chore: import DH V2 D5.6.4 production baseline

api-v3/test/unit/survey-planning-authorization.test.ts

@@ -0,0 +1,31 @@
+import 'reflect-metadata';
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { REQUIRED_PERMISSIONS_KEY } from '../../src/authorization/decorators/require-permissions.decorator';
+import {
+  SurveyCampaignsController,
+  SurveyCampaignTargetsController,
+} from '../../src/survey-planning/survey-campaigns.controller';
+
+function permissionFor(controller: object, method: string): string[] {
+  const handler = controller[method as keyof typeof controller];
+  return Reflect.getMetadata(REQUIRED_PERMISSIONS_KEY, handler) as string[];
+}
+
+test('campaign endpoints separate reading, management and assignment', () => {
+  const controller = SurveyCampaignsController.prototype;
+  assert.deepEqual(permissionFor(controller, 'list'), ['surveys.read']);
+  assert.deepEqual(permissionFor(controller, 'get'), ['surveys.read']);
+  assert.deepEqual(permissionFor(controller, 'assignees'), ['surveys.assign']);
+  assert.deepEqual(permissionFor(controller, 'create'), ['surveys.manage']);
+  assert.deepEqual(permissionFor(controller, 'update'), ['surveys.manage']);
+  assert.deepEqual(permissionFor(controller, 'changeStatus'), ['surveys.manage']);
+  assert.deepEqual(permissionFor(controller, 'addTarget'), ['surveys.manage']);
+});
+
+test('target planning, assignment and execution use distinct permissions', () => {
+  const controller = SurveyCampaignTargetsController.prototype;
+  assert.deepEqual(permissionFor(controller, 'update'), ['surveys.manage']);
+  assert.deepEqual(permissionFor(controller, 'assign'), ['surveys.assign']);
+  assert.deepEqual(permissionFor(controller, 'changeStatus'), ['surveys.execute']);
+});