fix(tess): wire command approvals through gateway

apps/gateway/src/commands/command-executor-tess-security.spec.ts

@@ -1,5 +1,6 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import type { SlashCommandPayload } from '@mosaicstack/types';
+import { CommandAuthorizationService } from './command-authorization.service.js';
 import { CommandExecutorService } from './command-executor.service.js';
 
 const registry = {
@@ -33,7 +34,7 @@ const authorization = {
   ),
 };
 
-function buildExecutor(): CommandExecutorService {
+function buildExecutor(authorizationService: unknown = authorization): CommandExecutorService {
   return new CommandExecutorService(
     registry as never,
     { getSession: vi.fn() } as never,
@@ -44,10 +45,25 @@ function buildExecutor(): CommandExecutorService {
     null,
     null,
     null,
-    authorization as never,
+    authorizationService as never,
   );
 }
 
+function createDurableAuthorization(): CommandAuthorizationService {
+  const entries = new Map<string, string>();
+  const db = {
+    select: () => ({ from: () => ({ where: () => ({ limit: async () => [{ role: 'admin' }] }) }) }),
+  };
+  const redis = {
+    get: async (key: string) => entries.get(key) ?? null,
+    set: async (key: string, value: string) => {
+      entries.set(key, value);
+    },
+    del: async (key: string) => Number(entries.delete(key)),
+  };
+  return new CommandAuthorizationService(db as never, redis);
+}
+
 describe('TESS-M1-SEC-001 command authorization abuse cases', () => {
   const payload: SlashCommandPayload = { command: 'gc', conversationId: 'conversation-1' };
 
@@ -70,4 +86,21 @@ describe('TESS-M1-SEC-001 command authorization abuse cases', () => {
     expect(result.message).toContain('approval');
     expect(sessionGc.sweepOrphans).not.toHaveBeenCalled();
   });
+
+  it('executes an admin command only after a valid durable approval is issued and supplied', async (): Promise<void> => {
+    const executor = buildExecutor(createDurableAuthorization());
+
+    const denied = await executor.execute(payload, 'admin-1');
+    const approval = await executor.createApproval(payload, 'admin-1');
+    const approved = await executor.execute(
+      { ...payload, approvalId: approval?.approvalId },
+      'admin-1',
+    );
+
+    expect(denied.success).toBe(false);
+    expect(denied.message).toContain('approval');
+    expect(approval).not.toBeNull();
+    expect(approved.success).toBe(true);
+    expect(sessionGc.sweepOrphans).toHaveBeenCalledOnce();
+  });
 });