Let gitea's forge-account provider read the assignments it learns its consumers from (issue 955)

modules/gitea/cmd/forge-account-provider/main_test.go

@@ -1,6 +1,9 @@
 package main
 
 import (
+	"encoding/json"
+	"os"
+	"slices"
 	"strings"
 	"testing"
 )
@@ -20,3 +23,24 @@ func TestConfigFromEnvNamesWhatIsMissing(t *testing.T) {
 		t.Fatalf("%v", err)
 	}
 }
+
+// Issue 955: the runtime grants a module only the states its manifest `reads`, and the provider watches the machines'
+// keys and, through the SDK's provider, the controller's assignments (where it learns its consumers). Run as the
+// bus test does, with every bucket made, a missing grant passes unseen; the manifest is read here instead.
+func TestTheManifestReadsEveryStateTheProviderWatches(t *testing.T) {
+	raw, err := os.ReadFile("../../module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m struct {
+		Reads []string `json:"reads"`
+	}
+	if err := json.Unmarshal(raw, &m); err != nil {
+		t.Fatal(err)
+	}
+	for _, state := range []string{"mesh-controller.assignments", "ssh-client.keys"} {
+		if !slices.Contains(m.Reads, state) {
+			t.Errorf("gitea's reads %v lack %q, so the runtime refuses its watch", m.Reads, state)
+		}
+	}
+}