feat: complete catalog sensitivity enhancements

backend/test/catalog-databases-routes.test.ts

@@ -11,6 +11,7 @@ import type { ObservedSchemaSnapshot } from "../src/catalog/types.js";
 import { WorkspaceSecretStore } from "../src/workspaces/secret-store.js";
 import type { WorkspaceRegistry, WorkspaceRevision } from "../src/workspaces/registry.js";
 import type { WorkspaceDescriptor } from "../src/workspaces/schema.js";
+import type { WorkspaceDiagnoser } from "../src/routes/workspaces.js";
 
 const roots: string[] = [];
 afterEach(() => {
@@ -33,6 +34,7 @@ function setup(
   catalogDependencies: {
     catalogOperationCoordinator?: CatalogOperationCoordinator;
     catalogPostgresAccess?: CatalogPostgresAccess;
+    workspaceDiagnoser?: WorkspaceDiagnoser;
   } = {},
   workspaceDescriptor: WorkspaceDescriptor = workspace,
 ) {
@@ -56,7 +58,7 @@ function setup(
     workspaceRegistry: registry,
     workspaceSecretStore: secretStore,
     catalogRepository: repository,
-    workspaceDiagnoser: vi.fn(),
+    workspaceDiagnoser: vi.fn(async () => ({ activatable: true, diagnostics: [] })),
     ...catalogDependencies,
   });
   return { app, secretStore, repository };
@@ -275,6 +277,72 @@ test("rejects a connection test while another catalog operation owns the databas
   }
 });
 
+test("workspace and database tests use the same current catalog database binding", async () => {
+  const connect = vi.fn(async () => ({
+    query: vi.fn(async () => ({
+      rows: [{ database: "warehouse", schema: "datawarehouse" }],
+    })),
+    end: vi.fn(async () => undefined),
+  }));
+  const diagnose: WorkspaceDiagnoser = vi.fn(async () => ({
+    activatable: true,
+    diagnostics: [{
+      level: "info",
+      code: "binding_ok",
+      message: "Installation bindings and diagnostics succeeded.",
+    }],
+  }));
+  const { app } = setup({
+    THT_WS_PSD_CLINICAL_DWH_TRANSPORT: "postgres_direct",
+    THT_WS_PSD_CLINICAL_DWH_HOST: "legacy-db.internal",
+    THT_WS_PSD_CLINICAL_DWH_PORT: "5432",
+    THT_WS_PSD_CLINICAL_DWH_USER: "legacy-reader",
+  }, {
+    catalogPostgresAccess: { connect } as CatalogPostgresAccess,
+    workspaceDiagnoser: diagnose,
+  });
+  const created = (await app.inject({
+    method: "POST",
+    url: "/catalog/databases",
+    payload: {
+      ...direct,
+      binding: { ...direct.binding, host: "current-db.internal", username: "current-reader" },
+    },
+  })).json();
+
+  const databaseTest = await app.inject({
+    method: "POST",
+    url: `/catalog/databases/${created.id}/test`,
+    payload: { version: created.version },
+  });
+  const workspaceTest = await app.inject({
+    method: "POST",
+    url: "/workspaces/psd-clinical/test",
+    payload: {},
+  });
+
+  expect(databaseTest.statusCode).toBe(200);
+  expect(workspaceTest.statusCode).toBe(200);
+  expect(connect).toHaveBeenCalledTimes(2);
+  expect(connect.mock.calls.map(([database]) => database)).toEqual([
+    expect.objectContaining({
+      databaseName: "warehouse",
+      schema: "datawarehouse",
+      binding: expect.objectContaining({ host: "current-db.internal", username: "current-reader" }),
+    }),
+    expect.objectContaining({
+      databaseName: "warehouse",
+      schema: "datawarehouse",
+      binding: expect.objectContaining({ host: "current-db.internal", username: "current-reader" }),
+    }),
+  ]);
+  expect(diagnose).toHaveBeenCalledWith(
+    workspace,
+    expect.any(Object),
+    { writeProbe: false, skipDwh: true },
+  );
+});
+
 test("returns exact global and per-database fleet metrics", async () => {
   const { app, repository } = setup();
   const database = await repository.create(direct);