.After(resendDelay):
+			}
+			continue
+		}
+		select {
+		case confirm := <-session.notifyConfirm:
+			if confirm.Ack {
+				log.Info().Msg("AMQP Push confirmed!")
+				return nil
+			}
+		case <-time.After(resendDelay):
+		}
+		log.Info().Msg("AMQP Push didn't confirm. Retrying...")
+	}
+}
+
+// Push will push to the queue without checking for
+// confirmation. It returns an error if it fails to connect.
+// No guarantees are provided for whether the server will
+// recieve the message.
+func (session *AMQPSession) UnsafePush(ex, rt string, data []byte) error {
+	session.waitChannelReady()
+	session.mutexCh.Lock()
+	defer session.mutexCh.Unlock()
+	return session.channel.Publish(
+		ex,    // Exchange
+		rt,    // Routing key
+		false, // Mandatory
+		false, // Immediate
+		amqp.Publishing{
+			ContentType: "text/plain",
+			Body:        data,
+		},
+	)
+}
+
+// Stream will continuously put queue items on the channel.
+// It is required to call delivery.Ack when it has been
+// successfully processed, or delivery.Nack when it fails.
+// Ignoring this will cause data to build up on the server.
+func (session *AMQPSession) Stream(exName, qName, rKey string, consumer func(amqp.Delivery)) error {
+	session.mutex.Lock()
+	reinit := make(chan bool, 1)
+	session.streamsReInit = append(session.streamsReInit, reinit)
+	session.mutex.Unlock()
+	go func() {
+		for {
+			session.waitChannelReady()
+
+			_, err := session.channel.QueueDeclare(
+				qName,
+				false, // Durable
+				true,  // Delete when unused
+				true,  // Exclusive
+				false, // No-wait
+				nil,   // Arguments
+			)
+
+			if err != nil {
+				panic("AMQP failed to declare queue " + qName + ": " + err.Error())
+			}
+
+			session.channel.ExchangeDeclare(exName, "topic", false, false, false, false, nil)
+			session.channel.QueueBind(qName, rKey, exName, false, nil)
+
+			ch, err := session.channel.Consume(
+				qName,
+				"",    // Consumer
+				true,  // Auto-Ack
+				true,  // Exclusive
+				false, // No-local
+				false, // No-Wait
+				nil,   // Args
+			)
+
+			if err != nil {
+				panic("AMQP failed to consume queue " + err.Error())
+			}
+
+			func() {
+				for {
+					select {
+					case delivery := <-ch:
+						consumer(delivery)
+					case <-reinit:
+						return
+					}
+				}
+			}()
+
+			log.Warn().Msg("AMQP Stream loop interrupted")
+		}
+	}()
+	return nil
+}
+
+// Close will delete the queue, close the channel and the connection.
+func (session *AMQPSession) Close(qName string) error {
+	log.Error().Msg("Closing connection to RabbitMQ")
+	_, err := session.channel.QueueDelete(qName, false, false, false)
+	if err != nil {
+		return err
+	}
+	err = session.channel.Close()
+	if err != nil {
+		return err
+	}
+	err = session.connection.Close()
+	if err != nil {
+		return err
+	}
+	return nil
+}
--- a/pkg/auth/hmac.go
+++ b/pkg/auth/hmac.go
@@ -0,0 +1,47 @@
+package auth
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"net/http"
+	"time"
+)
+
+// APIKeyHMAC contains API keys credential to authenticate to HTTP API using HMAC
+type APIKeyHMAC struct {
+	AccessKey string
+	SecretKey string
+}
+
+// NewAPIKeyHMAC creates an instance of APIKeyHMAC
+func NewAPIKeyHMAC(accessKey, secretKey string) *APIKeyHMAC {
+	return &APIKeyHMAC{
+		AccessKey: accessKey,
+		SecretKey: secretKey,
+	}
+}
+
+// GetSignature return a signature for the given nonce, if nonce is zero it use the current time in millisecond
+func (key *APIKeyHMAC) GetSignature(nonce int64) string {
+	if nonce == 0 {
+		nonce = int64(time.Now().UnixNano() * 1000000)
+	}
+	mac := hmac.New(sha256.New, []byte(key.SecretKey))
+	mac.Write([]byte(fmt.Sprintf("%d%s", nonce, key.AccessKey)))
+	return hex.EncodeToString(mac.Sum(nil))
+}
+
+// GetSignedHeader returns a header with valid HMAC authorization fields
+func (key *APIKeyHMAC) GetSignedHeader(nonce int64) http.Header {
+	if nonce == 0 {
+		nonce = int64(time.Now().UnixNano() * 1000000)
+	}
+
+	return http.Header{
+		"X-Auth-Apikey":    {key.AccessKey},
+		"X-Auth-Nonce":     {fmt.Sprintf("%d", nonce)},
+		"X-Auth-Signature": {key.GetSignature(nonce)},
+	}
+}
--- a/pkg/auth/hmac_test.go
+++ b/pkg/auth/hmac_test.go
@@ -0,0 +1,34 @@
+package auth
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestAPIKeyHMACGetSignature(t *testing.T) {
+	accessKey := "61d025b8573501c2"
+	secretKey := "2d0b4979c7fe6986daa8e21d1dc0644f"
+
+	k := NewAPIKeyHMAC(accessKey, secretKey)
+	nonce := int64(1584524005143)
+	signature := k.GetSignature(nonce)
+	assert.Equal(t, "bd42b945e095880e28d046846dbecf655fdf09d95a396a24fe6fe1df42f15d13", signature)
+}
+
+func TestAPIKeyHMACGetSignedHeader(t *testing.T) {
+	accessKey := "61d025b8573501c2"
+	secretKey := "2d0b4979c7fe6986daa8e21d1dc0644f"
+
+	k := NewAPIKeyHMAC(accessKey, secretKey)
+	nonce := int64(1584524005143)
+	headers := k.GetSignedHeader(nonce)
+
+	assert.Equal(t,
+		http.Header{
+			"X-Auth-Apikey":    {accessKey},
+			"X-Auth-Nonce":     {"1584524005143"},
+			"X-Auth-Signature": {"bd42b945e095880e28d046846dbecf655fdf09d95a396a24fe6fe1df42f15d13"},
+		}, headers)
+}
--- a/pkg/auth/jwt.go
+++ b/pkg/auth/jwt.go
@@ -0,0 +1,31 @@
+package auth
+
+import (
+	"crypto/rsa"
+	"encoding/json"
+
+	"github.com/golang-jwt/jwt"
+)
+
+// Auth struct represents parsed jwt information.
+type Auth struct {
+	UID        string          `json:"uid"`
+	State      string          `json:"state"`
+	Email      string          `json:"email"`
+	Role       string          `json:"role"`
+	ReferralID json.Number     `json:"referral_id"`
+	Level      json.Number     `json:"level"`
+	Audience   []string        `json:"aud,omitempty"`
+	jwt.StandardClaims
+}
+
+// ParseAndValidate parses token and validates RS256 signature with Barong RSA public key.
+func ParseAndValidate(token string, key *rsa.PublicKey) (Auth, error) {
+	auth := Auth{}
+
+	_, err := jwt.ParseWithClaims(token, &auth, func(t *jwt.Token) (interface{}, error) {
+		return key, nil
+	})
+
+	return auth, err
+}
--- a/pkg/auth/key_store.go
+++ b/pkg/auth/key_store.go
@@ -0,0 +1,150 @@
+package auth
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/pem"
+	"io/ioutil"
+	"os"
+
+	"github.com/golang-jwt/jwt"
+)
+
+type KeyStore struct {
+	PublicKey  *rsa.PublicKey
+	PrivateKey *rsa.PrivateKey
+}
+
+func fileExist(path string) bool {
+	_, err := os.Stat(path)
+	return err == nil
+}
+
+func (ks *KeyStore) LoadPublicKeyFromFile(path string) error {
+	pemBytes, err := ioutil.ReadFile(path)
+	if err != nil {
+		return err
+	}
+
+	key, err := jwt.ParseRSAPublicKeyFromPEM(pemBytes)
+	if err != nil {
+		return err
+	}
+
+	ks.PublicKey = key
+
+	return nil
+}
+
+func (ks *KeyStore) LoadPublicKeyFromString(str string) error {
+	pemBytes, err := base64.StdEncoding.DecodeString(str)
+	if err != nil {
+		return err
+	}
+
+	key, err := jwt.ParseRSAPublicKeyFromPEM(pemBytes)
+	if err != nil {
+		return err
+	}
+
+	ks.PublicKey = key
+
+	return nil
+}
+
+func (ks *KeyStore) LoadPrivateKey(path string) error {
+	pemBytes, err := ioutil.ReadFile(path)
+	if err != nil {
+		return err
+	}
+
+	key, err := jwt.ParseRSAPrivateKeyFromPEM(pemBytes)
+	if err != nil {
+		return err
+	}
+
+	ks.PrivateKey = key
+
+	return nil
+}
+
+func (ks *KeyStore) GenerateKeys() error {
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		return err
+	}
+
+	ks.PrivateKey = key
+	ks.PublicKey = &key.PublicKey
+
+	return nil
+}
+
+func (ks *KeyStore) SavePrivateKey(path string) error {
+	file, err := os.Create(path)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+
+	block := &pem.Block{
+		Type:  "RSA PRIVATE KEY",
+		Bytes: x509.MarshalPKCS1PrivateKey(ks.PrivateKey),
+	}
+
+	return pem.Encode(file, block)
+}
+
+func (ks *KeyStore) SavePublicKey(path string) error {
+	bytes, err := x509.MarshalPKIXPublicKey(ks.PublicKey)
+	if err != nil {
+		return err
+	}
+
+	file, err := os.Create(path)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+
+	block := &pem.Block{
+		Type:  "PUBLIC KEY",
+		Bytes: bytes,
+	}
+
+	return pem.Encode(file, block)
+}
+
+func LoadOrGenerateKeys(privPath, pubPath string) (*KeyStore, error) {
+	ks := &KeyStore{}
+
+	if fileExist(privPath) {
+		if err := ks.LoadPrivateKey(privPath); err != nil {
+			return ks, err
+		}
+	} else {
+		if err := ks.GenerateKeys(); err != nil {
+			return ks, err
+		}
+		if err := ks.SavePrivateKey(privPath); err != nil {
+			return ks, err
+		}
+	}
+
+	if fileExist(pubPath) {
+		if err := ks.LoadPublicKeyFromFile(pubPath); err != nil {
+			return ks, err
+		}
+	} else {
+		if ks.PublicKey == nil {
+			ks.PublicKey = &ks.PrivateKey.PublicKey
+		}
+		if err := ks.SavePublicKey(pubPath); err != nil {
+			return ks, err
+		}
+	}
+
+	return ks, nil
+}
--- a/pkg/auth/validator.go
+++ b/pkg/auth/validator.go
@@ -0,0 +1,83 @@
+package auth
+
+import (
+	"crypto/ed25519"
+	"crypto/rsa"
+	"fmt"
+	"os"
+
+	pkgjwt "github.com/openware/pkg/jwt"
+)
+
+const (
+	ValidatorRSA   = "rsa"
+	ValidatorEdDSA = "eddsa"
+)
+
+// Validator verifies Barong JWT tokens using RS256 or EdDSA depending on configured key material.
+type Validator struct {
+	Mode string
+	RSA  *rsa.PublicKey
+	EdDSA ed25519.PublicKey
+}
+
+type Claims struct {
+	UID  string
+	Role string
+}
+
+// LoadValidator reads JWT_PUBLIC_KEY (base64 PEM) or -pubKey file path.
+// OpenDAX / Barong 2.6 uses RS256; upstream Rango 3.1.2+ defaults to EdDSA.
+func LoadValidator(pubKeyPath string) (Validator, error) {
+	if encPem := os.Getenv("JWT_PUBLIC_KEY"); encPem != "" {
+		rsaStore := KeyStore{}
+		if err := rsaStore.LoadPublicKeyFromString(encPem); err == nil && rsaStore.PublicKey != nil {
+			return Validator{Mode: ValidatorRSA, RSA: rsaStore.PublicKey}, nil
+		}
+
+		edStore := pkgjwt.KeyStoreEdDSA{}
+		if err := edStore.LoadPublicKeyFromString(encPem); err == nil && edStore.PublicKey != nil {
+			return Validator{Mode: ValidatorEdDSA, EdDSA: edStore.PublicKey}, nil
+		}
+
+		return Validator{}, fmt.Errorf("JWT_PUBLIC_KEY is neither a valid RSA nor EdDSA public key")
+	}
+
+	rsaStore := KeyStore{}
+	if err := rsaStore.LoadPublicKeyFromFile("config/rsa-key.pub"); err == nil && rsaStore.PublicKey != nil {
+		return Validator{Mode: ValidatorRSA, RSA: rsaStore.PublicKey}, nil
+	}
+
+	edStore := pkgjwt.KeyStoreEdDSA{}
+	if err := edStore.LoadPublicKeyFromFile(pubKeyPath); err != nil {
+		return Validator{}, fmt.Errorf("load public key from %q: %w", pubKeyPath, err)
+	}
+	if edStore.PublicKey == nil {
+		return Validator{}, fmt.Errorf("public key not loaded from %q", pubKeyPath)
+	}
+
+	return Validator{Mode: ValidatorEdDSA, EdDSA: edStore.PublicKey}, nil
+}
+
+func (v Validator) ParseAndValidate(token string) (Claims, error) {
+	if token == "" {
+		return Claims{}, fmt.Errorf("missing token")
+	}
+
+	switch v.Mode {
+	case ValidatorRSA:
+		auth, err := ParseAndValidate(token, v.RSA)
+		if err != nil {
+			return Claims{}, err
+		}
+		return Claims{UID: auth.UID, Role: auth.Role}, nil
+	case ValidatorEdDSA:
+		auth, err := pkgjwt.ParseAndValidateEdDSA(token, v.EdDSA)
+		if err != nil {
+			return Claims{}, err
+		}
+		return Claims{UID: auth.UID, Role: auth.Role}, nil
+	default:
+		return Claims{}, fmt.Errorf("unknown validator mode %q", v.Mode)
+	}
+}
--- a/pkg/auth/validator_test.go
+++ b/pkg/auth/validator_test.go
@@ -0,0 +1,31 @@
+package auth
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/base64"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestLoadValidator_RSAFromEnv(t *testing.T) {
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+
+	store := KeyStore{PublicKey: &key.PublicKey}
+	path := t.TempDir() + "/pub.pem"
+	require.NoError(t, store.SavePublicKey(path))
+
+	pemBytes, err := os.ReadFile(path)
+	require.NoError(t, err)
+
+	t.Setenv("JWT_PUBLIC_KEY", base64.StdEncoding.EncodeToString(pemBytes))
+
+	validator, err := LoadValidator("config/ed25519-key.pub")
+	require.NoError(t, err)
+	assert.Equal(t, ValidatorRSA, validator.Mode)
+	assert.NotNil(t, validator.RSA)
+}
--- a/pkg/message/msg.go
+++ b/pkg/message/msg.go
@@ -0,0 +1,26 @@
+package message
+
+import (
+	"encoding/json"
+)
+
+type Request struct {
+	Method  string
+	Streams []string
+}
+
+func PackOutgoingResponse(err error, message interface{}) ([]byte, error) {
+	res := make(map[string]interface{}, 1)
+	if err != nil {
+		res["error"] = err.Error()
+	} else {
+		res["success"] = message
+	}
+	return json.Marshal(res)
+}
+
+func PackOutgoingEvent(channel string, data interface{}) ([]byte, error) {
+	resp := make(map[string]interface{}, 1)
+	resp[channel] = data
+	return json.Marshal(resp)
+}
--- a/pkg/message/msg_test.go
+++ b/pkg/message/msg_test.go
@@ -0,0 +1,48 @@
+package message
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+)
+
+func TestMsg_Response(t *testing.T) {
+	t.Run("no error", func(t *testing.T) {
+		res, err := PackOutgoingResponse(nil, "ok")
+		fmt.Println(string(res))
+
+		if err != nil {
+			t.Fatal("Should not return error")
+		}
+
+		if string(res) != `{"success":"ok"}` {
+			t.Fatal("Response invalid")
+		}
+	})
+
+	t.Run("Some error", func(t *testing.T) {
