feat(restheart-mongo): port full RESTHeart REST surface

Replace the minimal record-traffic stub with the complete loop that
the keploy compat lane needs to gate. flow.sh::restheart_record_traffic
now drives the full RESTHeart 9.x surface end-to-end against bare
RESTHeart, and restheart_list_routes enumerates every (method, route)
tuple it fires so coverage stays in lockstep.

Covered surfaces:
- CRUD on /<db>/<coll> + /<db>/<coll>/<docid> (HAL, _size, _meta,
  _indexes, ETag conditional flow, writeMode insert/update/upsert,
  $-operator PATCH variety)
- Aggregations via _meta.aggrs with avars variable interpolation
  (scalars / arrays / nested / missing / malformed)
- Bulk writes (POST array body, filter PATCH, filter DELETE,
  larger 25-doc batches, mixed valid/invalid)
- GraphQL apps (gql-apps registration, query / mutation / fragment /
  alias / multi-op, BSON scalar coercion on outputs and inputs,
  introspection, error paths)
- Files / GridFS (.files buckets, multipart upload, binary download
  with Range requests, metadata fetch, delete)
- ACL rules (predicate evaluator across method / path-prefix /
  qparams-* / bson-request-* / equals[%U,...] / in[%h,...]) plus
  the mongo permission interceptors (readFilter, writeFilter,
  projectResponse, mergeRequest, filterOperatorsBlacklist,
  propertiesBlacklist, allowBulk*)
- Users (/users) with the userPwdHasher bcrypt interceptor; reader /
  writer roles authenticating via Basic + Bearer; wrong-password deny
- Sessions / multi-doc transactions (/_sessions/<id>/_txns/<txnid>)
  with commit and abort branches
- Auth services (/token form grants, JWT, Auth-Token, Digest,
  OAuth metadata under /.well-known/oauth-*)
- Diagnostics (/ping, /metrics in json/prometheus/openmetrics, per-db
  and per-coll, /health/db, OPTIONS preflight, gzip request encoding,
  Accept-Encoding negotiation)
- MongoMountResolver (multiple databases, encoded collection names,
  root /_size and /_meta, trailing-slash and double-slash variants)

restheart_bootstrap now PUTs every collection record-traffic touches.
README.md describes the sample as a complete keploy compat lane
sample and lists every surface it exercises.

Signed-off-by: Akash Kumar <meakash7902@gmail.com>

Author: AkashKumar7902

restheart-mongo/README.md

@@ -1,15 +1,21 @@
-# restheart-mongo — keploy compat lane sample (work in progress)
+# restheart-mongo — keploy compat lane sample
 
-Minimum reproducer scaffold for the RESTHeart / MongoDB compat lane. Mirrors the architectural pattern of the [doccano-django sample in `samples-python`](https://github.com/keploy/samples-python/tree/main/doccano-django): the sample owns orchestration (compose / bootstrap / traffic / noise filter / coverage), keploy CI lanes consume it as a thin wrapper.
+A complete, self-contained sample that drives the RESTHeart 9.x REST surface keploy needs to gate on its compat lanes. Mirrors the architectural pattern of the [doccano-django sample in `samples-python`](https://github.com/keploy/samples-python/tree/main/doccano-django): the sample owns orchestration (compose / bootstrap / traffic / noise filter / coverage), and keploy CI lanes consume it as a thin wrapper.
 
-## Status
+The traffic loop exercises the surfaces that keploy parsers and matchers have to handle correctly across record + replay:
 
