fix(workspace): honor profile_workspace in runtime profile resolution

Runtime profile lookups now consult provider.profile_workspace via
get_type_profile_for_scope. Providers created with --global-profile
(profile_workspace="") resolve to the platform profile even when a
workspace profile shadows the same ID. All 6 runtime call sites
updated; type-only call sites remain scope-agnostic.

Signed-off-by: Derek Carr <decarr@redhat.com>

Author: derekwaynecarr

crates/openshell-server/src/grpc/policy.rs

@@ -542,9 +542,11 @@ async fn build_credential_set_for_sandbox_with_catalog(
 
         let provider_type = provider.r#type.trim();
         let profile_id = normalize_provider_type(provider_type).unwrap_or(provider_type);
-        let Some(profile) =
-            super::provider::get_provider_type_profile_with_catalog(catalog, profile_id)
-        else {
+        let Some(profile) = super::provider::get_provider_type_profile_for_scope(
+            catalog,
+            profile_id,
+            &provider.profile_workspace,
+        ) else {
             warn!(
                 provider_name = %name,
                 provider_type,
@@ -1502,9 +1504,11 @@ async fn profile_provider_policy_layers_with_catalog(
 
         let provider_type = provider.r#type.trim();
         let profile_id = normalize_provider_type(provider_type).unwrap_or(provider_type);
-        let Some(profile) =
-            super::provider::get_provider_type_profile_with_catalog(catalog, profile_id)
-        else {
+        let Some(profile) = super::provider::get_provider_type_profile_for_scope(
+            catalog,
+            profile_id,
+            &provider.profile_workspace,
+        ) else {
             warn!(
                 provider_name = %name,
                 provider_type,
@@ -5431,6 +5435,79 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn provider_policy_layers_respect_profile_workspace_scope() {
+        let store = test_store().await;
+
+        let make_stored_profile =
+            |id: &str, workspace: &str, host: &str| openshell_core::proto::StoredProviderProfile {
+                metadata: Some(openshell_core::proto::datamodel::v1::ObjectMeta {
+                    id: format!("profile-{id}-{workspace}"),
+                    name: id.to_string(),
+                    created_at_ms: 1_000_000,
+                    labels: HashMap::new(),
+                    resource_version: 0,
+                    annotations: HashMap::new(),
+                    workspace: workspace.to_string(),
+                    deletion_timestamp_ms: 0,
+                }),
+                profile: Some(openshell_core::proto::ProviderProfile {
+                    id: id.to_string(),
+                    display_name: format!("{host} profile"),
+                    endpoints: vec![NetworkEndpoint {
+                        host: host.to_string(),
+                        port: 443,
+                        ..Default::default()
+                    }],
+                    ..Default::default()
+                }),
+            };
+
+        store
+            .put_message(&make_stored_profile(
+                "scope-api",
+                "",
+                "platform.example.com",
+            ))
+            .await
+            .unwrap();
+        store
+            .put_message(&make_stored_profile(
+                "scope-api",
+                "default",
+                "workspace.example.com",
+            ))
+            .await
+            .unwrap();
+
+        let mut global_provider = test_provider("global-prov", "scope-api");
+        global_provider.profile_workspace = String::new();
+        store.put_message(&global_provider).await.unwrap();
+
+        let normal_provider = test_provider("normal-prov", "scope-api");
+        store.put_message(&normal_provider).await.unwrap();
+
+        let global_layers =
+            profile_provider_policy_layers(&store, "default", &["global-prov".to_string()])
+                .await
+                .unwrap();
+        assert_eq!(global_layers.len(), 1);
+        assert_eq!(
+            global_layers[0].rule.endpoints[0].host, "platform.example.com",
+            "provider with profile_workspace='' should resolve the platform profile"
+        );
+
+        let normal_layers =
+            profile_provider_policy_layers(&store, "default", &["normal-prov".to_string()])
+                .await
+                .unwrap();
+        assert_eq!(normal_layers.len(), 1);
+        assert_eq!(
+            normal_layers[0].rule.endpoints[0].host, "workspace.example.com",
+            "provider with profile_workspace='default' should resolve the workspace profile"
+        );
+    }
+
     #[test]
     fn providers_v2_enabled_defaults_false_when_unset() {
         assert!(

crates/openshell-server/src/grpc/provider.rs

@@ -650,7 +650,9 @@ pub(super) async fn resolve_dynamic_credentials_with_catalog(
 
         let profile_id =
             normalize_provider_type(&provider.r#type).unwrap_or(provider.r#type.as_str());
-        let Some(profile) = get_provider_type_profile_with_catalog(catalog, profile_id) else {
+        let Some(profile) =
+            get_provider_type_profile_for_scope(catalog, profile_id, &provider.profile_workspace)
+        else {
             continue;
         };
 
