<fix>[identity]: propagate ExternalTenantContext via TaskContext for cascade resources

[ZStack-Robot]

Problem

ExternalTenantResourceTracker fails to track cascade resources (Volume, NIC, CdRom) created during VM creation. Only the top-level VM gets an ExternalTenantResourceRefVO record.

Root cause: VmInstanceBase.handle(InstantiateNewCreatedVmInstanceMsg) uses thdf.chainSubmit() which executes the FlowChain in a thread-pool worker thread. The ThreadLocal ExternalTenantContext is lost during this thread handoff, so when cascade resources are persisted and notifyResourceOwnershipCreated() is called, ExternalTenantContext.getCurrent() returns null.

Fix

Piggyback on ZStack's existing TaskContext propagation infrastructure:

1. Write side (BeforeDeliveryMessageInterceptor): When restoring ExternalTenantContext to ThreadLocal, also store it in TaskContext via putTaskContextItem().

2. Read side (notifyResourceOwnershipCreated): If ThreadLocal is null, fallback to TaskContext.getTaskContextItem() which is automatically propagated across thread boundaries by HasThreadContextAspect / SetThreadContextAspect.

This works because:

• HasThreadContextAspect.aj auto-captures TaskContext snapshot when any HasThreadContext object (ChainTask, Completion, etc.) is constructed
• SetThreadContextAspect.aj auto-restores TaskContext before ChainTask.run(), Completion.success/fail(), etc.

Changes

• ExternalTenantResourceTracker.java: ~30 lines added/changed in 1 file

Resolves

ZSTAC-1147

sync from gitlab !9588

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: http://open.zstack.ai:20001/code-reviews/zstack-cloud.yaml (via .coderabbit.yaml)

Review profile: CHILL

Plan: Pro

Run ID: 395c65db-7e27-4b1d-9b18-e6b8b3451e47

📥 Commits

Reviewing files that changed from the base of the PR and between dbbbe01 and f039a47.

📒 Files selected for processing (1)

• identity/src/main/java/org/zstack/identity/ExternalTenantResourceTracker.java

---

Walkthrough

此变更在 ExternalTenantResourceTracker 中添加了 TaskContext 支持，用于在线程池边界间传播 ExternalTenantContext。更新了拦截器逻辑以同时处理 TaskContext 的写入和移除操作，并增强了资源所有权通知中的上下文获取机制。

Changes

Cohort / File(s)	Summary
TaskContext 上下文传播 identity/src/main/java/org/zstack/identity/ExternalTenantResourceTracker.java	引入 TASK_CONTEXT_EXTERNAL_TENANT 常量并在消息传递时将外部租户上下文写入/移除 TaskContext；更新接收端拦截器逻辑以恢复和清除 TaskContext 中的租户上下文；增强资源所有权通知以在 ThreadLocal 缺失时从 TaskContext 回退。

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Poem

🐰 兔子蹦跳说，TaskContext真妙，
线程池之间，租户不跑掉，
拦截器守护，上下文闪耀，
资源追踪妥，边界无烦恼！
一个文件改，逻辑却精妙。✨

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
Title check	❌ Error	标题超过72字符限制（86字符），不符合要求。	将标题缩短至72字符以内，可以考虑简化描述部分，例如：'[identity]: propagate ExternalTenantContext via TaskContext'
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (1 passed)

Check name	Status	Explanation
Description check	✅ Passed	PR描述清晰地阐述了问题、根本原因、修复方案和改动详情，与变更集完全相关。

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync/hanyu.liang/fix-1147

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}