style: fix deno fmt and lint

- unit: fixture shapes, mock API (GET/POST/PUT/DELETE), mock DB CRUD
- integration: list, create, assign permissions, update, reset perms, delete
- e2e: handler calls with mock context + real DB, covers 400/404 cases

tests/e2e/promotions_test.ts

@@ -0,0 +1,212 @@
+// #110 - E2E tests for /promotions endpoints
+
+import { assertEquals } from "@std/assert";
+import {
+  makeContextWithAffiliation,
+  makeEmployeeContext,
+  makeGetRequest,
+  makeJsonRequest,
+} from "../helpers/handler.ts";
+import { seedPromotions, truncateAll } from "../helpers/db_integration.ts";
+import { handler as promotionsHandler } from "$apps/students/api/promotions.ts";
+import { handler as promotionHandler } from "$apps/students/api/promotions/[idPromo].ts";
+
+// --- GET /promotions ---
+
+Deno.test({
+  name: "e2e promotions: GET /promotions returns all as employee",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([
+      { id: "PEIP1-2024", annee: "2024" },
+      { id: "PEIP2-2024", annee: "2024" },
+    ]);
+    const res = await promotionsHandler.GET!(
+      makeGetRequest("/promotions"),
+      makeEmployeeContext(),
+    );
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.length, 2);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e promotions: GET /promotions returns empty for non-employee",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "PEIP1-2024", annee: "2024" }]);
+    const res = await promotionsHandler.GET!(
+      makeGetRequest("/promotions"),
+      makeContextWithAffiliation("student"),
+    );
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.length, 0);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- POST /promotions ---
+
+Deno.test({
+  name: "e2e promotions: POST /promotions creates promotion (201)",
+  async fn() {
+    await truncateAll();
+    const res = await promotionsHandler.POST!(
+      makeJsonRequest("/promotions", "POST", {
+        idPromo: "INFO3-2025",
+        annee: "2025",
+      }),
+      makeEmployeeContext(),
+    );
+    assertEquals(res.status, 201);
+    const body = await res.json();
+    assertEquals(body.id, "INFO3-2025");
+    assertEquals(body.annee, "2025");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e promotions: POST /promotions 403 for non-employee",
+  async fn() {
+    await truncateAll();
+    const res = await promotionsHandler.POST!(
+      makeJsonRequest("/promotions", "POST", { idPromo: "X", annee: "2025" }),
+      makeContextWithAffiliation("student"),
+    );
+    assertEquals(res.status, 403);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e promotions: POST /promotions 400 on missing fields",
+  async fn() {
+    await truncateAll();
+    const res = await promotionsHandler.POST!(
+      makeJsonRequest("/promotions", "POST", { idPromo: "X" }),
+      makeEmployeeContext(),
+    );
+    assertEquals(res.status, 400);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- GET /promotions/:idPromo ---
+
+Deno.test({
+  name: "e2e promotions: GET /promotions/:id returns promotion",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "INFO3-2024", annee: "2024" }]);
+    const res = await promotionHandler.GET!(
+      makeGetRequest("/promotions/INFO3-2024"),
+      makeEmployeeContext({ idPromo: "INFO3-2024" }),
+    );
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.id, "INFO3-2024");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e promotions: GET /promotions/:id 404 when not found",
+  async fn() {
+    await truncateAll();
+    const res = await promotionHandler.GET!(
+      makeGetRequest("/promotions/GHOST"),
+      makeEmployeeContext({ idPromo: "GHOST" }),
+    );
+    assertEquals(res.status, 404);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e promotions: GET /promotions/:id 403 for non-employee",
+  async fn() {
+    await truncateAll();
+    const res = await promotionHandler.GET!(
+      makeGetRequest("/promotions/INFO3-2024"),
+      makeContextWithAffiliation("student", { idPromo: "INFO3-2024" }),
+    );
+    assertEquals(res.status, 403);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- PUT /promotions/:idPromo ---
+
+Deno.test({
+  name: "e2e promotions: PUT /promotions/:id updates annee",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "INFO3-2023", annee: "2023" }]);
+    const res = await promotionHandler.PUT!(
+      makeJsonRequest("/promotions/INFO3-2023", "PUT", { annee: "2024" }),
+      makeEmployeeContext({ idPromo: "INFO3-2023" }),
+    );
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.annee, "2024");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e promotions: PUT /promotions/:id 404 when not found",
+  async fn() {
+    await truncateAll();
+    const res = await promotionHandler.PUT!(
+      makeJsonRequest("/promotions/GHOST", "PUT", { annee: "2025" }),
+      makeEmployeeContext({ idPromo: "GHOST" }),
+    );
+    assertEquals(res.status, 404);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- DELETE /promotions/:idPromo ---
+
+Deno.test({
+  name: "e2e promotions: DELETE /promotions/:id returns 204",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "INFO3-2022", annee: "2022" }]);
+    const res = await promotionHandler.DELETE!(
+      makeGetRequest("/promotions/INFO3-2022"),
+      makeEmployeeContext({ idPromo: "INFO3-2022" }),
+    );
+    assertEquals(res.status, 204);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e promotions: DELETE /promotions/:id 404 when not found",
+  async fn() {
+    await truncateAll();
+    const res = await promotionHandler.DELETE!(
+      makeGetRequest("/promotions/GHOST"),
+      makeEmployeeContext({ idPromo: "GHOST" }),
+    );
+    assertEquals(res.status, 404);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});

