gongxue-base/apps/server/src/organizations/organizations.controller.spec.ts

import 'reflect-metadata';
import { PERMISSION_KEY } from '../auth/decorators/permission.decorator';
import { OrganizationsController } from './organizations.controller';

describe('OrganizationsController permissions', () => {
  it('allows student editors to use the options endpoint without full entity exposure', () => {
    expect(
      Reflect.getMetadata(PERMISSION_KEY, OrganizationsController.prototype.findOptions),
    ).toEqual(['organization:view', 'student:create', 'student:edit']);
  });

  it('keeps the full entity list restricted to organization viewers only', () => {
    expect(Reflect.getMetadata(PERMISSION_KEY, OrganizationsController.prototype.findAll)).toEqual([
      'organization:view',
    ]);
  });

  it('keeps organization detail restricted to organization viewers', () => {
    expect(Reflect.getMetadata(PERMISSION_KEY, OrganizationsController.prototype.findOne)).toEqual([
      'organization:view',
    ]);
  });
});