From 69464b9a64b29f0365628902dfa2bfb8ae045d9d Mon Sep 17 00:00:00 2001
From: Daniel Sutton <dcsu@pm.me>
Date: Mon, 24 Aug 2026 12:23:53 +0100
Subject: [PATCH] fix(webapp): bound the fixed-length flag key IN filters

CI's oxlint flags an unbounded Prisma `in:` filter: the list length becomes
the bind-parameter count, so each distinct length is a separate prepared
statement. Both lists here are compile-time constants, but boundedIn is what
the neighbouring call sites use and it needs no suppression comment. It pads
to the next power of two by repeating the last key, which an IN over a unique
column does not notice.
---
 apps/webapp/app/v3/featureFlags.server.ts                    | 2 +-
 apps/webapp/app/v3/runOpsMigration/runOpsMintShard.server.ts | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/apps/webapp/app/v3/featureFlags.server.ts b/apps/webapp/app/v3/featureFlags.server.ts
index 7760df8fe..d45cdfd39 100644
--- a/apps/webapp/app/v3/featureFlags.server.ts
+++ b/apps/webapp/app/v3/featureFlags.server.ts
@@ -252,7 +252,7 @@ async function stampGracedGroups(
   graceMs: number
 ): Promise<Record<string, unknown>> {
   const existingRows = await tx.featureFlag.findMany({
-    where: { key: { in: GRACED_GLOBAL_KEYS } },
+    where: { key: { in: boundedIn(GRACED_GLOBAL_KEYS) } },
     select: { key: true, value: true },
   });
   const existingGlobal: Record<string, unknown> = {};
diff --git a/apps/webapp/app/v3/runOpsMigration/runOpsMintShard.server.ts b/apps/webapp/app/v3/runOpsMigration/runOpsMintShard.server.ts
index 02a432fb5..9a93eeb22 100644
--- a/apps/webapp/app/v3/runOpsMigration/runOpsMintShard.server.ts
+++ b/apps/webapp/app/v3/runOpsMigration/runOpsMintShard.server.ts
@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import type { ShardKey } from "@trigger.dev/core/v3/isomorphic";
-import { $replica } from "~/db.server";
+import { $replica, boundedIn } from "~/db.server";
 import { env } from "~/env.server";
 import { logger } from "~/services/logger.server";
 import { BoundedTtlCache } from "~/services/realtime/boundedTtlCache";
@@ -208,7 +208,7 @@ const liveCache = singleton("runOpsMintShardCache", (): { current: MintShardCach
 
 async function readSetFlags(): Promise<Record<string, unknown>> {
   const rows = await $replica.featureFlag.findMany({
-    where: { key: { in: GLOBAL_SHARD_KEYS } },
+    where: { key: { in: boundedIn(GLOBAL_SHARD_KEYS) } },
     select: { key: true, value: true },
   });
   const flags: Record<string, unknown> = {};