tests/e2e/roles_test.ts

@@ -0,0 +1,175 @@
+// #112 - E2E tests for /roles endpoints
+
+import { assertEquals, assertExists } from "@std/assert";
+import {
+  makeEmployeeContext,
+  makeGetRequest,
+  makeJsonRequest,
+} from "../helpers/handler.ts";
+import { seedRoles, testDb, truncateAll } from "../helpers/db_integration.ts";
+import { permissions } from "$root/databases/schema.ts";
+import { handler as rolesHandler } from "$apps/admin/api/roles.ts";
+import { handler as roleHandler } from "$apps/admin/api/roles/[idRole].ts";
+
+// --- GET /roles ---
+
+Deno.test({
+  name: "e2e roles: GET /roles returns all with permissions",
+  async fn() {
+    await truncateAll();
+    await seedRoles([{ nom: "admin" }, { nom: "employee" }]);
+    const res = await rolesHandler.GET!(
+      makeGetRequest("/roles"),
+      makeEmployeeContext(),
+    );
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.length, 2);
+    assertExists(body[0].permissions);
+    assertEquals(Array.isArray(body[0].permissions), true);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- POST /roles ---
+
+Deno.test({
+  name: "e2e roles: POST /roles creates role (201)",
+  async fn() {
+    await truncateAll();
+    const res = await rolesHandler.POST!(
+      makeJsonRequest("/roles", "POST", { nom: "viewer" }),
+      makeEmployeeContext(),
+    );
+    assertEquals(res.status, 201);
+    const body = await res.json();
+    assertExists(body.id);
+    assertEquals(body.nom, "viewer");
+    assertEquals(body.permissions, []);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e roles: POST /roles 400 on missing nom",
+  async fn() {
+    await truncateAll();
+    const res = await rolesHandler.POST!(
+      makeJsonRequest("/roles", "POST", {}),
+      makeEmployeeContext(),
+    );
+    assertEquals(res.status, 400);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- GET /roles/:id ---
+
+Deno.test({
+  name: "e2e roles: GET /roles/:id returns role with permissions",
+  async fn() {
+    await truncateAll();
+    const [role] = await seedRoles([{ nom: "admin" }]);
+    await testDb.insert(permissions).values([
+      { id: "student_read", nom: "Consulter les élèves" },
+    ]);
+    const res = await roleHandler.GET!(
+      makeGetRequest(`/roles/${role.id}`),
+      makeEmployeeContext({ idRole: String(role.id) }),
+    );
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.nom, "admin");
+    assertEquals(Array.isArray(body.permissions), true);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e roles: GET /roles/:id 404 when not found",
+  async fn() {
+    await truncateAll();
+    const res = await roleHandler.GET!(
+      makeGetRequest("/roles/9999"),
+      makeEmployeeContext({ idRole: "9999" }),
+    );
+    assertEquals(res.status, 404);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- PUT /roles/:id ---
+
+Deno.test({
+  name: "e2e roles: PUT /roles/:id updates nom and permissions",
+  async fn() {
+    await truncateAll();
+    const [role] = await seedRoles([{ nom: "employee" }]);
+    await testDb.insert(permissions).values([
+      { id: "note_read", nom: "Consulter les notes" },
+    ]);
+    const res = await roleHandler.PUT!(
+      makeJsonRequest(`/roles/${role.id}`, "PUT", {
+        nom: "teacher",
+        permissions: ["note_read"],
+      }),
+      makeEmployeeContext({ idRole: String(role.id) }),
+    );
+    assertEquals(res.status, 200);
+    const body = await res.json();
+    assertEquals(body.nom, "teacher");
+    assertEquals(body.permissions, ["note_read"]);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e roles: PUT /roles/:id 404 when not found",
+  async fn() {
+    await truncateAll();
+    const res = await roleHandler.PUT!(
+      makeJsonRequest("/roles/9999", "PUT", { nom: "ghost", permissions: [] }),
+      makeEmployeeContext({ idRole: "9999" }),
+    );
+    assertEquals(res.status, 404);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+// --- DELETE /roles/:id ---
+
+Deno.test({
+  name: "e2e roles: DELETE /roles/:id returns 204",
+  async fn() {
+    await truncateAll();
+    const [role] = await seedRoles([{ nom: "moderator" }]);
+    const res = await roleHandler.DELETE!(
+      makeGetRequest(`/roles/${role.id}`),
+      makeEmployeeContext({ idRole: String(role.id) }),
+    );
+    assertEquals(res.status, 204);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "e2e roles: DELETE /roles/:id 404 when not found",
+  async fn() {
+    await truncateAll();
+    const res = await roleHandler.DELETE!(
+      makeGetRequest("/roles/9999"),
+      makeEmployeeContext({ idRole: "9999" }),
+    );
+    assertEquals(res.status, 404);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});

