fix(dashboard): fetch all assignable policies to prevent dropping revocations

[arnav-1124]

What

Fetches all assignable policies by specifying { limit: 9999, fields: "id" } in useRbacAssignablePolicies when computing policy diffs during role permission editing.

Why

Fixes #16734. Previously, useRbacAssignablePolicies was called without pagination parameters, defaulting to limit: 20. Any existing policies beyond the first 20 were omitted from assignableIds and silently ignored when calculating policy revocations on submit.

How

• Added { limit: 9999, fields: "id" } to useRbacAssignablePolicies in edit-role-permissions-form.tsx.

Testing

• Verified that assignableIds contains the full list of policy IDs for diff calculations without truncation.

[changeset-bot]

🦋 Changeset detected

Latest commit: 8619f3f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 83 packages

Name	Type
@medusajs/dashboard	Major
@medusajs/draft-order	Major
@medusajs/loyalty-plugin	Major
@medusajs/admin-bundler	Major
@medusajs/medusa	Major
@medusajs/test-utils	Major
@medusajs/medusa-oas-cli	Major
integration-tests-http	Patch
@medusajs/analytics	Major
@medusajs/api-key	Major
@medusajs/auth	Major
@medusajs/caching	Major
@medusajs/cart	Major
@medusajs/currency	Major
@medusajs/customer	Major
@medusajs/file	Major
@medusajs/fulfillment	Major
@medusajs/index	Major
@medusajs/inventory	Major
@medusajs/link-modules	Major
@medusajs/locking	Major
@medusajs/notification	Major
@medusajs/order	Major
@medusajs/payment	Major
@medusajs/pricing	Major
@medusajs/product	Major
@medusajs/promotion	Major
@medusajs/rbac	Major
@medusajs/region	Major
@medusajs/sales-channel	Major
@medusajs/search	Major
@medusajs/settings	Major
@medusajs/stock-location	Major
@medusajs/store	Major
@medusajs/tax	Major
@medusajs/translation	Major
@medusajs/user	Major
@medusajs/workflow-engine-inmemory	Major
@medusajs/workflow-engine-redis	Major
@medusajs/search-postgres	Major
@medusajs/oas-github-ci	Major
@medusajs/cache-inmemory	Major
@medusajs/cache-redis	Major
@medusajs/event-bus-local	Major
@medusajs/event-bus-redis	Major
@medusajs/analytics-local	Major
@medusajs/analytics-posthog	Major
@medusajs/auth-emailpass	Major
@medusajs/auth-github	Major
@medusajs/auth-google	Major
@medusajs/auth-oidc	Major
@medusajs/caching-redis	Major
@medusajs/file-local	Major
@medusajs/file-s3	Major
@medusajs/fulfillment-manual	Major
@medusajs/locking-postgres	Major
@medusajs/locking-redis	Major
@medusajs/notification-local	Major
@medusajs/notification-sendgrid	Major
@medusajs/payment-stripe	Major
@medusajs/core-flows	Major
@medusajs/framework	Major
@medusajs/instantsearch-adapter	Major
@medusajs/js-sdk	Major
@medusajs/modules-sdk	Major
@medusajs/orchestration	Major
@medusajs/query	Major
@medusajs/types	Major
@medusajs/utils	Major
@medusajs/workflows-sdk	Major
create-medusa-app	Major
@medusajs/http-types-generator	Major
@medusajs/cli	Major
@medusajs/deps	Major
@medusajs/eslint-plugin	Major
@medusajs/telemetry	Major
@medusajs/admin-sdk	Major
@medusajs/admin-shared	Major
@medusajs/admin-vite-plugin	Major
@medusajs/icons	Major
@medusajs/toolbox	Major
@medusajs/ui-preset	Major
@medusajs/ui	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[medusa-os-bot]

Thanks for the contribution! A few items need to be addressed before this can move forward:

The PR fixes a real bug in the role-permissions edit form: useRbacAssignablePolicies was called without pagination parameters (defaulting to limit 20), so any assignable policies beyond the first 20 were absent from assignableIds and silently excluded from revocation calculations on submit. The fix adds { limit: 9999, fields: "id" } to ensure the full set of assignable IDs is available for the diff — the approach is sound and the scope is minimal. One blocking issue: the changeset file marks the @medusajs/dashboard package as a major bump, but this is a bug fix that does not remove any exports, change any public API signature, or alter documented behaviour. The bump type must be patch per the contribution guidelines. Non-blocking note: the 9999 cap is pragmatic and reasonable given typical RBAC policy counts, but it is a soft ceiling — an installation with more than 9,999 assignable policies would silently reproduce the bug. The existing code comment already documents the intent; no code change is required for this observation.

• .changeset/eighty-paths-train.md: changeset bump type is major but this is a bug fix with no API or behaviour change — change the bump type to patch.

Triggered by: new PR opened