---
title: "1.28.2 — Opt-in realtime group-topic permissions"
description: "Adds optional permission checks for realtime group subscriptions and message delivery, including revocation checks on existing connections."
date: "2026-09-16"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-28-2/"
---

Adds optional permission checks for realtime group subscriptions and message delivery, including revocation checks on existing connections.

### Added

- Add the file-static `REALTIME_GROUP_TOPIC_PERMISSIONS` setting for `group:<id>` topics. A nonempty list or tuple grants access when an active account User has any configured permission on an active group with active ancestors, using the existing group permission rules.

### Security

- Enforce the configured policy for client, automatic, and hook-returned subscriptions; custom hooks cannot bypass it.
- Recheck current User and group permissions from the primary database before every protected delivery. Revoked access or authorization errors drop the message and unsubscribe that topic.
- Deny protected group access for empty or malformed configuration, invalid group topic IDs, and non-User bearer identities.

### Upgrade notes

- Unset or `None` preserves existing behavior; no application changes are required unless enabling the policy.
- Upgrade to a framework version supporting this setting before enabling an application's policy. Older versions ignore the setting and do not enforce it.
- After access is restored, clients must subscribe again; dropped messages are not replayed.