novox/mesh-delivery
19
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

DLV-G2: a row that no tool runner, no tools bundle of the bus module and no account invoking every tool holds the bus's create, update, snapshot or delete subjects of a module's bus state (ADR 0626 §4, How it is checked)

Browse Source 
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
This commit is contained in:
jschoubben
2026-11-04 12:50:18 +01:00
parent cb1cf7fd73
commit 20a4a79993
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/mesh-grants/internal/buscompose/buscompose_test.go
+8 -2
View File
@@ -1096,14 +1096,20 @@ func theBusModulesProcessKeepsBusState(t *testing.T) {
perms[u.Username()] = p
}
keeper := perms["a.nats.keeper"]
for _, u := range []string{"a.nats.keeper", "a.nats.other", "a.mod-x.sneak", "a.node-tools", "a.nats.nats-tools", "a.admin-ish"} {
if _, ok := perms[u]; !ok {
t.Fatalf("no user %s composed: %v", u, slices.Collect(maps.Keys(perms)))
}
}
for _, s := range []string{"KV_mod-x_records", "mod-x_audit", "mod-x_audit_snapshot", "KV_mod-x_audit_state",
"KV_mod-x_audit_index-by-status", "OBJ_mod-x_parts", "KV_gone_kept"} {
for _, op := range []string{"CREATE", "UPDATE", "DELETE", "SNAPSHOT"} {
if !MayPublish(keeper, "$JS.API.STREAM."+op+"."+s) {
t.Errorf("the bus module's process may not %s %s", op, s)
}
// Only the process whose bus declares `keeps`, and only on the module holding mesh-broker (ADR 0626 §1, §3).
for _, other := range []string{"a.nats.other", "a.mod-x.sneak"} {
// Only the process whose bus declares `keeps`, and only on the module holding mesh-broker (ADR 0626 §1, §3): no
// tool runner, and not the bus module's own tools (ADR 0626 §4), however wide their grant.
for _, other := range []string{"a.nats.other", "a.mod-x.sneak", "a.node-tools", "a.nats.nats-tools", "a.admin-ish"} {
if MayPublish(perms[other], "$JS.API.STREAM."+op+"."+s) {
t.Errorf("%s, which is no keeper of the bus, may %s %s", other, op, s)
}