new updates

Backend/ERPCore/Controllers/BranchConfigController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Config;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
@@ -14,6 +16,7 @@ namespace ERPCore.Controllers;
 /// </para>
 /// </summary>
 [Route("api/v1/branch-config")]
+[Authorize(Policy = NavPolicies.Prefix + "settings")]
 public sealed class BranchConfigController : ApiControllerBase
 {
     private readonly IBranchConfigService _config;

Backend/ERPCore/Controllers/BrandsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Brands;
 using ERPCore.Dtos.Common;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Brand master endpoints (docs/11-BACKEND-PHASE1.md §2.6).</summary>
 [Route("api/v1/brands")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
 public sealed class BrandsController : ApiControllerBase
 {
     private readonly IBrandService _brands;

Backend/ERPCore/Controllers/BundleSalesController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Sales;
@@ -7,6 +9,7 @@ using Microsoft.AspNetCore.Mvc;
 namespace ERPCore.Controllers;
 
 [Route("api/v1/bundle-sales")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class BundleSalesController : ApiControllerBase
 {
     private readonly IBundleSaleService _bundles;

Backend/ERPCore/Controllers/CategoriesController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Categories;
 using ERPCore.Dtos.Common;
@@ -12,6 +14,7 @@ namespace ERPCore.Controllers;
 /// <c>?tree=true</c> parameter is gone along with the self-nesting model.
 /// </summary>
 [Route("api/v1/categories")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
 public sealed class CategoriesController : ApiControllerBase
 {
     private readonly ICategoryService _categories;

Backend/ERPCore/Controllers/CustomersController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Customers;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Customer master endpoints for Phase 1 sales.</summary>
 [Route("api/v1/customers")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class CustomersController : ApiControllerBase
 {
     private readonly ICustomerService _customers;

Backend/ERPCore/Controllers/DashboardController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Dashboard;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
@@ -6,6 +8,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Dashboard overview stats — cross-domain counts, not a stored entity.</summary>
 [Route("api/v1/dashboard")]
+[Authorize(Policy = NavPolicies.Prefix + "dashboard")]
 public sealed class DashboardController : ApiControllerBase
 {
     private readonly IDashboardService _dashboard;

Backend/ERPCore/Controllers/FreeIssuesController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Sales;
@@ -12,6 +14,7 @@ namespace ERPCore.Controllers;
 /// the existing sales-slip CRUD surface under a more business-friendly route.
 /// </summary>
 [Route("api/v1/free-issues")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class FreeIssuesController : ApiControllerBase
 {
     private readonly ISalesSlipService _slips;

Backend/ERPCore/Controllers/GeneralLedgerController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
 
@@ -14,6 +16,7 @@ namespace ERPCore.Controllers;
 /// only and is never exposed to the frontend.
 /// </summary>
 [Route("api/v1/gl")]
+[Authorize(Policy = NavPolicies.Prefix + "ledgers")]
 public sealed class GeneralLedgerController : ApiControllerBase
 {
     private readonly IGeneralLedgerService _gl;

Backend/ERPCore/Controllers/GrnsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Grn;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Goods-receipt endpoints (docs/11 §4).</summary>
 [Route("api/v1/grns")]
+[Authorize(Policy = NavPolicies.Prefix + "receiving")]
 public sealed class GrnsController : ApiControllerBase
 {
     private readonly IGrnService _grns;

Backend/ERPCore/Controllers/Hrm/EmployeesController.cs

@@ -94,13 +94,13 @@ public sealed class EmployeesController : ApiControllerBase
 
     /// <summary>Permanently deletes the employee and all dependent HR records. Blocked (409) if payroll history exists.</summary>
     [HttpDelete("{employeeId:int}")]
-    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(typeof(EmployeeDeleteResultDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
-    public async Task<IActionResult> Delete(int employeeId, CancellationToken ct)
+    public async Task<ActionResult<EmployeeDeleteResultDto>> Delete(int employeeId, [FromQuery] bool deleteUserAccount, CancellationToken ct)
     {
-        await _employees.DeleteAsync(employeeId, ct);
-        return NoContent();
+        var result = await _employees.DeleteAsync(employeeId, deleteUserAccount, ct);
+        return Ok(result);
     }
 
