test(harness): add native_client helper to cluster test harness

Native protocol connections in cluster tests hand-rolled a PoolConfig
per call site, defaulting to trust user "admin" which the harness
never provisions, causing spurious auth failures. Add
TestClusterNode::native_client()/native_client_with() that always
connects as the harness's bootstrapped trust superuser, and expose it
as a shared HARNESS_SUPERUSER constant so the pgwire and native paths
can't drift apart. Update existing native-protocol tests to use the
new helper instead of constructing PoolConfig by hand.

Author: farhan-syah

Cargo.lock

@@ -89,16 +89,13 @@ fn is_serialization_abort(e: &NodeDbError) -> bool {
 /// the SAME socket and server session, so `BEGIN → read → writes → COMMIT` all
 /// share one transaction context.
 fn pinned_native_client(node: &TestClusterNode) -> NativeClient {
-    NativeClient::new(PoolConfig {
-        addr: format!("127.0.0.1:{}", node.native_port),
+    // `native_client_with` overrides `addr`/`auth` to the harness's
+    // bootstrapped superuser (see its doc comment for why the `PoolConfig`
+    // default of trust user `admin` never works against this harness); the
+    // `max_size: 1` pinning is this test's own requirement, preserved
+    // explicitly through the caller-supplied base config.
+    node.native_client_with(PoolConfig {
         max_size: 1,
-        // The cluster harness runs trust auth with `nodedb` as the sole
-        // materialized superuser; the `PoolConfig` default user is `admin`,
-        // which trust mode rejects as a non-existent identity. Authenticate as
-        // the harness superuser, matching the pgwire path (`user=nodedb`).
-        auth: nodedb_types::protocol::AuthMethod::Trust {
-            username: "nodedb".into(),
-        },
         ..Default::default()
     })
 }

nodedb-cluster-tests/tests/native_gather_join_in_txn_occ.rs

@@ -26,8 +26,6 @@
 
 use std::time::Duration;
 
-use nodedb_client::NativeClient;
-
 use crate::common::cluster_harness::{TestCluster, wait_for};
 
 const SOURCES: usize = 12;
@@ -123,9 +121,11 @@ async fn native_implicit_edge_delete_cleans_reverse_cross_node() {
         .expect("a non-sequencer-leader coordinator must exist in a 3-node cluster");
     let coordinator = &cluster.nodes[coordinator_idx];
 
-    // Connect a NativeClient to the coordinator's native listener port.
-    let native_addr = format!("127.0.0.1:{}", coordinator.native_port);
-    let native = NativeClient::connect(&native_addr);
+    // Connect a NativeClient to the coordinator's native listener port,
+    // authenticated as the harness's bootstrapped trust superuser (a bare
+    // `NativeClient::connect` defaults to trust user `admin`, which this
+    // harness never provisions).
+    let native = coordinator.native_client();
 
     // Issue the predicate DELETE via the NATIVE protocol.
     // This exercises the `edge_recon_gate::try_edge_recon_dispatch` path.

nodedb-cluster-tests/tests/sql_cluster_cross_node_dml_tests/native_implicit_edge_delete_cross_node.rs

@@ -16,6 +16,7 @@ nodedb = { workspace = true }
 nodedb-array = { workspace = true }
 nodedb-physical = { workspace = true }
 nodedb-bridge = { workspace = true }
+nodedb-client = { workspace = true, features = ["native"] }
 nodedb-cluster = { workspace = true }
 nodedb-crdt = { workspace = true }
 nodedb-mem = { workspace = true }

nodedb-test-support/Cargo.toml

@@ -35,4 +35,4 @@ mod spawn_variants;
 mod teardown;
 mod types;
 
