diff --git a/client/bot/handlers/middleware_test.go b/client/bot/handlers/middleware_test.go
index 627885a..f752c7b 100644
--- a/client/bot/handlers/middleware_test.go
+++ b/client/bot/handlers/middleware_test.go
@@ -1,13 +1,20 @@
 package handlers
 
 import (
+	"os"
+	"path/filepath"
 	"testing"
 
 	"github.com/celestix/gotgproto/ext"
 	"github.com/celestix/gotgproto/types"
 	"github.com/gotd/td/tg"
+	"github.com/krau/SaveAny-Bot/config"
 )
 
+// Regression: callback queries usually arrive as updateShort without entity
+// maps, so resolving the sender through the entity map yields ID 0 and every
+// click was denied by the whitelist check. Callback updates must use the
+// native UserID field.
 func TestResponsibleUserID(t *testing.T) {
 	tests := []struct {
 		name   string
@@ -49,3 +56,30 @@ func TestResponsibleUserID(t *testing.T) {
 		})
 	}
 }
+
+// Regression: withPermission must treat ContinueGroups (the dispatcher's
+// success sentinel) as a pass and invoke the wrapped handler. v0.60.1 treated
+// it as an error, so every permitted callback was swallowed before the real
+// handler ran.
+func TestWithPermissionInvokesHandler(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "config.toml")
+	if err := os.WriteFile(path, []byte("workers = 2\n\n[[users]]\nid = 42\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := config.Init(t.Context(), path); err != nil {
+		t.Fatal(err)
+	}
+
+	update := &ext.Update{CallbackQuery: &tg.UpdateBotCallbackQuery{UserID: 42}}
+	called := false
+	handler := withPermission(func(ctx *ext.Context, u *ext.Update) error {
+		called = true
+		return nil
+	})
+	if err := handler(&ext.Context{}, update); err != nil {
+		t.Fatalf("withPermission returned error: %v", err)
+	}
+	if !called {
+		t.Fatal("withPermission did not invoke the wrapped handler")
+	}
+}