feat(app-studio): route tenant access through the GraphQL gateway

mjudeikis · claude · mjudeikis · commit ba4d009fe64c · 2026-06-26T22:06:56.000+03:00
Activate the GraphQL path: clientFor now builds a tenant.Scope from the
X-Kedge-Cluster header (the hub-injected workspace cluster ID) and the caller
token, so App Studio reaches its workspace through the hub's gateway — which
serves any workspace the caller has access to, unlike the DefaultCluster-gated
kcp user-proxy.

- http.go reads X-Kedge-Cluster into identity.clusterID
- server.go/main.go construct the GraphQL client from KEDGE_HUB_URL
- all ~18 c.Dynamic().Resource(gvr) call sites move to c.Resource(descriptor),
  backed by the GraphQL Scope (prod) or a dynamic client (tests)
- tenant_resources.go holds the GraphQL descriptors (Kind/Plural) for Project,
  Secret, SandboxRunner, and code-provider Connection/Repository
- isProjectAPIInitializingError recognises the gateway "schema not ready"
  shapes (no schema for cluster / Project type missing) for the 503 path

Module builds, vets, and the full test suite passes.

Co-Authored-By: Claude Opus 4.8 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/providers/app-studio/api/code_repository.go b/providers/app-studio/api/code_repository.go
@@ -101,7 +101,7 @@ func (s *Server) prepareProjectRepository(ctx context.Context, c *asclient.Clien
 
 func selectCodeConnection(ctx context.Context, c *asclient.Client, requested string) (string, error) {
 	if requested != "" {
-		conn, err := c.Dynamic().Resource(codeConnectionsGVR).Get(ctx, requested, metav1.GetOptions{})
+		conn, err := c.Resource(codeConnectionResource, "").Get(ctx, requested, metav1.GetOptions{})
 		if err != nil {
 			return "", codeProviderRequestError("get Code connection", err)
 		}
@@ -111,7 +111,7 @@ func selectCodeConnection(ctx context.Context, c *asclient.Client, requested str
 		return requested, nil
 	}
 
-	list, err := c.Dynamic().Resource(codeConnectionsGVR).List(ctx, metav1.ListOptions{})
+	list, err := c.Resource(codeConnectionResource, "").List(ctx, metav1.ListOptions{})
 	if err != nil {
 		return "", codeProviderRequestError("list Code connections", err)
 	}
@@ -142,7 +142,7 @@ func repositoryName(ctx context.Context, c *asclient.Client, requested, displayN
 		if i > 0 {
 			name = dns1123LabelWithSuffix(base, uuid.NewString()[:6])
 		}
-		if _, err := c.Dynamic().Resource(codeRepositoriesGVR).Get(ctx, name, metav1.GetOptions{}); apierrors.IsNotFound(err) {
+		if _, err := c.Resource(codeRepositoryResource, "").Get(ctx, name, metav1.GetOptions{}); apierrors.IsNotFound(err) {
 			return name, nil
 		} else if err != nil {
 			return "", codeProviderRequestError("get Code repository", err)
@@ -169,7 +169,7 @@ func (s *Server) createProjectRepository(ctx context.Context, c *asclient.Client
 		"description":   plan.Description,
 		"autoInit":      true,
 	}
-	if _, err := c.Dynamic().Resource(codeRepositoriesGVR).Create(ctx, repo, metav1.CreateOptions{}); err != nil {
+	if _, err := c.Resource(codeRepositoryResource, "").Create(ctx, repo, metav1.CreateOptions{}); err != nil {
 		if apierrors.IsAlreadyExists(err) {
 			return newValidationError(fmt.Sprintf("Code repository %q already exists", plan.Ref))
 		}
@@ -183,10 +183,10 @@ func projectRepositoryView(ctx context.Context, c *asclient.Client, p *aiv1alpha
 	var list codeResourceLister
 	if c != nil {
 		get = func(ctx context.Context, gvr schema.GroupVersionResource, name string) (*unstructured.Unstructured, error) {
-			return c.Dynamic().Resource(gvr).Get(ctx, name, metav1.GetOptions{})
+			return c.Resource(codeResourceFor(gvr), "").Get(ctx, name, metav1.GetOptions{})
 		}
 		list = func(ctx context.Context, gvr schema.GroupVersionResource, opts metav1.ListOptions) (*unstructured.UnstructuredList, error) {
-			return c.Dynamic().Resource(gvr).List(ctx, opts)
+			return c.Resource(codeResourceFor(gvr), "").List(ctx, opts)
 		}
 	}
 	return projectRepositoryViewFromResources(ctx, p, get, list)
diff --git a/providers/app-studio/api/development_runtime.go b/providers/app-studio/api/development_runtime.go
@@ -68,7 +68,7 @@ func (s *Server) runtimeTargetForProject(ctx context.Context, c *asclient.Client
 	if strings.TrimSpace(name) == "" {
 		return runtimeTarget{}, nil, fmt.Errorf("sandbox runner name is empty")
 	}
-	obj, err := c.Dynamic().Resource(sandboxRunnerGVR).Get(ctx, name, metav1.GetOptions{})
+	obj, err := c.Resource(sandboxRunnerResource, "").Get(ctx, name, metav1.GetOptions{})
 	if err != nil {
 		return runtimeTarget{}, nil, err
 	}
@@ -332,14 +332,14 @@ func patchLastSync(ctx context.Context, c *asclient.Client, name string, t metav
 	if c == nil {
 		return nil
 	}
-	obj, err := c.Dynamic().Resource(sandboxRunnerGVR).Get(ctx, name, metav1.GetOptions{})
+	obj, err := c.Resource(sandboxRunnerResource, "").Get(ctx, name, metav1.GetOptions{})
 	if err != nil {
 		return err
 	}
 	if err := unstructured.SetNestedField(obj.Object, t.Format("2006-01-02T15:04:05Z07:00"), "status", "lastSyncTime"); err != nil {
 		return err
 	}
-	_, err = c.Dynamic().Resource(sandboxRunnerGVR).UpdateStatus(ctx, obj, metav1.UpdateOptions{})
+	_, err = c.Resource(sandboxRunnerResource, "").UpdateStatus(ctx, obj, metav1.UpdateOptions{})
 	if apierrors.IsNotFound(err) || apierrors.IsForbidden(err) {
 		return nil
 	}
diff --git a/providers/app-studio/api/development_sync.go b/providers/app-studio/api/development_sync.go
@@ -457,8 +457,8 @@ func (s *Server) scheduleDevelopmentSyncAfterMutation(id identity, p *aiv1alpha1
 }
 
