feat(BA-6556): AppConfig REST v2 API (raw fragments and merged read/update)

[jopemachine]

Summary

Adds the AppConfig REST v2 API (BA-6556, BEP-1052 / epic BA-5781), mirroring the layered app_config_allow_list / app_config_definition stacks. This is the API surface over the fragment write/search service (BA-6554) and the merged-AppConfig read service (BA-6555).

Endpoints

METHOD	path	auth	operation
POST	/v2/app-config-fragments/	superadmin	create a fragment at any scope
GET	/v2/app-config-fragments/{fragment_id}	superadmin	get by id
PATCH	/v2/app-config-fragments/{fragment_id}	superadmin	update the config document
DELETE	/v2/app-config-fragments/{fragment_id}	superadmin	purge by id
POST	/v2/app-config-fragments/search	superadmin	paginated cross-scope search
POST	/v2/app-config-fragments/scoped-search	auth	fragments visible to the calling (domain, user)
POST	/v2/app-config/resolve	auth	merged AppConfig for a principal
GET	/v2/app-config/public/{config_name}	anonymous	public-only merged read (no auth middleware)

Layers

• DI wiring — register AppConfigFragmentRepositories + AppConfigService / AppConfigFragmentService + processors into Repositories / Services / Processors / factory.
• scoped_search — now principal-visibility aware: VisibleConfigTarget + AppConfigVisibleScope resolve to public + the principal's domain + the principal's own user fragment (reusing the by_*_visibility conditions), unconditional like resolve.
• public resolve — AppConfigService.resolve_public + list_public_fragments merge only public-scope fragments for an anonymous (pre-login) caller.
• API — shared AppConfigAdapter, v2 DTOs (app_config, app_config_fragment), route registries + tree wiring, AppConfigResolveNotAllowed (403).

Notes

• app_config processors carry no RBAC validator (per the agreed phase plan) — auth is gated at the REST route. resolve / scoped-search additionally reject a request whose user_id is not the authenticated caller, a temporary stand-in until the validator lands. domain is not yet guarded.
• GQL / SDK / CLI for AppConfig follow in subsequent PRs.

📚 Stacked PRs

Part of the AppConfigFragment / AppConfig stack under BEP-1052 (epic BA-5781). Merge in order:

1. ✅ feat(BA-6552): add app_config_fragments DB model and Alembic migration #12306 — feat(BA-6552): app_config_fragments DB model and Alembic migration
2. ✅ feat(BA-6553): add app_config_fragments repository layer #12307 — feat(BA-6553): repository layer
3. ✅ refactor(BA-6619): consolidate AppConfigScopeType into common.data (single definition) #12403 — refactor(BA-6619): consolidate AppConfigScopeType into common.data
4. ✅ refactor(BA-6620): ExistsQuerier ops primitive + AppConfigAllowList.exists #12405 — refactor(BA-6620): ExistsQuerier + AppConfigAllowList.exists
5. ✅ feat(BA-6554): add app_config_fragment service layer #12358 — feat(BA-6554): AppConfigFragment service layer
6. ✅ feat(BA-6702): move fragment rank to the allow list with scope defaults #12516 — feat(BA-6702): move fragment rank to the allow list with scope defaults
7. ✅ feat(BA-6701): expose allow-list rank on the v2 API surface #12517 — feat(BA-6701): expose allow-list rank on the v2 API surface
8. ✅ feat(BA-6704): cascade app config subtree deletion from the definition #12518 — feat(BA-6704): cascade app config subtree deletion from the definition
9. ✅ feat(BA-6626): app_config_fragment bulk repository layer #12426 — feat(BA-6626): app_config_fragment bulk repository layer
10. ✅ feat(BA-6618): app_config_fragment bulk CRUD service layer #12401 — feat(BA-6618): app_config_fragment bulk CRUD service layer
11. ✅ feat(BA-6810): AppConfigFragment visible-fragments query (repository layer) #12706 — feat(BA-6810): AppConfigFragment visible-fragments query (repository layer)
12. feat(BA-6886): register APP_CONFIG_FRAGMENT as an RBAC resource type #12856 — feat(BA-6886): register APP_CONFIG_FRAGMENT as an RBAC resource type + permission backfill
13. feat(BA-6859): bind AppConfig fragments to their RBAC scope on write (repository layer) #12826 — feat(BA-6859): bind fragments to their RBAC scope on write (repository layer)
14. fix(BA-6872): seed APP_CONFIG_FRAGMENT permissions into the RBAC role fixture #12837 — fix(BA-6872): seed APP_CONFIG_FRAGMENT permissions into the RBAC role fixture
15. chore(BA-6873): drop the dead APP_CONFIG RBAC entity type #12839 — chore(BA-6873): drop the dead APP_CONFIG RBAC entity type
16. feat(BA-6555): AppConfig merge engine + resolve service (service layer) #12359 — feat(BA-6555): AppConfig merge engine + resolve service (service layer)
17. 👉 feat(BA-6556): AppConfig REST v2 API (raw fragments and merged read/update) #12377 — feat(BA-6556): AppConfig REST v2 API ← you are here
18. feat(BA-6860): RBAC-gate app_config fragment writes at the processors #12759 — feat(BA-6860): fragment write API routes + bulk write authz

Access model: fragment create/update/purge are gated by RBAC (a user writes their own user-scope fragment, a domain admin their domain's, a superadmin any — public is superadmin-only); reads are gated by the allow list (existence = readable layer, rank = merge order) plus scope visibility, with no RBAC on the read path; app_config_definitions / app_config_allow_list themselves are superadmin-only (REST + GQL). Closed / superseded: #12794 · #12756 · #12764.

---

📚 Documentation preview 📚: https://sorna--12377.org.readthedocs.build/en/12377/

---

📚 Documentation preview 📚: https://sorna-ko--12377.org.readthedocs.build/ko/12377/

---

📚 Documentation preview 📚: https://sorna--12377.org.readthedocs.build/en/12377/

---

📚 Documentation preview 📚: https://sorna-ko--12377.org.readthedocs.build/ko/12377/

---

📚 Documentation preview 📚: https://sorna--12377.org.readthedocs.build/en/12377/

---

📚 Documentation preview 📚: https://sorna-ko--12377.org.readthedocs.build/ko/12377/

---

📚 Documentation preview 📚: https://sorna--12377.org.readthedocs.build/en/12377/

---

📚 Documentation preview 📚: https://sorna-ko--12377.org.readthedocs.build/ko/12377/

---

📚 Documentation preview 📚: https://sorna--12377.org.readthedocs.build/en/12377/

---

📚 Documentation preview 📚: https://sorna-ko--12377.org.readthedocs.build/ko/12377/

---

📚 Documentation preview 📚: https://sorna--12377.org.readthedocs.build/en/12377/

---

📚 Documentation preview 📚: https://sorna-ko--12377.org.readthedocs.build/ko/12377/