feat(ui): support advanced proxy cache configurations in UI

[stonezdj]

• Support repository filter configuration (pattern and kind) for proxy cache projects.
• Ensure the local on not found and proxy referrer API checkbox editability is controlled by project configuration update permissions.

Thank you for contributing to Harbor!

Comprehensive Summary of your change

Issue being fixed

Fixes #(issue)

Please indicate you've done the following:

• Well Written Title and Summary of the PR
• Label the PR as needed. "release-note/ignore-for-release, release-note/new-feature, release-note/update, release-note/enhancement, release-note/community, release-note/breaking-change, release-note/docs, release-note/infra, release-note/deprecation"
• Accepted the DCO. Commits without the DCO will delay acceptance.
• Made sure tests are passing and test coverage is added if needed.
• Considered the docs impact and opened a new docs issue or PR with docs changes if needed in website repository.

[wy65701436]

cc @bupd and @Vad1mo could you please help to review?

[Copilot]

Pull request overview

Adds UI controls and localization for proxy-cache repository filters and permission-aware proxy settings.

Changes:

• Adds repository filter pattern/kind controls.
• Serializes filter metadata during project creation and updates.
• Updates proxy-cache permissions, layout, models, and translations.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/portal/src/i18n/lang/zh-tw-lang.json	Adds Traditional Chinese filter strings.
src/portal/src/i18n/lang/zh-cn-lang.json	Adds Simplified Chinese filter strings.
src/portal/src/i18n/lang/tr-tr-lang.json	Adds Turkish filter strings.
src/portal/src/i18n/lang/ru-ru-lang.json	Adds Russian filter strings.
src/portal/src/i18n/lang/pt-br-lang.json	Adds Brazilian Portuguese filter strings.
src/portal/src/i18n/lang/ko-kr-lang.json	Adds Korean filter strings.
src/portal/src/i18n/lang/fr-fr-lang.json	Adds French filter strings.
src/portal/src/i18n/lang/es-es-lang.json	Adds Spanish filter strings.
src/portal/src/i18n/lang/en-us-lang.json	Adds English filter strings.
src/portal/src/i18n/lang/de-de-lang.json	Adds German filter strings.
src/portal/src/app/shared/services/project.service.ts	Serializes filter metadata on updates.
src/portal/src/app/base/project/project.ts	Extends project metadata and filter constants.
src/portal/src/app/base/project/project-config/project-policy-config/project.ts	Extends configuration metadata types.
src/portal/src/app/base/project/project-config/project-policy-config/project-policy-config.component.ts	Loads filter settings and updates permissions.
src/portal/src/app/base/project/project-config/project-policy-config/project-policy-config.component.scss	Adds filter-control styling.
src/portal/src/app/base/project/project-config/project-policy-config/project-policy-config.component.html	Adds filter controls and checkbox permission handling.
src/portal/src/app/base/left-side-nav/projects/create-project/create-project.component.ts	Includes filters in project creation.
src/portal/src/app/base/left-side-nav/projects/create-project/create-project.component.html	Adds creation-form filter controls.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

❌ Patch coverage is 45.05495% with 50 lines in your changes missing coverage. Please review.
✅ Project coverage is 66.42%. Comparing base (6e82764) to head (402bf76).

Files with missing lines	Patch %	Lines
...rojects/create-project/create-project.component.ts	29.16%	12 Missing and 5 partials ⚠️
.../portal/src/app/shared/services/project.service.ts	0.00%	17 Missing ⚠️
...t-policy-config/project-policy-config.component.ts	36.00%	16 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #23536   +/-   ##
=======================================
  Coverage   66.41%   66.42%           
=======================================
  Files        1077     1078    +1     
  Lines      118037   118112   +75     
  Branches     2965     2985   +20     
=======================================
+ Hits        78392    78452   +60     
- Misses      35334    35352   +18     
+ Partials     4311     4308    -3     

Flag	Coverage Δ
unittests	66.42% <45.05%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/portal/src/app/base/project/project.ts	100.00% <100.00%> (ø)
...tal/src/app/shared/units/repository-filter.util.ts	100.00% <100.00%> (ø)
...t-policy-config/project-policy-config.component.ts	50.84% <36.00%> (-2.83%)	⬇️
...rojects/create-project/create-project.component.ts	45.19% <29.16%> (-1.60%)	⬇️
.../portal/src/app/shared/services/project.service.ts	3.38% <0.00%> (-0.62%)	⬇️

... and 6 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Vad1mo]

Comparing this against the merged proposal (goharbor/community#280) and the backend implementation (#23527), a few deviations:

1. Client-side validation is missing

The proposal's UI section requires: "Validation should happen both client-side and server-side."