+		res, err := PackOutgoingResponse(errors.New("Some Error"), "ok")
+		fmt.Println(string(res))
+
+		if err != nil {
+			t.Fatal("Should not return error")
+		}
+
+		if string(res) != `{"error":"Some Error"}` {
+			t.Fatal("Response invalid")
+		}
+	})
+}
+
+func TestMsg_Event(t *testing.T) {
+	res, err := PackOutgoingEvent("someMethod", "Hello")
+	fmt.Println(string(res))
+
+	if err != nil {
+		t.Fatal("Should not return error")
+	}
+
+	if string(res) != `{"someMethod":"Hello"}` {
+		t.Fatal("Event invalid")
+	}
+}
--- a/pkg/message/parser.go
+++ b/pkg/message/parser.go
@@ -0,0 +1,59 @@
+package message
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"reflect"
+)
+
+func ParseRequest(msg []byte) (Request, error) {
+	request, err := Parse(msg)
+	if err != nil {
+		return request, err
+	}
+
+	return request, nil
+}
+
+func Parse(msg []byte) (Request, error) {
+	var v map[string]interface{}
+	var parsed Request
+
+	if err := json.Unmarshal(msg, &v); err != nil {
+		return parsed, fmt.Errorf("Could not parse message: %w", err)
+	}
+
+	switch v["event"] {
+	case "subscribe":
+		parsed.Method = "subscribe"
+		streams, ok := v["streams"]
+		if !ok {
+			return parsed, fmt.Errorf("No streams provided")
+		}
+		switch reflect.TypeOf(streams).Kind() {
+		case reflect.Slice:
+			streams := reflect.ValueOf(v["streams"])
+			for i := 0; i < streams.Len(); i++ {
+				parsed.Streams = append(parsed.Streams, streams.Index(i).Interface().(string))
+			}
+		}
+	case "unsubscribe":
+		parsed.Method = "unsubscribe"
+		streams, ok := v["streams"]
+		if !ok {
+			return parsed, fmt.Errorf("No streams provided")
+		}
+		switch reflect.TypeOf(streams).Kind() {
+		case reflect.Slice:
+			streams := reflect.ValueOf(v["streams"])
+			for i := 0; i < streams.Len(); i++ {
+				parsed.Streams = append(parsed.Streams, streams.Index(i).Interface().(string))
+			}
+		}
+	default:
+		return parsed, errors.New("Could not parse Type: Invalid event")
+	}
+
+	return parsed, nil
+}
--- a/pkg/metrics/metrics.go
+++ b/pkg/metrics/metrics.go
@@ -0,0 +1,63 @@
+package metrics
+
+import (
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promauto"
+)
+
+var defaultMetrics *Metrics
+
+type Metrics struct {
+	clients prometheus.Gauge
+	subs    *prometheus.GaugeVec
+}
+
+func Enable() {
+	defaultMetrics = &Metrics{}
+	registerMetrics()
+}
+
+func registerMetrics() {
+	defaultMetrics.clients = promauto.NewGauge(
+		prometheus.GaugeOpts{
+			Name: "rango_hub_clients_count",
+			Help: "Number of clients currently connected",
+		},
+	)
+
+	defaultMetrics.subs = promauto.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Name: "rango_hub_subscriptions_count",
+			Help: "Number of user subscribed to a topic",
+		},
+		[]string{"type", "topic"},
+	)
+}
+
+func RecordHubClientNew() {
+	if defaultMetrics == nil {
+		return
+	}
+	defaultMetrics.clients.Inc()
+}
+
+func RecordHubClientClose() {
+	if defaultMetrics == nil {
+		return
+	}
+	defaultMetrics.clients.Dec()
+}
+
+func RecordHubSubscription(typ, topic string) {
+	if defaultMetrics == nil {
+		return
+	}
+	defaultMetrics.subs.WithLabelValues(typ, topic).Inc()
+}
+
+func RecordHubUnsubscription(typ, topic string) {
+	if defaultMetrics == nil {
+		return
+	}
+	defaultMetrics.subs.WithLabelValues(typ, topic).Dec()
+}
--- a/pkg/routing/client.go
+++ b/pkg/routing/client.go
@@ -0,0 +1,331 @@
+package routing
+
+import (
+	"bytes"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/gorilla/websocket"
+	msg "github.com/openware/rango/pkg/message"
+	"github.com/openware/rango/pkg/metrics"
+	"github.com/rs/zerolog/log"
+)
+
+const (
+	// Time allowed to write a message to the peer.
+	writeWait = 10 * time.Second
+
+	// Time allowed to read the next pong message from the peer.
+	pongWait = 60 * time.Second
+
+	// Send pings to peer with this period. Must be less than pongWait.
+	pingPeriod = (pongWait * 9) / 10
+
+	// Maximum message size allowed from peer.
+	maxMessageSize = 512
+)
+
+var (
+	newline = []byte{'\n'}
+	space   = []byte{' '}
+)
+
+var upgrader = websocket.Upgrader{
+	ReadBufferSize:  1024,
+	WriteBufferSize: 1024,
+	CheckOrigin:     checkSameOrigin(os.Getenv("API_CORS_ORIGINS")),
+}
+
+var maxBufferedMessages = 256
+
+type Auth struct {
+	UID  string
+	Role string
+}
+
+// FIXME: IClient looks very wrong.
+type IClient interface {
+	Send(string)
+	Close()
+	GetAuth() Auth
+	GetSubscriptions() []string
+	SubscribePublic(string)
+	SubscribePrivate(string)
+	UnsubscribePublic(string)
+	UnsubscribePrivate(string)
+}
+
+// Client is a middleman between the websocket connection and the hub.
+type Client struct {
+	hub *Hub
+
+	// User ID if authorized
+	Auth Auth
+
+	pubSub  []string
+	privSub []string
+
+	// The websocket connection.
+	conn *websocket.Conn
+
+	// Buffered channel of outbound messages.
+	send chan []byte
+}
+
+func checkSameOrigin(origins string) func(r *http.Request) bool {
+	if origins == "" {
+		return func(r *http.Request) bool {
+			origin := r.Header["Origin"]
+			if len(origin) == 0 {
+				return true
+			}
+			u, err := url.Parse(origin[0])
+			if err != nil {
+				return false
+			}
+			return strings.EqualFold(u.Host, r.Host)
+		}
+	}
+
+	hosts := []string{}
+
+	for _, o := range strings.Split(origins, ",") {
+		o = strings.TrimSpace(o)
+		if strings.HasPrefix(o, "http://") || strings.HasPrefix(o, "https://") {
+			u, err := url.Parse(o)
+			if err != nil || u.Host == "" {
+				panic("Failed to parse url in API_CORS_ORIGINS: " + o)
+			}
+			hosts = append(hosts, u.Host)
+		} else {
+			hosts = append(hosts, o)
+		}
+	}
+
+	return func(r *http.Request) bool {
+		origin := r.Header["Origin"]
+		if len(origin) == 0 {
+			return true
+		}
+		u, err := url.Parse(origin[0])
+		if err != nil {
+			return false
+		}
+
+		for _, host := range hosts {
+			if strings.EqualFold(u.Host, host) {
+				return true
+			}
+		}
+		return false
+	}
+}
+
+// NewClient handles websocket requests from the peer.
+func NewClient(hub *Hub, w http.ResponseWriter, r *http.Request) {
+	conn, err := upgrader.Upgrade(w, r, nil)
+	if err != nil {
+		log.Error().Msg("Websocket upgrade failed: " + err.Error())
+		return
+	}
+	client := &Client{
+		hub:  hub,
+		conn: conn,
+		send: make(chan []byte, maxBufferedMessages),
+		Auth: Auth{
+			UID:  r.Header.Get("JwtUID"),
+			Role: r.Header.Get("JwtRole"),
+		},
+		pubSub:  []string{},
+		privSub: []string{},
+	}
+
+	if client.Auth.UID == "" {
+		log.Info().Msgf("New anonymous connection")
+	} else {
+		log.Info().Msgf("New authenticated connection: %s", client.Auth.UID)
+	}
+
+	hub.handleSubscribe(&Request{
+		client: client,
+		Request: msg.Request{
+			Streams: parseStreamsFromURI(r.RequestURI),
+		},
+	})
+
+	metrics.RecordHubClientNew()
+
+	// Allow collection of memory referenced by the caller by doing all work in
+	// new goroutines.
+	go client.write()
+	go client.read()
+}
+
+func (c *Client) Send(s string) {
+	if len(c.send) == maxBufferedMessages {
+		log.Warn().Msg("Closing slow websocket connection")
+		c.conn.Close()
+	} else {
+		c.send <- []byte(s)
+	}
+}
+
+func (c *Client) Close() {
+	close(c.send)
+}
+
+func (c *Client) GetAuth() Auth {
+	return c.Auth
+}
+
+func (c *Client) GetSubscriptions() []string {
+	return append(c.pubSub, c.privSub...)
