MT-23488: fix bulk permissions request body field names

[oshchyhol]

Motivation

MT-23488

permissions.bulkPermissionsUpdate didn't work at all. The request body was built with resourceType and accessLevel keys, but the API expects resource_type and access_level. Rails strong params drop unknown keys, so the API ignored the update. Destroy was broken too: _destroy was only sent when the caller passed an untyped _destroy field (hidden behind a @ts-ignore), and the typed destroy param did nothing.

Changes

• send resource_type and access_level instead of the camelCase keys in PUT .../permissions/bulk
• build _destroy from the typed destroy param, drop the @ts-ignore that was hiding the bug
• change destroy from string to boolean to match _destroy: boolean in the OpenAPI spec. With a string, destroy: "false" would still destroy the permission on the server; with a boolean, false simply isn't sent
• the bulk permissions tests now check the exact JSON body that goes out

How to test

• permissions.bulkPermissionsUpdate(accessId, [{ resourceId, resourceType: "account", accessLevel: "viewer" }]) – the permission is created/updated with viewer access. Before the fix the API dropped the camelCase keys and nothing changed
• the same call with destroy: true – the permission is destroyed. Before the fix the destroy flag never reached the API
• the same call with destroy: false – the permission is created/updated, not destroyed
• permissions.getResources() – still works as before

Caveat: destroy in PermissionResourceParams changes from string to boolean. Nobody can depend on the old type – _destroy never reached the API before this fix.

Summary by CodeRabbit

• Bug Fixes

  • Corrected bulk permission updates to send deletion flags as boolean values.
  • Improved request serialization to use the expected API field names.
  • Updated permission parameter validation to accept optional boolean deletion flags.

• Tests

  • Added coverage verifying serialized payloads for both permission update scenarios.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: df33d962-a453-4227-9c8c-3bf09bd3e6c4

📥 Commits

Reviewing files that changed from the base of the PR and between 85245f4 and 8885041.

📒 Files selected for processing (4)

• examples/general/permissions.ts
• src/__tests__/lib/api/resources/Permissions.test.ts
• src/lib/api/resources/Permissions.ts
• src/types/api/permissions.ts

---

📝 Walkthrough

Walkthrough

The permission update API now accepts boolean destroy values. It serializes permission fields with API snake_case names and adds tests for destruction and non-destruction payloads.

Changes

Permission update payload

Layer / File(s)	Summary
Permission payload contract and serialization src/types/api/permissions.ts, src/lib/api/resources/Permissions.ts	destroy now uses a boolean type. Bulk permission updates serialize resource_type, access_level, and conditional _destroy fields.
Payload tests and example usage src/__tests__/lib/api/resources/Permissions.test.ts, examples/general/permissions.ts	Tests verify serialized payloads for both permission cases. The example passes destroy: true.

Estimated code review effort: 2 (Simple) | ~10 minutes

Mergeability Score: ⚪ Minimal · up to 88850

This localized request-body fix is merge-ready after normal checks; no actionable merge-blocking risk remains, with only a follow-up to confirm the in-app example matches the updated boolean parameter.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: correcting bulk permissions request body field names.
Description check	✅ Passed	The description covers motivation, changes, testing steps, and caveats; only the optional Images and GIFs section is absent.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}