Rename to checkLinkPermissions and stop log following on revoke

The old name read as an unconditional unsubscribe. Log following has
its own subscription outside SubscriptionController, so check
core.log.follow on permission changes too. Move the per-connection
work into one helper and split the tests into userPermissionsUpdated
and rolesUpdated, checking the account update event is sent.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/controller/src/Controller.ts

@@ -1,6 +1,7 @@
 import type winston from "winston";
 import { BlockList, type AddressInfo, isIPv4, isIPv6 } from "net";
 import type { ControllerArgs } from "../controller.js";
+import type ControlConnection from "./ControlConnection.js";
 import express, { type Request, type Response, type NextFunction, type Application } from "express";
 import type { Static } from "@sinclair/typebox";
 import finalhandler from "finalhandler";
@@ -1086,18 +1087,24 @@ export default class Controller {
 	userPermissionsUpdated(user: Readonly<User>) {
 		for (let controlConnection of this.wsServer.controlConnections.values()) {
 			if (controlConnection.user === user) {
-				this.subscriptions.unsubscribeUnpermitted(controlConnection, user);
-				controlConnection.send(
-					new lib.AccountUpdateEvent([...user.roles].map(r => ({
-						name: r.name,
-						id: r.id,
-						permissions: [...r.permissions],
-					})))
-				);
+				this._controlPermissionsUpdated(controlConnection);
 			}
 		}
 	}
 
+	_controlPermissionsUpdated(controlConnection: ControlConnection) {
+		const user = controlConnection.user;
+		this.subscriptions.checkLinkPermissions(controlConnection, user);
+		controlConnection.checkLogPermission();
+		controlConnection.send(
+			new lib.AccountUpdateEvent([...user.roles].map(r => ({
+				name: r.name,
+				id: r.id,
+				permissions: [...r.permissions],
+			})))
+		);
+	}
+
 	rolesUpdated(roles: lib.Role[]) {
 		this.subscriptions.broadcast(new lib.RoleUpdatesEvent(roles));
 		this.hooks.rolesUpdated.invoke(roles);
@@ -1105,16 +1112,7 @@ export default class Controller {
 		for (const role of roles) {
 			for (let controlConnection of this.wsServer.controlConnections.values()) {
 				if (controlConnection.user.roles.has(role)) {
-					this.subscriptions.unsubscribeUnpermitted(controlConnection, controlConnection.user);
-					controlConnection.send(
-						new lib.AccountUpdateEvent(
-							[...controlConnection.user.roles].map(r => ({
-								name: r.name,
-								id: r.id,
-								permissions: [...r.permissions],
-							}))
-						)
-					);
+					this._controlPermissionsUpdated(controlConnection);
 				}
 			}
 		}