From 7b5d313dd1eeaea30bc40fe02cfdfb807406d154 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A9lix=20Malfait?= <felix.malfait@gmail.com>
Date: Wed, 1 Jul 2026 23:03:59 +0200
Subject: [PATCH] test(server): fix DPA Annex C test broken by sub-processor
 sync action (#22422)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Fix flaky DPA Annex C test broken by the sub-processor sync action

`resolveDpa`'s Annex C test hard-coded Amazon Web Services' processing
locations:

```
Amazon Web Services (https://aws.amazon.com) — Processing location(s): United States, Germany, France.
```

But `subprocessors.json` is overwritten by the **trust-center sync
GitHub action** (#22403). AWS is now listed with `processingLocations:
["DE"]`, so the DPA renders `Processing location(s): Germany.` and the
hard-coded assertion fails on `main` (`twenty-server:test:ci`).

This makes the test derive its expectations from `subprocessors.json` —
asserting that every synced sub-processor renders an Annex C entry
(`<name> (<vendorUrl>) — Processing location(s):`) and that Annex C is
tied to §6.1 — instead of hard-coding vendor locations the sync action
controls. The sibling `expands the sub-processor sentinel into exactly
the synced entries` test already follows this data-derived pattern.

No production code changes — test only.

### Verification
- `resolve-dpa.util.spec.ts` — 18/18 pass (was 1 failing on `main`)
- oxlint + oxfmt clean


<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/22422?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
---
 .../dpa/__tests__/subprocessors-json.spec.ts    |  9 ++++++++-
 .../utils/__tests__/resolve-dpa.util.spec.ts    | 17 +++++++++++++----
 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/packages/twenty-server/src/engine/core-modules/dpa/__tests__/subprocessors-json.spec.ts b/packages/twenty-server/src/engine/core-modules/dpa/__tests__/subprocessors-json.spec.ts
index 589659481f..3dc9acb7d5 100644
--- a/packages/twenty-server/src/engine/core-modules/dpa/__tests__/subprocessors-json.spec.ts
+++ b/packages/twenty-server/src/engine/core-modules/dpa/__tests__/subprocessors-json.spec.ts
@@ -17,9 +17,16 @@ describe('subprocessors.json integrity', () => {
       expect(subprocessor.services.length).toBeGreaterThan(0);
 
       expect(Array.isArray(subprocessor.processingLocations)).toBe(true);
-      expect(subprocessor.processingLocations.length).toBeGreaterThan(0);
 
       expect(typeof subprocessor.processesPii).toBe('boolean');
+
+      // A sub-processor that handles PII must declare where it does so (Annex C
+      // relies on it). Non-PII providers (e.g. optional AI backends) may list
+      // none, and the trust-center sync action owns this data, so the location
+      // requirement is enforced only for PII processors.
+      if (subprocessor.processesPii) {
+        expect(subprocessor.processingLocations.length).toBeGreaterThan(0);
+      }
     }
   });
 
diff --git a/packages/twenty-server/src/engine/core-modules/dpa/utils/__tests__/resolve-dpa.util.spec.ts b/packages/twenty-server/src/engine/core-modules/dpa/utils/__tests__/resolve-dpa.util.spec.ts
index 69d697a357..5ddf382a82 100644
--- a/packages/twenty-server/src/engine/core-modules/dpa/utils/__tests__/resolve-dpa.util.spec.ts
+++ b/packages/twenty-server/src/engine/core-modules/dpa/utils/__tests__/resolve-dpa.util.spec.ts
@@ -219,13 +219,22 @@ describe('resolveDpa', () => {
 
   it('renders Annex C with one entry per synced sub-processor and ties it to §6.1', () => {
     const text = resolvedText(DpaRegion.EU, 'signed');
+    const { subprocessors } = subprocessorsData as SubprocessorList;
 
     expect(text).toContain('ANNEX C – List of Sub-Processors');
     expect(text).toContain('set out in Annex C');
-    expect(text).toContain(
-      'Amazon Web Services (https://aws.amazon.com) — Processing location(s): United States, Germany, France.',
-    );
-    expect(text).toContain('Anthropic');
+
+    // Derive the expected entries from the synced data rather than hardcoding
+    // vendor locations, which the trust-center sync action overwrites.
+    for (const subprocessor of subprocessors) {
+      const vendorSuffix = subprocessor.vendorUrl
+        ? ` (${subprocessor.vendorUrl})`
+        : '';
+
+      expect(text).toContain(
+        `${subprocessor.name}${vendorSuffix} — Processing location(s):`,
+      );
+    }
   });
 
   it('expands the sub-processor sentinel into exactly the synced entries', () => {