From ceecea147d470b2e711f74aedb066854c16b440b Mon Sep 17 00:00:00 2001 From: Ettore Di Giacinto Date: Wed, 4 Nov 2026 10:19:45 +0000 Subject: [PATCH] test(studio): the allowlist does not pass the gate of an auto trigger that acts The gate behind the auto start of a trigger with acts asks about a capability that is not sensitive, with the Sensitive mark. Pin that an allowlisted sender alone is refused and a paired one passes. Assisted-by: Claude:claude-sonnet-5-5 --- core/services/studio/connectors_enforce_test.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/core/services/studio/connectors_enforce_test.go b/core/services/studio/connectors_enforce_test.go index 822ddaeb50..ec174fb82f 100644 --- a/core/services/studio/connectors_enforce_test.go +++ b/core/services/studio/connectors_enforce_test.go @@ -194,6 +194,12 @@ var _ = Describe("permissions in the turns of a connector chat", func() { Expect(req(studio.CapabilityRequest{Capability: contract.CapProposalsConfirm, Sender: "11", Sensitive: true})).To(BeFalse(), "neither does the allowlist") Expect(req(studio.CapabilityRequest{Capability: contract.CapProposalsConfirm, Sender: "12", Sensitive: true})).To(BeTrue(), "a pairing does") Expect(req(studio.CapabilityRequest{Capability: contract.CapProposalsConfirm, Sender: "12"})).To(BeTrue(), "paired") + // The gate behind the auto start of a trigger that acts asks about a + // capability that is not sensitive, with the Sensitive mark: the + // allowlist must not pass it, only a pairing. + Expect(req(studio.CapabilityRequest{Capability: contract.CapTriggersPropose, Sender: "11"})).To(BeTrue(), "the allowlist holds a capability that is not sensitive") + Expect(req(studio.CapabilityRequest{Capability: contract.CapTriggersPropose, Sender: "11", Sensitive: true})).To(BeFalse(), "but not when the request is marked sensitive") + Expect(req(studio.CapabilityRequest{Capability: contract.CapTriggersPropose, Sender: "12", Sensitive: true})).To(BeTrue(), "a pairing passes") Expect(gate.Allow(ctx, studio.CapabilityRequest{Capability: contract.CapProposalsConfirm, Binding: "nope", Sender: "12"})).To(BeFalse()) Expect(gate.Allow(ctx, studio.CapabilityRequest{Capability: contract.CapProposalsConfirm, Binding: b.ID, Owner: "mallory", Sender: "12"})).To(BeFalse()) })