test(open): retain image reference whitelist regression during closeout

apps/pac-service/tests/lookup-content.spec.ts

+import { lookupContent } from '../src/modules/open/lookup-content';
 import { toLookupFact, LookupFactRow } from '../src/modules/open/lookup-fact';
 import { toOpenFact } from '../src/modules/open/open-fact';
 import { LookupContentError } from '../src/modules/open/lookup-narrative';
@@ -198,3 +199,23 @@ describe('lookup content whitelist', () => {
     ).toBe(false);
   });
 });
+
+test('image file references keep the existing access contract with a nested whitelist', () => {
+  const ref = {
+    provider: 'meyer',
+    connectionId: 'test',
+    fileId: 'oss-1',
+    role: 'original',
+    secret: 'excluded',
+  };
+  const result = lookupContent(
+    'image_record',
+    { image_external_id: 'i-1', file_refs: [ref] },
+    null,
+    null,
+    'friday',
+  );
+  expect(result.fileRefs).toEqual([
+    { provider: 'meyer', connectionId: 'test', fileId: 'oss-1', role: 'original' },
+  ]);
+});