security: authorize every Campaign effect version

tests/test_mail_profile_boundary.py

@@ -1,7 +1,7 @@
 from __future__ import annotations
 
 from types import SimpleNamespace
-from unittest.mock import patch
+from unittest.mock import call, patch
 
 import pytest
 from fastapi import HTTPException
@@ -228,3 +228,21 @@ def test_fork_inherited_profile_requires_mail_profile_use_scope() -> None:
 
     assert captured.value.status_code == 403
     fork.assert_not_called()
+
+
+def test_campaign_wide_effect_authorizes_every_affected_version() -> None:
+    session = object()
+    principal = SimpleNamespace(tenant_id="tenant-1")
+
+    with patch.object(router, "_require_campaign_profile_use_if_needed") as require_profile:
+        router._require_campaign_versions_profile_use(  # noqa: SLF001 - security boundary regression test
+            session,  # type: ignore[arg-type]
+            principal,  # type: ignore[arg-type]
+            "campaign-1",
+            {"version-2", "version-1"},
+        )
+
+    assert require_profile.call_args_list == [
+        call(session, principal, "campaign-1", "version-1"),
+        call(session, principal, "campaign-1", "version-2"),
+    ]