chore(server): bump REST API version

[imbajin]

Closeout TODO

• Publish REST API 0.72 consistently through source properties, the API
  JAR manifest, and the runtime version endpoint.
• Add GraphSpace-wide default-role mutations for existing and future graphs
  while keeping historical per-graph observer grants removable.
• Prepare the audit limiter during login so the first authenticated write
  succeeds without a warm-up request.
• Let global administrators and GraphSpace managers update or delete schema
  templates within their authority.
• Preserve the creator-owned mutation path without eagerly requiring an
  authenticator in anonymous mode.
• Keep Kubernetes peer stability in stable StatefulSet/Service DNS and
  remove the earlier Server-side PD dynamic IP/allowlist refresh.
• Use 120 columns consistently in Checkstyle, EditorConfig, contributor
  guidance, and current-PR formatting without reformatting legacy sources.
• Keep future TinkerPop 3.7 merge-step behavior outside this 3.5.1 PR.
• Resolve every current review thread.
• Finish all current-head checks except explicitly deferred Codecov and the ignored dependency-review job.
• Obtain the remaining upstream approval.

1.5–1.8 compatibility

• 1.8/current master — exposes the new API 0.72 GraphSpace and template
  authorization contract used by current Hubble.
• 1.7 — remains on the legacy API 0.71 contract; compatibility handling
  stays in the Client/Hubble boundary.
• 1.5 — unchanged; auth/PD compatibility work is outside this Server PR.

Before → After

flowchart LR
    B["Before<br/>master and 1.7 both reported API 0.71<br/>future-graph roles were incomplete<br/>first writes needed prior limiter state<br/>PD address refresh leaked into Server"]
    A["After<br/>master reports API 0.72<br/>GraphSpace-wide default roles<br/>first authenticated write works directly<br/>Kubernetes DNS owns peer stability"]
    B --> A

Loading

Area	Before	After
API capability	Current master was indistinguishable from 1.7	Current master reports API 0.72
GraphSpace roles	Observer grants were tied to known graphs	The all-graphs target covers existing and future graphs
First write	Audit limiting could be initialized after the first mutation	Login prepares the limiter before authenticated writes
Template ownership	Manager checks could eagerly require auth state	Owners keep the direct path; managers use scoped authorization
Kubernetes peers	Server contained PD-driven dynamic address refresh	Stable StatefulSet/Service DNS remains the single owner
Source style	Java wrapping guidance stopped at 100 columns	New and current-PR code uses a single 120-column threshold

Current state

• Server head: 7083242676277b2536614e4804c4f93313707bed
• Product source matches validated 28641f54; the only later diff is the dependency-review Action upgrade
• Previous matching-tree checks: 21/21 passed
• Unresolved review threads: 0
• GitHub checks: 20 effective checks passed; Codecov is deferred and dependency-review v5 was canceled/ignored after stalling on the oversized summary
• Merge gate: upstream review required

[codecov]

Codecov Report

❌ Patch coverage is 0% with 118 lines in your changes missing coverage. Please review.
✅ Project coverage is 0.34%. Comparing base (431f6e6) to head (7083242).

Files with missing lines	Patch %	Lines
.../org/apache/hugegraph/auth/HugeGraphAuthProxy.java	0.00%	61 Missing ⚠️
.../org/apache/hugegraph/api/space/GraphSpaceAPI.java	0.00%	20 Missing ⚠️
...a/org/apache/hugegraph/auth/HugeAuthenticator.java	0.00%	10 Missing ⚠️
...java/org/apache/hugegraph/api/auth/ManagerAPI.java	0.00%	9 Missing ⚠️
...g/apache/hugegraph/auth/StandardAuthManagerV2.java	0.00%	8 Missing ⚠️
.../apache/hugegraph/api/space/SchemaTemplateAPI.java	0.00%	7 Missing ⚠️
...n/java/org/apache/hugegraph/core/GraphManager.java	0.00%	3 Missing ⚠️

❗ There is a different number of reports uploaded between BASE (431f6e6) and HEAD (7083242). Click for more details.

HEAD has 4 uploads less than BASE

Flag	BASE (431f6e6)	HEAD (7083242)
	5	1

Additional details and impacted files

@@             Coverage Diff              @@
##             master   #3159       +/-   ##
============================================
- Coverage     41.06%   0.34%   -40.72%     
+ Complexity      519      74      -445     
============================================
  Files           771     749       -22     
  Lines         65962   63520     -2442     
  Branches       8766    8345      -421     
============================================
- Hits          27088     220    -26868     
- Misses        36008   63277    +27269     
+ Partials       2866      23     -2843     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[imbajin]

Why this branch contains PD Raft changes

The PD change in 3d9d9544 is independent of the REST API 0.72 bump. It was identified while preparing the real 3-PD distributed matrix, where PD peers use stable hostnames but container/Pod IPs may change after restart or membership updates.

