Project pending approvals as authorized work

tests/test_approvals.py

@@ -7,6 +7,8 @@ import unittest
 from sqlalchemy import create_engine
 from sqlalchemy.orm import sessionmaker
 
+from govoplan_core.auth import ApiPrincipal
+from govoplan_core.core.access import PrincipalRef
 from govoplan_core.core.approvals import (
     ApprovalActorSelector,
     ApprovalDecisionCommand,
@@ -16,6 +18,8 @@ from govoplan_core.core.approvals import (
 )
 from govoplan_core.db.base import Base
 from govoplan_approvals.backend.service import ApprovalStoreError, SqlApprovalRequests
+from govoplan_core.core.tasks import WorkItemQuery
+from govoplan_approvals.backend.work_items import ApprovalWorkItemProvider
 
 
 DIGEST = "a" * 64
@@ -241,6 +245,62 @@ class ApprovalRuntimeTests(unittest.TestCase):
             )
             self.assertEqual("escalated", escalated.state)
 
+    def test_work_provider_reuses_exact_decision_eligibility(self) -> None:
+        with self.Session() as session:
+            created = self.service.create_request(
+                session,
+                self.requester,
+                command=request_command(),
+                idempotency_key="work-provider-request",
+            )
+            reviewer = ApiPrincipal(
+                principal=PrincipalRef(
+                    account_id="reviewer",
+                    membership_id="membership-reviewer",
+                    tenant_id="tenant-1",
+                    scopes=frozenset(
+                        {
+                            "approvals:workspace:read",
+                            "approvals:workspace:decide",
+                        }
+                    ),
+                    group_ids=frozenset({"reviewers"}),
+                ),
+                account=object(),
+                user=object(),
+            )
+            provider = ApprovalWorkItemProvider()
+
+            page = provider.list_items(
+                session,
+                reviewer,
+                query=WorkItemQuery(tenant_id="tenant-1"),
+            )
+            self.assertEqual(1, page.total)
+            self.assertEqual(created.id, page.items[0].id)
+            self.assertEqual("Review", page.items[0].required_action)
+            self.assertEqual("campaign_version", page.items[0].sources[0].resource_type)
+
+            self.service.decide(
+                session,
+                reviewer,
+                request_id=created.id,
+                command=ApprovalDecisionCommand(
+                    "approved",
+                    "Reviewed.",
+                    1,
+                    "work-provider-decision",
+                ),
+            )
+            self.assertEqual(
+                0,
+                provider.list_items(
+                    session,
+                    reviewer,
+                    query=WorkItemQuery(tenant_id="tenant-1"),
+                ).total,
+            )
+
     def test_template_and_evidence_role_constraints_are_frozen(self) -> None:
         template_command = ApprovalTemplateCreateCommand(
             key="campaign-release",