From 20a4a79993273454f69253727b610d67cb961661 Mon Sep 17 00:00:00 2001 From: jochen Date: Wed, 4 Nov 2026 12:50:18 +0100 Subject: [PATCH] =?UTF-8?q?DLV-G2:=20a=20row=20that=20no=20tool=20runner,?= =?UTF-8?q?=20no=20tools=20bundle=20of=20the=20bus=20module=20and=20no=20a?= =?UTF-8?q?ccount=20invoking=20every=20tool=20holds=20the=20bus's=20create?= =?UTF-8?q?,=20update,=20snapshot=20or=20delete=20subjects=20of=20a=20modu?= =?UTF-8?q?le's=20bus=20state=20(ADR=200626=20=C2=A74,=20How=20it=20is=20c?= =?UTF-8?q?hecked)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig --- .../mesh-grants/internal/buscompose/buscompose_test.go | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/modules/mesh-grants/internal/buscompose/buscompose_test.go b/modules/mesh-grants/internal/buscompose/buscompose_test.go index a0a65dbc..59c6bbc6 100644 --- a/modules/mesh-grants/internal/buscompose/buscompose_test.go +++ b/modules/mesh-grants/internal/buscompose/buscompose_test.go @@ -1096,14 +1096,20 @@ func theBusModulesProcessKeepsBusState(t *testing.T) { perms[u.Username()] = p } keeper := perms["a.nats.keeper"] + for _, u := range []string{"a.nats.keeper", "a.nats.other", "a.mod-x.sneak", "a.node-tools", "a.nats.nats-tools", "a.admin-ish"} { + if _, ok := perms[u]; !ok { + t.Fatalf("no user %s composed: %v", u, slices.Collect(maps.Keys(perms))) + } + } for _, s := range []string{"KV_mod-x_records", "mod-x_audit", "mod-x_audit_snapshot", "KV_mod-x_audit_state", "KV_mod-x_audit_index-by-status", "OBJ_mod-x_parts", "KV_gone_kept"} { for _, op := range []string{"CREATE", "UPDATE", "DELETE", "SNAPSHOT"} { if !MayPublish(keeper, "$JS.API.STREAM."+op+"."+s) { t.Errorf("the bus module's process may not %s %s", op, s) } - // Only the process whose bus declares `keeps`, and only on the module holding mesh-broker (ADR 0626 §1, §3). - for _, other := range []string{"a.nats.other", "a.mod-x.sneak"} { + // Only the process whose bus declares `keeps`, and only on the module holding mesh-broker (ADR 0626 §1, §3): no + // tool runner, and not the bus module's own tools (ADR 0626 §4), however wide their grant. + for _, other := range []string{"a.nats.other", "a.mod-x.sneak", "a.node-tools", "a.nats.nats-tools", "a.admin-ish"} { if MayPublish(perms[other], "$JS.API.STREAM."+op+"."+s) { t.Errorf("%s, which is no keeper of the bus, may %s %s", other, op, s) }