From 48502c4ade288301998ca544df9635af5d510541 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Thu, 29 Oct 2026 21:56:08 +0100
Subject: [PATCH] nats: the tools read their credential from a word of their
 own, since the runtime strips MESH_BROKER_FILE (issue 1952 N1-N3)

---
 modules/nats/cmd/nats-tools/bus.go           | 8 ++++----
 modules/nats/cmd/nats-tools/manifest_test.go | 4 ++--
 modules/nats/cmd/nats-tools/removal.go       | 2 +-
 modules/nats/module.json                     | 3 ++-
 4 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/modules/nats/cmd/nats-tools/bus.go b/modules/nats/cmd/nats-tools/bus.go
index aba82e6b..ea37bc88 100644
--- a/modules/nats/cmd/nats-tools/bus.go
+++ b/modules/nats/cmd/nats-tools/bus.go
@@ -12,17 +12,17 @@ import (
 
 // LiveBus is the bus as the module's own credential reaches it. Nothing connects until a tool that changes the
 // bus is called, so the tools that read (through the monitoring endpoint) answer as they did with no credential.
-// MESH_BROKER_FILE names the credential (the process nats-tools's own secret `broker-nats-tools`); MESH_NATS_SERVER where the bus is as
+// NATS_TOOLS_CREDENTIAL names the credential (a word of the bundle's own: the runtime strips MESH_BROKER_FILE) (the process nats-tools's own secret `broker-nats-tools`); MESH_NATS_SERVER where the bus is as
 // seen from this machine (default: its own port on loopback).
 func LiveBus() Bus {
 	return func(ctx context.Context) (jetstream.JetStream, func(), error) {
-		file := env("MESH_BROKER_FILE", "")
+		file := env("NATS_TOOLS_CREDENTIAL", "")
 		if file == "" {
-			return nil, nil, errors.New("MESH_BROKER_FILE is not set, so this tool has no credential to reach the bus with (the module's manifest sets it)")
+			return nil, nil, errors.New("NATS_TOOLS_CREDENTIAL is not set, so this tool has no credential to reach the bus with (the module's manifest sets it)")
 		}
 		c, err := busconn.Read(file)
 		if err != nil {
-			return nil, nil, err
+			return nil, nil, fmt.Errorf("the credential at %s (NATS_TOOLS_CREDENTIAL) cannot be read: %w", file, err)
 		}
 		nc, err := busconn.Connect(env("MESH_NATS_SERVER", "tls://127.0.0.1:4222"), c, "nats-tools")
 		if err != nil {
diff --git a/modules/nats/cmd/nats-tools/manifest_test.go b/modules/nats/cmd/nats-tools/manifest_test.go
index 37320afe..2ff0750d 100644
--- a/modules/nats/cmd/nats-tools/manifest_test.go
+++ b/modules/nats/cmd/nats-tools/manifest_test.go
@@ -123,8 +123,8 @@ func TestTheBussManifestMountsItsProgramsIntoTheUpstreamImage(t *testing.T) {
 		}
 	}
 	for _, a := range m.Build.Artifacts {
-		if a.Name == "tools" && a.Env["MESH_BROKER_FILE"] != "" {
-			t.Errorf("the tools set their own credential %q: the runtime gives the process nats-tools its secret broker-nats-tools (ADR 0192)", a.Env["MESH_BROKER_FILE"])
+		if a.Name == "tools" && a.Env["NATS_TOOLS_CREDENTIAL"] != "${dir:mesh-state}/broker-nats-tools" {
+			t.Errorf("the tools' credential is %q: the process nats-tools' own secret broker-nats-tools, under a word of the bundle's own (the runtime strips MESH_BROKER_FILE)", a.Env["NATS_TOOLS_CREDENTIAL"])
 		}
 	}
 	args, _ := server["args"].([]any)
diff --git a/modules/nats/cmd/nats-tools/removal.go b/modules/nats/cmd/nats-tools/removal.go
index 633afccd..3aff66e5 100644
--- a/modules/nats/cmd/nats-tools/removal.go
+++ b/modules/nats/cmd/nats-tools/removal.go
@@ -5,7 +5,7 @@ package main
 // here reads.
 //
 // **Narrow by what the tool needs, and narrower by what the bus grants.** The tools reach the bus on the
-// credential the module's manifest names (MESH_BROKER_FILE); the bus refuses whatever that credential is not
+// credential the module's manifest names (NATS_TOOLS_CREDENTIAL); the bus refuses whatever that credential is not
 // granted, so a wrong stream, consumer or bucket is refused by the server and said here, not trusted to the
 // arguments. Each tool refuses without `why`, reads what it would remove first (and says it, so a person can ask
 // with dry_run and then for real), removes, reads that it is gone, and says what it did as an event of the module
diff --git a/modules/nats/module.json b/modules/nats/module.json
index 75ee79e3..eeee7924 100644
--- a/modules/nats/module.json
+++ b/modules/nats/module.json
@@ -201,7 +201,8 @@
           "MESH_NATS_MONITOR": "http://127.0.0.1:8222",
           "MESH_NATS_CONTAINER": "mesh-broker-nats",
           "MESH_NATS_USERS_FILE": "/etc/nats/accounts.conf",
-          "MESH_NATS_SNAPSHOTS_DIR": "${dir:snapshots}"
+          "MESH_NATS_SNAPSHOTS_DIR": "${dir:snapshots}",
+          "NATS_TOOLS_CREDENTIAL": "${dir:mesh-state}/broker-nats-tools"
         }
       },
       {