feat: escalate chat approvals through inbox

packages/casan-control-panel/backend/test/approvals.test.ts

@@ -12,6 +12,7 @@ const orgAdmin = { actor: 'root', role: 'org-admin', project: 'default', tenant:
 
 function withTempGovernance(fn: (paths: { inbox: string; store: string }) => void) {
   const prevInbox = process.env.CASAN_APPROVAL_INBOX_FILE;
+  const prevStrict = process.env.CASAN_APPROVAL_STRICT;
   const prevStore = process.env.CASAN_CP_STORE_FILE;
   const prevKeyDir = process.env.CASAN_CP_KEY_DIR;
   const prevPub = process.env.CASAN_CP_PUB;
@@ -25,6 +26,8 @@ function withTempGovernance(fn: (paths: { inbox: string; store: string }) => voi
   } finally {
     if (prevInbox === undefined) delete process.env.CASAN_APPROVAL_INBOX_FILE;
     else process.env.CASAN_APPROVAL_INBOX_FILE = prevInbox;
+    if (prevStrict === undefined) delete process.env.CASAN_APPROVAL_STRICT;
+    else process.env.CASAN_APPROVAL_STRICT = prevStrict;
     if (prevStore === undefined) delete process.env.CASAN_CP_STORE_FILE;
     else process.env.CASAN_CP_STORE_FILE = prevStore;
     if (prevKeyDir === undefined) delete process.env.CASAN_CP_KEY_DIR;
@@ -62,6 +65,28 @@ test('approval inbox submit -> approve applies governed setting and writes overs
   });
 });
 
+test('approval inbox denies forged JWT in strict mode without deciding proposal', () => {
+  withTempGovernance(({ inbox }) => {
+    const svc = new ApprovalsService();
+    const submitted = svc.submit({
+      action: 'settings.write',
+      target: 'security.strict',
+      risk: 'high',
+      sensitive: true,
+      reason: 'strict approval required',
+      payload: { key: 'security.strict', value: true },
+    }, projectAdmin) as any;
+    process.env.CASAN_APPROVAL_STRICT = '1';
+    assert.throws(
+      () => svc.decide({ id: submitted.proposal.id, decision: 'approve', reason: 'forged jwt', approvalJwt: 'fake.jwt.token' }, approver),
+      ForbiddenException,
+    );
+    const inboxRaw = JSON.parse(readFileSync(inbox, 'utf8'));
+    assert.equal(inboxRaw.proposals[0].status, 'pending');
+    assert.equal(inboxRaw.oversight.length, 1);
+  });
+});
+
 test('approval inbox enforces separation of duties', () => {
   withTempGovernance(() => {
     const svc = new ApprovalsService();