feat(BA-7731): carry the role's scope and the permission's bit in the responses

[HyeockJinKim]

Summary

• A role belongs to one scope since BA-7730, but nothing said which one on the way out. RoleNode, RoleGQL and the v1 RoleDTO now carry scope_type and scope_id, read off the row as an EntityType and an EntityID — no element enum stands between the column and the wire.
• A permission row answers with permission, the bit it actually holds. operation stays, carrying the same bit named as an action, and is deprecated.
• PermissionBitGQL moves from entity_share to the shared rbac scope module. entity_share imports rbac, so reading the enum back from rbac closed a circle. The enum is unreleased, so the move leaves the schema unchanged.

Schema changes

Every change is additive; the graphql-inspector check reports no breaking change.

+ permission: PermissionBit!   (Added in 26.9.0)
+ operation  @deprecated       (Deprecated since 26.9.0. Use `permission`.)
+ scopeType: String!           (Added in 26.9.0)
+ scopeId: UUID!               (Added in 26.9.0)

Not in scope

The v1 REST PermissionDTO and ObjectPermissionDTO keep operation alone. The v1 types module has no bit enum, and mirroring the deprecation there would make v1 depend on v2. Dropping the scope from the permission rows themselves is BA-7732.

Test plan

• pants lint and pants check --changed-dependents=transitive over the change set
• pants test --changed-since --changed-dependents=direct (11 targets)
• CI

Resolves BA-7731

🤖 Generated with Claude Code

https://claude.ai/code/session_013UiMJNt9dasPDtpBP7sSsC

---

📚 Documentation preview 📚: https://sorna--14446.org.readthedocs.build/en/14446/

---

📚 Documentation preview 📚: https://sorna-ko--14446.org.readthedocs.build/ko/14446/

[Copilot]

🟢 Approval recommended

The reviewed changes have no unresolved approval-blocking issues.

Pull request overview

Adds role scope metadata and exposes explicit permission bits while preserving the deprecated operation field.

Changes:

• Adds scope_type and scope_id to role responses.
• Adds permission and deprecates operation.
• Relocates the shared GraphQL permission enum.
• Updates adapters, DTOs, schemas, tests, and changelogs.

File summaries

File	Description
tests/unit/manager/api/gql/rbac/test_permission_mutations.py	Updates permission fixtures.
tests/unit/common/dto/manager/v2/rbac/test_response.py	Tests scope and permission response fields.
tests/unit/client_v2/test_rbac.py	Updates role response fixtures.
tests/unit/client_v2/test_rbac_client.py	Updates client fixtures.
src/ai/backend/manager/api/rest/rbac/role_adapter.py	Maps role scope into v1 responses.
src/ai/backend/manager/api/gql/rbac/types/scope.py	Hosts the shared permission-bit enum.
src/ai/backend/manager/api/gql/rbac/types/role.py	Exposes role scope fields.
src/ai/backend/manager/api/gql/rbac/types/permission.py	Exposes permission bits and deprecates operation.
src/ai/backend/manager/api/gql/entity_share/types.py	Reuses the shared permission-bit enum.
src/ai/backend/manager/api/adapters/rbac/adapter.py	Maps scope and permission data into DTOs.
src/ai/backend/common/dto/manager/v2/rbac/response.py	Extends v2 response models.
src/ai/backend/common/dto/manager/rbac/response.py	Extends v1 role responses.
docs/manager/graphql-reference/v2-schema.graphql	Updates the v2 GraphQL schema reference.
docs/manager/graphql-reference/supergraph.graphql	Updates the composed schema.
changes/14446.feature.md	Documents the new response fields.
changes/14446.deprecation.md	Documents the operation deprecation.

Review details

• Files reviewed: 16/16 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.