feat(BA-4525): Unify ScopeType/EntityType to RBACElementType in permission controller

[fregataa]

Summary

• Replace ScopeType and EntityType with unified RBACElementType at interface boundaries in the permission controller repository, service, and their direct GQL/REST callers
• Legacy types are bridged at DB row construction and ScopeId creation using to_scope_type() / to_entity_type() methods
• Move GLOBAL scope handling from repository to REST handler as an early-return (since RBACElementType has no GLOBAL value)

Test plan

• pants lint passes on changed files
• pants check passes (remaining errors are BA-4526 scope or pre-existing)
• pants test passes for permission controller tests

Resolves BA-4525

[Copilot]

Pull request overview

This PR aims to standardize RBAC “type” handling by replacing legacy ScopeType/EntityType at permission-controller boundaries with a unified RBACElementType, while bridging back to legacy enums at DB row construction and ID creation.

Changes:

• Switch permission-controller service/actions/repository APIs from ScopeType/EntityType to RBACElementType for scope/entity selection.
• Add bridging conversions (to_scope_type() / to_entity_type()) in creators/updaters/options and update GQL/REST adapters accordingly.
• Move GLOBAL scope search behavior out of repository and into the REST handler via an early return.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 18 comments.

Show a summary per file

File	Description
src/ai/backend/manager/services/permission_contoller/service.py	Returns unified RBACElementType lists and passes element types to repository.
src/ai/backend/manager/services/permission_contoller/actions/search_scopes.py	Renames action input from scope_type to element_type.
src/ai/backend/manager/services/permission_contoller/actions/get_scope_types.py	Changes action result payload to element_types: list[RBACElementType].
src/ai/backend/manager/services/permission_contoller/actions/get_entity_types.py	Changes action result payload to element_types: list[RBACElementType].
src/ai/backend/manager/repositories/permission_controller/updaters.py	Maps RBACElementType back to legacy enums when updating DB rows.
src/ai/backend/manager/repositories/permission_controller/role_manager.py	Updates system-role permission creation flow to use RBACElementType keys.
src/ai/backend/manager/repositories/permission_controller/repository.py	Updates search_scopes() to match on RBACElementType and removes GLOBAL handling from it.
src/ai/backend/manager/repositories/permission_controller/options.py	Converts query conditions to accept RBACElementType and bridge to legacy enums for DB filtering.
src/ai/backend/manager/repositories/permission_controller/db_source/db_source.py	Bridges role-permission updates by converting incoming legacy types to RBACElementType.
src/ai/backend/manager/repositories/permission_controller/creators.py	Changes creator specs to accept RBACElementType and bridge to legacy enums when building ORM rows.
src/ai/backend/manager/repositories/base/rbac/revoker.py	Changes revoker scope-type field to RBACElementType and converts to legacy for DB delete.
src/ai/backend/manager/repositories/base/rbac/granter.py	Changes granter scope-type field to RBACElementType and converts to legacy for DB insert.
src/ai/backend/manager/api/rest/rbac/permission_adapter.py	Converts REST request legacy enums to RBACElementType for create-permission actions.
src/ai/backend/manager/api/rest/rbac/object_permission_adapter.py	Converts REST request legacy EntityType to RBACElementType for object-permission actions.
src/ai/backend/manager/api/rest/rbac/handler.py	Adds GLOBAL early-return for scope search and converts element-types back to legacy DTO enums.
src/ai/backend/manager/api/rest/rbac/entity_adapter.py	Switches entity search querier builder to RBACElementType.
src/ai/backend/manager/api/gql/rbac/types/permission.py	Uses element types in conditions/creator/updater wiring.
src/ai/backend/manager/api/gql/rbac/types/entity.py	Uses element types in entity-scope filtering.

Comments suppressed due to low confidence (1)

src/ai/backend/manager/repositories/permission_controller/repository.py:310

• PermissionControllerRepository.get_global_scope() appears unused now (verified no call sites after GLOBAL handling moved to the REST handler). Consider removing it to avoid dead code, or routing the handler’s static GLOBAL response through this helper to avoid duplication.

    def get_global_scope(self) -> ScopeListResult:
        """Get the global scope as a static result."""
        return ScopeListResult(
            items=[
                ScopeData(

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jopemachine]

Please rebase the main branch, and resolve the conflict @fregataa