fix: close permission review gaps

fix: harden permission-gated UI — minimum-org endpoint, modal/Popconfirm fail-closed on revocation

apps/server/src/organizations/organizations.controller.spec.ts

@@ -0,0 +1,23 @@
+import 'reflect-metadata';
+import { PERMISSION_KEY } from '../auth/decorators/permission.decorator';
+import { OrganizationsController } from './organizations.controller';
+
+describe('OrganizationsController permissions', () => {
+  it('allows student editors to use the options endpoint without full entity exposure', () => {
+    expect(
+      Reflect.getMetadata(PERMISSION_KEY, OrganizationsController.prototype.findOptions),
+    ).toEqual(['organization:view', 'student:create', 'student:edit']);
+  });
+
+  it('keeps the full entity list restricted to organization viewers only', () => {
+    expect(Reflect.getMetadata(PERMISSION_KEY, OrganizationsController.prototype.findAll)).toEqual([
+      'organization:view',
+    ]);
+  });
+
+  it('keeps organization detail restricted to organization viewers', () => {
+    expect(Reflect.getMetadata(PERMISSION_KEY, OrganizationsController.prototype.findOne)).toEqual([
+      'organization:view',
+    ]);
+  });
+});