feat(rbac): agent RBAC/ACL scenes and resource-locator check bundles (#41768)

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

api/controllers/openapi/auth/data.py

@@ -6,7 +6,7 @@ from enum import StrEnum
 from pydantic import BaseModel, ConfigDict, Field
 from werkzeug.exceptions import InternalServerError
 
-from core.rbac import RBACPermission, RBACResourceScope
+from controllers.common.rbac import RBACCheck
 from libs.oauth_bearer import Scope, TokenType
 from models.account import Account, Tenant, TenantAccountRole
 from models.model import App, EndUser
@@ -25,23 +25,15 @@ class ExternalIdentity(BaseModel):
     issuer: str | None = None
 
 
-class RBACRequirement(BaseModel):
-    model_config = ConfigDict(frozen=True)
-
-    resource_type: RBACResourceScope
-    scene: RBACPermission
-    resource_required: bool = True
-
-
 class RequestContext(BaseModel):
-    model_config = ConfigDict(frozen=True)
+    model_config = ConfigDict(frozen=True, arbitrary_types_allowed=True)
 
     token_type: TokenType
     scope: Scope | None = None
     path_params: dict[str, str]
     workspace_membership: bool = False
     allowed_roles: frozenset[TenantAccountRole] | None = None
-    rbac: RBACRequirement | None = None
+    rbac: RBACCheck | None = None
 
 
 class AuthData(BaseModel):
@@ -58,7 +50,7 @@ class AuthData(BaseModel):
     path_params: dict[str, str] = Field(default_factory=dict)
 
     allowed_roles: frozenset[TenantAccountRole] | None = None
-    rbac: RBACRequirement | None = None
+    rbac: RBACCheck | None = None
 
     app: App | None = None
     tenant: Tenant | None = None