iii-worker-manager

The iii-worker-manager is a mandatory engine worker that opens WebSocket listeners. The base engine.workers.iii-worker-manager entry sets the main port (49134 by default); #instance entries open separate listeners with their own RBAC, middleware, and registration hooks. Channels are mounted on every listener at /ws/channels/{channel_id}.

When to Use

• Exposing the engine to an untrusted network, RBAC is mandatory, never open the engine port itself. Use the standalone rbac-proxy worker (iii trigger compose::add worker=rbac-proxy), which applies these RBAC rules on its own port out of process. A second #instance listener with an rbac block and an auth_function_id is the in-engine alternative.
• Restricting which functions a connected worker can invoke, combine expose_functions filters (operator-side) with forbidden_functions from AuthResult (per-session, hard deny).
• Auditing, rate-limiting, or enriching every invocation, set middleware_function_id on the listener; the middleware decides whether to call the target and what to return.
• Per-tenant or per-session namespace isolation, return function_registration_prefix from the auth function so every function/trigger this session registers is transparently prefixed without the worker code knowing.
• Gating dynamic registration, wire on_function_registration_function_id, on_trigger_registration_function_id, or on_trigger_type_registration_function_id to validate or rewrite registrations.

Boundaries