+}
+
+func (c *Client) SubscribePublic(s string) {
+	if !contains(c.pubSub, s) {
+		c.pubSub = append(c.pubSub, s)
+	}
+}
+
+func (c *Client) SubscribePrivate(s string) {
+	if !contains(c.privSub, s) {
+		c.privSub = append(c.privSub, s)
+	}
+}
+
+func (c *Client) UnsubscribePublic(s string) {
+	l := make([]string, len(c.pubSub)-1)
+	i := 0
+	for _, el := range c.pubSub {
+		if s != el {
+			l[i] = el
+			i++
+		}
+	}
+	c.pubSub = l
+}
+
+func (c *Client) UnsubscribePrivate(s string) {
+	l := make([]string, len(c.privSub)-1)
+	i := 0
+	for _, el := range c.privSub {
+		if s != el {
+			l[i] = el
+			i++
+		}
+	}
+	c.privSub = l
+}
+
+func parseStreamsFromURI(uri string) []string {
+	streams := make([]string, 0)
+	path := strings.Split(uri, "?")
+	if len(path) != 2 {
+		return streams
+	}
+	for _, up := range strings.Split(path[1], "&") {
+		p := strings.Split(up, "=")
+		if len(p) != 2 || p[0] != "stream" {
+			continue
+		}
+		streams = append(streams, strings.Split(p[1], ",")...)
+
+	}
+	return streams
+}
+
+// read pumps messages from the websocket connection to the hub.
+//
+// The application runs read in a per-connection goroutine. The application
+// ensures that there is at most one reader on a connection by executing all
+// reads from this goroutine.
+func (c *Client) read() {
+	defer func() {
+		log.Debug().Msgf("Closing client read (%s)", c.GetAuth().UID)
+		c.hub.Unregister <- c
+		metrics.RecordHubClientClose()
+		c.conn.Close()
+	}()
+
+	c.conn.SetReadLimit(maxMessageSize)
+	c.conn.SetReadDeadline(time.Now().Add(pongWait))
+	c.conn.SetPongHandler(func(string) error {
+		c.conn.SetReadDeadline(time.Now().Add(pongWait))
+		return nil
+	})
+
+	for {
+		_, message, err := c.conn.ReadMessage()
+		if err != nil {
+			if websocket.IsUnexpectedCloseError(err, websocket.CloseGoingAway, websocket.CloseAbnormalClosure) {
+				log.Info().Msgf("error: %v", err)
+			}
+			break
+		}
+		message = bytes.TrimSpace(bytes.Replace(message, newline, space, -1))
+		if len(message) == 0 {
+			continue
+		}
+		if isDebug() {
+			log.Debug().Msgf("Received message %s", message)
+		}
+
+		// handle ping
+		if string(message) == "ping" {
+			c.send <- []byte("pong")
+			continue
+		}
+
+		req, err := msg.ParseRequest(message)
+		if err != nil {
+			c.send <- []byte(responseMust(err, nil))
+			continue
+		}
+
+		c.hub.Requests <- Request{c, req}
+	}
+}
+
+// write pumps messages from the hub to the websocket connection.
+//
+// A goroutine running write is started for each connection. The
+// application ensures that there is at most one writer to a connection by
+// executing all writes from this goroutine.
+func (c *Client) write() {
+	ticker := time.NewTicker(pingPeriod)
+	defer func() {
+		log.Debug().Msgf("Closing client write (%s)", c.GetAuth().UID)
+		ticker.Stop()
+		c.conn.Close()
+	}()
+
+	for {
+		select {
+		case message, ok := <-c.send:
+			c.conn.SetWriteDeadline(time.Now().Add(writeWait))
+			if !ok {
+				// The hub closed the channel.
+				c.conn.WriteMessage(websocket.CloseMessage, []byte{})
+				return
+			}
+
+			w, err := c.conn.NextWriter(websocket.TextMessage)
+			if err != nil {
+				return
+			}
+			w.Write(message)
+			if err := w.Close(); err != nil {
+				return
+			}
+		case <-ticker.C:
+			c.conn.SetWriteDeadline(time.Now().Add(writeWait))
+			if err := c.conn.WriteMessage(websocket.PingMessage, nil); err != nil {
+				return
+			}
+		}
+	}
+}
--- a/pkg/routing/client_test.go
+++ b/pkg/routing/client_test.go
@@ -0,0 +1,139 @@
+package routing
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestClient(t *testing.T) {
+	hub := NewHub(nil)
+	client := &Client{
+		hub:     hub,
+		send:    make(chan []byte, 256),
+		Auth:    Auth{UID: "UIDABC001", Role: "admin"},
+		pubSub:  []string{},
+		privSub: []string{},
+	}
+
+	assert.Equal(t, "UIDABC001", client.GetAuth().UID)
+	assert.Equal(t, []string{}, client.GetSubscriptions())
+
+	client.SubscribePublic("a.x")
+	assert.Equal(t, []string{"a.x"}, client.GetSubscriptions())
+	assert.Equal(t, []string{"a.x"}, client.pubSub)
+	assert.Equal(t, []string{}, client.privSub)
+
+	client.SubscribePublic("a.y")
+	assert.Equal(t, []string{"a.x", "a.y"}, client.GetSubscriptions())
+	assert.Equal(t, []string{"a.x", "a.y"}, client.pubSub)
+	assert.Equal(t, []string{}, client.privSub)
+
+	client.UnsubscribePublic("a.y")
+	assert.Equal(t, []string{"a.x"}, client.GetSubscriptions())
+	assert.Equal(t, []string{"a.x"}, client.pubSub)
+	assert.Equal(t, []string{}, client.privSub)
+
+	client.SubscribePrivate("b")
+	assert.Equal(t, []string{"a.x", "b"}, client.GetSubscriptions())
+	assert.Equal(t, []string{"a.x"}, client.pubSub)
+	assert.Equal(t, []string{"b"}, client.privSub)
+
+	client.SubscribePrivate("c")
+	assert.Equal(t, []string{"a.x", "b", "c"}, client.GetSubscriptions())
+	assert.Equal(t, []string{"a.x"}, client.pubSub)
+	assert.Equal(t, []string{"b", "c"}, client.privSub)
+
+	client.UnsubscribePrivate("b")
+	assert.Equal(t, []string{"a.x", "c"}, client.GetSubscriptions())
+	assert.Equal(t, []string{"a.x"}, client.pubSub)
+	assert.Equal(t, []string{"c"}, client.privSub)
+
+	client.UnsubscribePrivate("c")
+	assert.Equal(t, []string{"a.x"}, client.GetSubscriptions())
+	assert.Equal(t, []string{"a.x"}, client.pubSub)
+	assert.Equal(t, []string{}, client.privSub)
+
+	client.UnsubscribePublic("a.x")
+	assert.Equal(t, []string{}, client.GetSubscriptions())
+	assert.Equal(t, []string{}, client.pubSub)
+	assert.Equal(t, []string{}, client.privSub)
+}
+
+func TestParseStreamsFromURI(t *testing.T) {
+	assert.Equal(t, []string{}, parseStreamsFromURI("/?"))