 func (s *Server) syncDevelopmentAfterMutation(id identity, p *aiv1alpha1.Project, name string) {
-	if s.clients == nil {
-		klog.V(2).Infof("development sandbox sync after %s skipped for project %s: tenant client factory is not configured", projectToolBaseName(name), p.Name)
+	if s.gql == nil {
+		klog.V(2).Infof("development sandbox sync after %s skipped for project %s: tenant GraphQL client is not configured", projectToolBaseName(name), p.Name)
 		return
 	}
 	c, err := s.clientFor(id)
diff --git a/providers/app-studio/api/http.go b/providers/app-studio/api/http.go
@@ -31,6 +31,7 @@ import (
 // headers (defense in depth — a spoofed header cannot mis-scope storage).
 type identity struct {
 	tenantPath    string // X-Kedge-Tenant, e.g. root:kedge:orgs:<org>:<ws>
+	clusterID     string // X-Kedge-Cluster, the workspace's kcp logical-cluster ID
 	orgUUID       string // parsed from tenantPath
 	workspaceUUID string // parsed from tenantPath ("" when the path is org-only)
 	user          string // X-Kedge-User
@@ -50,6 +51,7 @@ func identityFromRequest(w http.ResponseWriter, r *http.Request) (identity, bool
 	org, ws := parseTenantPath(tenantPath)
 	return identity{
 		tenantPath:    tenantPath,
+		clusterID:     strings.TrimSpace(r.Header.Get("X-Kedge-Cluster")),
 		orgUUID:       org,
 		workspaceUUID: ws,
 		user:          strings.TrimSpace(r.Header.Get("X-Kedge-User")),
diff --git a/providers/app-studio/api/llm.go b/providers/app-studio/api/llm.go
@@ -1279,7 +1279,7 @@ func firstSSELine(body []byte) (json.RawMessage, bool) {
 
 func readProjectLLMSettings(ctx context.Context, c *asclient.Client) (projectLLMSettings, error) {
 	settings := defaultProjectLLMSettings()
-	secret, err := c.Dynamic().Resource(secretGVR).Namespace(projectLLMSecretNamespace).Get(ctx, projectLLMSecretName, metav1.GetOptions{})
+	secret, err := c.Resource(secretResource, projectLLMSecretNamespace).Get(ctx, projectLLMSecretName, metav1.GetOptions{})
 	if apierrors.IsNotFound(err) {
 		return settings, nil
 	}
@@ -1301,16 +1301,16 @@ func readProjectLLMSettings(ctx context.Context, c *asclient.Client) (projectLLM
 
