feat(rbac): wire RBAC into RESP and binary servers

README.md

@@ -145,6 +145,8 @@ Every option is available as a flag and an environment variable.
 | `--tls-cert`          | `TSD_TLS_CERT`           | _(none)_         | TLS certificate path; watched for automatic rotation     |
 | `--tls-key`           | `TSD_TLS_KEY`            | _(none)_         | TLS private key path; watched for automatic rotation     |
 | `--tls-ca`            | `TSD_TLS_CA`             | _(none)_         | Client CA path for mTLS; watched for automatic rotation  |
+| `--require-pass`      | `TSD_REQUIRE_PASS`       | _(none)_         | Single password required via `AUTH`; empty disables it   |
+| `--rbac-config`       | `TSD_RBAC_CONFIG`        | _(none)_         | YAML/JSON RBAC policy file (roles, users, default role); hot-reloaded on SIGHUP |
 | `--shutdown-timeout`  | `TSD_SHUTDOWN_TIMEOUT`  | `10s`            | Max wait for graceful shutdown on SIGINT/SIGTERM         |
 
 Runtime tuning (environment only): `TSD_GC_PERCENT` (default `-1`, GC off for a zero‑GC hot
@@ -172,8 +174,45 @@ redis-cli -p 6379 SET k v EX 60   # OK (60s TTL)
 redis-cli -p 6379 DEL foo         # (integer) 1
 ```
 
-Supported commands today: **`PING`, `GET`, `SET` (with `EX`/`PX`), `DEL`**. Unknown commands
-return a `-ERR` reply without dropping the connection.
+Supported commands today: **`PING`, `GET`, `SET` (with `EX`/`PX`), `DEL`, `AUTH`, `ROLE`
+(`CREATE`/`SETUSER`/`DELUSER`/`DELETE`/`LIST`/`GETUSER`)**. Unknown commands return a `-ERR`
+reply without dropping the connection.
+
+#### Authentication & RBAC
+
+Start with `--require-pass` for a single shared password, or `--rbac-config` for per-user
+authentication with role-based access control (supersedes `--require-pass`):
+
+```yaml
+# policy.yaml — loaded at startup and hot-reloaded on SIGHUP.
+# Passwords are bcrypt hashes, e.g. of "adminsecret" / "alicepw"; a password
+# is required unless the user is explicitly marked nopass.
+roles:
+  - name: admin
+    rules: ["+@all", "~*"]
+  - name: readonly
+    rules: ["+get", "~*"]
+users:
+  - name: admin
+    role: admin
+    password: "$2a$10$pcaKkTfRy.KSdNUgKszYYedE7L32P9fSEG3x1phq0EbjeYkn5WpEi"
+  - name: alice
+    role: readonly
+    password: "$2a$10$sslrTYVwaIaA7O1lhokY2OgnojP5bB8YJ/o2MXaFP1v49lG8fqJYK"
+default_role: readonly    # least privilege: fallback for users without an explicit role
+```
+
+```bash
+./bin/tellstone --rbac-config policy.yaml --enable-resp
+redis-cli AUTH admin adminsecret                 # +OK
+redis-cli ROLE CREATE operator +get '~users:*'   # +OK (runtime roles)
+redis-cli ROLE SETUSER bob operator '>bobpw'     # +OK
+redis-cli ROLE GETUSER bob                       # bob / operator / 1
+```
+
+Unauthenticated data commands return `-NOAUTH`; commands a user's role does not grant return
+`-NOPERM`. The native binary client offers the same via `client.AuthUser` and `RoleCreate` /
+`RoleSetUser` (see `cmd/example/role`).
 
 ### Native binary protocol (Go client)
 

client/client_role.go

@@ -0,0 +1,91 @@
+package client
+
+// RoleUser is a decoded ROLE GETUSER record.
+type RoleUser struct {
+	Role    string // empty when the user has no explicit role
+	HasPass bool
+}
+
+// RoleListEntry is one role from a ROLE LIST response.
+type RoleListEntry struct {
+	Name       string
+	Commands   []string
+	Namespaces [][]byte
+}
+
+// RoleCreate issues ROLE CREATE <name> <rule>... on the binary protocol.
+// Rule tokens follow the RESP conventions: "+cmd", "-cmd", "+@category",
+// "-@category", "~prefix", "~*". Fails when the role already exists.
