chore: import DH V2 D5.6.4 production baseline

api-v3/test/unit/inspection-findings-authorization.test.ts

@@ -0,0 +1,52 @@
+import 'reflect-metadata';
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { REQUIRED_PERMISSIONS_KEY } from '../../src/authorization/decorators/require-permissions.decorator';
+import { FindingCatalogController } from '../../src/inspection-findings/finding-catalog.controller';
+import {
+  InspectionActFindingsController,
+  InspectionFindingsController,
+} from '../../src/inspection-findings/inspection-findings.controller';
+
+function permissionFor(controller: object, method: string): string[] {
+  const handler = controller[method as keyof typeof controller];
+  return Reflect.getMetadata(REQUIRED_PERMISSIONS_KEY, handler) as string[];
+}
+
+test('finding endpoints separate catalog, content, follow-up and closure permissions', () => {
+  assert.deepEqual(permissionFor(FindingCatalogController.prototype, 'list'), [
+    'finding_catalog.read',
+  ]);
+  for (const method of [
+    'adminList',
+    'createCategory',
+    'updateCategory',
+    'createItem',
+    'updateItem',
+  ]) {
+    assert.deepEqual(permissionFor(FindingCatalogController.prototype, method), [
+      'finding_catalog.manage',
+    ]);
+  }
+  assert.deepEqual(permissionFor(InspectionActFindingsController.prototype, 'list'), [
+    'inspection_findings.read',
+  ]);
+  assert.deepEqual(permissionFor(InspectionActFindingsController.prototype, 'create'), [
+    'inspection_findings.create',
+  ]);
+  assert.deepEqual(permissionFor(InspectionFindingsController.prototype, 'list'), [
+    'inspection_findings.read',
+  ]);
+  assert.deepEqual(permissionFor(InspectionFindingsController.prototype, 'get'), [
+    'inspection_findings.read',
+  ]);
+  assert.deepEqual(permissionFor(InspectionFindingsController.prototype, 'update'), [
+    'inspection_findings.update',
+  ]);
+  assert.deepEqual(permissionFor(InspectionFindingsController.prototype, 'updateFollowUp'), [
+    'inspection_findings.follow_up',
+  ]);
+  assert.deepEqual(permissionFor(InspectionFindingsController.prototype, 'close'), [
+    'inspection_findings.close',
+  ]);
+});