chore: import DH V2 D5.6.4 production baseline

api-v3/test/unit/audit-controller.test.ts

@@ -0,0 +1,16 @@
+import 'reflect-metadata';
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { AuditController } from '../../src/audit/audit.controller';
+import { REQUIRED_PERMISSIONS_KEY } from '../../src/authorization/decorators/require-permissions.decorator';
+
+function permissionFor(method: string): string[] {
+  const prototype = AuditController.prototype;
+  const handler = prototype[method as keyof typeof prototype];
+  return Reflect.getMetadata(REQUIRED_PERMISSIONS_KEY, handler) as string[];
+}
+
+test('AuditController protects list and detail with audit.read', () => {
+  assert.deepEqual(permissionFor('list'), ['audit.read']);
+  assert.deepEqual(permissionFor('getById'), ['audit.read']);
+});