 func writeProjectLLMSettings(ctx context.Context, c *asclient.Client, settings projectLLMSettings) error {
 	secret := projectLLMSettingsSecret(settings)
-	existing, err := c.Dynamic().Resource(secretGVR).Namespace(projectLLMSecretNamespace).Get(ctx, projectLLMSecretName, metav1.GetOptions{})
+	existing, err := c.Resource(secretResource, projectLLMSecretNamespace).Get(ctx, projectLLMSecretName, metav1.GetOptions{})
 	if apierrors.IsNotFound(err) {
-		_, err = c.Dynamic().Resource(secretGVR).Namespace(projectLLMSecretNamespace).Create(ctx, secret, metav1.CreateOptions{})
+		_, err = c.Resource(secretResource, projectLLMSecretNamespace).Create(ctx, secret, metav1.CreateOptions{})
 		return err
 	}
 	if err != nil {
 		return err
 	}
 	secret.SetResourceVersion(existing.GetResourceVersion())
-	_, err = c.Dynamic().Resource(secretGVR).Namespace(projectLLMSecretNamespace).Update(ctx, secret, metav1.UpdateOptions{})
+	_, err = c.Resource(secretResource, projectLLMSecretNamespace).Update(ctx, secret, metav1.UpdateOptions{})
 	return err
 }
 
diff --git a/providers/app-studio/api/projects.go b/providers/app-studio/api/projects.go
@@ -167,10 +167,20 @@ func writeProjectError(w http.ResponseWriter, err error) {
 }
 
 func isProjectAPIInitializingError(err error) bool {
-	if !apierrors.IsNotFound(err) {
+	if err == nil {
 		return false
 	}
-	return strings.Contains(strings.ToLower(err.Error()), "server could not find the requested resource")
+	low := strings.ToLower(err.Error())
+	// kcp dynamic path: the Project API isn't served in the workspace yet.
+	if apierrors.IsNotFound(err) && strings.Contains(low, "server could not find the requested resource") {
+		return true
+	}
+	// GraphQL path: either the gateway has no schema for the workspace cluster
+	// yet, or the schema lacks the Project type (APIBinding not established) —
+	// both surface while the workspace is still being provisioned.
+	return strings.Contains(low, "workspace initializing") ||
+		strings.Contains(low, "cannot query field") ||
+		strings.Contains(low, "unknown field")
 }
 