Before:

• IpAuthHandler resolved peer hostnames only at startup or an explicit peer-list update;
• the same hostname resolving to a new Pod IP could leave the Raft allowlist stale and reject a valid peer;
• peer changes could update Raft membership without a reliably synchronized allowlist;
• a fully unresolved/empty result followed the old allow-all path;
• resolver, singleton, RPC-server and failed-start cleanup were incomplete.

After:

• configured/runtime peer addresses are normalized and bounded before use;
• DNS resolution has timeout, concurrency and stale-entry limits, with background refresh;
• successful membership changes refresh the active allowlist;
• startup/shutdown failures clean the resolver, handler and RPC resources;
• unit, service-update and Raft integration tests cover these boundaries.

Most of the apparent size is defensive behavior and tests: this commit is +1375/-226, including about 700 added test lines and relocation/expansion of the old IpAuthHandlerTest.

Scope note: this is not required to distinguish API 0.71 from 0.72, nor by the Hubble permission capability itself. It should be reviewed as a standalone PD reliability/security change (and preferably split from the API-version PR). Passing tests do not replace the pending final 3+3+3 runtime validation.

Scope freeze

The Hubble dependency is limited to the API 0.72 contract and the GraphSpace-wide default-role behavior. The PD Raft DNS/IP work is independent and must not grow further except for a blocker reproduced by the required 3+3+3 runtime. It should remain separately reviewable/splittable from the Hubble compatibility change.

[imbajin]

Blocking: yes. Summary: No actionable code defect was independently confirmed at this head. Approval remains blocked by the current codecov/project failure. Evidence: Java 11 targeted tests passed: PD auth/raft 20/20, PDService raft update 6/6, GraphSpace API 13/13; current checks show codecov/project FAILURE.

[imbajin]

Blocking: yes. Summary: The new Gremlin mutation pre-check misses TinkerPop merge steps, so execute-only users can reach mutation paths without a required WRITE check. Evidence: traversalPermissions() only recognizes AddVertexStartStep, AddVertexStep, AddEdgeStartStep, AddEdgeStep, AddPropertyStep, and DropStep at HugeGraphAuthProxy.java:2533-2541; TinkerPop 3.7.6 also has MergeVertexStep and MergeEdgeStep, whose on-match path can call Vertex.property directly. Please classify both merge steps as WRITE (including nested children) and add execute-only regression tests for mergeV/mergeE create and onMatch cases.

[imbajin]

Blocking: yes. Summary: The current head has authorization correctness and isolation regressions in GraphSpace role checks, Gremlin mutation enforcement, and callback context cleanup. Evidence: exact-head static review plus six independent read-only lanes; latest checks pass for builds/Docker/CodeQL, while dependency-review is cancelled and Codecov failures are non-blocking.

[imbajin]

‼️ Critical: A space-wide OBSERVER is persisted through createSpaceDefaultRole() under the ALL_GRAPHS marker, but this graph-specific branch checks only isDefaultRole(name, graph, user, defaultRole). A user with the new space-wide role is therefore reported as false when the same check includes a concrete graph parameter; the parallel ManagerAPI path has the same omission. Please treat the ALL_GRAPHS role as covering the requested graph, and add a regression test for both endpoints.

[imbajin]

⚠️ Important: This new authorization shortcut returns true when the operator is a SPACE manager for the current graph space and the target grant merely contains an entry for that space. UserAPI.role() then serializes the complete rolePermission(user) object, so a space-a manager can read the space-b entries of a multi-space grant. Please return a graph-space-scoped projection (or reject mixed grants) before allowing this path, and add a cross-space response-isolation test.

[imbajin]

‼️ Critical: The classifier only recognizes concrete Add*, AddPropertyStep, and DropStep instances. A Groovy lambda such as g.V().sideEffect { it.get().property('k', 'v') } contains none of these steps, while vertices() returns raw graph elements whose property() mutates the backend directly. An EXECUTE-only user can therefore bypass the new WRITE check. Please reject or sandbox lambda mutations, or route element mutations through an authorized proxy; add an execute-only strategy-level regression that calls apply() rather than only reflecting over the classifier.

[imbajin]

‼️ Critical: The previous gRPC listener wrapper cleared authentication state in finally; this path now scopes only AuthContext through runAsAdmin(). HugeGraphAuthProxy.CONTEXTS is an InheritableThreadLocal, and REQUEST_GRAPH_SPACE is not cleared here, so a reused or inherited listener thread can retain a prior request identity/graph space after the callback or an exception. Please clear or save/restore all auth thread-locals at this listener boundary in finally, and add a thread-reuse/exception regression test.

