feat(provider): implement scoped provider name uniqueness

Allow multiple users to create providers with the same visible name by
storing them with an owner-prefixed DB key ({owner}/{name}). Resolution
uses two-pass lookup: try owned first, fall back to shared.

Key changes:
- ownership.rs: scoped_name, display_name, owner_prefix,
  scoped_name_for_principal, resolve_scoped_name helpers + unit tests
- provider.rs: create stamps scoped key, get/update/delete resolve via
  two-pass, list filters by owner, responses strip prefix
- sandbox.rs: spec.providers stores DB keys, attach/detach resolve
  user-visible names, all response paths strip prefixes

Zero DB migration required — existing partial unique index on
(object_type, name) already supports scoped keys.

Closes: rossoctl/rossoctl#1996

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Paolo Dettori <dettori@us.ibm.com>

Author: pdettori

crates/openshell-server/src/auth/ownership.rs

@@ -166,6 +166,109 @@ fn is_valid_label_value(value: &str) -> bool {
         .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.')
 }
 
+// ---------------------------------------------------------------------------
+// Scoped name helpers
+// ---------------------------------------------------------------------------
+
+/// Separator between owner and object name in scoped DB keys.
+const SCOPE_SEPARATOR: char = '/';
+
+/// Build a scoped DB key: `"{owner}/{name}"`.
+///
+/// The owner segment is the sanitized subject (UUID or hex hash), guaranteed to
+/// contain no `/`. The user-visible name may contain `/` only if we ever allow
+/// it (currently validation rejects it), but the *first* `/` is always the
+/// owner boundary.
+pub fn scoped_name(owner: &str, name: &str) -> String {
+    format!("{owner}{SCOPE_SEPARATOR}{name}")
+}
+
+/// Extract the user-visible name from a potentially scoped DB key.
+///
+/// If the key contains a `/`, the part after the first `/` is the display name.
+/// If no `/`, the key *is* the display name (shared/legacy provider).
+pub fn display_name(db_key: &str) -> &str {
+    match db_key.find(SCOPE_SEPARATOR) {
+        Some(pos) => &db_key[pos + 1..],
+        None => db_key,
+    }
+}
+
+/// Extract the owner prefix from a scoped DB key, if present.
+pub fn owner_prefix(db_key: &str) -> Option<&str> {
+    db_key.find(SCOPE_SEPARATOR).map(|pos| &db_key[..pos])
+}
+
+/// Build the scoped DB key for the given principal, or return the raw name for
+/// anonymous/admin callers.
+pub fn scoped_name_for_principal(
+    name: &str,
+    principal: Option<&Principal>,
+    admin_role: &str,
+) -> Result<String, Status> {
+    let Some(identity) = principal_identity(principal) else {
+        return Ok(name.to_string());
+    };
+
+    if !admin_role.is_empty() && identity.roles.iter().any(|r| r == admin_role) {
+        return Ok(name.to_string());
+    }
+
+    let owner_value = sanitize_subject(&identity.subject)?;
+    Ok(scoped_name(&owner_value, name))
+}
+
+/// Resolve a provider name with owner-scoped fallback.
+///
+/// Resolution order:
+/// 1. Try `{owner}/{name}` (user's own provider)
+/// 2. Fall back to `{name}` (shared provider, no owner prefix)
+///
+/// Admin callers and anonymous principals resolve the raw name directly.
+pub async fn resolve_scoped_name(
+    store: &crate::persistence::Store,
+    object_type: &str,
+    name: &str,
+    principal: Option<&Principal>,
+    admin_role: &str,
+) -> Result<Option<crate::persistence::ObjectRecord>, Status> {
+    let Some(identity) = principal_identity(principal) else {
+        // Anonymous/none → direct lookup (backward compat)
+        return store
+            .get_by_name(object_type, name)
+            .await
+            .map_err(|e| Status::internal(format!("fetch by name failed: {e}")));
+    };
+
+    // Admin with explicit scoped name (contains '/') → direct lookup
+    let is_admin = !admin_role.is_empty() && identity.roles.iter().any(|r| r == admin_role);
+    if is_admin && name.contains(SCOPE_SEPARATOR) {
+        return store
+            .get_by_name(object_type, name)
+            .await
+            .map_err(|e| Status::internal(format!("fetch by name failed: {e}")));
+    }
+
+    // Non-admin (or admin without explicit scope): try owned first
+    if !is_admin {
+        let owner_value = sanitize_subject(&identity.subject)?;
+        let owned_key = scoped_name(&owner_value, name);
+        let owned = store
+            .get_by_name(object_type, &owned_key)
+            .await
+            .map_err(|e| Status::internal(format!("fetch owned provider failed: {e}")))?;
+        if owned.is_some() {
+            return Ok(owned);
+        }
+    }
+
+    // Fall back to shared (unscoped) name
+    store
+        .get_by_name(object_type, name)
+        .await
+        .map_err(|e| Status::internal(format!("fetch shared provider failed: {e}")))
+}
+
 // ---------------------------------------------------------------------------
 // Tests
 // ---------------------------------------------------------------------------
@@ -370,4 +473,61 @@ mod tests {
         let result = owner_selector(None, "", "openshell-admin").unwrap();
         assert_eq!(result, "");
     }
+
+    // ---- scoped name helpers ----
+
+    #[test]
+    fn scoped_name_construction() {
+        assert_eq!(scoped_name("alice-uuid-1234", "openai"), "alice-uuid-1234/openai");
+    }
+
+    #[test]
+    fn display_name_strips_owner() {
+        assert_eq!(display_name("alice-uuid-1234/openai"), "openai");
+    }
+
+    #[test]
+    fn display_name_shared_unchanged() {
+        assert_eq!(display_name("openai"), "openai");
+    }
+
+    #[test]
+    fn owner_prefix_extracts_owner() {
+        assert_eq!(owner_prefix("alice-uuid-1234/openai"), Some("alice-uuid-1234"));
+    }
+
+    #[test]
+    fn owner_prefix_none_for_shared() {
+        assert_eq!(owner_prefix("openai"), None);
+    }
+
+    #[test]
+    fn scoped_name_for_principal_user() {
+        let principal = alice();
+        let result =
+            scoped_name_for_principal("openai", Some(&principal), "openshell-admin").unwrap();
+        assert_eq!(result, "alice-uuid-1234/openai");
+    }
+
+    #[test]
+    fn scoped_name_for_principal_admin_unscoped() {
+        let principal = admin_principal();
+        let result =
+            scoped_name_for_principal("openai", Some(&principal), "openshell-admin").unwrap();
+        assert_eq!(result, "openai");
+    }
+
+    #[test]
+    fn scoped_name_for_principal_anonymous_unscoped() {
+        let result =
+            scoped_name_for_principal("openai", Some(&Principal::Anonymous), "openshell-admin")
+                .unwrap();
+        assert_eq!(result, "openai");
+    }
+
+    #[test]
+    fn scoped_name_for_principal_none_unscoped() {
+        let result = scoped_name_for_principal("openai", None, "openshell-admin").unwrap();
+        assert_eq!(result, "openai");
+    }
 }