fix: keep cron update delivery validation scoped

steipete · steipete · commit 72bc9ae95231 · 2026-05-31T21:32:23.000-04:00
diff --git a/src/gateway/server-methods/cron.ts b/src/gateway/server-methods/cron.ts
@@ -166,16 +166,19 @@ function assertValidCronUpdatePatch(params: {
   currentJob: CronJob;
   patch: CronJobPatch;
 }) {
-  // Validate the post-patch job, not just the sparse patch, because delivery
-  // and payload/session fields can be split across existing state and patch.
+  // Apply the full patch so service-owned payload/session constraints are
+  // checked before mutation; configured-channel checks stay delivery-scoped so
+  // stale existing delivery does not block unrelated updates like disabling.
   const nextJob = structuredClone(params.currentJob);
   applyJobPatch(nextJob, params.patch, {
     defaultAgentId: params.defaultAgentId,
   });
-  assertValidCronAnnounceDelivery({
-    cfg: params.cfg,
-    delivery: nextJob.delivery,
-  });
+  if ("delivery" in params.patch) {
+    assertValidCronAnnounceDelivery({
+      cfg: params.cfg,
+      delivery: nextJob.delivery,
+    });
+  }
 }
 
 function resolveCronJobId(params: CronJobIdParams): string | undefined {
diff --git a/src/gateway/server-methods/cron.validation.test.ts b/src/gateway/server-methods/cron.validation.test.ts
@@ -608,6 +608,40 @@ describe("cron method validation", () => {
     expectResponseError(respond, { messageIncludes: "delivery.channel is required" });
   });
 
+  it("does not revalidate stale delivery config for unrelated updates", async () => {
+    setRuntimeConfig({
+      session: {
+        mainKey: "main",
+      },
+      channels: {
+        slack: {
+          botToken: "xoxb-slack-token",
+          appToken: "xapp-slack-token",
+        },
+      },
+      plugins: {
+        entries: {
+          slack: { enabled: true },
+        },
+      },
+    });
+
+    const { context, respond } = await invokeCronUpdate(
+      {
+        id: "cron-1",
+        patch: {
+          enabled: false,
+        },
+      },
+      createCronJob({
+        delivery: { mode: "announce", channel: "telegram", to: "telegram:123" },
+      }),
+    );
+
+    expect(context.cron.update).toHaveBeenCalledWith("cron-1", { enabled: false });
+    expect(respond).toHaveBeenCalledWith(true, { id: "cron-1" }, undefined);
+  });
+
   it("rejects target ids mistakenly supplied as delivery.channel providers", async () => {
     setRuntimeConfig({
       session: {
