@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/src/modules/workflow/__tests__/merge-announces-tree.test.ts

@@ -0,0 +1,220 @@
+import { afterAll, beforeAll, describe, it, expect, vi } from 'vitest';
+import {
+  DEFAULT_BRANCH,
+  branchModelFromEnv,
+  configureBranchModel,
+  type WorkflowEvent,
+} from '@bevel-software/platform-shared';
+
+import type { GitService } from '../git/git.service.js';
+import type { PullRequestService } from '../git/pull-request.service.js';
+import type { IReviewWorkflowService } from '../review-workflow/review-workflow.interface.js';
+import type { WorkspaceService } from '../../workspace/workspace.service.js';
+import type { IAccessControl } from '../../access/access-control.interface.js';
+import type { FileLockService } from '../file-lock.service.js';
+import type { PendingCommitsService } from '../pending-commits.service.js';
+import type { WorkflowEventBus } from '../event-bus.js';
+import type { Database } from '../../database/connection.js';
+import { WorkflowService } from '../workflow.service.js';
+import { openChangeGate } from '../../../__tests__/open-change-gate.js';
+
+/**
+ * APPLYING A CHANGE REQUEST ANNOUNCES THE TREE IT REWROTE.
+ *
+ * The bug, found on staging: an approved `.tool` merged into the default
+ * branch stayed invisible — to every open MCP connection and every browser —
+ * for tens of seconds, once for 42.
+ *
+ * Why it was invisible is the whole point of this file. `mergePr` runs
+ * `git merge --no-ff` in the TARGET branch's own workspace and pushes the
+ * result, so the working tree already holds the merged files. The pull that
+ * follows is then a no-op: the clone is at origin, `treeChanged` is false, and
+ * `pullWorkspace` announces nothing — it announces a pull that moved the tree,
+ * and this one did not move it, the merge did.
+ *
+ * Nothing else covered the gap. `change-request-merged` carries no branch and
+ * no workspace, so `catalog-cache-invalidation.ts` cannot act on it; a later
+ * `POST /api/sync/<branch>` answers "up-to-date" without pulling for the same
+ * reason. The catalogs were left holding a scan of a tree that no longer
+ * existed until an unrelated default-branch write dropped them, or their TTL
+ * ran out — which is exactly why an unrelated write made the staleness vanish.
+ */
+
+const KB_DIR = 'knowledge-base';
+const HEAD = 'someone/add-a-tool';
+const USER = { id: 'u1', email: 'someone@x.com', name: 'Someone' };
+
+/**
+ * A default branch this deployment chose, pinned for the whole file.
+ *
+ * `DEFAULT_BRANCH` is a binding a deployment configures at boot (the suite's
+ * `test-setup.ts` applies the environment's), so reading it here would make
+ * these assertions agree with whatever that environment happens to say — and a
+ * regression that hardcoded a branch name would still pass wherever the two
+ * coincided. Deliberately NOT `main`, so `main` written into the emit would
+ * fail here rather than slip through.
+ */
+const TRUNK = 'trunk';
+
+beforeAll(() => {
+  configureBranchModel({ defaultBranch: TRUNK, protectedBranches: [TRUNK] });
+});
+afterAll(() => {
+  // Back to what the suite booted with: the binding is process-wide, and a
+  // file that leaves its own branch model behind changes the meaning of
+  // anything that runs after it in the same worker.
+  configureBranchModel(branchModelFromEnv());
+});
+
+function noopAccessControl(): IAccessControl {
+  return { invalidate: vi.fn() } as unknown as IAccessControl;
+}
+
+function makeSvc(
+  opts: { base?: string; pullTreeChanged?: boolean; mergeThrows?: Error; pullThrows?: Error } = {},
+) {
+  const base = opts.base ?? TRUNK;
+  const events: WorkflowEvent[] = [];
+  const bus = {
+    emit: vi.fn((payload: WorkflowEvent) => {
+      events.push(payload);
+      return payload;
+    }),
+  } as unknown as WorkflowEventBus;
+
+  const reviewWorkflow = {
+    mergePr: opts.mergeThrows
+      ? vi.fn().mockRejectedValue(opts.mergeThrows)
+      : vi.fn().mockResolvedValue({ prNumber: 1, sha: 'merged-sha', mergedAt: 't' }),
+  } as unknown as IReviewWorkflowService;
+
+  const git = {
+    fetch: vi.fn().mockResolvedValue(undefined),
+    // The real shape after a local merge + push: the clone is already at
+    // origin, so the pull moves nothing.
+    pull: opts.pullThrows
+      ? vi.fn().mockRejectedValue(opts.pullThrows)
+      : vi.fn().mockResolvedValue({ treeChanged: opts.pullTreeChanged ?? false }),
+    readFileAtRef: vi.fn().mockResolvedValue(null), // no roles.yaml either side
+    commitFile: vi.fn(),
+    push: vi.fn(),
+  } as unknown as GitService;
+
+  const prs = {
+    getPr: vi.fn().mockResolvedValue({ branch: HEAD, base }),
+    getPrDetail: vi.fn().mockResolvedValue({ headSha: 'sha', approvals: [], state: 'open', title: 'T', base }),
+    invalidateDetailCache: vi.fn(),
+  } as unknown as PullRequestService;
+
+  const workspaceService = {
+    getOrCreateForBranch: vi.fn(async (branch: string) => ({ id: encodeURIComponent(branch) })),
+    getWorkspacePath: vi.fn(async (id: string) => `/tmp/${id}`),
+  } as unknown as WorkspaceService;
+
+  const svc = new WorkflowService(
+    {} as unknown as Database,
+    git,
+    prs,
+    reviewWorkflow,
+    workspaceService,
+    noopAccessControl(),
+    { acquire: vi.fn(), release: vi.fn() } as unknown as FileLockService,
+    {} as unknown as PendingCommitsService,
+    KB_DIR,
+    openChangeGate(),
+    bus,
+  );
+  // Branch retirement is git IO past the announcement and irrelevant here.
+  vi.spyOn(svc as unknown as { retireMergedSourceBranch: () => Promise<void> }, 'retireMergedSourceBranch')
+    .mockResolvedValue(undefined);
+
+  const merge = () => svc.mergeChangeRequest(1, USER, 'sha', [], 'open', 'T', base, 'w1', { bypass: false });
+  const treeEvents = () => events.filter((e) => e.kind === 'fs-tree-changed');
+  return { svc, merge, events, treeEvents, git, bus };
+}
+
+describe('applying a change request announces the tree it rewrote', () => {
+  it('announces the default branch even though the post-merge pull moved nothing', async () => {
+    const { merge, treeEvents } = makeSvc();
+
+    await merge();
+
+    // Exactly the signal `catalog-cache-invalidation.ts` subscribes to, naming
+    // the workspace the merge rewrote — so the tool and skill catalogs are
+    // dropped before the next `list_tools` reads them.
+    expect(treeEvents()).toEqual([
+      { kind: 'fs-tree-changed', workspaceId: encodeURIComponent(TRUNK), branch: TRUNK },
+    ]);
+    // The deployment's own default branch, read from the binding rather than
+    // written into the emit: these two are the same thing, and a hardcoded
+    // branch name would make them differ.
+    expect(DEFAULT_BRANCH).toBe(TRUNK);
+  });
+
+  /**
+   * The pull FAILING does not make the announcement a lie. `mergePr` runs
+   * `git merge --no-ff` in the target branch's OWN workspace and pushes from
+   * there, so the merged bytes are on that disk before the pull is attempted —
+   * a pull that then fails leaves the tree holding the merge, which is
+   * precisely what the catalogs have to re-scan. (The pull is there for the
+   * rarer case of someone else's commits, and its failure is already
+   * best-effort: the merge has landed on origin either way.)
+   */
+  it('announces even when the post-merge pull fails', async () => {
+    const { merge, treeEvents } = makeSvc({ pullThrows: new Error('origin unreachable') });
+
+    await merge();
+
+    expect(treeEvents()).toEqual([
+      { kind: 'fs-tree-changed', workspaceId: encodeURIComponent(TRUNK), branch: TRUNK },
+    ]);
+  });
+
+  /**
+   * The rare path where the clone WAS behind — someone else pushed between the
+   * merge and the pull. The pull then announces the same tree, and a second
+   * event buys a duplicate catalog re-scan and a duplicate browser refetch for
+   * a change already reported.
+   */
+  it('does not announce twice when the pull already did', async () => {
+    const { merge, treeEvents } = makeSvc({ pullTreeChanged: true });
+
+    await merge();
+
+    expect(treeEvents()).toHaveLength(1);
+  });
+
+  /** The announcement comes BEFORE the merge is reported, so a session that reacts to
+   * `change-request-merged` by refetching cannot read a catalog that is still stale. */
+  it('announces before it says the request was applied', async () => {
+    const { merge, events } = makeSvc();
+
+    await merge();
+
+    const tree = events.findIndex((e) => e.kind === 'fs-tree-changed');
+    const merged = events.findIndex((e) => e.kind === 'change-request-merged');
+    expect(tree).toBeGreaterThanOrEqual(0);
+    expect(merged).toBeGreaterThan(tree);
+  });
+
+  /**
+   * The catalogs read the default branch and nothing else, and a merge into
+   * some other base rewrote a tree they never scanned.
+   */
+  it('says nothing about a merge into another base', async () => {
+    const { merge, treeEvents } = makeSvc({ base: 'team/staging' });
+
+    await merge();
+
+    expect(treeEvents()).toEqual([]);
+  });
+
+  /** A merge that did not happen rewrote nothing. */
+  it('says nothing when the merge failed', async () => {
+    const { merge, treeEvents } = makeSvc({ mergeThrows: new Error('merge exploded') });
+
+    await expect(merge()).rejects.toThrow('merge exploded');
+
+    expect(treeEvents()).toEqual([]);
+  });
+});

package/src/modules/workflow/__tests__/pending-commits.worker.concurrency.test.ts

@@ -0,0 +1,187 @@
+import { describe, it, expect, vi } from 'vitest';
+import type { ISystemNoticeSink, RecoveryAgentRunner } from '../pending-commits.worker.js';
+import { PendingCommitsWorker } from '../pending-commits.worker.js';
+import type { PendingCommit, PendingCommitsService } from '../pending-commits.service.js';
+
+/**
+ * How the worker spreads its work ACROSS workspaces — the one property the
+ * per-row decision tree (see the sibling suite) says nothing about. Driven
+ * through `drainOnce()` like that suite, with commits the test holds open so
+ * that "in flight at the same time" is observable rather than inferred.
+ */
+
+const RECOVERY_BOT = { id: 'recovery-bot-id', email: 'recovery-bot@bevel.local', name: 'Recovery Bot' };
+
+function row(workspaceId: string, id = `row-${workspaceId}`): PendingCommit {
+  return {
+    id,
+    workspaceId,
+    branch: 'feat/x',
+    path: 'Foo.md',
+    authorEmail: 'alice@example.com',
+    authorName: 'Alice',
+    queuedAt: new Date('2026-01-01T00:00:00Z'),
+    status: 'running',
+    attempts: 0,
+    recoveryAgentRuns: 0,
+    lastAttemptedAt: null,
+    lastError: null,
+  };
+}
+
+/** A queue holding one row per listed workspace, handed out once each. */
+function queueWith(rows: PendingCommit[]) {
+  const pending = new Map(rows.map((r) => [r.workspaceId, r]));
+  const service = {
+    enqueue: vi.fn(),
+    claimNext: vi.fn(async (workspaceId: string) => {
+      const next = pending.get(workspaceId) ?? null;
+      pending.delete(workspaceId);
+      return next;
+    }),
+    hasReadyRow: vi.fn().mockResolvedValue(false),
+    markSucceeded: vi.fn().mockResolvedValue(undefined),
+    markTransientFailure: vi.fn().mockResolvedValue(undefined),
+    markRecoveryStarted: vi.fn().mockResolvedValue(undefined),
+    markNeedsAttention: vi.fn().mockResolvedValue(undefined),
+  } as unknown as PendingCommitsService & { markSucceeded: ReturnType<typeof vi.fn>; claimNext: ReturnType<typeof vi.fn> };
+  return service;
+}
+
+/** Commits that finish only when the test says so, and count how many are open. */
+function heldCommits() {
+  const open = new Map<string, () => void>();
+  let inFlight = 0;
+  let peak = 0;
+  const workflow = {
+    runPendingCommit: vi.fn(
+      (workspaceId: string) =>
+        new Promise<void>((resolve) => {
+          inFlight += 1;
+          peak = Math.max(peak, inFlight);
+          open.set(workspaceId, () => {
+            inFlight -= 1;
+            resolve();
+          });
+        }),
+    ),
+  };
+  return {
+    workflow,
+    release: (workspaceId: string) => open.get(workspaceId)?.(),
+    releaseAll: () => [...open.keys()].forEach((id) => open.get(id)?.()),
+    get inFlight() {
+      return inFlight;
+    },
+    get peak() {
+      return peak;
+    },
+  };
+}
+
+function makeWorker(
+  service: PendingCommitsService,
+  workflow: { runPendingCommit: ReturnType<typeof vi.fn> },
+  workspaceIds: string[],
+): PendingCommitsWorker {
+  const worker = new PendingCommitsWorker({
+    service,
+    workflow: workflow as never,
+    recoveryAgent: { run: vi.fn() } as unknown as RecoveryAgentRunner,
+    feedback: { send: vi.fn() } as unknown as ISystemNoticeSink,
+    workspaces: { knownWorkspaces: () => workspaceIds.map((id) => ({ id, branch: 'feat/x' })) },
+    recoveryBot: RECOVERY_BOT,
+    now: () => new Date('2026-01-01T00:01:00Z'),
+  });
+  // Same seam the sibling suite uses: the single-pass drain without the loop.
+  (worker as unknown as { running: boolean }).running = true;
+  return worker;
+}
+
+const settle = () => new Promise<void>((resolve) => setTimeout(resolve, 0));
+
+describe('PendingCommitsWorker.drainOnce across workspaces', () => {
+  it('a workspace whose remote has stalled does not delay another workspace', async () => {
+    const service = queueWith([row('ws-stalled'), row('ws-fine')]);
+    const commits = heldCommits();
+    const worker = makeWorker(service, commits.workflow, ['ws-stalled', 'ws-fine']);
+
+    const pass = worker.drainOnce();
+    await settle();
+    // Both are in flight: the stalled one has not been allowed to block the other.
+    expect(commits.inFlight).toBe(2);
+
+    commits.release('ws-fine');
+    await settle();
+    // The fine workspace's row landed while the stalled one is still pushing.
+    expect(service.markSucceeded).toHaveBeenCalledWith('row-ws-fine');
+    expect(service.markSucceeded).not.toHaveBeenCalledWith('row-ws-stalled');
+
+    commits.release('ws-stalled');
+    await pass;
+    expect(service.markSucceeded).toHaveBeenCalledWith('row-ws-stalled');
+  });
+
+  it('never drains one clone under two spellings at once', async () => {
+    // A route hands the worker the decoded form, a directory listing the
+    // encoded one. They are one workspace, one clone, and one drain.
+    const service = queueWith([]);
+    const commits = heldCommits();
+    const worker = makeWorker(service, commits.workflow, ['alice/feature', 'alice%2Ffeature']);
+
+    await worker.drainOnce();
+
+    expect(service.claimNext).toHaveBeenCalledTimes(1);
+    expect(service.claimNext).toHaveBeenCalledWith('alice%2Ffeature', expect.any(Date));
+  });
+
+  it('bounds how many workspaces drain at once, and gets to all of them', async () => {
+    const ids = ['ws-1', 'ws-2', 'ws-3', 'ws-4', 'ws-5', 'ws-6'];
+    const service = queueWith(ids.map((id) => row(id)));
+    const commits = heldCommits();
+    const worker = makeWorker(service, commits.workflow, ids);
+
+    const pass = worker.drainOnce();
+    await settle();
+    expect(commits.inFlight).toBe(4);
+
+    // Finishing one admits the next; the ceiling holds throughout.
+    commits.release('ws-1');
+    await settle();
+    expect(commits.inFlight).toBe(4);
+    expect(commits.peak).toBe(4);
+
+    commits.releaseAll();
+    await settle();
+    commits.releaseAll();
+    await pass;
+    for (const id of ids) expect(service.markSucceeded).toHaveBeenCalledWith(`row-${id}`);
+    expect(commits.peak).toBe(4);
+  });
+
+  it('within one workspace, rows still land one after another', async () => {
+    // Two rows for one workspace: the second is claimed only after the first
+    // has finished, because they share a clone.
+    const first = row('ws-1', 'row-a');
+    const second = row('ws-1', 'row-b');
+    const rows = [first, second];
+    const service = queueWith([]);
+    (service.claimNext as ReturnType<typeof vi.fn>).mockImplementation(async () => rows.shift() ?? null);
+    (service.hasReadyRow as ReturnType<typeof vi.fn>).mockImplementation(async () => rows.length > 0);
+    const commits = heldCommits();
+    const worker = makeWorker(service, commits.workflow, ['ws-1']);
+
+    const pass = worker.drainOnce();
+    await settle();
+    expect(commits.inFlight).toBe(1);
+
+    commits.release('ws-1');
+    await settle();
+    expect(commits.workflow.runPendingCommit).toHaveBeenCalledTimes(2);
+
+    commits.release('ws-1');
+    await pass;
+    expect(service.markSucceeded).toHaveBeenCalledWith('row-a');
+    expect(service.markSucceeded).toHaveBeenCalledWith('row-b');
+  });
+});

package/src/modules/workflow/__tests__/preserve-roles-yaml.test.ts

@@ -13,6 +13,7 @@ import { PendingCommitsService } from '../pending-commits.service.js';
 import { WorkflowService } from '../workflow.service.js';
 import type { Database } from '../../database/connection.js';
 import { RolesYamlPreservationError } from '../../../shared/domain-errors.js';
+import { openChangeGate } from '../../../__tests__/open-change-gate.js';
 
 /**
  * Focused tests for the roles.yaml-preservation guard inside
@@ -80,7 +81,7 @@ describe('mergeChangeRequest — roles.yaml preservation guard', () => {
 
     const git = {
       fetch: vi.fn().mockResolvedValue(undefined),
-      pull: vi.fn().mockResolvedValue(undefined),
+      pull: vi.fn().mockResolvedValue({ treeChanged: true }),
       // Resolve roles.yaml at origin/<ref> from the per-test content.
       readFileAtRef: vi.fn(async (_ws: string, ref: string) =>
         ref === `origin/${BASE}` ? opts.baseRoles : ref === `origin/${HEAD}` ? opts.headRoles : null,
@@ -120,6 +121,7 @@ describe('mergeChangeRequest — roles.yaml preservation guard', () => {
       git, prs, reviewWorkflow, workspaceService, ac,
       fileLocks, {} as unknown as PendingCommitsService,
       KB_DIR,
+      openChangeGate(),
     );
     // Conflicts are now surfaced by the local merge inside `reviewWorkflow.mergePr`
     // (mocked to resolve here), so there's no provider "mergeable" pre-check to stub.

package/src/modules/workflow/__tests__/sanitize-error.test.ts

@@ -59,6 +59,16 @@ describe('sanitizeError', () => {
     expect(out.endsWith('…')).toBe(true);
   });
 
+  it('honours a raised cap, and falls back to 200 for a cap that is not a positive whole number', () => {
+    const long = 'x'.repeat(500);
+    expect(sanitizeError(long, { maxLen: 300 })).toHaveLength(300);
+    for (const maxLen of [Number.NaN, Number.POSITIVE_INFINITY, 0, -5, 12.5]) {
+      const out = sanitizeError(long, { maxLen });
+      expect(out).toHaveLength(200);
+      expect(out.endsWith('…')).toBe(true);
+    }
+  });
+
   it('is idempotent on already-sanitised text', () => {
     const once = sanitizeError(new Error('Authorization: Bearer abc; token=def123'));
     const twice = sanitizeError(once);