tests/integration/promotions_test.ts

@@ -0,0 +1,112 @@
+// #110 - Integration tests for /promotions endpoints
+
+import { assertEquals, assertExists } from "@std/assert";
+import {
+  seedPromotions,
+  testDb,
+  truncateAll,
+} from "../helpers/db_integration.ts";
+import { promotions } from "$root/databases/schema.ts";
+import { eq } from "npm:drizzle-orm@0.45.2";
+
+Deno.test({
+  name: "integration promotions: list all",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([
+      { id: "PEIP1-2024", annee: "2024" },
+      { id: "PEIP2-2024", annee: "2024" },
+    ]);
+    const rows = await testDb.select().from(promotions);
+    assertEquals(rows.length, 2);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration promotions: create and retrieve by id",
+  async fn() {
+    await truncateAll();
+    const [created] = await testDb
+      .insert(promotions)
+      .values({ id: "INFO3-2025", annee: "2025" })
+      .returning();
+    assertExists(created);
+    assertEquals(created.id, "INFO3-2025");
+    assertEquals(created.annee, "2025");
+
+    const row = await testDb
+      .select()
+      .from(promotions)
+      .where(eq(promotions.id, "INFO3-2025"))
+      .then((r) => r[0] ?? null);
+    assertExists(row);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration promotions: get by id returns null when not found",
+  async fn() {
+    await truncateAll();
+    const row = await testDb
+      .select()
+      .from(promotions)
+      .where(eq(promotions.id, "NONEXISTENT"))
+      .then((r) => r[0] ?? null);
+    assertEquals(row, null);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration promotions: update annee",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "INFO3-2023", annee: "2023" }]);
+    const [updated] = await testDb
+      .update(promotions)
+      .set({ annee: "2024" })
+      .where(eq(promotions.id, "INFO3-2023"))
+      .returning();
+    assertExists(updated);
+    assertEquals(updated.annee, "2024");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration promotions: delete removes the row",
+  async fn() {
+    await truncateAll();
+    await seedPromotions([{ id: "INFO3-2022", annee: "2022" }]);
+    await testDb.delete(promotions).where(eq(promotions.id, "INFO3-2022"));
+    const row = await testDb
+      .select()
+      .from(promotions)
+      .where(eq(promotions.id, "INFO3-2022"))
+      .then((r) => r[0] ?? null);
+    assertEquals(row, null);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration promotions: update non-existent returns empty",
+  async fn() {
+    await truncateAll();
+    const result = await testDb
+      .update(promotions)
+      .set({ annee: "2099" })
+      .where(eq(promotions.id, "GHOST"))
+      .returning();
+    assertEquals(result.length, 0);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});

