refactor(BA-5737): fold project_id into CreateVFolderInProjectInput

Align with the TerminateSessionsInProjectInput precedent: the *InProject
input DTO carries project_id as a field, and the adapter takes a single
DTO (no separate project_id parameter). GQL mutation drops the standalone
projectId argument; REST handler overrides body.project_id with the URL
path segment so the URL remains authoritative.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: fregataa

src/ai/backend/client/cli/v2/vfolder/commands.py

@@ -187,6 +187,7 @@ def project_create(
     from ai.backend.common.dto.manager.v2.vfolder.types import VFolderUsageMode
 
     input_dto = CreateVFolderInProjectInput(
+        project_id=project_id,
         name=name,
         usage_mode=VFolderUsageMode(usage_mode),
         host=host,
@@ -196,7 +197,7 @@ def project_create(
     async def _run() -> None:
         registry = await create_v2_registry(load_v2_config())
         try:
-            result = await registry.vfolder.create_in_project(project_id, input_dto)
+            result = await registry.vfolder.create_in_project(input_dto)
             print_result(result)
         finally:
             await registry.close()

src/ai/backend/client/v2/domains_v2/vfolder.py

@@ -81,13 +81,15 @@ async def create(self, request: CreateVFolderInput) -> CreateVFolderPayload:
 
     async def create_in_project(
         self,
-        project_id: UUID,
         request: CreateVFolderInProjectInput,
     ) -> CreateVFolderPayload:
-        """Create a vfolder owned by a project."""
+        """Create a vfolder owned by a project.
+
+        The target project is read from ``request.project_id``.
+        """
         return await self._client.typed_request(
             "POST",
-            f"{_PATH}/projects/{project_id}",
+            f"{_PATH}/projects/{request.project_id}",
             request=request,
             response_model=CreateVFolderPayload,
         )

src/ai/backend/common/dto/manager/v2/vfolder/request.py

@@ -88,10 +88,13 @@ def strip_and_validate_name(cls, v: object) -> object:
 class CreateVFolderInProjectInput(BaseRequestModel):
     """Input for creating a virtual folder within a project.
 
-    Unlike ``CreateVFolderInput``, ``project_id`` is supplied as a separate
-    mutation/path argument so this model contains only the payload fields.
+    The project the vfolder belongs to is identified by ``project_id``. In
+    transport layers where the scope is expressed separately (REST path
+    segment, GraphQL scope argument), that value is injected into this
+    field before the DTO reaches the adapter.
     """
 
+    project_id: UUID = Field(description="Project UUID that owns the vfolder")
     name: VFolderName = Field(description="VFolder name")
     host: str | None = Field(default=None, description="Storage host for the vfolder")
     usage_mode: VFolderUsageMode = Field(

src/ai/backend/manager/api/adapters/vfolder.py

@@ -369,10 +369,9 @@ async def create(self, input: CreateVFolderInput) -> CreateVFolderPayload:
 
     async def create_in_project(
         self,
-        project_id: UUID,
         input: CreateVFolderInProjectInput,
     ) -> CreateVFolderPayload:
-        """Create a vfolder owned by ``project_id``.
+        """Create a vfolder owned by ``input.project_id``.
 
         Uses ``CreateVFolderInProjectAction`` which is PROJECT-scoped so the
         caller must hold CREATE permission on the project.
@@ -381,7 +380,7 @@ async def create_in_project(
         if me is None:
             raise UnreachableError("User context is not available")
         action = CreateVFolderInProjectAction(
-            project_id=project_id,
+            project_id=input.project_id,
             user_id=me.user_id,
             domain_name=me.domain_name,
             name=input.name,

src/ai/backend/manager/api/gql/vfolder_v2/resolver/mutation.py

@@ -258,11 +258,10 @@ async def bulk_delete_vfolders_v2(
 )  # type: ignore[misc]
 async def create_vfolder_in_project(
     info: Info[StrawberryGQLContext],
-    project_id: UUID,
     input: CreateVFolderInProjectInputGQL,
 ) -> CreateVFolderPayloadGQL:
     """Create a new virtual folder scoped to a project."""
-    payload = await info.context.adapters.vfolder.create_in_project(project_id, input.to_pydantic())
+    payload = await info.context.adapters.vfolder.create_in_project(input.to_pydantic())
     return CreateVFolderPayloadGQL.from_pydantic(payload)
 
 

src/ai/backend/manager/api/gql/vfolder_v2/types/mutations.py

@@ -138,6 +138,7 @@ class CreateVFolderInputGQL(PydanticInputMixin[CreateInputDTO]):
     name="CreateVFolderInProjectInput",
 )
 class CreateVFolderInProjectInputGQL(PydanticInputMixin[CreateInProjectInputDTO]):
+    project_id: UUID = gql_field(description="Project UUID that owns the vfolder.")
     name: str = gql_field(description="VFolder name.")
     host: str | None = gql_field(default=None, description="Storage host for the vfolder.")
     usage_mode: VFolderUsageModeGQL = gql_field(

src/ai/backend/manager/api/rest/v2/vfolder/handler.py

@@ -112,8 +112,13 @@ async def project_create(
         path: PathParam[ProjectIdPathParam],
         body: BodyParam[CreateVFolderInProjectInput],
     ) -> APIResponse:
-        """Create a vfolder owned by a project."""
-        result = await self._adapter.create_in_project(path.parsed.project_id, body.parsed)
+        """Create a vfolder owned by a project.
+
+        The path segment ``{project_id}`` is authoritative; any ``project_id``
+        value in the body is overridden to match the URL.
+        """
+        dto = body.parsed.model_copy(update={"project_id": path.parsed.project_id})
+        result = await self._adapter.create_in_project(dto)
         return APIResponse.build(status_code=HTTPStatus.CREATED, response_model=result)
 
     async def deploy(

tests/component/vfolder_v2/test_vfolder_mutation.py

@@ -252,11 +252,12 @@ async def test_regular_user_denied(
     ) -> None:
         """Regular user without project CREATE permission is denied before service runs."""
         request = CreateVFolderInProjectInput(
+            project_id=group_fixture,
             name=f"rbac-denied-{secrets.token_hex(4)}",
             host="local",
             usage_mode=VFolderUsageMode.GENERAL,
             permission=VFolderPermissionField.READ_WRITE,
             cloneable=False,
         )
         with pytest.raises(PermissionDeniedError):
-            await user_v2_registry.vfolder.create_in_project(group_fixture, request)
+            await user_v2_registry.vfolder.create_in_project(request)