test: add tests for unprotected behavior

app/test/groups/group_permission_test.dart

@@ -0,0 +1,84 @@
+// Copyright (c) 2026 Sharezone UG (haftungsbeschränkt)
+// Licensed under the EUPL-1.2-or-later.
+//
+// You may obtain a copy of the Licence at:
+// https://joinup.ec.europa.eu/software/page/eupl
+//
+// SPDX-License-Identifier: EUPL-1.2
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:group_domain_models/group_domain_models.dart';
+import 'package:sharezone/groups/group_permission.dart';
+
+void main() {
+  group('HasRolePermission', () {
+    group('hasPermission for administration', () {
+      test('should be true for owner', () {
+        expect(MemberRole.owner.hasPermission(GroupPermission.administration),
+            isTrue);
+      });
+
+      test('should be true for admin', () {
+        expect(MemberRole.admin.hasPermission(GroupPermission.administration),
+            isTrue);
+      });
+
+      test('should be false for creator', () {
+        expect(MemberRole.creator.hasPermission(GroupPermission.administration),
+            isFalse);
+      });
+
+      test('should be false for standard', () {
+        expect(
+            MemberRole.standard.hasPermission(GroupPermission.administration),
+            isFalse);
+      });
+    });
+
+    group('hasPermission for contentCreation', () {
+      test('should be true for owner', () {
+        expect(MemberRole.owner.hasPermission(GroupPermission.contentCreation),
+            isTrue);
+      });
+
+      test('should be true for admin', () {
+        expect(MemberRole.admin.hasPermission(GroupPermission.contentCreation),
+            isTrue);
+      });
+
+      test('should be true for creator', () {
+        expect(
+            MemberRole.creator.hasPermission(GroupPermission.contentCreation),
+            isTrue);
+      });
+
+      test('should be false for standard', () {
+        expect(
+            MemberRole.standard.hasPermission(GroupPermission.contentCreation),
+            isFalse);
+      });
+    });
+  });
+
+  group('isUserAdminOrOwnerOfGroup', () {
+    test('should be true for owner', () {
+      expect(isUserAdminOrOwnerOfGroup(MemberRole.owner), isTrue);
+    });
+
+    test('should be true for admin', () {
+      expect(isUserAdminOrOwnerOfGroup(MemberRole.admin), isTrue);
+    });
+
+    test('should be false for creator', () {
+      expect(isUserAdminOrOwnerOfGroup(MemberRole.creator), isFalse);
+    });
+
+    test('should be false for standard', () {
+      expect(isUserAdminOrOwnerOfGroup(MemberRole.standard), isFalse);
+    });
+
+    test('should be false for null role', () {
+      expect(isUserAdminOrOwnerOfGroup(null), isFalse);
+    });
+  });
+}

app/test/submissions/submission_permissions_test.dart

@@ -0,0 +1,93 @@
+// Copyright (c) 2026 Sharezone UG (haftungsbeschränkt)
+// Licensed under the EUPL-1.2-or-later.
+//
+// You may obtain a copy of the Licence at:
+// https://joinup.ec.europa.eu/software/page/eupl
+//
+// SPDX-License-Identifier: EUPL-1.2
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:group_domain_models/group_domain_models.dart';
+import 'package:hausaufgabenheft_logik/hausaufgabenheft_logik.dart';
+import 'package:mockito/annotations.dart';
+import 'package:mockito/mockito.dart';
+import 'package:sharezone/submissions/submission_permissions.dart';
+import 'package:sharezone/util/api/course_gateway.dart';
+import 'package:user/user.dart';
+
+@GenerateNiceMocks([MockSpec<CourseGateway>()])
+import 'submission_permissions_test.mocks.dart';
+
+void main() {
+  late MockCourseGateway mockCourseGateway;
+
+  setUp(() {
+    mockCourseGateway = MockCourseGateway();
+  });
+
+  group('SubmissionPermissions.isAllowedToViewSubmittedPermissions', () {
+    test('should allow when user is teacher and is admin in course', () async {
+      when(mockCourseGateway.getRoleFromCourseNoSync(any))
+          .thenReturn(MemberRole.admin);
+      final stream = Stream.value(TypeOfUser.teacher);
+      final permissions = SubmissionPermissions(stream, mockCourseGateway);
+      final homework = HomeworkDto.create(courseID: 'course1');
+
+      final result =
+          await permissions.isAllowedToViewSubmittedPermissions(homework);
+
+      expect(result, isTrue);
+    });
+
+    test('should allow when user is teacher and is owner in course', () async {
+      when(mockCourseGateway.getRoleFromCourseNoSync(any))
+          .thenReturn(MemberRole.owner);
+      final stream = Stream.value(TypeOfUser.teacher);
+      final permissions = SubmissionPermissions(stream, mockCourseGateway);
+      final homework = HomeworkDto.create(courseID: 'course1');
+
+      final result =
+          await permissions.isAllowedToViewSubmittedPermissions(homework);
+
+      expect(result, isTrue);
+    });
+
+    test('should deny when user is teacher but only standard in course', () async {
+      when(mockCourseGateway.getRoleFromCourseNoSync(any))
+          .thenReturn(MemberRole.standard);
+      final stream = Stream.value(TypeOfUser.teacher);
+      final permissions = SubmissionPermissions(stream, mockCourseGateway);
+      final homework = HomeworkDto.create(courseID: 'course1');
+
+      final result =
+          await permissions.isAllowedToViewSubmittedPermissions(homework);
+
+      expect(result, isFalse);
+    });
+
+    test('should deny when user is student even if admin in course', () async {
+      when(mockCourseGateway.getRoleFromCourseNoSync(any))
+          .thenReturn(MemberRole.admin);
+      final stream = Stream.value(TypeOfUser.student);
+      final permissions = SubmissionPermissions(stream, mockCourseGateway);
+      final homework = HomeworkDto.create(courseID: 'course1');
+
+      final result =
+          await permissions.isAllowedToViewSubmittedPermissions(homework);
+
+      expect(result, isFalse);
+    });
+
+    test('should deny when course role is null (defaults to standard)', () async {
+      when(mockCourseGateway.getRoleFromCourseNoSync(any)).thenReturn(null);
+      final stream = Stream.value(TypeOfUser.teacher);
+      final permissions = SubmissionPermissions(stream, mockCourseGateway);
+      final homework = HomeworkDto.create(courseID: 'course1');
+
+      final result =
+          await permissions.isAllowedToViewSubmittedPermissions(homework);
+
+      expect(result, isFalse);
+    });
+  });
+}