From d01839c29c3710a69fb32d69f7f6c250266ff0a5 Mon Sep 17 00:00:00 2001 From: jochen Date: Sun, 25 Oct 2026 22:51:25 +0100 Subject: [PATCH] =?UTF-8?q?Grant=20the=20grants=20part=20reading=20every?= =?UTF-8?q?=20membership;=20seal=20the=20seeded=20account=20in=20the=20add?= =?UTF-8?q?resses=20test=20(ADR=200547=20=C2=A75,=20review;=20issue=201945?= =?UTF-8?q?)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The grants part reads each module's last membership before it publishes, so it is granted the direct get on every membership subject beside the publish (review of mesh-grants, B1). The test TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker failed on main since PR #467: it seeds anchor.mesh-controller with no seal, and an account counts as issued only once sealed (ADR 0543 §2). The rule is right; the fixture is fixed, sealing the seeded credential the controller already uses. Test only. --- cmd/mesh-controller/addresses_integration_test.go | 5 +++++ internal/broker/membership_test.go | 2 ++ internal/broker/nats.go | 5 +++-- 3 files changed, 10 insertions(+), 2 deletions(-) diff --git a/cmd/mesh-controller/addresses_integration_test.go b/cmd/mesh-controller/addresses_integration_test.go index 363f05e1..1420e0f6 100644 --- a/cmd/mesh-controller/addresses_integration_test.go +++ b/cmd/mesh-controller/addresses_integration_test.go @@ -111,6 +111,11 @@ func TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker(t *testing.T) Kind: inventory.BusController, Node: "anchor", Module: "mesh-controller"}, "bootstrap"); err != nil { t.Fatal(err) } + // Seeded with the credential the controller already uses, so it is sealed: an account counts as issued only once + // sealed (ADR 0543 §2, PR #467), and genesis's seed is the credential in use. + if err := open.inventory.MarkBusAccountSealed(ctx, "anchor.mesh-controller"); err != nil { + t.Fatal(err) + } if _, err := assign(ctx, open, "anchor", "mesh-controller"); err != nil { t.Fatal(err) } diff --git a/internal/broker/membership_test.go b/internal/broker/membership_test.go index 8f8e8493..a837340c 100644 --- a/internal/broker/membership_test.go +++ b/internal/broker/membership_test.go @@ -79,6 +79,8 @@ func TestAnAccountMayReadItsOwnMembershipAndNoOthers(t *testing.T) { t.Fatal(err) } has(t, grants.Publish, "mesh.assignment.*.*") + has(t, grants.Publish, "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.*.*") + hasNot(t, perms.Publish, "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.*.*") hasNot(t, grants.Publish, "$JS.API.STREAM.CREATE.>") hasNot(t, grants.Publish, "mesh.assignment.>") } diff --git a/internal/broker/nats.go b/internal/broker/nats.go index 6230f12d..8d51e7c3 100644 --- a/internal/broker/nats.go +++ b/internal/broker/nats.go @@ -916,9 +916,10 @@ func PermissionsFor(p Principal) (Permissions, error) { pub = append(pub, BusConnzSubject) } // The grants part alone publishes the modules' memberships into the assignments stream (novox/hq ADR 0547 §5; - // the operator, 2026-10-25 22:31): one per subject, `mesh.assignment..`, and no stream it defines. + // the operator, 2026-10-25 22:31): one per subject, `mesh.assignment..`, reading the last one of each + // first so it publishes only what changed, and no stream it defines. if p.Module == GrantsModule { - pub = append(pub, "mesh.assignment.*.*") + pub = append(pub, "mesh.assignment.*.*", "$JS.API.DIRECT.GET."+AssignmentsStream+".mesh.assignment.*.*") } // The view alone reads the build seats' workers for the backlog of asks (issue 1887 A8a). if p.Module == ViewModule {