feat(BA-5830): convert AppConfigFragment REST to bulk-only writes (BEP-1052 §3)

Replaces the single-item `create` / `update` / `purge` endpoints with
bulk equivalents per BEP-1052 §3 (all writes are bulk; pass a
one-element array for a single write).

New REST routes on `/v2/app-config-fragments/`:
- `POST /bulk-create`        — superadmin (admin, any scope)
- `POST /bulk-update`        — superadmin
- `POST /bulk-purge`         — superadmin
- `POST /my/bulk-create`     — auth (USER scope, current_user)
- `POST /my/bulk-update`     — auth (USER scope, current_user)

Removed: `POST /`, `POST /update`, `POST /purge` — replaced by the
bulk variants above. Reads are unchanged (`POST /get`,
`POST /{scope_type}/{scope_id}/search`, `POST /search`).

Handler methods updated to accept the v2 Bulk* DTOs added in
BA-5829 (#11285) and return the Bulk*Payload DTOs. `my_bulk_*`
resolves the caller via the adapter's `current_user()` call so the
REST handler itself stays auth-agnostic.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jopemachine

src/ai/backend/manager/api/rest/v2/app_config_fragment/handler.py

@@ -1,4 +1,10 @@
-"""REST v2 handler for the app-config fragment domain (BEP-1052 §2)."""
+"""REST v2 handler for the app-config fragment domain (BEP-1052 §4).
+
+Writes are **bulk-only** per BEP §3 — the single-item create / update /
+purge endpoints were removed in favour of `/bulk-create`,
+`/bulk-update`, `/bulk-purge` (admin) and `/my/bulk-create`,
+`/my/bulk-update` (self-service).
+"""
 
 from __future__ import annotations
 
@@ -8,11 +14,13 @@
 
 from ai.backend.common.api_handlers import APIResponse, BodyParam, PathParam
 from ai.backend.common.dto.manager.v2.app_config_fragment.request import (
+    AdminBulkCreateAppConfigFragmentsInput,
+    AdminBulkPurgeAppConfigFragmentsInput,
+    AdminBulkUpdateAppConfigFragmentsInput,
     AppConfigFragmentKeyInput,
-    CreateAppConfigFragmentInput,
-    PurgeAppConfigFragmentInput,
+    BulkCreateMyAppConfigFragmentsInput,
+    BulkUpdateMyAppConfigFragmentsInput,
     SearchAppConfigFragmentsInput,
-    UpdateAppConfigFragmentInput,
 )
 from ai.backend.common.dto.manager.v2.app_config_fragment.types import AppConfigScopeType
 from ai.backend.logging import BraceStyleAdapter
@@ -33,6 +41,8 @@ class V2AppConfigFragmentHandler:
     def __init__(self, *, adapter: AppConfigFragmentAdapter) -> None:
         self._adapter = adapter
 
+    # ── Reads ────────────────────────────────────────────────────
+
     async def get(
         self,
         body: BodyParam[AppConfigFragmentKeyInput],
@@ -64,28 +74,48 @@ async def admin_search(
         result = await self._adapter.admin_search(body.parsed)
         return APIResponse.build(status_code=HTTPStatus.OK, response_model=result)
 
-    async def admin_create(
+    # ── Admin bulk writes (BEP-1052 §3) ──────────────────────────
+
+    async def admin_bulk_create(
+        self,
+        body: BodyParam[AdminBulkCreateAppConfigFragmentsInput],
+    ) -> APIResponse:
+        """Strict insert across any scope; per-item transactions (admin only)."""
+        result = await self._adapter.admin_bulk_create(body.parsed)
+        return APIResponse.build(status_code=HTTPStatus.OK, response_model=result)
+
+    async def admin_bulk_update(
         self,
-        body: BodyParam[CreateAppConfigFragmentInput],
+        body: BodyParam[AdminBulkUpdateAppConfigFragmentsInput],
     ) -> APIResponse:
-        """Create a new fragment (admin only)."""
-        result = await self._adapter.create(body.parsed)
-        return APIResponse.build(status_code=HTTPStatus.CREATED, response_model=result)
+        """Wholesale JSON replacement; per-item transactions (admin only)."""
+        result = await self._adapter.admin_bulk_update(body.parsed)
+        return APIResponse.build(status_code=HTTPStatus.OK, response_model=result)
+
+    async def admin_bulk_purge(
+        self,
+        body: BodyParam[AdminBulkPurgeAppConfigFragmentsInput],
+    ) -> APIResponse:
+        """Cleanup-only deletion; absent keys are no-oped (admin only)."""
+        result = await self._adapter.admin_bulk_purge(body.parsed)
+        return APIResponse.build(status_code=HTTPStatus.OK, response_model=result)
+
+    # ── Self-service bulk writes (BEP-1052 §3) ───────────────────
 
