From 377aeba9c6bfdab9f2756c1ff7ab541c3254cc20 Mon Sep 17 00:00:00 2001
From: iroiro147 <sarthak.singh@mastersunion.org>
Date: Fri, 7 Aug 2026 08:40:12 +0530
Subject: [PATCH] test(conformance): supply d tag for workflow definitions
 after relay schema change
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The relay's handle_workflow_def now requires clients to supply the
workflow_id via a `d` tag and rejects definitions without one
("invalid: missing d tag (workflow_id)", command_executor.rs:668).
The workflow_trigger_is_community_confined conformance row was still
written against the older server-generates-the-id contract: it passed
only `h` + `name` tags and read the id out of the accept response.
Definitions were rejected at setup, so the isolation assertion (A's
workflow id can't be fired under B's community) never ran — a false red.

Update define_workflow to generate a fresh UUID locally, tag it via `d`
alongside `h` and `name`, and return it directly (no response parsing).
The trigger path already passes `d` with the same UUID, so no other
change is needed.

Refs #5101

Signed-off-by: iroiro147 <sarthak.singh@mastersunion.org>
---
 .../tests/conformance_multitenant.rs          | 37 ++++++++-----------
 1 file changed, 15 insertions(+), 22 deletions(-)

diff --git a/crates/buzz-test-client/tests/conformance_multitenant.rs b/crates/buzz-test-client/tests/conformance_multitenant.rs
index 4c8c8904ac..2a26cbabbf 100644
--- a/crates/buzz-test-client/tests/conformance_multitenant.rs
+++ b/crates/buzz-test-client/tests/conformance_multitenant.rs
@@ -1741,20 +1741,22 @@ mod workflows {
     }
 
     /// Define a workflow in `channel_id` on `http_base`'s community (kind:30620,
-    /// `h`=channel, content=YAML). Returns the **server-generated** workflow id,
-    /// parsed out of the OK message (`response:{"workflow_id":"…"}`). This id is
-    /// the tenant-scoped handle the trigger door confines: defined under A, it
-    /// only resolves under A.
+    /// `h`=channel, `d`=client-generated workflow id, content=YAML). Returns the
+    /// id (which the server now requires the client to supply; cf.
+    /// `handle_workflow_def` rejecting "missing d tag (workflow_id)"). That id
+    /// is the tenant-scoped handle the trigger door confines: defined under A,
+    /// it only resolves under A.
     async fn define_workflow(http_base: &str, keys: &Keys, channel_id: &str, name: &str) -> String {
-        // `h` binds the channel; `name` is required by `handle_workflow_def`
-        // (it rejects "missing workflow name" before parsing YAML). We use the
-        // `name` tag, not `d`: the server *generates* the workflow id, and that
-        // generated id — not any client-supplied `d` — is the handle this row
-        // confines. A `d` tag here would falsely imply the trigger resolves by
-        // client key.
+        // `h` binds the channel; `name` is required by `handle_workflow_def`.
+        // The current relay also requires the client to supply the workflow id
+        // via a `d` tag (previously it generated one server-side). We generate
+        // a fresh UUID per call and use it for both the definition and the
+        // subsequent trigger.
+        let workflow_id = uuid::Uuid::new_v4().to_string();
         let event = EventBuilder::new(Kind::Custom(KIND_WORKFLOW_DEF), workflow_yaml(name))
             .tags(vec![
                 Tag::parse(["h", channel_id]).unwrap(),
+                Tag::parse(["d", workflow_id.as_str()]).unwrap(),
                 Tag::parse(["name", name]).unwrap(),
             ])
             .sign_with_keys(keys)
@@ -1764,18 +1766,9 @@ mod workflows {
             body["accepted"].as_bool().unwrap_or(false),
             "workflow def not accepted against {http_base}: {body}"
         );
-        // The command executor returns `message: "response:{json}"` where json
-        // carries `workflow_id`. Extract it.
-        let msg = body["message"].as_str().unwrap_or_default();
-        let json_part = msg.strip_prefix("response:").unwrap_or_else(|| {
-            panic!("workflow def OK message missing `response:` prefix: {msg:?}")
-        });
-        let resp: serde_json::Value = serde_json::from_str(json_part)
-            .unwrap_or_else(|e| panic!("parse workflow def response json: {e} ({json_part:?})"));
-        resp["workflow_id"]
-            .as_str()
-            .unwrap_or_else(|| panic!("workflow def response missing workflow_id: {resp}"))
-            .to_string()
+        // The relay's success envelope echoes back the workflow_id we supplied;
+        // we no longer need to parse the response to learn it.
+        workflow_id
     }
 
     /// Fire a workflow by id on `http_base`'s community (kind:46020, `d`=id).