 func (s *Server) listProjects(w http.ResponseWriter, r *http.Request) {
@@ -297,7 +307,7 @@ func (s *Server) cleanupCreatedProjectSetup(ctx context.Context, c *asclient.Cli
 	_ = s.deleteProjectProviderResources(ctx, c, p, id)
 	if p.Spec.Repository != nil {
 		if ref := strings.TrimSpace(p.Spec.Repository.RepositoryRef); ref != "" {
-			_ = c.Dynamic().Resource(codeRepositoriesGVR).Delete(ctx, ref, metav1.DeleteOptions{})
+			_ = c.Resource(codeRepositoryResource, "").Delete(ctx, ref, metav1.DeleteOptions{})
 		}
 	}
 	if name := strings.TrimSpace(p.Name); name != "" {
diff --git a/providers/app-studio/api/provider_resources.go b/providers/app-studio/api/provider_resources.go
@@ -89,7 +89,7 @@ func ensureProjectProviderResource(ctx context.Context, c *asclient.Client, p *a
 	if owner := projectProviderResourceOwnerRef(p); owner != nil {
 		want.SetOwnerReferences([]metav1.OwnerReference{*owner})
 	}
-	res := c.Dynamic().Resource(gvr)
+	res := c.Resource(providerBindingResource(gvr, binding.ResourceRef.Kind), "")
 	existing, err := res.Get(ctx, name, metav1.GetOptions{})
 	if apierrors.IsNotFound(err) {
 		return res.Create(ctx, want, metav1.CreateOptions{})
@@ -138,7 +138,7 @@ func (s *Server) deleteProjectProviderResources(ctx context.Context, c *asclient
 			}
 			runtimeNamespace := ""
 			if isSandboxRunnerBinding(binding) && s != nil && s.runtimeClient != nil {
-				obj, err := c.Dynamic().Resource(gvr).Get(ctx, name, metav1.GetOptions{})
+				obj, err := c.Resource(providerBindingResource(gvr, binding.ResourceRef.Kind), "").Get(ctx, name, metav1.GetOptions{})
 				if err != nil && !apierrors.IsNotFound(err) {
 					return err
 				}
@@ -149,7 +149,7 @@ func (s *Server) deleteProjectProviderResources(ctx context.Context, c *asclient
 					}
 				}
 			}
-			err = c.Dynamic().Resource(gvr).Delete(ctx, name, metav1.DeleteOptions{})
+			err = c.Resource(providerBindingResource(gvr, binding.ResourceRef.Kind), "").Delete(ctx, name, metav1.DeleteOptions{})
 			if err != nil && !apierrors.IsNotFound(err) {
 				return err
 			}
@@ -291,7 +291,7 @@ func projectProviderBindingStatus(ctx context.Context, c *asclient.Client, p *ai
 		status.Phase = "Invalid"
 		return status
 	}
-	obj, err := c.Dynamic().Resource(gvr).Get(ctx, name, metav1.GetOptions{})
+	obj, err := c.Resource(providerBindingResource(gvr, binding.ResourceRef.Kind), "").Get(ctx, name, metav1.GetOptions{})
 	if err != nil {
 		status.Phase = "Pending"
 		return status
diff --git a/providers/app-studio/api/server.go b/providers/app-studio/api/server.go
@@ -46,7 +46,7 @@ import (
 // for dev MCP calls; workspaces stores project files owned by App Studio; and
 // assistantEngine runs project assistant turns.
 type Server struct {
-	clients                      *tenant.ClientFactory
+	gql                          *tenant.GraphQLClient
 	store                        store.Store
 	workspaces                   *workspace.FileStore
 	hubBase                      string
@@ -65,14 +65,14 @@ type Server struct {
 }
 
 // New constructs a Server.
-func New(clients *tenant.ClientFactory, msgStore store.Store, hubBase string, mcpInsecureSkipTLSVerify bool) *Server {
-	return NewWithWorkspace(clients, msgStore, nil, hubBase, mcpInsecureSkipTLSVerify)
+func New(gql *tenant.GraphQLClient, msgStore store.Store, hubBase string, mcpInsecureSkipTLSVerify bool) *Server {
+	return NewWithWorkspace(gql, msgStore, nil, hubBase, mcpInsecureSkipTLSVerify)
 }
 
 // NewWithWorkspace constructs a Server with an explicit project workspace store.
-func NewWithWorkspace(clients *tenant.ClientFactory, msgStore store.Store, workspaces *workspace.FileStore, hubBase string, mcpInsecureSkipTLSVerify bool) *Server {
+func NewWithWorkspace(gql *tenant.GraphQLClient, msgStore store.Store, workspaces *workspace.FileStore, hubBase string, mcpInsecureSkipTLSVerify bool) *Server {
 	s := &Server{
-		clients:                  clients,
+		gql:                      gql,
 		store:                    msgStore,
 		workspaces:               workspaces,
 		hubBase:                  hubBase,
@@ -190,13 +190,14 @@ func (s *Server) Register(r *mux.Router) {
 	r.HandleFunc("/api/projects/{project}/memory", s.patchProjectMemory).Methods(http.MethodPatch)
 }
 
-// clientFor builds a workspace-scoped client acting as the caller.
+// clientFor builds a workspace-scoped client acting as the caller, talking to
+// the hub's GraphQL gateway for the caller's current workspace cluster.
 func (s *Server) clientFor(id identity) (*asclient.Client, error) {
-	dyn, err := s.clients.For(id.tenantPath, id.token)
+	scope, err := s.gql.For(id.clusterID, id.token)
 	if err != nil {
 		return nil, err
 	}
-	return asclient.NewFromDynamic(dyn), nil
+	return asclient.NewFromGraphQL(scope), nil
 }
 
