完成五人团队正式内用最小收口（07-18-small-team-internal-readiness）

server/tests/unit/routes/payroll.items.test.js

@@ -21,7 +21,7 @@ function buildSalaryItem(overrides = {}) {
 }
 
 async function buildApp({
-  actor = { id: ADMIN_ID, permissionCodes: ["system.settings"] },
+  actor = { id: ADMIN_ID, permissionCodes: ["payroll.manage"] },
 } = {}) {
   const app = Fastify();
   const state = {
@@ -90,7 +90,7 @@ async function buildApp({
 }
 
 describe("payroll salary item routes", () => {
-  it("allows admins to create, list and patch salary items", async () => {
+  it("allows payroll managers to create, list and patch salary items", async () => {
     const { app, state, salaryItem } = await buildApp();
 
     const createResponse = await app.inject({
@@ -157,4 +157,18 @@ describe("payroll salary item routes", () => {
 
     await app.close();
   });
+
+  it("does not accept system.settings as a substitute for payroll.manage", async () => {
+    const { app } = await buildApp({
+      actor: {
+        id: "system-admin-1",
+        permissionCodes: ["system.settings", "system.accounts.manage"],
+      },
+    });
+
+    const response = await app.inject({ method: "GET", url: "/api/payroll/items" });
+
+    expect(response.statusCode).toBe(403);
+    await app.close();
+  });
 });