docs: TLDR de tenant-isolation comments en docstrings

Author: uittenbroekrobbert

operations-manager/python/opi/core/git_monitor.py

@@ -39,11 +39,7 @@ async def check_and_create_namespaces(project_data: dict[str, Any]) -> bool:
     """
     kubectl = create_kubectl_connector()
 
-    # Tenant-isolation guard: this path reads the project file directly from
-    # git, bypassing ProjectManager.get_deployments. Without the same pin a
-    # tenant who commits a project file with another tenant's namespace would
-    # make OPI create and label that victim namespace. Pin (and fail closed)
-    # here too, using the shared helper so both paths stay in lockstep.
+    # Bypasses ProjectManager.get_deployments, so pin here too.
     enforce_namespace_pin(project_data)
 
     project_name = project_data.get("name")
@@ -153,10 +149,7 @@ async def file_change_handler(file_path: str, content: dict) -> None:
             try:
                 namespace_success = await check_and_create_namespaces(content)
             except ValueError as exc:
-                # Tenant-isolation guard rejected a project file that declared
-                # a namespace not equal to its project name. Fail closed: do
-                # not create or label anything, and do not crash the polling
-                # loop - just log the rejected cross-tenant attempt.
+                # Mismatched namespace; skip this project, keep polling loop alive.
                 logger.error(f"Rejected project '{project_name}' from git monitor: {exc}")
                 return
 

operations-manager/python/opi/core/simple_background.py

@@ -290,22 +290,14 @@ async def process_project_yaml_background(
     deployment_name: str | None = None,
     is_new_project: bool = False,
 ) -> None:
-    """Background task that creates a project from pre-built YAML content.
+    """Background task that creates a project from pre-built wizard YAML.
 
-    Unlike ``process_project_background`` which takes a
-    ``SelfServiceProjectRequest`` and generates YAML, this function
-    receives the final YAML string directly (produced by the wizard
-    with editables and generators).
-
-    The remaining pipeline is identical: git commit, ProjectManager
-    deployment, ArgoCD monitoring, and progress tracking.
+    Same pipeline as ``process_project_background``.
 
     Args:
-        is_new_project: True when called from the create flow (wizard
-            "new project"). When True a project file with this name must
-            not already exist - overwriting it would let one tenant take
-            over another tenant's project. The update/edit flows pass
-            False because they intentionally rewrite an existing file.
+        is_new_project: True for the create flow only. When True the file
+            must not already exist (or one tenant overwrites another).
+            Update/edit flows pass False.
     """
     try:
         logger.info(f"Background task {task_id} starting for project: {project_name} (from wizard YAML)")
@@ -341,12 +333,7 @@ async def process_project_yaml_background(
             project_file_path = f"projects/{project_name}.yaml"
             commit_message = f"Create project {project_name}"
 
-            # Tenant-isolation guard: on the create flow a project file with
-            # this name must not already exist. Without this check a tenant
-            # could submit the wizard with another tenant's project name and
-            # silently overwrite their project file, flipping ownership on
-            # the next reload. The update/edit flows pass is_new_project=False
-            # because they legitimately rewrite an existing file.
+            # Create flow only: existing file would let one tenant overwrite another.
             if is_new_project and await git_connector_for_project_files.file_exists(project_file_path):
                 error_msg = (
                     f"Project '{project_name}' bestaat al. "

operations-manager/python/opi/core/task_handlers_project.py

@@ -104,11 +104,7 @@ async def handle_create_project(payload: dict, progress: Any) -> dict:
         project_file_path = f"projects/{project_name}.yaml"
         commit_message = f"Create project {project_name}"
 
-        # Tenant-isolation guard: this is the create path, so a project file
-        # with this name must not already exist. Without this check a tenant
-        # could pick another tenant's project name and silently overwrite
-        # their project file, taking over ownership on reload. Mirrors the
-        # guard in simple_background.process_project_background.
+        # Create flow: bail if file exists (would overwrite another tenant's project).
         if await git_connector_for_project_files.file_exists(project_file_path):
             error_msg = (
                 f"Project '{project_name}' bestaat al. "

operations-manager/python/opi/handlers/project_file_handler.py

@@ -2138,36 +2138,12 @@ async def extract_deployment_helm_chart_values(
         return {}
 
     def extract_deployment_namespace(self, project_data: dict[str, Any], deployment_name: str) -> str | None:
-        """
-        Extract the namespace for a deployment, pinned to the project name.
-
-        The project file is attacker-controlled. A deployment declaring a
-        namespace that doesn't match the project name would direct OPI to
-        operate on a victim namespace (cross-tenant isolation breach). This
-        function enforces the same invariant as
-        ``project_manager.enforce_namespace_pin`` -- declared namespace must
-        equal project name, missing namespace defaults to the project name --
-        but locally and without mutating ``project_data``. It is called from
-        backup/restore endpoints and tasks that read project YAML directly
-        rather than via ``ProjectManager.get_deployments`` (which is the
-        canonical pinned reader).
-
-        Note: To get the actual Kubernetes namespace, use
-        get_prefixed_namespace(cluster, namespace) from
-        opi.core.cluster_config.
-
-        Args:
-            project_data: The parsed project data
-            deployment_name: Name of the deployment
+        """Return the deployment namespace pinned to the project name.
 
-        Returns:
-            The project-name-pinned namespace if the deployment exists,
-            None if no deployment with that name is found.
-
-        Raises:
-            ValueError: If the deployment exists and declares a namespace
-                that does not match the project name. Same message shape as
-                ``enforce_namespace_pin``.
+        Same invariant as ``project_manager.enforce_namespace_pin`` but
+        local and non-mutating. Used by callers that don't go through
+        ``ProjectManager.get_deployments`` (backup/restore endpoints, tasks).
+        Raises ValueError on mismatch.
         """
         project_name = project_data.get("name")
         for deployment in project_data.get("deployments", []):

operations-manager/python/opi/manager/project_manager.py

@@ -129,28 +129,12 @@
 
 
 def enforce_namespace_pin(project_data: dict[str, Any]) -> None:
-    """Pin every deployment namespace to the project name.
-
-    The project file is attacker-controlled. An explicit ``namespace``
-    pointing at another project would make OPI label and operate on a
-    victim namespace and generate ArgoCD resources targeting it
-    (cross-tenant isolation breach). Default the namespace when absent
-    (the legitimate common case) and reject any explicit value that
-    differs. We fail closed instead of silently rewriting, so a mismatch
-    surfaces the actual intent.
-
-    This mutates ``project_data`` in place so every code path that reads
-    ``deployment["namespace"]`` afterwards sees the pinned value. It must
-    be called by every entry point that turns a project file into
-    namespace or ArgoCD actions - not only ``ProjectManager.get_deployments``
-    but also the git-monitor path, which reads the project file directly.
-
-    Args:
-        project_data: The parsed project file contents.
-
-    Raises:
-        ValueError: If a deployment specifies a namespace that does not
-            match the project name.
+    """Pin every deployment namespace to the project name (mutates in place).
+
+    Defaults a missing namespace to the project name; raises ValueError on
+    mismatch. Must be called by every entry that turns a project file into
+    namespace/ArgoCD actions, otherwise a tenant can label another
+    project's namespace.
     """
     project_name = project_data.get("name")
     if not project_name: