Add automatic Diego sync callbacks to RouteAccessRule

- Add after_create and after_destroy callbacks to touch associated processes
- Updates process.updated_at to trigger Diego ProcessesSync immediately
- Eliminates 30-second wait for access rule changes to propagate to GoRouter
- Add comprehensive unit tests for callbacks and validations
- Ensure RouteAccessRule model is loaded in app/models.rb

This enables automatic synchronization of access rules to Diego/GoRouter
within seconds instead of requiring manual app restarts or waiting for
the next sync cycle.

Author: rkoster

app/models.rb

@@ -69,6 +69,7 @@
 require 'models/runtime/revision_sidecar_model'
 require 'models/runtime/revision_sidecar_process_type_model'
 require 'models/runtime/route'
+require 'models/runtime/route_access_rule'
 require 'models/runtime/space_routes'
 require 'models/runtime/space_quota_definition'
 require 'models/runtime/stack'

app/models/runtime/route_access_rule.rb

@@ -11,5 +11,27 @@ def validate
       validates_presence :selector
       validates_presence :route_id
     end
+
+    def after_create
+      super
+      touch_associated_processes
+    end
+
+    def after_destroy
+      super
+      touch_associated_processes
+    end
+
+    private
+
+    def touch_associated_processes
+      # Update the timestamp on all processes associated with this route
+      # This triggers Diego's ProcessesSync to pick up the route changes
+      return unless route
+
+      route.apps.each do |process|
+        process.update(updated_at: Time.now)
+      end
+    end
   end
 end

spec/unit/models/runtime/route_access_rule_spec.rb

@@ -0,0 +1,112 @@
+require 'spec_helper'
+
+module VCAP::CloudController
+  RSpec.describe RouteAccessRule, type: :model do
+    let(:space) { Space.make }
+    let(:domain) { SharedDomain.make(name: 'apps.identity') }
+    let(:route) { Route.make(space: space, domain: domain) }
+    let(:process) { ProcessModelFactory.make(space: space) }
+    let(:app_guid) { SecureRandom.uuid }
+
+    before do
+      RouteMappingModel.make(app: process, route: route, process_type: 'web')
+    end
+
+    describe 'validations' do
+      it 'requires a name' do
+        rule = RouteAccessRule.new(selector: 'cf:app:123', route: route)
+        expect(rule.valid?).to be false
+        expect(rule.errors[:name]).to include("can't be blank")
+      end
+
+      it 'requires a selector' do
+        rule = RouteAccessRule.new(name: 'test-rule', route: route)
+        expect(rule.valid?).to be false
+        expect(rule.errors[:selector]).to include("can't be blank")
+      end
+
+      it 'requires a route_id' do
+        rule = RouteAccessRule.new(name: 'test-rule', selector: 'cf:app:123')
+        expect(rule.valid?).to be false
+        expect(rule.errors[:route_id]).to include("can't be blank")
+      end
+    end
+
+    describe 'associations' do
+      it 'belongs to a route' do
+        rule = RouteAccessRule.create(
+          name: 'test-rule',
+          selector: 'cf:app:123',
+          route: route
+        )
+        expect(rule.route).to eq(route)
+      end
+    end
+
+    describe 'callbacks' do
+      describe 'after_create' do
+        it 'touches associated processes to trigger Diego sync' do
+          initial_updated_at = process.updated_at
+
+          # Sleep to ensure timestamp difference
+          sleep 0.1
+
+          RouteAccessRule.create(
+            name: 'test-rule',
+            selector: "cf:app:#{app_guid}",
+            route: route
+          )
+
+          process.reload
+          expect(process.updated_at).to be > initial_updated_at
+        end
+
+        it 'does not fail if route has no associated processes' do
+          route_without_processes = Route.make(space: space, domain: domain)
+
+          expect {
+            RouteAccessRule.create(
+              name: 'test-rule',
+              selector: "cf:app:#{app_guid}",
+              route: route_without_processes
+            )
+          }.not_to raise_error
+        end
+      end
+
+      describe 'after_destroy' do
+        it 'touches associated processes to trigger Diego sync' do
+          rule = RouteAccessRule.create(
+            name: 'test-rule',
+            selector: "cf:app:#{app_guid}",
+            route: route
+          )
+
+          process.reload
+          initial_updated_at = process.updated_at
+
+          # Sleep to ensure timestamp difference
+          sleep 0.1
+
+          rule.destroy
+
+          process.reload
+          expect(process.updated_at).to be > initial_updated_at
+        end
+
+        it 'does not fail if route has no associated processes' do
+          route_without_processes = Route.make(space: space, domain: domain)
+          rule = RouteAccessRule.create(
+            name: 'test-rule',
+            selector: "cf:app:#{app_guid}",
+            route: route_without_processes
+          )
+
+          expect {
+            rule.destroy
+          }.not_to raise_error
+        end
+      end
+    end
+  end
+end