fix(security): drop profile grants on the removed crm_competitor object

[yinlianghui]

Description

main is currently failing pnpm validate with four cross-reference errors — every profile that grants CRUD on crm_competitor points at an object that no longer exists:

✗ Permission 'marketing_user' grants on object 'crm_competitor' which is not defined in objects.
✗ Permission 'sales_manager' grants on object 'crm_competitor' which is not defined in objects.
✗ Permission 'sales_rep'     grants on object 'crm_competitor' which is not defined in objects.
✗ Permission 'system_admin'  grants on object 'crm_competitor' which is not defined in objects.

Reproduced on a clean checkout of main at 7f0b3ef4, so this is not specific to any open PR — but it turns every open PR's Build and Test red until it is fixed.

Root cause — a semantic conflict git could not see

Two merges disagreed on meaning while merging cleanly on text:

Time (UTC)	Event
01:50	#547 opened. crm_competitor existed on its base, so granting CRUD on it was correct.
06:50	#551 merged, reverting the demo-only competitor module and removing the crm_competitor object.
07:57	#547 merged — an hour after the object was gone, still carrying the grants.

#551 touched objects, views, navigation and seed data; #547 touched src/profiles/. No file overlapped, so git had nothing to conflict on and GitHub's mergeability check — which is textual — stayed green for both. Neither PR was wrong on its own; only their merge order was.

Changes

• Drop the crm_competitor grant from sales_rep, sales_manager, marketing_user and system_admin, and reword the surrounding comments that described the competitor catalog.
• The crm_opportunity.competitors picklist field is unrelated and stays — it never referenced the removed object. (revert: remove demo-only contract kanban and competitor module (#532 follow-up) #551 deliberately restored it as the hardcoded select.)

Verification

On a clean checkout with this fix applied:

• pnpm validate — clean: 15 Objects / 309 Fields, 6 Permissions, 12 Positions. The only remaining output is the two pre-existing campaign_enrollment flow-variable warnings, which are expected and documented as safe to ignore.
• pnpm typecheck — clean.
• pnpm test — 128/128 passing (11 files).

Type of Change

• Bug fix (non-breaking change which fixes an issue)

Checklist

• pnpm validate passes
• pnpm typecheck passes
• pnpm test passes
• Changeset added

Refs #547, refs #551. No new issue filed: this is the mechanical consequence of the two merges above, not a product defect. The removed demo module itself is archived at tag demo-series-2026-07 if it is ever needed again.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
hotcrm	Ignored		Jul 30, 2026 8:37am