[DSIP-104][ApiServer][UI] Introduce project-scoped authorization

.github/workflows/api-test.yml

@@ -87,6 +87,17 @@ jobs:
           -Pdocker,staging \
           -Ddocker.tag=ci \
           -Danalyze.skip=true
+      - name: Export Project Maven Artifacts
+        run: |
+          tar --exclude='*-sources.jar' --exclude='*-shade.jar' \
+            -czf /tmp/api-test-maven-artifacts.tar.gz \
+            -C "$HOME/.m2/repository" org/apache/dolphinscheduler
+      - uses: actions/upload-artifact@v6
+        name: Upload Project Maven Artifacts
+        with:
+          name: api-test-maven-artifacts
+          path: /tmp/api-test-maven-artifacts.tar.gz
+          retention-days: 1
       - name: Export Docker Images
         run: |
           docker save apache/dolphinscheduler-standalone-server:ci -o /tmp/standalone-image.tar \
@@ -153,6 +164,15 @@ jobs:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}-api-test
           restore-keys: ${{ runner.os }}-maven-
+      - uses: actions/download-artifact@v8
+        name: Download Project Maven Artifacts
+        with:
+          name: api-test-maven-artifacts
+          path: /tmp
+      - name: Restore Project Maven Artifacts
+        run: |
+          mkdir -p "$HOME/.m2/repository"
+          tar -xzf /tmp/api-test-maven-artifacts.tar.gz -C "$HOME/.m2/repository"
       - uses: actions/download-artifact@v8
         name: Download Docker Images
         with:
@@ -165,7 +185,7 @@ jobs:
         run: df -h
       - name: Run Test
         run: |
-          ./mvnw -B -f dolphinscheduler-api-test/pom.xml -am \
+          ./mvnw -B -nsu -f dolphinscheduler-api-test/pom.xml -am \
             -DfailIfNoTests=false \
             -Dspotless.skip=true \
             -Dtest=${{ matrix.case.class }} test

docs/docs/en/contribute/join/security-model.md

@@ -2,6 +2,12 @@
 
 This document is mainly used to describe the scope of work, responsibilities and key functions of users with different roles. By introducing user permissions and functions, it helps users understand the precautions and rules in the deployment, use, operation and maintenance stages. Developers can use this document to understand the boundaries between security vulnerabilities and normal functions.
 
+## Project authorization boundaries (from 3.5.0)
+
+Users receive independent operation permissions within projects, and projects receive use grants for eight shared-resource types. Operations using resources check both dimensions. Use grants do not grant resource modification, deletion or re-granting rights, and member management does not include project resource authorization. System administrators pass project operation checks, but the relevant projects still need resource grants. Executing users do not need personal resource grants; resource files retain their existing authorization mechanism.
+
+Revocation affects subsequent manual operations, but does not retroactively stop running or queued instances or recheck background triggers of existing schedules and automatic retries. Project authorization does not sandbox task code. See [Security (Authorization System)](../../guide/security/security.md#granted-permissions) for the full permission list, project creators' separate lifecycle permissions, cross-project checks and revocation rules.
+
 ## Apache DolphinScheduler Workflow
 
 From understanding to using Apache DolphinScheduler, users generally go through the following stages.
@@ -31,8 +37,8 @@ Service deployment personnel need to have the authority to operate the server. S
 
 ### 2. System administrator
 
-The system administrator has all the operation permissions of Apache DolphinScheduler. In actual use, the scope of use of the administrator user should be ensured, and the administrator user should be highly trusted not to abuse this function.
-(1). The administrator user can operate queue management, tenant management, user management, alarm group management, worker group management, token management and other functions. The administrator user can operate all configurations, including important information such as sensitive credentials required to connect to resources. It is necessary to ensure that the person using the administrator user can operate the corresponding resources. At the same time, the administrator user can authorize operations on resources, data sources, projects, etc. in the user management module. The administrator user needs to clearly authorize the user to have all usage permissions for the corresponding resources.
+System administrators manage global settings and pass project operation checks; operations using project resources still require project resource grants. In actual use, the scope of use of the administrator user should be ensured, and the administrator user should be highly trusted not to abuse this function.
+(1). The administrator user can operate queue management, tenant management, user management, alarm group management, worker group management, token management and other functions. The administrator user can operate all configurations, including important information such as sensitive credentials required to connect to resources. It is necessary to ensure that the person using the administrator user can operate the corresponding resources. Administrators also assign project member permissions and project resource-use grants in Project Management and must understand the scope of these grants.
 (2). System administrators have all the operational permissions that ordinary users have
 