-pub use types::TestClusterNode;
+pub use types::{HARNESS_SUPERUSER, TestClusterNode};

nodedb-test-support/src/cluster_harness/node/lifecycle/mod.rs

@@ -22,7 +22,7 @@ use nodedb::wal::WalManager;
 use crate::cluster_harness::cluster::ClusterSpawnConfig;
 
 use super::client_slot::ClusterTestClient;
-use super::types::{DataDir, TestClusterNode};
+use super::types::{DataDir, HARNESS_SUPERUSER, TestClusterNode};
 
 impl TestClusterNode {
     /// [`Self::spawn_with_full_config`] entry point used by every spawn
@@ -111,7 +111,7 @@ impl TestClusterNode {
         // `AuthMode::Trust`, which resolves — but never fabricates — a durable
         // stored identity. Without this every node rejects the harness connect
         // with `trust auth: user 'nodedb' does not exist`.
-        credentials.bootstrap_trust_superuser("nodedb")?;
+        credentials.bootstrap_trust_superuser(HARNESS_SUPERUSER)?;
         let mut shared =
             SharedState::new_with_credentials(dispatcher, Arc::clone(&wal), credentials)?;
 

nodedb-test-support/src/cluster_harness/node/lifecycle/spawn_full.rs

@@ -10,6 +10,14 @@ use nodedb::event::EventPlane;
 
 use super::client_slot::ClusterTestClient;
 
+/// The sole trust identity the cluster harness bootstraps on every node
+/// (see `spawn_full::spawn_with_full_config_at`'s
+/// `credentials.bootstrap_trust_superuser(HARNESS_SUPERUSER)`). Both the
+/// pre-wired `client` field (pgwire, `user=nodedb`) and
+/// [`super::super::native_client`]'s helper authenticate as this identity —
+/// single source of truth so the two paths cannot drift apart.
+pub const HARNESS_SUPERUSER: &str = "nodedb";
+
 /// Ownership of this node's on-disk data directory.
 ///
 /// `Owned` is the historical behaviour: the node minted its own `tempdir()`

nodedb-test-support/src/cluster_harness/node/lifecycle/types.rs

@@ -6,5 +6,6 @@
 pub mod graph;
 pub mod inspect;
 pub mod lifecycle;
+pub mod native_client;
 
 pub use lifecycle::TestClusterNode;

nodedb-test-support/src/cluster_harness/node/mod.rs

@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! Native (MessagePack) protocol client construction for [`TestClusterNode`].
+//!
+//! `NativeClient::connect` / `PoolConfig::default()` authenticate as trust
+//! user `"admin"`, but the cluster harness bootstraps exactly ONE trust
+//! identity per node — [`super::lifecycle::HARNESS_SUPERUSER`] (see
+//! `lifecycle::spawn_full`'s `credentials.bootstrap_trust_superuser(...)`),
+//! the same identity the pre-wired pgwire `client` field connects as. A bare
+//! `NativeClient::connect` against this harness therefore ALWAYS fails auth
+//! with `trust user 'admin' does not exist`. Use the helpers below instead
+//! of hand-rolling a `PoolConfig` at each test call site.
+
+use nodedb_client::NativeClient;
+use nodedb_client::native::pool::PoolConfig;
+use nodedb_types::protocol::AuthMethod;
+
+use super::lifecycle::{HARNESS_SUPERUSER, TestClusterNode};
+
+impl TestClusterNode {
+    /// A `NativeClient` pool-connected to this node's native listener,
+    /// authenticated as the harness's bootstrapped trust superuser.
+    pub fn native_client(&self) -> NativeClient {
+        self.native_client_with(PoolConfig::default())
+    }
+
+    /// Same as [`Self::native_client`], but starting from a caller-supplied
+    /// `PoolConfig` for fields the harness doesn't dictate — e.g. a test
+    /// pinning `max_size: 1` so every call rides one socket/session for an
+    /// in-transaction sequence. `addr` and `auth` are always overridden to
+    /// this node's native port and the harness superuser, so callers cannot
+    /// reintroduce the `admin` mismatch by way of `base`.
+    pub fn native_client_with(&self, base: PoolConfig) -> NativeClient {
+        NativeClient::new(PoolConfig {
+            addr: format!("127.0.0.1:{}", self.native_port),
+            auth: AuthMethod::Trust {
+                username: HARNESS_SUPERUSER.to_string(),
+            },
+            ..base
+        })
+    }
+}