From ff1fcd33030b844ccab3694122a3cc8a65d86814 Mon Sep 17 00:00:00 2001
From: Jens Caers <jens@itworx.tech>
Date: Wed, 26 Aug 2026 23:56:35 +0200
Subject: [PATCH] test(deploy): lock one-shot approved request semantics

---
 tests/approved-deployment-one-shot.test.mjs | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 tests/approved-deployment-one-shot.test.mjs

diff --git a/tests/approved-deployment-one-shot.test.mjs b/tests/approved-deployment-one-shot.test.mjs
new file mode 100644
index 0000000..28bd943
--- /dev/null
+++ b/tests/approved-deployment-one-shot.test.mjs
@@ -0,0 +1,21 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import test from 'node:test';
+
+const deployUrl = new URL('../examples/server/forgeflow-deploy', import.meta.url);
+
+test('a signed approved request is consumed once before target selection or mutation', async () => {
+  const script = await readFile(deployUrl, 'utf8');
+  const verifyIndex = script.indexOf('openssl pkeyutl -verify');
+  const consumeIndex = script.indexOf('mkdir -m 0700 "$EVIDENCE_REPLAY_DIR/$APPROVAL_ID"');
+  const targetIndex = script.indexOf('APP_DIR=""');
+  const resetIndex = script.indexOf('git -C "$APP_DIR" reset --hard "$SHA"');
+
+  assert.ok(verifyIndex > 0);
+  assert.ok(consumeIndex > verifyIndex);
+  assert.ok(targetIndex > consumeIndex);
+  assert.ok(resetIndex > consumeIndex);
+  assert.match(script, /EVIDENCE_REPLAY_DIR="\/var\/lib\/forgeflow-status\/approved-requests"/);
+  assert.match(script, /install -d -o root -g root -m 0700 "\$EVIDENCE_REPLAY_DIR"/);
+  assert.match(script, /Approved deployment evidence was already consumed/);
+});