users and institutions route, tests fixed

backend/tests/Feature/UserPositionControllerTest.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\Lists\UserPosition;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class UserPositionControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    // --- Lettura (pubblica, throttle:public) ----------------------------------
+
+    public function test_index_lists_positions_for_an_operational_user(): void
+    {
+        $this->actingAs($this->operationalUser(), 'sanctum');
+        UserPosition::factory()->count(2)->create();
+
+        $this->getJson('/api/user-positions')
+            ->assertOk()
+            ->assertJsonStructure(['message', 'data' => [['id', 'value']]]);
+    }
+
+    public function test_show_returns_a_single_position(): void
+    {
+        $this->actingAs($this->operationalUser(), 'sanctum');
+        $position = UserPosition::factory()->create();
+
+        $this->getJson("/api/user-positions/{$position->id}")
+            ->assertOk()
+            ->assertJsonPath('data.id', $position->id)
+            ->assertJsonPath('data.value', $position->value);
+    }
+
+    // --- Gating ---------------------------------------------------------------
+
+    public function test_guests_can_read_positions(): void
+    {
+        UserPosition::factory()->create();
+
+        $this->getJson('/api/user-positions')->assertOk();
+    }
+}