feat(BA-5815): AppConfigPolicy GraphQL

changes/11269.feature.md

@@ -0,0 +1 @@
+Add `AppConfigPolicy` GraphQL surface (types / queries / bulk mutations) — admins can create / update / purge / list policies that gate AppConfigFragment writes via Strawberry GQL.

docs/manager/graphql-reference/supergraph.graphql

@@ -191,6 +191,91 @@ type AddRevisionPayload
   revision: ModelRevision!
 }
 
+"""
+Added in UNRELEASED. Per-item input for admin bulk create — `config_name` + initial `scope_sources`.
+"""
+input AdminAppConfigPolicyCreateItemInput
+  @join__type(graph: STRAWBERRY)
+{
+  """Unique, immutable policy name."""
+  configName: String!
+
+  """Ordered scope chain."""
+  scopeSources: [String!]!
+}
+
+"""
+Added in UNRELEASED. Per-item input for admin bulk update — target row id + new `scope_sources`.
+"""
+input AdminAppConfigPolicyUpdateItemInput
+  @join__type(graph: STRAWBERRY)
+{
+  """Policy row id."""
+  id: UUID!
+
+  """Ordered scope chain."""
+  scopeSources: [String!]!
+}
+
+"""Added in UNRELEASED. Payload for `adminBulkCreateAppConfigPolicies`."""
+type AdminBulkCreateAppConfigPoliciesPayload
+  @join__type(graph: STRAWBERRY)
+{
+  """Created policies."""
+  created: [AppConfigPolicy!]!
+
+  """Per-item failures."""
+  failed: [AppConfigPolicyBulkError!]!
+}
+
+"""Added in UNRELEASED. Admin bulk create input for app-config policies."""
+input AdminBulkCreateAppConfigPolicyInput
+  @join__type(graph: STRAWBERRY)
+{
+  """Policies to create."""
+  items: [AdminAppConfigPolicyCreateItemInput!]!
+}
+
+"""Added in UNRELEASED. Payload for `adminBulkPurgeAppConfigPolicies`."""
+type AdminBulkPurgeAppConfigPoliciesPayload
+  @join__type(graph: STRAWBERRY)
+{
+  """Ids of policies actually removed (absent ids no-oped)."""
+  purgedIds: [UUID!]!
+
+  """Per-item failures."""
+  failed: [AppConfigPolicyBulkError!]!
+}
+
+"""
+Added in UNRELEASED. Admin bulk purge input for app-config policies (keyed on row id).
+"""
+input AdminBulkPurgeAppConfigPolicyInput
+  @join__type(graph: STRAWBERRY)
+{
+  """Policy row ids to purge."""
+  ids: [UUID!]!
+}
+
+"""Added in UNRELEASED. Payload for `adminBulkUpdateAppConfigPolicies`."""
+type AdminBulkUpdateAppConfigPoliciesPayload
+  @join__type(graph: STRAWBERRY)
+{
+  """Updated policies."""
+  updated: [AppConfigPolicy!]!
+
+  """Per-item failures."""
+  failed: [AppConfigPolicyBulkError!]!
+}
+
+"""Added in UNRELEASED. Admin bulk update input for app-config policies."""
+input AdminBulkUpdateAppConfigPolicyInput
+  @join__type(graph: STRAWBERRY)
+{
+  """Policies to update."""
+  items: [AdminAppConfigPolicyUpdateItemInput!]!
+}
+
 """Added in 26.4.2. Admin input for creating a keypair for a user."""
 input AdminCreateKeypairInput
   @join__type(graph: STRAWBERRY)
@@ -895,6 +980,95 @@ type AllowedResourceGroupsPayload
   items: [String!]!
 }
 
