feat(BA-6837): authorize fragment reads via allow_list read_access tier

changes/12359.feature.md

@@ -0,0 +1 @@
+Add the app_config read service: resolve a user's merged AppConfig for one or many config names by rank-ordering the visible public / domain / user fragments and deep-merging them.

changes/12377.feature.md

@@ -0,0 +1 @@
+Add the AppConfig REST v2 API: admin CRUD and paginated search of raw config fragments, principal-scoped fragment search, the merged `(user, config_name)` resolve, and an anonymous public-only merged read (BEP-1052).

changes/12755.feature.md

@@ -0,0 +1 @@
+Add `read_access` / `write_access` access-level columns to the AppConfig allow list, decoupling read-enablement from write-authorization so a config layer's read and write audiences are explicit rather than implied by the allow-list row's existence (BEP-1052).

changes/12756.feature.md

@@ -0,0 +1 @@
+Expose the AppConfig allow-list `read_access` / `write_access` tiers on the v2 API (REST, GraphQL, SDK, CLI), so admins can set and re-policy who may read / write each config layer (BEP-1052).

changes/12759.feature.md

@@ -0,0 +1 @@
+Authorize AppConfig fragment writes against the allow-list `write_access` tier so a user can manage their own user-scope fragment while public/domain layers stay admin-only; fragment write endpoints move from superadmin-only to authenticated with per-write tier checks (BEP-1052).

changes/12764.feature.md

@@ -0,0 +1 @@
+Authorize AppConfig merged-config reads against the allow-list `read_access` tier so a config layer contributes to a caller's read only when the caller may read it; anonymous public reads expose only public-readable layers (BEP-1052).

docs/manager/graphql-reference/supergraph.graphql

@@ -887,6 +887,15 @@ type AllowedResourceGroupsPayload
   items: [String!]!
 }
 
+enum AppConfigAccessLevel
+  @join__type(graph: STRAWBERRY)
+{
+  PUBLIC @join__enumValue(graph: STRAWBERRY)
+  AUTHENTICATED @join__enumValue(graph: STRAWBERRY)
+  OWNER @join__enumValue(graph: STRAWBERRY)
+  ADMIN @join__enumValue(graph: STRAWBERRY)
+}
+
 """
 Added in 26.7.0. Permission to write config fragments for one config name at one scope type.
 """
@@ -908,6 +917,16 @@ type AppConfigAllowList implements Node
   """
   rank: Int!
 
+  """
+  Added in 26.8.0. Minimum principal tier allowed to read the fragments under this entry.
+  """
+  readAccess: AppConfigAccessLevel!
+
+  """
+  Added in 26.8.0. Minimum principal tier allowed to write the fragments under this entry.
+  """
+  writeAccess: AppConfigAccessLevel!
+
   """Creation timestamp (UTC)."""
   createdAt: DateTime!
 
@@ -3524,6 +3543,16 @@ input CreateAppConfigAllowListInput
   Added in 26.8.0. Merge rank applied to fragments under this entry (low to high; higher wins). Defaults to the scope type's default rank (public=100, domain=200, user=300).
   """
   rank: Int = null
+
+  """
+  Added in 26.8.0. Minimum principal tier allowed to read the fragments under this entry. Defaults to the scope type's default (public=public, domain=authenticated, user=owner).
+  """
+  readAccess: AppConfigAccessLevel = null
+
+  """
+  Added in 26.8.0. Minimum principal tier allowed to write the fragments under this entry. Defaults to the scope type's default (public=admin, domain=admin, user=owner).
+  """
+  writeAccess: AppConfigAccessLevel = null
 }
 
 """Added in 26.7.0. Payload for app config allow-list entry creation."""
@@ -19333,7 +19362,7 @@ input UpdateAllowedResourceGroupsForProjectInput
 }
 
 """
-Added in 26.8.0. Input for updating an app config allow-list entry (rank only).
+Added in 26.8.0. Input for updating an app config allow-list entry (rank / access tiers).
 """
 input UpdateAppConfigAllowListInput
   @join__type(graph: STRAWBERRY)
@@ -19345,6 +19374,16 @@ input UpdateAppConfigAllowListInput
   New merge rank applied to fragments under this entry (low to high; higher wins). Omit to leave unchanged.
   """
   rank: Int = null
+
+  """
+  New minimum principal tier allowed to read the fragments under this entry. Omit to leave unchanged.
+  """
+  readAccess: AppConfigAccessLevel = null
+
+  """
+  New minimum principal tier allowed to write the fragments under this entry. Omit to leave unchanged.
+  """
+  writeAccess: AppConfigAccessLevel = null
 }
 
 """Added in 26.8.0. Payload for app config allow-list entry update."""

docs/manager/graphql-reference/v2-schema.graphql

@@ -609,6 +609,13 @@ type AllowedResourceGroupsPayload {
   items: [String!]!
 }
 
+enum AppConfigAccessLevel {
+  PUBLIC
+  AUTHENTICATED
+  OWNER
+  ADMIN
+}
+
 """
 Added in 26.7.0. Permission to write config fragments for one config name at one scope type.
 """
@@ -627,6 +634,16 @@ type AppConfigAllowList implements Node {
   """
   rank: Int!
 
+  """
+  Added in 26.8.0. Minimum principal tier allowed to read the fragments under this entry.
+  """
+  readAccess: AppConfigAccessLevel!
+
+  """
+  Added in 26.8.0. Minimum principal tier allowed to write the fragments under this entry.
+  """
+  writeAccess: AppConfigAccessLevel!
+
   """Creation timestamp (UTC)."""
   createdAt: DateTime!
 
@@ -2345,6 +2362,16 @@ input CreateAppConfigAllowListInput {
   Added in 26.8.0. Merge rank applied to fragments under this entry (low to high; higher wins). Defaults to the scope type's default rank (public=100, domain=200, user=300).
   """
   rank: Int = null
+
+  """
+  Added in 26.8.0. Minimum principal tier allowed to read the fragments under this entry. Defaults to the scope type's default (public=public, domain=authenticated, user=owner).
+  """
+  readAccess: AppConfigAccessLevel = null
+
+  """
+  Added in 26.8.0. Minimum principal tier allowed to write the fragments under this entry. Defaults to the scope type's default (public=admin, domain=admin, user=owner).
+  """
+  writeAccess: AppConfigAccessLevel = null
 }
 
 """Added in 26.7.0. Payload for app config allow-list entry creation."""
@@ -13512,7 +13539,7 @@ input UpdateAllowedResourceGroupsForProjectInput {
 }
 
 """
-Added in 26.8.0. Input for updating an app config allow-list entry (rank only).
+Added in 26.8.0. Input for updating an app config allow-list entry (rank / access tiers).
 """
 input UpdateAppConfigAllowListInput {
   """App config allow-list entry id to update."""
@@ -13522,6 +13549,16 @@ input UpdateAppConfigAllowListInput {
   New merge rank applied to fragments under this entry (low to high; higher wins). Omit to leave unchanged.
   """
   rank: Int = null
+
+  """
+  New minimum principal tier allowed to read the fragments under this entry. Omit to leave unchanged.
+  """
+  readAccess: AppConfigAccessLevel = null
+
+  """
+  New minimum principal tier allowed to write the fragments under this entry. Omit to leave unchanged.
+  """
+  writeAccess: AppConfigAccessLevel = null
 }
 
 """Added in 26.8.0. Payload for app config allow-list entry update."""