fix(core): Shift existing rules on create to avoid order conflict#28722
Conversation
Creating a role mapping rule at an occupied order previously failed with a 409 conflict. The create path now splices the new rule into the target position and uses the existing two-phase applyOrder transaction to renumber contiguously. The create DTO accepts an optional order (append when omitted). Frontend omits order on create and serialises create calls so the backend appends in the user's intended order.
n8n-assistant
Bot
added
core
Bundle ReportChanges will decrease total bundle size by 6.91kB (-0.02%) ⬇️. This is within the configured threshold ✅ Detailed changes
Affected Assets, Files, and Routes:view changes for bundle: editor-ui-esmAssets Changed:
Files in
|
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
Adds integration coverage for inserting at a middle index (existing tests only covered head, tail, and over-end clamping) and for the instance/project order independence on (type, order). Adds Zod-level tests for the create DTO, including the new non-negative order rule.
…tance-role-mapping-rule
Performance ComparisonComparing current → latest master → 14-day baseline Memory consumption baseline with starter plan resources
docker-stats
Idle baseline with Instance AI module loaded
How to read this table
|
Omitting order on create broke reordering when a new local rule was dragged above existing persisted rules — the backend would append instead of respecting the user-intended position. The backend now safely shifts existing rules on order collision, so the frontend can always send the local order. Creates remain sequential to avoid concurrent temp-order collisions.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 8 files
Architecture diagram
sequenceDiagram
participant UI as Browser / Frontend
participant API as API Route / Controller
participant Service as RoleMappingRuleService
participant DB as Database (TypeORM)
Note over UI, DB: Rule Creation & Atomic Reordering Flow
UI->>UI: Prepare local changes (Delete, Update, Create)
par Deletes & Updates
UI->>API: DELETE /role-mapping-rule/:id
UI->>API: PATCH /role-mapping-rule/:id
end
loop NEW: Sequential Create (Prevent Race Conditions)
UI->>API: POST /role-mapping-rule { order, ... }
API->>Service: create(dto)
Service->>DB: Fetch existing rules for type (e.g., 'instance')
DB-->>Service: List of rules [A(0), B(1)]
Service->>Service: NEW: Clamp requested order to [0, length]
Service->>Service: NEW: Calculate tempOrder (max + 1)
Service->>DB: NEW: Insert new rule with tempOrder
Note right of DB: Avoids unique constraint conflict<br/>before reordering
DB-->>Service: Rule C saved
Service->>Service: CHANGED: Splice C into ID list at target index
Service->>DB: Start Transaction (applyOrder)
Note over Service, DB: Two-phase update to renumber sequence [0...N]
DB->>DB: Phase 1: Move rules to temporary sequence
DB->>DB: Phase 2: Assign final sequential orders
DB-->>Service: Commit
Service->>DB: Reload created rule
DB-->>Service: Rule C with final order
Service-->>API: Return Rule
API-->>UI: 201 Created
end
alt Invalid Order Input
UI->>API: POST /role-mapping-rule { order: -1 }
API-->>UI: 400 Bad Request (Zod Validation)
end
cstuncsik
requested review from
a team,
BGZStephen,
afitzek,
guillaumejacquart and
phyllis-noester
and removed request for
a team
Merging this PR will improve performance by 17.57%
Performance Changes
Comparing 
Footnotes
|
Instance AI Workflow Eval Results8/8 built | 8/27 passed (29%)
Failure detailspartial-action-failure [builder_issue]
invalid-email [builder_issue]
happy-path [builder_issue]
multi-team-creator [builder_issue]
no-cross-team-issues [builder_issue]
unknown-creator [builder_issue]
api-error [builder_issue]
high-volume
channel-not-found [builder_issue]
insufficient-permissions [builder_issue]
happy-path [builder_issue]
no-bugs [builder_issue]
high-priority [builder_issue]
medium-priority [builder_issue]
low-priority [builder_issue]
happy-path [builder_issue]
all-filtered [builder_issue]
happy-path [builder_issue]
no-alerts [builder_issue]
|
cstuncsik
deleted the
iam-560-fix-order-conflict-when-adding-instance-role-mapping-rule
branch
|
Got released with |
2 participants
Summary
Fixes a 409 conflict when creating a role mapping rule that lands on an already-occupied
order. The backend now splices the new rule into the requested position and atomically renumbers the sequence using the existing two-phaseapplyOrdertransaction. Omittingorderappends the rule; out-of-range values clamp to the end of the list.How to verify in the browser
Prerequisites: n8n running locally with SAML or OIDC provisioning licensed (
N8N_LICENSE_ACTIVATION_KEYor dev license), and an SSO config that uses Rules in n8n for role assignment.$claims.admin === true) and a role, then save the SSO config.1.,2.).Related Linear tickets, Github issues, and Community forum posts
https://linear.app/n8n/issue/IAM-560
Review / Merge checklist
Backport to Beta,Backport to Stable, orBackport to v1(if the PR is an urgent fix that needs to be backported)🤖 PR Summary generated by AI