vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-nats-auth: pin that a hive can't create a named consumer on agent-limits

Browse source 
The grant test covered the bare consumer-create subject only, so a grant
of `$JS.API.CONSUMER.CREATE.KV_agent-limits.>` would have passed it.
It now also checks a named consumer, bare and with a key filter.
Raised by the #4268 verify pass.
This commit is contained in:
atlas 2026-10-12 12:03:49 +02:00 • committed by mara
commit e14955f20a
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
swarm-nats-auth/src/policy.rs
View file

@ -748,6 +748,13 @@ mod tests {
format!("$JS.API.STREAM.PURGE.{STREAM}"),
format!("$JS.API.STREAM.MSG.DELETE.{STREAM}"),
format!("$JS.API.CONSUMER.CREATE.{STREAM}"),
// A named consumer, bare and with a key filter, which a grant of
// `CONSUMER.CREATE.<stream>.>` would cover.
format!("$JS.API.CONSUMER.CREATE.{STREAM}.c1"),
format!(
"$JS.API.CONSUMER.CREATE.{STREAM}.c1.{}",
key_subject("atlas")
),
] {
assert!(!may(&forbidden), "hive alpha may publish {forbidden}");
}