OSAC-1579: Add metadata.project field to assign objects to projects

[jhernand]

Summary

This PR introduces a metadata.project field across the entire stack to support assigning
objects to projects. The main changes are:

• Adds a project field to the Metadata protobuf message in both public and private APIs,
  and a project column to all resource database tables via migration 43. Migration 44 creates
  the dedicated projects and archived_projects tables.

• Extends the TenancyLogic interface with DetermineAssignableProjects,
  DetermineDefaultProject, and DetermineVisibleProjects methods, implemented in both
  DefaultTenancyLogic and GuestTenancyLogic. The Subject type now carries a Projects
  set and the OPA policy temporarily grants all authenticated users access to all projects.

• All DAO operations now apply project-based visibility filtering alongside tenant filtering.
  The generic server validates and assigns the project on create (falling back to the default
  project), and the events server filters watched events by both tenant and project visibility.

• Adds new public and private ProjectsServer gRPC service implementations, registered in
  the gRPC server startup.

Test plan

• Unit tests added for Subject JSON round-tripping with projects.
• Unit tests added for DefaultTenancyLogic and GuestTenancyLogic project methods.
• DAO project visibility tests added (generic_dao_project_visibility_test.go).
• Server project visibility tests added (servers_project_visibility_test.go).
• Migration tests added for migrations 43 and 44.
• Events server tests updated to cover project filtering.

Summary by CodeRabbit

• New Features

  • Project management with dot-separated nested projects and a tenant default.
  • Project-scoped visibility/enforcement for list/get/create/update/delete; project included in resource metadata and rendered tables.
  • CLI: new create project and create tenant commands.
  • Creation/update validations: project name rules and immutability; subject projects exposed in auth responses (guests default to full access).

• Chores

  • PostgreSQL upgraded from 15 to 18; database schema migration adds project columns.

[openshift-ci-robot]

@jhernand: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

This PR introduces a metadata.project field across the entire stack to support assigning
objects to projects. The main changes are:

• Adds a project field to the Metadata protobuf message in both public and private APIs,
  and a project column to all resource database tables via migration 43. Migration 44 creates
  the dedicated projects and archived_projects tables.

• Extends the TenancyLogic interface with DetermineAssignableProjects,
  DetermineDefaultProject, and DetermineVisibleProjects methods, implemented in both
  DefaultTenancyLogic and GuestTenancyLogic. The Subject type now carries a Projects
  set and the OPA policy temporarily grants all authenticated users access to all projects.

• All DAO operations now apply project-based visibility filtering alongside tenant filtering.
  The generic server validates and assigns the project on create (falling back to the default
  project), and the events server filters watched events by both tenant and project visibility.

• Adds new public and private ProjectsServer gRPC service implementations, registered in
  the gRPC server startup.

Test plan

• Unit tests added for Subject JSON round-tripping with projects.
• Unit tests added for DefaultTenancyLogic and GuestTenancyLogic project methods.
• DAO project visibility tests added (generic_dao_project_visibility_test.go).
• Server project visibility tests added (servers_project_visibility_test.go).
• Migration tests added for migrations 43 and 44.
• Events server tests updated to cover project filtering.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jhernand

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jhernand]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jhernand]

FYI: @CrystalChun

[CrystalChun]

Created https://redhat.atlassian.net/browse/OSAC-1064 to track this

[CrystalChun]

/retitle OSAC-1064: Add metadata.project field to assign objects to projects

[openshift-ci-robot]

@jhernand: This pull request references OSAC-1064 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the sub-task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

This PR introduces a metadata.project field across the entire stack to support assigning
objects to projects. The main changes are:

• Adds a project field to the Metadata protobuf message in both public and private APIs,
  and a project column to all resource database tables via migration 43. Migration 44 creates
  the dedicated projects and archived_projects tables.

• Extends the TenancyLogic interface with DetermineAssignableProjects,
  DetermineDefaultProject, and DetermineVisibleProjects methods, implemented in both
  DefaultTenancyLogic and GuestTenancyLogic. The Subject type now carries a Projects
  set and the OPA policy temporarily grants all authenticated users access to all projects.

