test(security): split pgwire auth tests and add session handle security coverage

Break the monolithic `pgwire_auth.rs` into focused files by concern:
`pgwire_auth_wire.rs` (connection setup), `pgwire_auth_users.rs` (user
DDL), `pgwire_auth_tenants.rs` (tenant DDL), `pgwire_auth_grants.rs`
(GRANT / REVOKE), `pgwire_auth_show.rs` (SHOW commands), and
`pgwire_auth_audit.rs` (audit trail assertions). Shared helpers move to
`tests/common/pgwire_auth_helpers.rs`.

Add `session_handle_fingerprint_wire.rs`: wire-level tests for the
`ClientFingerprint` binding path — covers Strict, Subnet, and Disabled
modes against seeded handles with matching and mismatching origins.

Add `session_handle_security.rs`: unit-style integration tests for
rate-limit enforcement (SQLSTATE 53300 after cap exceeded) and miss-spike
audit emission.

Expose `shared: Arc<SharedState>` on `PgWireHarness` so tests can seed
session-handle state before hitting the wire.

Author: farhan-syah

nodedb/tests/common/mod.rs

@@ -1,6 +1,7 @@
 //! Shared helpers for integration tests.
 
 pub mod cluster_harness;
+pub mod pgwire_auth_helpers;
 pub mod pgwire_harness;
 
 use nodedb::event::cdc::event::CdcEvent;

nodedb/tests/common/pgwire_auth_helpers.rs

@@ -0,0 +1,66 @@
+//! Shared fixtures for `pgwire_auth_*` integration tests.
+//!
+//! Each split test file needs: a minimal `SharedState`, two canonical
+//! identities (superuser + readonly), and two DDL runners (expect ok /
+//! expect err). Keeping them here avoids copy-paste drift across files.
+
+#![allow(dead_code)]
+
+use std::sync::Arc;
+
+use nodedb::bridge::dispatch::Dispatcher;
+use nodedb::control::security::identity::{AuthMethod, AuthenticatedIdentity, Role};
+use nodedb::control::server::pgwire::ddl;
+use nodedb::control::state::SharedState;
+use nodedb::types::TenantId;
+use nodedb::wal::WalManager;
+
+/// Create a minimal `SharedState` (no Data Plane needed for DDL tests).
+pub fn make_state() -> Arc<SharedState> {
+    let dir = tempfile::tempdir().unwrap();
+    let wal_path = dir.path().join("test.wal");
+    let wal = Arc::new(WalManager::open_for_testing(&wal_path).unwrap());
+    let (dispatcher, _data_sides) = Dispatcher::new(1, 64);
+    SharedState::new(dispatcher, wal)
+}
+
+/// Superuser identity for DDL tests.
+pub fn superuser() -> AuthenticatedIdentity {
+    AuthenticatedIdentity {
+        user_id: 0,
+        username: "admin".into(),
+        tenant_id: TenantId::new(0),
+        auth_method: AuthMethod::Trust,
+        roles: vec![Role::Superuser],
+        is_superuser: true,
+    }
+}
+
+/// Readonly identity for permission tests.
+pub fn readonly_user() -> AuthenticatedIdentity {
+    AuthenticatedIdentity {
+        user_id: 99,
+        username: "viewer".into(),
+        tenant_id: TenantId::new(1),
+        auth_method: AuthMethod::Trust,
+        roles: vec![Role::ReadOnly],
+        is_superuser: false,
+    }
+}
+
+/// Run DDL, expect success.
+pub async fn ddl_ok(state: &SharedState, identity: &AuthenticatedIdentity, sql: &str) {
+    let result = ddl::dispatch(state, identity, sql).await;
+    assert!(result.is_some(), "DDL not recognized: {sql}");
+    result
+        .unwrap()
+        .unwrap_or_else(|e| panic!("DDL failed: {sql}: {e}"));
+}
+
+/// Run DDL, expect error; return the error string for assertions.
+pub async fn ddl_err(state: &SharedState, identity: &AuthenticatedIdentity, sql: &str) -> String {
+    let result = ddl::dispatch(state, identity, sql).await;
+    assert!(result.is_some(), "DDL not recognized: {sql}");
+    let err = result.unwrap().unwrap_err();
+    err.to_string()
+}

nodedb/tests/common/pgwire_harness.rs

@@ -18,6 +18,11 @@ use nodedb::wal::WalManager;
 pub struct TestServer {
     pub client: tokio_postgres::Client,
     pub pg_port: u16,
+    /// Underlying shared state — exposed so integration tests can drive
+    /// store-level side effects (e.g. seeding a session handle with a
+    /// specific `ClientFingerprint`) before hitting the wire.
+    #[allow(dead_code)]
+    pub shared: Arc<SharedState>,
     _conn_handle: tokio::task::JoinHandle<()>,
     shutdown_bus: nodedb::control::shutdown::ShutdownBus,
     poller_shutdown_tx: tokio::sync::watch::Sender<bool>,
@@ -151,6 +156,7 @@ impl TestServer {
         Self {
             client,
             pg_port: pg_addr.port(),
+            shared,
             _conn_handle: conn_handle,
             shutdown_bus,
             poller_shutdown_tx,