package/src/modules/workflow/__tests__/workflow.routes.folder-proposals.test.ts

@@ -0,0 +1,128 @@
+import type { Server } from 'node:http';
+import type { AddressInfo } from 'node:net';
+import express from 'express';
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import type { AuthUser, IWorkflowService } from '@bevel-software/platform-shared';
+import type { IAccessControl } from '../../access/access-control.interface.js';
+import type { AuthService } from '../../auth/auth.service.js';
+import type { WorkspaceService } from '../../workspace/workspace.service.js';
+import { WorkflowEventBus } from '../event-bus.js';
+import { WorkflowDomainError } from '../../../shared/domain-errors.js';
+import { createWorkflowRoutes } from '../workflow.routes.js';
+
+/**
+ * The two routes a folder delete calls. What they must get right on their
+ * own: `under-folder` is not a change-request number (the `/:number` route
+ * registered after it would answer 400 "invalid change request number"), a
+ * folder that could step outside the knowledge base is refused before the
+ * service sees it, and a refusal keeps its status.
+ */
+
+const ALICE: AuthUser = { id: 'u-alice', email: 'alice@example.com', name: 'Alice' };
+
+describe('folder change-request routes', () => {
+  let server: Server;
+  let baseUrl: string;
+  const workflow = {
+    changeRequestsUnderFolder: vi.fn(),
+    removeFolderFromChangeRequests: vi.fn(),
+  };
+
+  beforeEach(async () => {
+    workflow.changeRequestsUnderFolder.mockReset();
+    workflow.removeFolderFromChangeRequests.mockReset();
+    const app = express();
+    app.use(express.json());
+    app.use('/api', (req, _res, next) => {
+      (req as unknown as { userId: string }).userId = ALICE.id;
+      next();
+    });
+    app.use(
+      '/api',
+      createWorkflowRoutes(
+        workflow as unknown as IWorkflowService,
+        {} as WorkspaceService,
+        { getUserById: vi.fn(async () => ALICE) } as unknown as AuthService,
+        new WorkflowEventBus(),
+        {} as IAccessControl,
+        'knowledge-base',
+      ),
+    );
+    server = await new Promise<Server>((resolve) => {
+      const s = app.listen(0, () => resolve(s));
+    });
+    baseUrl = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+  });
+
+  afterEach(async () => {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  });
+
+  it('lists the requests under a folder for the caller', async () => {
+    workflow.changeRequestsUnderFolder.mockResolvedValue([{ number: 12, mayRemove: true }]);
+    const res = await fetch(`${baseUrl}/api/workflow/change-requests/under-folder?path=Data%2FReports%2F`);
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ requests: [{ number: 12, mayRemove: true }] });
+    expect(workflow.changeRequestsUnderFolder).toHaveBeenCalledWith('Data/Reports', ALICE);
+  });
+
+  it('removes the folder from the requests', async () => {
+    workflow.removeFolderFromChangeRequests.mockResolvedValue([
+      { number: 12, removedPaths: ['Data/Reports/a.md'], withdrawn: true },
+    ]);
+    const res = await fetch(`${baseUrl}/api/workflow/change-requests/under-folder/remove`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ path: 'Data/Reports' }),
+    });
+    expect(res.status).toBe(200);
+    expect((await res.json()).results[0]).toMatchObject({ number: 12, withdrawn: true });
+    expect(workflow.removeFolderFromChangeRequests).toHaveBeenCalledWith('Data/Reports', ALICE);
+  });
+
+  const MALFORMED = [
+    '',
+    '../Data',
+    'Data/../roles.yaml',
+    '/Data',
+    'Data//Reports',
+    'Data\\Reports',
+    'Data/Rep\u0000orts',
+    'Data/Rep\norts',
+    '-Data',
+    'C:tmp',
+    'c:/Data/Reports',
+    `Data/${'x'.repeat(1030)}`,
+  ];
+
+  it.each(MALFORMED)('refuses the folder %j before the service sees it', async (folder) => {
+    const res = await fetch(
+      `${baseUrl}/api/workflow/change-requests/under-folder?path=${encodeURIComponent(folder)}`,
+    );
+    expect(res.status).toBe(400);
+    expect(workflow.changeRequestsUnderFolder).not.toHaveBeenCalled();
+  });
+
+  it.each(MALFORMED)('refuses to remove the folder %j before the service sees it', async (folder) => {
+    const res = await fetch(`${baseUrl}/api/workflow/change-requests/under-folder/remove`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ path: folder }),
+    });
+    expect(res.status).toBe(400);
+    expect(workflow.removeFolderFromChangeRequests).not.toHaveBeenCalled();
+  });
+
+  it('keeps the service’s refusal status', async () => {
+    workflow.removeFolderFromChangeRequests.mockRejectedValue(
+      new WorkflowDomainError("You can't remove proposed changes from #40", 403),
+    );
+    const res = await fetch(`${baseUrl}/api/workflow/change-requests/under-folder/remove`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ path: 'Data/Reports' }),
+    });
+    expect(res.status).toBe(403);
+    expect((await res.json()).error).toContain('#40');
+  });
+});