[OPIK-7402] [BE] Reconcile audit mode with merged OPIK-7352 foreign-id validation

Resolve the semantic overlap after merging main (#7553): unify IdGenerator on
the merged API — implement validateIdNotInFuture / validateIdNotInFutureAsync
(and the IfPresent variants) and drop the superseded validateIdForUpdate*.
Own-id validateId stays workspace-tagged for the audit metric; referenced-id
validateIdNotInFuture falls back to UNKNOWN on the sync path and resolves the
workspace from the reactive context on the async path.

Keep #7553's fail-fast (validate before side effects) for span batches, now run
inside deferContextual so the batch's own ids attribute to the request workspace;
bindSpanToProjectAndId no longer re-validates. Trace batches keep validating in
bindTraceToProjectAndId with the workspace threaded through.

Update the async test to the renamed methods.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: thiagohora

apps/opik-backend/src/main/java/com/comet/opik/domain/IdGenerator.java

@@ -111,16 +111,19 @@ public Mono<UUID> validateIdAsync(@NonNull UUID id, String resource) {
     }
 
     @Override
-
-    public void validateIdForUpdate(@NonNull UUID id, String resource, String workspaceId) {
+    public void validateIdNotInFuture(@NonNull UUID id, String resource) {
         IdGenerator.validateVersion(id, resource);
-        uuidV7TimestampValidator.validateNotInFuture(id, resource, workspaceId);
+        // Referenced/foreign ids are validated where the request-scoped workspace is not threaded
+        // (e.g. the synchronous fail-fast batch pass), so the audit metric falls back to UNKNOWN here;
+        // the batch's own ids still carry the workspace via validateId.
+        uuidV7TimestampValidator.validateNotInFuture(id, resource, ErrorMetricsResolver.UNKNOWN);
     }
 
     @Override
-    public Mono<UUID> validateIdForUpdateAsync(@NonNull UUID id, String resource) {
+    public Mono<UUID> validateIdNotInFutureAsync(@NonNull UUID id, String resource) {
         return Mono.deferContextual(ctx -> Mono.fromCallable(() -> {
-            validateIdNotInFuture(id, resource, workspaceId(ctx));
+            IdGenerator.validateVersion(id, resource);
+            uuidV7TimestampValidator.validateNotInFuture(id, resource, workspaceId(ctx));
             return id;
         }));
     }

apps/opik-backend/src/main/java/com/comet/opik/domain/SpanService.java

@@ -375,15 +375,6 @@ public Mono<Long> create(@NonNull SpanBatch batch) {
 
         List<Span> dedupedSpans = dedupSpans(batch.spans());
 
-        // Fail fast on invalid ids BEFORE any side effect below (auto-stripped attachment deletion, project
-        // creation), so a rejected batch never mutates state.
-        dedupedSpans.forEach(span -> {
-            if (span.id() != null) {
-                idGenerator.validateId(span.id(), SPAN_KEY);
-            }
-            validateSpanReferences(span.traceId(), span.parentSpanId());
-        });
-
         List<String> projectNames = dedupedSpans
                 .stream()
                 .map(Span::projectName)
@@ -401,7 +392,19 @@ public Mono<Long> create(@NonNull SpanBatch batch) {
                 .filter(Objects::nonNull)
                 .collect(Collectors.toSet());
 
-        return attachmentService.deleteAutoStrippedAttachments(SPAN, spanIds)
+        // Fail fast on invalid ids BEFORE any side effect below (auto-stripped attachment deletion, project
+        // creation), so a rejected batch never mutates state. Runs inside deferContextual so the audit
+        // metric can attribute the batch's own ids to the request workspace.
+        return Mono.deferContextual(validationCtx -> {
+            String validationWorkspaceId = validationCtx.get(RequestContext.WORKSPACE_ID);
+            dedupedSpans.forEach(span -> {
+                if (span.id() != null) {
+                    idGenerator.validateId(span.id(), SPAN_KEY, validationWorkspaceId);
+                }
+                validateSpanReferences(span.traceId(), span.parentSpanId());
+            });
+            return attachmentService.deleteAutoStrippedAttachments(SPAN, spanIds);
+        })
                 .then(Mono.deferContextual(ctx -> {
                     String workspaceId = ctx.get(RequestContext.WORKSPACE_ID);
                     String workspaceName = ctx.getOrDefault(RequestContext.WORKSPACE_NAME, "");
@@ -410,7 +413,7 @@ public Mono<Long> create(@NonNull SpanBatch batch) {
                     Mono<List<Span>> resolveProjects = Flux.fromIterable(projectNames)
                             .flatMap(projectService::getOrCreate)
                             .collectList()
-                            .map(projects -> bindSpanToProjectAndId(dedupedSpans, projects, workspaceId));
+                            .map(projects -> bindSpanToProjectAndId(dedupedSpans, projects));
 