+	assert.Equal(t, []string{}, parseStreamsFromURI(""))
+	assert.Equal(t, []string{"aaa", "bbb"}, parseStreamsFromURI("/?stream=aaa&stream=bbb"))
+	assert.Equal(t, []string{"aaa", "bbb"}, parseStreamsFromURI("/?stream=aaa,bbb"))
+	assert.Equal(t, []string{"aaa", "bbb"}, parseStreamsFromURI("/public/?stream=aaa,bbb"))
+}
+
+func TestCheckSameOriginEmpty(t *testing.T) {
+	var checkSameOriginTests = []struct {
+		ok bool
+		r  *http.Request
+	}{
+		{false, &http.Request{Host: "example.org", Header: map[string][]string{"Origin": {"https://other.org"}}}},
+		{true, &http.Request{Host: "example.org", Header: map[string][]string{"Origin": {"https://example.org"}}}},
+		{true, &http.Request{Host: "Example.org", Header: map[string][]string{"Origin": {"https://example.org"}}}},
+	}
+
+	for _, tt := range checkSameOriginTests {
+		ok := checkSameOrigin("")(tt.r)
+		if tt.ok != ok {
+			t.Errorf("checkSameOrigin(%+v) returned %v, want %v", tt.r, ok, tt.ok)
+		}
+	}
+}
+
+func TestCheckSameOriginDomainsSetup(t *testing.T) {
+	var checkSameOriginTests = []struct {
+		ok bool
+		r  *http.Request
+	}{
+		{false, &http.Request{Host: "example.org", Header: map[string][]string{"Origin": {"https://other.org"}}}},
+		{true, &http.Request{Host: "whatever.org", Header: map[string][]string{"Origin": {"https://example.org"}}}},
+		{true, &http.Request{Host: "whatever.org", Header: map[string][]string{"Origin": {"https://Example.org"}}}},
+		{true, &http.Request{Host: "whatever.org", Header: map[string][]string{"Origin": {"https://example.com"}}}},
+		{true, &http.Request{Host: "whatever.org", Header: map[string][]string{"Origin": {"https://Example.com"}}}},
+		{true, &http.Request{Host: "whatever.org", Header: map[string][]string{"Origin": {}}}},
+	}
+
+	checker := checkSameOrigin("example.org,example.com")
+	for _, tt := range checkSameOriginTests {
+		ok := checker(tt.r)
+		if tt.ok != ok {
+			t.Errorf("checkSameOrigin(%+v) returned %v, want %v", tt.r, ok, tt.ok)
+		}
+	}
+
+	checker = checkSameOrigin("example.org, example.com")
+	for _, tt := range checkSameOriginTests {
+		ok := checker(tt.r)
+		if tt.ok != ok {
+			t.Errorf("checkSameOrigin(%+v) returned %v, want %v", tt.r, ok, tt.ok)
+		}
+	}
+
+	checker = checkSameOrigin("https://example.org,https://example.com")
+	for _, tt := range checkSameOriginTests {
+		ok := checker(tt.r)
+		if tt.ok != ok {
+			t.Errorf("checkSameOrigin(%+v) returned %v, want %v", tt.r, ok, tt.ok)
+		}
+	}
+
+	checker = checkSameOrigin("https://example.org, https://example.com")
+	for _, tt := range checkSameOriginTests {
+		ok := checker(tt.r)
+		if tt.ok != ok {
+			t.Errorf("checkSameOrigin(%+v) returned %v, want %v", tt.r, ok, tt.ok)
+		}
+	}
+}
+
+func TestCheckSameOriginBadConfiguration(t *testing.T) {
+	assert.Panics(t, func() { checkSameOrigin("https://ex ample.org") })
+	assert.Panics(t, func() { checkSameOrigin("https://ex:ample.org") })
+}
--- a/pkg/routing/hub.go
+++ b/pkg/routing/hub.go
@@ -0,0 +1,572 @@
+package routing
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"sync"
+
+	msg "github.com/openware/rango/pkg/message"
+	"github.com/openware/rango/pkg/metrics"
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+	"github.com/streadway/amqp"
+)
+
+type Request struct {
+	client IClient
+	msg.Request
+}
+
+// Hub maintains the set of active clients and broadcasts messages to the
+// clients.
+type Hub struct {
+	// Register Requests from the clients.
+	Requests chan Request
+
+	// Unregister requests from clients.
+	Unregister chan IClient
+
+	// List of clients registered to public topics
+	PublicTopics map[string]*Topic
+
+	// List of clients registered to private topics
+	PrivateTopics map[string]map[string]*Topic
+
+	// map[prefix -> map[topic -> *Topic]]
+	PrefixedTopics map[string]map[string]*Topic
+
+	// Storage for incremental objects
+	IncrementalObjects map[string]*IncrementalObject
+
+	// map[prefix -> allowed roles]
+	RBAC map[string][]string
+
+	mutex sync.Mutex
+}
+
+type Event struct {
+	Scope  string      // global, public, private
+	Stream string      // channel routing key
+	Type   string      // event type
+	Topic  string      // topic routing key (stream.type)
+	Body   interface{} // event json body
+}
+
+type IncrementalObject struct {
+	Snapshot   string
+	Increments []string
+}
+
+func NewHub(rbac map[string][]string) *Hub {
+	return &Hub{
+		Requests:           make(chan Request),
+		Unregister:         make(chan IClient),
+		PublicTopics:       make(map[string]*Topic, 100),
+		PrivateTopics:      make(map[string]map[string]*Topic, 1000),
+		PrefixedTopics:     make(map[string]map[string]*Topic, 100),
+		IncrementalObjects: make(map[string]*IncrementalObject, 5),
+		RBAC:               rbac,
+	}
+}
+
+func isIncrementObject(s string) bool {
+	return strings.HasSuffix(s, "-inc")
+}
+
+func isSnapshotObject(s string) bool {
+	return strings.HasSuffix(s, "-snap")
+}
+
+func isDebug() bool {
+	return log.Logger.GetLevel() <= zerolog.DebugLevel
+}
+
+func isTrace() bool {
+	return log.Logger.GetLevel() <= zerolog.TraceLevel
+}
+
+func getTopic(scope, stream, typ string) string {
+	if isSnapshotObject(typ) {
+		typ = strings.Replace(typ, "-snap", "-inc", 1)
+	}
+	if scope == "private" {
+		return typ
+	}
+	return stream + "." + typ
+}
+
+func (h *Hub) ListenWebsocketEvents() {
+	for {
+		select {
+		case req := <-h.Requests:
+			h.handleRequest(&req)
+
+		case client := <-h.Unregister:
+			log.Info().Msgf("Unregistering client (%s)", client.GetAuth().UID)
+			h.unsubscribeAll(client)
+			client.Close()
+		}
+	}
+}
+
+// ReceiveMsg handles AMQP messages
+func (h *Hub) ReceiveMsg(delivery amqp.Delivery) {
+	if isTrace() {
+		log.Trace().Msgf("AMQP msg received: %s -> %s", delivery.RoutingKey, delivery.Body)
+	}
+	s := strings.Split(delivery.RoutingKey, ".")
+
+	var o interface{}
+	err := json.Unmarshal(delivery.Body, &o)
+
+	if err != nil {
+		log.Error().Msgf("JSON parse error: %s, msg: %s", err.Error(), delivery.Body)
+		return
+	}
+
+	switch len(s) {
+	case 2:
+		msg := Event{
+			Scope:  s[0],
+			Stream: "",
+			Type:   s[1],
+			Topic:  getTopic(s[0], s[0], s[1]),
+			Body:   o,
+		}
+
+		h.routeMessage(&msg)
+
+	case 3:
+		msg := Event{
+			Scope:  s[0],
+			Stream: s[1],
+			Type:   s[2],
+			Topic:  getTopic(s[0], s[1], s[2]),
+			Body:   o,
+		}
+
+		h.routeMessage(&msg)
+
+	default:
+		log.Error().Msgf("Bad routing key: %s", delivery.RoutingKey)
+	}
+}
+
+func (h *Hub) SkipPrivateMsg(delivery amqp.Delivery) {
+	if strings.HasPrefix(delivery.RoutingKey, "private") {
+		return
+	}
+
+	h.ReceiveMsg(delivery)
+}
+
+func (h *Hub) handleSnapshot(msg *Event) (string, error) {
+	topic := msg.Stream + "." + msg.Type
+	body, err := json.Marshal(map[string]interface{}{
+		topic: msg.Body,
+	})
+