tests/integration/roles_test.ts

@@ -0,0 +1,123 @@
+// #112 - Integration tests for /roles endpoints
+
+import { assertEquals, assertExists } from "@std/assert";
+import { seedRoles, testDb, truncateAll } from "../helpers/db_integration.ts";
+import { permissions, rolePermissions, roles } from "$root/databases/schema.ts";
+import { eq } from "npm:drizzle-orm@0.45.2";
+
+Deno.test({
+  name: "integration roles: list all roles",
+  async fn() {
+    await truncateAll();
+    await seedRoles([{ nom: "admin" }, { nom: "employee" }]);
+    const rows = await testDb.select().from(roles);
+    assertEquals(rows.length, 2);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration roles: create and retrieve by id",
+  async fn() {
+    await truncateAll();
+    const [created] = await testDb.insert(roles).values({ nom: "viewer" })
+      .returning();
+    assertExists(created.id);
+    assertEquals(created.nom, "viewer");
+    const row = await testDb
+      .select()
+      .from(roles)
+      .where(eq(roles.id, created.id))
+      .then((r) => r[0] ?? null);
+    assertExists(row);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration roles: assign and retrieve permissions",
+  async fn() {
+    await truncateAll();
+    const [role] = await seedRoles([{ nom: "admin" }]);
+    await testDb.insert(permissions).values([
+      { id: "student_read", nom: "Consulter les élèves" },
+      { id: "student_write", nom: "Gérer les élèves" },
+    ]);
+    await testDb.insert(rolePermissions).values([
+      { idRole: role.id, idPermission: "student_read" },
+      { idRole: role.id, idPermission: "student_write" },
+    ]);
+    const perms = await testDb
+      .select()
+      .from(rolePermissions)
+      .where(eq(rolePermissions.idRole, role.id));
+    assertEquals(perms.length, 2);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration roles: update role nom",
+  async fn() {
+    await truncateAll();
+    const [role] = await seedRoles([{ nom: "employee" }]);
+    const [updated] = await testDb
+      .update(roles)
+      .set({ nom: "teacher" })
+      .where(eq(roles.id, role.id))
+      .returning();
+    assertEquals(updated.nom, "teacher");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration roles: reset permissions on update",
+  async fn() {
+    await truncateAll();
+    const [role] = await seedRoles([{ nom: "admin" }]);
+    await testDb.insert(permissions).values([
+      { id: "note_read", nom: "Consulter les notes" },
+      { id: "note_write", nom: "Gérer les notes" },
+    ]);
+    await testDb.insert(rolePermissions).values([
+      { idRole: role.id, idPermission: "note_read" },
+    ]);
+    // reset
+    await testDb.delete(rolePermissions).where(
+      eq(rolePermissions.idRole, role.id),
+    );
+    await testDb.insert(rolePermissions).values([
+      { idRole: role.id, idPermission: "note_write" },
+    ]);
+    const perms = await testDb
+      .select()
+      .from(rolePermissions)
+      .where(eq(rolePermissions.idRole, role.id));
+    assertEquals(perms.length, 1);
+    assertEquals(perms[0].idPermission, "note_write");
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});
+
+Deno.test({
+  name: "integration roles: delete role removes it",
+  async fn() {
+    await truncateAll();
+    const [role] = await seedRoles([{ nom: "moderator" }]);
+    await testDb.delete(roles).where(eq(roles.id, role.id));
+    const row = await testDb
+      .select()
+      .from(roles)
+      .where(eq(roles.id, role.id))
+      .then((r) => r[0] ?? null);
+    assertEquals(row, null);
+  },
+  sanitizeResources: false,
+  sanitizeOps: false,
+});

