fix(repository): validate request remotes before cache access (BUG-001)

[sbalabanov]

Summary

• Require every repository to define a trusted repository_id that uniquely identifies it across Tango installations.
• Reject client remotes that do not exactly match a configured repository before cache or workspace access, and include the offending remote in mismatch errors.
• Use repository_id consistently for metric labels, cache-key namespaces, origin clones, and worker directories.

BUG-001 use case

With remote: "https://github.com/uber/tango.git" and repository_id: "tango", a client request for ../../outside does not match the configured remote and is rejected before any cache lookup or workspace lease. Valid requests use the configured tango namespace instead of deriving paths or cache keys from client input.

Test Plan

• go test -count=1 ./config ./internal/url ./controller ./core/repomanager ./orchestrator
• ./tools/bazel test //config:config_test //internal/url:url_test //controller:controller_test //core/repomanager:repomanager_test //orchestrator:orchestrator_test --nocache_test_results --test_output=errors
• aifx verify --timeout 15 --overall-timeout 30

Revert Plan

Revert the commit.

Issues

T3-BUG-001

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[sbalabanov]

make a PR description relevant to the diff between the latest change and a base revision. Simplify wording. Include use case example showing the bug.

[sbalabanov]

Updated the PR description for the current diff in 2f5946b. It now uses simpler wording and includes a concrete example where GitHub and GitLab remotes with the same repository path previously collided in cache and workspace namespaces.

[addressed by agent]

[sbalabanov]

Updated the PR description for the current diff against main and added a concrete BUG-001 example showing an unconfigured relative remote being rejected before cache or workspace access. Final SHA: 2f5946b.

[addressed by agent]

[sbalabanov]

Refactor and simplify implementation. Do not validate configuration remotes. Before making a cache request, validate that remote from the client matches one of the configured remotes. For metrics, infer a safe readable name from the full remote name. For folder / cache key names, use a format of safely inferred name + digest of important parts. Such repository configuration could be made when configuration is loaded so we do not infer these settings on each request.

[sbalabanov]

Addressed in b80d64c. Configuration loading now accepts remote syntax as-is and precomputes a bounded readable metric label plus a safe readable-name-and-digest namespace. Controller, orchestrator, and repository manager exact-match client remotes before cache or workspace access and reuse those precomputed values; credentials, query/fragment data, and unsafe path characters are excluded from derived identities.

[addressed by agent]

[sbalabanov]

Make repositoryID a part of repository configuration. Assume it is always safe for metrics and filesystem and cache keys. Use it in all of them. Make it a mandatory configuration value.
Check if similar configuration setting exists first, if it does, just reply with a comment and do not do changes.

[sbalabanov]

Update PR description according to latest change vs base revision. Do not account for the history of changes in this PR.

[sbalabanov]

Addressed review 5055212559 in 56e7da4. I searched the configuration schema and repository identity code and found no existing equivalent ID setting. Each repository now requires an operator-provided repository_id, exact client remotes are allowlisted before cache or workspace access, and the configured ID is used for metrics, cache keys, origin clones, and worker directories; URL inference and hashing were removed.

[addressed by agent]

[sbalabanov]

Updated the PR description for final SHA 56e7da4 using only the current diff against main. It now concisely describes the mandatory repository_id, exact remote allowlisting, namespace usage, and a concrete BUG-001 request for ../../outside that is rejected before cache or workspace access.

[addressed by agent]

[sbalabanov]

Updated the PR description for final SHA fb80317 using only the current diff against main. It now describes the mandatory repository_id, exact remote allowlisting, raw remote mismatch diagnostics, namespace usage, and a concrete BUG-001 request rejected before cache or workspace access.

[addressed by agent]