feat(workbench): add dynamic task approval lifecycle

tests/unit/test_operational_data.py

@@ -5,6 +5,8 @@ import pytest
 from pydantic import ValidationError
 
 from app.auth.project_dependencies import ProjectContext
+from app.api.v1.endpoints.operational_tasks import _task_permissions
+from app.auth.permissions import SCADA_VIEW, SIMULATION_VIEW
 from app.domain.schemas.operational_data import TaskDataQuery
 from app.infra.integrations.operational_data import TaskDataError, TaskDataSettings, read_task_data
 
@@ -129,3 +131,28 @@ def test_query_is_a_finite_read_scope_with_bounded_time_and_device_count():
                       start="2026-09-01T00:00:00Z", end="2026-09-23T00:00:00Z")
     with pytest.raises(ValidationError):
         TaskDataQuery(source="peripheral_observations")
+
+
+@pytest.mark.anyio
+async def test_task_service_uses_approved_delegation_only_during_source_read():
+    ctx = ProjectContext(project_id=uuid4(), user_id=uuid4(), project_code="test",
+                         project_role="member", system_role="service")
+    assert SCADA_VIEW not in _task_permissions(ctx)
+    assert SIMULATION_VIEW not in _task_permissions(ctx)
+    query = TaskDataQuery(source="scada_devices")
+    with pytest.raises(TaskDataError, match="委托身份尚未配置"):
+        await read_task_data(context=ctx, credential="Bearer AGENT", query=query,
+                             delegated=True, settings=settings())
+
+    def handler(request):
+        assert request.headers["Authorization"] == "Bearer REVIEWED_SOURCE"
+        assert request.headers["X-Project-Id"] == str(ctx.project_id)
+        return httpx.Response(200, json={"items": [], "project_id": str(ctx.project_id)})
+
+    snapshot = await read_task_data(
+        context=ctx, credential="Bearer AGENT", query=query, delegated=True,
+        settings=TaskDataSettings(_env_file=None, server_url="http://server.test",
+                                  delegation_bearer="REVIEWED_SOURCE"),
+        transport=httpx.MockTransport(handler),
+    )
+    assert snapshot.source == "scada_devices"