Refactor superuser grant selection logic to prioritize the most recently updated grant

services/nginx/app/routes/subusersRoute.php

@@ -527,7 +527,7 @@ class subusersRoute
             fn (array $grantRow): array => $this->buildSuperuserGrantPayload($grantRow, $setupRequired),
             $this->dedupeSuperuserGrantRows($grantRows)
         );
-        $primaryGrant = $grants[0] ?? null;
+        $primaryGrant = $this->selectPrimarySuperuserGrant($grants);
 
         $accessState = 'inactive';
         if (array_filter($grants, static fn (array $grant): bool => $grant['access_state'] === 'active') !== []) {
@@ -618,6 +618,32 @@ class subusersRoute
         return (int)($right['grant_id'] ?? 0) <=> (int)($left['grant_id'] ?? 0);
     }
 
+    private function selectPrimarySuperuserGrant(array $grants): ?array
+    {
+        if ($grants === []) {
+            return null;
+        }
+
+        $sorted = $grants;
+        usort($sorted, static function (array $left, array $right): int {
+            $leftUpdated = strtotime((string)($left['grant_updated_at'] ?? $left['grant_created_at'] ?? '')) ?: 0;
+            $rightUpdated = strtotime((string)($right['grant_updated_at'] ?? $right['grant_created_at'] ?? '')) ?: 0;
+            if ($leftUpdated !== $rightUpdated) {
+                return $rightUpdated <=> $leftUpdated;
+            }
+
+            $leftCreated = strtotime((string)($left['grant_created_at'] ?? '')) ?: 0;
+            $rightCreated = strtotime((string)($right['grant_created_at'] ?? '')) ?: 0;
+            if ($leftCreated !== $rightCreated) {
+                return $rightCreated <=> $leftCreated;
+            }
+
+            return (int)($right['grant_id'] ?? 0) <=> (int)($left['grant_id'] ?? 0);
+        });
+
+        return $sorted[0];
+    }
+
     private function routePositiveInt(string $name): int
     {
         global $response;