feat(ui): support advanced proxy cache configurations in UI

[stonezdj]

• Support repository filter configuration (pattern and kind) for proxy cache projects.
• Ensure the local on not found and proxy referrer API checkbox editability is controlled by project configuration update permissions.

Thank you for contributing to Harbor!

Comprehensive Summary of your change

Issue being fixed

Fixes #(issue)

Please indicate you've done the following:

• Well Written Title and Summary of the PR
• Label the PR as needed. "release-note/ignore-for-release, release-note/new-feature, release-note/update, release-note/enhancement, release-note/community, release-note/breaking-change, release-note/docs, release-note/infra, release-note/deprecation"
• Accepted the DCO. Commits without the DCO will delay acceptance.
• Made sure tests are passing and test coverage is added if needed.
• Considered the docs impact and opened a new docs issue or PR with docs changes if needed in website repository.

[wy65701436]

cc @bupd and @Vad1mo could you please help to review?

[Copilot]

Pull request overview

Adds UI controls and localization for proxy-cache repository filters and permission-aware proxy settings.

Changes:

• Adds repository filter pattern/kind controls.
• Serializes filter metadata during project creation and updates.
• Updates proxy-cache permissions, layout, models, and translations.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/portal/src/i18n/lang/zh-tw-lang.json	Adds Traditional Chinese filter strings.
src/portal/src/i18n/lang/zh-cn-lang.json	Adds Simplified Chinese filter strings.
src/portal/src/i18n/lang/tr-tr-lang.json	Adds Turkish filter strings.
src/portal/src/i18n/lang/ru-ru-lang.json	Adds Russian filter strings.
src/portal/src/i18n/lang/pt-br-lang.json	Adds Brazilian Portuguese filter strings.
src/portal/src/i18n/lang/ko-kr-lang.json	Adds Korean filter strings.
src/portal/src/i18n/lang/fr-fr-lang.json	Adds French filter strings.
src/portal/src/i18n/lang/es-es-lang.json	Adds Spanish filter strings.
src/portal/src/i18n/lang/en-us-lang.json	Adds English filter strings.
src/portal/src/i18n/lang/de-de-lang.json	Adds German filter strings.
src/portal/src/app/shared/services/project.service.ts	Serializes filter metadata on updates.
src/portal/src/app/base/project/project.ts	Extends project metadata and filter constants.
src/portal/src/app/base/project/project-config/project-policy-config/project.ts	Extends configuration metadata types.
src/portal/src/app/base/project/project-config/project-policy-config/project-policy-config.component.ts	Loads filter settings and updates permissions.
src/portal/src/app/base/project/project-config/project-policy-config/project-policy-config.component.scss	Adds filter-control styling.
src/portal/src/app/base/project/project-config/project-policy-config/project-policy-config.component.html	Adds filter controls and checkbox permission handling.
src/portal/src/app/base/left-side-nav/projects/create-project/create-project.component.ts	Includes filters in project creation.
src/portal/src/app/base/left-side-nav/projects/create-project/create-project.component.html	Adds creation-form filter controls.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.99%. Comparing base (f9a52ee) to head (1184f00).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #23536      +/-   ##
==========================================
+ Coverage   66.35%   68.99%   +2.64%     
==========================================
  Files        1073      820     -253     
  Lines      117683   103280   -14403     
  Branches     2965        0    -2965     
==========================================
- Hits        78090    71262    -6828     
+ Misses      35293    28078    -7215     
+ Partials     4300     3940     -360     

Flag	Coverage Δ
unittests	68.99% <ø> (+2.64%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 257 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Vad1mo]

Comparing this against the merged proposal (goharbor/community#280) and the backend implementation (#23527), a few deviations:

1. Client-side validation is missing

The proposal's UI section requires: "Validation should happen both client-side and server-side."

Neither the filter input in create-project.component.html nor the one in project-policy-config.component.html has any validator — an invalid pattern is only caught by the server's 400 on save. At minimum the regex kind can be validated client-side (try { new RegExp(pattern) }), and a doublestar pattern can be checked for balanced brackets/braces.

2. Tooltip describes anchoring semantics the backend doesn't have

REPOSITORY_FILTER_TOOLTIP (all 10 locales) says "regular expression patterns are head-anchored". The backend (#23527) requires the pattern to match the entire repository path, and the proposal says regex is "always auto-anchored". A user following this tooltip writes ^library/ and matches nothing. The tooltip should say the pattern must match the full repository path, e.g. ^library/.*.

3. allowUpdateProxyCacheConfiguration binding is dead

The proxy cache checkbox changes from hardcoded disabled to [disabled]="!allowUpdateProxyCacheConfiguration", but this PR removes the only assignment to that field. It's initialized to false (project-policy-config.component.ts:116) and never set, so the checkbox is still permanently disabled — the dynamic-looking binding just obscures that. Either restore an assignment or keep the hardcoded disabled.

Related: sibling controls in the same section now gate on three different signals — the filter input/select on hasChangeConfigRole, the enable checkbox on the dead allowUpdateProxyCacheConfiguration, and section visibility on isSystemAdmin (previously hasChangeConfigRole). The isSystemAdmin switch also changes who can see the proxy cache section, which the proposal doesn't cover.

4. Dead component state

repositoryFilterPattern/repositoryFilterKind are declared and populated in retrieve(), but the template binds projectPolicy.ProxyCacheFilterPattern/ProxyCacheFilterKind — the two fields are never read and can be removed.

5. Scope beyond the proposal

The proposal's UI section only asks for the Repository filter (label, kind selector, pattern input) in the create view. This PR additionally reworks the referrer API checkbox layout and permission gating, switches the proxy-cache section gating to isSystemAdmin, and adds a read-only filter display for non-admin members. These may be worthwhile, but they're not spec-driven — worth calling out in the PR description (the current second bullet covers only part of this) or splitting out.

Minor: updateProjectPolicy in project.service.ts now sends proxy_cache_filter_pattern/proxy_cache_filter_kind on every project update, including non-proxy projects (empty string + doublestar in the else branch). The backend ignores them for non-proxy projects on this endpoint, but sending them unconditionally relies on that. Also: REPOSITORY_FILTER_KIND_* constants are defined in base/project/project.ts and used in create-project, while this component and the service hardcode 'doublestar' — one or the other.

[Vad1mo]

behavior changes for existing users:

1. Project admins/maintainers lose visibility of the proxy cache config. On main, the proxy-cache checkbox block and the endpoint/bandwidth/connection-limit block are gated on hasChangeConfigRole (template lines 19, 36), so project-level admins see them (read-only). The PR regates both to isSystemAdmin. A non-sysadmin project admin now sees nothing about proxy cache except the new read-only filter row, and that only when a filter is actually set.
2. Referrer API becomes editable after project creation. On main the checkbox is [disabled]="!allowUpdateProxyCacheConfiguration", and that flag is provably always false in this view: it's hasChangeConfigRole && !isProxyCacheProject, and isProxyCacheProject is true whenever the project has a registry_id (project-config.component.ts:50-52) — which is exactly when the section renders. So no one could change it post-creation. The PR rebinds it to !hasChangeConfigRole, making it mutable by sysadmins. This is the PR body's stated intent, but it flips a previously-immutable setting to mutable. Side note: the same PR-body claim about local-on-not-found is a no-op — that checkbox is already gated by !hasChangeConfigRole on main (line 164).