     [HttpPost("{employeeId:int}/link-user")]

Backend/ERPCore/Controllers/ItemTypesController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.ItemTypes;
@@ -13,6 +15,7 @@ namespace ERPCore.Controllers;
 /// into the client-generated SKU (docs/10 Part C.9).
 /// </summary>
 [Route("api/v1/item-types")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
 public sealed class ItemTypesController : ApiControllerBase
 {
     private readonly IItemTypeService _itemTypes;

Backend/ERPCore/Controllers/ItemsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Items;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Item master endpoints (docs/11-BACKEND-PHASE1.md §2.1–2.2).</summary>
 [Route("api/v1/items")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
 public sealed class ItemsController : ApiControllerBase
 {
     private readonly IItemService _items;
@@ -27,6 +30,17 @@ public sealed class ItemsController : ApiControllerBase
         CancellationToken ct)
         => Ok(await _items.ListAsync(query, status, categoryId, subCategoryId, brandId, trackingMode, ct));
 
+    /// <summary>Barcode/RFID lookup — matches an item's barcode/SKU, or a batch/serial
+    /// barcode/no (optionally scoped to <paramref name="itemId"/> first).</summary>
+    [HttpGet("scan")]
+    [ProducesResponseType(typeof(ItemScanResultDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<ItemScanResultDto>> Scan([FromQuery] string code, [FromQuery] int? itemId, CancellationToken ct)
+    {
+        var result = await _items.ScanAsync(code, itemId, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
     /// <summary>Get a single item; returns an <c>ETag</c> for optimistic concurrency.</summary>
     [HttpGet("{itemId:int}")]
     [ProducesResponseType(typeof(ItemDetailDto), StatusCodes.Status200OK)]

Backend/ERPCore/Controllers/JournalEntriesController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Audit;
 using ERPCore.Dtos.Common;
 using ERPCore.Services.Interfaces;
@@ -10,6 +12,7 @@ namespace ERPCore.Controllers;
 /// Data only — no posting in Phase 1.
 /// </summary>
 [Route("api/v1/journal-entries")]
+[Authorize(Policy = NavPolicies.Prefix + "ledgers")]
 public sealed class JournalEntriesController : ApiControllerBase
 {
     private readonly IAuditService _audit;

Backend/ERPCore/Controllers/NotificationConfigController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Notifications;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
@@ -5,6 +7,7 @@ using Microsoft.AspNetCore.Mvc;
 namespace ERPCore.Controllers;
 
 [Route("api/v1/notification-config")]
+[Authorize(Policy = NavPolicies.Prefix + "settings")]
 public sealed class NotificationConfigController : ApiControllerBase
 {
     private readonly INotificationConfigService _config;

Backend/ERPCore/Controllers/NotificationsController.cs

@@ -0,0 +1,32 @@
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+[Route("api/v1/notifications")]
+public sealed class NotificationsController : ApiControllerBase
+{
+    private readonly INotificationService _notifications;
+    private readonly ICurrentUser _currentUser;
+
+    public NotificationsController(INotificationService notifications, ICurrentUser currentUser)
+    {
+        _notifications = notifications;
+        _currentUser = currentUser;
+    }
+
+    [HttpGet]
+    public async Task<ActionResult> Get([FromQuery] int take = 20, CancellationToken ct = default)
+    {
+        var feed = await _notifications.GetFeedAsync(_currentUser.AuditUserId, take, ct);
+        return Ok(feed);
+    }
+
+    [HttpPost("mark-all-read")]
+    public async Task<ActionResult> MarkAllRead(CancellationToken ct)
+    {
+        await _notifications.MarkAllReadAsync(_currentUser.AuditUserId, ct);
+        return NoContent();
+    }
+}

Backend/ERPCore/Controllers/ProductConfigController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Config;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
@@ -16,6 +18,7 @@ namespace ERPCore.Controllers;
 /// </para>
 /// </summary>
 [Route("api/v1/product-config")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
 public sealed class ProductConfigController : ApiControllerBase
 {
     private readonly IProductConfigService _config;

Backend/ERPCore/Controllers/ProductionRunsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Production;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Production run endpoints (docs/30-BACKEND-PHASE2.md §D.2–D.3).</summary>
 [Route("api/v1/production-runs")]
+[Authorize(Policy = NavPolicies.Prefix + "production")]
 public sealed class ProductionRunsController : ApiControllerBase
 {
     private readonly IProductionRunService _runs;

Backend/ERPCore/Controllers/ProductionTemplatesController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Production;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Production template endpoints (docs/30-BACKEND-PHASE2.md §D.1).</summary>
 [Route("api/v1/production-templates")]
+[Authorize(Policy = NavPolicies.Prefix + "production")]
 public sealed class ProductionTemplatesController : ApiControllerBase
 {
     private readonly IProductionTemplateService _templates;

Backend/ERPCore/Controllers/PurchaseInvoicesController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Grn;
@@ -9,6 +11,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Purchase invoice endpoints — vendor invoices consolidating Confirmed GRNs.</summary>
 [Route("api/v1/purchase-invoices")]
+[Authorize(Policy = NavPolicies.Prefix + "procurement")]
 public sealed class PurchaseInvoicesController : ApiControllerBase
 {
     private readonly IPurchaseInvoiceService _invoices;

Backend/ERPCore/Controllers/PurchaseOrdersController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Procurement;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Purchase-order endpoints (docs/11 §3.3).</summary>
 [Route("api/v1/purchase-orders")]
+[Authorize(Policy = NavPolicies.Prefix + "procurement")]
 public sealed class PurchaseOrdersController : ApiControllerBase
 {
     private readonly IPurchaseOrderService _pos;
@@ -32,7 +35,7 @@ public sealed class PurchaseOrdersController : ApiControllerBase
         return Ok(result.Value);
     }
 
-    /// <summary>Create a PO — auto-approved on creation in Phase 1 (FR-PROC-04). Totals computed server-side.</summary>
+    /// <summary>Create a PO — non-draft is issued straight into PendingApproval (FR-PROC-04). Totals computed server-side.</summary>
     [HttpPost]
     [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
@@ -57,7 +60,7 @@ public sealed class PurchaseOrdersController : ApiControllerBase
         return Ok(result.Value);
     }
 
-    /// <summary>Submit a Draft PO (Draft → Approved). 409 PO_NOT_EDITABLE if not Draft.</summary>
+    /// <summary>Submit a Draft PO (Draft → PendingApproval). 409 PO_NOT_EDITABLE if not Draft.</summary>
     [HttpPost("{poId:int}/submit")]
     [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -67,6 +70,7 @@ public sealed class PurchaseOrdersController : ApiControllerBase
 
     /// <summary>Delete a PO — permitted only while Draft (409 PO_NOT_EDITABLE otherwise).</summary>
     [HttpDelete("{poId:int}")]
+    [Authorize(Policy = NavPolicies.Prefix + "procurement" + NavPolicies.ActionSeparator + NavPolicies.DeleteAction)]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
@@ -76,13 +80,28 @@ public sealed class PurchaseOrdersController : ApiControllerBase
         return NoContent();
     }
 
-    /// <summary>Approve — no-op in Phase 1 (POs auto-approve); transitions PendingApproval→Approved when enabled.</summary>
+    /// <summary>Approve — PendingApproval → Approved. 403 PO_APPROVAL_FORBIDDEN if the caller
+    /// isn't an Admin or is the PO's own creator; 409 PO_NOT_PENDING_APPROVAL otherwise.</summary>
     [HttpPost("{poId:int}/approve")]
+    [Authorize(Policy = NavPolicies.Prefix + "procurement" + NavPolicies.ActionSeparator + NavPolicies.ApproveAction)]
     [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
     public async Task<ActionResult<PurchaseOrderDto>> Approve(int poId, CancellationToken ct)
         => Ok(await _pos.ApproveAsync(poId, ct));
 
+    /// <summary>Reject — PendingApproval → Draft, so the requester can revise and resubmit.
+    /// Same caller restrictions as <see cref="Approve"/>.</summary>
+    [HttpPost("{poId:int}/reject")]
+    [Authorize(Policy = NavPolicies.Prefix + "procurement" + NavPolicies.ActionSeparator + NavPolicies.ApproveAction)]
+    [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PurchaseOrderDto>> Reject(int poId, [FromBody] RejectPurchaseOrderRequest request, CancellationToken ct)
+        => Ok(await _pos.RejectAsync(poId, request.Reason, ct));
+
     /// <summary>Cancel — 409 if any goods have been received against the PO.</summary>
     [HttpPost("{poId:int}/cancel")]
     [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status200OK)]

Backend/ERPCore/Controllers/PurchaseReturnsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Procurement;
 using ERPCore.Services.Interfaces;
@@ -7,6 +9,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Purchase-return endpoints (docs/11 §3.4).</summary>
 [Route("api/v1/purchase-returns")]
+[Authorize(Policy = NavPolicies.Prefix + "procurement")]
 public sealed class PurchaseReturnsController : ApiControllerBase
 {
     private readonly IPurchaseReturnService _returns;

Backend/ERPCore/Controllers/RequisitionsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Procurement;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Purchase-requisition endpoints (docs/11 §3.1).</summary>
 [Route("api/v1/requisitions")]
+[Authorize(Policy = NavPolicies.Prefix + "procurement")]
 public sealed class RequisitionsController : ApiControllerBase
 {
     private readonly IRequisitionService _requisitions;

Backend/ERPCore/Controllers/RfqsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Procurement;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>RFQ &amp; quotation endpoints (docs/11 §3.2).</summary>
 [Route("api/v1/rfqs")]
+[Authorize(Policy = NavPolicies.Prefix + "procurement")]
 public sealed class RfqsController : ApiControllerBase
 {
     private readonly IRfqService _rfqs;

Backend/ERPCore/Controllers/RolesController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Rbac;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Role CRUD + permission assignment (mirrors AuthHex's Role; see docs/10 C.9).</summary>
 [Route("api/v1/roles")]
+[Authorize(Policy = NavPolicies.Prefix + "settings")]
 public sealed class RolesController : ApiControllerBase
 {
     private readonly IRoleService _roles;
@@ -64,6 +67,7 @@ public sealed class RolesController : ApiControllerBase
     }
 
     [HttpDelete("{roleId:int}")]
+    [Authorize(Policy = NavPolicies.Prefix + "settings" + NavPolicies.ActionSeparator + NavPolicies.DeleteAction)]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]

Backend/ERPCore/Controllers/SalesDayEndController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Sales;
 using ERPCore.Services.Interfaces;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 /// <summary>Cashier day-end close-out — locks a cashier's Posted sales slips for a business
 /// date and posts one consolidated GL journal entry for the day (docs/14 Sales API).</summary>
 [Route("api/v1/sales-day-end")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class SalesDayEndController : ApiControllerBase
 {
     private readonly ISalesDayEndService _dayEnds;

Backend/ERPCore/Controllers/SalesInvoicesController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Sales;
@@ -7,6 +9,7 @@ using Microsoft.AspNetCore.Mvc;
 namespace ERPCore.Controllers;
 
 [Route("api/v1/sales-invoices")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class SalesInvoicesController : ApiControllerBase
 {
     private readonly ISalesInvoiceService _invoices;

Backend/ERPCore/Controllers/SalesReportsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Sales;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
@@ -5,6 +7,7 @@ using Microsoft.AspNetCore.Mvc;
 namespace ERPCore.Controllers;
 
 [Route("api/v1/reports/sales")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class SalesReportsController : ApiControllerBase
 {
     private readonly ISalesReportService _reports;