+	if err != nil {
+		return "", err
+	}
+
+	o, ok := h.IncrementalObjects[msg.Topic]
+	if !ok {
+		o = &IncrementalObject{}
+		h.IncrementalObjects[msg.Topic] = o
+	}
+	o.Snapshot = string(body)
+	o.Increments = []string{}
+
+	return string(body), nil
+}
+
+func (h *Hub) handleIncrement(msg *Event) (string, error) {
+	body, err := json.Marshal(map[string]interface{}{
+		msg.Topic: msg.Body,
+	})
+
+	if err != nil {
+		return "", err
+	}
+
+	o, ok := h.IncrementalObjects[msg.Topic]
+	if !ok {
+		return "", fmt.Errorf("No snapshot received before the increment for topic %s, ignoring", msg.Topic)
+	}
+	o.Increments = append(o.Increments, string(body))
+	return string(body), nil
+
+}
+
+func (h *Hub) handleMessage(topic *Topic, ok bool, msg *Event) {
+	switch {
+	case isIncrementObject(msg.Type):
+		rm, err := h.handleIncrement(msg)
+		if err != nil {
+			log.Error().Msgf("handleIncrement failed: %s", err.Error())
+			return
+		}
+		if ok {
+			topic.broadcastRaw(rm)
+		}
+
+	case isSnapshotObject(msg.Type):
+		_, err := h.handleSnapshot(msg)
+		if err != nil {
+			log.Error().Msgf("handleSnapshot failed: %s", err.Error())
+			return
+		}
+
+	default:
+		if ok {
+			topic.broadcast(msg)
+		}
+	}
+}
+
+func (h *Hub) routeMessage(msg *Event) {
+	if isTrace() {
+		log.Trace().Msgf("Routing message %v", msg)
+	}
+	h.mutex.Lock()
+	defer h.mutex.Unlock()
+
+	switch msg.Scope {
+	case "public", "global":
+		topic, ok := h.PublicTopics[msg.Topic]
+		h.handleMessage(topic, ok, msg)
+
+		if !ok {
+			if isTrace() {
+				log.Trace().Msgf("No public registration to %s", msg.Topic)
+				log.Trace().Msgf("Public topics: %v", h.PublicTopics)
+			}
+		}
+
+	case "private":
+		uid := msg.Stream
+		uTopic, ok := h.PrivateTopics[uid]
+		if ok {
+			topic, ok := uTopic[msg.Topic]
+			if ok {
+				topic.broadcast(msg)
+				break
+			}
+		}
+		if isTrace() {
+			log.Trace().Msgf("No private registration to %s", msg.Topic)
+			log.Trace().Msgf("Private topics: %v", h.PrivateTopics)
+		}
+
+	default:
+		scope, ok := h.PrefixedTopics[msg.Scope]
+		if !ok {
+			return
+		}
+
+		topic, ok := scope[msg.Topic]
+		if !ok {
+			return
+		}
+
+		topic.broadcast(msg)
+
+		log.Trace().Msgf("Broadcasted message scope %s", msg.Scope)
+	}
+
+}
+
+func (h *Hub) unsubscribeAll(client IClient) {
+	h.mutex.Lock()
+	defer h.mutex.Unlock()
+
+	for t, topic := range h.PublicTopics {
+		if topic.unsubscribe(client) {
+			metrics.RecordHubUnsubscription("public", t)
+		}
+		if topic.len() == 0 {
+			delete(h.PublicTopics, t)
+		}
+	}
+
+	for k, scope := range h.PrefixedTopics {
+		for t, topic := range scope {
+			if topic.unsubscribe(client) {
+				metrics.RecordHubUnsubscription("prefixed", t)
+			}
+
+			if topic.len() == 0 {
+				delete(scope, t)
+			}
+		}
+
+		if len(scope) == 0 {
+			delete(h.PrefixedTopics, k)
+		}
+	}
+
+	uid := client.GetAuth().UID
+	topics, ok := h.PrivateTopics[uid]
+	if !ok {
+		return
+	}
+
+	for t, topic := range topics {
+		if topic.unsubscribe(client) {
+			metrics.RecordHubUnsubscription("private", t)
+		}
+		if topic.len() == 0 {
+			delete(topics, t)
+		}
+	}
+
+	if len(topics) == 0 {
+		delete(h.PrivateTopics, uid)
+	}
+
+}
+
+func responseMust(e error, r interface{}) string {
+	res, err := msg.PackOutgoingResponse(e, r)
+	if err != nil {
+		log.Panic().Msg("responseMust failed:" + err.Error())
+		panic(err.Error())
+	}
+
+	return string(res)
+}
+
+func isPrivateStream(s string) bool {
+	return strings.Count(s, ".") == 0
+}
+func isPrefixedStream(s string) bool {
+	return strings.Count(s, ".") == 2
+}
+
+func (h *Hub) handleRequest(req *Request) {
+	switch req.Method {
+	case "subscribe":
+		h.handleSubscribe(req)
+	case "unsubscribe":
+		h.handleUnsubscribe(req)
+	default:
+		req.client.Send(responseMust(errors.New("unsupported method"), nil))
+	}
+}
+
+func (h *Hub) subscribePrivate(t string, req *Request) {
+	uid := req.client.GetAuth().UID
+	if uid == "" {
+		log.Error().Msgf("Anonymous user tried to subscribe to private stream %s", t)
+		return
+	}
+
+	uTopics, ok := h.PrivateTopics[uid]
+	if !ok {
+		uTopics = make(map[string]*Topic, 3)
+		h.PrivateTopics[uid] = uTopics
+	}
+
+	topic, ok := uTopics[t]
+	if !ok {
+		topic = NewTopic(h)
+		uTopics[t] = topic
+	}
+
+	if topic.subscribe(req.client) {
+		metrics.RecordHubSubscription("private", t)
+		req.client.SubscribePrivate(t)
+	}
+}
+
+func (h *Hub) subscribePublic(t string, req *Request) {
+	topic, ok := h.PublicTopics[t]
+	if !ok {
+		topic = NewTopic(h)
+		h.PublicTopics[t] = topic
+	}
+
+	// Replay snapshot and buffered increments before joining the topic, so live
+	// broadcasts cannot interleave ahead of the initial ob-snap on market switch.
+	if isIncrementObject(t) {
+		o, ok := h.IncrementalObjects[t]
+		if ok && o.Snapshot != "" {
+			req.client.Send(o.Snapshot)
+			for _, inc := range o.Increments {
+				req.client.Send(inc)
+			}
+		}
+	}
+
+	if topic.subscribe(req.client) {
+		metrics.RecordHubSubscription("public", t)
+		req.client.SubscribePublic(t)
+	}
+}
+
+func (h *Hub) premittedRBAC(prefix string, auth Auth) bool {
+	rbac := h.RBAC[prefix]
+
+	for _, role := range rbac {
+		if role == auth.Role {
+			return true
+		}
+	}
+
+	return false
+}
+
+func splitPrefixedTopic(prefixed string) (string, string) {
+	spl := strings.Split(prefixed, ".")
+	prefix := spl[0]
+	t := strings.TrimPrefix(prefixed, prefix+".")
+
+	return prefix, t
+}
+
+func (h *Hub) subscribePrefixed(prefixed string, req *Request) {
+	prefix, t := splitPrefixedTopic(prefixed)
+
+	if !h.premittedRBAC(prefix, req.client.GetAuth()) {
+		req.client.Send(responseMust(nil, map[string]interface{}{
+			"message": "cannot subscribe to " + prefixed,
+		}))
+
+		return
+	}
+
+	topics, ok := h.PrefixedTopics[prefix]
+	if !ok {
+		topics := make(map[string]*Topic, 0)
+		h.PrefixedTopics[prefix] = topics
+	}
+
+	topic, ok := topics[t]
+	if !ok {
+		topic = NewTopic(h)
+		h.PrefixedTopics[prefix][t] = topic
+	}
+
+	if isIncrementObject(t) {
+		o, ok := h.IncrementalObjects[t]
+		if ok && o.Snapshot != "" {
+			req.client.Send(o.Snapshot)
+			for _, inc := range o.Increments {
+				req.client.Send(inc)
+			}
+		}
+	}
+
+	if topic.subscribe(req.client) {
+		metrics.RecordHubSubscription("prefixed", prefixed)
+		req.client.SubscribePublic(prefixed)
+	}
+}
+
+func (h *Hub) handleSubscribe(req *Request) {
+	h.mutex.Lock()
+	defer h.mutex.Unlock()
+
+	for _, t := range req.Streams {
+		switch {
+		case isPrivateStream(t):
+			h.subscribePrivate(t, req)
+		case isPrefixedStream(t):
+			h.subscribePrefixed(t, req)
+		default:
+			h.subscribePublic(t, req)
+		}
+	}
+
+	req.client.Send(responseMust(nil, map[string]interface{}{
+		"message": "subscribed",
+		"streams": req.client.GetSubscriptions(),
+	}))
+}
+
