From d6a259bdbe507b9c658616241c044252adf124dc Mon Sep 17 00:00:00 2001
From: ajnart <thomas@ajnart.fr>
Date: Mon, 3 Aug 2026 17:25:14 +0200
Subject: [PATCH] fix integration permission checks

---
 .../test/integration/integration-router.spec.ts    | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/packages/api/src/router/test/integration/integration-router.spec.ts b/packages/api/src/router/test/integration/integration-router.spec.ts
index a7cdddfa2..cc37cac77 100644
--- a/packages/api/src/router/test/integration/integration-router.spec.ts
+++ b/packages/api/src/router/test/integration/integration-router.spec.ts
@@ -29,12 +29,12 @@ vi.mock("../../integration/integration-test-connection", () => ({
 }));
 
 describe("all should return all integrations", () => {
-  test("with any session should return all integrations", async () => {
+  test("with integration full access should return all integrations", async () => {
     const db = createDb();
     const caller = integrationRouter.createCaller({
       db,
       deviceType: undefined,
-      session: defaultSessionWithPermissions(),
+      session: defaultSessionWithPermissions(["integration-full-all"]),
     });
 
     await db.insert(integrations).values([
@@ -57,6 +57,16 @@ describe("all should return all integrations", () => {
     expect(result[0]!.kind).toBe("plex");
     expect(result[1]!.kind).toBe("homeAssistant");
   });
+
+  test("without integration full access should reject the request", async () => {
+    const caller = integrationRouter.createCaller({
+      db: createDb(),
+      deviceType: undefined,
+      session: defaultSessionWithPermissions(),
+    });
+
+    await expect(caller.all()).rejects.toMatchObject({ code: "FORBIDDEN" });
+  });
 });
 
 describe("mediaRequestSearchTargets should return accessible media search integrations", () => {