refactor(db): extract authentication allowlist store

[TheSentinel454]

Current reconstructed head

Exact base: codex/issue-12-api-token-store at efd769903a0aab75961453ab247bef923f64ac38
Exact head: codex/issue-12-allowlist-store at 7ae63f6be2f3f1265b976f37756f3ca0caaffa59

This current head removes crates/buzz-db/tests/store_ownership.rs; no replacement path-sensitive ownership test is introduced. Apart from removing that complete test-file diff, the production patch is byte-for-byte identical to the previously reviewed slice. This remains part of tracker #2 and the #17/#19 acceptance work.

Independent exact-head review from a separate clean Blox workstation found no issues. Current-head evidence passed formatting, strict buzz-db clippy, 111 non-PostgreSQL library tests with 200 PostgreSQL tests ignored, the observability source test, relay consumer compilation, exact ownership/unique-span review checks, and 1 allowlist PostgreSQL test on native PostgreSQL where applicable.

Why

Complete the authentication-allowlist half of tracker #2 and domain issue #12 while keeping Db as the stable public facade. This child stacks on the API-token extraction in #6783.

What

• Add a dedicated allowlist.rs owner for AllowlistEntry, every allowlist Db method, inline SQL, focused tests, and datastore spans
• Preserve every public Db signature and the crate-root AllowlistEntry export
• Preserve community scoping, UPSERT/delete behavior, timestamps, row parsing, and validation/error behavior
• Keep NIP-43 relay membership and migration/backfill orchestration outside this authentication-allowlist module

Stack

• Exact base: codex/issue-12-api-token-store at 7798ea8 (#6783)
• Exact head: codex/issue-12-allowlist-store at fa88a64
• Tracker: buzz-db: break up lib.rs — move impl Db methods to domain modules TheSentinel454/buzz#2
• Domain: buzz-db: move misplaced types to domain modules TheSentinel454/buzz#12
• Test/span acceptance: buzz-db: move lib.rs tests (~4,000 lines) to domain modules TheSentinel454/buzz#17 and buzz-db: consistent #[datastore_span] tracing placement TheSentinel454/buzz#19

Non-goals

• No SQL, schema, validation, retry, timeout, transaction, or client-visible behavior changes
• No consolidation of authentication allowlisting with NIP-43 relay membership
• No movement of cross-domain migration/backfill orchestration
• No store traits, domain-handle redesign, broad PgExecutor migration, raw pool accessor, new crate, or directory-wide reorganization
• No changes to, retargeting of, or merge action on parent PRs or PR Add database pressure observability #6700

Risk Assessment

Low. This is a direct ownership move. The guard also prevents relay-membership backfill orchestration from drifting into the authentication allowlist owner.

Blox Verification

Author workstation: buzz-tornquist-issue-2-store-stack (2046520), exact head f30633fc37d9b44860db5644418e066a917dc113.

• cargo fmt --all --check — passed
• cargo clippy -p buzz-db -p buzz-relay --all-targets -- -D warnings — passed
• Native PostgreSQL: cargo test -p buzz-db allowlist::tests:: -- --ignored --test-threads=1 — 1 passed
• Relay public-path/all-target compilation is covered by the relay clippy invocation
• Commit-time formatting, sadscan, attribution, and sign-off hooks — passed

Independent exact-head review: buzz-tornquist-pr-6784-review (2049132) found no critical, important, or minor issues. The reviewer confirmed exact production method/test equivalence, one span per operation, and that NIP-43 backfill remains relay-membership owned.

Generated with Codex

Superseded pre-comment restack verification

PR #6700 merged before publication completed. This layer was restacked onto current main through the exact parent named above; the final cumulative tip is 2ddcc8a. Cumulative author gates passed: formatting and diff checks; buzz-db and buzz-relay all-target clippy with -D warnings; DB lib 111 passed / 200 ignored; ownership 22/22; observability 1/1; the full isolated PostgreSQL domain matrix; and relay lib 910 passed / 49 ignored.

