From 85e49b3c4819d53967eae5a77cd8696cacf0a64c Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Sat, 1 Aug 2026 16:40:34 +0000 Subject: [PATCH] test: desynchronise the stored address so the guard pins the derivation --- backend/tests/preserve_on_behalf_of.rs | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/backend/tests/preserve_on_behalf_of.rs b/backend/tests/preserve_on_behalf_of.rs index 15eded753f..1720201cd7 100644 --- a/backend/tests/preserve_on_behalf_of.rs +++ b/backend/tests/preserve_on_behalf_of.rs @@ -2442,7 +2442,17 @@ async fn test_schedule_group_permissioned_as(db: Pool) -> anyhow::Resu "edited_by should be the deploying user, not the group" ); - // A group has no address of its own, so the synthetic one can only come from deriving it. + // Writes put the derived address in the column too, so a response that read the row would + // look identical to one that derived. Desynchronise them to tell the two apart: the reply + // must be the address `g/all` derives to, not the one sitting in the row. + sqlx::query!( + "UPDATE schedule SET email = 'stale@windmill.dev' WHERE path = $1 AND workspace_id = $2", + "u/test-user/schedule_group_perm", + "test-workspace" + ) + .execute(&db) + .await?; + let resp = authed( client().get(format!("{base}/schedules/get/u/test-user/schedule_group_perm")), "SECRET_TOKEN", @@ -2453,7 +2463,7 @@ async fn test_schedule_group_permissioned_as(db: Pool) -> anyhow::Resu assert_eq!( returned["email"].as_str(), Some("group-all@windmill.dev"), - "the schedule response derives the address from the principal" + "the schedule response derives the address from the principal, not from the column" ); Ok(())