feat: add CASL authorization and AI configuration

apps/server/src/classes/classes.controller.ts

@@ -30,15 +30,10 @@ import { RequirePermission } from '../auth/decorators/permission.decorator';
 import { NotificationsService } from '../notifications/notifications.service';
 import { NotificationType } from '../entities/notification.entity';
 import * as ExcelJS from 'exceljs';
-
-interface RequestUser {
-  id: number;
-  permissions?: string[];
-  isSuperAdmin?: boolean;
-}
+import { AuthorizationService, CaslAction, SubjectName, AuthenticatedUser } from '../authorization';
 
 interface AuthenticatedRequest {
-  user: RequestUser;
+  user: AuthenticatedUser;
 }
 
 @UseGuards(JwtAuthGuard)
@@ -48,11 +43,14 @@ export class ClassesController {
     private readonly service: ClassesService,
     private readonly logService: OperationLogsService,
     private readonly notificationsService: NotificationsService,
+    private readonly authz: AuthorizationService,
   ) {}
 
   private assertReadAccess(req: AuthenticatedRequest, classId: number) {
+    // Legacy: Manage (super_admin) or Update (class:edit) grants broad class access
     const canManageAll =
-      req.user.isSuperAdmin === true || req.user.permissions?.includes('class:edit') === true;
+      this.authz.can(req, CaslAction.Manage, SubjectName.Class) ||
+      this.authz.can(req, CaslAction.Update, SubjectName.Class);
     return this.service.assertClassAccess(req.user.id, classId, canManageAll);
   }
 
@@ -61,7 +59,8 @@ export class ClassesController {
   async findAll(@Query() query: QueryClassDto, @Request() req: AuthenticatedRequest) {
     const classIds = await this.service.getAccessibleClassIds(
       req.user.id,
-      req.user.isSuperAdmin === true || req.user.permissions?.includes('class:edit') === true,
+      this.authz.can(req, CaslAction.Manage, SubjectName.Class) ||
+        this.authz.can(req, CaslAction.Update, SubjectName.Class),
     );
     return this.service.findAll(query, classIds);
   }