-    async def admin_update(
+    async def my_bulk_create(
         self,
-        body: BodyParam[UpdateAppConfigFragmentInput],
+        body: BodyParam[BulkCreateMyAppConfigFragmentsInput],
     ) -> APIResponse:
-        """Update a fragment's `extra_config` (admin only)."""
-        result = await self._adapter.update(body.parsed)
+        """Self-service bulk create on the caller's `USER` row."""
+        result = await self._adapter.my_bulk_create(body.parsed)
         return APIResponse.build(status_code=HTTPStatus.OK, response_model=result)
 
-    async def admin_purge(
+    async def my_bulk_update(
         self,
-        body: BodyParam[PurgeAppConfigFragmentInput],
+        body: BodyParam[BulkUpdateMyAppConfigFragmentsInput],
     ) -> APIResponse:
-        """Hard-delete a fragment (admin only)."""
-        result = await self._adapter.purge(body.parsed)
+        """Self-service bulk update on the caller's `USER` row."""
+        result = await self._adapter.my_bulk_update(body.parsed)
         return APIResponse.build(status_code=HTTPStatus.OK, response_model=result)
 
 

src/ai/backend/manager/api/rest/v2/app_config_fragment/registry.py

@@ -1,4 +1,4 @@
-"""Route registration for v2 app-config fragment endpoints."""
+"""Route registration for v2 app-config fragment endpoints (BEP-1052 §4)."""
 
 from __future__ import annotations
 
@@ -19,17 +19,16 @@ def register_v2_app_config_fragment_routes(
 ) -> RouteRegistry:
     """Register all v2 app-config fragment routes (BEP-1052 §4).
 
-    - `POST /v2/app-config-fragments/get` reads a single row via body
-      (the natural key has three fields, so a body DTO is cleaner than
-      a long path).
-    - Scoped search mounts at
-      `/v2/app-config-fragments/{scope_type}/{scope_id}/search` per the
-      project's scoped-search URL convention.
-    - Admin cross-scope search, create / update / purge are admin-only.
+    - `POST /get` reads a single row via body (three-field natural key).
+    - Scoped search mounts at `/{scope_type}/{scope_id}/search`.
+    - Admin cross-scope search + bulk writes are admin-only.
+    - `/my/bulk-create` and `/my/bulk-update` are self-service writes
+      on the caller's `USER` row (no `/my/bulk-purge` — admin-only
+      cleanup per BEP-1052 §3).
     """
     reg = RouteRegistry.create("app-config-fragments", route_deps.cors_options)
 
-    # Read
+    # Reads
     reg.add("POST", "/get", handler.get, middlewares=[auth_required])
     reg.add(
         "POST",
@@ -38,9 +37,12 @@ def register_v2_app_config_fragment_routes(
         middlewares=[auth_required],
     )
     reg.add("POST", "/search", handler.admin_search, middlewares=[superadmin_required])
-    # Write
-    reg.add("POST", "", handler.admin_create, middlewares=[superadmin_required])
-    reg.add("POST", "/update", handler.admin_update, middlewares=[superadmin_required])
-    reg.add("POST", "/purge", handler.admin_purge, middlewares=[superadmin_required])
+    # Admin bulk writes (BEP-1052 §3 — bulk-only)
+    reg.add("POST", "/bulk-create", handler.admin_bulk_create, middlewares=[superadmin_required])
+    reg.add("POST", "/bulk-update", handler.admin_bulk_update, middlewares=[superadmin_required])
+    reg.add("POST", "/bulk-purge", handler.admin_bulk_purge, middlewares=[superadmin_required])
+    # Self-service bulk writes
+    reg.add("POST", "/my/bulk-create", handler.my_bulk_create, middlewares=[auth_required])
+    reg.add("POST", "/my/bulk-update", handler.my_bulk_update, middlewares=[auth_required])
 
     return reg