+func (c *Client) RoleCreate(role string, rules []string, scratchBuf []byte) error {
+	if err := c.valid(); err != nil {
+		return err
+	}
+	return c.c.RoleCreate(role, rules, scratchBuf)
+}
+
+// RoleSetUser issues ROLE SETUSER <username> <role> [>password] [nopass].
+// At least one password option is required: pass []byte("nopass") for a
+// passwordless user. The last password option wins; nopass clears the hash.
+// A ">password" option transmits the password in cleartext unless the
+// connection was made with DialTLS — use DialTLS when passing secrets.
+func (c *Client) RoleSetUser(username, role string, passOptions [][]byte, scratchBuf []byte) error {
+	if err := c.valid(); err != nil {
+		return err
+	}
+	return c.c.RoleSetUser(username, role, passOptions, scratchBuf)
+}
+
+// RoleDelUser issues ROLE DELUSER <username>.
+func (c *Client) RoleDelUser(username string, scratchBuf []byte) error {
+	if err := c.valid(); err != nil {
+		return err
+	}
+	return c.c.RoleDelUser(username, scratchBuf)
+}
+
+// RoleDelete issues ROLE DELETE <role>.
+func (c *Client) RoleDelete(role string, scratchBuf []byte) error {
+	if err := c.valid(); err != nil {
+		return err
+	}
+	return c.c.RoleDelete(role, scratchBuf)
+}
+
+// RoleList issues ROLE LIST and returns the decoded roles.
+func (c *Client) RoleList(scratchBuf []byte) ([]RoleListEntry, error) {
+	if err := c.valid(); err != nil {
+		return nil, err
+	}
+	entries, err := c.c.RoleList(scratchBuf)
+	if err != nil {
+		return nil, err
+	}
+	out := make([]RoleListEntry, 0, len(entries))
+	for _, e := range entries {
+		out = append(out, RoleListEntry(e))
+	}
+	return out, nil
+}
+
+// RoleGetUser issues ROLE GETUSER <username> and returns the decoded record.
+func (c *Client) RoleGetUser(username string, scratchBuf []byte) (RoleUser, error) {
+	if err := c.valid(); err != nil {
+		return RoleUser{}, err
+	}
+	u, err := c.c.RoleGetUser(username, scratchBuf)
+	if err != nil {
+		return RoleUser{}, err
+	}
+	return RoleUser(u), nil
+}
+
+// AuthUser authenticates with a username/password pair (RBAC mode).
+// Must be called after Dial/DialTLS when the server runs with --rbac-config.
+// The password travels in cleartext unless the connection was made with
+// DialTLS — use DialTLS when transmitting secrets.
+func (c *Client) AuthUser(username, password string, scratchBuf []byte) error {
+	if err := c.valid(); err != nil {
+		return err
+	}
+	return c.c.AuthUser(username, password, scratchBuf)
+}

cmd/example/role/main.go

@@ -0,0 +1,123 @@
+/*
+Package main
+Tellstone Cloud-Native In-Memory Database
+File: main.go
+Description: Example that drives the ROLE command family over the binary protocol: authenticate
+as an admin user, create a role and a user bound to it, then verify that the new user can only
+run the commands its role grants. Run a server with --rbac-config pointing at the policy file
+before starting this example.
+
+Authors:
+
+	Maximilian Hagen
+*/
+package main
+
+import (
+	"fmt"
+	"log"
+	"strings"
+	"time"
+
+	"github.com/Saxy/Tellstone/client"
+)
+
+func main() {
+	c, err := client.Dial("127.0.0.1:9988", 5*time.Second)
+	if err != nil {
+		log.Fatalf("failed to dial server: %v", err)
+	}
+	defer c.Close()
+
+	// 4KB reusable scratch buffer for both building requests and receiving replies
+	buf := make([]byte, 4*1024)
+
+	// The server's policy file must already define "admin" with the "admin" role.
+	if err = c.AuthUser("admin", "adminsecret", buf); err != nil {
+		log.Fatalf("AUTH admin failed: %v", err)
+	}
+	fmt.Println("AUTH admin => OK")
+
+	// Seed a value under users:1 so alice's GET below returns it instead of a
+	// storage-level miss, which would be indistinguishable from an RBAC denial.
+	if _, err = c.Set([]byte("users:1"), []byte("alice-in-users"), 0, buf); err != nil {
+		log.Fatalf("SET users:1 failed: %v", err)
+	}
+	fmt.Println("SET users:1 => OK")
+
+	// ROLE CREATE defines a role that may only read keys under the "users:" prefix.
+	if err = c.RoleCreate("user-reader", []string{"+get", "~users:*"}, buf); err != nil {
+		log.Fatalf("ROLE CREATE failed: %v", err)
+	}
+	fmt.Println("ROLE CREATE user-reader => OK")
+
+	// ROLE SETUSER binds a password-protected user to that role.
+	if err = c.RoleSetUser("alice", "user-reader", [][]byte{[]byte(">alicepw")}, buf); err != nil {
+		log.Fatalf("ROLE SETUSER failed: %v", err)
+	}
+	fmt.Println("ROLE SETUSER alice => OK")
+
+	// ROLE GETUSER confirms the assignment.
+	u, err := c.RoleGetUser("alice", buf)
+	if err != nil {
+		log.Fatalf("ROLE GETUSER failed: %v", err)
+	}
+	fmt.Printf("ROLE GETUSER alice => role=%q has_password=%v\n", u.Role, u.HasPass)
+
+	// ROLE LIST enumerates every role on the server.
+	entries, err := c.RoleList(buf)
+	if err != nil {
+		log.Fatalf("ROLE LIST failed: %v", err)
+	}
+	for _, e := range entries {
+		ns := make([]string, len(e.Namespaces))
+		for i, p := range e.Namespaces {
+			ns[i] = string(p)
+		}
+		fmt.Printf("ROLE LIST => %s commands=%v namespaces=%v\n", e.Name, e.Commands, ns)
+	}
+
+	// Open a second connection as alice and prove the role's limits: GET on a
+	// matching key passes, SET and keys outside the whitelist are denied. The
+	// client surfaces authorization denials as errors carrying the server's
+	// NOT_AUTHORIZED error frame.
+	alice, err := client.Dial("127.0.0.1:9988", 5*time.Second)
+	if err != nil {
+		log.Fatalf("failed to dial server: %v", err)
+	}
+	defer alice.Close()
+	if err := alice.AuthUser("alice", "alicepw", buf); err != nil {
+		log.Fatalf("AUTH alice failed: %v", err)
+	}
+	fmt.Println("AUTH alice => OK")
+
+	// GET on a matching key must pass the role gate. The key was seeded
+	// above, so any error here — NOT_AUTHORIZED, a transport fault, or a
+	// storage miss — is a bug, not a valid outcome.
+	res, err := alice.Get([]byte("users:1"), buf)
+	if err != nil {
+		log.Fatalf("GET users:1 as alice failed: %v", err)
+	}
+	fmt.Printf("GET users:1 as alice => %s\n", res)
+
+	// SET is not in alice's role, so it must come back as a NOT_AUTHORIZED
+	// denial. Success means the ACL let an op through it should have blocked;
+	// any other error means the transport or storage broke, not the role.
+	if _, err := alice.Set([]byte("users:1"), []byte("hacked"), 0, buf); err == nil {
+		log.Fatalf("SET as alice unexpectedly allowed")
+	} else if !strings.Contains(err.Error(), "NOT_AUTHORIZED") {
+		log.Fatalf("SET as alice denied with the wrong error: %v", err)
+	} else {
+		fmt.Printf("SET as alice denied => %v\n", err)
+	}
+
+	// Same fail-closed check for a key outside the whitelist: the namespace
+	// gate must deny it with NOT_AUTHORIZED.
+	if _, err := alice.Get([]byte("accounts:1"), buf); err == nil {
+		log.Fatalf("GET accounts:1 as alice unexpectedly allowed")
+	} else if !strings.Contains(err.Error(), "NOT_AUTHORIZED") {
+		log.Fatalf("GET accounts:1 as alice denied with the wrong error: %v", err)
+	} else {
+		fmt.Printf("GET accounts:1 as alice denied => %v\n", err)
+	}
+}

config/config.go

@@ -42,6 +42,7 @@ type Config struct {
 	tlsKey            string
 	tlsCA             string
 	requirePass       string
+	rbacConfig        string
 }
 
 func getEnv[T any](key string, fallback T) T {
