# 20260707_account_sub_unit_fls

Grants field-level security (**READ + EDIT**) on `Account.Sub_Unit__c` to **every
profile-owned PermissionSet**, so end users can see and set the Sub-unit (APAC
PoD) value on the Account page.

## Symptom

A user (non-admin) opens an Account and the **Sub Unit** field renders **blank**,
even though it was placed on the layout. A read-only SOQL probe as a
non-admin user returns HTTP 400 for `SELECT ... WHERE Sub_Unit__c != null` (the
field is dropped / not accessible), while an admin can see and place the field.

## Root cause

`pingcap-inc/nexuscrm-pingcap-pack#3596` shipped the new field
`Account.Sub_Unit__c` (region-neutral picklist, replacing the live-only
`APAC_POD__c` drift field) and its layout placement, but did **not** ship any
`FieldPermissions`. In NexusCRM (Salesforce-compatible), a custom field with no
FLS row is invisible to non-admin profiles even after the pack deploys — the
field renders blank and is dropped from the query API for those users. Only
profiles carrying the `ViewAllData` / admin god-bit see it.

This is the same class of gap as the `FieldPermissions` grants shipped for
`Credits__c` (see
`20260531_staging_green_customsetting_column/007_credits_approval_and_permissions.sql`),
generalized to all profiles like `20260625_flow_visibility_all_profiles`.

## What this bundle does

`001_grant_account_sub_unit_fls_all_profiles.sql` inserts a `FieldPermissions`
row (`PermissionsRead=1`, `PermissionsEdit=1`) on `Account.Sub_Unit__c` for every
profile-owned PermissionSet (`IsOwnedByProfile = 1`). Matched by that flag, not
by hardcoded ids/names, so it covers newly-migrated profiles automatically.

- **Idempotent:** deterministic per-permset Id + `ON DUPLICATE KEY UPDATE`;
  re-running is a no-op.
- **Env-agnostic:** safe on staging or prod.
- FLS is inert without object + record access, so a broad grant is safe —
  record-level sharing still gates which Accounts a user can see/edit. Tighten
  `EDIT` to specific personas later if PoD becomes sharing-sensitive (batch 2
  virtual-lead sharing rule).

`099_verify_account_sub_unit_fls.sql` asserts (fail-closed) that **0**
profile-owned permsets are left without read on the field, plus a per-profile
readout.

## Apply path

Patch bundles are **not** auto-applied on every deploy. Replay this bundle
before the pack apply by triggering the staging deploy with:

```
patch_dir = docs/migration/patch-bundles/20260707_account_sub_unit_fls
```

(workflow: **Deploy Staging Single-Slot Environment** → `workflow_dispatch`
input `patch_dir`), **or** run the two `.sql` files directly against the staging
TiDB in sorted order.

**Order:** apply **staging first**, run `099` verify (headline count must be 0),
confirm the Sub Unit field now renders for a non-admin user, *then* prod through
the gated deploy. Do **not** trial against prod.

## Prerequisite

`Account.Sub_Unit__c` must already exist on the target env (deployed from PR
#3596). The pack field is orthogonal to this FLS grant — the field creation is
schema; this bundle is access.