Require RabbitMQ publisher confirms

[rolandbeisel]

Require RabbitMQ Publisher Confirms for Event Externalization

Summary

RabbitMQ outbox event externalization previously considered a publish successful as soon as
RabbitMessageOperations.convertAndSend(…) returned.

That call reports failures which can be detected synchronously, including failures to establish a broker connection,
authentication failures, connection or channel creation failures, and synchronous I/O failures during publishing.
However, a successful return does not confirm that RabbitMQ accepted the individual publish. For example, the
connection can fail immediately after the local write, or the broker can asynchronously reject the publish.

This change requires correlated RabbitMQ publisher confirms for outbox mode. RabbitMQ outbox externalization is now
only considered successful after a positive publisher confirm.

The default module-listener mode remains unchanged and does not require publisher confirms.

Changes

• Require the following configuration when RabbitMQ is used in outbox mode:

  spring.rabbitmq.publisher-confirm-type=correlated

• Fail application startup with a clear error when correlated publisher confirms are missing in RabbitMQ outbox mode.

• Create a unique CorrelationData instance for every RabbitMQ outbox publish.

• Pass the correlation data through AmqpHeaders.PUBLISH_CONFIRM_CORRELATION.

• Complete the outbox transport future only after receiving a positive publisher confirm.

• Complete the transport future exceptionally after receiving a publisher nack.

• Continue propagating synchronous failures from convertAndSend(…) as failed transport futures.

• Keep module-listener publishing fire-and-forget and independent of publisher-confirm configuration.

• Document the RabbitMQ outbox configuration requirement and delivery guarantee.

• Correct copied Kafka bean names in the RabbitMQ and Spring Messaging outbox configurations.

Failure Scenarios

Included

The following scenarios prevent RabbitMQ outbox externalization from being considered successful:

• The broker connection cannot be established.
• Authentication fails.
• Connection or channel creation fails.
• basicPublish(…) encounters a synchronous I/O failure.
• convertAndSend(…) otherwise fails synchronously.
• RabbitMQ negatively acknowledges the publish with a publisher nack.
• No positive publisher confirm has been received yet.

Synchronous failures are propagated through the transport's failed CompletableFuture. Publisher nacks also complete
the future exceptionally. Blocking outbox integrations receive those failures through externalizeBlocking(…), while
asynchronous callers can observe the returned future.

Not Included

This change intentionally does not cover:

• Unroutable messages. RabbitMQ can positively confirm a publish even when no queue receives it.
• Publisher returns.
• Mandatory publishing.
• Consumer processing, acknowledgements, or failures.
• End-to-end delivery to, or processing by, a consumer.
• An arbitrary publisher-confirm timeout.

Publisher returns and mandatory publishing are separate concerns from confirming that RabbitMQ accepted a publish and
remain outside the scope of this change.

Tests

Added or updated tests verify that:

• Missing correlated publisher confirms fail startup in outbox mode with a clear error.
• Module-listener mode starts without correlated publisher confirms.
• Module-listener publishing does not add publisher-confirm correlation data.
• Synchronous convertAndSend(…) failures produce failed transport futures.
• A positive publisher confirm completes outbox externalization successfully.
• A publisher nack completes outbox externalization exceptionally.
• Publisher nacks propagate through the JobRunr and Namastack outbox handlers.
• Every outbox publish receives a unique correlation ID.
• CorrelationData is passed through AmqpHeaders.PUBLISH_CONFIRM_CORRELATION.

Verification

• Focused RabbitMQ externalizer configuration tests: 16 tests passed.
• Full AMQP test suite: 17 tests passed, including module-listener publishing without publisher confirms.
• Events core and Namastack integration tests passed.
• AMQP reactor build verification passed.