novox/mesh-controller
3
0
Fork 0
Code Issues Pull Requests 1 Releases Wiki Activity

Only CONSUMER.INFO was missing from a machine's grants; the rest was already there

Browse Source
This commit is contained in:
jschoubben
2026-09-28 01:17:40 +02:00
parent aa2d0b51ea
commit 2c2eb51878
2 changed files with 7 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/broker/nats.go
+5 -6
View File
@@ -244,16 +244,15 @@ func PermissionsFor(p Principal) (Permissions, error) {
case KindNode:
// A host publishes its own node's control traffic and subscribes its own declaration —
// and nothing of any other node's.
// And what the host does with its consumer, nothing more: binding to it asks the server
// about it (CONSUMER.INFO) and hears the answer on its own inbox; hearing a declaration
// acknowledges it. Found the first time a machine dialled a permissioned server: refused
// for both, and "this node cannot read its declarations" (2026-09-28).
// And binding to its consumer, which asks the server about it (CONSUMER.INFO) — the one
// thing the host does that nothing granted. Found the first time a machine dialled a
// permissioned server: "this node cannot read its declarations" (2026-09-28). The ack and
// the inbox are granted below with every principal's.
pub = []string{
"mesh.control." + p.Node + ".>",
"$JS.API.CONSUMER.INFO.NODES." + p.Node,
"$JS.ACK.NODES." + p.Node + ".>",
}
sub = []string{"mesh.node." + p.Node + ".declare", p.inbox()}
sub = []string{"mesh.node." + p.Node + ".declare"}
case KindModule:
// 1. Its own namespace: it publishes its events there and serves its tools there. Nothing
internal/broker/testdata/composed.conf
Vendored
+2 -2
View File
@@ -32,8 +32,8 @@ accounts {
subscribe: { allow: ["_INBOX.enrol.one.>"] }
} }
{ user: "node.one", password: "$2a$11$nnnnnnnnnnnnnnnnnnnnnn", permissions: {
publish: { allow: ["$JS.ACK.NODES.one.>", "$JS.ACK.NODES.one.>", "$JS.API.CONSUMER.INFO.NODES.one", "mesh.control.one.>"] }
subscribe: { allow: ["_INBOX.node.one.>", "_INBOX.node.one.>", "mesh.node.one.declare"] }
publish: { allow: ["$JS.ACK.NODES.one.>", "$JS.API.CONSUMER.INFO.NODES.one", "mesh.control.one.>"] }
subscribe: { allow: ["_INBOX.node.one.>", "mesh.node.one.declare"] }
} }
{ user: "one.telegram", password: "$2a$11$tttttttttttttttttttttt", permissions: {
publish: { allow: ["$JS.ACK.EVENTS.one_telegram.>", "mesh.seat.telegram-sender.event.delivered", "mesh.seat.telegram-sender.event.failed"] }