fix(BA-5772): guard allowed_vfolder_hosts against missing resource_policy key (#11185)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: fregataa

changes/11185.fix.md

@@ -0,0 +1 @@
+Fix `KeyError: 'allowed_vfolder_hosts'` when the keypair resource policy is missing during vfolder ownership changes.

src/ai/backend/manager/models/vfolder/row.py

@@ -795,8 +795,8 @@ async def get_allowed_vfolder_hosts_by_group(
             result_hosts = allowed_hosts | values
             allowed_hosts = result_hosts
     # Keypair Resource Policy's allowed_vfolder_hosts
-    final_result: VFolderHostPermissionMap = (
-        allowed_hosts | resource_policy["allowed_vfolder_hosts"]
+    final_result: VFolderHostPermissionMap = allowed_hosts | resource_policy.get(
+        "allowed_vfolder_hosts", VFolderHostPermissionMap()
     )
     return final_result
 
@@ -854,8 +854,8 @@ async def get_allowed_vfolder_hosts_by_user(
             result_hosts = allowed_hosts | row.allowed_vfolder_hosts
             allowed_hosts = result_hosts
     # Keypair Resource Policy's allowed_vfolder_hosts
-    final_result: VFolderHostPermissionMap = (
-        allowed_hosts | resource_policy["allowed_vfolder_hosts"]
+    final_result: VFolderHostPermissionMap = allowed_hosts | resource_policy.get(
+        "allowed_vfolder_hosts", VFolderHostPermissionMap()
     )
     return final_result