Merge pull request 'Grants creates a one-filter consumer on the plain create subject it is granted (issue 1966, recovery)' (#181) from fix/grants-consumer-plain-create into main

modules/mesh-grants/internal/buscompose/buscompose_test.go

@@ -1266,3 +1266,16 @@ func theBusModulesProcessKeepsBusState(t *testing.T) {
 	t.Run("the names are the manifest's", namesAreTheManifests)
 	t.Run("the bus grants are the declared", busGrantsAreTheDeclared)
 }
+
+// A consumer with one filter is created on the plain subject the grants part is granted, not the filtered form the client
+// library uses for FilterSubject alone ($JS.API.CONSUMER.CREATE.<stream>.<name>.<filter>), which no grant allows
+// (2026-11-08, issue 1966: the ASKS and FORGE consumers of the indexer and the builder were never made).
+func TestAOneFilterConsumerIsCreatedOnThePlainSubject(t *testing.T) {
+	cfg := ConsumerConfig(Consumer{Name: "novox_mesh-delivery-indexer", Stream: "ASKS", Filters: []string{"mesh.stream.mesh-delivery-checker.event.verdict"}})
+	if cfg.FilterSubject != "" || len(cfg.FilterSubjects) != 1 || cfg.FilterSubjects[0] != "mesh.stream.mesh-delivery-checker.event.verdict" {
+		t.Fatalf("a one-filter consumer is created with FilterSubject %q and FilterSubjects %v: the client would ask the filtered create subject", cfg.FilterSubject, cfg.FilterSubjects)
+	}
+	if none := ConsumerConfig(Consumer{Name: "a_m", Stream: "EVENTS"}); none.FilterSubject != "" || len(none.FilterSubjects) != 0 {
+		t.Fatalf("a consumer with no filter is created with filters %q %v", none.FilterSubject, none.FilterSubjects)
+	}
+}

modules/mesh-grants/internal/buscompose/create.go

@@ -101,11 +101,11 @@ func ConsumerConfig(c Consumer) jetstream.ConsumerConfig {
 		MaxAckPending: c.MaxAckPending,
 		Description:   c.Why,
 	}
-	switch len(c.Filters) {
+	// Every filter goes in FilterSubjects, one alone too: with exactly one in FilterSubject the client library creates on
-	case 0:
+	// `$JS.API.CONSUMER.CREATE.<stream>.<name>.<filter>`, a form the part is never granted (CreateConsumerGrants: a wildcard
-	case 1:
+	// in a filter would widen the grant), so such a create was refused and timed out (2026-11-08, issue 1966: ASKS and
-		cfg.FilterSubject = c.Filters[0]
+	// FORGE consumers of the indexer and the builder never made).
-	default:
+	if len(c.Filters) > 0 {
 		cfg.FilterSubjects = c.Filters
 	}
 	if c.FromNow {