From bc337820080895526449338a71ea1b6a1f00e9e6 Mon Sep 17 00:00:00 2001
From: "c1-dev-bot[bot]" <2740113+c1-dev-bot[bot]@users.noreply.github.com>
Date: Fri, 10 Apr 2026 15:42:32 +0000
Subject: [PATCH] fix: only check zero affected rows on first provisioning
 query
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The rowsAffected == 0 check in RunProvisioningQueries breaks multi-query
revoke configs. When a secondary query legitimately affects 0 rows (e.g.,
a conditional UPDATE that only fires when certain conditions are met), the
check triggers ErrQueryAffectedZeroRows, rolling back the entire
transaction including the successful first query. Revoke() then catches
this as GrantAlreadyRevoked and returns success — silently discarding
the work.

Fix: only apply the zero-rows check to the first query (index 0), which
represents the primary operation. Zero rows on the first query still
correctly signals "already granted/revoked." Secondary queries are
allowed to affect 0 rows without triggering rollback.

Fixes: CXH-1341
---
 pkg/bsql/query.go | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkg/bsql/query.go b/pkg/bsql/query.go
index 06ff670c..229ed19f 100644
--- a/pkg/bsql/query.go
+++ b/pkg/bsql/query.go
@@ -373,7 +373,7 @@ func (s *SQLSyncer) RunProvisioningQueries(ctx context.Context, queries, validat
 		}
 	}
 
-	for _, q := range queries {
+	for i, q := range queries {
 		q, qArgs, err := s.prepareProvisioningQuery(q, vars)
 		if err != nil {
 			return fmt.Errorf("failed to prepare query: %w", err)
@@ -393,7 +393,11 @@ func (s *SQLSyncer) RunProvisioningQueries(ctx context.Context, queries, validat
 			return ErrQueryAffectedMoreThanOneRow
 		}
 
-		if rowsAffected == 0 {
+		// Only check for zero affected rows on the first query.
+		// Secondary queries in a multi-query block may legitimately affect
+		// 0 rows (e.g., a conditional UPDATE that only applies when certain
+		// conditions are met).
+		if i == 0 && rowsAffected == 0 {
 			return ErrQueryAffectedZeroRows
 		}