feature test su institution

backend/routes/api/institutions.php

@@ -0,0 +1,29 @@
+<?php
+
+use App\Http\Controllers\InstitutionController;
+use App\Http\Controllers\InstitutionLinkController;
+use Illuminate\Support\Facades\Route;
+
+// Prefisso `api` e tier (`tier.app` / `tier.admin`) applicati dal loader in
+// bootstrap/app.php. Le istituzioni si risolvono per `uuid` (route key del model).
+
+// Lettura: utente pienamente operativo.
+Route::middleware('tier.app')->group(function () {
+    Route::apiResource('institutions', InstitutionController::class)->only(['index', 'show']);
+    Route::apiResource('institutions.links', InstitutionLinkController::class)
+        ->only(['index', 'show'])
+        ->scoped();
+});
+
+// Scrittura + soft delete: solo Admin.
+Route::middleware('tier.admin')->group(function () {
+    Route::apiResource('institutions', InstitutionController::class)->only(['store', 'update', 'destroy']);
+
+    // Soft delete: ripristino e cancellazione definitiva (binding sui cestinati).
+    Route::post('institutions/{institution}/restore', [InstitutionController::class, 'restore'])->withTrashed();
+    Route::delete('institutions/{institution}/force', [InstitutionController::class, 'forceDestroy'])->withTrashed();
+
+    Route::apiResource('institutions.links', InstitutionLinkController::class)
+        ->only(['store', 'update', 'destroy'])
+        ->scoped();
+});