+func (h *Hub) unsubscribePrivate(t string, req *Request) {
+	uid := req.client.GetAuth().UID
+	if uid == "" {
+		return
+	}
+	uTopics, ok := h.PrivateTopics[uid]
+	if !ok {
+		return
+	}
+
+	topic, ok := uTopics[t]
+	if ok {
+		if topic.unsubscribe(req.client) {
+			metrics.RecordHubUnsubscription("private", t)
+			req.client.UnsubscribePrivate(t)
+		}
+
+		if topic.len() == 0 {
+			delete(uTopics, t)
+		}
+	}
+
+	uTopics, ok = h.PrivateTopics[uid]
+	if ok && len(uTopics) == 0 {
+		delete(h.PrivateTopics, uid)
+	}
+}
+
+func (h *Hub) unsubscribePrefixed(prefixed string, req *Request) {
+	scope, t := splitPrefixedTopic(prefixed)
+	topics, ok := h.PrefixedTopics[scope]
+	if !ok {
+		return
+	}
+
+	topic, ok := topics[t]
+	if ok {
+		if topic.unsubscribe(req.client) {
+			metrics.RecordHubUnsubscription("prefixed", t)
+			req.client.UnsubscribePublic(t)
+		}
+
+		if topic.len() == 0 {
+			delete(topics, t)
+			h.PrefixedTopics[scope] = topics
+		}
+	}
+}
+
+func (h *Hub) unsubscribePublic(t string, req *Request) {
+	topic, ok := h.PublicTopics[t]
+	if ok {
+		if topic.unsubscribe(req.client) {
+			metrics.RecordHubUnsubscription("public", t)
+			req.client.UnsubscribePublic(t)
+		}
+
+		if topic.len() == 0 {
+			delete(h.PublicTopics, t)
+		}
+	}
+}
+
+func (h *Hub) handleUnsubscribe(req *Request) {
+	h.mutex.Lock()
+	defer h.mutex.Unlock()
+
+	for _, t := range req.Streams {
+		switch {
+		case isPrivateStream(t):
+			h.unsubscribePrivate(t, req)
+		case isPrefixedStream(t):
+			h.unsubscribePrefixed(t, req)
+		default:
+			h.unsubscribePublic(t, req)
+		}
+	}
+
+	req.client.Send(responseMust(nil, map[string]interface{}{
+		"message": "unsubscribed",
+		"streams": req.client.GetSubscriptions(),
+	}))
+}
--- a/pkg/routing/hub_test.go
+++ b/pkg/routing/hub_test.go
@@ -0,0 +1,355 @@
+package routing
+
+import (
+	"testing"
+
+	"github.com/openware/rango/pkg/message"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+type MockedClient struct {
+	mock.Mock
+}
+
+func (c *MockedClient) Send(m string) {
+	c.Called(m)
+}
+
+func (c *MockedClient) Close() {
+}
+
+func (c *MockedClient) GetAuth() Auth {
+	args := c.Called()
+	return args.Get(0).(Auth)
+}
+
+func (c *MockedClient) GetSubscriptions() []string {
+	args := c.Called()
+	return args.Get(0).([]string)
+}
+
+func (c *MockedClient) SubscribePublic(s string) {
+	c.Called(s)
+}
+
+func (c *MockedClient) SubscribePrivate(s string) {
+	c.Called(s)
+}
+
+func (c *MockedClient) UnsubscribePublic(s string) {
+	c.Called(s)
+}
+
+func (c *MockedClient) UnsubscribePrivate(s string) {
+	c.Called(s)
+}
+
+func setup(c *MockedClient, streams []string) *Hub {
+	h := NewHub(nil)
+	h.handleSubscribe(&Request{
+		client: c,
+		Request: message.Request{
+			Streams: streams,
+		},
+	})
+	return h
+}
+
+func teardown(h *Hub, c *MockedClient, streams []string) {
+	h.handleUnsubscribe(&Request{
+		client: c,
+		Request: message.Request{
+			Streams: streams,
+		},
+	})
+}
+
+func TestAnonymous(t *testing.T) {
+	t.Run("subscribe to a public single stream", func(t *testing.T) {
+		c := &MockedClient{}
+
+		streams := []string{
+			"eurusd.trades",
+		}
+
+		c.On("GetAuth").Return(Auth{})
+		c.On("GetSubscriptions").Return(streams).Once()
+		c.On("SubscribePublic", streams[0]).Return().Once()
+		c.On("Send", `{"success":{"message":"subscribed","streams":["`+streams[0]+`"]}}`).Return()
+
+		h := setup(c, streams)
+		assert.Equal(t, 1, len(h.PublicTopics))
+		assert.Equal(t, 0, len(h.PrivateTopics))
+
+		c.On("UnsubscribePublic", streams[0]).Return()
+		c.On("GetSubscriptions").Return([]string{}).Once()
+		c.On("Send", `{"success":{"message":"unsubscribed","streams":[]}}`).Return()
+
+		teardown(h, c, streams)
+		assert.Equal(t, 0, len(h.PublicTopics))
+		assert.Equal(t, 0, len(h.PrivateTopics))
+	})
+
+	t.Run("subscribe to multiple public streams", func(t *testing.T) {
+		c := &MockedClient{}
+		streams := []string{
+			"eurusd.trades",
+			"eurusd.updates",
+		}
+
+		c.On("GetAuth").Return(Auth{})
+		c.On("GetSubscriptions").Return(streams).Once()
+		c.On("SubscribePublic", "eurusd.trades").Return()
+		c.On("SubscribePublic", "eurusd.updates").Return()
+		c.On("Send", `{"success":{"message":"subscribed","streams":["eurusd.trades","eurusd.updates"]}}`).Return()
+
+		h := setup(c, []string{
+			"eurusd.trades",
+			"eurusd.updates",
+		})
+
+		assert.Equal(t, 2, len(h.PublicTopics))
+		assert.Equal(t, 0, len(h.PrivateTopics))
+
+		c.On("UnsubscribePublic", streams[0]).Return().Once()
+		c.On("UnsubscribePublic", streams[1]).Return().Once()
+		c.On("GetSubscriptions").Return([]string{}).Once()
+		c.On("Send", `{"success":{"message":"unsubscribed","streams":[]}}`).Return()
+
+		teardown(h, c, streams)
+		assert.Equal(t, 0, len(h.PublicTopics))
+		assert.Equal(t, 0, len(h.PrivateTopics))
+
+	})
+
+	t.Run("subscribe to a private single stream", func(t *testing.T) {
+		c := MockedClient{}
+
+		c.On("GetAuth").Return(Auth{})
+		c.On("GetSubscriptions").Return([]string{})
+		c.On("SubscribePrivate", "trades").Return()
+		c.On("Send", `{"success":{"message":"subscribed","streams":[]}}`).Return()
+
+		h := setup(&c, []string{
+			"trades",
+		})
+
+		assert.Equal(t, 0, len(h.PublicTopics))
+		assert.Equal(t, 0, len(h.PrivateTopics))
+	})
+}
+func TestAuthenticated(t *testing.T) {
+	t.Run("subscribe to a private single stream", func(t *testing.T) {
+		c := &MockedClient{}
+
+		c.On("GetAuth").Return(Auth{UID: "UIDABC00001"})
+		c.On("GetSubscriptions").Return([]string{"trades"}).Once()
+		c.On("SubscribePrivate", "trades").Return()
+		c.On("Send", `{"success":{"message":"subscribed","streams":["trades"]}}`).Return()
+
+		h := setup(c, []string{
+			"trades",
+		})
+		assert.Equal(t, 0, len(h.PublicTopics))
+		assert.Equal(t, 1, len(h.PrivateTopics))
+
+		c.On("UnsubscribePrivate", "trades").Return().Once()
+		c.On("GetSubscriptions").Return([]string{}).Once()
+		c.On("Send", `{"success":{"message":"unsubscribed","streams":[]}}`).Return()
+
+		teardown(h, c, []string{"trades"})
+		assert.Equal(t, 0, len(h.PublicTopics))
+		assert.Equal(t, 0, len(h.PrivateTopics))
+	})
+
+	t.Run("subscribe to multiple private streams", func(t *testing.T) {
+		c := &MockedClient{}
+
+		c.On("GetSubscriptions").Return([]string{"trades", "orders"}).Once()
+		c.On("GetAuth").Return(Auth{UID: "UIDABC00001"})
+		c.On("SubscribePrivate", "trades").Return()
+		c.On("SubscribePrivate", "orders").Return()
+		c.On("Send", `{"success":{"message":"subscribed","streams":["trades","orders"]}}`).Return()
+
+		h := setup(c, []string{"trades", "orders"})
+		assert.Equal(t, 0, len(h.PublicTopics))
+		assert.Equal(t, 1, len(h.PrivateTopics))
+
+		uTopics, ok := h.PrivateTopics["UIDABC00001"]
+		require.True(t, ok)
+		assert.Equal(t, 2, len(uTopics))
+
+		c.On("UnsubscribePrivate", "trades").Return().Once()
