feat(platform): harden governance and approval workflows

Tiku.UnitTests/PlatformAdmin/PlatformApprovalRulesTests.cs

@@ -0,0 +1,41 @@
+using Tiku.Application.PlatformAdmin;
+using Tiku.Domain.Platform;
+
+namespace Tiku.UnitTests.PlatformAdmin;
+
+public sealed class PlatformApprovalRulesTests
+{
+    [Theory]
+    [InlineData(4_999_999, false)]
+    [InlineData(5_000_000, true)]
+    [InlineData(5_000_001, true)]
+    public void Financial_threshold_is_fifty_thousand_yuan(int amountCents, bool expected) =>
+        Assert.Equal(expected, PlatformApprovalRules.RequiresApproval(true, false, 5_000_000, amountCents));
+
+    [Fact]
+    public void Always_policy_requires_approval_without_amount() =>
+        Assert.True(PlatformApprovalRules.RequiresApproval(true, true, null, null));
+
+    [Fact]
+    public void Disabled_policy_executes_immediately() =>
+        Assert.False(PlatformApprovalRules.RequiresApproval(false, true, 1, 10));
+
+    [Fact]
+    public void Requester_cannot_approve_own_request()
+    {
+        var actor = Guid.NewGuid();
+        var denial = PlatformApprovalRules.DecisionDenialCode(
+            PlatformApprovalRequestStatus.Pending, actor, actor, DateTimeOffset.UtcNow.AddHours(1),
+            "platform:tenant:manage", new HashSet<string> { "platform:tenant:manage" }, DateTimeOffset.UtcNow);
+        Assert.Equal("approval_maker_checker_required", denial);
+    }
+
+    [Fact]
+    public void Approver_must_still_hold_business_permission()
+    {
+        var denial = PlatformApprovalRules.DecisionDenialCode(
+            PlatformApprovalRequestStatus.Pending, Guid.NewGuid(), Guid.NewGuid(), DateTimeOffset.UtcNow.AddHours(1),
+            "platform:tenant:manage", new HashSet<string>(), DateTimeOffset.UtcNow);
+        Assert.Equal("approval_business_permission_required", denial);
+    }
+}