Was this PR generated or assisted by AI?

YES. The implementation, UI, schema upgrades, tests and documentation were generated or assisted by AI.

Purpose of the pull request

Implements DSIP-104: users receive operation permissions within a project, and shared resources are granted to projects. A protected operation requires the relevant project permission and all resource grants needed by that operation.

Closes #17923.

Authorization model

The two diagrams keep the same user and the same eight resource types in view. Follow the arrows to compare who receives a grant.

Before DSIP-104 — mixed authorization scopes

Personal datasource and Kubernetes namespace grants originate from the user. Worker groups already have a separate project association. Tenants, queues, environments, alert groups and task groups follow their existing ownership, project fields or resource-specific rules. The figure summarizes these different scopes; it does not imply one uniform legacy grant contract.

Editable draw.io source — before

After DSIP-104 — resources are granted to the project

Users receive VIEW, DEVELOP, PUBLISH, EXECUTE, MANAGE_SCHEDULES and MANAGE_MEMBERS within project P. Shared resource grants originate from project P, using the same model for datasources, Kubernetes namespaces, worker groups, tenants, queues, environments, alert groups and task groups.

System administrators grant or revoke project resources. System administrators and members with MANAGE_MEMBERS assign permissions within the project. Use grants confer no resource modification, deletion or re-granting rights. System administrators pass the user operation check, but required project resource grants still apply.

Editable draw.io source — after

Existing instances use their actual project. Nested subworkflows are checked against each child workflow's own project permissions and resource grants. Upgrade and revocation boundaries are described below.

Brief change log

• Add separate user-project permission and project-resource authorization tables, assignment APIs and project management UI. Permissions are VIEW, DEVELOP, PUBLISH, EXECUTE, MANAGE_SCHEDULES and MANAGE_MEMBERS.
• Scope visibility in SQL so project queries, counts and pagination agree. Project resource selectors return safe metadata without datasource connection parameters or environment configuration.
• Enforce permissions and required resource grants during configuration, publication, schedule management and manual execution/rerun. Resolve actual instance projects; check nested subworkflows against each child workflow's own project permissions and resource grants.
• Replace legacy personal grants for the eight supported shared resource types with project grants. Update project and Shell/Python E2E fixtures to use the resource assignment UI and explicitly grant execution resources.
• Add MySQL/PostgreSQL 3.5.0 upgrade scripts and English/Chinese upgrade notes.

Upgrade: Legacy authorization tables and data are retained without automatic migration or authorization fallback. Administrators must explicitly reassign project member permissions and resource grants. Resource files remain outside this project-resource grant model and retain their existing authorization mechanism.

Revocation: Resource grants are not rechecked for existing running/queued instances, scheduled triggers or automatic retries. Revocation does not stop those instances or disable existing schedules.

Verify this pull request

Latest code follow-up (712e2583f9):

• 168 tests passed across 8 API authorization and workflow service suites; 0 failures/errors/skips. Regression coverage includes user ID comparison by value, invalid/overflowing bulk project IDs rejected before permission changes, and empty/mixed task datasource checks.
• Updated two workflow test mocks to use the current project permission API.
• Spotless and git diff --check passed.

Earlier implementation validation (recorded before the latest follow-up; these broader checks were not repeated):

• 43 changed/new backend, DAO and upgrade suites: 450 passed, 7 existing skips, 0 failures/errors.
• Real MySQL 8 and PostgreSQL 16 upgrade/DAO tests covered preserved legacy data and execution/schedule records, empty new grant tables, repeatable upgrades, exact resource-key matching and string round trips.
• UI production build (including TypeScript), ESLint and Prettier passed. Updated E2E Java sources compiled; browser E2E tests were not run locally.

Pull Request Notice

Pull Request Notice