feat: appove and go

packages/casan-control-panel/backend/test/approvals.test.ts

@@ -102,6 +102,29 @@ test('operations owner request remains visible and actionable for an independent
   });
 });
 
+test('project reviewer cannot see or decide another project approval', async () => {
+  await withTempGovernance(async () => {
+    const svc = new ApprovalsService();
+    const submitted = svc.submit({
+      action: 'goal.workspace.execute',
+      target: 'project-alpha',
+      risk: 'high',
+      sensitive: true,
+      reason: 'project alpha patch',
+      payload: { goal_id: 'goal-alpha', project_id: 'project-alpha' },
+    }, { ...projectAdmin, project: 'project-alpha' }) as { proposal: { id: string } };
+    const otherProjectReviewer = { ...approver, project: 'project-beta' };
+
+    const reviewerInbox = svc.list(otherProjectReviewer, 'pending') as { count: number; proposals: Array<{ id: string }> };
+    assert.equal(reviewerInbox.count, 0);
+    assert.equal(reviewerInbox.proposals.length, 0);
+    await assert.rejects(
+      svc.decide({ id: submitted.proposal.id, decision: 'approve', reason: 'wrong project' }, otherProjectReviewer),
+      ForbiddenException,
+    );
+  });
+});
+
 test('approval inbox denies forged JWT in strict mode without deciding proposal', async () => {
   await withTempGovernance(async ({ inbox }) => {
     const svc = new ApprovalsService();