A node composing its own hears the vault's secret-changed, names and generations only (issue 1126, ADR 0547 §2)

go/buscompose/buscompose_test.go

@@ -1,6 +1,7 @@
 package buscompose
 
 import (
+	"slices"
 	"encoding/json"
 	"os"
 	"path/filepath"
@@ -44,7 +45,8 @@ func mayBeyondTheControllers(user string) map[string]bool {
 	if _, ok := strings.CutPrefix(user, "node."); !ok {
 		return nil
 	}
-	return map[string]bool{VaultOwnCall(Principal{Kind: KindNode, Node: strings.TrimPrefix(user, "node.")}): true}
+	return map[string]bool{VaultOwnCall(Principal{Kind: KindNode, Node: strings.TrimPrefix(user, "node.")}): true,
+		VaultSecretChanged: true}
 }
 
 // quotedToken is a quoted token of a composed list.
@@ -218,6 +220,9 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 		if plain, _ := PermissionsFor(Principal{Kind: KindNode, Node: "one"}); MayPublish(plain, VaultOwnCall(one)) {
 			t.Error("a node asks own while the vault does not serve it")
 		}
+		if !slices.Contains(perms.Subscribe, VaultSecretChanged) {
+			t.Errorf("node one does not hear the vault's secret-changed: %v", perms.Subscribe)
+		}
 	})
 	t.Run("the controller's golden server configuration", func(t *testing.T) {
 		seat := Seat{Name: "telegram-sender", Accepts: []string{"send"}, Emits: []string{"delivered", "failed"}}