Allow '.ACCOUNT.>' since was allowed prior

Signed-off-by: Derek Collison <[email protected]>

server/jetstream_test.go

@@ -23679,17 +23679,30 @@ func TestJetStreamAuditStreams(t *testing.T) {
  // Since prior behavior did allow $JS.EVENT to be captured without no-ack, these might break
  // on a server upgrade so make sure they still work ok without --no-ack.
 
- // Do avoid overlap.
+ // To avoid overlap error.
  err = js.DeleteStream("TEST1")
  require_NoError(t, err)
 
  _, err = js.AddStream(&nats.StreamConfig{
  Name: "TEST4",
  Subjects: []string{"$JS.EVENT.>"},
- NoAck: true,
  })
  require_NoError(t, err)
 
+ // Also allow $SYS.ACCOUNT to be captured without no-ack, these also might break
+ // on a server upgrade so make sure they still work ok without --no-ack.
+
+ // To avoid overlap error.
+ err = js.DeleteStream("TEST3")
+ require_NoError(t, err)
+
+ _, err = js.AddStream(&nats.StreamConfig{
+ Name: "TEST5",
+ Subjects: []string{"$SYS.ACCOUNT.>"},
+ })
+ require_NoError(t, err)
+
+ // We will test handling of ">" on a cluster here.
  // Specific test for capturing everything which will require both no-ack and replicas of 1.
  c := createJetStreamClusterExplicit(t, "R3S", 3)
  defer c.shutdown()

server/stream.go

@@ -1521,7 +1521,9 @@ func (s *Server) checkStreamCfg(config *StreamConfig, acc *Account) (StreamConfi
  }
  // And the $SYS subjects.
  if !cfg.NoAck && subjectIsSubsetMatch(subj, "$SYS.>") {
- return StreamConfig{}, NewJSStreamInvalidConfigError(fmt.Errorf("subjects that overlap with system api require no-ack to be true"))
+ if !subjectIsSubsetMatch(subj, "$SYS.ACCOUNT.>") {
+ return StreamConfig{}, NewJSStreamInvalidConfigError(fmt.Errorf("subjects that overlap with system api require no-ack to be true"))
+ }
  }
  // Mark for duplicate check.
  dset[subj] = struct{}{}