feat(BA-5737): add project-scoped VFolder create/delete GraphQL mutations

Add createProjectVfolderV2, deleteProjectVfolderV2, and
bulkDeleteProjectVfoldersV2 mutations so that project admin flows have a
consistent project-scoped GraphQL surface alongside projectVfolders.

- New VFolderScopeAction subclasses (PROJECT scope) in
  actions/vfolder_in_project.py for create, delete, and bulk-delete.
- Service methods: create_in_project delegates to create_v2 with
  project_id; delete_in_project / bulk_delete_in_project verify
  vfolder.group == project_id before trashing.
- ScopeActionProcessor wiring with scope_rbac_validators — superadmin
  bypasses; regular users without explicit project grants get 403.
- Adapter methods, GQL resolvers (NEXT_RELEASE_VERSION), and schema
  registration.
- Unit tests for service methods (mocked repo) and component tests
  exercising real ScopeActionRBACValidator against DB.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: fregataa

src/ai/backend/manager/api/adapters/vfolder.py

@@ -125,6 +125,11 @@
 from ai.backend.manager.services.vfolder.actions.upload_session_v2 import (
     CreateUploadSessionV2Action,
 )
+from ai.backend.manager.services.vfolder.actions.vfolder_in_project import (
+    BulkDeleteVFoldersInProjectAction,
+    CreateVFolderInProjectAction,
+    DeleteVFolderInProjectAction,
+)
 from ai.backend.manager.services.vfolder.actions.vfolder_v2 import (
     DeleteVFolderV2Action,
     PurgeVFolderV2Action,
@@ -361,6 +366,64 @@ async def create(self, input: CreateVFolderInput) -> CreateVFolderPayload:
         result = await self._processors.vfolder.create_vfolder_v2.wait_for_complete(action)
         return CreateVFolderPayload(vfolder=self._vfolder_data_to_node(result.vfolder))
 
+    async def create_in_project(
+        self,
+        project_id: UUID,
+        input: CreateVFolderInput,
+    ) -> CreateVFolderPayload:
+        """Create a vfolder owned by ``project_id``.
+
+        Uses ``CreateVFolderInProjectAction`` which is PROJECT-scoped so the
+        caller must hold CREATE permission on the project.
+        """
+        me = current_user()
+        if me is None:
+            raise UnreachableError("User context is not available")
+        action = CreateVFolderInProjectAction(
+            project_id=project_id,
+            user_id=me.user_id,
+            domain_name=me.domain_name,
+            name=input.name,
+            host=input.host,
+            usage_mode=VFolderUsageMode(input.usage_mode.value),
+            permission=VFolderPermission(input.permission.value),
+            cloneable=input.cloneable,
+        )
+        result = await self._processors.vfolder.create_vfolder_in_project.wait_for_complete(action)
+        return CreateVFolderPayload(vfolder=self._vfolder_data_to_node(result.vfolder))
+
+    async def delete_in_project(
+        self,
+        project_id: UUID,
+        vfolder_id: UUID,
+    ) -> DeleteVFolderPayload:
+        """Soft-delete a vfolder belonging to ``project_id``.
+
+        Uses ``DeleteVFolderInProjectAction`` which is PROJECT-scoped so the
+        caller must hold DELETE permission on the project.
+        """
+        action = DeleteVFolderInProjectAction(
+            project_id=project_id,
+            vfolder_id=vfolder_id,
+        )
+        await self._processors.vfolder.delete_vfolder_in_project.wait_for_complete(action)
+        return DeleteVFolderPayload(id=vfolder_id)
+
+    async def bulk_delete_in_project(
+        self,
+        project_id: UUID,
+        input: BulkDeleteVFoldersInput,
+    ) -> BulkDeleteVFoldersPayload:
+        """Soft-delete multiple vfolders that all belong to ``project_id``."""
+        action = BulkDeleteVFoldersInProjectAction(
+            project_id=project_id,
+            vfolder_ids=list(input.ids),
+        )
+        result = await self._processors.vfolder.bulk_delete_vfolders_in_project.wait_for_complete(
+            action
+        )
+        return BulkDeleteVFoldersPayload(deleted_count=len(result.deleted_vfolder_ids))
+
     async def create_upload_session(
         self, vfolder_id: UUID, input: CreateUploadSessionInput
     ) -> CreateUploadSessionPayload:

src/ai/backend/manager/api/gql/schema.py

@@ -412,10 +412,13 @@
 )
 from .vfolder_v2 import (
     admin_vfolders_v2,
+    bulk_delete_project_vfolders_v2,
     bulk_delete_vfolders_v2,
     bulk_purge_vfolders_v2,
     clone_vfolder_v2,
+    create_project_vfolder_v2,
     create_vfolder_v2,
+    delete_project_vfolder_v2,
     delete_vfolder_v2,
     deploy_vfolder_v2,
     my_vfolders,
@@ -845,6 +848,9 @@ class Mutation:
     deploy_vfolder_v2 = deploy_vfolder_v2
     bulk_delete_vfolders_v2 = bulk_delete_vfolders_v2
     bulk_purge_vfolders_v2 = bulk_purge_vfolders_v2
+    create_project_vfolder_v2 = create_project_vfolder_v2
+    delete_project_vfolder_v2 = delete_project_vfolder_v2
+    bulk_delete_project_vfolders_v2 = bulk_delete_project_vfolders_v2
     clone_vfolder_v2 = clone_vfolder_v2
     vfolder_list_files_v2 = vfolder_list_files_v2
     vfolder_mkdir_v2 = vfolder_mkdir_v2

