refactor(api): write the web-app access mode through the enterprise gateway, keep the read protocol as on main

api/controllers/openapi/_app_settings.py

@@ -27,7 +27,9 @@ from enums import WebAppAccessMode
 from extensions.ext_application_services import application_services
 from models import AppMode
 from services.app_site_service import AppSiteAppNotFoundError, AppSiteChanges, AppSiteNotFoundError
+from services.enterprise.enterprise_service import EnterpriseService
 from services.entities.app_entities import AppFieldChanges, AppRecord
+from services.webapp_access_adapters import EnterpriseWebAppAccessPolicyGateway
 from services.webapp_access_query_service import WebAppAccessUnavailableError
 
 REGULAR_MODES: Final = (
@@ -41,6 +43,7 @@ REGULAR_MODES: Final = (
 _SETTABLE_ACCESS_MODES: Final = frozenset(
     {WebAppAccessMode.PUBLIC, WebAppAccessMode.PRIVATE_ALL, WebAppAccessMode.SSO_VERIFIED}
 )
+_ACCESS_POLICY: Final = EnterpriseWebAppAccessPolicyGateway(webapp_auth=EnterpriseService.WebAppAuth)
 
 
 class WebAppPath(StrEnum):
@@ -210,7 +213,7 @@ def update_webapp_access(ctx: Context, body: WebAppAccessPayload) -> WebAppAcces
     if body.access_mode not in _SETTABLE_ACCESS_MODES:
         raise WebAppAccessModeConsoleOnly()
     try:
-        application_services().webapp_access.update_access_mode(app_id=ctx.app.id, access_mode=body.access_mode)
+        _ACCESS_POLICY.update_access_mode(ctx.app.id, body.access_mode)
     except WebAppAccessUnavailableError as error:
         raise WebAppAccessUnavailable() from error
     return WebAppAccess(access_mode=body.access_mode)

api/services/webapp_access_adapters.py

@@ -42,7 +42,6 @@ class EnterpriseWebAppAccessPolicyGateway(WebAppAccessPolicyGateway):
         except ValueError as error:
             raise WebAppAccessUnavailableError from error
 
-    @override
     def update_access_mode(self, app_id: str, access_mode: WebAppAccessMode) -> None:
         try:
             self._webapp_auth.update_app_access_mode(app_id, access_mode)

api/services/webapp_access_query_service.py

@@ -15,8 +15,6 @@ class WebAppAccessQuery(Protocol):
 class WebAppAccessPolicyGateway(Protocol):
     def get_access_mode(self, app_id: str) -> WebAppAccessMode: ...
 
-    def update_access_mode(self, app_id: str, access_mode: WebAppAccessMode) -> None: ...
-
     def is_user_allowed(self, *, user_id: str, app_id: str) -> bool: ...
 
 
@@ -74,9 +72,6 @@ class WebAppAccessQueryService:
 
         return self._policy.get_access_mode(app_id)
 
-    def update_access_mode(self, *, app_id: str, access_mode: WebAppAccessMode) -> None:
-        self._policy.update_access_mode(app_id, access_mode)
-
     def find_app_id_by_code(self, app_code: str) -> str | None:
         return self._access.find_app_id_by_code(app_code)
 

api/tests/unit_tests/controllers/openapi/test_app_settings.py

@@ -32,13 +32,15 @@ def test_set_webapp_access_returns_the_written_mode_without_reading_back(monkeyp
     webapp_access = Mock()
     webapp_access.get_access_mode.side_effect = WebAppAccessUnavailableError()
     monkeypatch.setattr(_app_settings, "application_services", lambda: SimpleNamespace(webapp_access=webapp_access))
+    policy = Mock()
+    monkeypatch.setattr(_app_settings, "_ACCESS_POLICY", policy)
 
     result = _app_settings.update_webapp_access(
         _context(), WebAppAccessPayload(access_mode=WebAppAccessMode.PRIVATE_ALL)
     )
 
     assert result.access_mode == WebAppAccessMode.PRIVATE_ALL
-    webapp_access.update_access_mode.assert_called_once_with(app_id="app-1", access_mode=WebAppAccessMode.PRIVATE_ALL)
+    policy.update_access_mode.assert_called_once_with("app-1", WebAppAccessMode.PRIVATE_ALL)
 
 
 @pytest.mark.parametrize(