Ruben Fiszel 9d9c5038ce fix(api): handle multi-version scripts when removing granular ACL (#9388) ...

* fix(api): handle multi-version scripts when removing granular ACL

remove_granular_acl built a CTE whose `old` subquery selects one row per
matching table row, then read it back via the scalar subquery
`(SELECT old_write FROM old)` in the RETURNING clause. For the `script`
table the PK is (workspace_id, hash), so a path with multiple deployed
versions yields several rows sharing the same (workspace_id, path). When
two or more versions carried the ACL key, `old` returned multiple rows and
PostgreSQL rejected the scalar subquery with "more than one row returned by
a subquery used as an expression", making it impossible to remove an ACL
entry from a script's permissions panel.

All versions share the same extra_perms value (the UPDATE applies to every
matching row), so any single row's old_write is representative. Add
`LIMIT 1` to the scalar subquery. Other kinds are unaffected because they
have a unique constraint on (workspace_id, path/name).

Introduced by b3603d872 (#7365). Add a regression test reproducing the
multi-version case at the SQL level.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: remove granular ACL regression test

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: trim ACL fix comment

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-01 06:55:24 +00:00

..

src

fix(api): handle multi-version scripts when removing granular ACL (#9388)

2026-06-01 06:55:24 +00:00

Cargo.toml

feat: folder default_permissioned_as rules for ownership defaults on deploy (#8801)

2026-04-12 20:14:07 +00:00