feat(BA-4178): Add scope types - resource group, container registry, and artifact registry #8491

fregataa · 2026-01-30T19:51:57Z

Summary

Add RESOURCE_GROUP, CONTAINER_REGISTRY, ARTIFACT_REGISTRY, and STORAGE_HOST to ScopeType enum

Checklist: (if applicable)

Milestone metadata specifying the target backport version
Mention to the original issue
Installer updates including:
- Fixtures for db schema changes
- New mandatory config options
Update of end-to-end CLI integration tests in ai.backend.test
API server-client counterparts (e.g., manager API -> client SDK)
Test case(s) to:
- Demonstrate the difference of before/after
- Demonstrate the flow of abstract/conceptual models with a concrete implementation
Documentation
- Contents in the docs directory
- docstrings in public interfaces and type annotations

Copilot

Pull request overview

This PR implements scope search functionality for three new scope types (resource group, container registry, and artifact registry) and adds a fourth scope type (storage host) that raises NotImplementedError since its data resides in etcd.

Changes:

Added RESOURCE_GROUP, CONTAINER_REGISTRY, ARTIFACT_REGISTRY, and STORAGE_HOST to the ScopeType enum
Implemented complete scope search infrastructure (conditions, orders, queriers, and database methods) for resource group, container registry, and artifact registry
Added NotSupportedOrderingType error for scope types that don't support CREATED_AT ordering (container and artifact registries)

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
src/ai/backend/common/data/permission/types.py	Added four new scope types to ScopeType enum
src/ai/backend/manager/repositories/permission_controller/repository.py	Added case statements to route new scope types to appropriate db_source methods
src/ai/backend/manager/repositories/permission_controller/options.py	Implemented condition and order classes for filtering and sorting the three new database-backed scope types
src/ai/backend/manager/repositories/permission_controller/db_source/db_source.py	Added search methods for querying resource groups, container registries, artifact registries, and storage hosts (raises NotImplementedError)
src/ai/backend/manager/errors/permission.py	Added NotSupportedOrderingType error for handling unsupported ordering operations
src/ai/backend/manager/api/rbac/scope_adapter.py	Implemented adapter methods to build queriers and convert filters/orders for the new scope types

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-30T19:59:14Z

src/ai/backend/manager/repositories/permission_controller/db_source/db_source.py

+    async def search_resource_group_scopes(
+        self,
+        querier: BatchQuerier,
+    ) -> ScopeListResult:
+        async with self._db.begin_readonly_session_read_committed() as db_sess:
+            query = sa.select(ScalingGroupRow.name)
+            result = await execute_batch_querier(
+                db_sess,
+                query,
+                querier,
+            )
+
+            items = [
+                ScopeData(
+                    id=ScopeId(scope_type=ScopeType.RESOURCE_GROUP, scope_id=row.name),
+                    name=row.name,
+                )
+                for row in result.rows
+            ]
+
+            return ScopeListResult(
+                items=items,
+                total_count=result.total_count,
+                has_next_page=result.has_next_page,
+                has_previous_page=result.has_previous_page,
+            )


The new scope search methods for RESOURCE_GROUP, CONTAINER_REGISTRY, and ARTIFACT_REGISTRY lack test coverage. The existing test file tests/unit/manager/repositories/permission_controller/test_search_scopes.py has comprehensive tests for DOMAIN, PROJECT, USER, and GLOBAL scope types, but does not include tests for the newly added scope types. Consider adding similar test classes (e.g., TestSearchResourceGroupScopes, TestSearchContainerRegistryScopes, TestSearchArtifactRegistryScopes) to ensure the new functionality works correctly.

src/ai/backend/manager/api/rbac/scope_adapter.py

src/ai/backend/manager/repositories/permission_controller/db_source/db_source.py

jopemachine · 2026-02-02T02:11:35Z

src/ai/backend/common/data/permission/types.py

    USER = "user"
    GLOBAL = "global"

+    # Scopes that are also treated as entity types


I have a question.
Could domain, user, project also be treated as entity types?

yes, they are. this comment is confusing so I deleted

jopemachine · 2026-02-02T02:14:21Z

src/ai/backend/manager/repositories/permission_controller/db_source/db_source.py

+    async def search_storage_host_scopes(
+        self,
+        querier: BatchQuerier,
+    ) -> ScopeListResult:
+        raise NotImplementedError("Storage host data is stored in etcd, not in the database.")


I think we'd just better remove this (it should be etcd_source or other)

since we have a plan to migrate the data from etcd to db, I left a TODO comment here

HyeockJinKim · 2026-02-03T04:04:05Z

src/ai/backend/manager/errors/permission.py

        )
+
+
+class NotSupportedOrderingType(BackendAIError, web.HTTPBadRequest):


It does seem close to UnsupportedOrderingType, but this error doesn't appear necessary. (I believe the type checker should catch it.)

