refactor: full-stack restructure with multi-tenancy, workspace management, and K8s diagnostics

- Add Workspace domain (entity, repository, service, handler, DTO)
- Add multi-tenant K8s client with tenant binding and quota management
- Add K8s diagnostics client (instance diagnostics)
- Add authorization middleware (authz package)
- Restructure frontend to feature-based architecture (features/)
- Add User Management page in configuration
- Add AccessDenied page and route guards
- Refactor shared components (form inputs, layout, UI)
- Update Tailwind config for new design system
- Add comprehensive documentation (docs/, tasks/, plans)
- Improve cluster service with better kubeconfig handling
- Add tests for crypto, config, helm client, tenant binding

backend/internal/domain/service/artifact_service.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"github.com/ocdp/cluster-service/internal/domain/entity"
 	"github.com/ocdp/cluster-service/internal/domain/repository"
+	"github.com/ocdp/cluster-service/internal/pkg/authz"
 )
 
 // ArtifactService Artifact 浏览领域服务
@@ -25,22 +26,22 @@ func NewArtifactService(
 
 // GetRegistry 获取 Registry 信息
 func (s *ArtifactService) GetRegistry(ctx context.Context, registryID string) (*entity.Registry, error) {
-	return s.registryRepo.GetByID(ctx, registryID)
+	return s.visibleRegistry(ctx, registryID)
 }
 
-// ListRepositories 列出 Registry 中的所有 repositories
-func (s *ArtifactService) ListRepositories(ctx context.Context, registryID string) ([]string, error) {
-	registry, err := s.registryRepo.GetByID(ctx, registryID)
+// ListRepositories 列出 Registry 中的 repositories
+func (s *ArtifactService) ListRepositories(ctx context.Context, registryID, artifactType string) ([]string, error) {
+	registry, err := s.visibleRegistry(ctx, registryID)
 	if err != nil {
 		return nil, entity.ErrRegistryNotFound
 	}
 
-	return s.ociClient.ListRepositories(ctx, registry)
+	return s.ociClient.ListRepositories(ctx, registry, artifactType)
 }
 
 // ListArtifacts 列出 repository 中的所有 artifacts
 func (s *ArtifactService) ListArtifacts(ctx context.Context, registryID, repository, mediaTypeFilter string) ([]*entity.Artifact, error) {
-	registry, err := s.registryRepo.GetByID(ctx, registryID)
+	registry, err := s.visibleRegistry(ctx, registryID)
 	if err != nil {
 		return nil, entity.ErrRegistryNotFound
 	}
@@ -50,7 +51,7 @@ func (s *ArtifactService) ListArtifacts(ctx context.Context, registryID, reposit
 
 // GetArtifact 获取 artifact 详情
 func (s *ArtifactService) GetArtifact(ctx context.Context, registryID, repository, reference string) (*entity.Artifact, error) {
-	registry, err := s.registryRepo.GetByID(ctx, registryID)
+	registry, err := s.visibleRegistry(ctx, registryID)
 	if err != nil {
 		return nil, entity.ErrRegistryNotFound
 	}
@@ -60,7 +61,7 @@ func (s *ArtifactService) GetArtifact(ctx context.Context, registryID, repositor
 
 // GetValuesSchema 获取 Helm Chart 的 values schema
 func (s *ArtifactService) GetValuesSchema(ctx context.Context, registryID, repository, reference string) (string, error) {
-	registry, err := s.registryRepo.GetByID(ctx, registryID)
+	registry, err := s.visibleRegistry(ctx, registryID)
 	if err != nil {
 		return "", entity.ErrRegistryNotFound
 	}
@@ -68,9 +69,19 @@ func (s *ArtifactService) GetValuesSchema(ctx context.Context, registryID, repos
 	return s.ociClient.GetValuesSchema(ctx, registry, repository, reference)
 }
 
+// GetValuesYAML 获取 Helm Chart 的原始 values.yaml
+func (s *ArtifactService) GetValuesYAML(ctx context.Context, registryID, repository, reference string) (string, error) {
+	registry, err := s.visibleRegistry(ctx, registryID)
+	if err != nil {
+		return "", entity.ErrRegistryNotFound
+	}
+
+	return s.ociClient.GetValuesYAML(ctx, registry, repository, reference)
+}
+
 // PullArtifact 下载 artifact
 func (s *ArtifactService) PullArtifact(ctx context.Context, registryID, repository, reference, destPath string) error {
-	registry, err := s.registryRepo.GetByID(ctx, registryID)
+	registry, err := s.visibleRegistry(ctx, registryID)
 	if err != nil {
 		return entity.ErrRegistryNotFound
 	}
@@ -78,3 +89,17 @@ func (s *ArtifactService) PullArtifact(ctx context.Context, registryID, reposito
 	return s.ociClient.PullArtifact(ctx, registry, repository, reference, destPath)
 }
 
+func (s *ArtifactService) visibleRegistry(ctx context.Context, registryID string) (*entity.Registry, error) {
+	principal, err := authz.RequirePrincipal(ctx)
+	if err != nil {
+		return nil, entity.ErrUnauthorized
+	}
+	registry, err := s.registryRepo.GetByID(ctx, registryID)
+	if err != nil {
+		return nil, entity.ErrRegistryNotFound
+	}
+	if !authz.CanReadResource(principal, registry.WorkspaceID, registry.OwnerID, registry.Visibility) {
+		return nil, entity.ErrRegistryNotFound
+	}
+	return registry, nil
+}