feat(BA-6628): add allow-list rank update across the v2 surface

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: jopemachine

.claude/skills/bai-cli/SKILL.md

@@ -104,6 +104,8 @@ Check options with `--help`.
 - **prometheus-query-definition**: user(get, search, execute) · admin(create, update, delete, preview)
 - **prometheus-query-definition-category**: user(get, search) · admin(create, delete)
 - **app-config**: user(get-domain, get-user, get-merged, delete-domain, delete-user)
+- **app-config-definition**: admin(create, get, search, purge)
+- **app-config-allow-list**: admin(create, get, search, update, purge)
 - **export**: admin(list-reports, get-report, audit-logs, keypairs, projects, sessions, sessions-by-project, users, users-by-domain) · my(keypairs, sessions)
 
 ### Utilities (not entities)

changes/12517.feature.md

@@ -1 +1 @@
-Expose the app config allow-list merge `rank` on the v2 REST/GraphQL APIs and CLI — optional create input (scope-type default when omitted), node field, and order field
+Expose the app config allow-list merge `rank` on the v2 REST/GraphQL APIs and CLI — optional create input (scope-type default when omitted), node field, order field, and a new admin update operation (`PATCH /v2/app-config-allow-list/{id}`, `adminUpdateAppConfigAllowList`, `./bai admin app-config-allow-list update --rank`) for re-ordering the merge

docs/manager/graphql-reference/supergraph.graphql

@@ -11374,6 +11374,11 @@ type Mutation
   """
   adminPurgeAppConfigAllowList(input: PurgeAppConfigAllowListInput!): PurgeAppConfigAllowListPayload @join__field(graph: STRAWBERRY)
 
+  """
+  Added in 26.8.0. Update an app config allow-list entry's rank by id (super admin only).
+  """
+  adminUpdateAppConfigAllowList(input: UpdateAppConfigAllowListInput!): UpdateAppConfigAllowListPayload @join__field(graph: STRAWBERRY)
+
   """
   Added in 25.14.0. Scan external registries to discover available artifacts. Searches HuggingFace or Reservoir registries for artifacts matching the specified criteria and registers them in the system with SCANNED status. The artifacts become available for import but are not downloaded until explicitly imported. This is the first step in the artifact workflow: Scan → Import → Use
   """
@@ -19181,6 +19186,29 @@ input UpdateAllowedResourceGroupsForProjectInput
   remove: [String!] = null
 }
 
+"""
+Added in 26.8.0. Input for updating an app config allow-list entry (rank only).
+"""
+input UpdateAppConfigAllowListInput
+  @join__type(graph: STRAWBERRY)
+{
+  """App config allow-list entry id to update."""
+  id: UUID!
+
+  """
+  New merge rank applied to fragments under this entry (low to high; higher wins). Omit to leave unchanged.
+  """
+  rank: Int = null
+}
+
+"""Added in 26.8.0. Payload for app config allow-list entry update."""
+type UpdateAppConfigAllowListPayload
+  @join__type(graph: STRAWBERRY)
+{
+  """Updated app config allow-list entry."""
+  appConfigAllowList: AppConfigAllowList!
+}
+
 """
 Added in 24.09.0. Input for updating artifact metadata properties.
 

docs/manager/graphql-reference/v2-schema.graphql

@@ -7233,6 +7233,11 @@ type Mutation {
   """
   adminPurgeAppConfigAllowList(input: PurgeAppConfigAllowListInput!): PurgeAppConfigAllowListPayload
 
+  """
+  Added in 26.8.0. Update an app config allow-list entry's rank by id (super admin only).
+  """
+  adminUpdateAppConfigAllowList(input: UpdateAppConfigAllowListInput!): UpdateAppConfigAllowListPayload
+
   """
   Added in 25.14.0. Scan external registries to discover available artifacts. Searches HuggingFace or Reservoir registries for artifacts matching the specified criteria and registers them in the system with SCANNED status. The artifacts become available for import but are not downloaded until explicitly imported. This is the first step in the artifact workflow: Scan → Import → Use
   """
@@ -13372,6 +13377,25 @@ input UpdateAllowedResourceGroupsForProjectInput {
   remove: [String!] = null
 }
 
+"""
+Added in 26.8.0. Input for updating an app config allow-list entry (rank only).
+"""
+input UpdateAppConfigAllowListInput {
+  """App config allow-list entry id to update."""
+  id: UUID!
+
+  """
+  New merge rank applied to fragments under this entry (low to high; higher wins). Omit to leave unchanged.
+  """
+  rank: Int = null
+}
+
+"""Added in 26.8.0. Payload for app config allow-list entry update."""
+type UpdateAppConfigAllowListPayload {
+  """Updated app config allow-list entry."""
+  appConfigAllowList: AppConfigAllowList!
+}
+
 """
 Added in 24.09.0. Input for updating artifact metadata properties.
 

src/ai/backend/client/cli/v2/admin/app_config_allow_list.py

@@ -156,6 +156,34 @@ async def _run() -> None:
     asyncio.run(_run())
 
 
+@app_config_allow_list.command()
+@click.argument("app_config_allow_list_id", type=click.UUID)
+@click.option(
+    "--rank",
+    required=True,
+    type=int,
+    help=("New merge rank applied to fragments under this entry (low to high; higher wins)."),
+)
+def update(app_config_allow_list_id: uuid.UUID, rank: int) -> None:
+    """Update an app config allow-list entry's rank by ID."""
+    from ai.backend.common.dto.manager.v2.app_config_allow_list.request import (
+        UpdateAppConfigAllowListInput,
+    )
+
+    async def _run() -> None:
+        registry = await create_v2_registry(load_v2_config())
+        try:
+            result = await registry.app_config_allow_list.admin_update(
+                app_config_allow_list_id,
+                UpdateAppConfigAllowListInput(id=app_config_allow_list_id, rank=rank),
+            )
+            print_result(result)
+        finally:
+            await registry.close()
+
+    asyncio.run(_run())
+
+
 @app_config_allow_list.command()
 @click.argument("app_config_allow_list_id", type=click.UUID)
 def purge(app_config_allow_list_id: uuid.UUID) -> None:

src/ai/backend/client/v2/domains_v2/app_config_allow_list.py

@@ -9,12 +9,14 @@
 from ai.backend.common.dto.manager.v2.app_config_allow_list.request import (
     CreateAppConfigAllowListInput,
     SearchAppConfigAllowListInput,
+    UpdateAppConfigAllowListInput,
 )
 from ai.backend.common.dto.manager.v2.app_config_allow_list.response import (
     AppConfigAllowListNode,
     CreateAppConfigAllowListPayload,
     PurgeAppConfigAllowListPayload,
     SearchAppConfigAllowListPayload,
+    UpdateAppConfigAllowListPayload,
 )
 
 _PATH: Final = "/v2/app-config-allow-list"
@@ -24,8 +26,8 @@ class V2AppConfigAllowListClient(BaseDomainClient):
     """SDK client for app config allow-list operations.
 
     Mirrors the REST v2 surface introduced in BA-6546. All calls require
-    super-admin privileges; the entity supports create, get, search, and
-    purge (no update or delete).
+    super-admin privileges; the entity supports create, get, search, update
+    (rank only), and purge.
     """
 
     async def admin_create(
@@ -60,6 +62,19 @@ async def admin_get(self, app_config_allow_list_id: UUID) -> AppConfigAllowListN
             response_model=AppConfigAllowListNode,
         )
 
+    async def admin_update(
+        self,
+        app_config_allow_list_id: UUID,
+        request: UpdateAppConfigAllowListInput,
+    ) -> UpdateAppConfigAllowListPayload:
+        """Update an app config allow-list entry's rank by ID (superadmin only)."""
+        return await self._client.typed_request(
+            "PATCH",
+            f"{_PATH}/{app_config_allow_list_id}",
+            request=request,
+            response_model=UpdateAppConfigAllowListPayload,
+        )
+
     async def admin_purge(
         self,
         app_config_allow_list_id: UUID,

src/ai/backend/common/dto/manager/v2/app_config_allow_list/request.py

@@ -22,6 +22,7 @@
     "CreateAppConfigAllowListInput",
     "PurgeAppConfigAllowListInput",
     "SearchAppConfigAllowListInput",
+    "UpdateAppConfigAllowListInput",
 )
 
 
@@ -45,6 +46,23 @@ class CreateAppConfigAllowListInput(BaseRequestModel):
     )
 
