fix(apiserver): enforce self_ug job scopes and accept project filters (bug-1934, bug-1935)

bug-1934: every job-permission check read a single scope and compared it
only with "self", so a job:view or job:control grant scoped to self_ug acted
like "all" (list, get by ID, control), and self + self_ug collapsed to self.
userJobScope() now collects all of a user's grants of a job permission
before deduplication and adds them up (all; self; self_ug = the user and
everyone sharing a user group). The job list appends a submit_user filter
for narrower scopes, get-by-ID keeps covered rows in a new slice (removing
from the ranged slice skipped rows) and answers 403, both control paths
and job output check the owner against the scope. User groups now reach
the apiserver: the config push converts cluster_config_t.ugroups and
OnUserGroupsUpdated() replaces the new store (nested groups, all,
exclusions). The default basic_user now also sees its user-group mates'
jobs, as its configuration says.

bug-1935: project_name and license_project are accepted job filters, so
xcecli jobs list -P works.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.wolf/bugs/bug-1934.md

@@ -50,6 +50,13 @@ config promises. Other job permissions using the same single-grant lookup
 were not checked yet.
 **Found by:** review, during `/kiro-spec-requirements project-config`
 (2026-10-10, RBAC survey for project-scoped job permissions).
+UPDATE (2026-10-10): confirmed by the new tests in
+`src/frontend/apiserver/controllers/job_scope_test.go` against the unfixed
+handlers: with only `self_ug` grants, alice listed carol's job
+(`submit_user carol: rows [..907], want []`), read it by ID (200), and
+killed it (`Job control <kill> accepted`, dispatched). `job:control` is
+affected as well as `job:view`. A user holding `self` and `self_ug` together
+got `self` only (the second scope was dropped).
 
 ## Environment
 - OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
@@ -71,15 +78,64 @@ were not checked yet.
 - Evidence: the code lines quoted in Description; no logs.
 
 ## Root cause
-TODO: required for fixed/partial
-
+Three defects in `src/frontend/apiserver`:
+- Every job-permission check read one scope: `GetRequireResourcePermission()`
+  (`controllers/rbac_check.go`) returns the first grant of the permission,
+  and `DeduplicatePermissions()` keeps one entry per permission name, so a
+  `self` + `self_ug` grant became one scope.
+- The checks compared that scope only with `self`
+  (`controllers/jobs.go` job list ~178/187, by-ID ~762, both control paths
+  ~2190 and ~2457; `output.go` compared with `all`), so any other scope,
+  `self_ug` included, fell through as unrestricted in the list, by-ID and
+  control paths.
+- The apiserver had no user-group data: `handleConfigPush()`
+  (`backend/clib.go`) ignored `cluster_config_t.ugroups`, so `self_ug` could
+  not have been resolved anyway.
+Also in the by-ID path: rows were removed from the slice being ranged over,
+which skipped the row after each removal.
+Since: pre-existing; `self_ug` was added as a job scope without enforcement
+(origin not bisected).
 ## Fix
-TODO: required for fixed/partial
-
+- `controllers/job_scope.go` (new): `userJobScope()` collects every grant
+  of a job permission before deduplication (`collectUserPermissionsWithType()`,
+  split out of `GetUserAllPermissionsWithType()` in `rbac_check.go`) and adds
+  them up: `all` covers every job, `self` the user's own, `self_ug` the user
+  and everyone sharing a user group with them; other scope types cover
+  nothing. `covers(owner)` and `ownerFilter()` (a `submit_user in/notin`
+  condition for job queries) apply it.
+- `controllers/jobs.go`: the job list appends the owner filter for narrower
+  scopes (a `submit_user` the scope does not cover now yields no rows); the
+  by-ID path keeps covered rows in a new slice and answers 403 (was 500)
+  when nothing is visible; both control paths reject an uncovered job with
+  403. `controllers/output.go`: the owner may always read; others need a
+  covering `job:view` grant.
+- `store/usergroups.go` (new) holds the user groups and resolves membership
+  (users, nested groups, `all`, exclusions, cycle-safe);
+  `models/usergroups.go` (new) the model; `backend`: `cClusterConfUserGroups()`
+  converts `cluster_config_t.ugroups`, and `handleConfigPush()` calls the new
+  `NotificationHandler.OnUserGroupsUpdated()`, which replaces the store.
+- Behaviour change: the default `basic_user` (`job:view` with `self` and
+  `self_ug`) now also sees the jobs of users sharing a user group with them,
+  as its configuration says; before, it saw only its own.
 ## Verification
-- Test: TODO: name + file; RED before the fix, GREEN after
-- Suites: TODO: suite results and build profile
-- Live: TODO: soak/deploy run, or n/a and why
+- Test: `src/frontend/apiserver/controllers/job_scope_test.go`:
+  `TestJobScope_SelfUGListCoversGroupOnly`, `TestJobScope_SelfUGGetByID`,
+  `TestJobScope_SelfUGControl`, `TestJobScope_SelfUGOutput`,
+  `TestJobScope_GrantsAddUp`: all RED before the fix (carol's job listed, read,
+  killed; group mates' output refused; self+self_ug collapsed to self), GREEN
+  after. `store/usergroups_test.go` `TestUserGroups_Membership` and
+  `backend/handler_test.go` `TestOnUserGroupsUpdated_ReplacesUserGroups`
+  (new code; RED as undefined symbols before).
+- Suites: `xce-build.sh apiserver asan xce.build --incremental`: apiserver Go
+  packages (store, utils, controllers, backend, backend/auth) and all xcecli
+  packages ok; cgo `xce_apiserver` built; meson `apiserver` suite 1/1 OK;
+  2026-10-10.
+- Live: n/a: handler-level tests drive the real gin handlers, RBAC loading
+  and stores; the only untested seam is the cgo conversion of
+  `cluster_config_t.ugroups`, which compiled into `xce_apiserver`; not run
+  against a live controller.
 
