chore: import DH V2 D5.6.4 production baseline

api-v3/test/unit/inspection-evidence-authorization.test.ts

@@ -0,0 +1,40 @@
+import 'reflect-metadata';
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { REQUIRED_PERMISSIONS_KEY } from '../../src/authorization/decorators/require-permissions.decorator';
+import {
+  InspectionEvidenceContentController,
+  InspectionFindingCommunicationsController,
+  InspectionFindingEvidenceController,
+} from '../../src/inspection-findings/inspection-evidence.controller';
+
+function permissionFor(controller: object, method: string): string[] {
+  const handler = controller[method as keyof typeof controller];
+  return Reflect.getMetadata(REQUIRED_PERMISSIONS_KEY, handler) as string[];
+}
+
+test('D4 evidence endpoints separate reading and creation', () => {
+  assert.deepEqual(
+    permissionFor(InspectionFindingEvidenceController.prototype, 'list'),
+    ['inspection_evidence.read'],
+  );
+  assert.deepEqual(
+    permissionFor(InspectionFindingEvidenceController.prototype, 'upload'),
+    ['inspection_evidence.create'],
+  );
+  assert.deepEqual(
+    permissionFor(InspectionEvidenceContentController.prototype, 'content'),
+    ['inspection_evidence.read'],
+  );
+});
+
+test('D4 communications endpoints separate reading and creation', () => {
+  assert.deepEqual(
+    permissionFor(InspectionFindingCommunicationsController.prototype, 'list'),
+    ['inspection_communications.read'],
+  );
+  assert.deepEqual(
+    permissionFor(InspectionFindingCommunicationsController.prototype, 'create'),
+    ['inspection_communications.create'],
+  );
+});