From d6690c376449bb66bbf8e9e6fa405de02b0e25da Mon Sep 17 00:00:00 2001 From: Codex Bot Date: Sun, 8 Nov 2026 01:24:53 +0800 Subject: [PATCH] Verify current-owner permissions before moved AI execution --- internal/platform/canvas_ai_model_integration_test.go | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/internal/platform/canvas_ai_model_integration_test.go b/internal/platform/canvas_ai_model_integration_test.go index 0e9ac66..a5d407a 100644 --- a/internal/platform/canvas_ai_model_integration_test.go +++ b/internal/platform/canvas_ai_model_integration_test.go @@ -522,4 +522,15 @@ func TestCanonicalAIAdmissionAndLifecycle(t *testing.T) { t.Fatal("deleting a moved target failed to revoke its old job") } + revoked := start(root, imageID, "image", 1) + mutate(func(model *canvasModel) { model.Elements[imageID]["ownerCanvasId"] = child }) + beforeRevoked := executions.Load() + if _, e = db.ExecContext(ctx, `UPDATE workspace_members SET role='viewer' WHERE project=$1 AND workspace_id=$2 AND account_id=$3`, project, workspace, account); e != nil { + t.Fatal(e) + } + execute(revoked["run_id"].(string)) + if result := call("GET", base(root)+"/ai/runs/"+revoked["run_id"].(string), nil, 200, 0, ""); result["status"] != "failed" || executions.Load() != beforeRevoked { + t.Fatal("moved target executed after write permission was revoked") + } + }