 ### 3. Ordinary system users
@@ -51,7 +57,7 @@ In addition to the core workflow development and operation, the normal use of th
 
 ## Data source management
 
-All users can operate data source management, and administrator users can operate after authorizing ordinary users. The corresponding permissions for data source task operation are provided by the data source connection, and the connection configuration should try to control the task execution permissions. In the data source configuration, users can customize the connection parameters and they will take effect on all tasks using the data source.
+Datasource creation, modification, deletion and access to sensitive configuration follow the datasource management APIs' permission checks; project resource-use grants do not grant these management permissions. The corresponding permissions for data source task operation are provided by the data source connection, and the connection configuration should try to control the task execution permissions. In the data source configuration, users can customize the connection parameters and they will take effect on all tasks using the data source.
 
 ## Resource Center
 

docs/docs/en/guide/project/project-list.md

@@ -13,7 +13,7 @@ This page describes details regarding Project screen in Apache DolphinScheduler.
 
 ## Project List
 
-On the project screen, list of all the existing projects along with details like name, owner, workflow definition, process instance, create and update time. This page also facilitates operations like create, edit, and delete project.
+The project screen lists projects visible through `VIEW` (all projects for system administrators), along with details like name, owner, workflow definition, process instance, create and update time. This page also facilitates operations like create, edit, and delete project.
 
 ![project-list](../../../../img/new_ui/dev/project/project-list.png)
 
@@ -23,17 +23,22 @@ On the project screen, list of all the existing projects along with details like
 
 ![project-list](../../../../img/new_ui/dev/project/project-create.png)
 
-## Project Worker Group Authorization
+## Project Member Permissions and Resource Grants
 
-- On the project management page, click the `Worker Group Authorization` button to enter the worker group authorization page, as shown in the figure below, select the worker group, click `WorkerGroup`, after successful authorization, the project can access the worker group.
-  ![project-worker-group](../../../../img/new_ui/dev/project/project-worker-group-auth.png)
+In Project Management, use member permissions to assign users' project operations and resource authorization to grant shared resources to the project. System administrators or users with `MANAGE_MEMBERS` can manage member permissions; only system administrators can grant or revoke project resources.
+
+Worker groups are one of the eight supported resource types. The default `default` group also requires an explicit project grant. Workflow operations require the corresponding user project permission and, when resources are used, the project's resource grants. See [Security (Authorization System)](../security/security.md#granted-permissions) for the full rules, execution checks and revocation boundaries.
+
+The following screenshot shows the legacy separate worker-group authorization screen for upgrade comparison only. From 3.5.0, use the unified project resource-authorization action.
+
+![project-worker-group](../../../../img/new_ui/dev/project/project-worker-group-auth.png)
 
 ## Project Overview
 
 - Click the project name link on the project management page to enter the project home page, as shown in the figure below, the project home page contains the task status statistics, process status statistics, and workflow definition statistics of the project. The introduction for those metrics:
 - Task status statistics: Within the specified time range, count the number of task instances status as successful submission, running, ready to pause, pause, ready to stop, stop, failure, success, need fault tolerance, kill and waiting threads
 - Process status statistics: Within the specified time range, count the number of workflow instances status as submission success, running, ready to pause, pause, ready to stop, stop, failure, success, need fault tolerance, kill and waiting threads
-- Workflow definition statistics: Count the workflow definitions created by this user and granted by the administrator
+- Workflow definition statistics: Count workflow definitions in the current project; viewing the project requires `VIEW`
 
 ![project-overview](../../../../img/new_ui/dev/project/project-overview.png)