Fix bulk permissions request body field names

[oshchyhol]

Motivation

permissions.bulkPermissionsUpdate sends a request body the API does not understand: resourceType/accessLevel are sent camelCase instead of the resource_type/access_level wire names, and _destroy is built from permission._destroy (not part of the typed params) while the typed destroy field is ignored, so destroy requests are silently dropped. Rails strong params drop the unknown camelCase keys server-side, so the method could not create, update, or destroy any permission.

Changes

• map resourceId/resourceType/accessLevel params to the resource_id/resource_type/access_level wire names expected by PUT .../permissions/bulk
• build _destroy from the typed destroy param; remove the @ts-ignore that was hiding the bug
• type destroy as boolean to match the OpenAPI _destroy: boolean contract (was string; a string "false" would still destroy the permission server-side, a boolean false is safely ignored)
• assert the serialized request body in the bulk permissions tests

How to test

• permissions.bulkPermissionsUpdate(accessId, [{ resourceId, resourceType: "account", accessLevel: "viewer" }]) – the permission is actually created/updated with viewer access (previously the API received unknown camelCase keys and rejected the update)
• same call with destroy: true – the permission is destroyed (previously the _destroy flag never reached the API)
• same call with destroy: false – the permission is created/updated, not destroyed
• permissions.getResources() – unchanged

Companion PRs

• none – standalone fix found while working on MT-23076

Caveat: destroy changes from string to boolean in PermissionResourceParams. Since _destroy never reached the API before this fix, no caller can depend on the old string behavior.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ac9879bd-c166-4a00-9121-325c81d64d2d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}