novox/mesh-catalog
18
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Prove the bus tools' removals on the grant mesh-sdk composes

Browse Source 
The removal test took a grant written by hand; it now composes it with
BusRemovalGrants for controller-leftovers and the node-engine's acts, so
it proves the mesh's own grant is enough and no wider (issue 1126 B5).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
This commit is contained in:
jschoubben
2026-11-02 12:29:56 +01:00
parent f8e4c1b0ae
commit e7b3fd470b
1 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/nats/cmd/nats-tools/removal_test.go
+12 -12
View File
@@ -12,6 +12,8 @@ import (
"testing"
"time"
"git.novox.be/novox/mesh-sdk/go/buscompose"
"git.novox.be/novox/mesh-sdk/go/catalogue"
"github.com/nats-io/nats-server/v2/server"
"github.com/nats-io/nats.go"
"github.com/nats-io/nats.go/jetstream"
@@ -25,25 +27,23 @@ import (
func TestTheRemovalToolsChangeOnlyWhatTheyAreAskedAndTheGrantAllows(t *testing.T) {
dir := t.TempDir()
conf := filepath.Join(dir, "nats.conf")
// Issue 1126 B5: the tools' grant as the mesh composes it for this module's word (mesh-sdk BusRemovalGrants), never
// a list written here, so the test proves the composed grant is enough and no wider.
grants, err := buscompose.BusRemovalGrants([]string{catalogue.RemovesControllerLeftovers, catalogue.RemovesEngineActs},
[]string{"novox"})
if err != nil {
t.Fatal(err)
}
allow := `["` + strings.Join(grants, `", "`) + `"]`
if err := os.WriteFile(conf, []byte(fmt.Sprintf(`listen: "127.0.0.1:-1"
jetstream { store_dir: %q }
accounts { MESH { jetstream: enabled, users: [
{ user: "admin", password: "admin" },
{ user: "nats-tools", password: "tools", permissions: {
publish: { allow: [
"$JS.API.CONSUMER.INFO.DEAD_LETTER_NOTICES.controller",
"$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES.controller",
"$JS.API.STREAM.INFO.ASSIGNMENTS",
"$JS.API.STREAM.DELETE.ASSIGNMENTS",
"$JS.API.CONSUMER.INFO.EVENTS.controller-merges",
"$JS.API.CONSUMER.DELETE.EVENTS.controller-merges",
"$JS.API.STREAM.INFO.KV_mesh-controller_rollouts",
"$JS.API.STREAM.DELETE.KV_mesh-controller_rollouts",
"$JS.API.STREAM.INFO.KV_mesh-host_acts",
"$KV.mesh-host_acts.>" ] },
publish: { allow: %s },
subscribe: { allow: ["_INBOX.nats-tools.>"] } } }
] } }
`, filepath.Join(dir, "js"))), 0o600); err != nil {
`, filepath.Join(dir, "js"), allow)), 0o600); err != nil {
t.Fatal(err)
}
opts, err := server.ProcessConfigFile(conf)