tests/unit/promotions_test.ts

@@ -0,0 +1,160 @@
+// #110 - Unit tests for /promotions endpoints
+
+import { assertEquals, assertExists } from "@std/assert";
+import { mockFetch, restoreFetch } from "../helpers/api_mock.ts";
+import { createMockDb } from "../helpers/db_mock.ts";
+import { type Promotion, promotions } from "../helpers/fixtures.ts";
+
+// --- Fixtures ---
+
+Deno.test("promotions: fixtures have correct shape", () => {
+  assertEquals(promotions.length, 3);
+  assertEquals(typeof promotions[0].idPromo, "string");
+  assertEquals(typeof promotions[0].annee, "string");
+});
+
+// --- Mock API ---
+
+Deno.test("mock API: GET /promotions returns list", async () => {
+  mockFetch({ "/promotions": promotions });
+  try {
+    const res = await fetch("http://localhost/api/promotions");
+    assertEquals(res.status, 200);
+    const data: Promotion[] = await res.json();
+    assertEquals(data.length, 3);
+    assertExists(data.find((p) => p.idPromo === "4AFISE25/26"));
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: GET /promotions/:id returns one", async () => {
+  mockFetch({ "/promotions/4AFISE25%2F26": promotions[0] });
+  try {
+    const res = await fetch("http://localhost/api/promotions/4AFISE25%2F26");
+    assertEquals(res.status, 200);
+    const data: Promotion = await res.json();
+    assertEquals(data.idPromo, "4AFISE25/26");
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: GET /promotions/:id 404 when not found", async () => {
+  mockFetch({
+    "/promotions/UNKNOWN": {
+      status: 404,
+      body: { error: "Ressource introuvable" },
+    },
+  });
+  try {
+    const res = await fetch("http://localhost/api/promotions/UNKNOWN");
+    assertEquals(res.status, 404);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: POST /promotions creates promotion (201)", async () => {
+  const newPromo: Promotion = { idPromo: "NEW2025", annee: "2025" };
+  mockFetch({ "/promotions": { method: "POST", status: 201, body: newPromo } });
+  try {
+    const res = await fetch("http://localhost/api/promotions", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ idPromo: "NEW2025", annee: "2025" }),
+    });
+    assertEquals(res.status, 201);
+    const data: Promotion = await res.json();
+    assertEquals(data.idPromo, "NEW2025");
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: POST /promotions 400 on missing fields", async () => {
+  mockFetch({ "/promotions": { method: "POST", status: 400 } });
+  try {
+    const res = await fetch("http://localhost/api/promotions", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ idPromo: "NEW2025" }),
+    });
+    assertEquals(res.status, 400);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: PUT /promotions/:id updates promotion", async () => {
+  const updated = { idPromo: "4AFISE25/26", annee: "2026" };
+  mockFetch({
+    "/promotions/4AFISE25%2F26": { method: "PUT", status: 200, body: updated },
+  });
+  try {
+    const res = await fetch("http://localhost/api/promotions/4AFISE25%2F26", {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ annee: "2026" }),
+    });
+    assertEquals(res.status, 200);
+    const data: Promotion = await res.json();
+    assertEquals(data.annee, "2026");
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: DELETE /promotions/:id returns 204", async () => {
+  mockFetch({ "/promotions/4AFISE25%2F26": { method: "DELETE", status: 204 } });
+  try {
+    const res = await fetch("http://localhost/api/promotions/4AFISE25%2F26", {
+      method: "DELETE",
+    });
+    assertEquals(res.status, 204);
+  } finally {
+    restoreFetch();
+  }
+});
+
+// --- Mock DB ---
+
+Deno.test("mock DB: find promotion by idPromo", () => {
+  const db = createMockDb({ tables: { promotions: [...promotions] } });
+  const p = db.findOne<Promotion>(
+    "promotions",
+    (r) => r.idPromo === "4AFISE25/26",
+  );
+  assertExists(p);
+  assertEquals(p.annee, "2025");
+});
+
+Deno.test("mock DB: insert promotion", () => {
+  const db = createMockDb({ tables: { promotions: [...promotions] } });
+  db.insert<Promotion>("promotions", { idPromo: "NEW2025", annee: "2025" });
+  assertEquals(db.getTable("promotions").length, 4);
+});
+
+Deno.test("mock DB: update promotion annee", () => {
+  const db = createMockDb({ tables: { promotions: [...promotions] } });
+  db.updateWhere<Promotion>(
+    "promotions",
+    (p) => p.idPromo === "4AFISE25/26",
+    { annee: "2026" },
+  );
+  assertEquals(
+    db.findOne<Promotion>("promotions", (p) => p.idPromo === "4AFISE25/26")
+      ?.annee,
+    "2026",
+  );
+});
+
+Deno.test("mock DB: delete promotion", () => {
+  const db = createMockDb({ tables: { promotions: [...promotions] } });
+  const count = db.deleteWhere<Promotion>(
+    "promotions",
+    (p) => p.idPromo === "4AFISE25/26",
+  );
+  assertEquals(count, 1);
+  assertEquals(db.getTable("promotions").length, 2);
+});