                     return resolveProjects
                             .flatMap(this::stripAttachmentsFromSpanBatch)
@@ -462,7 +465,7 @@ private void validateSpanReferences(UUID traceId, UUID parentSpanId) {
         idGenerator.validateIdNotInFutureIfPresent(parentSpanId, SPAN_PARENT_KEY);
     }
 
-    private List<Span> bindSpanToProjectAndId(List<Span> spans, List<Project> projects, String workspaceId) {
+    private List<Span> bindSpanToProjectAndId(List<Span> spans, List<Project> projects) {
         Map<String, Project> projectPerName = projects.stream()
                 .collect(Collectors.toMap(
                         WorkspaceUtils::stripProjectName,
@@ -482,10 +485,9 @@ private List<Span> bindSpanToProjectAndId(List<Span> spans, List<Project> projec
                         throw new IllegalStateException("Project not found: %s".formatted(span.projectName()));
                     }
 
+                    // Ids are already validated up-front in create(SpanBatch); generated ids are inherently valid.
                     UUID id = span.id() == null ? idGenerator.generateId() : span.id();
 
-                    idGenerator.validateId(id, SPAN_KEY, workspaceId);
-
                     return span.toBuilder().id(id).projectId(project.id()).build();
                 })
                 .toList();

apps/opik-backend/src/test/java/com/comet/opik/domain/IdGeneratorAsyncValidationTest.java

@@ -17,7 +17,7 @@
 
 /**
  * Covers the reactive validation paths of {@link IdGenerator} (which the sync {@link
- * UuidV7TimestampValidatorTest} does not): {@code validateIdAsync} / {@code validateIdForUpdateAsync}
+ * UuidV7TimestampValidatorTest} does not): {@code validateIdAsync} / {@code validateIdNotInFutureAsync}
  * resolve {@code workspaceId} from the Reactor context via {@code deferContextual}, falling back to
  * {@link com.comet.opik.infrastructure.metrics.ErrorMetricsResolver#UNKNOWN} when the context has no
  * {@link RequestContext#WORKSPACE_ID}. Both cases must preserve the accept/reject behavior.
@@ -76,14 +76,14 @@ void rejectAsyncRejectsFutureWithoutContext() {
     }
 
     @Test
-    @DisplayName("reject: validateIdForUpdateAsync rejects only too-far-future, accepts old ids")
+    @DisplayName("reject: validateIdNotInFutureAsync rejects only too-far-future, accepts old ids")
     void rejectForUpdateAsync() {
         var oldId = idAt(Instant.now().minus(48, ChronoUnit.HOURS));
-        StepVerifier.create(rejectGenerator.validateIdForUpdateAsync(oldId, RESOURCE).contextWrite(withWorkspace()))
+        StepVerifier.create(rejectGenerator.validateIdNotInFutureAsync(oldId, RESOURCE).contextWrite(withWorkspace()))
                 .expectNext(oldId)
                 .verifyComplete();
         StepVerifier
-                .create(rejectGenerator.validateIdForUpdateAsync(tooFarFutureId(), RESOURCE)
+                .create(rejectGenerator.validateIdNotInFutureAsync(tooFarFutureId(), RESOURCE)
                         .contextWrite(withWorkspace()))
                 .expectError(InvalidUUIDException.class)
                 .verify();
@@ -104,10 +104,10 @@ void auditAsyncNeverRejects() {
     }
 
     @Test
-    @DisplayName("audit: validateIdForUpdateAsync passes a too-far-future id through")
+    @DisplayName("audit: validateIdNotInFutureAsync passes a too-far-future id through")
     void auditForUpdateAsyncNeverRejects() {
         var id = tooFarFutureId();
-        StepVerifier.create(Mono.defer(() -> auditGenerator.validateIdForUpdateAsync(id, RESOURCE)))
+        StepVerifier.create(Mono.defer(() -> auditGenerator.validateIdNotInFutureAsync(id, RESOURCE)))
                 .expectNext(id)
                 .verifyComplete();
     }