HyeockJinKim · 2026-02-03T04:04:57Z

src/ai/backend/manager/repositories/permission_controller/db_source/db_source.py

+        querier: BatchQuerier,
+    ) -> ScopeListResult:
+        async with self._db.begin_readonly_session_read_committed() as db_sess:
+            query = sa.select(ScalingGroupRow.name)


Do we really have to query just the Name?

src/ai/backend/manager/api/rbac/scope_adapter.py

HyeockJinKim · 2026-02-03T04:06:35Z

src/ai/backend/manager/repositories/permission_controller/repository.py

+            case ScopeType.RESOURCE_GROUP:
+                return await self._db_source.search_resource_group_scopes(querier)
+            case ScopeType.CONTAINER_REGISTRY:
+                return await self._db_source.search_container_registry_scopes(querier)
+            case ScopeType.ARTIFACT_REGISTRY:
+                return await self._db_source.search_artifact_registry_scopes(querier)
+            case ScopeType.STORAGE_HOST:
+                return await self._db_source.search_storage_host_scopes(querier)


I don't understand why this is necessary. We agreed not to include repository queries like this in the internal implementation. This implementation should not be included.

…egistry, and artifact registry

fregataa added this to the 26.2 milestone Jan 30, 2026

fregataa self-assigned this Jan 30, 2026

Copilot AI review requested due to automatic review settings January 30, 2026 19:51

fregataa marked this pull request as draft January 30, 2026 19:52

github-actions bot added size:L 100~500 LoC comp:manager Related to Manager component comp:common Related to Common component labels Jan 30, 2026

Copilot started reviewing on behalf of fregataa January 30, 2026 19:52 View session

Copilot AI reviewed Jan 30, 2026

View reviewed changes

fregataa changed the title ~~feat(BA-4178): Implement scope search for resource group, container registry, and artifact registry~~ feat(BA-4178): Add scope types - resource group, container registry, and artifact registry Jan 31, 2026

fregataa force-pushed the feat/BA-4178-expand-scope-types branch from 3a5f8e0 to 701f98b Compare February 2, 2026 01:38

github-actions bot added size:XL 500~ LoC and removed size:L 100~500 LoC labels Feb 2, 2026

fregataa marked this pull request as ready for review February 2, 2026 01:42

fregataa requested review from HyeockJinKim and jopemachine February 2, 2026 01:42

jopemachine reviewed Feb 2, 2026

View reviewed changes

fregataa force-pushed the feat/BA-4178-expand-scope-types branch from 701f98b to 6d86ff7 Compare February 2, 2026 05:22

HyeockJinKim requested changes Feb 3, 2026

View reviewed changes

fregataa marked this pull request as draft February 3, 2026 05:23

fregataa added 5 commits February 3, 2026 15:13

feat(BA-2841): Implement scope search for resource group, container r…

1430750

…egistry, and artifact registry

add news fragment

643363e

test(BA-2841): Add unit tests for new scope type search

188ff37

update comments

c25d6f3

revert adding more functions

8f966e8

fregataa force-pushed the feat/BA-4178-expand-scope-types branch from 6d86ff7 to 8f966e8 Compare February 3, 2026 06:22

github-actions bot added size:S 10~30 LoC and removed size:XL 500~ LoC labels Feb 3, 2026

update news fragment

1d32446

fregataa requested a review from HyeockJinKim February 3, 2026 06:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(BA-4178): Add scope types - resource group, container registry, and artifact registry #8491

feat(BA-4178): Add scope types - resource group, container registry, and artifact registry #8491

fregataa commented Jan 30, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 30, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jopemachine Feb 2, 2026

Uh oh!

fregataa Feb 2, 2026

Uh oh!

jopemachine Feb 2, 2026 •

edited

Loading

Uh oh!

fregataa Feb 2, 2026

Uh oh!

HyeockJinKim Feb 3, 2026

Uh oh!

HyeockJinKim Feb 3, 2026

Uh oh!

Uh oh!

HyeockJinKim Feb 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		)


		class NotSupportedOrderingType(BackendAIError, web.HTTPBadRequest):

feat(BA-4178): Add scope types - resource group, container registry, and artifact registry #8491

Are you sure you want to change the base?

feat(BA-4178): Add scope types - resource group, container registry, and artifact registry #8491

Conversation

fregataa commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jopemachine Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

fregataa Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

jopemachine Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fregataa Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

HyeockJinKim Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

HyeockJinKim Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

HyeockJinKim Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

fregataa commented Jan 30, 2026 •

edited

Loading

jopemachine Feb 2, 2026 •

edited

Loading