Catalog: cascade bucketRemove through cached Policy/Role permissions (#4855)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: nl0

catalog/CHANGELOG.md

@@ -18,6 +18,7 @@ where verb is one of
 
 ## Changes
 
+- [Fixed] Admin Users / Policies panels: drop phantom permission rows referencing a just-removed bucket (cache was not cascading the removal through `Policy.permissions` / `ManagedRole.permissions`) ([#4855](https://github.com/quiltdata/quilt/pull/4855))
 - [Changed] Migrate user-facing bucket queries to the new role-scoped `buckets` / `bucket` GraphQL type; admins in a scoped managed role now see only role-permitted buckets in navbar / listings / deep-links (admin panel unchanged) ([#4839](https://github.com/quiltdata/quilt/pull/4839))
 - [Fixed] Refresh navbar bucket selector after bucket removal and after policy / role / user-role edits that change the caller's managed-role bucket set ([#4839](https://github.com/quiltdata/quilt/pull/4839))
 - [Added] HubSpot tracking ([#4807](https://github.com/quiltdata/quilt/pull/4807))

catalog/app/utils/GraphQL/Provider.tsx

@@ -21,6 +21,10 @@ const USERS_QUERY = urql.gql`{ admin { user { list { name } } } }`
 const DEFAULT_ROLE_QUERY = urql.gql`{ defaultRole { id } }`
 
 // Invalidate all cached variants of a root Query field (args-aware).
+// Marks cached variants stale so the next read refetches; does NOT
+// reliably notify active subscribers on urql 2.x + graphcache 4.x.
+// Use refetchRootField when a subscriber must see the new data
+// without re-navigation.
 function invalidateRootField(cache: GraphCache.Cache, fieldName: string) {
   for (const f of cache.inspectFields('Query')) {
     if (f.fieldName === fieldName) {
@@ -221,6 +225,29 @@ export default function GraphQLProvider({ children }: React.PropsWithChildren<{}
                 R.evolve({ buckets: R.reject(R.propEq('name', vars.name)) }),
               )
               cache.invalidate({ __typename: 'Bucket', name: vars.name })
+              // Server cascade-deletes the PolicyBucketPermission /
+              // RoleBucketPermission rows for the removed bucket, but the
+              // cached entries (keyed {bucketName}/{id}) are not reachable
+              // via the Bucket-entity invalidation above — strip them from
+              // every cached Policy.permissions and ManagedRole.permissions
+              // array.
+              const stripBucket = R.reject(R.pathEq(['bucket', 'name'], vars.name))
+              cache.updateQuery(
+                {
+                  query: urql.gql`{ policies { id permissions { bucket { name } } } }`,
+                },
+                R.evolve({
+                  policies: R.map(R.evolve({ permissions: stripBucket })),
+                }),
+              )
+              cache.updateQuery(
+                {
+                  query: urql.gql`{ roles { id ... on ManagedRole { permissions { bucket { name } } } } }`,
+                },
+                R.evolve({
+                  roles: R.map(R.evolve({ permissions: stripBucket })),
+                }),
+              )
             },
             policyCreateManaged: (result, _vars, cache) => {
               const policy = result.policyCreateManaged as any