I'm not sure if the words 'allowed' and 'permissions' are the right terminology here. Perhaps the config could look more like:

[filters]
methods = maven,runroot,distRepo
states = FAILED,CANCELED

Also, probably need to be more friendly and accept , and or as a separator in the config

For the if allowed_methods == '*' check. I wonder if we shouldn't just use multi_fnmatch.

The disallowed_methods global seems like it is supposed to be complementary to the allowed_methods one, but it isn't configurable like the other.

I think we might want to hard-code the exclusion of taskNotification. Also tagNotification and buildNotification.

I don't know if we need that sanity check for the existence of the task. We're handling callback -- I think we can trust the data.

For recipients, we should probably exclude hosts and disabled users.

We can pick this up again for 1.17

updated

I would add here, that defining disallowed_methods never override *Notification - it will be added anyway.

Can you create some global CONFIG outside of this function? Every call to this function will open/parse that file, which is not effective, neither expected (I would expect, that any change to any config will be reflected only after kojid restart)

Some simple description should be also added to docs/source/plugins.rst