From 14fa3bb61d1902dc2e8c163191b7309dd94536ba Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 23 Jun 2026 21:46:46 +0000
Subject: [PATCH] Fix claim mutation guard for allocated pools

---
 e2e/pool_resourcepoolclaim_test.go                | 12 ++++++------
 internal/webhook/resourcepool/claim_validating.go |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/e2e/pool_resourcepoolclaim_test.go b/e2e/pool_resourcepoolclaim_test.go
index 839f0e52..922dc8de 100644
--- a/e2e/pool_resourcepoolclaim_test.go
+++ b/e2e/pool_resourcepoolclaim_test.go
@@ -511,7 +511,7 @@ var _ = Describe("ResourcePoolClaim Tests", Ordered, Label("resourcepool", "clai
 			}, defaultTimeoutInterval, defaultPollInterval).Should(Succeed())
 		})
 
-		By("Allow on patching resources for claim (Increase)", func() {
+		By("Error on patching resources for claim (Increase) while allocated but unused", func() {
 			Eventually(func() error {
 				stat := &capsulev1beta2.ResourcePoolClaim{}
 				err := k8sClient.Get(context.TODO(), client.ObjectKey{Name: claim.Name, Namespace: claim.Namespace}, stat)
@@ -525,10 +525,10 @@ var _ = Describe("ResourcePoolClaim Tests", Ordered, Label("resourcepool", "clai
 				}
 
 				return k8sClient.Update(context.TODO(), stat)
-			}, defaultTimeoutInterval, defaultPollInterval).Should(Succeed())
+			}, defaultTimeoutInterval, defaultPollInterval).ShouldNot(Succeed())
 		})
 
-		By("Allow on patching resources for claim (Decrease)", func() {
+		By("Error on patching resources for claim (Decrease) while allocated but unused", func() {
 			Eventually(func() error {
 				stat := &capsulev1beta2.ResourcePoolClaim{}
 				if err := k8sClient.Get(
@@ -547,10 +547,10 @@ var _ = Describe("ResourcePoolClaim Tests", Ordered, Label("resourcepool", "clai
 				}
 
 				return k8sClient.Update(context.TODO(), stat)
-			}, defaultTimeoutInterval, defaultPollInterval).Should(Succeed())
+			}, defaultTimeoutInterval, defaultPollInterval).ShouldNot(Succeed())
 		})
 
-		By("Allow on patching pool name", func() {
+		By("Error on patching pool name while allocated but unused", func() {
 			Eventually(func() error {
 				stat := &capsulev1beta2.ResourcePoolClaim{}
 
@@ -560,7 +560,7 @@ var _ = Describe("ResourcePoolClaim Tests", Ordered, Label("resourcepool", "clai
 				stat.Spec.Pool = "some-random-pool"
 
 				return k8sClient.Update(context.TODO(), stat)
-			}, defaultTimeoutInterval, defaultPollInterval).Should(Succeed())
+			}, defaultTimeoutInterval, defaultPollInterval).ShouldNot(Succeed())
 		})
 
 		By("Delete Pool", func() {
diff --git a/internal/webhook/resourcepool/claim_validating.go b/internal/webhook/resourcepool/claim_validating.go
index c5923946..48ee81df 100644
--- a/internal/webhook/resourcepool/claim_validating.go
+++ b/internal/webhook/resourcepool/claim_validating.go
@@ -76,7 +76,7 @@ func (h *claimValidationHandler) OnUpdate(
 			return ad.ErroredResponse(fmt.Errorf("failed to decode new object: %w", err))
 		}
 
-		if oldClaim.IsBoundInResourcePool() {
+		if oldClaim.Status.Pool.UID != "" {
 			if oldClaim.Spec.Pool != newClaim.Spec.Pool || !reflect.DeepEqual(oldClaim.Spec.ResourceClaims, newClaim.Spec.ResourceClaims) {
 				return ad.Denyf("cannot change the requested resources while claim is allocated to a resourcepool %s", oldClaim.Status.Pool.Name)
 			}