[BanyanDB][RBAC] TDD workflow 3: data, special paths, and release proof

[hanahmily]

Root tracking issue: #13994

Workflow ID: W-PR3 — owns PR 3 of 3

Blocked by: #14015, which must be merged to main before this workflow starts

Design: Issue #13994 RBAC design

Important

This issue owns one complete TDD workflow and one PR. C1–C8 are sequential
RED→GREEN rounds inside this workflow PR. Remaining release proof and docs are
final checklist stages in the same PR. None receives an independent PR.

Size audit

Classification: coordinated multi-cycle workflow issue; owns PR 3

Boundary: W-PR1/W-PR2's merged decision infrastructure activates all public data
request families plus the common stream RecvMsg and ByDBQL post-transform
hooks

Production activation: native query, Property mutation, streaming write, and
ByDBQL callers switch in this PR; the direct deployment suites prove the final
assembled behavior

RED test: TestRBACDataWorkflow; against merged W-PR2, an allowed alpha reader
is still PermissionDenied because every data executor remains fail-closed

End to end: extend the standalone rbac case with native data/stream/ByDBQL and
add the separate rbac-cluster distributed case plus non-blocking nightly stress

Format/lifecycle scope: unary data decisions, Property mutation, per-frame
stream receive, ByDBQL transformation/dispatch, and deployment verification; no
protobuf or persisted-format change

Fixtures and oracle: one alpha/beta marker-data family, exact allow/deny/status
answers, admin absence queries for denied writes, and fixed reload revisions

Focused suites: liaison data/special-path tests, standalone/distributed
integration, direct standalone/distributed E2E, and nightly stress

Dependencies present on main: no until W-PR2 merges

Decision: one complete PR-level TDD workflow containing eight ordered internal
rounds followed by the final release proof; rounds own no issues or PRs

Boundary

Consume the merged trusted principal, immutable snapshot, exhaustive method
policy, typed unary hook, and schema behavior. Activate every public data method
through its named typed executor. Streaming writes authorize each
resource-bearing frame through one common ServerStream.RecvMsg lifecycle;
ByDBQL authorizes the transformed native request immediately before dispatch.

At merge, every #13994 method is either explicitly authorized or retains its
documented authenticated/health behavior.

Workflow RED → GREEN

RED: add TestRBACDataWorkflow against a real W-PR2 liaison. An exact alpha
reader queries a seeded Stream/Measure/Trace/Property resource and is denied
because data executors are intentionally not active. Record this failure before
C1 starts.

GREEN: execute the internal rounds C1→C8 sequentially: Stream Query, Measure Query/TopN, Trace
Query, Property Query, Property Apply, Property Delete, per-frame writes, and
ByDBQL post-transform authorization. Each round adds only its RED, minimal
production activation, and focused integration subcase.

The parent tracer becomes GREEN only when unary, mutation, stream, and ByDBQL
behavior passes. Exact round contracts are in
the internal TDD-round catalog.

Requirements

R1. Every multi-group native read is all-or-nothing; one forbidden group denies
the request without partial data.

R2. Property Apply/Delete enforce the resource group before the handler and
denied calls leave records unchanged or absent.

R3. Every resource-bearing stream frame uses the current snapshot and denied
frames never reach storage; binding revocation affects the next frame.

R4. ByDBQL authorizes transformed native groups and cannot be bypassed by raw
SQL, parameters, casing, comments, or HTTP routing. Emitting metrics/logs remain
bounded and secret-safe.

End-to-end test

Extend test/e2e-v2/cases/rbac/ with the data/special stages and add
test/e2e-v2/cases/rbac-cluster/. This PR owns the marker-seeding portion of
E-DIR-01, the native-query half of E-DIR-04, E-DIR-05, E-DIR-06, the
stream portions of E-DIR-07 and E-DIR-09, E-DST-01 through E-DST-04,
and the final assembled matrix.

The tests must:

• seed distinct alpha/beta markers through protected APIs;
• prove native gRPC/HTTP reads, mixed-scope denial, and Property side effects;
• send allowed then forbidden frames through all three write protocols;
• prove ByDBQL scope after transformation for every native result family;
• exercise unary and stream revocation without reconnect/restart;
• compare decisions across two liaison endpoints and preserve internal flows;
• run reload/restart concurrency as non-blocking nightly stress; and
• verify the complete metrics/redaction matrix.

They are RED on merged W-PR2 because data and special-path executors remain
fail-closed. They become GREEN only through C1–C8.

Acceptance criteria

• TestRBACDataWorkflow is observed RED first and GREEN after C1–C8.
• Every internal round records its own RED/GREEN evidence in this one PR.
• Direct standalone and distributed E2E pass in this PR; nightly stress is
  installed as non-blocking.
• Operator/security docs and enabled/disabled examples match the shipped YAML.
• OAP and Canopy E2E are absent; their trust boundaries are documentation only.
• No internal round has an issue or independent PR.

Focused workflow gate:

go test -race -tags slim ./banyand/liaison/grpc ./banyand/liaison/http

TEST_CI_OPTS='--vv --fail-fast --focus=rbac' \
  make test-ci PKG=./test/integration/standalone/other/...
TEST_CI_OPTS='--vv --fail-fast' \
  make test-ci PKG=./test/integration/distributed/rbac/...

# Run test/e2e-v2/cases/rbac and rbac-cluster through the existing
# skywalking-infra-e2e workflow.

make build
make pre-push

Ordered internal TDD rounds

These are strict sequential RED→GREEN checklist items inside #14016.
They are not sub-issues and do not own independent PRs.

• C1 — Stream Query repeated-group decision
• C2 — Measure Query/TopN repeated-group decision
• C3 — Trace Query repeated-group decision
• C4 — Property Query repeated-group decision
• C5 — Property Apply side-effect-safe decision
• C6 — Property Delete side-effect-safe decision
• C7 — Measure/Stream/Trace per-frame write decision
• C8 — ByDBQL post-transform decision

For every round, the single workflow PR records the RED failure, minimum
GREEN activation, focused real-liaison integration proof, refactor, and
test command/results before the next round begins.

Important

Exactly one PR references and closes #14016. Do not create an issue or
PR for an individual round.

Scope

Production: native data extractors/bindings, Property mutations, stream wrapper
and typed adapters, ByDBQL transformed-request gate, emitting observability.

Tests/docs: remaining unit/integration rows, direct standalone/distributed E2E,
nightly stress, operator/security docs, and example configs.

Out of scope: OAP E2E, Canopy E2E, UI, OAuth/OIDC, external policy engines,
ABAC, and private data-node authorization changes.