Neither the filter input in create-project.component.html nor the one in project-policy-config.component.html has any validator — an invalid pattern is only caught by the server's 400 on save. At minimum the regex kind can be validated client-side (try { new RegExp(pattern) }), and a doublestar pattern can be checked for balanced brackets/braces.

2. Tooltip describes anchoring semantics the backend doesn't have

REPOSITORY_FILTER_TOOLTIP (all 10 locales) says "regular expression patterns are head-anchored". The backend (#23527) requires the pattern to match the entire repository path, and the proposal says regex is "always auto-anchored". A user following this tooltip writes ^library/ and matches nothing. The tooltip should say the pattern must match the full repository path, e.g. ^library/.*.

3. allowUpdateProxyCacheConfiguration binding is dead

The proxy cache checkbox changes from hardcoded disabled to [disabled]="!allowUpdateProxyCacheConfiguration", but this PR removes the only assignment to that field. It's initialized to false (project-policy-config.component.ts:116) and never set, so the checkbox is still permanently disabled — the dynamic-looking binding just obscures that. Either restore an assignment or keep the hardcoded disabled.

Related: sibling controls in the same section now gate on three different signals — the filter input/select on hasChangeConfigRole, the enable checkbox on the dead allowUpdateProxyCacheConfiguration, and section visibility on isSystemAdmin (previously hasChangeConfigRole). The isSystemAdmin switch also changes who can see the proxy cache section, which the proposal doesn't cover.

4. Dead component state

repositoryFilterPattern/repositoryFilterKind are declared and populated in retrieve(), but the template binds projectPolicy.ProxyCacheFilterPattern/ProxyCacheFilterKind — the two fields are never read and can be removed.

5. Scope beyond the proposal

The proposal's UI section only asks for the Repository filter (label, kind selector, pattern input) in the create view. This PR additionally reworks the referrer API checkbox layout and permission gating, switches the proxy-cache section gating to isSystemAdmin, and adds a read-only filter display for non-admin members. These may be worthwhile, but they're not spec-driven — worth calling out in the PR description (the current second bullet covers only part of this) or splitting out.

Minor: updateProjectPolicy in project.service.ts now sends proxy_cache_filter_pattern/proxy_cache_filter_kind on every project update, including non-proxy projects (empty string + doublestar in the else branch). The backend ignores them for non-proxy projects on this endpoint, but sending them unconditionally relies on that. Also: REPOSITORY_FILTER_KIND_* constants are defined in base/project/project.ts and used in create-project, while this component and the service hardcode 'doublestar' — one or the other.

[Vad1mo]

behavior changes for existing users:

1. Project admins/maintainers lose visibility of the proxy cache config. On main, the proxy-cache checkbox block and the endpoint/bandwidth/connection-limit block are gated on hasChangeConfigRole (template lines 19, 36), so project-level admins see them (read-only). The PR regates both to isSystemAdmin. A non-sysadmin project admin now sees nothing about proxy cache except the new read-only filter row, and that only when a filter is actually set.
2. Referrer API becomes editable after project creation. On main the checkbox is [disabled]="!allowUpdateProxyCacheConfiguration", and that flag is provably always false in this view: it's hasChangeConfigRole && !isProxyCacheProject, and isProxyCacheProject is true whenever the project has a registry_id (project-config.component.ts:50-52) — which is exactly when the section renders. So no one could change it post-creation. The PR rebinds it to !hasChangeConfigRole, making it mutable by sysadmins. This is the PR body's stated intent, but it flips a previously-immutable setting to mutable. Side note: the same PR-body claim about local-on-not-found is a no-op — that checkbox is already gated by !hasChangeConfigRole on main (line 164).

[wy65701436]

can you give a screenshot for this change?

[bupd]

@wy65701436 @stonezdj

I dont know what makes this review a low quality one

[bupd]

The UI Unit Tests are clearly failing and its the authors duty to fix and make sure ci is passing

[bupd]

@stonezdj Thanks for your contribution

suggestion: Please fix the lint issues given below

08:05:18 + npm run lint
08:05:18
08:05:18 > harbor@2.15.0 lint
08:05:18 > ng lint
08:05:18
08:05:19
08:05:19 Linting "harbor-portal"...
08:05:32
08:05:32 /home/ubuntu/_work/harbor/harbor/src/github.com/goharbor/harbor/src/portal/src/app/base/left-side-nav/projects/create-project/create-project.component.html
08:05:32 214:35 error Replace `·class="clr-control-label·endpoint·required">{{` with `⏎································class="clr-control-label·endpoint·required"` prettier/prettier
08:05:32 215:33 error Replace `'PROJECT.ENDPOINT'·|·translate` with `>{{·'PROJECT.ENDPOINT'·|·translate·}}</label` prettier/prettier
08:05:32 216:29 error Delete `}}</label` prettier/prettier
08:05:32
08:05:32 /home/ubuntu/_work/harbor/harbor/src/github.com/goharbor/harbor/src/portal/src/app/base/left-side-nav/projects/create-project/create-project.component.ts
08:05:32 401:54 error Delete `⏎················` prettier/prettier
08:05:32
08:05:32 ✖ 4 problems (4 errors, 0 warnings)
08:05:32 4 errors and 0 warnings potentially fixable with the `--fix` option.
08:05:32
08:05:32 Lint errors found in the listed files.
08:05:32 
Error: Process completed with exit code 1.

