test(integration): add DB integration tests for students, promotions, roles, modules

Covers full CRUD for each resource via testDb:
- promotions: list, create, get by id, not found, update, delete
- students: list, filter by promo, create, get, not found, update, delete
- roles: list, create, get with permissions, update+reset perms, delete
- modules: list, create, duplicate id rejection, get, not found, update, delete

27 integration tests passing in CI (act + Gitea Actions).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/integration/roles_test.ts

@@ -0,0 +1,145 @@
+import { assertEquals, assertExists } from "@std/assert";
+import {
+  seedRoles,
+  testDb,
+  truncateAll,
+} from "../helpers/db_integration.ts";
+import { permissions, rolePermissions, roles } from "$root/databases/schema.ts";
+import { eq } from "npm:drizzle-orm@0.45.2";
+
+Deno.test({
+  name: "integration: GET /roles - returns all roles",
+  async fn() {
+    await truncateAll();
+    await seedRoles([{ nom: "admin" }, { nom: "employee" }]);
+
+    const rows = await testDb.select().from(roles);
+    assertEquals(rows.length, 2);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration: POST /roles - creates a role",
+  async fn() {
+    await truncateAll();
+
+    const [created] = await testDb
+      .insert(roles)
+      .values({ nom: "viewer" })
+      .returning();
+
+    assertExists(created);
+    assertExists(created.id);
+    assertEquals(created.nom, "viewer");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration: GET /roles/:id - returns role with permissions",
+  async fn() {
+    await truncateAll();
+    const [role] = await seedRoles([{ nom: "admin" }]);
+    await testDb
+      .insert(permissions)
+      .values([
+        { id: "student_read", nom: "Consulter les élèves" },
+        { id: "student_write", nom: "Gérer les élèves" },
+      ]);
+    await testDb.insert(rolePermissions).values([
+      { idRole: role.id, idPermission: "student_read" },
+      { idRole: role.id, idPermission: "student_write" },
+    ]);
+
+    const perms = await testDb
+      .select()
+      .from(rolePermissions)
+      .where(eq(rolePermissions.idRole, role.id));
+
+    assertEquals(perms.length, 2);
+    assertExists(perms.find((p) => p.idPermission === "student_read"));
+    assertExists(perms.find((p) => p.idPermission === "student_write"));
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration: PUT /roles/:id - updates role and resets permissions",
+  async fn() {
+    await truncateAll();
+    const [role] = await seedRoles([{ nom: "employee" }]);
+    await testDb
+      .insert(permissions)
+      .values([
+        { id: "note_read", nom: "Consulter les notes" },
+        { id: "note_write", nom: "Gérer les notes" },
+      ]);
+    await testDb
+      .insert(rolePermissions)
+      .values([{ idRole: role.id, idPermission: "note_read" }]);
+
+    // Rename + reset permissions
+    await testDb
+      .update(roles)
+      .set({ nom: "teacher" })
+      .where(eq(roles.id, role.id));
+    await testDb
+      .delete(rolePermissions)
+      .where(eq(rolePermissions.idRole, role.id));
+    await testDb
+      .insert(rolePermissions)
+      .values([{ idRole: role.id, idPermission: "note_write" }]);
+
+    const updatedRole = await testDb
+      .select()
+      .from(roles)
+      .where(eq(roles.id, role.id))
+      .then((r) => r[0]);
+    const perms = await testDb
+      .select()
+      .from(rolePermissions)
+      .where(eq(rolePermissions.idRole, role.id));
+
+    assertEquals(updatedRole.nom, "teacher");
+    assertEquals(perms.length, 1);
+    assertEquals(perms[0].idPermission, "note_write");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration: DELETE /roles/:id - deletes role and its permissions",
+  async fn() {
+    await truncateAll();
+    const [role] = await seedRoles([{ nom: "moderator" }]);
+    await testDb
+      .insert(permissions)
+      .values([{ id: "user_read", nom: "Consulter les utilisateurs" }]);
+    await testDb
+      .insert(rolePermissions)
+      .values([{ idRole: role.id, idPermission: "user_read" }]);
+
+    await testDb
+      .delete(rolePermissions)
+      .where(eq(rolePermissions.idRole, role.id));
+    const [deleted] = await testDb
+      .delete(roles)
+      .where(eq(roles.id, role.id))
+      .returning();
+
+    assertExists(deleted);
+
+    const remaining = await testDb
+      .select()
+      .from(rolePermissions)
+      .where(eq(rolePermissions.idRole, role.id));
+    assertEquals(remaining.length, 0);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});