feat: add client kind command matrix parity

src/NATS.Server/NatsClient.cs

@@ -29,6 +29,7 @@ public interface ISubListAccess
 
 public sealed class NatsClient : IDisposable
 {
+    private static readonly ClientCommandMatrix CommandMatrix = new();
     private readonly Socket _socket;
     private readonly Stream _stream;
     private readonly NatsOptions _options;
@@ -46,6 +47,7 @@ public sealed class NatsClient : IDisposable
     private readonly ServerStats _serverStats;
 
     public ulong Id { get; }
+    public ClientKind Kind { get; }
     public ClientOptions? ClientOpts { get; private set; }
     public IMessageRouter? Router { get; set; }
     public Account? Account { get; private set; }
@@ -103,9 +105,11 @@ public sealed class NatsClient : IDisposable
     public IReadOnlyDictionary<string, Subscription> Subscriptions => _subs;
 
     public NatsClient(ulong id, Stream stream, Socket socket, NatsOptions options, ServerInfo serverInfo,
-        AuthService authService, byte[]? nonce, ILogger logger, ServerStats serverStats)
+        AuthService authService, byte[]? nonce, ILogger logger, ServerStats serverStats,
+        ClientKind kind = ClientKind.Client)
     {
         Id = id;
+        Kind = kind;
         _socket = socket;
         _stream = stream;
         _options = options;
@@ -311,6 +315,13 @@ public sealed class NatsClient : IDisposable
     {
         Interlocked.Exchange(ref _lastActivityTicks, DateTime.UtcNow.Ticks);
 
+        if (!CommandMatrix.IsAllowed(Kind, cmd.Operation))
+        {
+            _logger.LogDebug("Command {Command} is not allowed for client kind {ClientKind}", cmd.Operation, Kind);
+            await SendErrAndCloseAsync("Parser Error");
+            return;
+        }
+
         // If auth is required and CONNECT hasn't been received yet,
         // only allow CONNECT and PING commands
         if (_authService.IsAuthRequired && !ConnectReceived)