fix: workflow security pass

tests/agents/test_workflow_agent_graph.py

@@ -185,7 +185,7 @@ class TestSaveWorkflowRun:
     def test_returns_when_no_engine(self):
         agent = _make_agent(workflow_id="x", workflow_owner="u")
         # _engine is None
-        agent._finalize_workflow_run(agent.workflow_owner, None, "query")
+        agent._finalize_workflow_run(agent.workflow_owner, agent.workflow_owner, None, "query")
         # should not raise
 
     def test_returns_when_no_workflow_id(self):
@@ -194,7 +194,7 @@ class TestSaveWorkflowRun:
         agent._engine.execution_log = []
         agent._engine.state = {}
         agent._engine.get_execution_summary.return_value = []
-        agent._finalize_workflow_run(agent.workflow_owner, None, "query")
+        agent._finalize_workflow_run(agent.workflow_owner, agent.workflow_owner, None, "query")
 
     def test_returns_when_workflow_missing_in_db(self, pg_conn):
         agent = _make_agent(
@@ -207,7 +207,7 @@ class TestSaveWorkflowRun:
         agent._engine.get_execution_summary.return_value = []
         with _patch_db(pg_conn):
             # Should just return None since workflow not found in DB
-            agent._finalize_workflow_run(agent.workflow_owner, None, "q")
+            agent._finalize_workflow_run(agent.workflow_owner, agent.workflow_owner, None, "q")
 
     def test_creates_run_row(self, pg_conn):
         from application.storage.db.repositories.workflows import (
@@ -234,7 +234,9 @@ class TestSaveWorkflowRun:
         agent._engine.workflow_run_id = run_id
 
         with _patch_db(pg_conn):
-            agent._finalize_workflow_run(agent.workflow_owner, None, "my query")
+            agent._finalize_workflow_run(
+                agent.workflow_owner, agent.workflow_owner, None, "my query"
+            )
 
         runs = WorkflowRunsRepository(pg_conn).list_for_workflow(str(wf["id"]))
         assert len(runs) >= 1
@@ -256,7 +258,7 @@ class TestSaveWorkflowRun:
             "application.agents.workflow_agent.db_session", _broken
         ):
             # Should not raise
-            agent._finalize_workflow_run(agent.workflow_owner, None, "q")
+            agent._finalize_workflow_run(agent.workflow_owner, agent.workflow_owner, None, "q")
 
 
 class TestDetermineRunStatus: