feat: enforce authorization on CreateExperiment and CreateRegisteredModel

[remidebette]

Summary

Resurrects @nitaibezerra's original work from #195/#202, rebased onto current main and made workspace-aware.

Currently any authenticated user can create experiments and registered models regardless of DEFAULT_MLFLOW_PERMISSION or group/regex permissions — there's no before-request validator on CreateExperiment/CreateRegisteredModel, only an after-request handler that grants MANAGE to the creator after the resource already exists.

This PR adds opt-in creation enforcement gated by a new RESTRICT_RESOURCE_CREATION config flag (default: false), so existing deployments see no behaviour change unless they enable it.

Fixes #202.

Changes

Three rebased commits from @nitaibezerra plus one workspace-correctness fix:

1. fix: enforce authorization on CreateExperiment and CreateRegisteredModel — adds validate_can_create_experiment and validate_can_create_registered_model validators wired into BEFORE_REQUEST_HANDLERS. Resolves permission by resource name (the resource ID doesn't exist yet at creation time) using regex/group-regex sources only.
2. feat: add RESTRICT_RESOURCE_CREATION flag for backward compatibility — gates the new validators behind an opt-in config flag (default false).
3. docs: add resource creation authorization documentation — documents the flag and the resolution order.
4. fix(auth): respect workspace permissions for resource creation (new in this rebase) — extracts the existing workspace-fallback logic from resolve_permission into a small helper and applies it on the creation paths. Without this, with MLFLOW_ENABLE_WORKSPACES=true a user with no workspace permission would fall through to DEFAULT_MLFLOW_PERMISSION and could still create resources.

Behaviour

When RESTRICT_RESOURCE_CREATION=false (default): no change — anyone authenticated can create.

When RESTRICT_RESOURCE_CREATION=true:

Scenario	Result
User has matching regex / group-regex granting EDIT+ on the requested name	Allow
Workspaces disabled, no regex match	Falls back to DEFAULT_MLFLOW_PERMISSION
Workspaces enabled, no regex match, user has EDIT+ on request workspace	Allow
Workspaces enabled, no regex match, no workspace permission	Deny

Test plan

• pytest mlflow_oidc_auth/tests/validators/test_experiment.py mlflow_oidc_auth/tests/validators/test_registered_model.py mlflow_oidc_auth/tests/hooks/test_before_request.py mlflow_oidc_auth/tests/utils/test_permissions.py — 158/158 passing locally
• New tests cover: regex match, regex miss with workspaces enabled and a workspace permission, regex miss with workspaces enabled and no workspace permission (deny), regex miss with workspaces disabled
• Maintainer review

Notes

@nitaibezerra is preserved as the original author on commits 1-3. Happy to squash on merge if maintainers prefer a single-commit PR — let me know.

🤖 Generated with Claude Code

[remidebette]

I just noticed #245 after rebasing

The spirit behind this PR and the past one was that - pre-workspace - any experiment creation was allowed (as a bug), even the ones which subsequent access was being forbidden by a regex.
For example in my case of project based prefix <project>/<exp name> some people would be allowed some project prefix but not all.
So that if users did typos in the project name, they ended up creating experiments they would not be able to access.

This gets restricted by this PR, in the sense that a user needs experiment EDIT access to be able to create such an exp.

The issue is that with #245 and post-workspace, the responsibility of creating exps is not in the exps access rights anymore but in the workspace access rights (and should be Workspace MANAGE as per https://mlflow-oidc.github.io/mlflow-oidc-auth/#/workspaces?id=workspace-permissions

I was trying to see how to adapt the current non-workspace code for workspaces, but it seems irrelevant now.

Should we still plan on merging for the bug in: MLFLOW_ENABLE_WORKSPACES=false @kharkevich, or would you rather encourage users to switch to workspaces instead ?