new updates

Backend/ERPCore/Program.cs

@@ -15,6 +15,7 @@ using ERPCore.Services.Production;
 using ERPCore.Services.Stock;
 using ERPCore.System.Errors;
 using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.EntityFrameworkCore.Diagnostics;
 using Microsoft.OpenApi;
@@ -46,6 +47,12 @@ builder.Services.AddExceptionHandler<DomainExceptionHandler>();
 // Auth: validate external AuthHex RS256 tokens + ERP door policy (docs/10 A.4)
 builder.Services.AddErpJwtAuth(builder.Configuration);
 
+// Per-endpoint RBAC (docs/02-SECURITY.md AR-01) — [Authorize(Policy = NavPolicies.For("..."))].
+builder.Services.AddMemoryCache();
+builder.Services.AddScoped<INavPermissionService, NavPermissionService>();
+builder.Services.AddSingleton<IAuthorizationPolicyProvider, NavPolicyProvider>();
+builder.Services.AddScoped<IAuthorizationHandler, NavAuthorizationHandler>();
+
 // AuthController proxy → AuthHex (docs/11 §2.0)
 builder.Services.AddHttpClient<IAuthHexClient, AuthHexClient>(c =>
 {
@@ -70,6 +77,7 @@ builder.Services.AddScoped<IGeneralLedgerService, GeneralLedgerService>();
 // JIT-provisions a local shadow user and injects the local `int` id as `nameid`.
 builder.Services.AddHttpContextAccessor();
 builder.Services.AddScoped<ICurrentUser, CurrentUser>();
+builder.Services.AddScoped<ICurrentBranchContext, CurrentBranchContext>();
 builder.Services.AddScoped<IClaimsTransformation, ShadowUserClaimsTransformation>();
 
 // Unit of work + generic repository base
@@ -82,6 +90,7 @@ builder.Services.AddScoped<IItemService, ItemService>();
 builder.Services.AddScoped<IUomService, UomService>();
 builder.Services.AddScoped<ICategoryService, CategoryService>();
 builder.Services.AddScoped<IBrandService, BrandService>();
+builder.Services.AddScoped<ITaxRateService, TaxRateService>();
 builder.Services.AddScoped<IItemTypeService, ItemTypeService>();
 //builder.Services.AddScoped<ICompanyProfileService, CompanyProfileService>();
 builder.Services.AddScoped<IProductConfigService, ProductConfigService>();
@@ -89,8 +98,11 @@ builder.Services.AddScoped<IBranchConfigService, BranchConfigService>();
 builder.Services.AddScoped<IBranchAccessService, BranchAccessService>();
 builder.Services.AddSingleton<INotificationModuleCatalog, NotificationModuleCatalog>();
 builder.Services.AddScoped<INotificationConfigService, NotificationConfigService>();
+builder.Services.AddScoped<INotificationService, NotificationService>();
+builder.Services.AddScoped<IGlobalSearchService, GlobalSearchService>();
 builder.Services.AddScoped<IVendorService, VendorService>();
 builder.Services.AddScoped<IWarehouseService, WarehouseService>();
+builder.Services.AddScoped<ISupportTicketService, SupportTicketService>();
 
 // RBAC / sidebar: Role (shadow of AuthHex) + Permission assignment + user management
 builder.Services.AddScoped<IRoleService, RoleService>();