fix permissions and teacher attendance workflows

apps/server/src/students/students.scope.spec.ts

@@ -0,0 +1,43 @@
+import { StudentsService } from './students.service';
+
+describe('StudentsService — teacher class scope', () => {
+  it('limits student list to active students in assigned classes', async () => {
+    const repo = { find: jest.fn().mockResolvedValue([{ id: 11, name: '张三' }]) };
+    const classStudentRepo = {
+      find: jest.fn().mockResolvedValue([{ studentId: 11 }, { studentId: 11 }, { studentId: 12 }]),
+    };
+    const service = new StudentsService(
+      repo as never,
+      classStudentRepo as never,
+      {} as never,
+      {} as never,
+      {} as never,
+    );
+
+    await service.findAll({}, [3, 5]);
+
+    expect(classStudentRepo.find).toHaveBeenCalledWith({
+      where: { classId: expect.any(Object), status: 'active' },
+    });
+    expect(repo.find).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: expect.objectContaining({ id: expect.any(Object) }),
+        relations: ['tenant'],
+      }),
+    );
+  });
+
+  it('returns an empty student list when teacher has no assigned classes', async () => {
+    const repo = { find: jest.fn() };
+    const service = new StudentsService(
+      repo as never,
+      {} as never,
+      {} as never,
+      {} as never,
+      {} as never,
+    );
+
+    await expect(service.findAll({}, [])).resolves.toEqual([]);
+    expect(repo.find).not.toHaveBeenCalled();
+  });
+});