fix(app-studio): address tenant workspace by DefaultCluster, not path (#357)

The app-studio tenant client built its kcp config as
`<host>/clusters/<X-Kedge-Tenant>`, where X-Kedge-Tenant is the workspace
*path* (root:kedge:tenants:<org>:<ws>) injected by the hub. Because the
provider kubeconfig host points at the hub proxy, that request re-entered
the hub's kcp proxy, whose cluster gate accepts only the caller's
DefaultCluster *ID* (or ID:mount) — never a path — and 403'd with
"cluster access denied". This broke every /api/projects and llm-settings
call in prod.

The tenant factory only ever acts on the caller's own workspace, so drop
the /clusters/ segment and let the hub proxy scope the bare path to the
token's DefaultCluster. tenantPath is retained as a cache key only.

Also bundles in-progress infrastructure-provider instance-views work.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mjudeikis

providers/app-studio/tenant/client.go

@@ -16,7 +16,11 @@ You may obtain a copy of the License at
 // The base kubeconfig (the provider's own kcp connection) supplies only the
 // front-proxy host + TLS; its credential is dropped so the factory can never
 // authenticate as the provider. Per request we build a config with that host
-// (cluster segment swapped for the tenant's path) and the caller's bearer token.
+// (no /clusters/ segment) and the caller's bearer token: the kedge hub proxy
+// scopes bare paths to the caller's own DefaultCluster, which is the only
+// workspace this factory ever talks to. Addressing by the tenant's workspace
+// *path* instead would be rejected — the proxy's cluster gate accepts only the
+// caller's DefaultCluster *ID* (or ID:mount), not a path.
 package tenant
 
 import (
@@ -70,8 +74,14 @@ func NewClientFactory(base *rest.Config) *ClientFactory {
 	}
 }
 
-// For returns a dynamic client scoped to tenantPath, authenticating as the
-// caller via token. Cached per (tenant, token).
+// For returns a dynamic client scoped to the caller's own workspace,
+// authenticating as the caller via token. Cached per (tenant, token).
+//
+// The host carries no /clusters/ segment: the hub proxy scopes bare paths to
+// the token's DefaultCluster. tenantPath is retained only as a cache key — the
+// caller always acts within its own default workspace, so a request must never
+// be addressed by the workspace path (the proxy's gate rejects paths, accepting
+// only the DefaultCluster ID).
 func (f *ClientFactory) For(tenantPath, token string) (dynamic.Interface, error) {
 	if token == "" {
 		return nil, fmt.Errorf("no bearer token on request — cannot act on the tenant's behalf")
@@ -83,7 +93,7 @@ func (f *ClientFactory) For(tenantPath, token string) (dynamic.Interface, error)
 	}
 
 	cfg := &rest.Config{
-		Host:            f.baseHost + "/clusters/" + tenantPath,
+		Host:            f.baseHost,
 		BearerToken:     token,
 		TLSClientConfig: f.baseTLS,
 	}

providers/infrastructure/README.md

@@ -140,6 +140,7 @@ helm CLI.
 | Operator | `operator/` + `apis/v1alpha1` — `InfrastructureProvider` CRD + reconciler |
 | Helm chart | `deploy/chart/` — operator + provider Deployment + CatalogEntry |
 | Per-cloud credential convention | [docs/credentials.md](docs/credentials.md) |
+| Template-defined instance rendering | [docs/instance-views.md](docs/instance-views.md) |
 
 The CatalogEntry ships with `apiExport.schemas: []` (pure broker, no
 CRDs leak into tenant workspaces). The single `permissionClaim` is

providers/infrastructure/apis/v1alpha1/types_template.go

@@ -170,6 +170,33 @@ type TemplateSpec struct {
 	// not rendered in the form.
 	// +optional
 	Agent *TemplateAgent `json:"agent,omitempty"`
+
+	// View is optional presentation metadata that tells the portal how to render
+	// this template's instances — extra columns in the instance-list table and
+	// grouped, typed fields on the instance detail page — instead of the default
+	// raw-JSON dump. Authored by the template owner so each template controls its
+	// own UX. Field values are dot-paths or ${…}-interpolated strings resolved
+	// against the instance's spec/status/meta (see the portal's view resolver).
+	// Stored as raw JSON (preserve-unknown-fields) and surfaced to the portal as
+	// spec.view; opaque to the controller. Shape:
+	//
+	//	columns:                         # extra instance-list columns
+	//	  - header: Endpoint
+	//	    value: "https://${spec.expose.fqdn}"
+	//	    type: link                   # text | link | badge | code
+	//	detail:                          # detail-page field groups
+	//	  - title: Access
+	//	    fields:
+	//	      - label: URL
+	//	        value: "https://${status.url}"
+	//	        type: link
+	//	      - label: Region
+	//	        path: spec.region
+	//
+	// +optional
+	// +kubebuilder:pruning:PreserveUnknownFields
+	// +kubebuilder:validation:XPreserveUnknownFields
+	View *runtime.RawExtension `json:"view,omitempty"`
 }
 
