diff --git a/server/reload.go b/server/reload.go index 4a49026a661..89594d1b9e3 100644 --- a/server/reload.go +++ b/server/reload.go @@ -1077,7 +1077,7 @@ func (p *proxiesReload) Apply(s *Server) { c.setAuthError(ErrAuthProxyNotTrusted) c.authViolation() } - s.Noticef("Reloaded: proxies trusted keys %q were removed", p.add) + s.Noticef("Reloaded: proxies trusted keys %q were removed", p.del) } if len(p.add) > 0 { s.Noticef("Reloaded: proxies trusted keys %q were added", p.add) diff --git a/test/client_auth_test.go b/test/client_auth_test.go index 51e8cb02129..7402960e6fd 100644 --- a/test/client_auth_test.go +++ b/test/client_auth_test.go @@ -18,6 +18,7 @@ import ( "fmt" "net" "os" + "strings" "testing" "time" @@ -160,6 +161,18 @@ func TestClientConnectInfo(t *testing.T) { } } +type captureProxiesReloadLogger struct { + dummyLogger + ch chan string +} + +func (l *captureProxiesReloadLogger) Noticef(format string, args ...any) { + msg := fmt.Sprintf(format, args...) + if strings.Contains(msg, "proxies trusted keys") { + l.ch <- msg + } +} + func TestProxyKeyVerification(t *testing.T) { u1, _ := nkeys.CreateUser() u1Pub, _ := u1.PublicKey() @@ -343,10 +356,32 @@ func TestProxyKeyVerification(t *testing.T) { cid2 := currentCID checkLeafNodeConnected(t, s) + logger := &captureProxiesReloadLogger{ch: make(chan string, 10)} + s.SetLogger(logger, false, false) + os.WriteFile(conf, fmt.Appendf(nil, tmpl, u3Pub, u2Pub), 0660) if err := s.Reload(); err != nil { t.Fatalf("Reload failed: %v", err) } + for range 2 { + select { + case str := <-logger.ch: + if strings.Contains(str, "removed") { + if !strings.Contains(str, u1Pub) { + t.Fatalf("Expected removed trace to include %q, it did not: %s", u1Pub, str) + } + } else if strings.Contains(str, "added") { + if !strings.Contains(str, u3Pub) { + t.Fatalf("Expected added trace to include %q, it did not: %s", u3Pub, str) + } + } else { + t.Fatalf("Unexpected log: %q", str) + } + default: + t.Fatal("Expected a log, did not get one") + } + } + // Connections should get disconnected. // We need to consume what is sent by the server, but for leaf we may // get some LS+, etc... so just consumer until we get the io.EOF