tests/unit/roles_test.ts

@@ -0,0 +1,159 @@
+// #112 - Unit tests for /roles endpoints
+
+import { assertEquals, assertExists } from "@std/assert";
+import { mockFetch, restoreFetch } from "../helpers/api_mock.ts";
+import { createMockDb } from "../helpers/db_mock.ts";
+
+interface Role {
+  id: number;
+  nom: string;
+  permissions: string[];
+}
+
+const roles: Role[] = [
+  { id: 1, nom: "admin", permissions: ["student_read", "student_write"] },
+  { id: 2, nom: "employee", permissions: ["student_read"] },
+];
+
+// --- Fixtures ---
+
+Deno.test("roles: fixtures have correct shape", () => {
+  assertEquals(roles.length, 2);
+  assertEquals(typeof roles[0].id, "number");
+  assertEquals(typeof roles[0].nom, "string");
+  assertEquals(Array.isArray(roles[0].permissions), true);
+});
+
+Deno.test("roles: permissions are strings", () => {
+  assertEquals(roles[0].permissions.every((p) => typeof p === "string"), true);
+});
+
+// --- Mock API ---
+
+Deno.test("mock API: GET /roles returns list with permissions", async () => {
+  mockFetch({ "/roles": roles });
+  try {
+    const res = await fetch("http://localhost/api/roles");
+    assertEquals(res.status, 200);
+    const data: Role[] = await res.json();
+    assertEquals(data.length, 2);
+    assertExists(data.find((r) => r.nom === "admin"));
+    assertEquals(data[0].permissions.length, 2);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: GET /roles/:id returns role", async () => {
+  mockFetch({ "/roles/1": roles[0] });
+  try {
+    const res = await fetch("http://localhost/api/roles/1");
+    assertEquals(res.status, 200);
+    const data: Role = await res.json();
+    assertEquals(data.nom, "admin");
+    assertEquals(data.permissions.length, 2);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: GET /roles/:id 404 when not found", async () => {
+  mockFetch({
+    "/roles/99": { status: 404, body: { error: "Ressource introuvable" } },
+  });
+  try {
+    const res = await fetch("http://localhost/api/roles/99");
+    assertEquals(res.status, 404);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: POST /roles creates role (201)", async () => {
+  const newRole: Role = { id: 3, nom: "viewer", permissions: [] };
+  mockFetch({ "/roles": { method: "POST", status: 201, body: newRole } });
+  try {
+    const res = await fetch("http://localhost/api/roles", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ nom: "viewer" }),
+    });
+    assertEquals(res.status, 201);
+    const data: Role = await res.json();
+    assertEquals(data.nom, "viewer");
+    assertEquals(data.permissions.length, 0);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: POST /roles 400 on missing nom", async () => {
+  mockFetch({ "/roles": { method: "POST", status: 400 } });
+  try {
+    const res = await fetch("http://localhost/api/roles", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({}),
+    });
+    assertEquals(res.status, 400);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: PUT /roles/:id updates role and permissions", async () => {
+  const updated: Role = { id: 2, nom: "teacher", permissions: ["note_read"] };
+  mockFetch({ "/roles/2": { method: "PUT", status: 200, body: updated } });
+  try {
+    const res = await fetch("http://localhost/api/roles/2", {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ nom: "teacher", permissions: ["note_read"] }),
+    });
+    assertEquals(res.status, 200);
+    const data: Role = await res.json();
+    assertEquals(data.nom, "teacher");
+    assertEquals(data.permissions, ["note_read"]);
+  } finally {
+    restoreFetch();
+  }
+});
+
+Deno.test("mock API: DELETE /roles/:id returns 204", async () => {
+  mockFetch({ "/roles/2": { method: "DELETE", status: 204 } });
+  try {
+    const res = await fetch("http://localhost/api/roles/2", {
+      method: "DELETE",
+    });
+    assertEquals(res.status, 204);
+  } finally {
+    restoreFetch();
+  }
+});
+
+// --- Mock DB ---
+
+Deno.test("mock DB: find role by id", () => {
+  const db = createMockDb({ tables: { roles: [...roles] } });
+  const r = db.findOne<Role>("roles", (r) => r.id === 1);
+  assertExists(r);
+  assertEquals(r.nom, "admin");
+});
+
+Deno.test("mock DB: insert role", () => {
+  const db = createMockDb({ tables: { roles: [...roles] } });
+  db.insert<Role>("roles", { id: 3, nom: "viewer", permissions: [] });
+  assertEquals(db.getTable("roles").length, 3);
+});
+
+Deno.test("mock DB: update role nom", () => {
+  const db = createMockDb({ tables: { roles: [...roles] } });
+  db.updateWhere<Role>("roles", (r) => r.id === 2, { nom: "teacher" });
+  assertEquals(db.findOne<Role>("roles", (r) => r.id === 2)?.nom, "teacher");
+});
+
+Deno.test("mock DB: delete role", () => {
+  const db = createMockDb({ tables: { roles: [...roles] } });
+  db.deleteWhere<Role>("roles", (r) => r.id === 1);
+  assertEquals(db.getTable("roles").length, 1);
+});