Update backend services, user right tests and user right documentation

[juhanikat]

No description provided.

[Copilot]

Pull request overview

Updates backend authorization behavior and aligns API tests + documentation with the current user-rights model (notably around EditRestricted behavior and occurrence/cross-search access).

Changes:

• Hardened EditRestricted locality write permission checks to prevent gaining access by adding project links during an edit.
• Refactored/expanded backend API tests (locality update, species merge, collecting method values) to better cover user-right scenarios.
• Updated user-rights documentation with an Occurrence (Cross-Search) section and minor formatting cleanups.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
documentation/user_rights.md	Adds/adjusts documentation for occurrence/cross-search access and formatting.
backend/src/services/locality.ts	Tightens EditRestricted write permission logic for locality updates.
backend/src/api-tests/species/merge.test.ts	Refactors merge tests and adds explicit non-admin/anonymous rejection coverage.
backend/src/api-tests/locality/update.test.ts	Restructures locality update tests and adds permission-related cases for EditRestricted/anonymous.
backend/src/api-tests/locality/data.ts	Moves locality-species test payload details out of shared fixture to the test setup.
backend/src/api-tests/crossSearch/get.test.ts	Minor test description adjustment.
backend/src/api-tests/collectingMethodValues/getAll.test.ts	Updates auth coverage to include anonymous rejection and edit-role acceptance.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

backend/src/api-tests/collectingMethodValues/getAll.test.ts:41

• This test only verifies that anonymous users are rejected and that EditRestricted/EditUnrestricted users are accepted, but it no longer checks that a logged-in user without the required roles (e.g. Role.Project/testPl) is rejected. The route is protected by requireOneOf([Admin, EditUnrestricted, EditRestricted]) (backend/src/routes/collectingMethodValues.ts:8-12), so a negative case should be covered here.

  it('accepts users with locality edit access', async () => {
    await login('testEr', 'test')
    const { status: erStatus } = await send('collecting-method-values/all', 'GET')
    expect(erStatus).toBe(200)