feat(BA-4522): Add RBACElementType unified enum (#9030)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: fregataa

changes/9030.feature.md

@@ -0,0 +1 @@
+Add `RBACElementType` unified enum for BEP-1048 entity relationship model, replacing the separate `ScopeType` and RBAC-subset of `EntityType` with a single type.

src/ai/backend/common/data/permission/types.py

@@ -308,6 +308,55 @@ class ScopeType(enum.StrEnum):
 GLOBAL_SCOPE_ID = "global"
 
 
+class RBACElementType(enum.StrEnum):
+    """Unified element type for the RBAC scope-entity relationship model.
+
+    Each value identifies an element in the RBAC permission hierarchy
+    that can act as a scope (parent) or an entity (child) depending on
+    the relationship direction.
+
+    This enum replaces the separate ``ScopeType`` and RBAC-subset of
+    ``EntityType`` with a single unified type.
+    """
+
+    # === Scope hierarchy ===
+    DOMAIN = "domain"
+    PROJECT = "project"
+    USER = "user"
+
+    # === Root-query-enabled entities (scoped) ===
+    SESSION = "session"
+    VFOLDER = "vfolder"
+    DEPLOYMENT = "deployment"
+    MODEL_DEPLOYMENT = "model_deployment"
+    KEYPAIR = "keypair"
+    NOTIFICATION_CHANNEL = "notification_channel"
+    NETWORK = "network"
+    RESOURCE_GROUP = "resource_group"
+    CONTAINER_REGISTRY = "container_registry"
+    STORAGE_HOST = "storage_host"
+    IMAGE = "image"
+    ARTIFACT = "artifact"
+    ARTIFACT_REGISTRY = "artifact_registry"
+    SESSION_TEMPLATE = "session_template"
+    APP_CONFIG = "app_config"
+
+    # === Root-query-enabled entities (superadmin-only) ===
+    RESOURCE_PRESET = "resource_preset"
+    USER_RESOURCE_POLICY = "user_resource_policy"
+    KEYPAIR_RESOURCE_POLICY = "keypair_resource_policy"
+    PROJECT_RESOURCE_POLICY = "project_resource_policy"
+    ROLE = "role"
+    AUDIT_LOG = "audit_log"
+    EVENT_LOG = "event_log"
+
+    # === Auto-only entities used in permissions ===
+    NOTIFICATION_RULE = "notification_rule"
+
+    # === Entity-level scopes (for entity-scope permissions) ===
+    ARTIFACT_REVISION = "artifact_revision"
+
+
 class RelationType(enum.StrEnum):
     """Classification of parent-child entity edges in BEP-1048.