- Shipped
- August 5, 2026 at 5:49 AM UTC
- Author
- Kamo
- Commit
- 9131f2a
The geo section only ever denied: a country was blocked or it was absent. Orgs that want to serve one country had to enumerate every other one, which is unmaintainable and silently wrong the moment a new country code appears. org_geo_block_rules.is_blocked already existed and was hardcoded true, so an allow rule is that column set false — no schema change. Evaluation: an explicit block wins, then an allow list denies everything absent from it, and an empty allow list permits everything not blocked. That keeps existing block-only orgs behaving exactly as before. publishGeoRules now ships both sides of the rule set, since allow rules are load-bearing once one exists. Cached payloads written before this change carry no isBlocked field and survive the cache TTL across a deploy, so a missing field reads as blocked. Also scopes setBlocked and delete to the caller's org. delete previously resolved a rule by UUID alone, so an id from another tenant would have been honoured.