@@ -118,6 +119,7 @@ func getEnv[T any](key string, fallback T) T {
 //		TSD_TLS_KEY          – path to TLS private key file (PEM)
 //		TSD_TLS_CA           – path to CA certificate for client verification (enables mTLS)
 //		TSD_REQUIRE_PASS     – server password required by AUTH (empty = no authentication)
+//		TSD_RBAC_CONFIG     – path to a YAML/JSON RBAC policy file (roles, users, default_role)
 //
 // args are the command-line arguments to parse (typically os.Args[1:]); pass nil for an
 // environment-only / default configuration. A fresh flag.FlagSet is used so LoadConfig is
@@ -279,6 +281,15 @@ func LoadConfig(args []string) *Config {
 		getEnv("TSD_REQUIRE_PASS", ""),
 		"Password clients must supply via AUTH; empty disables authentication (default: none)",
 	)
+	// Optional RBAC policy file. When set, per-user authentication and
+	// role-based access control replace the single --require-pass password, and
+	// SIGHUP re-reads the file for hot-reload.
+	fs.StringVar(
+		&cfg.rbacConfig,
+		"rbac-config",
+		getEnv("TSD_RBAC_CONFIG", ""),
+		"Path to YAML/JSON RBAC policy file (roles, users, default_role); empty disables RBAC (default: none)",
+	)
 	// Custom usage output to guide operators.
 	fs.Usage = func() {
 		println("Tellstone server – high-performance in-memory database")
@@ -329,6 +340,7 @@ func (cfg *Config) GetTLSCert() string                { return cfg.tlsCert }
 func (cfg *Config) GetTLSKey() string                 { return cfg.tlsKey }
 func (cfg *Config) GetTLSCA() string                  { return cfg.tlsCA }
 func (cfg *Config) GetRequirePass() string            { return cfg.requirePass }
+func (cfg *Config) GetRBACConfig() string             { return cfg.rbacConfig }
 func (cfg *Config) MTLSEnabled() bool {
 	return cfg.tlsCert != "" && cfg.tlsKey != "" && cfg.tlsCA != ""
 }

config/config_test.go

@@ -339,3 +339,11 @@ func TestRequirePassEnvVar(t *testing.T) {
 		t.Fatalf("require-pass env mismatch: %q", cfg.GetRequirePass())
 	}
 }
+
+func TestRBACConfigEnvVar(t *testing.T) {
+	t.Setenv("TSD_RBAC_CONFIG", "/env/policy.yaml")
+	cfg := LoadConfig(nil)
+	if cfg.GetRBACConfig() != "/env/policy.yaml" {
+		t.Fatalf("rbac-config env mismatch: %q", cfg.GetRBACConfig())
+	}
+}

go.mod

@@ -11,6 +11,7 @@ require (
 	go.opentelemetry.io/otel/sdk v1.44.0
 	go.opentelemetry.io/otel/trace v1.44.0
 	golang.org/x/crypto v0.54.0
+	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (

go.sum

@@ -21,12 +21,18 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/panjf2000/ants/v2 v2.12.1 h1:BWvU2wHpyXWxhhNXsGB6JXLCNbshyLd1QxvoAmZnu10=
 github.com/panjf2000/ants/v2 v2.12.1/go.mod h1:tSQuaNQ6r6NRhPt+IZVUevvDyFMTs+eS4ztZc52uJTY=
 github.com/panjf2000/gnet/v2 v2.10.0 h1:rC4jNF+jtXj/FH+8JOIQ3XxjD+yBunYBLKg9TE3dc4g=
 github.com/panjf2000/gnet/v2 v2.10.0/go.mod h1:f9wdbOFsdbZqlSvXctWbPRW5bB/W++q8Zqz+D7tQIVQ=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
@@ -77,6 +83,9 @@ google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
 google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

internal/metrics/metrics_test.go

@@ -57,7 +57,7 @@ func TestCollectorEngineSnapshot(t *testing.T) {
 		t.Fatalf("expected key to exist after Set")
 	}
 	// Create a dummy network server (no handler, no activity).
-	srv := network.NewServer("", 0, nil, nil, log.NewNoOpLogger(), nil, "")
+	srv := network.NewServer("", 0, nil, nil, log.NewNoOpLogger(), nil, "", nil)
 
 	col := NewCollector(eng, srv, log.NewNoOpLogger())
 	snap := col.GetEngineSnapshot()

internal/network/README.md

@@ -18,8 +18,8 @@ The **`network`** package provides a high‑performance, zero‑allocation TCP e
 
