fix(test): stop the RBAC integration suite from sharing the seeded admin

src/lib/rbac/require-permission.itest.ts

@@ -1,22 +1,28 @@
-import { describe, it, expect } from "vitest"
+import { describe, it, expect, beforeAll } from "vitest"
 import { prisma } from "@/lib/prisma"
 import { seedPresetsForCompany, resolvePresetRoleId } from "./seed-roles"
 
-// Uses the seeded admin from `npx tsx prisma/seed.ts`. Assigns it the Viewer
-// preset, then asserts a Viewer lacks policy:manage but holds policy:read.
+// Seeds its own company rather than borrowing the shared admin account. The
+// previous version reassigned that admin to Viewer and restored it at the end,
+// which only holds if suites run one at a time. Vitest runs test files in
+// parallel against the same database, so any suite reading the admin's role
+// during that window saw the read-only Viewer set and failed.
+let companyId: string
+
+beforeAll(async () => {
+  const company = await prisma.company.create({
+    data: { name: "Require Permission Test Co", domain: `require-perm-${Date.now()}.test` },
+  })
+  companyId = company.id
+  await seedPresetsForCompany(prisma, companyId)
+})
+
 describe("requirePermission (real DB, in-process)", () => {
   it("Viewer is denied policy:manage but allowed policy:read", async () => {
-    const admin = await prisma.user.findUniqueOrThrow({ where: { email: "admin@datashield.local" } })
-    await seedPresetsForCompany(prisma, admin.companyId)
-    const viewerId = await resolvePresetRoleId(prisma, admin.companyId, "Viewer")
-    await prisma.user.update({ where: { id: admin.id }, data: { roleId: viewerId } })
-
-    const perms = await prisma.role.findUniqueOrThrow({ where: { id: viewerId } })
-    expect(perms.permissions).toContain("policy:read")
-    expect(perms.permissions).not.toContain("policy:manage")
+    const viewerId = await resolvePresetRoleId(prisma, companyId, "Viewer")
+    const viewer = await prisma.role.findUniqueOrThrow({ where: { id: viewerId } })
 
-    // Restore Administrator so other suites keep working.
-    const adminRole = await resolvePresetRoleId(prisma, admin.companyId, "Administrator")
-    await prisma.user.update({ where: { id: admin.id }, data: { roleId: adminRole } })
+    expect(viewer.permissions).toContain("policy:read")
+    expect(viewer.permissions).not.toContain("policy:manage")
   })
 })