+		c.On("UnsubscribePrivate", "orders").Return().Once()
+		c.On("GetSubscriptions").Return([]string{}).Once()
+		c.On("Send", `{"success":{"message":"unsubscribed","streams":[]}}`).Return()
+
+		teardown(h, c, []string{"trades", "orders"})
+		assert.Equal(t, 0, len(h.PublicTopics))
+		assert.Equal(t, 0, len(h.PrivateTopics))
+
+	})
+
+	t.Run("subscribe to multiple private and public streams", func(t *testing.T) {
+		c := &MockedClient{}
+
+		c.On("GetSubscriptions").Return([]string{"trades", "orders", "eurusd.updates"}).Once()
+		c.On("GetAuth").Return(Auth{UID: "UIDABC00001"})
+		c.On("SubscribePrivate", "trades").Return()
+		c.On("SubscribePrivate", "orders").Return()
+		c.On("SubscribePublic", "eurusd.updates").Return()
+		c.On("Send", `{"success":{"message":"subscribed","streams":["trades","orders","eurusd.updates"]}}`).Return()
+
+		h := setup(c, []string{"trades", "orders", "eurusd.updates"})
+		assert.Equal(t, 1, len(h.PublicTopics))
+		assert.Equal(t, 1, len(h.PrivateTopics))
+
+		uTopics, ok := h.PrivateTopics["UIDABC00001"]
+		require.True(t, ok)
+		assert.Equal(t, 2, len(uTopics))
+
+		c.On("UnsubscribePrivate", "trades").Return().Once()
+		c.On("UnsubscribePrivate", "orders").Return().Once()
+		c.On("UnsubscribePublic", "eurusd.updates").Return().Once()
+		c.On("GetSubscriptions").Return([]string{}).Once()
+		c.On("Send", `{"success":{"message":"unsubscribed","streams":[]}}`).Return()
+
+		teardown(h, c, []string{"trades", "orders", "eurusd.updates"})
+		assert.Equal(t, 0, len(h.PublicTopics))
+		assert.Equal(t, 0, len(h.PrivateTopics))
+	})
+}
+
+func TestIsIncremental(t *testing.T) {
+	assert.True(t, isIncrementObject("public.eurusd.ob-inc"))
+	assert.False(t, isIncrementObject("public.eurusd.ob-snap"))
+	assert.False(t, isIncrementObject("public.eurusd.ob"))
+
+	assert.True(t, isSnapshotObject("public.eurusd.ob-snap"))
+	assert.False(t, isSnapshotObject("public.eurusd.ob-inc"))
+	assert.False(t, isSnapshotObject("public.eurusd.ob"))
+}
+
+func TestGetTopic(t *testing.T) {
+	assert.Equal(t, "abc.count", getTopic("public", "abc", "count"))
+	assert.Equal(t, "count", getTopic("private", "abc", "count"))
+	assert.Equal(t, "abc.count-inc", getTopic("public", "abc", "count-inc"))
+	assert.Equal(t, "abc.count-inc", getTopic("public", "abc", "count-snap"))
+}
+
+func TestHandleMessage(t *testing.T) {
+	h := NewHub(nil)
+	c := &MockedClient{}
+	c.On("SubscribePublic", "abc.ticker").Return()
+	c.On("Send", "{\"abc.ticker\":{\"some\":\"data\"}}").Return()
+
+	h.subscribePublic("abc.ticker", &Request{
+		client: c,
+	})
+
+	h.routeMessage(&Event{
+		Scope:  "public",
+		Stream: "abc",
+		Type:   "ticker",
+		Topic:  "abc.ticker",
+		Body: map[string]interface{}{
+			"some": "data",
+		},
+	})
+
+	c.AssertExpectations(t)
+}
+
+func TestIncrementalObjectStorage(t *testing.T) {
+	h := NewHub(nil)
+
+	// Increments before the first snapshot must be ignored
+	h.routeMessage(&Event{
+		Scope:  "public",
+		Stream: "abc",
+		Type:   "count-inc",
+		Topic:  "abc.count-inc",
+		Body: map[string]interface{}{
+			"data":     1,
+			"sequence": 11,
+		},
+	})
+
+	require.Equal(t, 0, len(h.IncrementalObjects))
+
+	// Initial snapshot
+	h.routeMessage(&Event{
+		Scope:  "public",
+		Stream: "abc",
+		Type:   "count-snap",
+		Topic:  "abc.count-inc",
+		Body: map[string]interface{}{
+			"data":     []int{2, 3, 4},
+			"sequence": 12,
+		},
+	})
+
+	require.Equal(t, 1, len(h.IncrementalObjects))
+
+	o, ok := h.IncrementalObjects["abc.count-inc"]
+	require.True(t, ok)
+	require.Equal(t, 0, len(o.Increments))
+	require.Equal(t, `{"abc.count-snap":{"data":[2,3,4],"sequence":12}}`, o.Snapshot)
+
+	// First Increment
+	h.routeMessage(&Event{
+		Scope:  "public",
+		Stream: "abc",
+		Type:   "count-inc",
+		Topic:  "abc.count-inc",
+		Body: map[string]interface{}{
+			"data":     5,
+			"sequence": 13,
+		},
+	})
+	require.Equal(t, 1, len(h.IncrementalObjects))
+	o, ok = h.IncrementalObjects["abc.count-inc"]
+	require.True(t, ok)
+	require.Equal(t, 1, len(o.Increments))
+	require.Equal(t, `{"abc.count-snap":{"data":[2,3,4],"sequence":12}}`, o.Snapshot)
+	require.Equal(t, `{"abc.count-inc":{"data":5,"sequence":13}}`, o.Increments[0])
+
+	// Second Increment
+	h.routeMessage(&Event{
+		Scope:  "public",
+		Stream: "abc",
+		Type:   "count-inc",
+		Topic:  "abc.count-inc",
+		Body: map[string]interface{}{
+			"data":     6,
+			"sequence": 14,
+		},
+	})
+	require.Equal(t, 1, len(h.IncrementalObjects))
+	o, ok = h.IncrementalObjects["abc.count-inc"]
+	require.True(t, ok)
+	require.Equal(t, 2, len(o.Increments))
+	require.Equal(t, `{"abc.count-snap":{"data":[2,3,4],"sequence":12}}`, o.Snapshot)
+	require.Equal(t, `{"abc.count-inc":{"data":5,"sequence":13}}`, o.Increments[0])
+	require.Equal(t, `{"abc.count-inc":{"data":6,"sequence":14}}`, o.Increments[1])
+
+	// Second snapshot
+	h.routeMessage(&Event{
+		Scope:  "public",
+		Stream: "abc",
+		Type:   "count-snap",
+		Topic:  "abc.count-inc",
+		Body: map[string]interface{}{
+			"data":     []int{2, 3, 4, 5, 6},
+			"sequence": 14,
+		},
+	})
+
+	require.Equal(t, 1, len(h.IncrementalObjects))
+	o, ok = h.IncrementalObjects["abc.count-inc"]
+	require.True(t, ok)
+	require.Equal(t, 0, len(o.Increments))
+	require.Equal(t, `{"abc.count-snap":{"data":[2,3,4,5,6],"sequence":14}}`, o.Snapshot)
+}
--- a/pkg/routing/topic.go
+++ b/pkg/routing/topic.go
@@ -0,0 +1,79 @@
+package routing
+
+import (
+	"encoding/json"
+
+	msg "github.com/openware/rango/pkg/message"
+	"github.com/rs/zerolog/log"
+)
+
+type Topic struct {
+	hub     *Hub
+	clients map[IClient]struct{}
+}
+
+func NewTopic(h *Hub) *Topic {
+	return &Topic{
+		clients: make(map[IClient]struct{}),
+		hub:     h,
+	}
+}
+
+func eventMust(method string, data interface{}) []byte {
+	ev, err := msg.PackOutgoingEvent(method, data)
+	if err != nil {
+		log.Panic().Msg(err.Error())
+	}
+
+	return ev
+}
+
+func contains(list []string, el string) bool {
+	for _, l := range list {
+		if l == el {
+			return true
+		}
+	}
+	return false
+}
+
+func (t *Topic) len() int {
+	return len(t.clients)
+}
+
+func (t *Topic) broadcast(message *Event) {
+	body, err := json.Marshal(map[string]interface{}{
+		message.Topic: message.Body,
+	})
+
+	if err != nil {
+		log.Error().Msgf("Fail to JSON marshal: %s", err.Error())
+		return
+	}
+
+	for client := range t.clients {
+		client.Send(string(body))
+	}
+}
+
+func (t *Topic) broadcastRaw(msgBody string) {
+	for client := range t.clients {
+		client.Send(msgBody)
+	}
+}
+
+func (t *Topic) subscribe(c IClient) bool {
+	if _, ok := t.clients[c]; ok {
+		return false
+	}
+	t.clients[c] = struct{}{}
+
+	return true
+}
+
+func (t *Topic) unsubscribe(c IClient) bool {
+	_, ok := t.clients[c]
+	delete(t.clients, c)
+
+	return ok
+}