Skip to content

Commit c737d22

Browse files
committed
test(plugin-approvals): the mirror identity pin asserts the ruled organisation, not its absence
Claude-Session: https://claude.ai/code/session_01LR1cD9JqgkeqY7k9rrZH8s Co-authored-by: Claude <noreply@anthropic.com>
1 parent 2e76c1b commit c737d22

1 file changed

Lines changed: 15 additions & 8 deletions

File tree

‎packages/plugins/plugin-approvals/src/approval-service.test.ts‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5119,13 +5119,20 @@ describe('status mirror identity (#3783)', () => {
51195119
expect(mirrorContext()).toMatchObject({ isSystem: true });
51205120
});
51215121

5122-
it('carries the actor WITHOUT org-scoping the write', async () => {
5123-
// `tenantId` on an ExecutionContext is a driver-scoping knob, not
5124-
// attribution: ObjectQL turns it into a tenant predicate on the update. The
5125-
// submitter's org (`t1` on CTX) must therefore not ride along, or the mirror
5126-
// would silently no-op on a record whose org differs from the request's.
5127-
await open();
5128-
expect(mirrorContext()).not.toHaveProperty('tenantId');
5129-
expect(mirrorContext()).not.toHaveProperty('organizationId');
5122+
it('names the organisation it acts in, and carries no grants of its own (#24519)', async () => {
5123+
// Ruling 6271152775 on #24519 reverses what this pin used to assert: a
5124+
// named actor's mirror names its organisation through `tenantId`, so a
5125+
// `runAs:'user'` consumer resolves the actor's own request envelope in
5126+
// it. The organisation is the subject record's, read live; this fake
5127+
// engine exposes no schema, so the object has none of its own and the
5128+
// request's organisation stands in (`t1`, from the opening context), as
5129+
// it does for the request row's stamp. No `positions` / `permissions`
5130+
// ride along — a consumer would keep them verbatim — and no
5131+
// `organizationId`, which is not an envelope field. The record-organisation
5132+
// read and the end-to-end envelope are pinned in
5133+
// `status-mirror-envelope.integration.test.ts`.
5134+
const req = await open();
5135+
expect(req.organization_id).toBe('t1');
5136+
expect(mirrorContext()).toEqual({ isSystem: true, userId: 'u1', tenantId: 't1' });
51305137
});
51315138
});

0 commit comments

Comments
 (0)