Keep a security model's app grants off the catalog

Fixkamo-internal
Shipped
August 15, 2026 at 5:11 AM UTC
Author
kamo
Commit
9884a75

The Allowed Apps tab showed "Not Available" for every app and snapped back whenever another option was picked. loadModels() runs from a mount-only effect, so its mapBackendModel closed over the first render's serviceTypes — the platform app catalog, still empty because its fetch had not resolved. Hydration built appConfigs by mapping that array, so every model came back with no app configs at all and the persisted availability was discarded. The editor draws one row per catalog app, found no matching config, and fell back to NOT_AVAILABLE; updateAppConfig then mapped over the empty array, so a new selection had no row to land in. The payload went out empty too, and the backend reads an empty appConfigs list as "clear everything" — so saving a model from that screen wiped its grants. Hydrate straight off what the backend persisted instead. The catalog now only decides which rows get drawn and which ones a save states explicitly; it never decides what a model has. Config edits upsert so the first change to each app sticks, and the save payload carries through configs for apps the catalog no longer lists, which an unrelated save used to delete silently. Also fixes the list table's Apps column, which read 0 / N for every model.

All changes

Like what you see shipping?

Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.

Start Free ForeverView Pricing