From e14955f20ad1ed86001d1ed77d838834137ce366 Mon Sep 17 00:00:00 2001 From: atlas Date: Mon, 12 Oct 2026 12:03:49 +0200 Subject: [PATCH] swarm-nats-auth: pin that a hive can't create a named consumer on agent-limits The grant test covered the bare consumer-create subject only, so a grant of `$JS.API.CONSUMER.CREATE.KV_agent-limits.>` would have passed it. It now also checks a named consumer, bare and with a key filter. Raised by the #4268 verify pass. --- swarm-nats-auth/src/policy.rs | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/swarm-nats-auth/src/policy.rs b/swarm-nats-auth/src/policy.rs index 86a4d703..e4a69277 100644 --- a/swarm-nats-auth/src/policy.rs +++ b/swarm-nats-auth/src/policy.rs @@ -748,6 +748,13 @@ mod tests { format!("$JS.API.STREAM.PURGE.{STREAM}"), format!("$JS.API.STREAM.MSG.DELETE.{STREAM}"), format!("$JS.API.CONSUMER.CREATE.{STREAM}"), + // A named consumer, bare and with a key filter, which a grant of + // `CONSUMER.CREATE..>` would cover. + format!("$JS.API.CONSUMER.CREATE.{STREAM}.c1"), + format!( + "$JS.API.CONSUMER.CREATE.{STREAM}.c1.{}", + key_subject("atlas") + ), ] { assert!(!may(&forbidden), "hive alpha may publish {forbidden}"); }