[imbajin]

⚠️ Important: TinkerPop's TraversalStrategies.toList() contract requires an immutable list, and both the interface default and DefaultTraversalStrategies wrap their result with Collections.unmodifiableList. This override returns a mutable ArrayList, allowing callers to add/remove strategy proxies and changing the public API contract. Please return Collections.unmodifiableList(proxies) and add an immutability regression test.

[imbajin]

⚠️ Important: Removing the old **/Dockerfile* filter leaves the repository's docker/hbase/** tree outside every pull_request.paths entry, although it still contains a Dockerfile, entrypoint, and HBase configuration. Changes to that image will no longer trigger Docker Build CI and can merge without any image validation. Please retain docker/hbase/** in the trigger or add a dedicated HBase build job with checks appropriate to that image.

[imbajin]

⚠️ Important: Space-wide OBSERVER deletion removes the ALL_GRAPHS role first and then performs independent per-graph deletes. If any later metadata delete fails, the request returns an error while the global role is already gone and some legacy graph-level grants remain active, leaving authorization state partially migrated. Please make this migration transactional or explicitly idempotent/resumable with compensation, and cover an injected mid-loop failure.

[looksaw2]

Superseded by hugegraph#198. The reviewed fixes and remaining compatibility acceptance are now tracked in the organization repository; please close this ASF PR.

[imbajin]

Blocking: yes. Summary: The selected head still has unresolved authorization and lifecycle correctness risks, and the workflow's exact-head runs are waiting for maintainer approval. Evidence: current-head checks show seven action_required workflow runs; the inline findings below are independent of that external gate.

[imbajin]

‼️ Critical
Blocking: yes. Summary: The new traversal pre-check maps data mutations to ResourceType.GREMLIN WRITE/DELETE, so existing roles with data-resource WRITE/DELETE plus GREMLIN EXECUTE are rejected even though the public Gremlin contract only grants gremlin_execute. Evidence: lines 2469-2475 call verifyNamePermission with ResourceType.GREMLIN, while the existing role fixtures grant WRITE on VERTEX and EXECUTE on GREMLIN; resource matching is type-specific. Please check the actual graph data resource or introduce and migrate explicit GREMLIN WRITE/DELETE permissions with compatibility tests.

[imbajin]

‼️ Critical
Blocking: yes. Summary: This new public admin closure can be invoked by untrusted Gremlin reflection unless it is explicitly hidden, and it changes the caller seen by every operation in the closure to User.ADMIN. Evidence: runAsAdmin() sets AuthContext to User.ADMIN at lines 207-211, getContext() gives that context priority at lines 221-225, while HugeFactoryAuthProxy.registerPrivateActions() filters getContext/resetContext but does not filter runAsAdmin. Please make this trusted bridge non-public or add it to the script method denylist, and add an unauthorized Gremlin regression test.

[imbajin]

⚠️ Important
Blocking: yes. Summary: Space-wide OBSERVER cleanup only visits graphs currently returned by manager.graphs(name), so a legacy <graph>_observer role for a graph deleted earlier is never removed and can become active again if that graph name is recreated. Evidence: this loop is the only legacy-role cleanup at lines 276-280, while GraphManager.dropGraph() removes graph config before clearing the backend and does not remove the graph-scoped auth metadata. Please enumerate legacy observer roles from auth metadata or clean them during graph deletion, and cover delete/recreate with a user and group.

[imbajin]

‼️ Critical
Blocking: yes. Summary: The new HStore schema clear is protected only by GRAPH_LOCK, but schema writes use independent per-type/per-id locks, so a concurrent schema write can recreate metadata after super.clear() and leave it inconsistent with the subsequently cleared store. Evidence: StandardHugeGraph.clearBackend() calls CachedSchemaTransactionV2.clear() at line 523, while SchemaTransactionV2.saveSchema() and removeSchema() acquire only hugeType2Group(schema.type()) locks. Please coordinate clear with the same graph-wide/distributed schema-write lock and add a concurrent clear/write regression.

[imbajin]

⚠️ Important
Blocking: no. Summary: HStore clear now broadcasts schema-cache-clear directly, and storeProvider.clear() immediately emits STORE_CLEAR, whose listener calls clearCache(true) and broadcasts the same event again under the default task.sync_deletion=false. Evidence: the new notifySchemaCacheClear() at line 470 follows clearCache(false), while the existing STORE_CLEAR listener uses notify = !STORE_INIT and clearCache(true). Please make one layer own the broadcast or add a clear-operation guard, and verify the event is emitted once.

[imbajin]

⚠️ Important
Blocking: no. Summary: This check validates the manifest and version.properties against separate source literals, but it does not verify the version returned by the runtime endpoint or that the two API version representations are equivalent. Evidence: ApiVersion.VERSION prefers the API JAR manifest and VersionAPI returns it, so this head can pass with manifest 0.72.0.0 and property 0.72; lines 112-118 compare each artifact independently and never exercise /versions. Please compare normalized canonical values and assert the packaged runtime API response as well.