test(e2e): fix flaky namespace-watch specs; guard creator-grant rollback

The "two users" namespace-watch specs flake in CI (e.g. "doesn't show users
namespaces the other has created"): the watch occasionally returns a stale
or another user's namespace instead of the one the spec just created.

Root cause: WatchNamespaces did a cluster-scoped watch with no
ResourceVersion (so the apiserver first replays all existing namespaces) and
returned the *first* event, asserting it was this spec's namespace.
Namespaces accumulate across specs in envtest (there is no namespace GC
controller), so the replay delivers a stale namespace first and the helper
returns before the freshly-created one arrives. Fix: wait for the specific
expected namespace (keyed on name, not a count), and have callers also assert
the other user's namespace is absent, so a real cross-user leak still fails.

Also add an assertion to "recovers when there are kube write failures": after
paul's failed create of chani's namespace, no
`namespace:<ns>#creator@user:paul` relationship may remain (with
`view = viewer + creator`, a dangling grant would let paul see chani's
namespace). It passes in both lock modes -- the dual-write rollback is
correct -- so it stands as a regression guard, not a bug fix.

Unrelated to the REST mapper race; this is pre-existing e2e test-harness
flakiness, exposed once the embedded-SpiceDB metrics fix let the e2e suite
run far enough to reach these specs.

Signed-off-by: Víctor Roldán Betancort <vroldanbet@authzed.com>

Author: vroldanbet

e2e/proxy_test.go

@@ -132,11 +132,19 @@ var _ = Describe("Proxy", func() {
 				return item.Name
 			})
 		}
-		WatchNamespaces := func(ctx context.Context, client kubernetes.Interface, expected int) []string {
+		// WatchNamespaces watches namespaces as the given client until it observes the
+		// expected namespace, returning every name it saw along the way. It waits for the
+		// specific name rather than returning the first event: the namespace watch is
+		// cluster-scoped and starts with a replay of pre-existing namespaces, which
+		// accumulate across specs in envtest (there is no namespace GC controller). Keying
+		// on a count would otherwise make this return an arbitrary stale namespace and miss
+		// the one the test just created. Callers assert both that the expected name appears
+		// and that the other user's namespace does not, so this does not mask leaks.
+		WatchNamespaces := func(ctx context.Context, client kubernetes.Interface, expected string) []string {
 			ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
 			defer cancel()
 
-			got := make([]string, 0, expected)
+			got := make([]string, 0)
 			watcher, err := client.CoreV1().Namespaces().Watch(ctx, metav1.ListOptions{})
 			Expect(err).To(Succeed())
 			defer watcher.Stop()
@@ -147,7 +155,7 @@ var _ = Describe("Proxy", func() {
 					return got
 				}
 				got = append(got, ns.Name)
-				if len(got) == expected {
+				if ns.Name == expected {
 					return got
 				}
 			}
@@ -618,12 +626,16 @@ var _ = Describe("Proxy", func() {
 				defer wg.Wait()
 				wg.Go(func() error {
 					defer GinkgoRecover()
-					Expect(WatchNamespaces(ctx, paulClient, 1)).To(ContainElement(paulNamespace))
+					seen := WatchNamespaces(ctx, paulClient, paulNamespace)
+					Expect(seen).To(ContainElement(paulNamespace))
+					Expect(seen).ToNot(ContainElement(chaniNamespace))
 					return nil
 				})
 				wg.Go(func() error {
 					defer GinkgoRecover()
-					Expect(WatchNamespaces(ctx, chaniClient, 1)).To(ContainElement(chaniNamespace))
+					seen := WatchNamespaces(ctx, chaniClient, chaniNamespace)
+					Expect(seen).To(ContainElement(chaniNamespace))
+					Expect(seen).ToNot(ContainElement(paulNamespace))
 					return nil
 				})
 
@@ -666,6 +678,17 @@ var _ = Describe("Proxy", func() {
 				// paul isn't able to create chanis namespace
 				Expect(CreateNamespace(ctx, paulClient, chaniNamespace)).ToNot(BeNil())
 
+				// paul's failed create must not leave a dangling `creator` grant behind: with
+				// `permission view = viewer + creator`, that would let paul get/list/watch
+				// chani's namespace. This surfaces incomplete rollback of the optimistically
+				// written relationship when the kube write fails.
+				Expect(GetAllTuples(ctx, &v1.RelationshipFilter{
+					ResourceType:          "namespace",
+					OptionalResourceId:    chaniNamespace,
+					OptionalRelation:      "creator",
+					OptionalSubjectFilter: &v1.SubjectFilter{SubjectType: "user", OptionalSubjectId: "paul"},
+				})).To(BeEmpty())
+
 				// paul can only get his namespace
 				Expect(GetNamespace(ctx, paulClient, paulNamespace)).To(Succeed())
 				Expect(GetNamespace(ctx, paulClient, chaniNamespace)).ToNot(BeNil())