Backend/ERPCore/Controllers/SalesReturnsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Sales;
 using ERPCore.Services.Interfaces;
@@ -7,6 +9,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Sales-return endpoints — customer returns of previously sold goods.</summary>
 [Route("api/v1/sales-returns")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class SalesReturnsController : ApiControllerBase
 {
     private readonly ISalesReturnService _returns;

Backend/ERPCore/Controllers/SalesSlipPromotionsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Sales;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
@@ -5,6 +7,7 @@ using Microsoft.AspNetCore.Mvc;
 namespace ERPCore.Controllers;
 
 [Route("api/v1/sales-slips/{salesSlipId:int}/free-issue-suggestions")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class SalesSlipPromotionsController : ApiControllerBase
 {
     private readonly ISalesPromotionSuggestionService _suggestions;

Backend/ERPCore/Controllers/SalesSlipsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Sales;
@@ -7,6 +9,7 @@ using Microsoft.AspNetCore.Mvc;
 namespace ERPCore.Controllers;
 
 [Route("api/v1/sales-slips")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class SalesSlipsController : ApiControllerBase
 {
     private readonly ISalesSlipService _slips;

Backend/ERPCore/Controllers/SearchController.cs

@@ -0,0 +1,20 @@
+using ERPCore.Dtos.Search;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+[Route("api/v1/search")]
+public sealed class SearchController : ApiControllerBase
+{
+    private readonly IGlobalSearchService _search;
+
+    public SearchController(IGlobalSearchService search) => _search = search;
+
+    [HttpGet]
+    public async Task<ActionResult<IReadOnlyList<GlobalSearchResultDto>>> Get([FromQuery] string q, CancellationToken ct)
+    {
+        var results = await _search.SearchAsync(q, 6, ct);
+        return Ok(results);
+    }
+}

Backend/ERPCore/Controllers/StockAdjustmentsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Stock;
 using ERPCore.Services.Interfaces;
@@ -7,6 +9,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Stock-adjustment endpoints (docs/11 §5.5).</summary>
 [Route("api/v1/stock-adjustments")]
+[Authorize(Policy = NavPolicies.Prefix + "stock")]
 public sealed class StockAdjustmentsController : ApiControllerBase
 {
     private readonly IAdjustmentService _adjustments;

Backend/ERPCore/Controllers/StockController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Procurement;
 using ERPCore.Dtos.Stock;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Stock enquiry, ledger, valuation and reorder-alert endpoints (docs/11 §5.1–5.3, §5.7).</summary>
 [Route("api/v1/stock")]
+[Authorize(Policy = NavPolicies.Prefix + "stock")]
 public sealed class StockController : ApiControllerBase
 {
     private readonly IStockService _stock;

Backend/ERPCore/Controllers/StockCountsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Stock;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Stock-count endpoints (docs/11 §5.6).</summary>
 [Route("api/v1/stock-counts")]
+[Authorize(Policy = NavPolicies.Prefix + "stock")]
 public sealed class StockCountsController : ApiControllerBase
 {
     private readonly ICountService _counts;

Backend/ERPCore/Controllers/StockTransfersController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Stock;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Stock-transfer endpoints (docs/11 §5.4).</summary>
 [Route("api/v1/stock-transfers")]
+[Authorize(Policy = NavPolicies.Prefix + "stock")]
 public sealed class StockTransfersController : ApiControllerBase
 {
     private readonly ITransferService _transfers;

Backend/ERPCore/Controllers/SubCategoriesController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Categories;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
@@ -10,6 +12,7 @@ namespace ERPCore.Controllers;
 /// since a subcategory only exists in the context of one.
 /// </summary>
 [Route("api/v1/subcategories")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
 public sealed class SubCategoriesController : ApiControllerBase
 {
     private readonly ICategoryService _categories;

Backend/ERPCore/Controllers/SupportTicketsController.cs

@@ -0,0 +1,70 @@
+using ERPCore.Dtos.Support;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+[Route("api/v1/support-tickets")]
+public sealed class SupportTicketsController : ApiControllerBase
+{
+    private readonly ISupportTicketService _tickets;
+    private readonly ICurrentUser _currentUser;
+
+    public SupportTicketsController(ISupportTicketService tickets, ICurrentUser currentUser)
+    {
+        _tickets = tickets;
+        _currentUser = currentUser;
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(SupportTicketDto), StatusCodes.Status201Created)]
+    public async Task<ActionResult<SupportTicketDto>> Create([FromBody] CreateSupportTicketRequest request, CancellationToken ct)
+    {
+        var result = await _tickets.CreateAsync(_currentUser.AuditUserId, request, ct);
+        SetETag(result.RowVersion);
+        return CreatedAtAction(nameof(GetById), new { id = result.Value.TicketId }, result.Value);
+    }
+
+    [HttpGet]
+    [ProducesResponseType(typeof(IReadOnlyList<SupportTicketSummaryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IReadOnlyList<SupportTicketSummaryDto>>> GetList(CancellationToken ct)
+    {
+        var list = await _tickets.GetListAsync(_currentUser.AuditUserId, _currentUser.IsAdmin, ct);
+        return Ok(list);
+    }
+
+    [HttpGet("{id:int}")]
+    [ProducesResponseType(typeof(SupportTicketDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<SupportTicketDto>> GetById(int id, CancellationToken ct)
+    {
+        var result = await _tickets.GetByIdAsync(id, _currentUser.AuditUserId, _currentUser.IsAdmin, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost("{id:int}/messages")]
+    [ProducesResponseType(typeof(SupportTicketDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<SupportTicketDto>> AddMessage(int id, [FromBody] AddSupportTicketMessageRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _tickets.AddMessageAsync(id, _currentUser.AuditUserId, _currentUser.IsAdmin, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPut("{id:int}/status")]
+    [ProducesResponseType(typeof(SupportTicketDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<SupportTicketDto>> UpdateStatus(int id, [FromBody] UpdateSupportTicketStatusRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _tickets.UpdateStatusAsync(id, _currentUser.AuditUserId, _currentUser.IsAdmin, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+}

Backend/ERPCore/Controllers/TaxRatesController.cs

@@ -0,0 +1,70 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.TaxRates;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Tax rate master endpoints — see <see cref="Domain.Entities.TaxRate"/>.</summary>
+[Route("api/v1/tax-rates")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
+public sealed class TaxRatesController : ApiControllerBase
+{
+    private readonly ITaxRateService _taxRates;
+
+    public TaxRatesController(ITaxRateService taxRates) => _taxRates = taxRates;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<TaxRateDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<TaxRateDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _taxRates.ListAsync(query, status, ct));
+
+    [HttpGet("{taxRateId:int}")]
+    [ProducesResponseType(typeof(TaxRateDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<TaxRateDto>> GetById(int taxRateId, CancellationToken ct)
+    {
+        var result = await _taxRates.GetAsync(taxRateId, ct);
+        if (result is null) return NotFound();
+
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(TaxRateDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<TaxRateDto>> Create([FromBody] CreateTaxRateRequest request, CancellationToken ct)
+    {
+        var result = await _taxRates.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/tax-rates/{result.Value.TaxRateId}", result.Value);
+    }
+
+    [HttpPut("{taxRateId:int}")]
+    [ProducesResponseType(typeof(TaxRateDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<TaxRateDto>> Update(int taxRateId, [FromBody] UpdateTaxRateRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _taxRates.UpdateAsync(taxRateId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    /// <summary>Deactivate/reactivate. Masters are never hard-deleted (FR-MD-08).</summary>
+    [HttpPatch("{taxRateId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int taxRateId, [FromBody] UpdateTaxRateStatusRequest request, CancellationToken ct)
+    {
+        await _taxRates.SetStatusAsync(taxRateId, request.Status, ct);
+        return NoContent();
+    }
+}

Backend/ERPCore/Controllers/UomsController.cs

@@ -1,4 +1,6 @@
 using ERPCore.Domain.Enums;
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Uoms;
 using ERPCore.Services.Interfaces;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Unit-of-measure endpoints (docs/11-BACKEND-PHASE1.md §2.2).</summary>
 [Route("api/v1/uoms")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
 public sealed class UomsController : ApiControllerBase
 {
     private readonly IUomService _uoms;

Backend/ERPCore/Controllers/UsersController.cs

@@ -1,10 +1,13 @@
+using Microsoft.AspNetCore.Authorization;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Audit;
+using ERPCore.Dtos.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Hrm;
 using ERPCore.Dtos.Users;
 using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using ERPCore.System.Errors;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers;
@@ -14,6 +17,7 @@ namespace ERPCore.Controllers;
 /// account creation orchestrated against AuthHex (see <see cref="IUserManagementService.CreateAsync"/>).
 /// </summary>
 [Route("api/v1/users")]
+[Authorize(Policy = NavPolicies.Prefix + "settings")]
 public sealed class UsersController : ApiControllerBase
 {
     private readonly IUserManagementService _users;
@@ -83,4 +87,20 @@ public sealed class UsersController : ApiControllerBase
     [ProducesResponseType(typeof(PagedResponse<LoginActivityDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedResponse<LoginActivityDto>>> ListLoginDevices(int userId, [FromQuery] PageQuery query, CancellationToken ct)
         => Ok(await _audit.ListLoginDevicesAsync(userId, query, ct));
+
+    /// <summary>
+    /// Admin-only escape hatch: permanently deletes a stale AuthHex identity (by email/mobile/NIC/
+    /// username) that is blocking new registrations. Does not touch ERPCore's own `users` table.
+    /// See <see cref="IUserManagementService.PurgeAuthHexIdentityAsync"/>.
+    /// </summary>
+    [HttpPost("purge-authhex-identity")]
+    [ProducesResponseType(typeof(DeleteAuthHexUserResult), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    public async Task<ActionResult<DeleteAuthHexUserResult>> PurgeAuthHexIdentity([FromBody] PurgeAuthHexIdentityRequest request, CancellationToken ct)
+    {
+        if (!_currentUser.IsAdmin)
+            throw new DomainException("FORBIDDEN", "Only an administrator can purge an AuthHex identity.", 403);
+
+        return Ok(await _users.PurgeAuthHexIdentityAsync(request, ct));
+    }
 }

Backend/ERPCore/Controllers/VendorsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Vendors;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Vendor master endpoints (docs/11-BACKEND-PHASE1.md §2.4).</summary>
 [Route("api/v1/vendors")]
+[Authorize(Policy = NavPolicies.Prefix + "vendors")]
 public sealed class VendorsController : ApiControllerBase
 {
     private readonly IVendorService _vendors;

Backend/ERPCore/Controllers/WarehousesController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Warehouses;
 using ERPCore.Services.Interfaces;
@@ -7,6 +9,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Warehouse &amp; bin endpoints (docs/11-BACKEND-PHASE1.md §2.5).</summary>
 [Route("api/v1/warehouses")]
+[Authorize(Policy = NavPolicies.Prefix + "warehouses")]
 public sealed class WarehousesController : ApiControllerBase
 {
     private readonly IWarehouseService _warehouses;
@@ -37,6 +40,24 @@ public sealed class WarehousesController : ApiControllerBase
         return Created($"/api/v1/warehouses/{dto.WarehouseId}", dto);
     }
 
+    [HttpPut("{warehouseId:int}")]
+    [ProducesResponseType(typeof(WarehouseDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<WarehouseDto>> Update(int warehouseId, [FromBody] UpdateWarehouseRequest request, CancellationToken ct)
+        => Ok(await _warehouses.UpdateAsync(warehouseId, request, ct));
+
+    [HttpDelete("{warehouseId:int}")]
+    [Authorize(Policy = NavPolicies.Prefix + "warehouses" + NavPolicies.ActionSeparator + NavPolicies.DeleteAction)]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int warehouseId, CancellationToken ct)
+    {
+        await _warehouses.DeleteAsync(warehouseId, ct);
+        return NoContent();
+    }
+
     [HttpGet("{warehouseId:int}/bins")]
     [ProducesResponseType(typeof(IReadOnlyList<BinDto>), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]