 // requireProjectClient resolves the caller identity and a workspace-scoped
@@ -210,8 +211,12 @@ func (s *Server) requireProjectClient(w http.ResponseWriter, r *http.Request) (*
 		writeStatus(w, http.StatusBadRequest, "BadRequest", "a workspace is required for this endpoint — select an organization and workspace first")
 		return nil, identity{}, false
 	}
-	if s.clients == nil {
-		writeStatus(w, http.StatusNotImplemented, "NotImplemented", "tenant client factory not configured — provider has no kubeconfig")
+	if s.gql == nil {
+		writeStatus(w, http.StatusNotImplemented, "NotImplemented", "tenant GraphQL client not configured — provider has no hub URL")
+		return nil, identity{}, false
+	}
+	if id.clusterID == "" {
+		writeStatus(w, http.StatusBadRequest, "BadRequest", "no workspace cluster on request (X-Kedge-Cluster missing) — the hub did not resolve a cluster for this workspace")
 		return nil, identity{}, false
 	}
 	c, err := s.clientFor(id)
diff --git a/providers/app-studio/api/tenant_resources.go b/providers/app-studio/api/tenant_resources.go
@@ -0,0 +1,48 @@
+/*
+Copyright 2026 The Faros Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+*/
+
+package api
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	"github.com/faroshq/provider-app-studio/tenant"
+)
+
+// tenant.Resource descriptors for the workspace resources App Studio accesses
+// through asclient.Client.Resource. Kind/Plural drive the GraphQL field names
+// (<Kind>Yaml / <Plural>Yaml / delete<Kind>); they must match the CRD's kind
+// and its pluralization.
+var (
+	secretResource         = tenant.Resource{GVR: secretGVR, Kind: "Secret", Plural: "Secrets", Namespaced: true}
+	sandboxRunnerResource  = tenant.Resource{GVR: sandboxRunnerGVR, Kind: "SandboxRunner", Plural: "SandboxRunners"}
+	codeConnectionResource = tenant.Resource{GVR: codeConnectionsGVR, Kind: "Connection", Plural: "Connections"}
+	codeRepositoryResource = tenant.Resource{GVR: codeRepositoriesGVR, Kind: "Repository", Plural: "Repositories"}
+)
+
+// codeResourceFor maps a code-provider GVR to its descriptor, for the
+// repository-view getter/lister closures that are keyed by GVR.
+func codeResourceFor(gvr schema.GroupVersionResource) tenant.Resource {
+	switch gvr {
+	case codeRepositoriesGVR:
+		return codeRepositoryResource
+	case codeConnectionsGVR:
+		return codeConnectionResource
+	default:
+		return tenant.Resource{GVR: gvr, Kind: "", Plural: ""}
+	}
+}
+
+// providerBindingResource builds a descriptor for a project provider-binding's
+// target CR. The kind comes from the binding's ResourceRef; these CRs are
+// cluster-scoped in the workspace.
+func providerBindingResource(gvr schema.GroupVersionResource, kind string) tenant.Resource {
+	return tenant.Resource{GVR: gvr, Kind: kind, Plural: kind + "s"}
+}
diff --git a/providers/app-studio/main.go b/providers/app-studio/main.go
@@ -165,13 +165,14 @@ func runServe() {
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()
 
-	// Provider config → tenant client factory. Without a kubeconfig the project
-	// API returns 501 (useful for UI-only dev), with a loud warning.
-	var clientFactory *tenant.ClientFactory
-	if cfg, err := loadProviderConfig(); err != nil {
-		log.Printf("WARNING project API disabled (no provider kubeconfig): %v", err)
+	// Tenant access goes through the hub's GraphQL gateway (the hub injects
+	// X-Kedge-Cluster per request). Without a hub URL the project API returns
+	// 501 (useful for UI-only dev), with a loud warning.
+	var gqlClient *tenant.GraphQLClient
+	if hubURL := os.Getenv("KEDGE_HUB_URL"); hubURL == "" {
+		log.Printf("WARNING project API disabled (no KEDGE_HUB_URL)")
 	} else {
-		clientFactory = tenant.NewClientFactory(cfg)
+		gqlClient = tenant.NewGraphQLClient(hubURL, os.Getenv("KEDGE_HUB_INSECURE") == "true")
 	}
 
 	msgStore, closeStore, err := openMessageStore(ctx)
@@ -181,7 +182,7 @@ func runServe() {
 	defer closeStore()
 
