feat: allow rank-gated housekeeping preview in production

src/features/housekeeping/foundation/preview-route-contract.test.ts

@@ -365,10 +365,12 @@ describe("/admin-next preview gate", () => {
 		vi.clearAllMocks();
 		routeMocks.env.NODE_ENV = "test";
 		routeMocks.env.HOUSEKEEPING_NEXT_PREVIEW_ENABLED = true;
+		routeMocks.getHousekeepingCapabilityContext.mockResolvedValue(
+			capabilityContext([]),
+		);
 	});
 
 	it.each([
-		["production", true],
 		["production", false],
 		["development", false],
 	] as const)("returns 404 for NODE_ENV=%s flag=%s", async (nodeEnv, flag) => {
@@ -385,6 +387,35 @@ describe("/admin-next preview gate", () => {
 		expect(routeMocks.notFound).toHaveBeenCalledTimes(1);
 	});
 
+	it("returns 404 in production without the dedicated preview permission", async () => {
+		routeMocks.env.NODE_ENV = "production";
+
+		await expect(async () =>
+			renderRoute(
+				AdminNextLayout({
+					children: createElement("p", null, "Preview child"),
+				}),
+			),
+		).rejects.toThrow("NEXT_NOT_FOUND");
+		expect(routeMocks.notFound).toHaveBeenCalledTimes(1);
+	});
+
+	it("renders in production for a rank with the dedicated preview permission", async () => {
+		routeMocks.env.NODE_ENV = "production";
+		routeMocks.getHousekeepingCapabilityContext.mockResolvedValue(
+			capabilityContext(["housekeeping.preview.access"]),
+		);
+
+		const html = await renderRoute(
+			AdminNextLayout({
+				children: createElement("p", null, "Preview child"),
+			}),
+		);
+
+		expect(html).toContain("Preview child");
+		expect(routeMocks.notFound).not.toHaveBeenCalled();
+	});
+
 	it.each(["development", "test"] as const)(
 		"renders children in %s when explicitly enabled",
 		async (nodeEnv) => {