+"""Added in UNRELEASED. Scoped app-config policy."""
+type AppConfigPolicy implements Node
+  @join__implements(graph: STRAWBERRY, interface: "Node")
+  @join__type(graph: STRAWBERRY)
+{
+  """The Globally Unique ID of this object"""
+  id: ID!
+
+  """Unique, immutable policy name."""
+  configName: String!
+
+  """Ordered scope chain (low → high merge priority)."""
+  scopeSources: [String!]!
+
+  """Creation timestamp."""
+  createdAt: DateTime!
+
+  """Last update timestamp."""
+  updatedAt: DateTime
+}
+
+"""Added in UNRELEASED. Per-item failure info for bulk Policy mutations."""
+type AppConfigPolicyBulkError
+  @join__type(graph: STRAWBERRY)
+{
+  """Original position in the input list."""
+  index: Int!
+
+  """Reason for the failure."""
+  message: String!
+}
+
+"""
+Added in UNRELEASED. Connection type for paginated app-config policy results.
+"""
+type AppConfigPolicyConnection
+  @join__type(graph: STRAWBERRY)
+{
+  """Pagination data for this connection"""
+  pageInfo: PageInfo!
+
+  """Contains the nodes in this connection"""
+  edges: [AppConfigPolicyEdge!]!
+
+  """Total number of policies matching the query."""
+  count: Int!
+}
+
+"""An edge in a connection."""
+type AppConfigPolicyEdge
+  @join__type(graph: STRAWBERRY)
+{
+  """A cursor for use in pagination"""
+  cursor: String!
+
+  """The item at the end of the edge"""
+  node: AppConfigPolicy!
+}
+
+"""Added in UNRELEASED. Filter input for querying app-config policies."""
+input AppConfigPolicyFilter
+  @join__type(graph: STRAWBERRY)
+{
+  """Filter by config_name."""
+  configName: StringFilter = null
+}
+
+"""Added in UNRELEASED. Specifies ordering for app-config policy results."""
+input AppConfigPolicyOrderBy
+  @join__type(graph: STRAWBERRY)
+{
+  """The field to order by."""
+  field: AppConfigPolicyOrderField!
+
+  """Sort direction."""
+  direction: OrderDirection! = DESC
+}
+
+"""
+Added in UNRELEASED. Fields available for ordering app-config policies.
+"""
+enum AppConfigPolicyOrderField
+  @join__type(graph: STRAWBERRY)
+{
+  CONFIG_NAME @join__enumValue(graph: STRAWBERRY)
+  CREATED_AT @join__enumValue(graph: STRAWBERRY)
+  UPDATED_AT @join__enumValue(graph: STRAWBERRY)
+}
+
 """
 Added in 24.09.0. Input for approving an artifact revision.
 
@@ -10867,6 +11041,21 @@ type Mutation
   """
   updateMyAllowedClientIp(input: UpdateMyAllowedClientIPInput!): UpdateMyAllowedClientIPPayload! @join__field(graph: STRAWBERRY)
 
+  """
+  Added in UNRELEASED. Strict insert keyed on `configName` (admin only, per-item transaction).
+  """
+  adminBulkCreateAppConfigPolicies(input: AdminBulkCreateAppConfigPolicyInput!): AdminBulkCreateAppConfigPoliciesPayload! @join__field(graph: STRAWBERRY)
+
+  """
+  Added in UNRELEASED. Replace `scope_sources`; `config_name` is immutable. Admin only, per-item transaction.
+  """
+  adminBulkUpdateAppConfigPolicies(input: AdminBulkUpdateAppConfigPolicyInput!): AdminBulkUpdateAppConfigPoliciesPayload! @join__field(graph: STRAWBERRY)
+
+  """
+  Added in UNRELEASED. Hard-delete policies by row id; rows still referenced by fragments surface in `failed`. Admin only.
+  """
+  adminBulkPurgeAppConfigPolicies(input: AdminBulkPurgeAppConfigPolicyInput!): AdminBulkPurgeAppConfigPoliciesPayload! @join__field(graph: STRAWBERRY)
+
   """Added in 26.3.0. Create a new query definition (admin only)"""
   adminCreatePrometheusQueryPreset(input: CreateQueryDefinitionInput!): CreateQueryDefinitionPayload! @join__field(graph: STRAWBERRY)
 
@@ -13384,6 +13573,16 @@ type Query
   """
   adminImageAliases(filter: ImageV2AliasFilter = null, orderBy: [ImageV2AliasOrderByGQL!] = null, before: String = null, after: String = null, first: Int = null, last: Int = null, limit: Int = null, offset: Int = null): ImageV2AliasConnection @join__field(graph: STRAWBERRY)
 
+  """
+  Added in UNRELEASED. Get a single app-config policy by row id. Available to any authenticated user.
+  """
+  appConfigPolicy(id: UUID!): AppConfigPolicy @join__field(graph: STRAWBERRY)
+
+  """
+  Added in UNRELEASED. List app-config policies with filtering and pagination. Available to any authenticated user.
+  """
+  appConfigPolicies(filter: AppConfigPolicyFilter = null, orderBy: [AppConfigPolicyOrderBy!] = null, first: Int = null, after: String = null, last: Int = null, before: String = null, limit: Int = null, offset: Int = null): AppConfigPolicyConnection! @join__field(graph: STRAWBERRY)
+
   """
   Added in 26.4.2. Get a single prometheus query preset by ID. Available to any authenticated user since presets are a shared catalog of metric query templates.
   """