From 3c0dc478da17653eccd9f1b577214f0140c87226 Mon Sep 17 00:00:00 2001
From: Tyagiquamar <42589773+Tyagiquamar@users.noreply.github.com>
Date: Sun, 18 Oct 2026 22:45:34 +0530
Subject: [PATCH] fix(blueprints): hash basic-auth before header-auth delete

Compute the header-auth hash before deleting existing rows so
concurrent blueprint applies keep delete and insert adjacent.

Fixes #3835
---
 server/lib/blueprints/resourcePolicies.ts | 27 +++++++++++++++--------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/server/lib/blueprints/resourcePolicies.ts b/server/lib/blueprints/resourcePolicies.ts
index babb1c10a..ff4a47cc2 100644
--- a/server/lib/blueprints/resourcePolicies.ts
+++ b/server/lib/blueprints/resourcePolicies.ts
@@ -177,15 +177,7 @@ export async function updateResourcePolicies(
                 });
             }
 
-            // Sync header auth
-            await trx
-                .delete(resourcePolicyHeaderAuth)
-                .where(
-                    eq(
-                        resourcePolicyHeaderAuth.resourcePolicyId,
-                        resourcePolicyId
-                    )
-                );
+            // Sync header auth (hash before delete so delete+insert stay adjacent)
             if (policyData["basic-auth"]) {
                 const basicAuth = policyData["basic-auth"];
                 const headerAuthHash = await hashPassword(
@@ -193,12 +185,29 @@ export async function updateResourcePolicies(
                         `${basicAuth.user}:${basicAuth.password}`
                     ).toString("base64")
                 );
+                await trx
+                    .delete(resourcePolicyHeaderAuth)
+                    .where(
+                        eq(
+                            resourcePolicyHeaderAuth.resourcePolicyId,
+                            resourcePolicyId
+                        )
+                    );
                 await trx.insert(resourcePolicyHeaderAuth).values({
                     resourcePolicyId,
                     headerAuthHash,
                     extendedCompatibility:
                         basicAuth["extended-compatibility"] ?? true
                 });
+            } else {
+                await trx
+                    .delete(resourcePolicyHeaderAuth)
+                    .where(
+                        eq(
+                            resourcePolicyHeaderAuth.resourcePolicyId,
+                            resourcePolicyId
+                        )
+                    );
             }
 
             // Sync SSO roles