feat(BA-5764): add RBAC-enforced VFolder delete and restore mutations (#11164)

Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
Co-authored-by: octodog <[email protected]>

Author: 3 people

changes/11164.feature.md

@@ -0,0 +1 @@
+Add RBAC-enforced VFolder delete and restore v2 mutations with SingleEntityActionProcessor.

docs/manager/graphql-reference/supergraph.graphql

@@ -10804,6 +10804,11 @@ type Mutation
   """Added in 26.4.2. Permanently purge a virtual folder."""
   purgeVfolderV2(vfolderId: UUID!): PurgeVFolderV2Payload! @join__field(graph: STRAWBERRY)
 
+  """
+  Added in UNRELEASED. Restore a trashed virtual folder. RBAC enforced via scope chain.
+  """
+  restoreVFolder(vfolderId: UUID!): RestoreVFolderPayload! @join__field(graph: STRAWBERRY)
+
   """Added in 26.4.2. Deploy a deployment directly from a model VFolder."""
   deployVfolderV2(vfolderId: UUID!, input: DeployVFolderV2Input!): DeployVFolderV2Payload! @join__field(graph: STRAWBERRY)
 
@@ -14638,6 +14643,16 @@ type RestoreArtifactsPayload
   artifacts: [Artifact!]!
 }
 
+"""
+Added in UNRELEASED. Payload returned after restoring a virtual folder from trash.
+"""
+type RestoreVFolderPayload
+  @join__type(graph: STRAWBERRY)
+{
+  """ID of the restored virtual folder"""
+  id: UUID!
+}
+
 """
 Added in 26.4.3. Per-deployment result of an admin bulk revision refresh.
 """

docs/manager/graphql-reference/v2-schema.graphql

@@ -6794,6 +6794,11 @@ type Mutation {
   """Added in 26.4.2. Permanently purge a virtual folder."""
   purgeVfolderV2(vfolderId: UUID!): PurgeVFolderV2Payload!
 
+  """
+  Added in UNRELEASED. Restore a trashed virtual folder. RBAC enforced via scope chain.
+  """
+  restoreVFolder(vfolderId: UUID!): RestoreVFolderPayload!
+
   """Added in 26.4.2. Deploy a deployment directly from a model VFolder."""
   deployVfolderV2(vfolderId: UUID!, input: DeployVFolderV2Input!): DeployVFolderV2Payload!
 
@@ -9696,6 +9701,14 @@ type RestoreArtifactsPayload {
   artifacts: [Artifact!]!
 }
 
+"""
+Added in UNRELEASED. Payload returned after restoring a virtual folder from trash.
+"""
+type RestoreVFolderPayload {
+  """ID of the restored virtual folder"""
+  id: UUID!
+}
+
 """
 Added in 26.4.3. Per-deployment result of an admin bulk revision refresh.
 """

src/ai/backend/client/cli/v2/vfolder/commands.py

@@ -195,6 +195,22 @@ async def _run() -> None:
     asyncio.run(_run())
 
 
+@vfolder.command()
+@click.argument("vfolder_id", type=click.UUID)
+def restore(vfolder_id: UUID) -> None:
+    """Restore a trashed vfolder."""
+
+    async def _run() -> None:
+        registry = await create_v2_registry(load_v2_config())
+        try:
+            result = await registry.vfolder.restore(vfolder_id)
+            print_result(result)
+        finally:
+            await registry.close()
+
+    asyncio.run(_run())
+
+
 @vfolder.command()
 @click.argument("vfolder_id", type=click.UUID)
 @click.option(

src/ai/backend/client/v2/domains_v2/vfolder.py

@@ -33,6 +33,7 @@
     MkdirPayload,
     MoveFilePayload,
     PurgeVFolderPayload,
+    RestoreVFolderPayload,
     SearchVFoldersPayload,
     VFolderNode,
 )
@@ -126,6 +127,14 @@ async def purge(self, vfolder_id: UUID) -> PurgeVFolderPayload:
             response_model=PurgeVFolderPayload,
         )
 
+    async def restore(self, vfolder_id: UUID) -> RestoreVFolderPayload:
+        """Restore a trashed vfolder."""
+        return await self._client.typed_request(
+            "POST",
+            f"{_PATH}/{vfolder_id}/restore",
+            response_model=RestoreVFolderPayload,
+        )
+
     async def deploy(
         self,
         vfolder_id: UUID,

src/ai/backend/manager/api/adapters/vfolder.py

@@ -40,6 +40,7 @@
     MkdirPayload,
     MoveFilePayload,
     PurgeVFolderPayload,
+    RestoreVFolderPayload,
     SearchVFoldersPayload,
     VFolderNode,
 )
@@ -93,14 +94,19 @@
     combine_conditions_or,
     negate_conditions,
 )
+from ai.backend.manager.repositories.base.updater import Updater
 from ai.backend.manager.repositories.vfolder.types import (
     ProjectVFolderSearchScope,
     UserVFolderSearchScope,
 )
+from ai.backend.manager.repositories.vfolder.updaters import VFolderTrashUpdaterSpec
 from ai.backend.manager.services.deployment.actions.create_deployment import CreateDeploymentAction
 from ai.backend.manager.services.vfolder.actions.admin_search_vfolders import (
     AdminSearchVFoldersAction,
 )
+from ai.backend.manager.services.vfolder.actions.base import (
+    RestoreVFolderFromTrashAction,
+)
 from ai.backend.manager.services.vfolder.actions.batch_load_by_ids import (
     BatchLoadVFoldersByIdsAction,
 )
@@ -127,6 +133,9 @@
     DeleteVFolderV2Action,
     PurgeVFolderV2Action,
 )
+from ai.backend.manager.services.vfolder.actions.vfolder_v2_rbac import (
+    DeleteVFolderV2RBACAction,
+)
 