@@ -1092,7 +1094,9 @@ fn dynamic_token_grant_bindings_for_provider_with_catalog(
 ) -> Vec<DynamicTokenGrantBinding> {
     let provider_name = provider.object_name().to_string();
     let profile_id = normalize_provider_type(&provider.r#type).unwrap_or(provider.r#type.as_str());
-    let Some(profile) = get_provider_type_profile_with_catalog(catalog, profile_id) else {
+    let Some(profile) =
+        get_provider_type_profile_for_scope(catalog, profile_id, &provider.profile_workspace)
+    else {
         return Vec::new();
     };
     dynamic_token_grant_bindings_for_profile(&provider_name, &profile.to_proto())
@@ -1759,6 +1763,14 @@ pub(super) fn get_provider_type_profile_with_catalog(
     catalog.get_type_profile(id)
 }
 
+pub(super) fn get_provider_type_profile_for_scope(
+    catalog: &EffectiveProviderProfileCatalog,
+    id: &str,
+    profile_workspace: &str,
+) -> Option<ProviderTypeProfile> {
+    catalog.get_type_profile_for_scope(id, profile_workspace)
+}
+
 #[cfg(test)]
 pub(super) async fn get_provider_type_profile(
     store: &Store,
@@ -1796,7 +1808,11 @@ fn provider_refresh_defaults(
     provider: &Provider,
     credential_key: &str,
 ) -> Option<CredentialRefreshProfile> {
-    let profile = get_provider_type_profile_with_catalog(catalog, &provider.r#type)?;
+    let profile = get_provider_type_profile_for_scope(
+        catalog,
+        &provider.r#type,
+        &provider.profile_workspace,
+    )?;
     profile
         .credentials
         .iter()
@@ -1819,7 +1835,9 @@ fn resolved_additional_output_keys(
     provider: &Provider,
     credential_key: &str,
 ) -> HashMap<String, String> {
-    let Some(profile) = get_provider_type_profile_with_catalog(catalog, &provider.r#type) else {
+    let Some(profile) =
+        get_provider_type_profile_for_scope(catalog, &provider.r#type, &provider.profile_workspace)
+    else {
         return HashMap::new();
     };
     profile.resolved_additional_output_keys(credential_key)
@@ -9282,4 +9300,102 @@ mod tests {
             "workspace profile should NOT appear in global list"
         );
     }
+
+    #[tokio::test]
+    async fn global_profile_provider_resolves_platform_profile_at_runtime() {
+        let state = test_server_state().await;
+
+        let mut platform_profile = custom_profile("scope-test");
+        platform_profile.display_name = "Platform Version".to_string();
+        handle_import_provider_profiles(
+            &state,
+            Request::new(ImportProviderProfilesRequest {
+                profiles: vec![ProviderProfileImportItem {
+                    profile: Some(platform_profile),
+                    source: "scope-test.yaml".to_string(),
+                }],
+                workspace: String::new(),
+            }),
+        )
+        .await
+        .unwrap();
+
+        let mut ws_profile = custom_profile("scope-test");
+        ws_profile.display_name = "Workspace Version".to_string();
+        handle_import_provider_profiles(
+            &state,
+            Request::new(ImportProviderProfilesRequest {
+                profiles: vec![ProviderProfileImportItem {
+                    profile: Some(ws_profile),
+                    source: "scope-test.yaml".to_string(),
+                }],
+                workspace: "default".to_string(),
+            }),
+        )
+        .await
+        .unwrap();
+
+        let catalog = state
+            .provider_profile_sources
+            .snapshot_catalog(state.store.as_ref(), "default")
+            .await
+            .unwrap();
+
+        let global_result = catalog.get_type_profile_for_scope("scope-test", "");
+        assert!(global_result.is_some());
+        assert_eq!(
+            global_result.unwrap().display_name,
+            "Platform Version",
+            "provider with profile_workspace='' should resolve platform profile"
+        );
+    }
+
+    #[tokio::test]
+    async fn normal_provider_resolves_workspace_shadow_at_runtime() {
+        let state = test_server_state().await;
+
+        let mut platform_profile = custom_profile("scope-test-ws");
+        platform_profile.display_name = "Platform Version".to_string();
+        handle_import_provider_profiles(
+            &state,
+            Request::new(ImportProviderProfilesRequest {
+                profiles: vec![ProviderProfileImportItem {
+                    profile: Some(platform_profile),
+                    source: "scope-test-ws.yaml".to_string(),
+                }],
+                workspace: String::new(),
+            }),
+        )
+        .await
+        .unwrap();
+
+        let mut ws_profile = custom_profile("scope-test-ws");
+        ws_profile.display_name = "Workspace Version".to_string();
+        handle_import_provider_profiles(
+            &state,
+            Request::new(ImportProviderProfilesRequest {
+                profiles: vec![ProviderProfileImportItem {
+                    profile: Some(ws_profile),
+                    source: "scope-test-ws.yaml".to_string(),
+                }],
+                workspace: "default".to_string(),
+            }),
+        )
+        .await
+        .unwrap();
+
+        let catalog = state
+            .provider_profile_sources
+            .snapshot_catalog(state.store.as_ref(), "default")
+            .await
+            .unwrap();
+
+        let ws_result = catalog.get_type_profile_for_scope("scope-test-ws", "default");
+        assert!(ws_result.is_some());
+        assert_eq!(
+            ws_result.unwrap().display_name,
+            "Workspace Version",
+            "provider with profile_workspace='default' should resolve workspace profile"
+        );
+    }
 }