 ## References
-- Related: none
+- Related: bug-1935 (same session, same files)
+- Spec: `.kiro/specs/project-config/requirements.md` Requirement 8 (project
+  job scope builds on `userJobScope()`)

.wolf/bugs/bug-1935.md

@@ -10,7 +10,7 @@ last_seen: "2026-10-10T04:31:27Z"
 occurrences: 1
 files: ["src/frontend/apiserver/models/jobs.go", "src/frontend/apiserver/controllers/jobs.go", "src/frontend/xcecli/filters/job_filter.go"]
 tags: ["apiserver", "xcecli", "filter", "project"]
-related: []
+related: ["bug-1934"]
 ---
 
 # bug-1935: xcecli jobs list -P <project> fails: apiserver rejects project_name filter (unsupported filter)
@@ -36,6 +36,9 @@ project is `eng`.
 project. No data is affected.
 **Found by:** review, during `/kiro-spec-requirements project-config`
 (2026-10-10); `project-config` Requirement 7.5 needs this filter.
+UPDATE (2026-10-10): confirmed by `TestJobHandler_ProjectFilters`
+(`src/frontend/apiserver/controllers/job_scope_test.go`) before the fix:
+`status = 400 ... unsupported filter: project_name`.
 
 ## Environment
 - OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
@@ -55,15 +58,28 @@ project. No data is affected.
 - Evidence: the code lines quoted in Description; no logs.
 
 ## Root cause
-TODO: required for fixed/partial
-
+`JOB_SUPPORT_FILTERS` (`src/frontend/apiserver/models/jobs.go`) had
+`project_name` and `license_project` commented out, and
+`validateJobQueryFilters()` (`controllers/jobs.go`) rejects every field not on
+that list, while `xcecli` (`filters/job_filter.go:108-113`) sends exactly
+those fields for `-P` and the license-project option. The job store already
+carries both fields (`JobInfo.ProjectName`, `LicenseProject`). Since:
+pre-existing, origin unknown.
 ## Fix
-TODO: required for fixed/partial
-
+`models/jobs.go`: `project_name` and `license_project` are now in
+`JOB_SUPPORT_FILTERS`. No other change was needed: the store query filters
+by the JSON field name. `ARRAY_JOB_SUPPORT_FILTERS` (array statistics) is
+unchanged.
 ## Verification
-- Test: TODO: name + file; RED before the fix, GREEN after
-- Suites: TODO: suite results and build profile
-- Live: TODO: soak/deploy run, or n/a and why
+- Test: `TestJobHandler_ProjectFilters`
+  (`src/frontend/apiserver/controllers/job_scope_test.go`): RED before (400
+  unsupported filter), GREEN after (`{project_name:eq:eng}` and
+  `{license_project:eq:lic2}` select only the matching job).
+- Suites: same run as bug-1934: apiserver and xcecli Go tests ok, meson
+  `apiserver` suite 1/1 OK, asan, 2026-10-10.
+- Live: n/a: the change is a filter whitelist entry exercised through the
+  real handler and store in the test.
 
 ## References
-- Related: none
+- Related: bug-1934
+- Spec: `.kiro/specs/project-config/requirements.md` Requirement 7.5