[DSIP-104][ApiServer][UI] Introduce project-scoped authorization

.github/workflows/api-test.yml

@@ -87,6 +87,17 @@ jobs:
           -Pdocker,staging \
           -Ddocker.tag=ci \
           -Danalyze.skip=true
+      - name: Export Project Maven Artifacts
+        run: |
+          tar --exclude='*-sources.jar' --exclude='*-shade.jar' \
+            -czf /tmp/api-test-maven-artifacts.tar.gz \
+            -C "$HOME/.m2/repository" org/apache/dolphinscheduler
+      - uses: actions/upload-artifact@v6
+        name: Upload Project Maven Artifacts
+        with:
+          name: api-test-maven-artifacts
+          path: /tmp/api-test-maven-artifacts.tar.gz
+          retention-days: 1
       - name: Export Docker Images
         run: |
           docker save apache/dolphinscheduler-standalone-server:ci -o /tmp/standalone-image.tar \
@@ -153,6 +164,15 @@ jobs:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}-api-test
           restore-keys: ${{ runner.os }}-maven-
+      - uses: actions/download-artifact@v8
+        name: Download Project Maven Artifacts
+        with:
+          name: api-test-maven-artifacts
+          path: /tmp
+      - name: Restore Project Maven Artifacts
+        run: |
+          mkdir -p "$HOME/.m2/repository"
+          tar -xzf /tmp/api-test-maven-artifacts.tar.gz -C "$HOME/.m2/repository"
       - uses: actions/download-artifact@v8
         name: Download Docker Images
         with:
@@ -165,7 +185,7 @@ jobs:
         run: df -h
       - name: Run Test
         run: |
-          ./mvnw -B -f dolphinscheduler-api-test/pom.xml -am \
+          ./mvnw -B -nsu -f dolphinscheduler-api-test/pom.xml -am \
             -DfailIfNoTests=false \
             -Dspotless.skip=true \
             -Dtest=${{ matrix.case.class }} test

docs/docs/en/contribute/join/security-model.md

@@ -2,6 +2,14 @@
 
 This document is mainly used to describe the scope of work, responsibilities and key functions of users with different roles. By introducing user permissions and functions, it helps users understand the precautions and rules in the deployment, use, operation and maintenance stages. Developers can use this document to understand the boundaries between security vulnerabilities and normal functions.
 
+## Project authorization boundaries (from 3.5.0)
+
+The four project operation permissions are `VIEW`, `DEVELOP` (including definition publishing), `EXECUTE` (including schedule management) and `MANAGE_MEMBERS`. Users receive independent operation permissions within projects, and projects receive use grants for eight shared-resource types. Operations using resources check both dimensions. Use grants do not grant resource modification, deletion or re-granting rights, and member management does not include project resource authorization. System administrators pass project operation checks, but the relevant projects still need resource grants. Executing users do not need personal resource grants; resource files retain their existing authorization mechanism.
+
+Lineage queries expose related cross-project nodes, edges and summaries without requiring `VIEW` on every related project; accessing related workflow details and operations still requires permission on their actual projects.
+
+Revocation affects subsequent manual operations, but does not retroactively stop running or queued instances or recheck background triggers of existing schedules and automatic retries. Project authorization does not sandbox task code. See [Security (Authorization System)](../../guide/security/security.md#granted-permissions) for the full permission list, project creators' separate lifecycle permissions, cross-project checks and revocation rules.
+
 ## Apache DolphinScheduler Workflow
 
 From understanding to using Apache DolphinScheduler, users generally go through the following stages.
@@ -31,17 +39,17 @@ Service deployment personnel need to have the authority to operate the server. S
 
 ### 2. System administrator
 
-The system administrator has all the operation permissions of Apache DolphinScheduler. In actual use, the scope of use of the administrator user should be ensured, and the administrator user should be highly trusted not to abuse this function.
-(1). The administrator user can operate queue management, tenant management, user management, alarm group management, worker group management, token management and other functions. The administrator user can operate all configurations, including important information such as sensitive credentials required to connect to resources. It is necessary to ensure that the person using the administrator user can operate the corresponding resources. At the same time, the administrator user can authorize operations on resources, data sources, projects, etc. in the user management module. The administrator user needs to clearly authorize the user to have all usage permissions for the corresponding resources.
+System administrators manage global settings and pass project operation checks; operations using project resources still require project resource grants. In actual use, the scope of use of the administrator user should be ensured, and the administrator user should be highly trusted not to abuse this function.
+(1). The administrator user can operate queue management, tenant management, user management, alarm group management, worker group management, token management and other functions. The administrator user can operate all configurations, including important information such as sensitive credentials required to connect to resources. It is necessary to ensure that the person using the administrator user can operate the corresponding resources. Administrators also assign project member permissions and project resource-use grants in Project Management and must understand the scope of these grants.
 (2). System administrators have all the operational permissions that ordinary users have
 
 ### 3. Ordinary system users
 
-Ordinary users of Apache DolphinScheduler are defined as actual workflow development and operation users. Of course, they also need to maintain some resources required during the workflow development process. These users should be highly trusted not to abuse this function.
+Ordinary users of Apache DolphinScheduler develop and operate workflows using resources granted to their projects, within their project permissions. These users should be highly trusted not to abuse this function.
 
