refactor(hubble): unify auth and permission modes

[imbajin]

Closeout TODO

• Unify auth/non-auth client boundaries and keep only four presets: global administrator, GraphSpace read-only, GraphSpace read-write, and GraphSpace administrator.
• Separate account IDs from usernames, restore membership before GraphSpace grants, compensate response-lost writes, and remove new accounts after any authorization failure.
• Keep new-account work proportional to requested GraphSpaces; reserve full permission reconciliation for updates.
• Keep anonymous graph access separate from auth management, including graphs and GraphSpaces named auth.
• Pass the full 1.8 distributed-auth acceptance path: 1 Server + 3 PD + 3 Store + 1 Hubble, three GraphSpaces, at least two graphs per space, three representative users, and built-in admin.
• Complete Chrome allow/deny, member management, global administration, Operations, account-switch, and first-write paths.
• Complete the 1.7 compatibility paths with legacy profile reads, explicit read-only profile capability, password access, and fail-closed account management.
• Keep the public bootstrap config limited to mode flags, and show upgrade
  guidance when a legacy service does not provide an individual Operations metric.
• Filter authenticated GraphSpace discovery by current access, reject protected
  GraphSpaces through anonymous graph routes, and keep legacy membership visible.
• Validate URI and request-body GraphSpace scopes before Loader, upload,
  Vermeer, or graph controller work; keep non-auth resource errors on-page.
• Bind clone targets, global Ingest tasks, Gremlin collections, and
  execution-history IDs to their owning GraphSpace/graph scope.
• Keep read-only presets read-only across Loader/Ingest/query mutations,
  and apply scoped predicates in the final database update/delete operation.
• Use the shared 120-column threshold in Toolchain/Hubble and compact only current-PR code without reformatting legacy sources.
• Resolve all current review threads on #27 and #758.
• Keep speculative TinkerPop 3.7 merge-step work outside the current 3.5.1
  Server scope and resolve all threads on #3159.
• Keep Codecov explicitly deferred without weakening its gate or adding
  coverage-only code. The new 02cbe0e4 current-head checks are running on Support customized date format #27/refactor(hubble): unify auth and permission modes #758; the existing correctness/design/security reviewers are Clean.
• Complete the 1.5.0 standalone non-auth read, write, and Graph
  visualization smoke; remove its task-only runtime resources.
• Remove fixed credentials, temporary users/data, and remaining task-only
  resources; preserve the shared Maven cache.

1.5–1.8 compatibility/usability

• 1.5 · standalone · non-auth — anonymous schema/vertex write, separate
  read, and one-node Graph visualization passed; resources cleaned. Auth, PD,
  Operations, and distributed combinations are N/A for this acceptance scope.
• 1.7 · standalone · non-auth — graph read and Gremlin passed; resources cleaned.
• 1.7 · standalone · auth — admin/ordinary login and legacy profile capability passed; resources cleaned.
• 1.7 · distributed · non-auth — 1+1+1 topology and Hubble flows passed; resources cleaned.
• 1.7 · distributed · auth — 1+1+1 login/profile/account boundaries passed; resources cleaned.
• 1.8 · standalone · non-auth — core flow and latest anonymous auth-named graph delta passed; resources cleaned.
• 1.8 · standalone · auth — account and profile flows passed; resources cleaned.
• 1.8 · distributed · non-auth — topology, Operations, and anonymous template lifecycle passed; resources cleaned.
• 1.8 · distributed · auth — full 1+3+3 permission and usability scope passed; resources cleaned.

Non-auth compatibility snapshots

1.5.0 · standalone · non-auth	1.8/current · standalone · non-auth
Anonymous schema/vertex write followed by a separate read; Graph view renders one node.	Anonymous graph query renders two vertices and one edge.