 // TemplateAgent is machine-facing guidance for LLM agents operating this

providers/infrastructure/apis/v1alpha1/zz_generated.deepcopy.go

@@ -235,6 +235,24 @@ spec:
                 maxLength: 64
                 pattern: ^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$
                 type: string
+              view:
+                description: "View is optional presentation metadata that tells the
+                  portal how to render\nthis template's instances — extra columns
+                  in the instance-list table and\ngrouped, typed fields on the instance
+                  detail page — instead of the default\nraw-JSON dump. Authored by
+                  the template owner so each template controls its\nown UX. Field
+                  values are dot-paths or ${…}-interpolated strings resolved\nagainst
+                  the instance's spec/status/meta (see the portal's view resolver).\nStored
+                  as raw JSON (preserve-unknown-fields) and surfaced to the portal
+                  as\nspec.view; opaque to the controller. Shape:\n\n\tcolumns:                         #
+                  extra instance-list columns\n\t  - header: Endpoint\n\t    value:
+                  \"https://${spec.expose.fqdn}\"\n\t    type: link                   #
+                  text | link | badge | code\n\tdetail:                          #
+                  detail-page field groups\n\t  - title: Access\n\t    fields:\n\t
+                  \     - label: URL\n\t        value: \"https://${status.url}\"\n\t
+                  \       type: link\n\t      - label: Region\n\t        path: spec.region"
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
             required:
             - backend
             - instanceCRD

providers/infrastructure/config/crds/infrastructure.kedge.faros.sh_templates.yaml

@@ -0,0 +1,90 @@
+# Instance views — template-defined rendering
+
+By default the portal renders an instance's `My instances` row as
+Name / Template / Status / Age, and its detail page as a raw-JSON dump of the
+instance's `spec`. A template can override both by declaring a **view**, so each
+template controls how its own instances look — add an `Endpoint` column, turn a
+computed URL into a clickable link, group fields under headings, etc.
+
+The view is authored **on the template** (`spec.view` on the `Template` CRD, or
+the `kedge.faros.sh/view` annotation on a kro RGD). It is opaque to the
+controller and interpreted entirely by the portal's view resolver
+(`portal/src/view.ts`).
+
+## Shape
+
+```yaml
+spec:
+  view:
+    columns:                          # extra instance-list columns (after Name/Template)
+      - header: URL
+        value: "${status.url}"        # interpolated string
+        type: link
+      - header: Auth
+        path: spec.oidc.mode          # single dot-path
+        type: badge
+    detail:                           # detail-page field groups (replace the raw dump)
+      - title: Access
+        fields:
+          - label: URL
+            value: "${status.url}"
+            type: link
+          - label: Hostname
+            path: status.host
+            type: code
+```
+
+A template with no `view` keeps the default rendering. `columns` and `detail`
+are independent — define either or both.
+
+## Field values
+
+Each column/field resolves a single value two ways (use one):
+
+- `path:` — a dot-path, e.g. `status.host` or `spec.database.version`.
+- `value:` — a string with `${…}` tokens, e.g. `"https://${spec.expose.fqdn}/app"`.
+  A token that doesn't resolve becomes empty, so partial templates degrade
+  gracefully.
+
+Three namespaces are available, matching the CR's own shape:
+
+| Namespace | Source | Example |
+|-----------|--------|---------|
+| `spec.*` | the instance's input values | `spec.database.version` |
+| `status.*` | controller-computed outputs | `status.url`, `status.host` |
+| `meta.*` | `name`, `namespace`, `phase`, `template`, `createdAt` | `meta.phase` |
+
+An **unqualified** first segment resolves against `spec`, so `expose.fqdn` is the
+same as `spec.expose.fqdn`.
+
+> `status.*` only carries values your template's `status` mapping actually
+> projects onto the instance (the `conditions` and `children` arrays are excluded —
+> they have their own sections on the detail page). If a column referencing
+> `status.*`/`spec.*` shows `—`, the field isn't populated yet (still
+> provisioning) or isn't in the status mapping.
+
+## Renderers (`type`)
+
+| `type` | Renders as |
+|--------|------------|
+| `text` (default) | plain text |
+| `link` | clickable anchor opening in a new tab. The href is `href:` if set, else the resolved value; a bare host gets `https://` prepended. |
+| `code` | monospace pill with a copy button (good for secret names, hostnames) |
+| `badge` | neutral pill (good for enums like an auth mode or version) |
+
+## Worked example
+
+See [`install/templates/application.yaml`](../install/templates/application.yaml)
+for a full `spec.view` driving the URL column, an auth badge, and Access /
+Configuration / Readiness detail groups.
+
+## Notes for authors
+
+- Different templates may define different columns; the instance list shows the
+  ordered union of all present templates' headers, and a row only fills the
+  headers its own template defines.
+- When a template's columns reference `spec.*`/`status.*`, the portal fetches the
+  full instance object per row to populate them — keep the column count modest.
+- Keep `spec.view` in lockstep with the embedded CRD: after editing the
+  `Template` CRD's Go type, run `make codegen-infrastructure-provider` so the
+  generated + embedded CRDs carry the `view` field (otherwise kcp prunes it).

