feat: complete catalog sensitivity enhancements

backend/test/routes-workspaces.test.ts

@@ -11,6 +11,8 @@ import { WorkspaceRegistry, type WorkspaceRevision } from "../src/workspaces/reg
 import { serializeWorkspaceYaml, type CanonicalWorkspace } from "../src/workspaces/schema.js";
 import { WorkspaceSecretStore } from "../src/workspaces/secret-store.js";
 import type { AuthDiagnoser, AuthDiagnostics } from "../src/auth/diagnostics.js";
+import type { WorkspaceDatabase } from "../src/catalog/types.js";
+import type { WorkspaceDatabaseTester } from "../src/routes/workspaces.js";
 
 const workspace: CanonicalWorkspace = {
   workspace: {
@@ -63,12 +65,35 @@ const readyAuthentication: AuthDiagnostics = {
   checks: [{ level: "info", code: "auth_ready", message: "Authentication is ready." }],
 };
 
+const reachableWorkspaceDatabase: WorkspaceDatabase = {
+  id: "db-psd-clinical",
+  workspaceId: "psd-clinical",
+  engine: "postgres",
+  databaseName: "warehouse",
+  schema: "datawarehouse",
+  version: 1,
+  createdAt: "2026-01-01T00:00:00.000Z",
+  updatedAt: "2026-01-01T00:00:00.000Z",
+  binding: {
+    transport: "postgres_direct",
+    host: "current-db.internal",
+    port: 5432,
+    username: "current-reader",
+  },
+  connectionStatus: "reachable",
+  testedVersion: 1,
+  lastTestedAt: "2026-01-01T00:00:00.000Z",
+};
+
 function appFor(
   registry: RegistryFake,
   diagnose = vi.fn(async () => ({ activatable: true, diagnostics: [] })),
   secretStore = testSecretStore(),
   env: Record<string, string> = {},
   authDiagnoser: AuthDiagnoser = { inspect: vi.fn(async () => readyAuthentication) },
+  workspaceDatabaseTester: WorkspaceDatabaseTester = vi.fn(
+    async () => reachableWorkspaceDatabase,
+  ),
 ) {
   return buildApp(loadConfig({
     THT_HARNESS_DIR: "/missing-harness",
@@ -80,6 +105,7 @@ function appFor(
     workspaceDiagnoser: diagnose,
     workspaceSecretStore: secretStore,
     authDiagnoser,
+    workspaceDatabaseTester,
   } as any);
 }
 
@@ -283,7 +309,48 @@ test("runs diagnostics for a schema v4 workspace", async () => {
   expect(diagnose).toHaveBeenCalledWith(workspace, {
     dwh: expect.objectContaining({ transport: "postgres_direct" }),
     evidence: { missing: [], values: {} },
-  }, { writeProbe: false });
+  }, { writeProbe: false, skipDwh: true });
+});
+
+test("reports a missing Database Management configuration without using the legacy DWH test", async () => {
+  const diagnose = vi.fn(async () => ({
+    activatable: true,
+    diagnostics: [{
+      level: "info" as const,
+      code: "binding_ok" as const,
+      message: "Installation bindings and diagnostics succeeded.",
+    }],
+  }));
+  const workspaceDatabaseTester = vi.fn(async () => undefined);
+  const app = appFor(
+    registryFake(),
+    diagnose,
+    testSecretStore(),
+    {},
+    { inspect: vi.fn(async () => readyAuthentication) },
+    workspaceDatabaseTester,
+  );
+
+  const response = await app.inject({
+    method: "POST", url: "/workspaces/psd-clinical/test", payload: {},
+  });
+
+  expect(response.statusCode).toBe(200);
+  expect(response.json()).toMatchObject({
+    activatable: false,
+    diagnostics: [{
+      level: "error",
+      code: "binding_missing",
+      field: "dwh",
+      message: "Configure this workspace in Database Management before testing connections.",
+    }],
+  });
+  expect(diagnose).toHaveBeenCalledWith(
+    workspace,
+    expect.anything(),
+    { writeProbe: false, skipDwh: true },
+  );
+  expect(workspaceDatabaseTester).toHaveBeenCalledWith("psd-clinical");
 });
 
 test("reports runtime secret requirements without returning stored values", async () => {