@@ -5119,13 +5119,20 @@ describe('status mirror identity (#3783)', () => {
51195119 expect ( mirrorContext ( ) ) . toMatchObject ( { isSystem : true } ) ;
51205120 } ) ;
51215121
5122- it ( 'carries the actor WITHOUT org-scoping the write' , async ( ) => {
5123- // `tenantId` on an ExecutionContext is a driver-scoping knob, not
5124- // attribution: ObjectQL turns it into a tenant predicate on the update. The
5125- // submitter's org (`t1` on CTX) must therefore not ride along, or the mirror
5126- // would silently no-op on a record whose org differs from the request's.
5127- await open ( ) ;
5128- expect ( mirrorContext ( ) ) . not . toHaveProperty ( 'tenantId' ) ;
5129- expect ( mirrorContext ( ) ) . not . toHaveProperty ( 'organizationId' ) ;
5122+ it ( 'names the organisation it acts in, and carries no grants of its own (#24519)' , async ( ) => {
5123+ // Ruling 6271152775 on #24519 reverses what this pin used to assert: a
5124+ // named actor's mirror names its organisation through `tenantId`, so a
5125+ // `runAs:'user'` consumer resolves the actor's own request envelope in
5126+ // it. The organisation is the subject record's, read live; this fake
5127+ // engine exposes no schema, so the object has none of its own and the
5128+ // request's organisation stands in (`t1`, from the opening context), as
5129+ // it does for the request row's stamp. No `positions` / `permissions`
5130+ // ride along — a consumer would keep them verbatim — and no
5131+ // `organizationId`, which is not an envelope field. The record-organisation
5132+ // read and the end-to-end envelope are pinned in
5133+ // `status-mirror-envelope.integration.test.ts`.
5134+ const req = await open ( ) ;
5135+ expect ( req . organization_id ) . toBe ( 't1' ) ;
5136+ expect ( mirrorContext ( ) ) . toEqual ( { isSystem : true , userId : 'u1' , tenantId : 't1' } ) ;
51305137 } ) ;
51315138} ) ;
0 commit comments