feat: enforce per-user module access in Makelore

tests/unit/module-navigation.test.tsx

@@ -113,6 +113,42 @@ describe('AI module navigation', () => {
     expect(await screen.findByTestId('location-path')).toHaveTextContent('/ai-hardware');
   });
 
+  it('greys out a disabled module and does not navigate when it is clicked', async () => {
+    useAuthStore.setState({
+      moduleAccess: {
+        programming: true,
+        design: true,
+        learning: false,
+        robot: true,
+      },
+      user: {
+        username: 'zhangsan@example.com',
+        userId: 'user-1',
+        tenantId: null,
+        deptId: null,
+        authorities: [],
+      },
+    });
+
+    render(
+      <MemoryRouter initialEntries={['/module-select']}>
+        <Routes>
+          <Route path="/module-select" element={<ModuleSelection />} />
+          <Route path="*" element={<LocationProbe />} />
+        </Routes>
+      </MemoryRouter>,
+    );
+
+    const learningOption = screen.getByTestId('ai-module-option-learning');
+    expect(learningOption).toBeDisabled();
+    expect(learningOption).toHaveClass('module-option-card-disabled');
+    expect(learningOption).toHaveAttribute('aria-disabled', 'true');
+
+    fireEvent.click(learningOption);
+    expect(screen.getByTestId('ai-module-selection-page')).toBeInTheDocument();
+    expect(screen.queryByTestId('location-path')).not.toBeInTheDocument();
+  });
+
   it('routes AI programming from the chooser to the project conversation entry', async () => {
     render(
       <MemoryRouter initialEntries={['/module-select']}>