 	apiServer := api.NewWithWorkspace(
-		clientFactory,
+		gqlClient,
 		msgStore,
 		openWorkspaceStore(),
 		os.Getenv("KEDGE_HUB_URL"),
diff --git a/providers/app-studio/tenant/graphql.go b/providers/app-studio/tenant/graphql.go
@@ -151,14 +151,10 @@ func (s *Scope) exec(ctx context.Context, query string, vars map[string]any, res
 		return nil, err
 	}
 	if resp.StatusCode == http.StatusNotFound {
-		// No schema for this cluster: the gateway hasn't (yet) generated a
-		// schema for the workspace. Surface a NotFound the caller can treat as
-		// "initializing" rather than a hard failure.
-		gr := schema.GroupResource{}
-		if res != nil {
-			gr = res.GVR.GroupResource()
-		}
-		return nil, apierrors.NewNotFound(gr, name)
+		// No schema for this cluster yet: the gateway hasn't generated a schema
+		// for the workspace. Distinct from an object-not-found (which comes back
+		// as a GraphQL error) so callers can treat it as "initializing".
+		return nil, fmt.Errorf("graphql gateway has no schema for cluster %q yet — workspace initializing", s.clusterID)
 	}
 	if resp.StatusCode/100 != 2 {
 		return nil, fmt.Errorf("graphql gateway HTTP %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))

Original file line number	Diff line number	Diff line change
`@@ -101,7 +101,7 @@ func (s Server) prepareProjectRepository(ctx context.Context, c asclient.Clien`
`101`	`101`
`102`	`102`	`func selectCodeConnection(ctx context.Context, c *asclient.Client, requested string) (string, error) {`
`103`	`103`	`if requested != "" {`
`104`		`- conn, err := c.Dynamic().Resource(codeConnectionsGVR).Get(ctx, requested, metav1.GetOptions{})`
	`104`	`+ conn, err := c.Resource(codeConnectionResource, "").Get(ctx, requested, metav1.GetOptions{})`
`105`	`105`	`if err != nil {`
`106`	`106`	`return "", codeProviderRequestError("get Code connection", err)`
`107`	`107`	`}`
`@@ -111,7 +111,7 @@ func selectCodeConnection(ctx context.Context, c *asclient.Client, requested str`
`111`	`111`	`return requested, nil`
`112`	`112`	`}`
`113`	`113`
`114`		`- list, err := c.Dynamic().Resource(codeConnectionsGVR).List(ctx, metav1.ListOptions{})`
	`114`	`+ list, err := c.Resource(codeConnectionResource, "").List(ctx, metav1.ListOptions{})`
`115`	`115`	`if err != nil {`
`116`	`116`	`return "", codeProviderRequestError("list Code connections", err)`
`117`	`117`	`}`
`@@ -142,7 +142,7 @@ func repositoryName(ctx context.Context, c *asclient.Client, requested, displayN`
`142`	`142`	`if i > 0 {`
`143`	`143`	`name = dns1123LabelWithSuffix(base, uuid.NewString()[:6])`
`144`	`144`	`}`
`145`		`- if _, err := c.Dynamic().Resource(codeRepositoriesGVR).Get(ctx, name, metav1.GetOptions{}); apierrors.IsNotFound(err) {`
	`145`	`+ if _, err := c.Resource(codeRepositoryResource, "").Get(ctx, name, metav1.GetOptions{}); apierrors.IsNotFound(err) {`
`146`	`146`	`return name, nil`
`147`	`147`	`} else if err != nil {`
`148`	`148`	`return "", codeProviderRequestError("get Code repository", err)`
`@@ -169,7 +169,7 @@ func (s Server) createProjectRepository(ctx context.Context, c asclient.Client`
`169`	`169`	`"description": plan.Description,`
`170`	`170`	`"autoInit": true,`
`171`	`171`	`}`
`172`		`- if _, err := c.Dynamic().Resource(codeRepositoriesGVR).Create(ctx, repo, metav1.CreateOptions{}); err != nil {`
	`172`	`+ if _, err := c.Resource(codeRepositoryResource, "").Create(ctx, repo, metav1.CreateOptions{}); err != nil {`
`173`	`173`	`if apierrors.IsAlreadyExists(err) {`
`174`	`174`	`return newValidationError(fmt.Sprintf("Code repository %q already exists", plan.Ref))`
`175`	`175`	`}`
`@@ -183,10 +183,10 @@ func projectRepositoryView(ctx context.Context, c asclient.Client, p aiv1alpha`
`183`	`183`	`var list codeResourceLister`
`184`	`184`	`if c != nil {`
`185`	`185`	`get = func(ctx context.Context, gvr schema.GroupVersionResource, name string) (*unstructured.Unstructured, error) {`
`186`		`- return c.Dynamic().Resource(gvr).Get(ctx, name, metav1.GetOptions{})`
	`186`	`+ return c.Resource(codeResourceFor(gvr), "").Get(ctx, name, metav1.GetOptions{})`
`187`	`187`	`}`
`188`	`188`	`list = func(ctx context.Context, gvr schema.GroupVersionResource, opts metav1.ListOptions) (*unstructured.UnstructuredList, error) {`
`189`		`- return c.Dynamic().Resource(gvr).List(ctx, opts)`
	`189`	`+ return c.Resource(codeResourceFor(gvr), "").List(ctx, opts)`
`190`	`190`	`}`
`191`	`191`	`}`
`192`	`192`	`return projectRepositoryViewFromResources(ctx, p, get, list)`
Original file line number	Diff line number	Diff line change
`@@ -68,7 +68,7 @@ func (s Server) runtimeTargetForProject(ctx context.Context, c asclient.Client`
`68`	`68`	`if strings.TrimSpace(name) == "" {`
`69`	`69`	`return runtimeTarget{}, nil, fmt.Errorf("sandbox runner name is empty")`
`70`	`70`	`}`
`71`		`- obj, err := c.Dynamic().Resource(sandboxRunnerGVR).Get(ctx, name, metav1.GetOptions{})`
	`71`	`+ obj, err := c.Resource(sandboxRunnerResource, "").Get(ctx, name, metav1.GetOptions{})`
`72`	`72`	`if err != nil {`
`73`	`73`	`return runtimeTarget{}, nil, err`
`74`	`74`	`}`
`@@ -332,14 +332,14 @@ func patchLastSync(ctx context.Context, c *asclient.Client, name string, t metav`
`332`	`332`	`if c == nil {`
`333`	`333`	`return nil`
`334`	`334`	`}`
`335`		`- obj, err := c.Dynamic().Resource(sandboxRunnerGVR).Get(ctx, name, metav1.GetOptions{})`
	`335`	`+ obj, err := c.Resource(sandboxRunnerResource, "").Get(ctx, name, metav1.GetOptions{})`
`336`	`336`	`if err != nil {`
`337`	`337`	`return err`
`338`	`338`	`}`
`339`	`339`	`if err := unstructured.SetNestedField(obj.Object, t.Format("2006-01-02T15:04:05Z07:00"), "status", "lastSyncTime"); err != nil {`
`340`	`340`	`return err`
`341`	`341`	`}`
`342`		`- _, err = c.Dynamic().Resource(sandboxRunnerGVR).UpdateStatus(ctx, obj, metav1.UpdateOptions{})`
	`342`	`+ _, err = c.Resource(sandboxRunnerResource, "").UpdateStatus(ctx, obj, metav1.UpdateOptions{})`
`343`	`343`	`if apierrors.IsNotFound(err) \|\| apierrors.IsForbidden(err) {`
`344`	`344`	`return nil`
`345`	`345`	`}`