• Workstation: buzz-tornquist-pr-6784-final-review (2057622), fresh shallow checkout
• Base: e69f4e7180eae47d96c56012f9cbea966da584e2
• Head: b7347e78843d7b63e3cb383da7cbf5ffc956d4f0
• Findings: none

Reviewed the authentication allowlist extraction. AllowlistEntry, community-scoped SQL, Db wrappers, test, and datastore spans move together to allowlist.rs; crate-root compatibility is retained. The module remains separate from NIP-43 relay membership and introduces no migration or backfill ownership change.

Verification: format and diff checks passed; buzz-db --all-targets clippy passed with -D warnings; DB lib tests passed (111 passed, 200 PostgreSQL tests ignored); ownership (4/4) and observability (1/1) guards passed; the allowlist PostgreSQL isolation test passed on native PostgreSQL 17 with migrations 1-32 successful; relay lib test target compiled successfully. Final worktree was detached at the exact head and clean.

Complete evidence archive SHA-256: a8fd059c66d343e4d98850cb67747a41cb8c6161f98f74f3577ec6cc547fab63.

Comment-addressed restack

Review follow-up on #6777 removed only the low-value replaceable ownership source test. This PR was restacked onto its rewritten parent; its production patch is unchanged.

• Exact base: 7798ea83fe393cdc457577bb09a4fd7546b9722b
• Exact head: fa88a642a7aa10ce74f8cea692653e50b427f89e
• Final cumulative tip: 6fa2f104d42c6ba85bdf62e7ccb74ceaf4a84f67
• Per-layer patch-ID and tree audits confirm this PR’s production diff is unchanged from its pre-comment head.
• Cumulative Blox gate: formatting and diff checks; strict buzz-db/buzz-relay Clippy; DB lib 111 passed / 200 ignored; ownership 21/21; observability 1/1; every moved PostgreSQL test; relay lib 910 passed / 49 ignored.
• Independent re-review at this exact head: no findings; fresh exact-parent/head Blox review passed fmt/diff, strict Clippy, DB lib 111 passed / 200 ignored, current ownership/observability guards, 1 allowlist PostgreSQL test, and relay compilation.

[wpfleger96]

🤖 Combined review from three independent passes (two source reviews + one E2E test run at exact head 7ae63f6): no blocking findings; one MINOR (non-blocking) note below.

Verified clean:

• Pure extraction: the five moved Db methods (is_pubkey_allowed, has_allowlist_entries, add_to_allowlist, remove_from_allowlist, list_allowlist), AllowlistEntry, and the allowlist_is_scoped_to_community test are byte-identical after relocation; every removed lib.rs line reappears verbatim. All five span names, community-scoping predicates, UPSERT idempotency, and delete scoping preserved. pub use allowlist::AllowlistEntry keeps the root path compiling; the live auth consumer in buzz-relay/src/handlers/auth.rs is unchanged.
• The backfill boundary is deliberate and correct: backfill_from_allowlist stays with the relay_members owner because it orchestrates NIP-43 membership writes (including the non-empty-members guard against re-adding removed members) and only reads the allowlist. Both reviewers independently concluded moving it would conflate the auth gate with membership policy.
• E2E at head on fresh Postgres: moved allowlist test 1/1; an ephemeral black-box probe of Db::backfill_from_allowlist() passed (hex conversion, member role, community scoping, non-empty guard); relay_members::tests:: 9/10 with the single failure being a known pre-existing ownership-transfer mismatch that predates this stack; cargo check -p buzz-relay passes.

MINOR (non-blocking): a third copy of the setup_db/make_community Postgres test helpers now exists across module test mods (same note left on #6782). A shared #[cfg(test)] helper module as a stack-wide follow-up would remove the duplication.

[TheSentinel454]

🤖 Superseded by #6987, which consolidates the remaining issue #2 store-extraction stack onto merged #6782. #6987 is an open draft at the independently reviewed exact head, and all exact-head CI checks are green. This PR remains available for review history; please continue review on #6987.