fixing lint might probably fix failing ci workflow https://github.com/goharbor/harbor/actions/runs/29078451168/job/86315411475

[wy65701436]

@wy65701436 @stonezdj

I dont know what makes this review a low quality one

I'm not sure who added the comments, cc @Vad1mo and @stonezdj do you have any idea?
And I agree that the CI must be passed.

[stonezdj]

@wy65701436 @stonezdj
I dont know what makes this review a low quality one

I'm not sure who added the comments, cc @Vad1mo and @stonezdj do you have any idea? And I agree that the CI must be passed.

This PR is currently a work in progress, so errors are bound to happen. Outside of open source, I have other full-time commitments. This is an open and inclusive community, so please keep comments respectful and constructive! @wy65701436 @bupd @Vad1mo

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[wy65701436]

cc @AllForNothing could you please help to review?thanks.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.

Suppressed comments (4)

src/portal/src/app/shared/services/project.service.ts:188

• The update path has the same contract gap: ProjectMetadata in api/v2.0/swagger.yaml:7480-7535 does not declare either filter property, and the backend has no corresponding metadata constants or handling. The PUT request therefore discards these values, so saving appears successful but reloading loses the filter.

            metadata.proxy_cache_filter_pattern =
                projectPolicy.ProxyCacheFilterPattern;
            metadata.proxy_cache_filter_kind =
                projectPolicy.ProxyCacheFilterKind || 'doublestar';

src/portal/src/app/base/left-side-nav/projects/create-project/create-project.component.ts:475

• These fields are not part of the server's ProjectMetadata contract (api/v2.0/swagger.yaml:7480-7535) or its project metadata constants/handlers, so the generated Go request model drops both JSON properties and the new filter is never persisted on project creation. Add the repository-filter fields and validation/consumption to the API and backend before sending them from the UI.

            metadata.proxy_cache_filter_pattern =
                this.project.metadata.proxy_cache_filter_pattern;
            metadata.proxy_cache_filter_kind =
                this.project.metadata.proxy_cache_filter_kind ||
                REPOSITORY_FILTER_KIND_DOUBLESTAR;

src/portal/src/app/base/project/project-config/project-policy-config/project-policy-config.component.html:212

• This system-admin guard still hides both checkboxes from project admins even though project admins have configuration:update permission (src/common/rbac/project/rbac_role.go:25,71-72). That contradicts the intended permission-based editability: users with hasChangeConfigRole cannot see or edit the controls. Show this block for proxy-cache projects and let each control's existing [disabled]="!hasChangeConfigRole" enforce editability.

        } @if (isSystemAdmin && projectPolicy.ProxyCacheEnabled) {

src/portal/src/app/base/left-side-nav/projects/create-project/create-project.component.ts:438

• Repository-filter validation runs even when proxy cache is disabled. If a user enters an invalid filter and then turns proxy cache off, the hidden value/error remain; isValid keeps the OK button disabled, and this unconditional check would also reject submission. Gate this validation on enableProxyCache and clear the error when proxy cache is turned off so a normal project can still be created.

        this.validateRepositoryFilter();
        if (this.repositoryFilterError) {
            this.inlineAlert.showInlineError(this.repositoryFilterError);
            return;
        }

[Copilot]

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated no new comments.

Suppressed comments (4)

src/portal/src/app/shared/services/project.service.ts:188

• The update payload cannot persist either filter field: ProjectMetadata in api/v2.0/swagger.yaml has no matching properties, and the backend has no metadata constants/handling for these keys, so unmarshalling the typed request drops them. The request can report success while a reload loses the filter. Backend/API support and generated models need to be added with this UI change.

            metadata.proxy_cache_filter_pattern =
                projectPolicy.ProxyCacheFilterPattern;
            metadata.proxy_cache_filter_kind =
                projectPolicy.ProxyCacheFilterKind || 'doublestar';

src/portal/src/app/base/left-side-nav/projects/create-project/create-project.component.ts:436

