chore: import DH V2 D5.6.4 production baseline

api-v3/test/unit/phase-d5-3-22-director-report-review.test.ts

@@ -0,0 +1,56 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+const read = (path: string) => readFileSync(resolve(process.cwd(), path), 'utf8');
+const migration = read('src/database/migrations/1788631200000-phase-d5-3-22-director-report-review.ts');
+const review = read('src/inspection-reports/inspection-report-review.service.ts');
+const controller = read('src/inspection-reports/inspection-report-review.controller.ts');
+const word = read('src/inspection-reports/inspection-report-word.service.ts');
+const acts = read('src/inspection-acts/inspection-acts.service.ts');
+const findings = read('src/inspection-findings/inspection-findings.service.ts');
+
+test('D5.3.22 keeps report corrections as immutable numbered Word revisions', () => {
+  assert.match(migration, /inspection_report_revisions/);
+  assert.match(migration, /UNIQUE \(report_id, revision_number\)/);
+  assert.match(migration, /source IN \('AUTO','DIRECTOR_UPLOAD'\)/);
+  assert.match(word, /'AUTO'/);
+  assert.match(review, /'DIRECTOR_UPLOAD'/);
+  assert.match(review, /current_revision_number = \$2/);
+});
+
+test('D5.3.22 reserves revision approval and final signature to the Director role', () => {
+  assert.match(migration, /inspection_reports\.revise/);
+  assert.match(migration, /inspection_reports\.review/);
+  assert.match(migration, /inspection_reports\.sign_final/);
+  assert.match(migration, /\('director', 'inspection_reports\.sign_final'\)/);
+  assert.doesNotMatch(migration, /\('admin', 'inspection_reports\.sign_final'\)/);
+  assert.match(review, /role\.code = 'director'/);
+  assert.match(controller, /@RequirePermissions\('inspection_reports\.sign_final'\)/);
+});
+
+test('D5.3.22 approves exactly the latest revision before allowing a final signature', () => {
+  assert.match(review, /revision_number = \$2/);
+  assert.match(review, /approved_revision_id = \$2/);
+  assert.match(review, /review_status = 'APPROVED'/);
+  assert.match(review, /INSPECTION_REPORT_NOT_APPROVED/);
+  assert.match(review, /review_status = 'SIGNED'/);
+});
+
+test('D5.3.22 binds the final Director signature to report and revision hashes', () => {
+  assert.match(migration, /inspection_report_signatures/);
+  assert.match(review, /DH-INSPECTION-REPORT-SIGNATURE-V1/);
+  assert.match(review, /reportFrozenSha256/);
+  assert.match(review, /revisionSha256/);
+  assert.match(review, /sha256CanonicalJson\(payload\)/);
+  assert.match(review, /INSPECTION_REPORT_ALREADY_SIGNED/);
+});
+
+test('D5.3.22 changes only the report review layer and preserves inspection immutability', () => {
+  assert.match(acts, /assertVisitHasNoAct/);
+  assert.match(acts, /INSPECTION_VISIT_ACT_ALREADY_EXISTS/);
+  assert.match(findings, /INSPECTION_FINDING_RESPONSE_IMMUTABLE/);
+  assert.doesNotMatch(migration, /ALTER TABLE inspection_acts/);
+  assert.doesNotMatch(migration, /ALTER TABLE inspection_findings/);
+});