feat(platform): harden access scoping and delivery baseline

packages/api/src/__tests__/assistant-tools-country.test.ts

@@ -12,30 +12,50 @@ function createToolContext(
     userId: "user_1",
     userRole,
     permissions: new Set(permissions) as ToolContext["permissions"],
+    session: {
+      user: { email: "assistant@example.com", name: "Assistant User", image: null },
+      expires: "2026-03-29T00:00:00.000Z",
+    },
+    dbUser: {
+      id: "user_1",
+      systemRole: userRole,
+      permissionOverrides: null,
+    },
+    roleDefaults: null,
   };
 }
 
 describe("assistant country tools", () => {
   it("lists countries with schedule rules, active state, and metro cities", async () => {
+    const findMany = vi.fn().mockResolvedValue([
+      {
+        id: "country_de",
+        code: "DE",
+        name: "Deutschland",
+        dailyWorkingHours: 8,
+        scheduleRules: null,
+        isActive: true,
+        metroCities: [{ id: "city_muc", name: "Munich" }],
+      },
+      {
+        id: "country_es",
+        code: "ES",
+        name: "Spain",
+        dailyWorkingHours: 8,
+        scheduleRules: null,
+        isActive: true,
+        metroCities: [{ id: "city_mad", name: "Madrid" }],
+      },
+    ]);
     const ctx = createToolContext({
       country: {
-        findMany: vi.fn().mockResolvedValue([
-          {
-            id: "country_de",
-            code: "DE",
-            name: "Deutschland",
-            dailyWorkingHours: 8,
-            scheduleRules: null,
-            isActive: true,
-            metroCities: [{ id: "city_muc", name: "Munich" }],
-          },
-        ]),
+        findMany,
       },
     });
 
     const result = await executeTool(
       "list_countries",
-      JSON.stringify({ includeInactive: true }),
+      JSON.stringify({ search: "deu" }),
       ctx,
     );
 
@@ -49,6 +69,11 @@ describe("assistant country tools", () => {
       }>;
     };
 
+    expect(findMany).toHaveBeenCalledWith({
+      where: { isActive: true },
+      include: { metroCities: { orderBy: { name: "asc" } } },
+      orderBy: { name: "asc" },
+    });
     expect(parsed.count).toBe(1);
     expect(parsed.countries[0]).toMatchObject({
       code: "DE",