# Flow Visibility Workaround Rollout

## Scope

Temporary workaround for `pingcap-inc/NexusCRM#1553` / `#2119`.

Target grants:

1. `FlowDefinition.PermissionsViewAllRecords = 1`
2. `Flow.PermissionsViewAllRecords = 1`

Target profiles:

1. `Standard User`
2. `Sales`
3. `Pre-Sales`
4. `Marketing`
5. `Finance`
6. `SDR`
7. `Alliance & Channel`
8. `Demand Gen Manager`
9. `Automated Process`
10. `PM`
11. `Tech Support`

Expected scope:

1. `11` profile-owned `PermissionSet`
2. `22` `ObjectPermissions` rows

Patch bundle:

1. `docs/migration/patch-bundles/20260529_flow_visibility_profile_workaround`

## Staging

Dispatch staging blue-green deploy with the dedicated patch bundle:

```bash
bash scripts/trigger_remote_staging_bluegreen.sh \
  main \
  docs/migration/patch-bundles/20260529_flow_visibility_profile_workaround
```

Or direct runtime entrypoint:

```bash
python3 deployments/offline/runtime/deploy_staging_env.py \
  --env staging \
  --patch-dir docs/migration/patch-bundles/20260529_flow_visibility_profile_workaround \
  --reload-nginx \
  --verify-public
```

Staging pass criteria:

1. patch artifact contains `updated_rows`
2. verify output shows `matched_rows = 22`
3. verify output shows `rows_with_view_all_records = 22`
4. one P1 user UI check no longer shows `Flow '<name>' not found or not active`
5. if the next failure is `Progress__c` or `Risk_and_Next_Step__c`, treat that as `#2118`

## Production

Only after staging passes.

Run the same SQL against prod DB using the same bundle files:

```bash
mysql \
  -h"$TIDB_PROD_HOST" \
  -P"${TIDB_PROD_PORT:-4000}" \
  -u"$TIDB_PROD_USER" \
  -p"$TIDB_PROD_PASSWORD" \
  "$TIDB_PROD_DATABASE" \
  < docs/migration/patch-bundles/20260529_flow_visibility_profile_workaround/001_grant_flow_viewallrecords_p1_p2_profiles.sql
```

Then verify:

```bash
mysql \
  -h"$TIDB_PROD_HOST" \
  -P"${TIDB_PROD_PORT:-4000}" \
  -u"$TIDB_PROD_USER" \
  -p"$TIDB_PROD_PASSWORD" \
  "$TIDB_PROD_DATABASE" \
  < docs/migration/patch-bundles/20260529_flow_visibility_profile_workaround/099_verify_flow_viewallrecords_p1_p2_profiles.sql
```

Production pass criteria:

1. `matched_rows = 22`
2. `rows_with_view_all_records = 22`
3. one non-admin P1/P2 user no longer hits the flow-not-found error

## Rollback

After upstream `#1553` lands in deployed runtime, revert the temporary grant:

```sql
UPDATE ObjectPermissions op
JOIN PermissionSet ps
  ON ps.Id = op.ParentId
 AND IFNULL(ps.IsOwnedByProfile, 0) = 1
JOIN Profile p
  ON p.Id = ps.ProfileId
SET
  op.PermissionsViewAllRecords = 0,
  op.LastModifiedDate = NOW()
WHERE op.SobjectType IN ('FlowDefinition', 'Flow')
  AND p.Name IN (
    'Standard User',
    'Sales',
    'Pre-Sales',
    'Marketing',
    'Finance',
    'SDR',
    'Alliance & Channel',
    'Demand Gen Manager',
    'Automated Process',
    'PM',
    'Tech Support'
  );
```

## Notes

1. this workaround is intentionally separate from `#2118`
2. current repo tree does not expose a tracked L2 source for these profile-owned `ObjectPermissions`, so this rollout is patch-bundle based
3. do not mix this bundle into the existing default staging restart bundle