nats-io / nats-server / 34563354598
83%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 66
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 82.572% (+0.9%) from 81.645%
34563354598

push

github

web-flow 
(2.15) Fix scoped JetStream source reply subjects (#8586)

Fixes #8558.

When setting up a source or mirror, the server uses `$JSC.R.<uid>` as
the reply subject for both consumer creation and durable consumer
resets. In a leafnode deployment where multiple leaves share an account,
that means each leaf needs access to `$JSC.R.*`, even if all of its
other permissions are scoped to its own streams and consumers.

This adds an opt-in `js_api_reply_v2` feature flag. When enabled, source
and mirror setup replies include the remote JetStream resource in the
subject:

```text
$JSC.R.<domain>.<account-hash>.<stream>.<consumer>.<uid>
```

That lets a leafnode permission set allow only the replies associated
with a specific source or mirror relationship, instead of all `$JSC.R`
replies in the account.

The old reply format remains the default:

```text
$JSC.R.<uid>
```

The new format is used for both regular `CONSUMER.CREATE` requests and
BYO/durable `CONSUMER.RESET` requests, for sources and mirrors.

Added coverage for:

- Source consumer creation
- Source durable consumer reset
- Mirror consumer creation
- Mirror durable consumer reset

Tests runFixes #8558.

This adds an opt-in reply subject format for JetStream source and mirror
setup.

Today, source/mirror consumer setup uses reply subjects like:

```text
$JSC.R.<random id>
```

That means leafnodes sharing an account need permission for `$JSC.R.*`
to receive replies for `CONSUMER.CREATE` or durable `CONSUMER.RESET`. In
practice, that also lets one otherwise restricted leafnode see replies
intended for another.

When `js_api_reply_v2` is enabled, source and mirror setup now uses a
reply subject that includes the remote JetStream resource:

```text
$JSC.R.<domain>.<account-hash>.<stream>.<consumer>.<random id>
```

This makes it possible to grant a leafnode access only to replies for
the stream and consumer it is allowed to source or mirror.

The old format remains the default, so there is no behavior chan... (continued)

71380 of 86446 relevant lines covered (82.57%)

330385.5 hits per line

Coverage Regressions

Lines Coverage ∆ File
1069
82.84
 -0.29% src/github.com/nats-io/nats-server/server/jetstream_cluster.go
463
86.24
 0.16% src/github.com/nats-io/nats-server/server/stream.go
72
70.45
 -0.95% src/github.com/nats-io/nats-server/server/stream_backup.go
52
84.64
 0.25% src/github.com/nats-io/nats-server/server/jetstream.go
36
78.52
 0.92% src/github.com/nats-io/nats-server/server/raft.go
14
73.77
 -0.2% src/github.com/nats-io/nats-server/server/jetstream_api.go
11
77.55
 13.7% src/github.com/nats-io/nats-server/server/opts.go
7
92.96
 0.27% src/github.com/nats-io/nats-server/server/client.go
7
85.25
 0.0% src/github.com/nats-io/nats-server/server/feature_flags.go
4
78.68
 0.57% src/github.com/nats-io/nats-server/server/filestore.go
4
93.62
 0.0% src/github.com/nats-io/nats-server/server/gateway.go
2
86.12
 0.19% src/github.com/nats-io/nats-server/server/accounts.go
2
92.47
 -0.14% src/github.com/nats-io/nats-server/server/jetstream_batching.go
2
55.36
 -0.14% src/github.com/nats-io/nats-server/server/jetstream_errors_generated.go
2
89.48
 0.17% src/github.com/nats-io/nats-server/server/leafnode.go
2
84.21
 -5.26% src/github.com/nats-io/nats-server/server/raft_transport.go
2
84.82
 0.19% src/github.com/nats-io/nats-server/server/route.go
2
89.29
 0.77% src/github.com/nats-io/nats-server/server/server.go
Jobs
ID Job ID Ran Files Coverage
1 34563354598.1 66
82.57
 GitHub Action Run
Source Files on build 34563354598