fix integration permission checks

packages/api/src/router/integration/integration-router.ts

@@ -297,7 +297,6 @@ export const integrationRouter = createTRPCRouter({
       };
     }),
   create: permissionRequiredProcedure
-    .requiresPermission("integration-full-all")
     .requiresPermission("integration-create")
     .meta({
       mcp: {

packages/api/src/router/test/integration/integration-router.spec.ts

@@ -29,12 +29,12 @@ vi.mock("../../integration/integration-test-connection", () => ({
 }));
 
 describe("all should return all integrations", () => {
-  test("with any session should return all integrations", async () => {
+  test("with integration full access should return all integrations", async () => {
     const db = createDb();
     const caller = integrationRouter.createCaller({
       db,
       deviceType: undefined,
-      session: defaultSessionWithPermissions(),
+      session: defaultSessionWithPermissions(["integration-full-all"]),
     });
 
     await db.insert(integrations).values([
@@ -57,6 +57,16 @@ describe("all should return all integrations", () => {
     expect(result[0]!.kind).toBe("plex");
     expect(result[1]!.kind).toBe("homeAssistant");
   });
+
+  test("without integration full access should reject the request", async () => {
+    const caller = integrationRouter.createCaller({
+      db: createDb(),
+      deviceType: undefined,
+      session: defaultSessionWithPermissions(),
+    });
+
+    await expect(caller.all()).rejects.toMatchObject({ code: "FORBIDDEN" });
+  });
 });
 
 describe("mediaRequestSearchTargets should return accessible media search integrations", () => {