fix permissions and teacher attendance workflows

apps/server/src/auth/guards/permission.guard.spec.ts

@@ -0,0 +1,50 @@
+import { PermissionGuard } from './permission.guard';
+
+describe('PermissionGuard', () => {
+  const createContext = (user: unknown) =>
+    ({
+      getHandler: () => function handler() {},
+      getClass: () => class Controller {},
+      switchToHttp: () => ({ getRequest: () => ({ user }) }),
+    }) as never;
+
+  it('denies routes that forgot to declare permissions', () => {
+    const reflector = {
+      getAllAndOverride: jest.fn().mockReturnValue(false),
+      getAllAndMerge: jest.fn().mockReturnValue(undefined),
+    };
+    const guard = new PermissionGuard(reflector as never);
+
+    expect(guard.canActivate(createContext({ permissions: ['dashboard:view'] }))).toBe(false);
+  });
+
+  it('allows explicitly public routes without a user', () => {
+    const reflector = {
+      getAllAndOverride: jest.fn().mockReturnValue(true),
+      getAllAndMerge: jest.fn(),
+    };
+    const guard = new PermissionGuard(reflector as never);
+
+    expect(guard.canActivate(createContext(undefined))).toBe(true);
+  });
+
+  it('allows authenticated-only routes for logged-in users without requiring profile:view', () => {
+    const reflector = {
+      getAllAndOverride: jest.fn().mockReturnValueOnce(false).mockReturnValueOnce(true),
+      getAllAndMerge: jest.fn(),
+    };
+    const guard = new PermissionGuard(reflector as never);
+
+    expect(guard.canActivate(createContext({ permissions: [] }))).toBe(true);
+  });
+
+  it('denies authenticated-only routes when no authenticated user is present', () => {
+    const reflector = {
+      getAllAndOverride: jest.fn().mockReturnValueOnce(false).mockReturnValueOnce(true),
+      getAllAndMerge: jest.fn(),
+    };
+    const guard = new PermissionGuard(reflector as never);
+
+    expect(guard.canActivate(createContext(undefined))).toBe(false);
+  });
+});