Protect private API routes and scope agent data

SovereignAI-Starter/tests/test_workspace_changes.py

@@ -36,6 +36,25 @@ class WorkspaceChangeTests(unittest.TestCase):
         with self.assertRaisesRegex(ValueError, "انتهت صلاحية"):
             workspace.apply_change_preview(str(preview["token"]))
 
+    def test_preview_can_only_be_applied_by_its_owner(self) -> None:
+        target = self.root / "src" / "owned.py"
+        target.write_text("before = True\n", encoding="utf-8")
+        preview = workspace.create_change_preview(
+            self.root,
+            "src/owned.py",
+            "update",
+            "after = True\n",
+            user_id="account-one",
+        )
+
+        with self.assertRaisesRegex(ValueError, "لا تخص جلسة"):
+            workspace.apply_change_preview(
+                str(preview["token"]), user_id="account-two"
+            )
+        self.assertEqual(target.read_text(encoding="utf-8"), "before = True\n")
+        workspace.apply_change_preview(str(preview["token"]), user_id="account-one")
+        self.assertEqual(target.read_text(encoding="utf-8"), "after = True\n")
+
     def test_update_preview_detects_external_changes_before_apply(self) -> None:
         target = self.root / "src" / "existing.py"
         target.write_text("old = 1\n", encoding="utf-8")