bridge: make v3 pass the v2 REST suite

[aberoham]

bridge: make v3 pass the v2 REST suite

Everything the v2 GUI needs from the v3 API to serve real traffic through the
REST bridge (NicTool/NicTool#365).

authz enforcement. Ports the v2 permission model: group-tree reads, per-resource caps,
delegations with pseudo-delegation for zone records (zone_perm_add_records /
zone_perm_delete_records), self-write limits, and session revalidation against live user/
group rows with a 4h idle cutoff. Enforcement lives in one hapi plugin; policy in
lib/authz/store/base.js, SQL in lib/authz/store/mysql.js.

store layer. Audit, authz, delegation, and permission data access move behind
lib/<entity>/store/ — mysql complete, json/toml file backends aligned with mysql behavior,
mongodb/elasticsearch stubs that throw loudly. No mysql2 imports outside stores;
lib/store-access.test.js guards that.

Also here: searchable/paginated user listings, object moves between groups (with
permission-row rewrites), audit logging on zone/record mutations, canonical zone-name
conflict detection, scoped reads so delegated collections only show delegated rows.

Two semantic decisions worth review:

1. permissionRecord resolves a user-targeted perm row's group via
   COALESCE(u.nt_group_id, NULLIF(p.nt_group_id, 0)) — the user's current group wins over
   what the row says. Stale v2-era rows stop granting/denying based on dead group placement,
   and moves rewrite them going forward.
2. Zone-name uniqueness is enforced inside v3 by a named lock on the canonical form
   (case/trailing-dot folded). There is deliberately no unique index, so writers outside this
   codepath (v2 against the shared DB) can still create canonically-duplicate zones. Say the
   word if you'd rather have the index.

Copilot review fixes included: self_write can no longer smuggle permission fields through
PUT /user/{self}; moving a record out of a zone requires delete permission at the source, not
just create at the destination; session activity refreshes on ordinary requests so the idle
cutoff measures idleness.

Second-review fixes: the JWT max age now matches the 8h token ttl (the 4h cap cut active
users off regardless of activity); the audit and delegation file stores serialize their writes;
the zone file store allocates ids; /log/zone_record has a record-only delegation test.

Depends on: validate#31 (merged as 0a09c61, not yet released). CI installs that commit over
the published 1.0.0; the dependency bumps to the next validate release when it ships, and that
commit goes away. Pairs with NicTool/NicTool#365 (bridge + xt) and #363 (password hash interop).
Supersedes #60.

Tests: full suite green across api lib/routes and the dns libs; file-store suites pass under
NICTOOL_DATA_STORE=json; xt suites run through the bridge in NicTool#365.

[msimerson]

I cancelled the tests, after not passing for an hour, they weren't going to.

[msimerson]

needs updating against validate 1.0.0

[Copilot]

Pull request overview

Extends the v3 API to support v2 GUI traffic through the REST bridge for NicTool/NicTool#365.

Changes:

• Adds centralized authorization, delegation, session revalidation, and audit logging.
• Aligns MySQL and file stores with pagination, scoped reads, moves, and canonical zone uniqueness.
• Expands backend and integration tests and upgrades @nictool/validate.

