test(node): real-node deny harness for trust-boundary regressions (owner-gated mutations, path-scoped reads, client-surfaced denials)

.github/workflows/pr-checks.yml

@@ -96,6 +96,16 @@ jobs:
           DATABASE_URL: postgres://postgres:postgres@localhost:5432/gitlawb_test
         run: cargo test --workspace
 
+      # The real-node deny harness is behind the `test-harness` feature (so its
+      # spawn surface never compiles into the production binary), which means
+      # `--workspace` above skips it. Run it explicitly so the trust-boundary
+      # regression cases (INV-1/INV-2/INV-8) execute on every PR. Uses the same
+      # Postgres service; `#[sqlx::test]` provisions an isolated DB per test.
+      - name: cargo test (real-node deny harness)
+        env:
+          DATABASE_URL: postgres://postgres:postgres@localhost:5432/gitlawb_test
+        run: cargo test -p gitlawb-node --features test-harness --test deny_harness
+
   build-release:
     name: build --release
     runs-on: ubuntu-latest

crates/gitlawb-node/Cargo.toml

@@ -6,10 +6,28 @@ edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
 
+[lib]
+name = "gitlawb_node"
+path = "src/lib.rs"
+
 [[bin]]
 name = "gitlawb-node"
 path = "src/main.rs"
 
+# Exposes the `test_harness` spawn surface (src/test_harness.rs) to the
+# real-node deny-harness integration crate. Off by default so the production
+# binary never compiles test-only boot code. Enable with
+# `cargo test -p gitlawb-node --features test-harness`.
+[features]
+test-harness = []
+
+# Only builds when `test-harness` is enabled; otherwise skipped (not an error),
+# so `cargo test --workspace` without the feature stays green.
+[[test]]
+name = "deny_harness"
+path = "tests/deny_harness.rs"
+required-features = ["test-harness"]
+
 [dependencies]
 gitlawb-core = { path = "../gitlawb-core" }
 ed25519-dalek = { workspace = true }
@@ -77,3 +95,12 @@ libp2p-dns = { version = "0.44.0", features = ["tokio"] }
 [dev-dependencies]
 mockito = "1"
 tempfile = "3"
+# test-util enables tokio::test(start_paused): the delayed claim re-sweep
+# test drives the real CLAIM_SWEEP_MIN_AGE-plus-margin sleep on paused time.
+tokio = { workspace = true, features = ["test-util"] }
+# Used by the deny-harness integration crate (tests/deny_harness.rs): the
+# #[sqlx::test] macro for an ephemeral per-test pool, and reqwest as the real
+# HTTP client that drives deny paths over the socket.
+sqlx = { version = "0.8", features = ["postgres", "runtime-tokio-rustls", "macros", "migrate"] }
+reqwest = { workspace = true }
+hex = "0.4"

crates/gitlawb-node/src/config.rs

@@ -162,8 +162,10 @@ pub struct Config {
     pub metrics_addr: String,
 
     /// Maximum time to wait for in-flight requests to drain on shutdown, in
-    /// seconds. After this elapses, the server returns 503 to anything still
-    /// in flight and exits. Default: 30s.
+    /// seconds. On the shutdown signal the server stops accepting new
+    /// connections and gives in-flight requests this long to complete; at
+    /// expiry it abandons whatever remains (clients observe a closed
+    /// connection, not an error response) and exits. Default: 30s.
     #[arg(long, env = "GITLAWB_SHUTDOWN_GRACE_SECS", default_value_t = 30)]
     pub shutdown_grace_secs: u64,
 

crates/gitlawb-node/src/db/mod.rs

@@ -255,7 +255,7 @@ impl Db {
         &self.pool
     }
 
-    #[cfg(test)]
+    #[cfg(any(test, feature = "test-harness"))]
     pub fn for_testing(pool: PgPool) -> Self {
         Self { pool }
     }
@@ -264,7 +264,7 @@ impl Db {
     /// provisions an empty per-test database, so DB-backed tests must run this
     /// before seeding. Reuses the production `migrate()` path (the advisory lock
     /// is harmless on an isolated test DB and migrations are idempotent).
-    #[cfg(test)]
+    #[cfg(any(test, feature = "test-harness"))]
     pub(crate) async fn run_migrations(&self) -> Result<()> {
         self.migrate().await
     }

crates/gitlawb-node/src/git/repo_store.rs

@@ -33,7 +33,7 @@ pub struct RepoStore {
 }
 
 impl RepoStore {
-    #[cfg(test)]
+    #[cfg(any(test, feature = "test-harness"))]
     pub fn for_testing(repos_dir: PathBuf, pool: PgPool) -> Self {
         Self {
             repos_dir,