-**This is a SCAFFOLD.** The compose, bootstrap, and a minimal record-traffic loop work end-to-end against bare RESTHeart without keploy in the picture. The full traffic loop the existing keploy/enterprise lane drives (`compat_trigger_record_traffic` in `enterprise/.ci/scripts/restheart-linux.sh`, ~600 lines covering CRUD on `/<db>/<coll>` + GraphQL + files + ACL + users + bulk + aggregations) has **not been ported** into `flow.sh::restheart_record_traffic` yet. Lanes consuming this sample today should either:
-
-1. Port the missing curls into `flow.sh::restheart_record_traffic` (preferred — that's the migration this scaffold is designed around).
-2. Or call into `enterprise/.ci/scripts/restheart-linux.sh::compat_trigger_record_traffic` between `flow.sh bootstrap` and `flow.sh coverage` until the migration completes.
-
-See the migration plan in this PR's description / linked issue.
+* **CRUD** on `/<db>/<coll>` and `/<db>/<coll>/<docid>` — including `_size`, `_meta`, `_indexes`, ETag conditional requests, `writeMode=insert/update/upsert`, and `$inc / $push / $addToSet / $pull / $unset / $rename / $currentDate` PATCH operators.
+* **HAL** representations via `Accept: application/hal+json` and `?rep=hal&hal=full` on documents, collections, indexes, and bulk responses.
+* **Aggregations** via `_meta.aggrs` — group / count / sort / project / facet / lookup / unwind plus `avars` variable interpolation (scalars, arrays, nested objects, missing / malformed inputs).
+* **Bulk writes** — array-body POST, filter-bound PATCH and DELETE, larger 25-doc batches, mixed valid / invalid documents.
+* **GraphQL** apps — `gql-apps` registration, query / mutation / fragment / alias / multi-op forms, BSON scalar coercion (`BsonObjectId`, `BsonDecimal128`, `BsonLong`, `BsonDate`, `BsonBinary`) on outputs and inputs, introspection.
+* **Files / GridFS** — buckets (`<coll>.files`), multipart upload, binary download with `Range` requests, metadata fetch, delete.
+* **ACL** rules (`/acl`) — predicate evaluation (`method`, `path-prefix`, `qparams-whitelist`, `qparams-blacklist`, `qparams-contain`, `qparams-size`, `bson-request-whitelist/blacklist/contains`, `equals[%U,...]`, `in[%h, ...]`), `mongo` permission interceptors (`readFilter`, `writeFilter`, `projectResponse`, `mergeRequest`, `filterOperatorsBlacklist`, `propertiesBlacklist`, `allowBulk*`).
+* **Users** (`/users`) — non-admin user creation with the bcrypt password hasher; reader / writer roles authenticating via Basic + Bearer; wrong-password denial.
+* **Sessions / transactions** (`/_sessions`, `/_sessions/<id>/_txns/<txnid>`) — open, write inside, commit (PATCH), abort (DELETE), and re-read.
+* **Auth services** — `/token` form grants (password, client_credentials, refresh_token, unsupported), JWT bearer (valid + invalid signature), Auth-Token, Digest, OAuth metadata under `/.well-known/oauth-*`.
+* **Diagnostics** — `/ping`, `/metrics` (json / prometheus / openmetrics, per-db, per-coll), `/health/db`, OPTIONS preflight, gzip request encoding, Accept-Encoding negotiation.
+* **MongoMountResolver** — multiple databases, collections with dashes / dots / encoded slashes, root `/_size` and `/_meta`, trailing-slash and double-slash variants.
 
 ## Layout
 
@@ -26,10 +32,10 @@ restheart-mongo/
 
 The sample is keploy-independent: `docker compose up && bash flow.sh bootstrap && bash flow.sh record-traffic` runs end-to-end against bare RESTHeart. Lane scripts wrap that exact same path inside `keploy record` / `keploy test`.
 
-* `bootstrap` — wait for RESTHeart to start serving, PUT the test database + collection so subsequent reads have something to find.
-* `record-traffic` — drive RESTHeart's REST surface. Every call is logged to `${RESTHEART_FIRED_ROUTES_FILE}` (when set) so `coverage` has a numerator without a keploy recording.
-* `coverage` — emits `(method, path)` coverage. Denominator is curated from RESTHeart's pattern-based mount table (see `restheart_list_routes` in `flow.sh`); not file-system-derivable like Next.js, so the list lives in source and must be updated alongside `record-traffic`.
-* `list-routes` — diagnostic; prints the route table.
+* `bootstrap` — wait for RESTHeart to start serving and PUT the seed collections (`items`, `people`, `places`, `halpeople`, `relpeople`, `gql-apps`, `acl`, `_schemas`, `avatars.files`, `range_files.files`, `imported_csv`) so subsequent record-traffic calls have something to find.
+* `record-traffic` — drive the full RESTHeart REST surface listed above. Every call is logged to `${RESTHEART_FIRED_ROUTES_FILE}` (when set) so `coverage` has a numerator without a keploy recording, and every call is fault-tolerant (`|| true`) so a single transient 4xx never aborts the run. keploy is the assertion layer.
+* `coverage` — emits `(method, path)` coverage. The denominator is curated from RESTHeart's pattern-based mount table (see `restheart_list_routes` in `flow.sh`); RESTHeart routes are not file-system-derivable like Next.js, so the list lives in source and stays in lockstep with `record-traffic`.
+* `list-routes` — diagnostic; prints the route table the coverage report uses as its denominator.
 
 ## Local run
 
@@ -43,7 +49,4 @@ docker compose down -v
 
 ## Consumers
 
-Lanes pinning to this sample (pinned via `--branch feat/restheart-mongo-sample` until merge):
-
-* `keploy/enterprise` `.woodpecker/restheart-linux.yml` — being slimmed in a follow-up PR.
-* No `keploy/integrations` consumer today; could be added if a RESTHeart-flavoured Mongo wire bug surfaces.
+* `keploy/enterprise` `.woodpecker/restheart-linux.yml` — the RESTHeart compat lane delegates compose + traffic + coverage to this sample and wraps them in `keploy record` / `keploy test`.