• The create flow sends metadata keys that the current ProjectMetadata API schema/backend does not define, so they are discarded when the request is unmarshalled and the newly created project has no repository filter. Add the backend/API contract and generated model support before submitting these fields.

            metadata.proxy_cache_filter_pattern =
                this.project.metadata.proxy_cache_filter_pattern;
            metadata.proxy_cache_filter_kind =
                this.project.metadata.proxy_cache_filter_kind ||
                REPOSITORY_FILTER_KIND_DOUBLESTAR;

src/portal/src/app/base/left-side-nav/projects/create-project/create-project.component.ts:399

• Repository-filter validation runs even after proxy cache is turned off. If a user enters an invalid pattern and then disables proxy cache, the hidden field leaves repositoryFilterError set, the OK button remains disabled, and the user cannot create a normal project without re-enabling proxy cache to repair the hidden value. Validate/count this error only when enableProxyCache is true, or clear it when the toggle is disabled.

        this.validateRepositoryFilter();
        if (this.repositoryFilterError) {
            this.inlineAlert.showInlineError(this.repositoryFilterError);
            return;
        }

src/portal/src/app/base/project/project-config/project-policy-config/project-policy-config.component.html:212

• This system-admin guard prevents project users who have configuration UPDATE permission from ever reaching either checkbox, so their editability is still determined by the global role rather than hasChangeConfigRole. Show this block for proxy-cache projects and let the existing [disabled]="!hasChangeConfigRole" bindings enforce the permission.

        } @if (isSystemAdmin && projectPolicy.ProxyCacheEnabled) {

[chlins]

lgtm

[wy65701436]

lgtm

[Copilot]

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated no new comments.

Suppressed comments (5)

src/portal/src/app/base/left-side-nav/projects/create-project/create-project.component.ts:436

• These metadata keys are not part of the ProjectMetadata API model (api/v2.0/swagger.yaml:7480-7535) or the server metadata keys (src/pkg/project/models/pro_meta.go:18-31). The generated request decoder therefore drops them, so creating a project appears successful but the repository filter is never persisted or enforced. Add the API/server-side model, persistence, validation, and proxy behavior (or make this PR depend on the backend change) before sending these fields.

            metadata.proxy_cache_filter_pattern =
                this.project.metadata.proxy_cache_filter_pattern;
            metadata.proxy_cache_filter_kind =
                this.project.metadata.proxy_cache_filter_kind ||
                REPOSITORY_FILTER_KIND_DOUBLESTAR;

src/portal/src/app/shared/services/project.service.ts:188

• The update path has the same contract gap as creation: proxy_cache_filter_pattern and proxy_cache_filter_kind are absent from ProjectMetadata in api/v2.0/swagger.yaml:7480-7535 and from the server metadata definitions, so the backend cannot deserialize or return these values. Updating the UI will report success without persisting the filter until the API and backend are extended.

            metadata.proxy_cache_filter_pattern =
                projectPolicy.ProxyCacheFilterPattern;
            metadata.proxy_cache_filter_kind =
                projectPolicy.ProxyCacheFilterKind || 'doublestar';

src/portal/src/app/base/project/project-config/project-policy-config/project-policy-config.component.html:212

• This system-admin guard prevents project admins who have the project configuration update permission from seeing either checkbox, so their editability is still not controlled solely by hasChangeConfigRole as intended. Show this block for proxy-cache projects and retain the existing [disabled]="!hasChangeConfigRole" checks to enforce edit permission.

        } @if (isSystemAdmin && projectPolicy.ProxyCacheEnabled) {

src/portal/src/app/base/left-side-nav/projects/create-project/create-project.component.ts:399

• The repository-filter controls are only hidden with CSS when proxy cache is toggled off, so an invalid pattern remains in the model. This unconditional validation blocks creating an ordinary project, while repositoryFilterError also keeps the OK button disabled. Gate both this validation and the isValid error check on enableProxyCache, or clear the filter error when proxy cache is disabled.

        this.validateRepositoryFilter();
        if (this.repositoryFilterError) {
            this.inlineAlert.showInlineError(this.repositoryFilterError);
            return;
        }

src/portal/src/app/shared/units/repository-filter.util.ts:32

• Balanced brackets/braces are not sufficient doublestar validation. For example, [] (currently asserted as valid in the new test) and a trailing backslash pass this function, but github.com/bmatcuk/doublestar v1.3.4 treats them as malformed patterns. Validate against the backend's full doublestar grammar so the UI does not accept filters that later fail matching.

    } else if (kind === 'doublestar') {
        if (!checkBalancedChars(pattern)) {
            return 'PROJECT.REPOSITORY_FILTER_DOUBLESTAR_INVALID';
        }

Dismiss the request change since the CI is passed now. Bupd, feel free to reach out to me if any concern.