feat: create new project added

packages/casan-control-panel/backend/test/goals.test.ts

@@ -4,7 +4,7 @@ import { execFileSync } from 'node:child_process';
 import { mkdtempSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { BadRequestException } from '@nestjs/common';
+import { BadRequestException, ForbiddenException } from '@nestjs/common';
 import { GoalsService } from '../src/goals/goals.service.js';
 
 const root = join(import.meta.dirname, '..', '..', '..', '..');
@@ -24,6 +24,13 @@ test('goal start rejects project ids outside the server registry before model ro
   );
 });
 
+test('goal project creation is restricted to organization administrators', () => {
+  assert.throws(
+    () => new GoalsService().createProject({ projectId: 'denied-project', domain: 'Denied Project' }, { ...admin, role: 'viewer' }),
+    ForbiddenException,
+  );
+});
+
 test('H1 creates a bounded manifest and routes workspace side effects to approval without writing source', () => {
   const stateRoot = mkdtempSync(join(tmpdir(), 'casan-goal-context-'));
   const tenantRoot = join(stateRoot, 'tenants');