nats: the tools read their credential from a word of their own, since the runtime strips MESH_BROKER_FILE (issue 1952 N1-N3)

modules/nats/cmd/nats-tools/bus.go

@@ -12,17 +12,17 @@ import (
 
 // LiveBus is the bus as the module's own credential reaches it. Nothing connects until a tool that changes the
 // bus is called, so the tools that read (through the monitoring endpoint) answer as they did with no credential.
-// MESH_BROKER_FILE names the credential (the process nats-tools's own secret `broker-nats-tools`); MESH_NATS_SERVER where the bus is as
+// NATS_TOOLS_CREDENTIAL names the credential (a word of the bundle's own: the runtime strips MESH_BROKER_FILE) (the process nats-tools's own secret `broker-nats-tools`); MESH_NATS_SERVER where the bus is as
 // seen from this machine (default: its own port on loopback).
 func LiveBus() Bus {
 	return func(ctx context.Context) (jetstream.JetStream, func(), error) {
-		file := env("MESH_BROKER_FILE", "")
+		file := env("NATS_TOOLS_CREDENTIAL", "")
 		if file == "" {
-			return nil, nil, errors.New("MESH_BROKER_FILE is not set, so this tool has no credential to reach the bus with (the module's manifest sets it)")
+			return nil, nil, errors.New("NATS_TOOLS_CREDENTIAL is not set, so this tool has no credential to reach the bus with (the module's manifest sets it)")
 		}
 		c, err := busconn.Read(file)
 		if err != nil {
-			return nil, nil, err
+			return nil, nil, fmt.Errorf("the credential at %s (NATS_TOOLS_CREDENTIAL) cannot be read: %w", file, err)
 		}
 		nc, err := busconn.Connect(env("MESH_NATS_SERVER", "tls://127.0.0.1:4222"), c, "nats-tools")
 		if err != nil {

modules/nats/cmd/nats-tools/manifest_test.go

@@ -123,8 +123,8 @@ func TestTheBussManifestMountsItsProgramsIntoTheUpstreamImage(t *testing.T) {
 		}
 	}
 	for _, a := range m.Build.Artifacts {
-		if a.Name == "tools" && a.Env["MESH_BROKER_FILE"] != "" {
-			t.Errorf("the tools set their own credential %q: the runtime gives the process nats-tools its secret broker-nats-tools (ADR 0192)", a.Env["MESH_BROKER_FILE"])
+		if a.Name == "tools" && a.Env["NATS_TOOLS_CREDENTIAL"] != "${dir:mesh-state}/broker-nats-tools" {
+			t.Errorf("the tools' credential is %q: the process nats-tools' own secret broker-nats-tools, under a word of the bundle's own (the runtime strips MESH_BROKER_FILE)", a.Env["NATS_TOOLS_CREDENTIAL"])
 		}
 	}
 	args, _ := server["args"].([]any)

modules/nats/cmd/nats-tools/removal.go

@@ -5,7 +5,7 @@ package main
 // here reads.
 //
 // **Narrow by what the tool needs, and narrower by what the bus grants.** The tools reach the bus on the
-// credential the module's manifest names (MESH_BROKER_FILE); the bus refuses whatever that credential is not
+// credential the module's manifest names (NATS_TOOLS_CREDENTIAL); the bus refuses whatever that credential is not
 // granted, so a wrong stream, consumer or bucket is refused by the server and said here, not trusted to the
 // arguments. Each tool refuses without `why`, reads what it would remove first (and says it, so a person can ask
 // with dry_run and then for real), removes, reads that it is gone, and says what it did as an event of the module

modules/nats/module.json

@@ -201,7 +201,8 @@
           "MESH_NATS_MONITOR": "http://127.0.0.1:8222",
           "MESH_NATS_CONTAINER": "mesh-broker-nats",
           "MESH_NATS_USERS_FILE": "/etc/nats/accounts.conf",
-          "MESH_NATS_SNAPSHOTS_DIR": "${dir:snapshots}"
+          "MESH_NATS_SNAPSHOTS_DIR": "${dir:snapshots}",
+          "NATS_TOOLS_CREDENTIAL": "${dir:mesh-state}/broker-nats-tools"
         }
       },
       {