[shivamka1]

Stacked on #2868; retarget to db_v4 once it merges.

#2868 answers a policy fault (the policy itself failing, as opposed to a denial) on the read path with a generic "access policy is misconfigured" error and logs the detail. This applies the same rule to the places that still passed the policy's own error text through to the caller.

Write gate built on the read gate

The write gate resolved the caller's grant itself and answered a policy fault with the fault's own message under ACCESS_DENIED, and a caller with no grant at all with "WRITE permission required", which names a graph the read gate would hide. Both gates now resolve the grant through one function, so a fault and a missing grant are answered on a write exactly as on a read.

The generic error where a fault still leaked

The namespace write gate, the graph listing check and the metadata summary now answer with PermissionError::AuthPolicyError.

Caller does	Before	After
updateGraph on a graph whose policy faults	the fault's message, ACCESS_DENIED	Internal server error, access policy is misconfigured
updateGraph with no grant, namespace not visible	WRITE permission required for graph 'g'	Graph does not exist
updateGraph with no grant, namespace visible	same	Access denied: no permission for graph 'g'
graphs.list with one graph faulting	the fault's message, unlogged	Internal server error, access policy is misconfigured
newGraph when the namespace faults	the fault's message, ACCESS_DENIED	Internal server error, access policy is misconfigured
graphMetadata counts when full_read faults	the fault's message, unlogged	Internal server error, access policy is misconfigured

The last row has no test here: it is reachable only through a policy that overrides full_read, which the default policy does not.

Also corrects the comment on why a denial may name the graph: a listing hides graphs the caller has no grant on; the denial is safe because a path with no graph behind it is denied the same way.

[github-actions]

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Rust Benchmark'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 2.

Benchmark suite	Current: cc84a32	Previous: a05fce6	Ratio
lotr_graph/num_edges_temporal	365 ns/iter (± 0)	136 ns/iter (± 0)	2.68
lotr_graph/num_edges_temporal_cached	364 ns/iter (± 0)	139 ns/iter (± 1)	2.62
lotr_graph_window_100/num_edges_temporal	372 ns/iter (± 3)	149 ns/iter (± 0)	2.50
lotr_graph_window_100/num_edges_temporal_cached	373 ns/iter (± 1)	150 ns/iter (± 1)	2.49
lotr_graph_subgraph_10pc/num_nodes	16 ns/iter (± 0)	4 ns/iter (± 0)	4
lotr_graph_subgraph_10pc/num_nodes_cached	17 ns/iter (± 0)	4 ns/iter (± 0)	4.25

This comment was automatically generated by workflow using github-action-benchmark.