Add public projects

[haydnli-shopify]

Summary

Implements support for public projects to improve user onboarding experience. Users can now create public projects that are visible to all users, while maintaining backward compatibility with private projects as the default.

This PR is part of the larger self-serve membership management effort described in #2742.

Fixes #2670

Changes Made

• Added is_public field to Project model (database, core model, API schemas)
• Updated /api/projects/create endpoint to accept is_public parameter
• Implemented access control: non-members see only public projects, members see all accessible projects
• Optimized project listing with single efficient SQL query
• Added comprehensive test coverage (5 new tests covering creation and listing)
• Maintained backward compatibility (projects default to private)

API Usage

# Create public project
curl -X POST /api/projects/create -H "Content-Type: application/json" -d '{"project_name": "my-project", "is_public": true}'

# Create private project (default)
curl -X POST /api/projects/create -H "Content-Type: application/json" -d '{"project_name": "my-project"}'

Testing

All tests pass including new comprehensive coverage:

• test_creates_public_project
• test_creates_private_project_by_default
• test_creates_private_project_explicitly
• test_returns_public_projects_to_non_members
• test_member_sees_both_public_and_private_projects

[r4victor]

The PR currently does not work since it's missing a db migration. Please ensure you've tested the changes.

Also note that we release from master, so PRs should not introduce partially working features or should hide them behind feature flags. This PR only makes public projects visible in the list but what happens if I open the project? I assume it will error. I'm ok with adding join/leave functionality in a separate PR, but at least it should not error when opening.

[r4victor]

I suppose we should differentiate joined and not-joined projects in the UI, so maybe the API will return some field indicating that?

[r4victor]

@haydnli-shopify, now there is a problem that clicking on a public project (/api/projects/{project_name}/get) would result in 403 since the /get endpoint allows only project members. Is your plan to make public projects "non-clickable" in the UI before joining? Just want to confirm

Another option would be to show public project details before joining – it doesn't break any confidentiality since users can join and see anyway.

[haydnli-shopify]

@haydnli-shopify, now there is a problem that clicking on a public project (/api/projects/{project_name}/get) would result in 403 since the /get endpoint allows only project members. Is your plan to make public projects "non-clickable" in the UI before joining? Just want to confirm

Another option would be to show public project details before joining – it doesn't break any confidentiality since users can join and see anyway.

I went with your second option - the /api/projects/{project_name}/get endpoint now allows any authenticated user to view public project details before joining. Added a new ProjectMemberOrPublicAccess permission class that maintains existing member access while enabling public project discovery.
The 403 issue should be resolved. It should give a access denied here.

By the way, You could also check the PR for the second part of this issue here #2779, which handles works after we finish merging this current PR

[r4victor]

I recommend installing pre-commits so that linting is done automatically: https://github.com/dstackai/dstack/blob/master/contributing/DEVELOPMENT.md

[r4victor]

Please avoid WHAT comments that duplicate the code. If LLM generated, please remove.

[r4victor]

@haydnli-shopify, also please avoid force pushing PRs once under review – makes it unnecessary harder for others to review and contribute. If you need to pull changes from master, just do a regular merge into a PR branch.

[r4victor]

@haydnli-shopify Have you tested the UI? I found the public project page won't open if a user is not a member because the UI requests /api/project/{project_name}/gateways/list which is only for members. I'm strongly against making project endpoints available for non-members even for public projects since it would complicate permission system and would be harder to keep track of. So I suggest the UI changes:

• Do not show project details to non-members at all.
• Or show a different view that does not require calls to project-specific endpoints.

I think this PR can be merged to keep things going, so please address the issue in #2795.