feat: Display privilege zone graph context

[justin-prime1]

Description

Paired BHE PR: https://github.com/SpecterOps/bloodhound-enterprise/pull/1750

Merge blocker: Blocked until the paired BHE PR is approved and ready. This BHCE PR merges first, but neither sister merges until both are approved, green, and free of unresolved review threads other than this ordering blocker.

Stack: Layer 1 of 3.

Intent

Add the shared graph, Search, ETAC, and Explore behavior needed to consume Enterprise Privilege Zone graph context consistently with ordinary graph entities.

Implementation

• Uses standard uppercase names so existing Search and pathfinding discover the two PZ node kinds without a special search path.
• Converts the PZ node and relationship kinds into standard graph responses with human-readable labels.
• Scopes PZ property/relationship labels so unrelated OpenGraph entities retain existing formatting.
• Applies ETAC so an environment-specific zone follows its environment and a canonical zone is exposed only through an authorized linked environment node.

Blast Radius / Risk

Shared Search, graph conversion, unified graph, ETAC, and Explore detail paths change only for PZ_PrivilegeZone, PZ_PrivilegeZoneEnvironment, PZ_InZone, and PZ_PartOfZone. An ETAC defect could hide authorized context or expose canonical context without an authorized environment; focused tests cover both directions. BHCE adds no producer, migration, or standalone CE analysis behavior.

BHE/BHCE Parity

matched for shared graph behavior; the paired BHE runtime producer is intentionally Enterprise-only.

Reviewability / Reviewer Brief

Review size: 446 reviewable changed lines — 109 product and 337 tests. The author approved this cohesive Search/conversion/ETAC/UI exception over 400 lines; reviewer agreement is still required. Suggested order: ETAC; API conversions; Search; shared UI formatting; tests.

Test Changes

Added or updated tests for uppercase names, normalized Search, relationship labels, graph conversion, authorized/unauthorized canonical-zone ETAC behavior, PZ-specific property labels, and preservation of generic formatting. No tests were removed or weakened.

Rollback

After reverting the paired BHE producer, revert this BHCE PR. BHCE has no migration or persisted-data change. Reverting BHCE first would leave generated PZ entities without intended Search, ETAC, and display handling.

Motivation and Context

Enterprise materializes Privilege Zone graph objects; shared BHCE layers must render, search, traverse, and authorize them consistently. No Jira or GitHub issue is associated with this prototype, by author request.

Resolves N/A — prototype authorized without a ticket.

How Has This Been Tested?

Validation / Evidence

At BHCE 09e0f244ebe61914a9d2772990c733a41acac834 and paired BHE f2a35cf75a8f1ed552fe4f760d64af38e7ab0bc7:

• Focused graph-conversion, Search, unified-graph, ETAC, and query Go suites passed.
• Forty shared-UI tests, typecheck, and lint passed.
• Tagged integration packages compiled.
• Full clean just prepare-for-codereview, parity, and enterprise review passed.
• Browser validation covered Search, pathfinding, labels, and detail panels in the paired BHE stack.

Explicitly Not Validated

• Configured database-backed tagged integration execution.
• Production-scale Search/pathfinding performance.
• A dedicated WCAG 2.2 AA audit.
• Current-target revalidation after the latest BHCE main movement; this draft branch is one commit behind live main and must be refreshed before readiness.

Screenshots (optional):

Types of changes

• New feature (non-breaking change which adds functionality)

Checklist:

• I have met the contributing prerequisites
  • Assigned myself to this PR
  • Added the appropriate labels
  • Associated an issue: N/A by author request
  • Read the Contributing guide
• I have ensured that related documentation is up-to-date
• I have followed proper test practices

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: bf23d5f3-d378-48e0-80d8-9052ee073a3e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}