# A bus with the grants a witness needs (novox/hq to-be 45 §8), for witnessing_nats_test.go:
#
#   docker run -d --rm --name w -p 14224:4222 -v $PWD/internal/link/testdata:/c:ro nats:2.11-alpine -js -c /c/witness-grants.conf
#   MESH_TEST_NATS_GRANTS=nats://127.0.0.1:14224 go test ./internal/link/ -run TestNatsWitness
#
# `node.anchor` is a machine's host with exactly the two subjects the witness asks added to what a
# host already has (its inbox); `node.bare` is a host without them. `runtime` stands in for the tool
# runtime, `admin` for the controller writing the lease.
jetstream: enabled
accounts {
  MESH {
    jetstream: enabled
    users = [
      { user: "node.anchor", password: "a", permissions: {
        publish: { allow: ["$JS.API.DIRECT.GET.KV_mesh-controller_lease.$KV.mesh-controller_lease.holder", "$SRV.PING.node-tools.anchor"] }
        subscribe: { allow: ["_INBOX.node.anchor.>"] }
      } }
      { user: "node.bare", password: "b", permissions: {
        publish: { allow: ["mesh.control.bare.>"] }
        subscribe: { allow: ["_INBOX.node.bare.>"] }
      } }
      { user: "runtime", password: "r", permissions: {
        subscribe: { allow: ["$SRV.PING.node-tools.>"] }
        allow_responses: { max: 1, ttl: "1m" }
      } }
      { user: "admin", password: "x" }
    ]
  }
}