Original file line number	Diff line number	Diff line change
`@@ -457,8 +457,8 @@ func (s Server) scheduleDevelopmentSyncAfterMutation(id identity, p aiv1alpha1`
`457`	`457`	`}`
`458`	`458`
`459`	`459`	`func (s Server) syncDevelopmentAfterMutation(id identity, p aiv1alpha1.Project, name string) {`
`460`		`- if s.clients == nil {`
`461`		`- klog.V(2).Infof("development sandbox sync after %s skipped for project %s: tenant client factory is not configured", projectToolBaseName(name), p.Name)`
	`460`	`+ if s.gql == nil {`
	`461`	`+ klog.V(2).Infof("development sandbox sync after %s skipped for project %s: tenant GraphQL client is not configured", projectToolBaseName(name), p.Name)`
`462`	`462`	`return`
`463`	`463`	`}`
`464`	`464`	`c, err := s.clientFor(id)`
Original file line number	Diff line number	Diff line change
`@@ -167,10 +167,20 @@ func writeProjectError(w http.ResponseWriter, err error) {`
`167`	`167`	`}`
`168`	`168`
`169`	`169`	`func isProjectAPIInitializingError(err error) bool {`
`170`		`- if !apierrors.IsNotFound(err) {`
	`170`	`+ if err == nil {`
`171`	`171`	`return false`
`172`	`172`	`}`
`173`		`- return strings.Contains(strings.ToLower(err.Error()), "server could not find the requested resource")`
	`173`	`+ low := strings.ToLower(err.Error())`
	`174`	`+ // kcp dynamic path: the Project API isn't served in the workspace yet.`
	`175`	`+ if apierrors.IsNotFound(err) && strings.Contains(low, "server could not find the requested resource") {`
	`176`	`+ return true`
	`177`	`+ }`
	`178`	`+ // GraphQL path: either the gateway has no schema for the workspace cluster`
	`179`	`+ // yet, or the schema lacks the Project type (APIBinding not established) —`
	`180`	`+ // both surface while the workspace is still being provisioned.`
	`181`	`+ return strings.Contains(low, "workspace initializing") \|\|`
	`182`	`+ strings.Contains(low, "cannot query field") \|\|`
	`183`	`+ strings.Contains(low, "unknown field")`
`174`	`184`	`}`
`175`	`185`
`176`	`186`	`func (s Server) listProjects(w http.ResponseWriter, r http.Request) {`
`@@ -297,7 +307,7 @@ func (s Server) cleanupCreatedProjectSetup(ctx context.Context, c asclient.Cli`
`297`	`307`	`_ = s.deleteProjectProviderResources(ctx, c, p, id)`
`298`	`308`	`if p.Spec.Repository != nil {`
`299`	`309`	`if ref := strings.TrimSpace(p.Spec.Repository.RepositoryRef); ref != "" {`
`300`		`- _ = c.Dynamic().Resource(codeRepositoriesGVR).Delete(ctx, ref, metav1.DeleteOptions{})`
	`310`	`+ _ = c.Resource(codeRepositoryResource, "").Delete(ctx, ref, metav1.DeleteOptions{})`
`301`	`311`	`}`
`302`	`312`	`}`
`303`	`313`	`if name := strings.TrimSpace(p.Name); name != "" {`
Original file line number	Diff line number	Diff line change
`@@ -89,7 +89,7 @@ func ensureProjectProviderResource(ctx context.Context, c asclient.Client, p a`
`89`	`89`	`if owner := projectProviderResourceOwnerRef(p); owner != nil {`
`90`	`90`	`want.SetOwnerReferences([]metav1.OwnerReference{*owner})`
`91`	`91`	`}`
`92`		`- res := c.Dynamic().Resource(gvr)`
	`92`	`+ res := c.Resource(providerBindingResource(gvr, binding.ResourceRef.Kind), "")`
`93`	`93`	`existing, err := res.Get(ctx, name, metav1.GetOptions{})`
`94`	`94`	`if apierrors.IsNotFound(err) {`
`95`	`95`	`return res.Create(ctx, want, metav1.CreateOptions{})`
`@@ -138,7 +138,7 @@ func (s Server) deleteProjectProviderResources(ctx context.Context, c asclient`
`138`	`138`	`}`
`139`	`139`	`runtimeNamespace := ""`
`140`	`140`	`if isSandboxRunnerBinding(binding) && s != nil && s.runtimeClient != nil {`
`141`		`- obj, err := c.Dynamic().Resource(gvr).Get(ctx, name, metav1.GetOptions{})`
	`141`	`+ obj, err := c.Resource(providerBindingResource(gvr, binding.ResourceRef.Kind), "").Get(ctx, name, metav1.GetOptions{})`
`142`	`142`	`if err != nil && !apierrors.IsNotFound(err) {`
`143`	`143`	`return err`
`144`	`144`	`}`
`@@ -149,7 +149,7 @@ func (s Server) deleteProjectProviderResources(ctx context.Context, c asclient`
`149`	`149`	`}`
`150`	`150`	`}`
`151`	`151`	`}`
`152`		`- err = c.Dynamic().Resource(gvr).Delete(ctx, name, metav1.DeleteOptions{})`
	`152`	`+ err = c.Resource(providerBindingResource(gvr, binding.ResourceRef.Kind), "").Delete(ctx, name, metav1.DeleteOptions{})`
`153`	`153`	`if err != nil && !apierrors.IsNotFound(err) {`
`154`	`154`	`return err`
`155`	`155`	`}`
`@@ -291,7 +291,7 @@ func projectProviderBindingStatus(ctx context.Context, c asclient.Client, p ai`
`291`	`291`	`status.Phase = "Invalid"`
`292`	`292`	`return status`
`293`	`293`	`}`
`294`		`- obj, err := c.Dynamic().Resource(gvr).Get(ctx, name, metav1.GetOptions{})`
	`294`	`+ obj, err := c.Resource(providerBindingResource(gvr, binding.ResourceRef.Kind), "").Get(ctx, name, metav1.GetOptions{})`
`295`	`295`	`if err != nil {`
`296`	`296`	`status.Phase = "Pending"`
`297`	`297`	`return status`