Before → After

flowchart LR
    B["Before<br/>auth and non-auth paths diverged<br/>permission checks crossed client boundaries<br/>cluster state was hard to interpret"]
    A["After<br/>session client vs anonymous client<br/>four explicit permission presets<br/>version differences at Client compatibility boundary<br/>Operations exposes health, freshness, capacity, and recovery"]
    B --> A

Loading

Area	Before	After
Connection	Auth mode and anonymous mode followed different implicit paths	Auth uses the session client; non-auth uses a real anonymous client
Permission model	GraphSpace/member/graph capabilities were difficult to reason about together	Four presets define scope and write boundaries; custom permissions are out of scope
Compatibility	Version conditions could leak into pages and controllers	Compatibility stays in the Client layer; 1.8 uses API 0.72 and the matching Server contract
Operations	Cluster state required implementation-specific discovery behavior	Operations shows node availability, freshness, size/capacity, Store status, and recovery guidance

Compatibility scope

The complete data and permission path is intentionally limited to 1.8 distributed auth. Version 1.7 proves the thinner compatibility boundary, including the API 0.71 profile and membership behavior. Version 1.5 is limited to standalone non-auth core graph access; unsupported combinations are marked N/A instead of becoming placeholder TODOs.

Current CI gate

Current Toolchain head is 02cbe0e4. The final permission delta validates
direct URI/body scopes and indirect owner scopes for clone, Ingest, Loader,
upload, Vermeer, Gremlin collections, and execution history. Non-auth
resource-level 401 errors remain on-page instead of redirecting to a disabled
login route. Read-only users cannot mutate Loader/Ingest/query state; visible
Ingest filtering and pagination run in the database, and final writes include
scope predicates. The exact anonymous scoped auth-state endpoint remains
readable while nested auth-management routes stay protected. Password-only
updates omit unchanged permission fields; true combined password/permission
changes are rejected before any write. The final legacy fail-closed delta passes 77/77 focused backend tests with\nCheckstyle 0. The switcher also clears a revoked PD GraphSpace when the masked\ngraph-list response is 404; its focused frontend suite passes 20/20 and ESLint\nis clean; the preceding Account UI tests pass 19/19 with ESLint and i18n
clean.
Fork #27 and Apache #758 point to the same current head and have no unresolved\nthread; non-Codecov current-head checks are running on both PRs. Codecov project remains failed and explicitly deferred rather than counted as
passing. The existing correctness/design/security
reviewers are Clean on the final Toolchain delta. Server #3159 removed speculative TinkerPop 3.7 merge-step work. Product
source still matches the validated 28641f54; only the dependency-review
Action upgrade follows it, and current-head CI is running.

[codecov]

Codecov Report

❌ Patch coverage is 62.93980% with 474 lines in your changes missing coverage. Please review.
✅ Project coverage is 45.36%. Comparing base (b066b80) to head (83c2147).
⚠️ Report is 218 commits behind head on master.

Files with missing lines	Patch %	Lines
...org/apache/hugegraph/service/auth/UserService.java	61.15%	67 Missing and 27 partials ⚠️
.../hugegraph/controller/ingest/IngestController.java	31.34%	39 Missing and 7 partials ⚠️
.../hugegraph/service/auth/GraphSpaceUserService.java	81.66%	18 Missing and 26 partials ⚠️
...rg/apache/hugegraph/controller/BaseController.java	59.09%	18 Missing and 9 partials ⚠️
...che/hugegraph/service/space/GraphSpaceService.java	77.86%	14 Missing and 13 partials ⚠️
...graph/controller/algorithm/OltpAlgoController.java	0.00%	26 Missing ⚠️
...raph/controller/auth/GraphSpaceUserController.java	41.66%	17 Missing and 4 partials ⚠️
...ache/hugegraph/service/load/JobManagerService.java	0.00%	18 Missing ⚠️
...gegraph/controller/space/GraphSpaceController.java	37.50%	9 Missing and 6 partials ⚠️
...hugegraph/service/query/ExecuteHistoryService.java	0.00%	15 Missing ⚠️
... and 28 more

Additional details and impacted files

@@              Coverage Diff              @@
##             master     #758       +/-   ##
=============================================
- Coverage     62.49%   45.36%   -17.14%     
- Complexity     1903     4254     +2351     
=============================================
  Files           262      601      +339     
  Lines          9541    28872    +19331     
  Branches        886     3348     +2462     
=============================================
+ Hits           5963    13097     +7134     
- Misses         3190    14501    +11311     
- Partials        388     1274      +886     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[imbajin]

Blocking: yes. Summary: No additional actionable source-level finding was confirmed, but this PR is not approvable until the required review evidence and failing latest-head checks are resolved. Evidence: targeted Hubble authorization tests 72/72, frontend auth/route suites 90/90, and ServerCompatibilityTest 2/2; failed checks: hubble-ci (11, 3.11), codecov/patch, codecov/project.