|
|
|
@@ -54,6 +54,7 @@ type fakeBus struct {
|
|
|
|
|
hold chan struct{}
|
|
|
|
|
// creates are the streams the part asked to create, refused when refuseCreate.
|
|
|
|
|
creates []string
|
|
|
|
|
createdAge map[string]time.Duration
|
|
|
|
|
refuseCreate bool
|
|
|
|
|
// refuseUsers refuses the bus module's nats_users: the loaded list cannot be read.
|
|
|
|
|
refuseUsers bool
|
|
|
|
@@ -133,6 +134,10 @@ func (b *fakeBus) CreateDeclared(cfg jetstream.StreamConfig) error {
|
|
|
|
|
b.mu.Lock()
|
|
|
|
|
defer b.mu.Unlock()
|
|
|
|
|
b.creates = append(b.creates, cfg.Name)
|
|
|
|
|
if b.createdAge == nil {
|
|
|
|
|
b.createdAge = map[string]time.Duration{}
|
|
|
|
|
}
|
|
|
|
|
b.createdAge[cfg.Name] = cfg.MaxAge
|
|
|
|
|
if b.refuseCreate {
|
|
|
|
|
return errors.New("Permissions Violation for Publish to $JS.API.STREAM.CREATE." + cfg.Name)
|
|
|
|
|
}
|
|
|
|
@@ -315,7 +320,7 @@ func (b *fakeBus) assign(node, module string) {
|
|
|
|
|
const (
|
|
|
|
|
natsManifest = `{"module":"nats","version":"1","claims":[{"name":"mesh-broker"}],"own-secrets":{"broker":"/var/lib/nats/broker"}}`
|
|
|
|
|
xManifest = `{"module":"mod-x","version":"1","own-secrets":{"broker":"/var/lib/x/broker"},"state":[{"name":"kept","history":3}],` +
|
|
|
|
|
`"streams":[{"name":"things","events":["thing.added"],"max-age-days":2,"max-mib":5}],"logs":[{"name":"history"}]}`
|
|
|
|
|
`"streams":[{"name":"things","events":["thing.added"],"max-age-days":2,"max-mib":5}],"logs":[{"name":"history","max-age-days":30}]}`
|
|
|
|
|
yManifest = `{"module":"mod-y","version":"1","own-secrets":{"broker":"/var/lib/y/broker"},"reads":["mod-x.kept"]}`
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
@@ -1078,7 +1083,8 @@ func TestGrants(t *testing.T) {
|
|
|
|
|
licence, _ := os.ReadFile(filepath.Join("testdata", "claude-licence-manager.json"))
|
|
|
|
|
n := newFakeBus()
|
|
|
|
|
// 1952/S5 (ADR 0564 Limits 4): the bus module's tools bundle declares its own account and what it may remove.
|
|
|
|
|
n.manifestOf("nats", strings.TrimSuffix(natsManifest, "}")+`,"build":{"artifacts":[{"name":"tools","kind":"bundle","language":"go",`+
|
|
|
|
|
n.manifestOf("nats", strings.Replace(strings.TrimSuffix(natsManifest, "}"), `"broker":"/var/lib/nats/broker"`, `"broker":"/var/lib/nats/broker","broker-nats-tools":"${dir:tools-secret}/broker-nats-tools"`, 1)+
|
|
|
|
|
`,"resources":[{"id":"tools-secret","type":"directory","path":"/var/lib/mesh/nats-tools","mode":"0711"}],"build":{"artifacts":[{"name":"tools","kind":"bundle","language":"go",`+
|
|
|
|
|
`"system":"arch","from":"cmd/nats-tools","binary":"nats-tools","loads":["nats-tools"],"bus":{"removes":["DEAD_LETTER_NOTICES.controller","mesh-host_acts"]}}]}}`)
|
|
|
|
|
n.manifestOf("claude-licence-manager", string(licence))
|
|
|
|
|
n.assign("novox", "nats")
|
|
|
|
@@ -1796,6 +1802,9 @@ func TestGrants(t *testing.T) {
|
|
|
|
|
!strings.HasPrefix(first.Asserted[0], "mod-x at ") || !slices.Contains(b.events, grants.EventAsserted) {
|
|
|
|
|
t.Fatalf("the first pass created %v, said %v, events %v", b.creates, first.Asserted, b.events)
|
|
|
|
|
}
|
|
|
|
|
if b.createdAge["LOG_mod-x_history"] != 30*24*time.Hour { // a log's max-age-days is its stream's MaxAge (mesh-sdk 2e5cc4f)
|
|
|
|
|
t.Errorf("the log was created with max age %v, want 30 days", b.createdAge["LOG_mod-x_history"])
|
|
|
|
|
}
|
|
|
|
|
a := assertion()
|
|
|
|
|
if !a.Asserted || a.Says != grants.CreatesMissing {
|
|
|
|
|
t.Errorf("the assertion kept = %+v", a)
|
|
|
|
|
