Catch a denied publish at once instead of waiting it out, so an ungranted bucket's refusal names it (issue 1188, review round 1 finding 1)

go/process/state_integration_test.go

@@ -6,8 +6,8 @@ import (
 	"errors"
 	"strings"
 	"testing"
-	"time"
 
+	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
 
 	stdio "git.novox.be/novox/mesh-sdk/go"
@@ -64,15 +64,18 @@ func TestStateCreateGetUpdateOnAGrantedBucket(t *testing.T) {
 	}
 }
 
-// 1188/AC4: given an account not granted a bucket, when it writes there, then the bus's refusal comes back
-// as an error naming the bucket. A denied publish is refused only as an async protocol error with no
-// reply (never a reply naming the refusal), so StateTimeout is shortened for this test alone.
+// 1188/AC4: given an account not granted a bucket, when it writes there, then the bus's refusal comes
+// back as an error naming the bucket. The bucket exists (made by the admin) so the only reason Create
+// can fail is the missing grant, never "bucket not found"; and Conn's own ErrorHandler (conn.go
+// withRefusal/publishRefused) catches the denied publish at once, so this returns promptly rather than
+// after a timeout.
 func TestStateRefusesAnUngrantedBucketNamingIt(t *testing.T) {
-	old := StateTimeout
-	StateTimeout = 2 * time.Second
-	t.Cleanup(func() { StateTimeout = old })
+	url, account := grantedSendProcess(t)
+	_, adminJetStream := adminJS(t, url)
+	if _, err := adminJetStream.CreateKeyValue(ctxFor(t), jetstream.KeyValueConfig{Bucket: "mesh-mail_unrelated"}); err != nil {
+		t.Fatalf("the admin could not make the bucket: %v", err)
+	}
 
-	_, account := grantedSendProcess(t)
 	conn, err := Connect(account)
 	if err != nil {
 		t.Fatal(err)
@@ -80,9 +83,14 @@ func TestStateRefusesAnUngrantedBucketNamingIt(t *testing.T) {
 	defer conn.Close()
 
 	s := conn.State("unrelated")
-	if _, err := s.Create("key", map[string]any{"v": 1}); err == nil {
+	_, err = s.Create("key", map[string]any{"v": 1})
+	if err == nil {
 		t.Fatal("writing to an ungranted bucket was not refused")
-	} else if !strings.Contains(err.Error(), "mesh-mail_unrelated") {
+	}
+	if !errors.Is(err, nats.ErrPermissionViolation) {
+		t.Errorf("the refusal %v does not wrap nats.ErrPermissionViolation", err)
+	}
+	if !strings.Contains(err.Error(), "mesh-mail_unrelated") {
 		t.Errorf("the refusal %q does not name the bucket mesh-mail_unrelated", err.Error())
 	}
 }