[hercemer42]

A single-record action triggered on several record ids now answers 422 ("This action can only be triggered on one record at a time.") instead of running on the first record and answering success. Same fix as the Node agent, ForestAdmin/agent-nodejs#2028.

Refs: PRD-1704

What changes

1. A single-record action on two or more ids. Before: the action ran on the first record only (ActionContextSingle#get_record reads get_records[0]) and answered success, so the other records were skipped and nobody was told. After: 422, and nothing runs.
2. The same request on an action that requires approval. Before: the agent asked for an approval, which later ran on the first record only. After: 422 at submit time, before the permission check, so no approval is asked for. Approving a request already stored with several ids answers 422 too.
3. A single-record action on a select-all selection. Before: it ran on whichever record came first. After: 422. The UI already disables single-record actions on a select-all, so it never sends this.
4. Loading a single-record action's form with several ids (/hooks/load, /hooks/change, /hooks/search). Before: the form loaded against the first record. After: 422.

A single-record action on exactly one id, and bulk and global actions, behave as before; a spec now pins the one-id case.

Definition of Done

General

• Write an explicit title for the Pull Request, following Conventional Commits specification
• Test manually the implemented changes
• Validate the code quality (indentation, syntax, style, simplicity, readability)

Security

• Consider the security impact of the changes made

Squash message

fix(agent): refuse a single-record action given several records [PRD-1704]

A single-record action triggered on several record ids ran on the first
record only and answered success, skipping the others silently; approving
an approval request naming several ids did the same.

The action route now answers 422 for a single-record action whose
selection names more than one id or is a select-all, before the
permission check, on execute and on the form hooks alike.

🤖 Generated with Claude Code

Note

Reject multi-record selections for SINGLE-scope actions in Actions routes

• Adds Routes::Action::Actions.ensure_single_record, which raises UnprocessableError when a SINGLE-scope action receives more than one ID or a select-all/exclusion selection.
• The check runs in get_record_selection right after parsing selection IDs, before condition-tree building, related-data filtering, permission approval, and form loading.
• Adds specs covering rejection of two IDs, select-all, and signed approval requests, plus successful execution with exactly one ID.
• Behavioral Change: requests that previously continued with multi-record selections on SINGLE actions now get a 422 error instead.

Changes since #417 opened

• Modified ForestAdminAgent::Routes::Action::Actions.ensure_single_record to reject selections that do not contain exactly one record ID for SINGLE-scope actions [e92ccd1]
• Added test coverage for empty selection rejection in SINGLE-scope action validation [e92ccd1]

^{Macroscope summarized 13185c0.}

[qltysh]

Coverage Impact

This PR will not change total coverage.

Modified Files with Diff Coverage (1)

Rating	File	% Diff	Uncovered Line #s
	...st_admin_agent/lib/forest_admin_agent/routes/action/actions.rb	100.0%
	Total	100.0%

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

[linear-code]

PRD-1704

[hercemer42]

Spec (PRD-1704): conforms.

[matthv]

Spec (PRD-1704): conforms.

[Scra3]

Approved after /validator run 417-20261022165454-Scra3: nothing blocking posted, 0 preferential or code style, 0 suppressed below all.

[forest-bot]

🎉 This PR is included in version 1.46.4 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