 (1). Users can create workflows and tasks. For a list of supported task types, see [Task List]. Tasks will be executed in workers. Users can customize any command and code to run in a specified worker group. Be sure to pay attention to any command and code here. Users can execute all tasks under the task types supported by Apache DolphinScheduler, including shell, sql, and jump to other servers to execute shell scripts. At the same time, logs will be generated during the task running process. Users can view and download task running logs through the UI page.
 
-(2). Users can create data source connections, modify and delete authorized connections including corresponding configurations, especially operations on sensitive credentials of authorized connections. These operations may have a certain impact on the resources themselves or the system. Data sources include many types. For details, please see [Data Source List] on the official website.
+(2). Ordinary users can use datasources granted to projects where they hold the corresponding operation permissions. Datasource creation, global listing, details and sensitive configuration access, modification, connection testing and deletion are restricted to system administrators. Datasource creator status or project resource-use grants do not restore these management permissions for ordinary users.
 
 ### 4. Unlogged in users
 
@@ -51,7 +59,7 @@ In addition to the core workflow development and operation, the normal use of th
 
 ## Data source management
 
-All users can operate data source management, and administrator users can operate after authorizing ordinary users. The corresponding permissions for data source task operation are provided by the data source connection, and the connection configuration should try to control the task execution permissions. In the data source configuration, users can customize the connection parameters and they will take effect on all tasks using the data source.
+Datasource management is restricted to system administrators, including creation, global listing, details and sensitive configuration access, modification, connection testing and deletion. Ordinary users can query selectable datasources granted to a project where they hold `VIEW`, and configure or execute tasks within their corresponding project operation permissions. Project resource-use grants do not grant datasource management permissions. The corresponding permissions for data source task operation are provided by the data source connection, and the connection configuration should try to control the task execution permissions. In the data source configuration, users can customize the connection parameters and they will take effect on all tasks using the data source.
 
 ## Resource Center
 

docs/docs/en/guide/project/project-list.md

@@ -13,7 +13,7 @@ This page describes details regarding Project screen in Apache DolphinScheduler.
 
 ## Project List
 
-On the project screen, list of all the existing projects along with details like name, owner, workflow definition, process instance, create and update time. This page also facilitates operations like create, edit, and delete project.
+The project screen lists projects visible through `VIEW` (all projects for system administrators), along with details like name, owner, workflow definition, process instance, create and update time. This page also facilitates operations like create, edit, and delete project.
 
 ![project-list](../../../../img/new_ui/dev/project/project-list.png)
 
@@ -23,17 +23,22 @@ On the project screen, list of all the existing projects along with details like
 
 ![project-list](../../../../img/new_ui/dev/project/project-create.png)
 
-## Project Worker Group Authorization
+## Project Member Permissions and Resource Grants
 
-- On the project management page, click the `Worker Group Authorization` button to enter the worker group authorization page, as shown in the figure below, select the worker group, click `WorkerGroup`, after successful authorization, the project can access the worker group.
-  ![project-worker-group](../../../../img/new_ui/dev/project/project-worker-group-auth.png)
+In Project Management, use member permissions to assign users' project operations and resource authorization to grant shared resources to the project. System administrators or users with `MANAGE_MEMBERS` can manage member permissions; only system administrators can grant or revoke project resources.
+
+Worker groups are one of the eight supported resource types. The default `default` group also requires an explicit project grant. Workflow operations require the corresponding user project permission and, when resources are used, the project's resource grants. See [Security (Authorization System)](../security/security.md#granted-permissions) for the full rules, execution checks and revocation boundaries.
+
+The following screenshot shows the legacy separate worker-group authorization screen for upgrade comparison only. From 3.5.0, use the unified project resource-authorization action.
+
+![project-worker-group](../../../../img/new_ui/dev/project/project-worker-group-auth.png)
 
 ## Project Overview
 
 - Click the project name link on the project management page to enter the project home page, as shown in the figure below, the project home page contains the task status statistics, process status statistics, and workflow definition statistics of the project. The introduction for those metrics:
 - Task status statistics: Within the specified time range, count the number of task instances status as successful submission, running, ready to pause, pause, ready to stop, stop, failure, success, need fault tolerance, kill and waiting threads
 - Process status statistics: Within the specified time range, count the number of workflow instances status as submission success, running, ready to pause, pause, ready to stop, stop, failure, success, need fault tolerance, kill and waiting threads
-- Workflow definition statistics: Count the workflow definitions created by this user and granted by the administrator
+- Workflow definition statistics: Count workflow definitions in the current project; viewing the project requires `VIEW`
 
 ![project-overview](../../../../img/new_ui/dev/project/project-overview.png)