refactor(BA-5715): resolve owner_id via current_user() in services

[jopemachine]

📚 Stack

• main
  • refactor(BA-5709): add main_access_key resolver helpers #11041 — refactor(BA-5709): add main_access_key resolver helpers
    • refactor(BA-5710): thread main_access_key through UserPermission #11043 — refactor(BA-5710): thread main_access_key through UserPermission
      • refactor(BA-5711): rename SessionData user_uuid to owner_id #11045 — refactor(BA-5711): rename SessionData user_uuid to owner_id
        • refactor(BA-5650): add owner_id helpers and rename session data types [1/4] #11046 — refactor(BA-5712): switch session repository to owner_id
          • refactor(BA-5713): collapse scheduler signatures to owner_id #11047 — refactor(BA-5713): collapse scheduler signatures to owner_id
            • refactor(BA-5650): propagate owner_id through scheduler and sokovan [2/4] #11048 — refactor(BA-5714): propagate owner_id rename into sokovan
              • 👉 refactor(BA-5715): resolve owner_id via current_user() in services #11049 ← you are here — refactor(BA-5715): resolve owner_id via current_user() in services
                • refactor(BA-5650): unify session ownership to owner_id and main_access_key [1/2] #11050 — breaking(BA-5716): drop owner_access_key from REST v1 session API
                  • refactor(BA-5650): update tests and remaining ORM references [2/2] #11051 — refactor(BA-5717): test and remaining ORM updates (final tip)
                  • breaking(BA-5653): drop sessions/kernels access_key columns #11040 — breaking(BA-5653): drop sessions/kernels access_key columns

Merge from top to bottom. Intermediate slices may not build standalone; the final refactor tip is #11051, and #11040 is the schema-drop follow-up on top of it.

Summary

Drop owner_id from 21 read/control session action dataclasses; keep it only on the three delegation-capable creation actions. services/session/service.py: _requester_user_id() resolves requester UUID from the current_user() context var, replacing 21 action.owner_id sites. services/session/lifecycle.py: inject UserRepository via constructor. registry.py, dependencies/agents/*: wire the repository through the DI graph. UserRepository.get_main_access_key_by_id finalised.

Resolves BA-5715. Part of epic BA-5650.

---

BA-5650 Series: Split Rationale

Overall goal: migrate the session owner identifier from access_key (keypair) to owner_id (user UUID), and drop the sessions.access_key / kernels.access_key columns.

Split criteria: layer + dependency order. Bottom-up (DB helpers → service → API) so the destructive column drop can land safely at the end.

Order	Issue	Layer	Role
1	BA-5709	Foundation	Add get_main_access_key_by_id and related resolver helpers (everything else depends on this)
2	BA-5710	RBAC / Permission	Rename UserPermission.user_uuid → owner_id; add main_access_key field
3	BA-5711	Data	Rename SessionData.user_uuid → owner_id; Row adapters; GQL node
4	BA-5712	Repository	Collapse SessionRepository, SessionDBSource, creators signatures
5	BA-5713	Scheduler	predicates / drf / options; scheduler repo; stream/events shims
6	BA-5714	Sokovan	allocation / lifecycle / workload, launcher, controller, executor
7	BA-5715	Service	Drop owner_id from 21 read/control Actions; resolve via current_user()
8	BA-5716	API (v1)	Remove owner_access_key from REST v1 DTOs (breaking)
9	BA-5717	Tests / Cleanup	Test suite updates; remaining ORM / gql_legacy touch-ups
10	BA-5653	Schema	Alembic migration — rename/drop columns (destructive, must land last)

Why this split

• Dependencies: the BA-5709 helpers are required before 3–7 can recover access_key from owner_id. BA-5653 (destructive) only runs once every reader has migrated off the dropped column.
• Review size: a single-shot change would touch hundreds of files. Slicing by layer keeps each PR focused on one concern.
• Rollback safety: steps 1–7 are no-op on external behavior, step 8 is the API breaking change, step 10 is the schema drop. Each step is independently revertible.

[Copilot]

Pull request overview

Refactors session service flows to stop threading owner_id/owner_access_key through most read/control actions and instead derive the caller identity from the current_user() context, while keeping delegation support for a limited set of creation actions.

Changes:

• Replace many action.owner_* usages in SessionService with _requester_user_id() (via current_user()), and add helper to resolve delegated owner main access key.
• Inject UserRepository into SessionLifecycleManager and wire it through the AgentRegistry DI graph.
• Update session action dataclasses and template override validation to use owner_id (UUID) instead of owner_access_key.

Reviewed changes

Copilot reviewed 33 out of 33 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/ai/backend/manager/services/session/types.py	Switch template override schema field from owner_access_key to owner_id.
src/ai/backend/manager/services/session/service.py	Derive requester owner_id from current_user(), add main-access-key resolver, and update many service methods accordingly.
src/ai/backend/manager/services/session/lifecycle.py	Constructor-inject UserRepository and use it to resolve main access key for hook notifications.
src/ai/backend/manager/services/session/actions/*.py	Remove owner_access_key from many read/control action dataclasses; change create actions to carry owner_id.
src/ai/backend/manager/repositories/model_serving/repository.py	Adjust SessionRow.get_session call signature; remove model-definition refresh logic during modify_endpoint.
src/ai/backend/manager/registry.py	Wire UserRepository into SessionLifecycleManager; update SessionRow.get_session calls to use owner_id.
src/ai/backend/manager/dependencies/agents/registry.py	Add UserRepository to AgentRegistry dependency input and provider wiring.
src/ai/backend/manager/dependencies/agents/composer.py	Instantiate and provide UserRepository in the DI composition for AgentRegistry.
changes/11049.misc.md	Changelog entry for the refactor.

Comments suppressed due to low confidence (1)

src/ai/backend/manager/repositories/model_serving/repository.py:889

• This change removes the model-definition refresh behavior during endpoint modification: the new revision is no longer populated with a refreshed model_definition, so updates to model-definition.yaml in the vfolder won’t be picked up. There is an existing regression test (tests/unit/manager/repositories/model_serving/test_modify_endpoint_model_definition.py) that asserts this behavior. If this behavior is still required, reintroduce the refresh (or move it elsewhere); if it’s intentionally being removed, the test suite and any docs/semantics around modify_endpoint should be updated accordingly.

                # If revision-level fields changed, create a new revision
                if spec.has_revision_changes():
                    current_rev = endpoint_row._find_current_revision()
                    if current_rev is None:
                        raise InvalidAPIParameters("Endpoint has no current revision")

                    # Resolve image if changed
                    image_id = current_rev.image
                    image_ref = spec.image.optional_value()
                    if image_ref is not None:
                        image_name = image_ref.name
                        arch = image_ref.architecture.value()
                        resolved_image = await ImageRow.resolve(
                            db_session,
                            [ImageIdentifier(image_name, arch), ImageAlias(image_name)],
                        )
                        image_id = resolved_image.id

                    # Merge resource_slots: spec overrides current revision
                    merged_slots: ResourceSlot = (
                        spec.resource_slots.optional_value()
                        or ResourceSlot({
                            r.slot_name: r.quantity for r in current_rev.resource_slot_rows
                        })
                    )

                    # Merge revision fields: current revision as base, spec overrides
                    new_revision = DeploymentRevisionRow(
                        endpoint=endpoint_row.id,
                        revision_number=0,  # placeholder, will be set atomically below
                        image=image_id,
                        model=current_rev.model,
                        model_mount_destination=current_rev.model_mount_destination,
                        model_definition_path=(
                            spec.model_definition_path.optional_value()
                            if spec.model_definition_path.optional_value() is not None
                            else current_rev.model_definition_path
                        ),
                        resource_group=endpoint_row.resource_group,
                        resource_opts=(
                            spec.resource_opts.optional_value()
                            if spec.resource_opts.optional_value() is not None
                            else current_rev.resource_opts
                        ),
                        cluster_mode=(
                            spec.cluster_mode.value().value
                            if spec.cluster_mode.optional_value() is not None
                            else current_rev.cluster_mode
                        ),
                        cluster_size=(
                            spec.cluster_size.optional_value() or current_rev.cluster_size
                        ),
                        startup_command=current_rev.startup_command,
                        bootstrap_script=current_rev.bootstrap_script,
                        environ=(
                            spec.environ.optional_value()
                            if spec.environ.optional_value() is not None
                            else current_rev.environ
                        ),
                        callback_url=current_rev.callback_url,
                        runtime_variant=(
                            spec.runtime_variant.optional_value() or current_rev.runtime_variant
                        ),
                        extra_mounts=list(current_rev.extra_mounts),
                    )

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jopemachine]

Consolidated into the merged PR stack (A+B+C+D, E+F, G+H, I)