feat: appove and go

packages/casan-control-panel/backend/test/approvals.test.ts

@@ -102,6 +102,29 @@ test('operations owner request remains visible and actionable for an independent
   });
 });
 
+test('project reviewer cannot see or decide another project approval', async () => {
+  await withTempGovernance(async () => {
+    const svc = new ApprovalsService();
+    const submitted = svc.submit({
+      action: 'goal.workspace.execute',
+      target: 'project-alpha',
+      risk: 'high',
+      sensitive: true,
+      reason: 'project alpha patch',
+      payload: { goal_id: 'goal-alpha', project_id: 'project-alpha' },
+    }, { ...projectAdmin, project: 'project-alpha' }) as { proposal: { id: string } };
+    const otherProjectReviewer = { ...approver, project: 'project-beta' };
+
+    const reviewerInbox = svc.list(otherProjectReviewer, 'pending') as { count: number; proposals: Array<{ id: string }> };
+    assert.equal(reviewerInbox.count, 0);
+    assert.equal(reviewerInbox.proposals.length, 0);
+    await assert.rejects(
+      svc.decide({ id: submitted.proposal.id, decision: 'approve', reason: 'wrong project' }, otherProjectReviewer),
+      ForbiddenException,
+    );
+  });
+});
+
 test('approval inbox denies forged JWT in strict mode without deciding proposal', async () => {
   await withTempGovernance(async ({ inbox }) => {
     const svc = new ApprovalsService();

packages/casan-control-panel/backend/test/auth-context.test.ts

@@ -15,10 +15,11 @@ test('auth context keeps local explicit roles for dev', () => {
 test('auth context maps IdP group claim to RBAC role', () => {
   const actor = actorFromHeaders({
     'x-auth-request-user': 'bob@example.com',
-    'x-auth-request-groups': 'engineering,casan-approver',
+    'x-auth-request-groups': 'engineering,casan-approver,casan-project:AINative_OKR_CASAN4',
   });
   assert.equal(actor.actor, 'bob@example.com');
   assert.equal(actor.role, 'approver');
+  assert.equal(actor.project, 'AINative_OKR_CASAN4');
 });
 
 test('auth context fails closed to viewer for unknown role claim', () => {