feat(BA-6555): AppConfig merge engine + resolve service (service layer)

Resolve the merged AppConfig for a (user, config_name) on top of the repository's
visible-fragments query:
- AppConfigData: the merged per-user view (ordered fragments + deep-merged config; None
  when no fragment contributes)
- deep-merge in rank order — nested dicts recurse, lists/scalars are replaced wholesale by
  the higher-rank fragment
- resolve / resolve_bulk actions + processors (bulk repeats duplicate names in order)
- mocked-repository service tests

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jopemachine

changes/12359.feature.md

@@ -0,0 +1 @@
+Add the app_config read service: resolve a user's merged AppConfig for one or many config names by rank-ordering the visible public / domain / user fragments and deep-merging them.

src/ai/backend/manager/data/app_config/__init__.py

@@ -0,0 +1,21 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any
+
+from ai.backend.manager.data.app_config_fragment.types import AppConfigFragmentData
+
+
+@dataclass(frozen=True)
+class AppConfigData:
+    """Merged per-user view of one ``config_name``.
+
+    The ordered contributing ``fragments`` (rank low -> high) plus their deep-merged
+    ``merged_config``. ``merged_config`` is ``None`` when no fragment contributes (the config
+    name is defined but unconfigured for this scope) — distinct from a fragment that merges
+    to an empty ``{}``.
+    """
+
+    config_name: str
+    fragments: list[AppConfigFragmentData]
+    merged_config: dict[str, Any] | None

src/ai/backend/manager/data/app_config/types.py

@@ -210,24 +210,22 @@ async def scoped_search(
 
     @app_config_fragment_db_source_resilience.apply()
     async def list_visible_fragments_bulk(
-        self, config_names: list[str], scope: AppConfigScopeArguments
+        self, config_names: list[str], scope: AppConfigScopeArguments | None = None
     ) -> list[AppConfigFragmentData]:
-        """Visible fragments for several ``config_names`` at once, in a single query.
-
-        Selects the requested names AND any one of the principal's visible scopes (public,
-        its domain, or its own user). The scope filter is name-independent, so it is a single
-        OR group AND-combined with the name membership. Merge priority (``rank``) lives on the
-        joined allow-list entry; the result is always ordered by ascending ``rank`` so the
-        caller can group by name (each name's subset stays rank-ordered) and deep-merge each
-        name's fragments in order.
+        """Visible fragments for several ``config_names`` in one query, ordered by ascending ``rank``.
+
+        ``public`` always contributes; a ``scope`` additionally admits its domain and user
+        overlay, while ``scope=None`` (anonymous) sees only ``public``. Rank-ordered so the
+        caller can group by name and deep-merge each name's fragments in order.
         """
         if not config_names:
             return []
-        scope_visibility = [
-            AppConfigFragmentConditions.by_public_visibility(),
-            AppConfigFragmentConditions.by_domain_visibility(str(scope.domain_id)),
-            AppConfigFragmentConditions.by_user_visibility(str(scope.user_id)),
-        ]
+        scope_visibility = [AppConfigFragmentConditions.by_public_visibility()]
+        if scope is not None:
+            scope_visibility += [
+                AppConfigFragmentConditions.by_domain_visibility(str(scope.domain_id)),
+                AppConfigFragmentConditions.by_user_visibility(str(scope.user_id)),
+            ]
         querier = BatchQuerier(
             pagination=NoPagination(),
             conditions=[

src/ai/backend/manager/repositories/app_config_fragment/db_source/db_source.py

@@ -105,6 +105,6 @@ async def bulk_purge(
 
     @app_config_fragment_repository_resilience.apply()
     async def list_visible_fragments_bulk(
-        self, config_names: list[str], scope: AppConfigScopeArguments
+        self, config_names: list[str], scope: AppConfigScopeArguments | None = None
     ) -> list[AppConfigFragmentData]:
         return await self._db_source.list_visible_fragments_bulk(config_names, scope)

src/ai/backend/manager/repositories/app_config_fragment/repository.py

@@ -8,6 +8,9 @@
 from ai.backend.manager.repositories.app_config_definition.repositories import (
     AppConfigDefinitionRepositories,
 )
+from ai.backend.manager.repositories.app_config_fragment.repositories import (
+    AppConfigFragmentRepositories,
+)
 from ai.backend.manager.repositories.artifact.repositories import ArtifactRepositories
 from ai.backend.manager.repositories.artifact_registry.repositories import (
     ArtifactRegistryRepositories,
@@ -94,6 +97,7 @@ class Repositories:
     agent: AgentRepositories
     app_config_allow_list: AppConfigAllowListRepositories
     app_config_definition: AppConfigDefinitionRepositories
+    app_config_fragment: AppConfigFragmentRepositories
     auth: AuthRepositories
     container_registry: ContainerRegistryRepositories
     deployment: DeploymentRepositories
@@ -148,6 +152,7 @@ def create(cls, args: RepositoryArgs) -> Self:
         agent_repositories = AgentRepositories.create(args)
         app_config_allow_list_repositories = AppConfigAllowListRepositories.create(args)
         app_config_definition_repositories = AppConfigDefinitionRepositories.create(args)
+        app_config_fragment_repositories = AppConfigFragmentRepositories.create(args)
         auth_repositories = AuthRepositories.create(args)
         container_registry_repositories = ContainerRegistryRepositories.create(args)
         deployment_repositories = DeploymentRepositories.create(args)
@@ -203,6 +208,7 @@ def create(cls, args: RepositoryArgs) -> Self:
             agent=agent_repositories,
             app_config_allow_list=app_config_allow_list_repositories,
             app_config_definition=app_config_definition_repositories,
+            app_config_fragment=app_config_fragment_repositories,
             auth=auth_repositories,
             container_registry=container_registry_repositories,
             deployment=deployment_repositories,

src/ai/backend/manager/repositories/repositories.py

@@ -0,0 +1,19 @@
+from __future__ import annotations
+
+from typing import override
+
+from ai.backend.common.data.permission.types import EntityType
+from ai.backend.manager.actions.action.scope import BaseScopeAction, BaseScopeActionResult
+
+
+class AppConfigScopeAction(BaseScopeAction):
+    """Base for scope-level merged app config actions (resolve)."""
+
+    @override
+    @classmethod
+    def entity_type(cls) -> EntityType:
+        return EntityType.APP_CONFIG
+
+
+class AppConfigScopeActionResult(BaseScopeActionResult):
+    pass

src/ai/backend/manager/services/app_config/__init__.py

@@ -0,0 +1,59 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import override
+
+from ai.backend.common.data.permission.types import RBACElementType, ScopeType
+from ai.backend.common.identifier.user import UserID
+from ai.backend.manager.actions.types import ActionOperationType
+from ai.backend.manager.data.app_config.types import AppConfigData
+from ai.backend.manager.data.permission.types import RBACElementRef
+from ai.backend.manager.repositories.app_config_fragment.types import AppConfigScopeArguments
+from ai.backend.manager.services.app_config.actions.base import (
+    AppConfigScopeAction,
+    AppConfigScopeActionResult,
+)
+
+
+@dataclass
+class ResolveAppConfigAction(AppConfigScopeAction):
+    """Resolve the merged ``AppConfig`` for one ``config_name``.
+
+    ``scope`` carries the resolving principal ``(user, domain)``. When it is ``None`` — the
+    anonymous, pre-login read — only ``public``-scope fragments contribute and the action is
+    a ``GLOBAL`` read attributable to no user.
+    """
+
+    config_name: str
+    scope_arguments: AppConfigScopeArguments | None = None
+
+    @override
+    @classmethod
+    def operation_type(cls) -> ActionOperationType:
+        return ActionOperationType.GET
+
+    @override
+    def scope_type(self) -> ScopeType:
+        return ScopeType.USER if self.scope_arguments is not None else ScopeType.GLOBAL
+
+    @override
+    def scope_id(self) -> str:
+        return str(self.scope_arguments.user_id) if self.scope_arguments is not None else ""
+
+    @override
+    def target_element(self) -> RBACElementRef:
+        return RBACElementRef(RBACElementType.APP_CONFIG, "")
+
+
+@dataclass
+class ResolveAppConfigActionResult(AppConfigScopeActionResult):
+    app_config: AppConfigData
+    _user_id: UserID | None
+
+    @override
+    def scope_type(self) -> ScopeType:
+        return ScopeType.USER if self._user_id is not None else ScopeType.GLOBAL
+
+    @override
+    def scope_id(self) -> str:
+        return str(self._user_id) if self._user_id is not None else ""