From 7fd2502dd5cc28364be986c4bf2e8c89f954579c Mon Sep 17 00:00:00 2001
From: Jake Barnby <jakeb994@gmail.com>
Date: Fri, 3 Oct 2025 00:03:34 +1300
Subject: [PATCH] Block client bulk upsert txn

---
 .../Databases/Http/Databases/Transactions/Operations/Create.php  | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/Appwrite/Platform/Modules/Databases/Http/Databases/Transactions/Operations/Create.php b/src/Appwrite/Platform/Modules/Databases/Http/Databases/Transactions/Operations/Create.php
index 0aca3e3f7c..20cf79551c 100644
--- a/src/Appwrite/Platform/Modules/Databases/Http/Databases/Transactions/Operations/Create.php
+++ b/src/Appwrite/Platform/Modules/Databases/Http/Databases/Transactions/Operations/Create.php
@@ -87,6 +87,7 @@ class Create extends Action
             if (!$isAPIKey && !$isPrivilegedUser && \in_array($operation['action'], [
                 'bulkCreate',
                 'bulkUpdate',
+                'bulkUpsert',
                 'bulkDelete'
             ])) {
                 throw new Exception(Exception::USER_UNAUTHORIZED);