feat: implement viewer role permissions for bank transaction imports and connections (#234)

lib/auth/__tests__/require-write.test.ts

@@ -5,7 +5,7 @@ vi.mock('@/lib/company/context', () => ({
   getActiveCompanyId: vi.fn(),
 }))
 
-import { requireWritePermission } from '../require-write'
+import { requireWritePermission, getCompanyRole } from '../require-write'
 import { getActiveCompanyId } from '@/lib/company/context'
 
 describe('requireWritePermission', () => {
@@ -79,3 +79,60 @@ describe('requireWritePermission', () => {
     }
   })
 })
+
+describe('getCompanyRole', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('returns role and companyId for owner', async () => {
+    const { supabase, mockResult } = createMockSupabase()
+    vi.mocked(getActiveCompanyId).mockResolvedValue('company-1')
+    mockResult({ data: { role: 'owner' } })
+
+    const result = await getCompanyRole(supabase, 'user-1')
+    expect(result.ok).toBe(true)
+    if (result.ok) {
+      expect(result.role).toBe('owner')
+      expect(result.companyId).toBe('company-1')
+    }
+  })
+
+  it('returns role for viewer (does not block)', async () => {
+    const { supabase, mockResult } = createMockSupabase()
+    vi.mocked(getActiveCompanyId).mockResolvedValue('company-1')
+    mockResult({ data: { role: 'viewer' } })
+
+    const result = await getCompanyRole(supabase, 'user-1')
+    expect(result.ok).toBe(true)
+    if (result.ok) {
+      expect(result.role).toBe('viewer')
+      expect(result.companyId).toBe('company-1')
+    }
+  })
+
+  it('returns 403 when user has no membership', async () => {
+    const { supabase, mockResult } = createMockSupabase()
+    vi.mocked(getActiveCompanyId).mockResolvedValue('company-1')
+    mockResult({ data: null })
+
+    const result = await getCompanyRole(supabase, 'user-1')
+    expect(result.ok).toBe(false)
+    if (!result.ok) {
+      expect(result.response.status).toBe(403)
+    }
+  })
+
+  it('returns 403 when there is no active company', async () => {
+    const { supabase } = createMockSupabase()
+    vi.mocked(getActiveCompanyId).mockResolvedValue(null)
+
+    const result = await getCompanyRole(supabase, 'user-1')
+    expect(result.ok).toBe(false)
+    if (!result.ok) {
+      expect(result.response.status).toBe(403)
+      const body = await result.response.json()
+      expect(body.error).toContain('aktivt företag')
+    }
+  })
+})