feat: enforce filterRules restrictions on workspace create and update

[Snehadas2005]

This PR implements server-side enforcement of WorkspaceKind.spec.filterRules[] restrictions during Workspace creation (POST /workspaces) and update (PUT /workspaces/:name). Even if the frontend UI restricts or disables invalid options, the backend independently validates selected imageConfig and podConfig options against defined filter rules using the workspace's target namespace context to prevent direct API misuse.

Specifically:

• On Workspace create: Evaluates filterRules for both selected imageConfig and podConfig options using the target namespace context.
• On Workspace update: Only re-evaluates filterRules if imageConfig and/or podConfig are actually modified. This prevents existing workloads from breaking on unrelated workspace updates (e.g. updating labels/display name) when an administrator adds a new deny rule post-creation.
• Deny error response: Rejects invalid requests with HTTP 422 Unprocessable Entity containing the matched filter rule's denyMessage.text within cause.validation_errors[].

Key Changes

1. Workspace Repository (internal/repositories/workspaces/repo.go)

   • enforceFilterRuleRestrictions: Helper function that retrieves the referenced WorkspaceKind, resolves target namespace labels via resolveNamespaceLabels, and invokes the shared filterrules.Evaluate() engine for the selected imageConfig and podConfig.
   • CreateWorkspace: Invokes enforceFilterRuleRestrictions upfront before creating the Kubernetes resource.
   • UpdateWorkspace: Checks if newOptions.ImageConfig != currentOptions.ImageConfig or newOptions.PodConfig != currentOptions.PodConfig before validating, ensuring unchanged options are not re-checked.
   • Error Surface: Uses helper.NewInternalValidationError(filterErrs) to map denied options directly into the existing cause.validation_errors[] field error structure without requiring changes to the handler layer (workspaces_handler.go).

2. Unit & Integration Tests (api/workspaces_handler_test.go)
   Added an Ordered test context Enforcing filterRule restrictions on Workspace create/update covering:

   • Create rejection (imageConfig): Workspace create fails when selected imageConfig matches a deny rule.
   • Create rejection (podConfig): Workspace create fails when selected podConfig matches a deny rule.
   • Create success: Workspace create succeeds when all options are allowed.
   • Update rejection: Workspace update fails when changing to a restricted imageConfig.
   • Update success: Workspace update succeeds when options remain unchanged.

Verification

• Static Analysis & Linting: Ran go vet ./... and go fmt ./... across the backend with 0 errors/warnings.
• Build Verification: Verified binary compilation using go build ./cmd/main.go.
• Unit Tests: Verified all Ginkgo + envtest specifications pass via make test.

Notes for Reviewers

• The issue specifies returning HTTP 403 or 422. This implementation uses 422 Unprocessable Entity as it seamlessly reuses the existing InternalValidationError → failedValidationResponse pipeline already established for PVC/Secret mountability validation.

closes: #1206
related: #682

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign andyatmiami for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• workspaces/backend/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment