refactor(evidence): extract permission validation and queries to evidence_service, use domain exceptions

backend/tests/test_workflow.py

@@ -419,56 +419,57 @@ def test_dual_validation_red_approves_blue_rejects(mock_log):
 
 def test_evidence_team_separation():
     """Verify evidence router logic separates red and blue evidence correctly."""
-    from app.routers.evidence import _validate_upload_permission, _RED_EDITABLE_STATES, _BLUE_EDITABLE_STATES
+    from app.domain.errors import BusinessRuleViolation, PermissionViolation
+    from app.models.enums import TeamSide
+    from app.services.evidence_service import validate_upload_permission
 
     # Red tech can upload red evidence in draft
     test = _make_test(TestState.draft)
     red_user = _make_user("red_tech")
     red_user.role = "red_tech"
-    from app.models.enums import TeamSide
-    _validate_upload_permission(test, TeamSide.red, red_user)  # should not raise
+    validate_upload_permission(test, TeamSide.red, red_user.role)  # should not raise
 
     # Red tech can upload red evidence in red_executing
     test.state = TestState.red_executing
-    _validate_upload_permission(test, TeamSide.red, red_user)  # should not raise
+    validate_upload_permission(test, TeamSide.red, red_user.role)  # should not raise
 
-    # Red tech CANNOT upload red evidence in blue_evaluating
+    # Red tech CANNOT upload red evidence in blue_evaluating (state violation -> 400)
     test.state = TestState.blue_evaluating
     try:
-        _validate_upload_permission(test, TeamSide.red, red_user)
-        assert False, "Should have raised HTTPException"
-    except HTTPException as exc:
-        assert exc.status_code == 400
+        validate_upload_permission(test, TeamSide.red, red_user.role)
+        assert False, "Should have raised BusinessRuleViolation"
+    except BusinessRuleViolation:
+        pass
 
-    # Red tech CANNOT upload blue evidence
+    # Red tech CANNOT upload blue evidence (role violation -> 403)
     test.state = TestState.blue_evaluating
     try:
-        _validate_upload_permission(test, TeamSide.blue, red_user)
-        assert False, "Should have raised HTTPException"
-    except HTTPException as exc:
-        assert exc.status_code == 403
+        validate_upload_permission(test, TeamSide.blue, red_user.role)
+        assert False, "Should have raised PermissionViolation"
+    except PermissionViolation:
+        pass
 
     # Blue tech can upload blue evidence in blue_evaluating
     test.state = TestState.blue_evaluating
     blue_user = _make_user("blue_tech")
     blue_user.role = "blue_tech"
-    _validate_upload_permission(test, TeamSide.blue, blue_user)  # should not raise
+    validate_upload_permission(test, TeamSide.blue, blue_user.role)  # should not raise
 
-    # Blue tech CANNOT upload blue evidence in draft
+    # Blue tech CANNOT upload blue evidence in draft (state violation -> 400)
     test.state = TestState.draft
     try:
-        _validate_upload_permission(test, TeamSide.blue, blue_user)
-        assert False, "Should have raised HTTPException"
-    except HTTPException as exc:
-        assert exc.status_code == 400
+        validate_upload_permission(test, TeamSide.blue, blue_user.role)
+        assert False, "Should have raised BusinessRuleViolation"
+    except BusinessRuleViolation:
+        pass
 
-    # Blue tech CANNOT upload red evidence
+    # Blue tech CANNOT upload red evidence (role violation -> 403)
     test.state = TestState.draft
     try:
-        _validate_upload_permission(test, TeamSide.red, blue_user)
-        assert False, "Should have raised HTTPException"
-    except HTTPException as exc:
-        assert exc.status_code == 403
+        validate_upload_permission(test, TeamSide.red, blue_user.role)
+        assert False, "Should have raised PermissionViolation"
+    except PermissionViolation:
+        pass
 
 
 # ===========================================================================