Fix(query-builder): avoid dirtying saved queries on execution

[CarolineDenis]

Fixes #8614

Checklist

• Self-review the PR after opening it to make sure the changes look good and
  self-explanatory (or properly documented)
• Add relevant issue to release milestone
• Add pr to documentation list
• Add automated tests
• Add a reverse migration if a migration is present in the PR
• Add migration function to

  specify7/specifyweb/specify/management/commands/run_key_migration_functions.py

  Line 50 in ea04665

  def fix_schema_config(stdout: WriteToStdOut | None = None):

Testing instructions

• Open or created & save any query
• Run the query
• Click "Batch Edit"
• See batch edit opens

Summary by CodeRabbit

• Query Builder
  • Count-only runs now show result counts without changing the query’s saved settings.
  • Results and query export options now reflect whether the current run is count-only.
  • Sorting continues to update query fields and run the query normally.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6aa53a20-5da9-4176-a794-26d884156348

📥 Commits

Reviewing files that changed from the base of the PR and between b86cf66 and ae0d7b6.

📒 Files selected for processing (5)

• specifyweb/frontend/js_src/lib/components/QueryBuilder/QueryBuilderResults.tsx
• specifyweb/frontend/js_src/lib/components/QueryBuilder/ResultsWrapper.tsx
• specifyweb/frontend/js_src/lib/components/QueryBuilder/Wrapped.tsx
• specifyweb/frontend/js_src/lib/components/QueryBuilder/__tests__/useQueryExecution.test.tsx
• specifyweb/frontend/js_src/lib/components/QueryBuilder/useQueryExecution.ts

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The query execution hook now tracks count-only mode separately from the saved query. The results components use that state to control export-button visibility and determine whether to fetch rows.

Changes

Query Builder Count Mode

Layer / File(s)	Summary
Track query execution mode specifyweb/frontend/js_src/lib/components/QueryBuilder/useQueryExecution.ts, specifyweb/frontend/js_src/lib/components/QueryBuilder/__tests__/useQueryExecution.test.tsx	useQueryExecution initializes isCountOnly from query.countOnly and updates it when a query runs. The tests check count and regular execution without expecting the hook to update the saved query.
Resolve results count mode specifyweb/frontend/js_src/lib/components/QueryBuilder/ResultsWrapper.tsx	ResultsProps accepts an optional countOnly value. The wrapper resolves the value, includes it in the serialized query, and adds it to the effect dependencies.
Wire execution state to results specifyweb/frontend/js_src/lib/components/QueryBuilder/Wrapped.tsx, specifyweb/frontend/js_src/lib/components/QueryBuilder/QueryBuilderResults.tsx	Wrapped passes isCountOnly to QueryBuilderResults. The component uses it for export-button visibility and the results wrapper’s countOnly value. Sorting runs the regular query without passing updated fields to runQuery.

Sequence Diagram(s)

sequenceDiagram
  participant useQueryExecution
  participant Wrapped
  participant QueryBuilderResults
  participant ResultsWrapper
  useQueryExecution->>useQueryExecution: Set isCountOnly for the selected mode
  Wrapped->>QueryBuilderResults: Pass isCountOnly
  QueryBuilderResults->>ResultsWrapper: Pass countOnly
  ResultsWrapper->>ResultsWrapper: Resolve count-only mode

Loading

Suggested reviewers: grantfitzsimmons

Priority: ➖ Normal

Change: Bug fix · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to ae0d7

No confirmed issue blocks merging this Query Builder change after normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to ae0d7

Separating execution mode from saved queries avoids unintended changes without weakening the inspected access checks. Remaining uncertainty concerns mode consistency when an open query is replaced or requests overlap, rather than demonstrated unauthorized access.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The inspected server query path accepts client-supplied query data and optionally a collection identifier. It checks execute permission for the selected collection against the request user before execution. Its exposure is therefore not limited by the frontend count-mode toggle or assumed to be a single collection.

Trust Boundaries and Controls

• observed — The inspected CSV and KML endpoints retain execute plus export-specific permission checks. Batch-edit initiation still passes through get_query, while report execution retains its separate report-execute check. These server boundaries are unchanged by the PR; frontend export visibility is not their enforcement mechanism.
• observed — The inspected export dispatcher does not derive its operation from saved countOnly, and batch-edit row execution explicitly uses count_only=False. These consumers do not gain authority from the new local count-mode prop.

Resilience and Maintainability Implications

• observed — The results effect retains its existing promise-based completion and error handling without introducing cancellation or response-generation isolation. Failure or interruption no longer depends on reverting a count-mode write to the saved query, but overlapping-response ordering remains a pre-existing limitation rather than a demonstrated new security defect.

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: query execution no longer dirties saved queries.
Linked Issues check	✅ Passed	Issue #8614 requires Batch Edit to open after running a saved query without an unsaved-changes prompt. useQueryExecution now keeps run mode in local isCountOnly state instead of changing the query…
Out of Scope Changes check	✅ Passed	The changes are limited to query execution mode, result fetching, and related hook tests. These changes support the fix for issue #8614. No unrelated changes are evident.
Automatic Tests	✅ Passed	The PR updates the automated useQueryExecution test. It checks that count-mode execution sets local isCountOnly state without changing query.countOnly, and that an authorized run is deferred unt…
Testing Instructions	✅ Passed	The instructions cover the reported regression: open or create and save a query, run it, then click “Batch Edit” and verify that it opens. The changed execution hook no longer writes run state into th…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gabek96]

Testing instructions

• Open or created & save any query
• Run the query
• Click "Batch Edit"
• See batch edit opens

---

Screen.Recording.2026-10-05.at.8.43.47.AM.mov

Looks great! Everything is working as stated, I used the ojmnh2025_09_09

[rijulpoudel]

Testing instructions

• Open or created & save any query
• Run the query
• Click "Batch Edit"
• See batch edit opens

---

Batch edit opens fine!

[JDAM2k4]

Testing instructions

• Open or created & save any query
• Run the query
• Click "Batch Edit"
• See batch edit opens

---

Looks good! I can access batch edit from a query again.