fix(api): harden user self-service and resource linking

packages/api/src/__tests__/assistant-tools-user-admin-assignable-users.test.ts

@@ -0,0 +1,70 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { SystemRole } from "@capakraken/shared";
+
+vi.mock("@capakraken/application", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@capakraken/application")>();
+  return {
+    ...actual,
+    getDashboardBudgetForecast: vi.fn().mockResolvedValue([]),
+    getDashboardPeakTimes: vi.fn().mockResolvedValue([]),
+    listAssignmentBookings: vi.fn().mockResolvedValue([]),
+  };
+});
+
+import { executeTool } from "../router/assistant-tools.js";
+import { createToolContext } from "./assistant-tools-user-admin-test-helpers.js";
+
+describe("assistant user admin tool list_assignable_users", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("lists assignable users through the real user router path for manager users", async () => {
+    const findMany = vi.fn().mockResolvedValue([
+      { id: "user_1", name: "Alice", email: "alice@example.com" },
+    ]);
+    const ctx = createToolContext({
+      user: {
+        findMany,
+      },
+    }, SystemRole.MANAGER);
+
+    const result = await executeTool(
+      "list_assignable_users",
+      JSON.stringify({}),
+      ctx,
+    );
+
+    expect(JSON.parse(result.content)).toEqual([
+      { id: "user_1", name: "Alice", email: "alice@example.com" },
+    ]);
+    expect(findMany).toHaveBeenCalledWith({
+      select: {
+        id: true,
+        name: true,
+        email: true,
+      },
+      orderBy: { name: "asc" },
+    });
+  });
+
+  it("rejects assignable user listing for regular users through the backing router", async () => {
+    const ctx = createToolContext({
+      user: {
+        findMany: vi.fn(),
+      },
+    }, SystemRole.USER);
+
+    const result = await executeTool(
+      "list_assignable_users",
+      JSON.stringify({}),
+      ctx,
+    );
+
+    expect(JSON.parse(result.content)).toEqual(
+      expect.objectContaining({
+        error: "You do not have permission to perform this action.",
+      }),
+    );
+  });
+});