fix: align permission-gated UI actions

apps/server/src/occupancies/occupancies.controller.spec.ts

@@ -0,0 +1,26 @@
+import 'reflect-metadata';
+import { PERMISSION_KEY } from '../auth/decorators/permission.decorator';
+import { OccupanciesController } from './occupancies.controller';
+
+describe('OccupanciesController permissions', () => {
+  it('requires occupancy:delete for single and batch archive actions', () => {
+    expect(Reflect.getMetadata(PERMISSION_KEY, OccupanciesController.prototype.remove)).toEqual([
+      'occupancy:delete',
+    ]);
+    expect(
+      Reflect.getMetadata(PERMISSION_KEY, OccupanciesController.prototype.batchRemove),
+    ).toEqual(['occupancy:delete']);
+  });
+
+  it('keeps read-only endpoints on occupancy:view', () => {
+    expect(Reflect.getMetadata(PERMISSION_KEY, OccupanciesController.prototype.findAll)).toEqual([
+      'occupancy:view',
+    ]);
+    expect(
+      Reflect.getMetadata(PERMISSION_KEY, OccupanciesController.prototype.exportExcel),
+    ).toEqual(['occupancy:view']);
+    expect(
+      Reflect.getMetadata(PERMISSION_KEY, OccupanciesController.prototype.downloadTemplate),
+    ).toEqual(['occupancy:view']);
+  });
+});

apps/server/src/occupancies/occupancies.controller.ts

@@ -159,7 +159,7 @@ export class OccupanciesController {
   }
 
   @Delete(':id')
-  @RequirePermission('occupancy:view')
+  @RequirePermission('occupancy:delete')
   async remove(@Param('id') id: string, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.remove(+id);
@@ -177,7 +177,7 @@ export class OccupanciesController {
   }
 
   @Post('batch-delete')
-  @RequirePermission('occupancy:view')
+  @RequirePermission('occupancy:delete')
   async batchRemove(@Body() body: { ids: number[] }, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.batchRemove(body.ids || []);