providers/infrastructure/docs/instance-views.md

@@ -235,6 +235,24 @@ spec:
                 maxLength: 64
                 pattern: ^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$
                 type: string
+              view:
+                description: "View is optional presentation metadata that tells the
+                  portal how to render\nthis template's instances — extra columns
+                  in the instance-list table and\ngrouped, typed fields on the instance
+                  detail page — instead of the default\nraw-JSON dump. Authored by
+                  the template owner so each template controls its\nown UX. Field
+                  values are dot-paths or ${…}-interpolated strings resolved\nagainst
+                  the instance's spec/status/meta (see the portal's view resolver).\nStored
+                  as raw JSON (preserve-unknown-fields) and surfaced to the portal
+                  as\nspec.view; opaque to the controller. Shape:\n\n\tcolumns:                         #
+                  extra instance-list columns\n\t  - header: Endpoint\n\t    value:
+                  \"https://${spec.expose.fqdn}\"\n\t    type: link                   #
+                  text | link | badge | code\n\tdetail:                          #
+                  detail-page field groups\n\t  - title: Access\n\t    fields:\n\t
+                  \     - label: URL\n\t        value: \"https://${status.url}\"\n\t
+                  \       type: link\n\t      - label: Region\n\t        path: spec.region"
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
             required:
             - backend
             - instanceCRD

providers/infrastructure/install/crds/infrastructure.kedge.faros.sh_templates.yaml

@@ -85,6 +85,52 @@ spec:
       - "status.redirectURL — the OIDC redirect/callback URL to register with your IdP (byo mode)."
       - "Per-tier readiness: status.frontendReady / backendReady / databaseReady / oauthReady (ready replica counts)."
       - "The backend's DATABASE_URL env is sourced from Secret '<name>-db-credentials' (key 'uri') in the instance namespace — informational; the image just reads the DATABASE_URL env, it never reads the Secret."
+  # ── Portal presentation ───────────────────────────────────────────────
+  # Tells the portal how to render this template's instances instead of the
+  # default raw-JSON values dump. Field values are dot-paths or ${…}-interpolated
+  # strings resolved against the instance's spec.* (inputs), status.* (computed
+  # outputs), and meta.* (name/phase/…). type ∈ text|link|badge|code.
+  view:
+    # Extra columns in the "My instances" table (after Name/Template).
+    columns:
+      - header: URL
+        value: "${status.url}"
+        type: link
+      - header: Auth
+        path: spec.oidc.mode
+        type: badge
+    # Field groups on the instance detail page (replace the raw values dump).
+    detail:
+      - title: Access
+        fields:
+          - label: URL
+            value: "${status.url}"
+            type: link
+          - label: Hostname
+            path: status.host
+            type: code
+          - label: Redirect URL
+            value: "${status.redirectURL}"
+            type: link
+      - title: Configuration
+        fields:
+          - label: Auth mode
+            path: spec.oidc.mode
+            type: badge
+          - label: Postgres version
+            path: spec.database.version
+            type: badge
+          - label: DB secret
+            path: status.dbConnectionSecretRef.name
+            type: code
+      - title: Readiness
+        fields:
+          - label: Frontend
+            path: status.frontendReady
+          - label: Backend
+            path: status.backendReady
+          - label: Database
+            path: status.databaseReady
   instanceCRD:
     group: infrastructure.kedge.faros.sh
     version: v1alpha1

providers/infrastructure/install/templates/application.yaml

@@ -244,6 +244,16 @@ func unstructuredToInstance(obj *unstructured.Unstructured, templateName string)
 	if spec, _, _ := unstructured.NestedMap(obj.Object, "spec"); spec != nil {
 		inst.Values = spec
 	}
+	if status, _, _ := unstructured.NestedMap(obj.Object, "status"); status != nil {
+		// Surface controller-computed outputs (url, fqdn, secret names, …)
+		// for a template's View to reference as status.*. Drop the bulky
+		// conditions/children arrays — already promoted to typed fields.
+		delete(status, "conditions")
+		delete(status, "children")
+		if len(status) > 0 {
+			inst.Status = status
+		}
+	}
 	if phase, _, _ := unstructured.NestedString(obj.Object, "status", "phase"); phase != "" {
 		inst.Phase = phase
 	}

providers/infrastructure/kro/instance.go

@@ -161,5 +161,11 @@ func rgdToTemplate(obj *unstructured.Unstructured) (*Template, error) {
 			t.SampleValues = parsed
 		}
 	}
+	if raw := annotations[AnnotationView]; raw != "" {
+		var view TemplateView
+		if err := json.Unmarshal([]byte(raw), &view); err == nil {
+			t.View = &view
+		}
+	}
 	return t, nil
 }