[BanyanDB][RBAC] TDD workflow 2: group-scoped schema authorization

[hanahmily]

Root tracking issue: #13994

Workflow ID: W-PR2 — owns PR 2 of 3

Blocked by: #14014, which must be merged to main before this workflow starts

Design: Issue #13994 RBAC design

Important

This issue owns one complete TDD workflow and one PR. B1–B10 are sequential
RED→GREEN rounds inside this workflow PR. They are checklist items, not
sub-issues, and never receive independent PRs.

Size audit

Classification: coordinated multi-cycle workflow issue; owns PR 2

Boundary: W-PR1's fail-closed unary decision activates the complete
group-scoped schema lifecycle through typed extractors, one Group.List response
filter, and two SchemaBarrier scope forms

Production activation: Group, seven registry services, Group.List, and
SchemaBarrier callers switch in this PR; no auth/compiler or data handler changes

RED test: TestRBACSchemaWorkflow; against merged W-PR1, an allowed alpha writer
is still PermissionDenied because every schema executor remains fail-closed

End to end: extend the direct standalone rbac case to provision alpha/beta
schema, prove scoped CRUD/List/Exist, filtered Group.List, and SchemaBarrier over
gRPC/HTTP

Format/lifecycle scope: unary schema pre-handler decisions, one unary response
filter, and barrier waits; no protobuf or persisted-format change

Fixtures and oracle: one alpha/beta schema family covering Group plus seven
registries; literal visible-name/status/side-effect expectations are independent
of production extractors

Focused suites: liaison schema adapter tests, standalone schema integration, and
the direct schema E2E stage

Dependencies present on main: no until W-PR1 merges

Decision: one complete PR-level TDD workflow containing ten ordered internal
rounds; the strict seams are checklist boundaries, not issues or PRs

Boundary

Consume W-PR1's trusted principal, immutable snapshot, method policy, and
fail-closed unary hook. Activate only Group, schema registry, Group.List, and
SchemaBarrier rules. Scope comes from the typed request/response shapes in the
round catalog; no generic protobuf field search is allowed.

At merge, callers may rely on the entire schema lifecycle being consistently
authorized over gRPC and HTTP. Data methods remain fail-closed for W-PR3.

Workflow RED → GREEN

RED: add TestRBACSchemaWorkflow against a real W-PR1 liaison. An exact
alpha writer attempts Group and registry schema operations and is denied because
the schema executors are intentionally not active. Record this failure before
B1 starts.

GREEN: execute the internal rounds B1→B10 sequentially: Group point reads, Group upserts,
Group delete, registry List, registry Get/Exist, registry Create/Update,
registry Delete, Group.List filtering, SchemaBarrier key waits, and
SchemaBarrier revision waits. Each round adds only its RED, minimal executor,
and focused integration subcase.

The parent tracer becomes GREEN only when the full schema role/scope/transport
matrix passes. Exact round contracts are in
the internal TDD-round catalog.

Requirements

R1. Exact and wildcard schema grants work; wrong scopes deny before handlers,
and unauthorized existence checks return PermissionDenied, not false.

R2. Group scope uses Group.Metadata.Name; registry scope uses only the three
agreed structural request families. Nil/empty requests retain validation
precedence after authentication.

R3. Denied create/update/delete operations leave no metadata, deletion-task, or
tombstone side effect. Group.List uses the request snapshot and leaks no hidden
group.

R4. SchemaBarrier key waits require every resolved group, with group-kind scope
from SchemaKey.Name; revision waits require wildcard schema read. Every bound
HTTP route matches direct gRPC.

End-to-end test

Extend test/e2e-v2/cases/rbac/ in this PR with the schema stage. It owns the
schema-bootstrap portion of E-DIR-01 and the Group.List/schema half of
E-DIR-04.

The stage must:

• use the admin to create alpha/beta Group and representative child schemas;
• wait for schema application through the protected SchemaBarrier API;
• prove exact writer CRUD and reader Get/List/Exist behavior over gRPC/HTTP;
• prove denied mutations leave the preloaded schema unchanged;
• show an alpha reader lists only alpha while wildcard admin sees alpha/beta;
  and
• exercise key-group and global-revision barrier scope without timing sleeps.

It is RED on merged W-PR1 because schema methods are fail-closed. It becomes
GREEN only after B1–B10 activate their named production seams.

Acceptance criteria

• TestRBACSchemaWorkflow is observed RED first and GREEN after B1–B10.
• Every internal round records its own RED/GREEN evidence in this one PR.
• The direct schema E2E stage above passes in this PR.
• All data permission methods remain fail-closed.
• No internal round has an issue or independent PR.

Focused workflow gate:

go test -race -tags slim ./banyand/liaison/grpc ./banyand/liaison/http

TEST_CI_OPTS='--vv --fail-fast --focus=rbac-schema' \
  make test-ci PKG=./test/integration/standalone/other/...

# Run the schema stage in test/e2e-v2/cases/rbac/e2e.yaml.

make build
make pre-push

Ordered internal TDD rounds

These are strict sequential RED→GREEN checklist items inside #14015.
They are not sub-issues and do not own independent PRs.

• B1 — Group Get/Exist direct-group reads
• B2 — Group Create/Update body-name writes
• B3 — Group Delete before deletion-task creation
• B4 — Seven registry List methods by direct group
• B5 — Seven registry Get/Exist methods by metadata group
• B6 — Seven registry Create/Update methods by resource metadata
• B7 — Seven registry Delete methods by metadata group
• B8 — Group.List response filtering
• B9 — SchemaBarrier key waits
• B10 — SchemaBarrier global revision wait

For every round, the single workflow PR records the RED failure, minimum
GREEN activation, focused real-liaison integration proof, refactor, and
test command/results before the next round begins.

Important

Exactly one PR references and closes #14015. Do not create an issue or
PR for an individual round.

Scope

Production: typed schema extractors/rule bindings, Group.List response filter,
and SchemaBarrier scope extraction.

Tests: schema unit tables, focused standalone schema integration, and direct
schema E2E.

Out of scope: auth/compiler/global changes, native data, stream frames, ByDBQL,
distributed E2E, OAP E2E, and Canopy E2E.