[DSIP-104][ApiServer][UI] Introduce project-scoped authorization

[ruanwenjun]

Was this PR generated or assisted by AI?

YES. The implementation, UI, schema upgrades, tests and documentation were generated or assisted by AI.

Purpose of the pull request

Implements DSIP-104: users receive explicit operation permissions within a project, and shared resources are granted to projects. Project operations require the relevant permission and resource grants.

Closes #17923.

flowchart LR
    U[User] -->|Project operation permissions| P[Project]
    R[Shared resources] -->|Resource-use grants| P
    P --> C{Permission AND resource grant}
    C --> A[Allow project operation]

Loading

Brief change log

• Add separate user-project permission and project-resource authorization tables, assignment APIs and project management UI. System administrators grant resources; project member managers assign permissions within their project.
• Scope resource queries in SQL and enforce project permissions at configuration, publication and manual execution/rerun entry points, including nested subworkflows. Resolve actual instance projects and return non-sensitive metadata from project resource selectors.
• Cover datasources, worker groups, tenants, queues, environments, alert groups, Kubernetes namespaces and task groups. Resource files are deferred.
• Update project and Shell/Python E2E fixtures to use the new resource assignment UI and explicitly grant their execution resources.
• Add MySQL/PostgreSQL 3.5.0 upgrade scripts and English/Chinese upgrade notes. Legacy authorization tables and data are retained without migration or authorization fallback; administrators must reassign project member permissions and resource grants.

Resource grant revocation does not recheck existing running/queued instances, scheduled triggers or automatic retries, and does not disable existing schedules.

Verify this pull request

Local validation:

• All 43 changed/new backend, DAO and upgrade test suites: 450 passed, 7 existing skips, 0 failures/errors.
• Real MySQL 8 and PostgreSQL 16 upgrade/DAO tests verify empty new grant tables, preserved legacy permissions and execution/schedule records, safe repeated upgrades, exact resource-key matching and string round trips.
• UI production build (including TypeScript checks), ESLint and Prettier checks passed.
• Updated E2E Java sources compile successfully; browser E2E tests were not run locally.
• Diff whitespace checks passed.

The initial CI documentation link check failed while parsing the existing lychee.toml (include_fragments = false is incompatible with the CI lychee version). That configuration is unchanged by this PR.

Pull Request Notice

Pull Request Notice