Authz refactor w/ orthogonal capabilities

Cargo.toml

@@ -68,6 +68,7 @@ crossterm = "0"
 csv = "1"
 dirs = "6"
 encoding_rs = { version = "0", features = ["serde"] }
+enumset = { version = "1", features = ["serde"] }
 flate2 = { version = "1", features = ["zlib-rs"] }
 futures = "0"
 futures-core = "0"

crates/agent/src/integration_tests/user_publications.rs

@@ -139,18 +139,18 @@ async fn test_user_publications() {
         )
         .await;
     assert!(!dog_result.status.is_success());
-    insta::assert_debug_snapshot!(dog_result.errors, @r###"
+    insta::assert_debug_snapshot!(dog_result.errors, @r#"
     [
         (
             "flow://unauthorized/cats/noms",
             "User is not authorized to read this catalog name",
         ),
         (
             "flow://materialization/dogs/materialize",
-            "Specification 'dogs/materialize' is not read-authorized to 'cats/noms'.\nAvailable grants are: [\n  {\n    \"subject_role\": \"dogs/\",\n    \"object_role\": \"dogs/\",\n    \"capability\": \"write\"\n  },\n  {\n    \"subject_role\": \"dogs/\",\n    \"object_role\": \"ops/dp/public/\",\n    \"capability\": \"read\"\n  }\n]",
+            "Specification 'dogs/materialize' is not read-authorized to 'cats/noms'.\nAvailable grants are: [\n  {\n    \"subject_role\": \"dogs/\",\n    \"object_role\": \"dogs/\",\n    \"capability\": \"write\",\n    \"bundles\": []\n  },\n  {\n    \"subject_role\": \"dogs/\",\n    \"object_role\": \"ops/dp/public/\",\n    \"capability\": \"read\",\n    \"bundles\": []\n  }\n]",
         ),
     ]
-    "###);
+    "#);
 
     // Add a user_grant for dogs and assert that a subsequent publication still fails for lack of a role_grant.
     harness
@@ -164,14 +164,14 @@ async fn test_user_publications() {
         )
         .await;
     assert!(!dog_result.status.is_success());
-    insta::assert_debug_snapshot!(dog_result.errors, @r###"
+    insta::assert_debug_snapshot!(dog_result.errors, @r#"
     [
         (
             "flow://materialization/dogs/materialize",
-            "Specification 'dogs/materialize' is not read-authorized to 'cats/noms'.\nAvailable grants are: [\n  {\n    \"subject_role\": \"dogs/\",\n    \"object_role\": \"dogs/\",\n    \"capability\": \"write\"\n  },\n  {\n    \"subject_role\": \"dogs/\",\n    \"object_role\": \"ops/dp/public/\",\n    \"capability\": \"read\"\n  }\n]",
+            "Specification 'dogs/materialize' is not read-authorized to 'cats/noms'.\nAvailable grants are: [\n  {\n    \"subject_role\": \"dogs/\",\n    \"object_role\": \"dogs/\",\n    \"capability\": \"write\",\n    \"bundles\": []\n  },\n  {\n    \"subject_role\": \"dogs/\",\n    \"object_role\": \"ops/dp/public/\",\n    \"capability\": \"read\",\n    \"bundles\": []\n  }\n]",
         ),
     ]
-    "###);
+    "#);
 
     // Add the role grant, and now dogs can materialize cats/noms
     harness

crates/control-plane-api/Cargo.toml

@@ -44,6 +44,7 @@ chrono = { workspace = true }
 clap = { workspace = true }
 colored_json = { workspace = true }
 derivative = { workspace = true }
+enumset = { workspace = true }
 futures = { workspace = true }
 humantime = { workspace = true }
 humantime-serde = { workspace = true }

crates/control-plane-api/src/server/mod.rs

@@ -317,6 +317,9 @@ fn ops_suffix(task: &snapshot::SnapshotTask) -> String {
 
 const fn map_capability_to_gazette(capability: models::Capability) -> u32 {
     match capability {
+        models::Capability::None => {
+            panic!("gazette capability mapping requires Read, Write, or Admin")
+        }
         models::Capability::Read => {
             proto_gazette::capability::LIST | proto_gazette::capability::READ
         }