feat(authz): BatchCheck client part 2/2 (S09 Enforcement plan: 3/20)

David Fernandezrequested to merge
10io/s09-enforcement-step-3-part2of2 into main

Stacked MRs

Step 3 ships as 2 stacked MRs to keep each part within the review size limit. Part 1 targeted main and has merged; this part was rebased onto main and is now the bottom of the stack. Review and merge bottom-up.

What this MR does

Part 2 of 2 of the S09 Enforcement plan — Step 3: GLAZ BatchCheck client method, per S09 (authorization).

Hardens the BatchCheck client that part 1 introduced:

  • Raises the per-RPC retry replay buffer to 32 MiB, passed as a call option on BatchCheck rather than at the dial: it bounds the sent request, and past gRPC's 256 KiB default the configured UNAVAILABLE retry stops applying to a large batch with no error. The receive cap stays at gRPC's 4 MiB default, which covers the 1.59 MiB worst case of the consumer S09 specifies; TestClient_Check_KeepsDefaultReceiveCap pins that nothing raises it on the RPC that gates every authorized request.
  • At-cap boundary tests: exactly MaxBatchCheckItems items, MaxBatchCheckRelationships deduped relationships, MaxBatchCheckActionsPerItem actions, and MaxBatchCheckAncestorIDsPerItem ancestor ids are each accepted (a > → >= flip in validation goes red).
  • The response-shape rejection suite: out-of-range and duplicate (item_index, action) verdicts, unrequested actions, and incomplete responses.
  • An oversized-batch retry test measuring a >256 KiB request via proto.Size and asserting it still retries 3× on UNAVAILABLE.
  • BatchCheck error-code table parity with Check (TestClient_BatchCheck_ErrorMapping).

Production code is 5 LoC (the sizing constant, its call option, and the comment naming why the option is per-call); the rest is the test coverage whose only subject it is.

The rebase onto the merged part 1 adapted this part to two contracts part 1's review round added: the at-cap fixtures now use canonical UUID ids (part 1 validates id format client-side), and the tolerated-mismatch echo test was dropped — part 1's TestClient_BatchCheck_ObjectEcho pins the fail-closed contract that supersedes it.

Size

389 reviewable LoC against main at d2fde608: 6 production (5 in internal/authz/glaz/client.go, 1 comment line in internal/authz/glaz/checker.go), 383 tests (364 in internal/authz/glaz/batchcheck_test.go, 19 in internal/authz/glaz/client_test.go).

e2e scenarios

Test hardening plus one client sizing constant; no request-path behavior changes, so no docs/testing/ scenario is added or affected.

Related to #652 (closed)

Stacked MRs (review/merge bottom-up)

Edited by David Fernandez

Merge request reports