#3099 fix(security): require bundle.delete to set app_versions.deleted_at

Summary (AI generated)

• Block authenticated/anon (API key) app_versions updates that set deleted_at or deleted=true unless the caller has bundle.delete.
• Upload-scoped app_uploader keys keep the ability to update non-deletion fields on non-deleted rows.
• Service-role / internal writers can still soft-delete.

Motivation (AI generated)

app_versions UPDATE RLS allowed any principal with app.upload_bundle to write deleted_at on a live row. Setting deleted_at enqueues storage deletion via on_version_update, so an upload-only API key could destroy bundles it was never granted bundle.delete for.

Business Impact (AI generated)

Stops a privilege-escalation path from upload-scoped CI keys to bundle deletion. Customers who isolate upload keys from delete rights keep that isolation.

Test Plan (AI generated)

• Isolated-app regression: upload API key cannot set deleted_at
• Isolated-app regression: upload API key cannot set deleted=true
• Isolated-app regression: upload API key can still update non-deletion fields
• Isolated-app regression: app_admin (bundle.delete) can set deleted_at
• Isolated-app regression: service_role can still set deleted_at
• CI backend tests pass

Generated with AI

Made with Cursor

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Bug Fixes

  • Strengthened permissions for deleting application versions and bundles.
  • Upload-scoped keys can no longer modify deletion fields or bypass application scope restrictions.
  • Authorized bundle-delete and service roles can still perform soft deletes.
  • Standardized permission-denied errors for unauthorized deletion attempts.

• Tests

  • Added comprehensive coverage for deletion permissions, scope enforcement, allowed updates, and cleanup behavior.