fix(realtime): scope batch-add upserts to the caller's workflow

[waleedlatif1]

Summary

• Block, edge, and subflow ids are global primary keys, so the ON CONFLICT (id) DO UPDATE in batch-add-blocks / batch-add-edges could update a row that belongs to a different workflow than the socket's
• Added upsertWorkflowRows: setWhere: workflow_id = <socket workflow> confines the update to the caller's workflow, and a RETURNING id count check aborts the transaction when a conflict was skipped instead of dropping rows silently
• All seven upsert sites (blocks, default loop/parallel subflows, payload loops/parallels, edges in both handlers) go through the helper; default subflow rows are now one batched upsert instead of one per container block
• Same-workflow re-adds (undo/redo) still upsert; every client add path generates fresh ids, so legitimate traffic never hits the new rejection

Type of Change

• Bug fix (security)

Testing

• E2E against a real Postgres with the full schema, calling persistWorkflowOperation: block, edge, and loop ids owned by another workflow are rejected and the other workflow's rows are unchanged; a rejected batch commits none of its own rows; a normal add plus a same-workflow re-add still works. On the pre-fix code all six cross-workflow checks fail (other workflow's rows overwritten)
• apps/realtime type-check, biome, src/database vitest

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 10, 2026 7:56pm UTC

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Heads up: you’ve reached your flex budget. Increase your flex budget or wait for usage to reset.

Turn on auto-fix | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[Critical impact] The PR appears safe to merge; no actionable issues remain.

Summary

The PR prevents batch adds from overwriting rows owned by another workflow.

• Realtime adds only change rows in the caller’s workflow.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Batch add] --> B[Insert workflow rows]
  B --> C{ID already exists?}
  C -->|No| D[Insert row]
  C -->|Same workflow| E[Update row]
  C -->|Other workflow| F[Skip update]
  D --> G{Returned count matches input?}
  E --> G
  F --> G
  G -->|Yes| H[Continue transaction]
  G -->|No| I[Throw and roll back]

Loading

_{Reviews (2) · Last reviewed commit: "fix(realtime): type the scoped upsert he..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Heads up: you’ve reached your flex budget. Increase your flex budget or wait for usage to reset.

Turn on auto-fix | Re-trigger cubic</sub>