refactor(housekeeping): reuse request capability context

src/features/housekeeping/foundation/authorization.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, it } from "vitest";
+import { authorizeHousekeeping } from "./authorization";
+import { anyCapability, type HousekeepingCapabilityContext } from "./contracts";
+
+function capabilityContext(
+	granted: readonly string[],
+	rank = 7,
+): HousekeepingCapabilityContext {
+	return {
+		actor: { id: 42, username: "operator", rank },
+		isSuperAdmin: false,
+		has: (slug) => granted.includes(slug),
+		hasAny: (...slugs) => slugs.some((slug) => granted.includes(slug)),
+		hasAll: (...slugs) => slugs.every((slug) => granted.includes(slug)),
+	};
+}
+
+describe("authorizeHousekeeping", () => {
+	it("returns the authorized capability context", () => {
+		const context = capabilityContext(["admin.users.view"]);
+
+		expect(
+			authorizeHousekeeping(context, anyCapability("admin.users.view")),
+		).toMatchObject({ ok: true, data: context });
+	});
+
+	it("returns FORBIDDEN for a missing capability regardless of rank", () => {
+		const result = authorizeHousekeeping(
+			capabilityContext([], 999),
+			anyCapability("admin.users.view"),
+		);
+
+		expect(result).toMatchObject({
+			ok: false,
+			error: {
+				code: "FORBIDDEN",
+				messageKey: "errors.housekeeping.forbidden",
+			},
+		});
+	});
+});