refactor(BA-5709): add main_access_key resolver helpers

[jopemachine]

📚 Stack

• main
  • 👉 refactor(BA-5709): add main_access_key resolver helpers #11041 ← you are here — refactor(BA-5709): add main_access_key resolver helpers
    • refactor(BA-5710): thread main_access_key through UserPermission #11043 — refactor(BA-5710): thread main_access_key through UserPermission
      • refactor(BA-5711): rename SessionData user_uuid to owner_id #11045 — refactor(BA-5711): rename SessionData user_uuid to owner_id
        • refactor(BA-5650): add owner_id helpers and rename session data types [1/4] #11046 — refactor(BA-5712): switch session repository to owner_id
          • refactor(BA-5713): collapse scheduler signatures to owner_id #11047 — refactor(BA-5713): collapse scheduler signatures to owner_id
            • refactor(BA-5650): propagate owner_id through scheduler and sokovan [2/4] #11048 — refactor(BA-5714): propagate owner_id rename into sokovan
              • refactor(BA-5715): resolve owner_id via current_user() in services #11049 — refactor(BA-5715): resolve owner_id via current_user() in services
                • refactor(BA-5650): unify session ownership to owner_id and main_access_key [1/2] #11050 — breaking(BA-5716): drop owner_access_key from REST v1 session API
                  • refactor(BA-5650): update tests and remaining ORM references [2/2] #11051 — refactor(BA-5717): test and remaining ORM updates (final tip)
                  • breaking(BA-5653): drop sessions/kernels access_key columns #11040 — breaking(BA-5653): drop sessions/kernels access_key columns

Merge from top to bottom. Intermediate slices may not build standalone; the final refactor tip is #11051, and #11040 is the schema-drop follow-up on top of it.

Summary

Add UserRepository.get_main_access_key_by_id (plus the matching UserDBSource method) and rewrite SessionConditions.by_access_key_* filters to resolve the owner's main_access_key via a subquery. _owners_where_main_access_key staticmethod centralises the subquery shape. Behavior unchanged on main.

Resolves BA-5709. Part of epic BA-5650.

---

📚 Documentation preview 📚: https://sorna--11041.org.readthedocs.build/en/11041/

---

📚 Documentation preview 📚: https://sorna-ko--11041.org.readthedocs.build/ko/11041/

---

BA-5650 Series: Split Rationale

Overall goal: migrate the session owner identifier from access_key (keypair) to owner_id (user UUID), and drop the sessions.access_key / kernels.access_key columns.

Split criteria: layer + dependency order. Bottom-up (DB helpers → service → API) so the destructive column drop can land safely at the end.

Order	Issue	Layer	Role
1	BA-5709	Foundation	Add get_main_access_key_by_id and related resolver helpers (everything else depends on this)
2	BA-5710	RBAC / Permission	Rename UserPermission.user_uuid → owner_id; add main_access_key field
3	BA-5711	Data	Rename SessionData.user_uuid → owner_id; Row adapters; GQL node
4	BA-5712	Repository	Collapse SessionRepository, SessionDBSource, creators signatures
5	BA-5713	Scheduler	predicates / drf / options; scheduler repo; stream/events shims
6	BA-5714	Sokovan	allocation / lifecycle / workload, launcher, controller, executor
7	BA-5715	Service	Drop owner_id from 21 read/control Actions; resolve via current_user()
8	BA-5716	API (v1)	Remove owner_access_key from REST v1 DTOs (breaking)
9	BA-5717	Tests / Cleanup	Test suite updates; remaining ORM / gql_legacy touch-ups
10	BA-5653	Schema	Alembic migration — rename/drop columns (destructive, must land last)

Why this split

• Dependencies: the BA-5709 helpers are required before 3–7 can recover access_key from owner_id. BA-5653 (destructive) only runs once every reader has migrated off the dropped column.
• Review size: a single-shot change would touch hundreds of files. Slicing by layer keeps each PR focused on one concern.
• Rollback safety: steps 1–7 are no-op on external behavior, step 8 is the API breaking change, step 10 is the schema drop. Each step is independently revertible.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR adds helper APIs to resolve a user’s main_access_key and rewires session access-key filters to resolve via the owning user’s main_access_key (preparatory work for dropping redundant sessions.access_key / kernels.access_key columns).

Changes:

• Add UserRepository.get_main_access_key_by_id and UserDBSource.get_main_access_key_by_id for single-query access-key resolution by user UUID.
• Rewrite SessionConditions.by_access_key_* filters to use a UserRow.main_access_key subquery keyed by SessionRow.user_uuid.
• Add a changelog entry describing the refactor groundwork.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
src/ai/backend/manager/repositories/user/repository.py	Adds repository helper for main_access_key lookup and adjusts endpoint ownership delegation call signature.
src/ai/backend/manager/repositories/user/db_source/db_source.py	Adds DBSource scalar query for main_access_key and updates endpoint ownership delegation call signature.
src/ai/backend/manager/models/session/conditions.py	Reworks access-key session filters to resolve via owner subquery; adds centralized helper.
changes/11041.misc.md	Documents the new helper + filter rewrite as groundwork for future column removal.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jopemachine]

Consolidated into the merged PR stack (A+B+C+D, E+F, G+H, I)