feat(BA-6860): RBAC-gate app_config fragment writes at the processors

[jopemachine]

Summary

Gates AppConfig fragment writes with RBAC (BA-6860, BEP-1052 / epic BA-5781), completing the write-authorization path whose data layer landed in #12801 (BA-6859). The interim fixed-scope _may_write service check is gone — authorization now runs on the standard RBAC validators at the processor layer.

How

• Processors: the RBAC validators are attached to the write processors only — create → scope validator, update/purge → single-entity validator, bulk_* → bulk validator; validators is passed through the factory. Read processors (get / admin_search / scoped_search) carry no validator.
• Resolution: a caller may write when their role grants the operation on APP_CONFIG_FRAGMENT in the fragment's scope — a user in their own user scope (system role, auto-provisioned at user creation; the fragment→scope association from feat(BA-6859): bind app_config fragments to their RBAC scope on write (repository layer) #12801 resolves update/purge targets), a domain admin in their domain, a superadmin anywhere. public fragments are global-scoped (no RBAC scope) → superadmin-only.
• Routes: fragment POST /, PATCH /{id}, DELETE /{id} move from superadmin_required to auth_required; handler/adapter methods drop the admin_ prefix. Read routes unchanged.

Notes

• Reads stay allowlist/visibility-gated (no RBAC on the read path) — see the access model below.
• No data backfill: the feature is unreleased, so no pre-existing fragments or write paths exist.
• bulk_* service paths are validator-gated but not yet API-exposed.

📚 Stacked PRs

Part of the AppConfigFragment / AppConfig stack under BEP-1052 (epic BA-5781). Merge in order:

1. ✅ feat(BA-6552): add app_config_fragments DB model and Alembic migration #12306 — feat(BA-6552): app_config_fragments DB model and Alembic migration
2. ✅ feat(BA-6553): add app_config_fragments repository layer #12307 — feat(BA-6553): repository layer
3. ✅ refactor(BA-6619): consolidate AppConfigScopeType into common.data (single definition) #12403 — refactor(BA-6619): consolidate AppConfigScopeType into common.data
4. ✅ refactor(BA-6620): ExistsQuerier ops primitive + AppConfigAllowList.exists #12405 — refactor(BA-6620): ExistsQuerier + AppConfigAllowList.exists
5. ✅ feat(BA-6554): add app_config_fragment service layer #12358 — feat(BA-6554): AppConfigFragment service layer
6. ✅ feat(BA-6702): move fragment rank to the allow list with scope defaults #12516 — feat(BA-6702): move fragment rank to the allow list with scope defaults
7. ✅ feat(BA-6701): expose allow-list rank on the v2 API surface #12517 — feat(BA-6701): expose allow-list rank on the v2 API surface
8. ✅ feat(BA-6704): cascade app config subtree deletion from the definition #12518 — feat(BA-6704): cascade app config subtree deletion from the definition
9. ✅ feat(BA-6626): app_config_fragment bulk repository layer #12426 — feat(BA-6626): app_config_fragment bulk repository layer
10. ✅ feat(BA-6618): app_config_fragment bulk CRUD service layer #12401 — feat(BA-6618): app_config_fragment bulk CRUD service layer
11. feat(BA-6810): AppConfigFragment visible-fragments query (repository layer) #12706 — feat(BA-6810): AppConfigFragment visible-fragments query (repository layer)
12. feat(BA-6859): bind app_config fragments to their RBAC scope on write (repository layer) #12801 — feat(BA-6859): bind fragments to their RBAC scope on write (repository layer)
13. feat(BA-6555): AppConfig merge engine + resolve service (service layer) #12359 — feat(BA-6555): AppConfig merge engine + resolve service (service layer)
14. feat(BA-6556): AppConfig REST v2 API (raw fragments and merged read/update) #12377 — feat(BA-6556): AppConfig REST v2 API
15. 👉 feat(BA-6860): RBAC-gate app_config fragment writes at the processors #12759 — feat(BA-6860): RBAC-gate fragment writes at the processors ← you are here

Access model: fragment create/update/purge are gated by RBAC (a user writes their own user-scope fragment, a domain admin their domain's, a superadmin any — public is superadmin-only); reads are gated by the allow list (existence = readable layer, rank = merge order) plus scope visibility, with no RBAC on the read path; app_config_definitions / app_config_allow_list themselves are superadmin-only (REST + GQL). Closed / superseded: #12794 · #12756 · #12764.

---

📚 Documentation preview 📚: https://sorna--12759.org.readthedocs.build/en/12759/

---

📚 Documentation preview 📚: https://sorna-ko--12759.org.readthedocs.build/ko/12759/