feat: establish production SaaS foundation

scripts/tenant-permission-resolution-test.js

@@ -0,0 +1,58 @@
+import assert from 'node:assert/strict';
+
+const {
+  hasResolvedTenantPermission,
+  hasTenantPermission,
+} = await import('../apps/api/src/features/tenant-admin/auth.ts');
+
+function auth(role, permissions = {}, templatePermissions = {}) {
+  return { role, permissions, templatePermissions };
+}
+
+assert.equal(
+  hasTenantPermission(auth('teacher'), 'content:questions:write'),
+  true,
+  'teacher role defaults should grant content permissions',
+);
+assert.equal(
+  hasTenantPermission(auth('teacher', { 'content:*': false }), 'content:questions:write'),
+  false,
+  'member wildcard deny must override role defaults',
+);
+assert.equal(
+  hasTenantPermission(auth('tenant_operator', { 'content:questions:write': false }), 'content:questions:write'),
+  false,
+  'member exact deny must override role defaults',
+);
+assert.equal(
+  hasTenantPermission(auth('teacher', { 'content:questions:write': true, 'content:*': false }), 'content:questions:write'),
+  true,
+  'member exact allow must take precedence over a broader member deny',
+);
+assert.equal(
+  hasTenantPermission(auth('teacher', {}, { 'content:*': false }), 'content:questions:write'),
+  false,
+  'template wildcard deny must override role defaults',
+);
+assert.equal(
+  hasTenantPermission(auth('teacher', { 'content:*': false }, { 'content:questions:write': true }), 'content:questions:write'),
+  false,
+  'member decisions must take precedence over template decisions',
+);
+assert.equal(
+  hasResolvedTenantPermission(auth('teacher'), 'content:analytics:read', false),
+  false,
+  'a caller may narrow role defaults for sensitive content permissions',
+);
+assert.equal(
+  hasResolvedTenantPermission(auth('teacher', { 'content:analytics:read': true }), 'content:analytics:read', false),
+  true,
+  'an explicit member grant should work when the caller role default is denied',
+);
+assert.equal(
+  hasResolvedTenantPermission(auth('tenant_owner', { 'content:*': false }), 'content:write', true),
+  false,
+  'explicit deny must apply even to a role that is allowed by default',
+);
+
+console.log('[PASS] tenant permission resolution precedence');