# AclFilter

**Kind:** Interface

**Source:** [`packages/microservices/external/kafka.interface.ts`](https://github.com/nestjs/nest/blob/master/packages/microservices/external/kafka.interface.ts#L469)

**Part of:** [Microservices](subsystem-packages-microservices)

`AclFilter` defines criteria for selecting Kafka ACL entries when querying, deleting, or managing permissions. It combines resource, principal, host, operation, and permission attributes to describe the ACL records that should match within the Kafka integration layer.

## Properties

| Property | Type |
|---|---|
| `resourceType` | `AclResourceTypes` |
| `resourceName` | `string` |
| `resourcePatternType` | `ResourcePatternTypes` |
| `principal` | `string` |
| `host` | `string` |
| `operation` | `AclOperationTypes` |
| `permissionType` | `AclPermissionTypes` |

## Diagram

```mermaid
graph LR
  A[AclFilter] --> B[resourceType: AclResourceTypes]
  A --> C[resourceName: string]
  A --> D[resourcePatternType: ResourcePatternTypes]
  A --> E[principal: string]
  A --> F[host: string]
  A --> G[operation: AclOperationTypes]
  A --> H[permissionType: AclPermissionTypes]

  B --> I[Kafka Resource]
  E --> J[Kafka Principal]
  G --> K[Allowed Operation]
  H --> L[Permission Rule]
```

## Usage

```ts
import {
  AclFilter,
  AclOperationTypes,
  AclPermissionTypes,
  AclResourceTypes,
  ResourcePatternTypes,
} from '@nestjs/microservices';

const topicReadFilter: AclFilter = {
  resourceType: AclResourceTypes.TOPIC,
  resourceName: 'orders',
  resourcePatternType: ResourcePatternTypes.LITERAL,
  principal: 'User:order-service',
  host: '*',
  operation: AclOperationTypes.READ,
  permissionType: AclPermissionTypes.ALLOW,
};

// Pass the filter to the Kafka admin client when listing or deleting ACLs.
const matchingAcls = await kafkaAdmin.describeAcls(topicReadFilter);
```

## AI Coding Instructions

- Use the Kafka enum values for `resourceType`, `resourcePatternType`, `operation`, and `permissionType`; do not use arbitrary strings.
- Set `resourceName` and `principal` to the exact Kafka resource and principal identifiers expected by the broker.
- Use `host: '*'` when the ACL should apply from any client host; use a specific host only when network restrictions are required.
- Ensure `resourcePatternType` matches the intended resource matching behavior, such as literal versus prefixed topic names.
- Reuse the same `AclFilter` shape for ACL lookup and deletion operations so the targeted permissions remain consistent.