Assert the caller userId in the publish-note isolation test

[kentcdodds]

Summary

Last review point from #925, which merged before I could fold it in. CodeRabbit was right and it is worth fixing rather than leaving.

The cross-user test for repo_show_publish_note asserted the scoped lookup like this:

expect(mockModule.getEntitySourceByIdForUser).toHaveBeenCalledWith(
	expect.anything(),
	expect.objectContaining({ id: 'source-1' }),
)

objectContaining only checks the keys it names, so the assertion would still have passed if userId were omitted entirely or passed with the wrong value — which is the single thing that test exists to verify. Now it asserts the exact argument:

expect(mockModule.getEntitySourceByIdForUser).toHaveBeenCalledWith(
	expect.anything(),
	{ id: 'source-1', userId: 'user-1' },
)

One line, test-only, no production change.

Validation

npm run validate green in full: format:check, lint (1 pre-existing warning in sentry-tunnel.node.test.ts, 0 errors), typecheck, 1295 unit tests across 400 files, 18 Playwright E2E, 2 MCP E2E, backup:build, primitives:check, migrations:check.

System recap — composes existing primitives (low risk)

Mode: recap · Base: main @ 36edd717 · Head: 5d8adab9

Classification: composes — test-only assertion tightening. No production code, no primitive behaviour change.

Primitives touched

Primitive	Group	Impact
capability-registry	assistant	composes — test coverage only

Invariants

Strengthens the guard on per-user isolation rather than changing it: the repo-source lookup test now fails if the userId predicate is dropped from the query call.

  

Summary by CodeRabbit

• Tests
  • Updated access-control test expectations to verify that source lookups include both the source identifier and requesting user identifier.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5d7ee862-fb08-45a9-a53d-b851c8068aa7

📥 Commits

Reviewing files that changed from the base of the PR and between 36edd71 and 5d8adab.

📒 Files selected for processing (1)

• packages/worker/src/mcp/capabilities/repo/repo-show-publish-note.node.test.ts

---

📝 Walkthrough

Walkthrough

The cross-user access rejection test now asserts that getEntitySourceByIdForUser receives both the source ID and requesting user ID.

Changes

Repository access test

Layer / File(s)	Summary
User-scoped lookup assertion packages/worker/src/mcp/capabilities/repo/repo-show-publish-note.node.test.ts	The cross-user rejection test expects the source and requesting user identifiers in the lookup call.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• kentcdodds/kody#925: Updates the same test for user-scoped getEntitySourceByIdForUser arguments.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main test-only change: asserting the caller userId in the publish-note isolation test.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/sentry-k1-kody-mcp-caller-errors-6045

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔎 Preview deployed: https://kody-pr-927.kody-a99.workers.dev

Worker: kody-pr-927
D1: kody-pr-927-db
KV: kody-pr-927-oauth-kv

Mocks:

• cloudflare: https://kody-pr-927-mock-cloudflare.kody-a99.workers.dev/__mocks (kody-pr-927-mock-cloudflare)