RFE: Allow sharing leases with other users

[mangelajo]

Summary

Allow the owner of a lease to share it with other users, granting them access to the leased device during the lease lifetime.

Motivation

Currently, a lease is strictly bound to the user who requested it. In collaborative workflows (e.g. pair debugging, handoffs between shifts, or team-based hardware labs), it is common for multiple people to need access to the same device during a single lease session.

Today, if a colleague needs to interact with a device that someone else has leased, the original owner must give up the lease so the other person can request a new one (losing session state, hooks, etc.)

Not ideal.

Proposed Behavior

The lease owner should be able to share their active lease with one or more other users. Shared users would be able to:

• Connect to the device via jmp shell using the shared lease
• Extend the lease duration
• End/release the lease
• Run commands against the device (SSH, serial, power, storage, etc.)

Sharing could happen:

• At lease request time — specifying additional users who should have access from the start (e.g. jmp create lease --share user1,user2)
• During an active lease — the owner grants access to additional users after the lease is already running (e.g. jmp lease share <lease-id> --user user1)

Permissions model considerations:

• The original requester remains the owner of the lease
• Shared users get full access to the device for the lease duration (or a subset — could be scoped in a future iteration)
• Only the owner (or shared users, depending on policy) can add/remove other shared users
• Audit trail should reflect which user performed each action on a shared lease

API / CLI Sketch

# Share at creation time
jmp create lease --selector board=qemu --share user1@example.com,user2@example.com

# Share an existing lease
jmp lease share <lease-id> --add user1@example.com

# Remove a shared user
jmp lease share <lease-id> --remove user1@example.com

# List shared users
jmp lease share <lease-id> --list

# Connect to a shared lease (as a shared user)
jmp shell --lease <lease-id>

Implementation Notes

• The Lease CRD would need a new field (e.g. spec.sharedWith: []string) to track authorized users beyond the owner.
• The controller's authorization checks for Listen, Dial, and lease management operations would need to allow shared users.
• OIDC identity of the connecting user would be checked against both the owner and the shared users list.
• gRPC service methods (ExtendLease, ReleaseLease, etc.) would need updated authorization logic.

Use Cases

1. Pair debugging — Two engineers collaborate on a hardware issue; one leases the board, shares with the other, both can SSH in and run commands.
2. Shift handoff — A night-shift engineer shares the lease with the day-shift engineer before signing off, avoiding device downtime from re-leasing.
3. CI + human intervention — A CI pipeline leases a device, then shares the lease with a human operator for manual validation steps.
4. Training / demos — An instructor shares a leased device with students so they can observe or interact with real hardware.