fix permissions and teacher attendance workflows

apps/server/src/rbac/rbac.permissions.spec.ts

@@ -0,0 +1,23 @@
+import { PRESET_ROLES } from './rbac.service';
+
+describe('preset role permissions', () => {
+  it('gives teachers explicit workspace permissions without class/schedule delete privileges', () => {
+    const teacher = PRESET_ROLES.find((role) => role.code === 'teacher');
+
+    expect(teacher).toBeDefined();
+    expect(teacher?.permissionGroups).toEqual(['notification', 'profile']);
+    expect(teacher?.extraPermissions).toEqual(
+      expect.arrayContaining([
+        'student:view',
+        'class:view',
+        'schedule:view',
+        'attendance:view',
+        'attendance:create',
+        'attendance:export',
+      ]),
+    );
+    expect(teacher?.extraPermissions).not.toEqual(
+      expect.arrayContaining(['class:delete', 'schedule:delete']),
+    );
+  });
+});