Carry a value into the vault sealed to its call, and prove both paths of the switch (issue 675)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/link/seat_as_test.go

@@ -0,0 +1,47 @@
+package link
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/testbus"
+)
+
+// A mesh seat's verb asked in the caller's own name goes on the subject that names its caller (novox/hq issue
+// 365), so the holder knows who asks from the subject alone: how the vault takes a value from the controller
+// and nobody else (design 57's V2, issue 675).
+func TestAMeshSeatsVerbIsAskedInTheCallersOwnName(t *testing.T) {
+	conn, err := nats.Connect(testbus.URL(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	heard := make(chan string, 1)
+	sub, err := conn.Subscribe(broker.CalledPattern(SeatToolSubject("mesh-vault", "accept")), func(m *nats.Msg) {
+		heard <- m.Subject
+		raw, _ := json.Marshal(Answer{Result: json.RawMessage(`{"call":"c1"}`)})
+		_ = m.Respond(raw)
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer sub.Unsubscribe()
+	answer, err := AskMeshSeatToolAs(context.Background(), conn, broker.ControllerName, "mesh-vault", "accept",
+		map[string]any{"provider": "novox", "provision": "postgres"}, 5*time.Second)
+	if err != nil || string(answer.Result) != `{"call":"c1"}` {
+		t.Fatalf("%+v %v", answer, err)
+	}
+	subject := <-heard
+	if subject != "mesh.seat.mesh-vault.call.accept.controller" || !strings.HasSuffix(subject, "."+broker.ControllerName) {
+		t.Errorf("asked on %s", subject)
+	}
+	if _, err := AskMeshSeatToolAs(context.Background(), conn, "not a user!", "mesh-vault", "accept", nil, time.Second); err == nil {
+		t.Error("a caller that is no bus user was asked in")
+	}
+}