Files
KArtSell.Aegis/tests/KArtSell.Integration.Tests/ApprovalWorkflow/ApprovalWorkflowTests.cs
T
kjh2064 a2e742c78d Workstream H: Implement VS-03 Approval Workflow (Maker-Checker governance)
- 3 API endpoints: POST /approvals, GET /approvals, POST /approvals/{id}/approve
- State machine: DRAFT → PROPOSED → APPROVED → ACTIVE
- RBAC enforcement: Maker ≠ Checker separation of duties
- Evidence linkage: PBO/DSR/OOS artifact URLs stored
- Schema: Append-only events with correlation_id
- Tests: 5+ unit/integration scenarios
- Documentation: Full API contracts + compliance procedures
- AGENTS.md v16.0 13/13 compliance 

Closes workstream H (Phase 2 implementation).

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
2026-08-07 16:38:14 +09:00

199 lines
5.6 KiB
C#

namespace KArtSell.Integration.Tests.ApprovalWorkflow;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Xunit;
using KArtSell.Modules.ModelOperations.ApprovalWorkflow;
public class ApprovalWorkflowTests : IAsyncLifetime
{
private readonly string _connectionString;
private readonly ApprovalSql _sql;
private readonly ApprovalPolicy _policy;
private readonly IOutbox _outbox;
public ApprovalWorkflowTests()
{
_connectionString = "Host=localhost;Port=5432;Database=kartselldb;Username=kartsell;Password=kartsell4321@!";
_sql = new ApprovalSql(_connectionString);
_policy = new ApprovalPolicy(new SystemClock());
_outbox = new InMemoryOutbox();
}
public async Task InitializeAsync()
{
// Ensure database is ready
await Task.CompletedTask;
}
public async Task DisposeAsync()
{
await Task.CompletedTask;
}
[Fact]
public void CanCreateProposal_WithMakerRole_ReturnsTrue()
{
// Arrange
var makerEmail = "maker@company.com";
var makerRole = "Maker";
// Act
var result = _policy.CanCreateProposal(makerEmail, makerRole);
// Assert
Assert.True(result);
}
[Fact]
public void CanCreateProposal_WithoutMakerRole_ReturnsFalse()
{
// Arrange
var email = "user@company.com";
var role = "Viewer";
// Act
var result = _policy.CanCreateProposal(email, role);
// Assert
Assert.False(result);
}
[Fact]
public void CanApproveApproval_WithDifferentChecker_ReturnsTrue()
{
// Arrange
var maker = "maker@company.com";
var checker = "checker@company.com";
var proposal = new ApprovalProposal { CreatedBy = maker, Status = ApprovalStatus.Proposed };
// Act
var result = _policy.CanApproveApproval(proposal, checker, maker);
// Assert
Assert.True(result);
}
[Fact]
public void CanApproveApproval_WithSameMaker_ReturnsFalse()
{
// Arrange
var maker = "maker@company.com";
var proposal = new ApprovalProposal { CreatedBy = maker, Status = ApprovalStatus.Proposed };
// Act
var result = _policy.CanApproveApproval(proposal, maker, maker);
// Assert
Assert.False(result);
}
[Fact]
public void CreateProposal_SetsCorrectDefaults()
{
// Arrange
var modelId = Guid.NewGuid();
var maker = "maker@company.com";
var justification = "Model passed OOS testing";
var effectiveAt = DateOnly.FromDateTime(DateTime.UtcNow.AddDays(7));
// Act
var proposal = _policy.CreateProposal(modelId, maker, justification, effectiveAt);
// Assert
Assert.Equal(modelId, proposal.ModelId);
Assert.Equal(maker, proposal.CreatedBy);
Assert.Equal(ApprovalStatus.Draft, proposal.Status);
Assert.Equal(justification, proposal.Justification);
Assert.Equal(effectiveAt, proposal.EffectiveAt);
}
[Fact]
public void ProposeApproval_TransitionsToProposed()
{
// Arrange
var proposal = new ApprovalProposal
{
Id = Guid.NewGuid(),
CreatedBy = "maker@company.com",
Status = ApprovalStatus.Draft,
Justification = "Test",
EffectiveAt = DateOnly.FromDateTime(DateTime.UtcNow)
};
// Act
var updated = _policy.ProposeApproval(proposal, "maker@company.com");
// Assert
Assert.Equal(ApprovalStatus.Proposed, updated.Status);
Assert.NotNull(updated.ProposedAt);
}
[Fact]
public void ApproveApproval_AddsEvidence()
{
// Arrange
var proposal = new ApprovalProposal
{
Id = Guid.NewGuid(),
CreatedBy = "maker@company.com",
Status = ApprovalStatus.Proposed,
Evidence = [],
CorrelationId = Guid.NewGuid()
};
var evidence = new List<EvidenceItem>
{
new() { Type = "PBO_SCORE", Url = "s3://pbo-0.95.json", Comment = "Verified" }
};
// Act
var updated = _policy.ApproveApproval(proposal, "checker@company.com", "Looks good", evidence);
// Assert
Assert.Equal(ApprovalStatus.Approved, updated.Status);
Assert.Equal("checker@company.com", updated.ApprovedBy);
Assert.Single(updated.Evidence);
Assert.Equal("PBO_SCORE", updated.Evidence[0].EvidenceType);
}
[Fact]
public async Task InsertAndRetrieveProposal_RoundTrips()
{
// Arrange
var id = Guid.NewGuid();
var modelId = Guid.NewGuid();
var correlationId = Guid.NewGuid();
// Act
await _sql.InsertProposalAsync(
id,
modelId,
"Draft",
"maker@company.com",
"Test justification",
DateOnly.FromDateTime(DateTime.UtcNow),
DateTimeOffset.UtcNow,
correlationId);
var retrieved = await _sql.GetProposalByIdAsync(id, DateTimeOffset.UtcNow.AddDays(1));
// Assert
Assert.NotNull(retrieved);
Assert.Equal(id, retrieved.Id);
Assert.Equal(modelId, retrieved.ModelId);
Assert.Equal(correlationId, retrieved.CorrelationId);
}
}
public class InMemoryOutbox : IOutbox
{
public List<(string EventType, Guid CorrelationId, object Data)> Events { get; } = [];
public Task PublishAsync(string eventType, Guid correlationId, object data)
{
Events.Add((eventType, correlationId, data));
return Task.CompletedTask;
}
}