fix(portal): prepare approved resource mappings safely

www/tools/service-portal.test.mjs

@@ -10,6 +10,7 @@ import { decryptPortalStream, encryptPortalStream, validatePortalPayload, portal
 import { collectResource, resourceReferences, rewriteResources } from './portal-resources.mjs';
 import { isFormACompletion } from '../src/utils/jotform-completion.ts';
 import { portalLinkPresentation } from '../src/utils/portal-presentation.ts';
+import { applyRoleMappings, approvedMapping, summarizeMappings } from './portal-production.mjs';
 
 test('completion envelope requires an exact approved origin, active frame window and string Form A ID', () => {
   const source = {};
@@ -108,12 +109,28 @@ test('resource extraction reconciles duplicate views and rewrites only approved
   const html = '<h2>Synthetic</h2><a href="/hubfs/example.pdf">Example</a><a href="/hubfs/example.pdf">Again</a><a href="https://unapproved.invalid/form">Other</a>';
   const refs = resourceReferences(html, 'synthetic');
   assert.equal(refs.length, 2); assert.equal(new Set(refs.map((r) => r.sourceUrl)).size, 1);
-  const record = { references: refs, rewriteApproved: true, destinationImplemented: true, destinationVerified: true, deliveryPath: '/staff-resources/example.pdf', classification: 'STAFF-INTERNAL' };
-  assert.throws(() => rewriteResources(html, [record]));
-  const result = rewriteResources(html, [{ ...record, destinationAccessControlled: true }]);
+  const record = { references: refs, rewriteApproved: true, mappingApproved: true, deliveryPath: '/staff-resources/example.pdf', classification: 'STAFF-INTERNAL' };
+  assert.equal(rewriteResources(html, [record], 'staff').html, html);
+  const result = rewriteResources(html, [{ ...record, accessPolicyApproved: true }], 'staff');
   assert.equal(result.count, 2); assert.ok(result.html.includes('>Again</a>')); assert.ok(result.html.includes('https://unapproved.invalid/form'));
   assert.equal(rewriteResources(html, []).html, html);
 });
+test('role-based resource mapping separates source approval from later server verification', () => {
+  const record = {
+    sourceUrl: 'https://www.azinstitute4autism.com/hubfs/guide.pdf', originalPath: '/hubfs/guide.pdf',
+    localFile: 'a'.repeat(64), references: [{ view: 'staff-stream' }, { view: 'management-stream' }],
+  };
+  const roles = { staff: 'staff-stream', management: 'management-stream' };
+  const summary = summarizeMappings({ resources: [record] }, roles);
+  assert.equal(summary.shared, 1); assert.equal(summary.ambiguous, 0);
+  const mapped = applyRoleMappings({ resources: [record] }, roles, { approveShared: true });
+  assert.equal(mapped.resources[0].installMappings.length, 2);
+  for (const role of ['staff', 'management']) {
+    const mapping = approvedMapping(mapped.resources[0], role);
+    assert.ok(mapping); assert.equal(mapping.destinationInstalled, false);
+    assert.equal(mapping.destinationAccessVerified, false);
+  }
+});
 test('private collector validates binary, reuses hash, rejects errors and unapproved redirects', async () => {
   const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'aia-private-test-'));
   try {