Fix script exec permission testing

Explicity triggered scripts are no longer the only source of
permissions - iterators use the same mechanisms

pkg/corredor/service.go

@@ -452,13 +452,6 @@ func (svc *service) registerServerScripts(ss ...*ServerScript) {
 		// Corredor can (by design) serve us script with errors (load, parse time) and
 		// they need to be ignored by security, trigger, iterator handlers
 		if len(s.Errors) == 0 {
-			if sec, rr, err := svc.serverScriptSecurity(script); err != nil {
-				s.Errors = append(s.Errors, err.Error())
-			} else {
-				s.Security = sec
-				svc.permissions = append(svc.permissions, rr...)
-			}
-
 			if s.Iterator != nil {
 				// process iterator and register (deferred) event handlers
 				if ptrs, err := svc.processIterator(s); err != nil {
@@ -475,6 +468,15 @@ func (svc *service) registerServerScripts(ss ...*ServerScript) {
 			}
 		}
 
+		if len(s.Errors) == 0 {
+			if sec, rr, err := svc.serverScriptSecurity(script); err != nil {
+				s.Errors = append(s.Errors, err.Error())
+			} else {
+				s.Security = sec
+				svc.permissions = append(svc.permissions, rr...)
+			}
+		}
+
 		if len(s.Errors) == 0 {
 			svc.log.Debug(
 				"script registered",

pkg/corredor/service_test.go

@@ -221,7 +221,7 @@ func TestService_canExec(t *testing.T) {
 	svc.registerServerScripts(script1, script2, script3, script4)
 
 	a.Len(svc.sScripts, 3)
-	a.Len(svc.permissions, 2)
+	a.Len(svc.permissions, 3)
 	a.True(svc.canExec(ctx, script1.Name))
 	a.False(svc.canExec(ctx, script2.Name))
 }