Skip to content

chore(release): staging to production - 2026.05.15#1077

Merged
ct3685 merged 2 commits into
productionfrom
staging
May 15, 2026
Merged

chore(release): staging to production - 2026.05.15#1077
ct3685 merged 2 commits into
productionfrom
staging

Conversation

@github-actions
Copy link
Copy Markdown

@github-actions github-actions Bot commented May 15, 2026

🚀 Release: Staging to Production

Release Date: 2026-05-15

Changes in this release


This PR is automatically created/updated when commits are pushed to staging.
Merging this PR will trigger the release workflow to create a new GitHub release.

@vercel
Copy link
Copy Markdown

vercel Bot commented May 15, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
answerai-docs Building Building Preview May 15, 2026 8:28pm
the-answerai Building Building Preview May 15, 2026 8:28pm

Request Review

## Root Cause

Same class of bug as PR #1075 but in `updateChatflow`.

The controller calls `getChatflowById(id, req.user.activeWorkspaceId)`
before saving. The admin's `activeWorkspaceId` is their Personal
Workspace — the template source chatflow lives in the Default Workspace
— so the service query returns null and throws "not found in the
database", blocking the save.

## Fix

One line: admins skip the workspace filter in the lookup, same pattern
as the GET controller.

```typescript
const isAdmin = req.user?.roles?.includes('Admin') || req.user?.permissions?.includes('org:manage')
const chatflow = await chatflowsService.getChatflowById(req.params.id, isAdmin ? undefined : workspaceId)
```

The service still does org-scoped access — it just doesn't add a
workspace filter to the SQL query for admins.

## Test Plan

- [ ] As an admin, open the default template canvas and save a change —
should succeed
- [ ] As a non-admin, saving a chatflow in a workspace they don't belong
to should still be blocked
@ct3685 ct3685 merged commit 868ef0e into production May 15, 2026
9 of 11 checks passed
@maxtechera maxtechera temporarily deployed to staging - aai-unified2-flowise-moonstruck May 15, 2026 21:10 — with Render Inactive
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants