Add regression tests for workspace-scoped approval service calls

tests/test_approval_workspace_scope.py

@@ -0,0 +1,38 @@
+from __future__ import annotations
+
+from unittest.mock import AsyncMock
+
+import pytest
+
+from app.projects.repositories.approval_repository import ApprovalRepository
+from app.projects.services.approval_service import ApprovalService
+
+
+@pytest.mark.asyncio
+async def test_approval_repository_queries_are_workspace_scoped() -> None:
+    repository = ApprovalRepository(None)
+    # Repository calls require a real database; this regression test protects
+    # the service contract so routes cannot omit the authenticated workspace.
+    repository.list_requests = AsyncMock(return_value=[])
+    service = ApprovalService(repository, None)
+    result = await service.list_requests("workspace-a", "workflow-a")
+    assert result == []
+    repository.list_requests.assert_awaited_once_with("workspace-a", "workflow-a")
+
+
+@pytest.mark.asyncio
+async def test_approval_actions_pass_workspace_to_repository() -> None:
+    repository = ApprovalRepository(None)
+    request = type("Request", (), {
+        "created_by": "submitter",
+        "project_id": "project-a",
+        "editor_revision": 1,
+        "workspace_id": "workspace-a",
+    })()
+    repository.get_request = AsyncMock(return_value=request)
+    repository.update_request_status = AsyncMock(return_value=request)
+    editor = type("Editor", (), {"get_state": AsyncMock(return_value=type("State", (), {"revision": 1})())})()
+    service = ApprovalService(repository, editor)
+    await service.approve_request("workspace-a", "request-a", "reviewer")
+    repository.get_request.assert_awaited_once_with("workspace-a", "request-a")
+    repository.update_request_status.assert_awaited_once_with("workspace-a", "request-a", "approved")