feat(assistant): align resource tool visibility with read audiences

packages/api/src/__tests__/assistant-router.test.ts

@@ -357,6 +357,7 @@ describe("assistant router tool gating", () => {
 
     expect(controllerNames).toContain("query_change_history");
     expect(controllerNames).toContain("get_entity_timeline");
+    expect(controllerNames).toContain("search_by_skill");
     expect(controllerNames).toContain("export_resources_csv");
     expect(controllerNames).toContain("export_projects_csv");
     expect(controllerNames).toContain("list_audit_log_entries");
@@ -368,6 +369,7 @@ describe("assistant router tool gating", () => {
     expect(controllerNames).toContain("get_project_computation_graph");
     expect(userNames).not.toContain("query_change_history");
     expect(userNames).not.toContain("get_entity_timeline");
+    expect(userNames).not.toContain("search_by_skill");
     expect(userNames).not.toContain("export_resources_csv");
     expect(userNames).not.toContain("export_projects_csv");
     expect(userNames).not.toContain("list_audit_log_entries");
@@ -660,8 +662,10 @@ describe("assistant router tool gating", () => {
     expect(managerNames).not.toContain("create_metro_city");
     expect(managerNames).not.toContain("update_metro_city");
     expect(managerNames).not.toContain("delete_metro_city");
+    expect(userNames).not.toContain("search_resources");
     expect(userNames).not.toContain("get_country");
     expect(userNames).not.toContain("list_org_units");
+    expect(userWithResourceOverview).toContain("search_resources");
     expect(userWithResourceOverview).toContain("get_country");
     expect(userWithResourceOverview).toContain("list_org_units");
   });

packages/api/src/__tests__/resource-router.test.ts

@@ -697,6 +697,52 @@ describe("resource router", () => {
     });
   });
 
+  it("blocks controller-only resource analytics for plain users", async () => {
+    const db = {
+      resource: {
+        findMany: vi.fn(),
+      },
+      assignment: {
+        findMany: vi.fn(),
+      },
+      demandRequirement: {
+        findMany: vi.fn(),
+      },
+    };
+
+    const caller = createProtectedCaller(db);
+
+    await expect(caller.getSkillsAnalytics()).rejects.toMatchObject({
+      code: "FORBIDDEN",
+      message: "Controller access required",
+    });
+    await expect(caller.searchBySkills({
+      rules: [{ skill: "Houdini", minProficiency: 4 }],
+    })).rejects.toMatchObject({
+      code: "FORBIDDEN",
+      message: "Controller access required",
+    });
+    await expect(caller.listWithUtilization({})).rejects.toMatchObject({
+      code: "FORBIDDEN",
+      message: "Controller access required",
+    });
+    await expect(caller.getChargeabilityStats({})).rejects.toMatchObject({
+      code: "FORBIDDEN",
+      message: "Controller access required",
+    });
+    await expect(caller.getSkillMarketplace({
+      searchSkill: "Houdini",
+      availableOnly: true,
+    })).rejects.toMatchObject({
+      code: "FORBIDDEN",
+      message: "Controller access required",
+    });
+
+    expect(db.resource.findMany).not.toHaveBeenCalled();
+    expect(db.assignment.findMany).not.toHaveBeenCalled();
+    expect(db.demandRequirement.findMany).not.toHaveBeenCalled();
+  });
+
   it("rejects chargeability summary access for foreign resources", async () => {
     const db = {
       resource: {