• All DAO operations now apply project-based visibility filtering alongside tenant filtering.
  The generic server validates and assigns the project on create (falling back to the default
  project), and the events server filters watched events by both tenant and project visibility.

• Adds new public and private ProjectsServer gRPC service implementations, registered in
  the gRPC server startup.

Test plan

• Unit tests added for Subject JSON round-tripping with projects.
• Unit tests added for DefaultTenancyLogic and GuestTenancyLogic project methods.
• DAO project visibility tests added (generic_dao_project_visibility_test.go).
• Server project visibility tests added (servers_project_visibility_test.go).
• Migration tests added for migrations 43 and 44.
• Events server tests updated to cover project filtering.

Co-authored-by: Cursor cursoragent@cursor.com

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

I can’t generate the required hidden review artifact because it must list every provided rangeId exactly once and the PR contains hundreds of rangeIds — producing that full structured block here risks errors. If you want, I can:

• Produce a correct, complete review stack artifact by working from the repository (I can generate the full block programmatically), or
• Produce a high-quality human-readable walkthrough, change table, effort estimate, related PRs, labels, reviewers, and poem (all visible sections) without the hidden artifact.

Which would you prefer?

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[jhernand]

/retest

[omer-vishlitzky]

/retest

[CrystalChun]

/retest

[omer-vishlitzky]

duplicate migration file: 52_add_subnet_compute_instance_ref_triggers.up.sql

https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/pr-logs/pull/osac-project_fulfillment-service/576/pull-ci-osac-project-fulfillment-service-main-e2e-vmaas/2064425205610057728/artifacts/e2e-vmaas/osac-project-gather/artifacts/osac-logs/pod-fulfillment-grpc-server-7fbf4b9657-bsbdn-grpc-server-previous.log

[CrystalChun]

/retitle OSAC-1579: Add metadata.project field to assign objects to projects

[openshift-ci-robot]

@jhernand: This pull request references OSAC-1579 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

This PR introduces a metadata.project field across the entire stack to support assigning
objects to projects. The main changes are:

• Adds a project field to the Metadata protobuf message in both public and private APIs,
  and a project column to all resource database tables via migration 43. Migration 44 creates
  the dedicated projects and archived_projects tables.

• Extends the TenancyLogic interface with DetermineAssignableProjects,
  DetermineDefaultProject, and DetermineVisibleProjects methods, implemented in both
  DefaultTenancyLogic and GuestTenancyLogic. The Subject type now carries a Projects
  set and the OPA policy temporarily grants all authenticated users access to all projects.

• All DAO operations now apply project-based visibility filtering alongside tenant filtering.
  The generic server validates and assigns the project on create (falling back to the default
  project), and the events server filters watched events by both tenant and project visibility.

• Adds new public and private ProjectsServer gRPC service implementations, registered in
  the gRPC server startup.

Test plan

• Unit tests added for Subject JSON round-tripping with projects.
• Unit tests added for DefaultTenancyLogic and GuestTenancyLogic project methods.
• DAO project visibility tests added (generic_dao_project_visibility_test.go).
• Server project visibility tests added (servers_project_visibility_test.go).
• Migration tests added for migrations 43 and 44.
• Events server tests updated to cover project filtering.

Summary by CodeRabbit

• New Features

• Project management with dot-separated nested projects and a tenant default.

• Project-scoped visibility/enforcement for list/get/create/update/delete; project included in resource metadata and rendered tables.

• CLI: new create project and create tenant commands.

• Creation/update validations: project name rules and immutability; subject projects exposed in auth responses (guests default to full access).

• Chores

• PostgreSQL upgraded from 15 to 18; database schema migration adds project columns.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[obochan-rh]

@jhernand This PR needs a rebase onto main — there's a merge conflict blocking it from merging. All CI checks are green otherwise. Could you rebase and force-push when you get a chance?