src/ai/backend/manager/api/gql/vfolder_v2/__init__.py

@@ -6,10 +6,13 @@
 
 from .resolver import (
     admin_vfolders_v2,
+    bulk_delete_project_vfolders_v2,
     bulk_delete_vfolders_v2,
     bulk_purge_vfolders_v2,
     clone_vfolder_v2,
+    create_project_vfolder_v2,
     create_vfolder_v2,
+    delete_project_vfolder_v2,
     delete_vfolder_v2,
     deploy_vfolder_v2,
     my_vfolders,
@@ -45,9 +48,12 @@
     "project_vfolders",
     "vfolder_v2",
     # Mutations
+    "bulk_delete_project_vfolders_v2",
     "bulk_delete_vfolders_v2",
     "bulk_purge_vfolders_v2",
+    "create_project_vfolder_v2",
     "create_vfolder_v2",
+    "delete_project_vfolder_v2",
     "delete_vfolder_v2",
     "deploy_vfolder_v2",
     "purge_vfolder_v2",

src/ai/backend/manager/api/gql/vfolder_v2/resolver/__init__.py

@@ -1,10 +1,13 @@
 """VFolder GraphQL resolver package."""
 
 from .mutation import (
+    bulk_delete_project_vfolders_v2,
     bulk_delete_vfolders_v2,
     bulk_purge_vfolders_v2,
     clone_vfolder_v2,
+    create_project_vfolder_v2,
     create_vfolder_v2,
+    delete_project_vfolder_v2,
     delete_vfolder_v2,
     deploy_vfolder_v2,
     purge_vfolder_v2,
@@ -24,9 +27,12 @@
     "project_vfolders",
     "vfolder_v2",
     # Mutations
+    "bulk_delete_project_vfolders_v2",
     "bulk_delete_vfolders_v2",
     "bulk_purge_vfolders_v2",
+    "create_project_vfolder_v2",
     "create_vfolder_v2",
+    "delete_project_vfolder_v2",
     "delete_vfolder_v2",
     "deploy_vfolder_v2",
     "purge_vfolder_v2",

src/ai/backend/manager/api/gql/vfolder_v2/resolver/mutation.py

@@ -6,6 +6,7 @@
 
 from strawberry import Info
 
+from ai.backend.common.meta.meta import NEXT_RELEASE_VERSION
 from ai.backend.manager.api.gql.decorators import BackendAIGQLMeta, gql_mutation
 from ai.backend.manager.api.gql.types import StrawberryGQLContext
 from ai.backend.manager.api.gql.vfolder_v2.types.mutations import (
@@ -227,6 +228,65 @@ async def bulk_delete_vfolders_v2(
     return BulkDeleteVFoldersPayloadGQL.from_pydantic(payload)
 
 
+@gql_mutation(
+    BackendAIGQLMeta(
+        added_version=NEXT_RELEASE_VERSION,
+        description=(
+            "Create a virtual folder owned by the specified project. "
+            "Requires project-scoped CREATE permission."
+        ),
+    )
+)  # type: ignore[misc]
+async def create_project_vfolder_v2(
+    info: Info[StrawberryGQLContext],
+    project_id: UUID,
+    input: CreateVFolderInputGQL,
+) -> CreateVFolderPayloadGQL:
+    """Create a new virtual folder scoped to a project."""
+    payload = await info.context.adapters.vfolder.create_in_project(project_id, input.to_pydantic())
+    return CreateVFolderPayloadGQL.from_pydantic(payload)
+
+
+@gql_mutation(
+    BackendAIGQLMeta(
+        added_version=NEXT_RELEASE_VERSION,
+        description=(
+            "Soft-delete a virtual folder that belongs to the specified project. "
+            "Requires project-scoped DELETE permission."
+        ),
+    )
+)  # type: ignore[misc]
+async def delete_project_vfolder_v2(
+    info: Info[StrawberryGQLContext],
+    project_id: UUID,
+    vfolder_id: UUID,
+) -> DeleteVFolderPayloadGQL:
+    """Soft-delete a project-owned virtual folder."""
+    payload = await info.context.adapters.vfolder.delete_in_project(project_id, vfolder_id)
+    return DeleteVFolderPayloadGQL.from_pydantic(payload)
+
+
+@gql_mutation(
+    BackendAIGQLMeta(
+        added_version=NEXT_RELEASE_VERSION,
+        description=(
+            "Soft-delete multiple virtual folders that all belong to the specified project. "
+            "Requires project-scoped DELETE permission."
+        ),
+    )
+)  # type: ignore[misc]
+async def bulk_delete_project_vfolders_v2(
+    info: Info[StrawberryGQLContext],
+    project_id: UUID,
+    input: BulkDeleteVFoldersInputGQL,
+) -> BulkDeleteVFoldersPayloadGQL:
+    """Soft-delete multiple project-owned virtual folders."""
+    payload = await info.context.adapters.vfolder.bulk_delete_in_project(
+        project_id, input.to_pydantic()
+    )
+    return BulkDeleteVFoldersPayloadGQL.from_pydantic(payload)
+
+
 @gql_mutation(
     BackendAIGQLMeta(
         added_version="26.4.2",