 
+class UpdateAppConfigAllowListInput(BaseRequestModel):
+    """Input for updating an app config allow-list entry.
+
+    Only ``rank`` is updatable — the identity pair (``config_name``, ``scope_type``)
+    is immutable (purge and recreate to change it).
+    """
+
+    id: UUID = Field(description="App config allow-list entry id to update.")
+    rank: int | None = Field(
+        default=None,
+        description=(
+            "New merge rank applied to fragments under this entry (low to high; "
+            "higher wins). Omit to leave unchanged."
+        ),
+    )
+
+
 class PurgeAppConfigAllowListInput(BaseRequestModel):
     """Input for purging an app config allow-list entry."""
 

src/ai/backend/common/dto/manager/v2/app_config_allow_list/response.py

@@ -15,6 +15,7 @@
     "CreateAppConfigAllowListPayload",
     "PurgeAppConfigAllowListPayload",
     "SearchAppConfigAllowListPayload",
+    "UpdateAppConfigAllowListPayload",
 )
 
 
@@ -39,6 +40,14 @@ class CreateAppConfigAllowListPayload(BaseResponseModel):
     )
 
 
+class UpdateAppConfigAllowListPayload(BaseResponseModel):
+    """Payload for app config allow-list entry update."""
+
+    app_config_allow_list: AppConfigAllowListNode = Field(
+        description="Updated app config allow-list entry."
+    )
+
+
 class PurgeAppConfigAllowListPayload(BaseResponseModel):
     """Payload for app config allow-list entry purge."""
 

src/ai/backend/manager/api/adapters/app_config_allow_list/adapter.py

@@ -13,12 +13,14 @@
     CreateAppConfigAllowListInput,
     PurgeAppConfigAllowListInput,
     SearchAppConfigAllowListInput,
+    UpdateAppConfigAllowListInput,
 )
 from ai.backend.common.dto.manager.v2.app_config_allow_list.response import (
     AppConfigAllowListNode,
     CreateAppConfigAllowListPayload,
     PurgeAppConfigAllowListPayload,
     SearchAppConfigAllowListPayload,
+    UpdateAppConfigAllowListPayload,
 )
 from ai.backend.common.dto.manager.v2.app_config_allow_list.types import (
     AppConfigAllowListOrderField,
@@ -40,8 +42,12 @@
 from ai.backend.manager.repositories.app_config_allow_list.creators import (
     AppConfigAllowListCreatorSpec,
 )
+from ai.backend.manager.repositories.app_config_allow_list.updaters import (
+    AppConfigAllowListUpdaterSpec,
+)
 from ai.backend.manager.repositories.base import (
     Purger,
+    Updater,
     combine_conditions_or,
     negate_conditions,
 )
@@ -58,6 +64,10 @@
 from ai.backend.manager.services.app_config_allow_list.actions.search import (
     SearchAppConfigAllowListAction,
 )
+from ai.backend.manager.services.app_config_allow_list.actions.update import (
+    UpdateAppConfigAllowListAction,
+)
+from ai.backend.manager.types import OptionalState
 
 
 @lru_cache(maxsize=1)
@@ -144,6 +154,26 @@ async def admin_search(
             has_previous_page=action_result.has_previous_page,
         )
 
+    async def admin_update(
+        self, input: UpdateAppConfigAllowListInput
+    ) -> UpdateAppConfigAllowListPayload:
+        updater = Updater(
+            spec=AppConfigAllowListUpdaterSpec(
+                rank=(
+                    OptionalState.update(input.rank)
+                    if input.rank is not None
+                    else OptionalState.nop()
+                ),
+            ),
+            pk_value=AppConfigAllowListID(input.id),
+        )
+        action_result = await self._processors.app_config_allow_list.update.wait_for_complete(
+            UpdateAppConfigAllowListAction(updater=updater)
+        )
+        return UpdateAppConfigAllowListPayload(
+            app_config_allow_list=self._data_to_node(action_result.allow_list),
+        )
+
     async def admin_purge(
         self, input: PurgeAppConfigAllowListInput
     ) -> PurgeAppConfigAllowListPayload:

src/ai/backend/manager/api/gql/app_config_allow_list/__init__.py

@@ -5,6 +5,7 @@
     admin_app_config_allow_lists,
     admin_create_app_config_allow_list,
     admin_purge_app_config_allow_list,
+    admin_update_app_config_allow_list,
 )
 from .types import (
     AppConfigAllowListConnection,
@@ -37,4 +38,5 @@
     # Mutation resolvers
     "admin_create_app_config_allow_list",
     "admin_purge_app_config_allow_list",
+    "admin_update_app_config_allow_list",
 )