feat(BA-6837): authorize fragment reads via allow_list read_access tier

[jopemachine]

Summary

Enforces AppConfig read authorization (BA-6837, BEP-1052 / epic BA-5781) — the read-side mirror of BA-6836 (#12759). A config layer's fragments contribute to a caller's read only when the caller satisfies that layer's read_access tier (reusing AppConfigAccessLevel.is_satisfied_by). No RBAC validator; the allow-list access tiers are AppConfig's authorization system.

How

• Read query list_visible_fragments_bulk now selects each layer's read_access and returns VisibleFragment(data, read_access) instead of bare fragment data.
• resolve / resolve_bulk drop layers the caller may not read before merging (exact — these are the security-critical end-user paths). resolve_public (scope=None, requester=None) yields only read_access == public layers.
• scoped_search filters the returned page by each item's tier (looked up via by_config_and_scope, cached).
• Read actions carry the caller: requester=current_user() (authenticated resolve / scoped-search), requester=None (anonymous public).
• No route changes — middleware unchanged (resolve/scoped-search = auth, public = anonymous).

Default policy → behavior preserved

Default read_access (public=public, domain=authenticated, user=owner) matches the existing scope-visibility filter, so default reads are unchanged; only an admin-set non-default read_access (e.g. a public layer set to admin) further restricts.

Notes

• scoped_search gates the returned page post-fetch; total_count / has_next_page still reflect the visible-scope match count before the read_access gate (paginated counts are not re-derived) — documented in-code. The merged reads (resolve / public) filter fully, so they are exact.
• superadmin reads every layer; anonymous reads only public-read layers.

📚 Stacked PRs

Part of the AppConfigFragment / AppConfig stack under BEP-1052 (epic BA-5781). Merge in order:

1. ✅ feat(BA-6552): add app_config_fragments DB model and Alembic migration #12306 — feat(BA-6552): app_config_fragments DB model and Alembic migration
2. ✅ feat(BA-6553): add app_config_fragments repository layer #12307 — feat(BA-6553): repository layer
3. ✅ refactor(BA-6619): consolidate AppConfigScopeType into common.data (single definition) #12403 — refactor(BA-6619): consolidate AppConfigScopeType into common.data
4. ✅ refactor(BA-6620): ExistsQuerier ops primitive + AppConfigAllowList.exists #12405 — refactor(BA-6620): ExistsQuerier + AppConfigAllowList.exists
5. ✅ feat(BA-6554): add app_config_fragment service layer #12358 — feat(BA-6554): AppConfigFragment service layer
6. ✅ feat(BA-6702): move fragment rank to the allow list with scope defaults #12516 — feat(BA-6702): move fragment rank to the allow list with scope defaults
7. ✅ feat(BA-6701): expose allow-list rank on the v2 API surface #12517 — feat(BA-6701): expose allow-list rank on the v2 API surface
8. ✅ feat(BA-6704): cascade app config subtree deletion from the definition #12518 — feat(BA-6704): cascade app config subtree deletion from the definition
9. ✅ feat(BA-6626): app_config_fragment bulk repository layer #12426 — feat(BA-6626): app_config_fragment bulk repository layer
10. ✅ feat(BA-6618): app_config_fragment bulk CRUD service layer #12401 — feat(BA-6618): app_config_fragment bulk CRUD service layer
11. feat(BA-6810): AppConfigFragment visible-fragments query (repository layer) #12706 — feat(BA-6810): AppConfigFragment visible-fragments query (repository layer)
12. feat(BA-6834): AppConfig allow_list permission column (ro/rw, model + migration) #12794 — feat(BA-6834): AppConfig allow_list read/write access levels (model + migration) — read/write separation foundation
13. feat(BA-6555): AppConfig merge engine + resolve service (service layer) #12359 — feat(BA-6555): AppConfig merge engine + resolve service (service layer)
14. feat(BA-6556): AppConfig REST v2 API (raw fragments and merged read/update) #12377 — feat(BA-6556): AppConfig REST v2 API
15. feat(BA-6835): expose the allow_list permission on the v2 API #12756 — feat(BA-6835): expose read/write access level on the allow_list v2 API
16. feat(BA-6860): RBAC-gate app_config fragment writes at the processors #12759 — feat(BA-6836): authorize fragment writes via allow_list write_access tier
17. 👉 feat(BA-6837): authorize fragment reads via allow_list read_access tier #12764 — feat(BA-6837): authorize fragment reads via allow_list read_access tier ← you are here

AppConfig is treated as RBAC-Global with no RBAC validator; app_config_allow_list's access tiers are AppConfig's standalone authorization system. The access-level columns sit at the base so every layer above builds on the read/write-separated model.

[jopemachine]

Closing: read authorization is no longer a separate concern. In the finalized design, the allow-list carries a single permission (ro/rw) column (VFolder-style) and reads use the existing scope-visibility (public→everyone, domain→members, user→owner) with no per-config read policy. So there is no read_access to enforce — this PR's work is dropped. Write authorization (rw + scope owner) lives in #12759.