 ```
 - **length** – Total size of the `type` byte + the variable length `payload` (Big-Endian).
-- **type** – An 8-bit unsigned integer representing `MessageType` (`MsgPing`, `MsgPong`, `MsgRequest`, `MsgResponse`).
-- **payload** – Optional binary array representing data instructions (e.g., Tellstone raw SQL statements).
+- **type** – An 8-bit unsigned integer representing `MessageType` (`MsgPing`, `MsgPong`, `MsgRequest`, `MsgResponse`, `MsgError`, `MsgAuth`, `MsgAuthOk`, `MsgAuthErr`).
+- **payload** – Optional binary array representing data instructions (e.g., Tellstone raw SQL statements). Failures for the data path ride in `MsgError` frames; `MsgResponse` frames carry data values unchanged, so a stored value may begin with `"ERR "` without being mistaken for an error.
 
 ## Usage Examples
 

internal/network/benchmark_tls_test.go

@@ -39,7 +39,7 @@ func startBenchServer(b *testing.B, handler func(msg *Message) ([]byte, MessageT
 	addr := l.Addr().String()
 	l.Close()
 
-	srv := NewServer(addr, 0, nil, handler, log.NewNoOpLogger(), nil, "")
+	srv := NewServer(addr, 0, nil, handler, log.NewNoOpLogger(), nil, "", nil)
 	go func() { _ = srv.ListenAndServe() }()
 	if err := waitForServer(addr, 2*time.Second); err != nil {
 		b.Fatalf("server not ready: %v", err)
@@ -92,7 +92,7 @@ func startBenchTLSServer(b *testing.B, handler func(msg *Message) ([]byte, Messa
 	addr := l.Addr().String()
 	l.Close()
 
-	srv := NewServer(addr, 0, nil, handler, log.NewNoOpLogger(), tlsConfigs, "")
+	srv := NewServer(addr, 0, nil, handler, log.NewNoOpLogger(), tlsConfigs, "", nil)
 	go func() {
 		_ = srv.ListenAndServe()
 	}()