fix: review comments

api/tests/test_workflow_run_creation.py

@@ -78,3 +78,69 @@ async def test_prepare_inputs_falls_back_to_published_when_draft_missing():
         "name": "explicit",
         "published_only": "kept",
     }
+    workflow_client.get_draft_version.assert_awaited_once_with(33)
+
+
+@pytest.mark.asyncio
+async def test_prepare_inputs_uses_current_definition_when_released_missing():
+    workflow = _workflow()
+    workflow.released_definition = None
+    workflow.current_definition = SimpleNamespace(
+        id=66,
+        template_context_variables={"name": "current", "current_only": "kept"},
+    )
+    workflow_client = SimpleNamespace(get_draft_version=AsyncMock())
+
+    run_inputs = await prepare_workflow_run_inputs(
+        workflow_client,
+        workflow,
+        include_template_context=True,
+    )
+
+    assert run_inputs.definition_id == 66
+    assert run_inputs.initial_context == {
+        "name": "current",
+        "current_only": "kept",
+    }
+    workflow_client.get_draft_version.assert_not_awaited()
+
+
+@pytest.mark.asyncio
+async def test_prepare_inputs_falls_back_to_workflow_template_context_when_definition_context_is_none():
+    workflow = _workflow()
+    workflow.released_definition = SimpleNamespace(
+        id=77,
+        template_context_variables=None,
+    )
+    workflow_client = SimpleNamespace(get_draft_version=AsyncMock())
+
+    run_inputs = await prepare_workflow_run_inputs(
+        workflow_client,
+        workflow,
+        include_template_context=True,
+    )
+
+    assert run_inputs.definition_id == 77
+    assert run_inputs.initial_context == {
+        "name": "workflow",
+        "workflow_only": "kept",
+    }
+
+
+@pytest.mark.asyncio
+async def test_prepare_inputs_respects_empty_definition_template_context():
+    workflow = _workflow()
+    workflow.released_definition = SimpleNamespace(
+        id=77,
+        template_context_variables={},
+    )
+    workflow_client = SimpleNamespace(get_draft_version=AsyncMock())
+
+    run_inputs = await prepare_workflow_run_inputs(
+        workflow_client,
+        workflow,
+        include_template_context=True,
+    )
+
+    assert run_inputs.definition_id == 77
+    assert run_inputs.initial_context == {}

api/tests/test_workflow_versioning.py

@@ -640,3 +640,35 @@ class TestRunDefinitionBinding:
             "company_name": "Override Co",
             "provider": "smallwebrtc",
         }
+
+    async def test_run_rejects_definition_from_another_workflow(
+        self, db_session, org_and_user
+    ):
+        """The DB client must not bind a run to another workflow's definition."""
+        org, user = org_and_user
+        workflow_a = await db_session.create_workflow(
+            name="Workflow A",
+            workflow_definition=GRAPH_V1,
+            user_id=user.id,
+            organization_id=org.id,
+        )
+        workflow_b = await db_session.create_workflow(
+            name="Workflow B",
+            workflow_definition=GRAPH_V2,
+            user_id=user.id,
+            organization_id=org.id,
+        )
+        workflow_b_versions = await db_session.get_workflow_versions(workflow_b.id)
+        workflow_b_definition = next(
+            v for v in workflow_b_versions if v.status == "published"
+        )
+
+        with pytest.raises(ValueError, match="does not belong"):
+            await db_session.create_workflow_run(
+                name="Bad Run",
+                workflow_id=workflow_a.id,
+                mode="smallwebrtc",
+                user_id=user.id,
+                organization_id=org.id,
+                definition_id=workflow_b_definition.id,
+            )