fix(ZWEI-3796): pass includesDeletedRows for RESTORE permission check (#481)

nicola-smartive · cursoragent · web-flow · commit 77f97d089cb4 · 2026-05-28T07:20:05.000+02:00
getEntityToMutate must allow permission paths to match already-deleted
rows when restoring, same as list queries with deleted: true.

Co-authored-by: Cursor &lt;cursoragent@cursor.com&gt;
diff --git a/src/permissions/check.ts b/src/permissions/check.ts
@@ -108,7 +108,7 @@ export const getEntityToMutate = async (
     throw new NotFoundError(`${model.name} to ${action.toLowerCase()} not found`);
   }
 
-  applyPermissions(ctx, model.name, model.name, query, action);
+  applyPermissions(ctx, model.name, model.name, query, action, undefined, action === 'RESTORE');
   entity = await query;
   if (!entity) {
     throw new PermissionError(getRole(ctx), action, `this ${model.name}`, 'no available permissions applied');

Original file line number	Diff line number	Diff line change
`@@ -108,7 +108,7 @@ export const getEntityToMutate = async (`
`108`	`108`	throw new NotFoundError(`${model.name} to ${action.toLowerCase()} not found`);
`109`	`109`	`}`
`110`	`110`
`111`		`- applyPermissions(ctx, model.name, model.name, query, action);`
	`111`	`+ applyPermissions(ctx, model.name, model.name, query, action, undefined, action === 'RESTORE');`
`112`	`112`	`entity = await query;`
`113`	`113`	`if (!entity) {`
`114`	`114`	throw new PermissionError(getRole(ctx), action, `this ${model.name}`, 'no available permissions applied');