fix(portal): prepare approved resource mappings safely

www/tools/deploy-portal-resources.test.mjs

@@ -27,7 +27,7 @@ async function writeApprovedResource(privateRoot, hubfs, bytes = Buffer.from('sy
   const localFile = 'a'.repeat(64);
   await fs.writeFile(path.join(hubfs, localFile), bytes, { mode: 0o600 });
   await fs.writeFile(path.join(privateRoot, 'manifest.json'), JSON.stringify({ resources: [{
-    classification: 'STAFF-INTERNAL', deliveryPath: '/staff-resources/guide.pdf', destinationImplemented: true, destinationVerified: true, destinationAccessControlled: true, rewriteApproved: true, localFile, sha256: digest(bytes), size: bytes.length,
+    classification: 'STAFF-INTERNAL', deliveryPath: '/staff-resources/guide.pdf', mappingApproved: true, accessPolicyApproved: true, rewriteApproved: true, destinationInstalled: false, destinationHashVerified: false, destinationPermissionsVerified: false, destinationAccessVerified: false, localFile, sha256: digest(bytes), size: bytes.length,
   }] }));
   return { localFile, bytes };
 }
@@ -40,8 +40,22 @@ test('resource plan copies only hash-verified approved protected resources', asy
     assert.equal(plan.files.length, 1);
     assert.equal((await fs.readFile(path.join(stage, 'staff', localFile))).toString(), bytes.toString());
     assert.match(serializeResourcePlan(plan), /^AIA_PORTAL_RESOURCE_PLAN_V1\nsourceCommit=a{40}\nfile\tstaff\tguide\.pdf\t/);
-    await fs.writeFile(path.join(privateRoot, 'manifest.json'), JSON.stringify({ resources: [{ classification: 'STAFF-INTERNAL', deliveryPath: '/staff-resources/../bad', localFile, sha256: digest(bytes), size: bytes.length }] }));
-    await assert.rejects(prepareResourcePlan(privateRoot, path.join(root, 'second'), sha), /destination/);
+    await fs.writeFile(path.join(privateRoot, 'manifest.json'), JSON.stringify({ resources: [{ classification: 'STAFF-INTERNAL', deliveryPath: '/staff-resources/../bad', mappingApproved: true, accessPolicyApproved: true, rewriteApproved: true, localFile, sha256: digest(bytes), size: bytes.length }] }));
+    await assert.rejects(prepareResourcePlan(privateRoot, path.join(root, 'second'), sha), /approved for installation/);
+  } finally { await fs.rm(root, { recursive: true, force: true }); }
+});
+
+test('one verified source may be installed into both protected role namespaces', async () => {
+  const { root, privateRoot, hubfs, stage } = await fixture();
+  try {
+    const localFile = 'b'.repeat(64), bytes = Buffer.from('synthetic shared non-phi document');
+    await fs.writeFile(path.join(hubfs, localFile), bytes, { mode: 0o600 });
+    const mapping = (role) => ({ role, classification: role === 'staff' ? 'STAFF-INTERNAL' : 'MANAGEMENT-INTERNAL', deliveryPath: `/${role}-resources/shared.pdf`, mappingApproved: true, accessPolicyApproved: true, rewriteApproved: true, destinationInstalled: false, destinationHashVerified: false, destinationPermissionsVerified: false, destinationAccessVerified: false });
+    await fs.writeFile(path.join(privateRoot, 'manifest.json'), JSON.stringify({ resources: [{ classification: 'UNRESOLVED', installMappings: [mapping('staff'), mapping('management')], localFile, sha256: digest(bytes), size: bytes.length }] }));
+    const plan = await prepareResourcePlan(privateRoot, stage, sha);
+    assert.deepEqual(plan.files.map(({ role }) => role), ['management', 'staff']);
+    assert.equal((await fs.readFile(path.join(stage, 'staff', localFile))).toString(), bytes.toString());
+    assert.equal((await fs.readFile(path.join(stage, 'management', localFile))).toString(), bytes.toString());
   } finally { await fs.rm(root, { recursive: true, force: true }); }
 });