From b5125190354d48ec60a6209f6e1c8a8ce61ff8b0 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 3 Sep 2026 04:29:18 +0000 Subject: [PATCH] test(approvals): pin tenant-admin `can_override` and `resumed` on pending recall The tenant-admin reverse check exercised the #3424 override recall but asserted neither of the two postures its platform-admin sibling pins: the `viewer.can_override` flag the gate is spelled against, and `resumed` down the reject branch. Mirror the platform-admin idiom in the same block: read the request as the tenant admin before the recall and assert the flag, then assert `out.resumed` after it. Test-only. No production code changes. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8 --- .../plugins/plugin-approvals/src/approval-revise.test.ts | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/packages/plugins/plugin-approvals/src/approval-revise.test.ts b/packages/plugins/plugin-approvals/src/approval-revise.test.ts index e0a7dc8da8..7f0cdf6518 100644 --- a/packages/plugins/plugin-approvals/src/approval-revise.test.ts +++ b/packages/plugins/plugin-approvals/src/approval-revise.test.ts @@ -482,8 +482,13 @@ describe('Send back for revision (ADR-0044)', () => { it('reverse check (tenant admin): admitted on `pending` too — the narrowing is about status, not posture', async () => { const { req, editAttempt } = await pendingRequest(); await expect(editAttempt()).rejects.toThrow(/RECORD_LOCKED/); // pending → locked + // The viewer flag the gate agrees with, read by the tenant admin itself. + const seen = await service.getRequest(req.id, TENANT_ADMIN); + expect(seen!.viewer!.can_override).toBe(true); + const out = await service.recall(req.id, { actorId: 'org_owner' }, TENANT_ADMIN); expect(out.request.status).toBe('recalled'); + expect(out.resumed).toBe(true); // resumed down the reject branch expect(await actionsOf(req.id)).toContain('recall'); await expect(editAttempt()).resolves.toBeUndefined(); // the #3424 release still happens });