 from .base import BaseAdapter
 
@@ -383,13 +392,23 @@ async def get(self, vfolder_id: UUID) -> VFolderNode:
         return self._vfolder_data_to_node(result.vfolder)
 
     async def delete(self, vfolder_id: UUID) -> DeleteVFolderPayload:
-        """Soft-delete a vfolder (move to trash)."""
+        """Soft-delete a vfolder (move to trash). RBAC enforced."""
+        updater = Updater(spec=VFolderTrashUpdaterSpec(), pk_value=vfolder_id)
+        action = DeleteVFolderV2RBACAction(vfolder_id=vfolder_id, updater=updater)
+        await self._processors.vfolder.delete_v2_rbac.wait_for_complete(action)
+        return DeleteVFolderPayload(id=vfolder_id)
+
+    async def restore(self, vfolder_id: UUID) -> RestoreVFolderPayload:
+        """Restore a trashed vfolder. RBAC enforced."""
         me = current_user()
         if me is None:
             raise UnreachableError("User context is not available")
-        action = DeleteVFolderV2Action(user_id=me.user_id, vfolder_id=vfolder_id)
-        await self._processors.vfolder.delete_v2.wait_for_complete(action)
-        return DeleteVFolderPayload(id=vfolder_id)
+        action = RestoreVFolderFromTrashAction(
+            user_uuid=me.user_id,
+            vfolder_uuid=vfolder_id,
+        )
+        await self._processors.vfolder.restore_vfolder_from_trash.wait_for_complete(action)
+        return RestoreVFolderPayload(id=vfolder_id)
 
     async def purge(self, vfolder_id: UUID) -> PurgeVFolderPayload:
         """Permanently delete a vfolder."""

src/ai/backend/manager/api/gql/schema.py

@@ -421,6 +421,7 @@
     my_vfolders,
     project_vfolders,
     purge_vfolder_v2,
+    restore_vfolder_v2,
     vfolder_create_download_session_v2,
     vfolder_create_upload_session_v2,
     vfolder_delete_files_v2,
@@ -842,6 +843,7 @@ class Mutation:
     create_vfolder_v2 = create_vfolder_v2
     delete_vfolder_v2 = delete_vfolder_v2
     purge_vfolder_v2 = purge_vfolder_v2
+    restore_vfolder_v2 = restore_vfolder_v2
     deploy_vfolder_v2 = deploy_vfolder_v2
     bulk_delete_vfolders_v2 = bulk_delete_vfolders_v2
     bulk_purge_vfolders_v2 = bulk_purge_vfolders_v2

src/ai/backend/manager/api/gql/vfolder_v2/__init__.py

@@ -15,6 +15,7 @@
     my_vfolders,
     project_vfolders,
     purge_vfolder_v2,
+    restore_vfolder_v2,
     vfolder_create_download_session_v2,
     vfolder_create_upload_session_v2,
     vfolder_delete_files_v2,
@@ -51,6 +52,7 @@
     "delete_vfolder_v2",
     "deploy_vfolder_v2",
     "purge_vfolder_v2",
+    "restore_vfolder_v2",
     "clone_vfolder_v2",
     "vfolder_list_files_v2",
     "vfolder_mkdir_v2",

src/ai/backend/manager/api/gql/vfolder_v2/resolver/__init__.py

@@ -8,6 +8,7 @@
     delete_vfolder_v2,
     deploy_vfolder_v2,
     purge_vfolder_v2,
+    restore_vfolder_v2,
     vfolder_create_download_session_v2,
     vfolder_create_upload_session_v2,
     vfolder_delete_files_v2,
@@ -30,6 +31,7 @@
     "delete_vfolder_v2",
     "deploy_vfolder_v2",
     "purge_vfolder_v2",
+    "restore_vfolder_v2",
     "clone_vfolder_v2",
     "vfolder_list_files_v2",
     "vfolder_mkdir_v2",

src/ai/backend/manager/api/gql/vfolder_v2/resolver/mutation.py

@@ -6,6 +6,7 @@
 
 from strawberry import Info
 
+from ai.backend.common.meta.meta import NEXT_RELEASE_VERSION
 from ai.backend.manager.api.gql.decorators import BackendAIGQLMeta, gql_mutation
 from ai.backend.manager.api.gql.types import StrawberryGQLContext
 from ai.backend.manager.api.gql.vfolder_v2.types.mutations import (
@@ -31,6 +32,7 @@
     MoveFileInputGQL,
     MoveFilePayloadGQL,
     PurgeVFolderPayloadGQL,
+    RestoreVFolderPayloadGQL,
     UploadSessionInputGQL,
     UploadSessionPayloadGQL,
 )
@@ -78,6 +80,22 @@ async def purge_vfolder_v2(
     return PurgeVFolderPayloadGQL.from_pydantic(payload)
 
 
+@gql_mutation(
+    BackendAIGQLMeta(
+        added_version=NEXT_RELEASE_VERSION,
+        description="Restore a trashed virtual folder. RBAC enforced via scope chain.",
+    ),
+    name="restoreVFolder",
+)  # type: ignore[misc]
+async def restore_vfolder_v2(
+    info: Info[StrawberryGQLContext],
+    vfolder_id: UUID,
+) -> RestoreVFolderPayloadGQL:
+    """Restore a virtual folder from trash."""
+    payload = await info.context.adapters.vfolder.restore(vfolder_id)
+    return RestoreVFolderPayloadGQL.from_pydantic(payload)
+
+
 @gql_mutation(
     BackendAIGQLMeta(
         added_version="26.4.2",