fix(portal): prepare approved resource mappings safely

www/tools/portal-resources.mjs

@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import * as cheerio from 'cheerio';
+import { approvedMapping } from './portal-production.mjs';
 export const sourceOrigin = 'https://www.azinstitute4autism.com';
 export const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
 
@@ -28,16 +29,17 @@ export function resourceReferences(html, view) {
   for (const match of html.matchAll(/url\(\s*['"]?([^)'"\s]+)['"]?\s*\)/g)) record(match[1], '', 'css-url');
   return references;
 }
-export function rewriteResources(html, records) {
+export function rewriteResources(html, records, role) {
   const mappings = new Map();
   for (const record of records) {
-    if (!record.rewriteApproved) continue;
-    if (!record.destinationImplemented || !record.destinationVerified || !record.deliveryPath?.startsWith('/') || record.deliveryPath.startsWith('//') || /[?<>"'\s]/.test(record.deliveryPath)) throw new Error('Unverified resource mapping');
-    if (!['PUBLIC-APPROVED', 'STAFF-INTERNAL', 'MANAGEMENT-INTERNAL'].includes(record.classification)) throw new Error('Unclassified resource mapping');
-    if (record.classification !== 'PUBLIC-APPROVED' && !record.destinationAccessControlled) throw new Error('Internal destination lacks access control');
+    const mapping = role ? approvedMapping(record, role) : null;
+    // Public links use their legacy, explicitly approved single-path contract.
+    const publicMapping = record.classification === 'PUBLIC-APPROVED' && record.rewriteApproved && record.mappingApproved && typeof record.deliveryPath === 'string' && record.deliveryPath.startsWith('/') && !record.deliveryPath.startsWith('//') && !/[?<>"'\s]/.test(record.deliveryPath);
+    if (!mapping && !publicMapping) continue;
+    const deliveryPath = mapping?.deliveryPath ?? record.deliveryPath;
     for (const ref of record.references) {
       if (ref.attribute === 'css-url' || ref.attribute === 'srcset') throw new Error('CSS/srcset rewriting requires separate review');
-      mappings.set(ref.original, record.deliveryPath);
+      mappings.set(ref.original, deliveryPath);
     }
   }
   let count = 0;