Reviewed changes

Copilot reviewed 79 out of 79 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
test/run.sh	Routes coverage through backend runners.
test/backends/toml.sh	Runs TOML tests serially.
test/backends/mysql.sh	Runs MySQL tests serially.
test/backends/json.sh	Runs JSON tests serially.
routes/zone.test.js	Tests uniqueness, moves, and audit logs.
routes/zone.js	Adds authorization, pagination, auditing, and conflicts.
routes/zone_record.test.js	Tests delegation scope, sorting, and auditing.
routes/zone_record.js	Adds authorization, scope, and auditing.
routes/user.test.js	Tests sessions, searches, moves, and permissions.
routes/user.js	Adds authorization, pagination, moves, and permission controls.
routes/test/permissions.js	Adds route permission fixtures.
routes/session.test.js	Tests revocation and qualified usernames.
routes/session.js	Returns effective permissions and refreshes activity.
routes/permission.test.js	Tests self-permission restrictions.
routes/permission.js	Adds authorization and permission updates.
routes/nameserver.test.js	Tests nameserver moves.
routes/nameserver.js	Adds authorization and scoped listings.
routes/log.js	Introduces audit-log endpoints.
routes/lifecycle.test.js	Tests shutdown disconnection.
routes/index.js	Registers authz, delegation, logs, and shutdown hook.
routes/group.test.js	Tests authorized group operations.
routes/group.js	Adds authorization and permission controls.
routes/delegation.js	Introduces delegation routes and caps.
package.json	Upgrades validation dependency.
lib/zone/test/mysql.js	Tests canonical lock names.
lib/zone/store/mysql.js	Adds locking, scoping, and nameserver access.
lib/zone/store/file.js	Adds uniqueness locking and scoped access.
lib/zone/store/base.js	Defines zone-name canonicalization and conflicts.
lib/zone_record/test/index.js	Tests record-type replacement.
lib/zone_record/store/mysql.js	Adds scoping, sorting, and type cleanup.
lib/zone_record/store/file.js	Adds scoped filtering and expanded sorting.
lib/user/test/index.js	Tests creation, listing, and authentication.
lib/user/store/mysql.js	Adds search, pagination, moves, and qualified login.
lib/user/store/file.js	Aligns file-backed user behavior.
lib/user/qualified.test.js	Tests qualified username parsing.
lib/user/qualified.js	Adds qualified username parsing.
lib/store-stubs.test.js	Verifies unsupported backend stubs.
lib/store-access.test.js	Enforces store-only MySQL access.
lib/session/test/index.js	Tests distinct login sessions.
lib/session/store/mysql.js	Preserves distinct sessions and activity timestamps.
lib/session/store/file.js	Serializes session creation.
lib/permission/test/index.js	Tests legacy rows and permission reuse.
lib/permission/store/mysql.js	Handles legacy rows and partial updates.
lib/permission/store/mongodb.js	Adds an explicit unsupported stub.
lib/permission/store/file.js	Expands file-backed permission behavior.
lib/permission/store/elasticsearch.js	Adds an explicit unsupported stub.
lib/permission/index.js	Dispatches additional backends.
lib/page.test.js	Tests pagination limits.
lib/page.js	Adds configurable page limits.
lib/mysql.js	Adds dedicated transactional connections.
lib/group/test/index.js	Tests ancestry rebuilding after moves.
lib/group/store/mysql.js	Rebuilds subgroup closure transactionally.
lib/group/store/file.js	Delegates permission creation to its store.
lib/file-stores.test.js	Tests file-store subsystem parity.
lib/delegation/store/mysql.js	Implements MySQL delegation persistence.
lib/delegation/store/mongodb.js	Adds an explicit unsupported stub.
lib/delegation/store/file.js	Implements file-backed delegations.
lib/delegation/store/elasticsearch.js	Adds an explicit unsupported stub.
lib/delegation/store/base.js	Defines the delegation contract.
lib/delegation/index.js	Selects the delegation backend.
lib/config.js	Adds a list-limit environment override.
lib/authz/store/mysql.js	Implements MySQL authorization queries.
lib/authz/store/mongodb.js	Adds an explicit unsupported stub.
lib/authz/store/file.js	Implements file-backed authorization queries.
lib/authz/store/elasticsearch.js	Adds an explicit unsupported stub.
lib/authz/store/base.js	Implements authorization policy.
lib/authz/index.js	Selects the authorization backend.
lib/authz-plugin.js	Enforces authorization and session validity.
lib/audit/store/mysql.js	Implements MySQL audit persistence and queries.
lib/audit/store/mongodb.js	Adds an explicit unsupported stub.
lib/audit/store/file.js	Implements file-backed audit storage.
lib/audit/store/elasticsearch.js	Adds an explicit unsupported stub.
lib/audit/store/base.js	Defines audit logging behavior.
lib/audit/index.js	Selects the audit backend.
lib/audit.test.js	Tests MySQL audit behavior.
docker/Dockerfile	Normalizes package copy syntax.
CHANGELOG.md	Documents unreleased bridge changes.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.