feat: add user and role view sheets with detailed information display

- Created UserViewSheet component to display user details including username, full name, role, status, and timestamps.
- Created RoleViewSheet component to display role details including name, level, status, creation date, and associated permissions.
- Introduced permissions configuration in a new permissions.ts file, defining categories and permission codes for better management.
- Implemented middleware for authentication, ensuring access control for protected routes.

Distribution/Features/Auth/AuthController.cs

@@ -1,3 +1,5 @@
+using System.IdentityModel.Tokens.Jwt;
+using Distribution.Features.User;
 using Distribution.Infra.Authorization;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
@@ -6,32 +8,93 @@ namespace Distribution.Features.Auth;
 
 [ApiController]
 [Route("api/auth")]
-public class AuthController(AuthService service, ICurrentUserService currentUser) : ControllerBase
+public class AuthController(AuthService service, ICurrentUserService currentUser, IUserRepository userRepo) : ControllerBase
 {
     private static IActionResult ToActionResult(AuthHexResponse result) =>
         result.Success ? new OkObjectResult(result) : new ObjectResult(result) { StatusCode = result.StatusCode is >= 400 and < 600 ? result.StatusCode : 401 };
 
     [HttpPost("login")]
-    public async Task<IActionResult> Login(LoginRequest request, CancellationToken ct) =>
-        ToActionResult(await service.LoginAsync(request, ct));
+    [AllowAnonymous]
+    public async Task<IActionResult> Login(LoginRequest request, CancellationToken ct)
+    {
+        var result = await service.LoginAsync(request, ct);
+
+        if (!result.Success || result.Data is not { } data)
+            return ToActionResult(result);
+
+        string? token = null;
+        TimeSpan maxAge = TimeSpan.FromHours(1);
+
+        if (data.TryGetProperty("accessToken", out var tokenEl))
+            token = tokenEl.GetString();
+
+        if (data.TryGetProperty("expiresIn", out var expEl))
+            maxAge = TimeSpan.FromSeconds(expEl.GetInt32());
+
+        if (!string.IsNullOrEmpty(token))
+        {
+            Response.Cookies.Append("access-token", token, new CookieOptions
+            {
+                HttpOnly = true,
+                SameSite = SameSiteMode.Lax,
+                Path = "/",
+                MaxAge = maxAge,
+                Secure = Request.IsHttps,
+            });
+        }
+
+        MeResponse? profile = null;
+        if (!string.IsNullOrEmpty(token))
+        {
+            var jwt = new JwtSecurityTokenHandler().ReadJwtToken(token);
+            var userIdStr = jwt.Claims.FirstOrDefault(c => c.Type == "UserId")?.Value;
+            if (Guid.TryParse(userIdStr, out var userId))
+            {
+                var user = await userRepo.GetByIdAsync(userId);
+                if (user is not null)
+                    profile = new MeResponse(
+                        user.Id,
+                        user.Username,
+                        user.FK_RoleId,
+                        user.Role?.Name ?? string.Empty,
+                        user.Role?.Level ?? 0);
+            }
+        }
+
+        return Ok(new { result.StatusCode, result.Success, result.Message, result.Data, profile });
+    }
 
     [HttpPost("register")]
+    [AllowAnonymous]
     public async Task<IActionResult> Register(RegisterRequest request, CancellationToken ct) =>
         ToActionResult(await service.RegisterAsync(request, ct));
 
     [HttpGet("me")]
     [Authorize]
-    public async Task<IActionResult> Me(CancellationToken ct)
+    public async Task<IActionResult> Me()
     {
-        var userId = currentUser.UserId ?? throw new UnauthorizedAccessException();
-        return ToActionResult(await service.GetUserDetailsAsync(userId, ct));
+        if (currentUser.UserId is null) return Unauthorized();
+        var user = await userRepo.GetByIdAsync(currentUser.UserId.Value);
+        if (user is null) return Unauthorized();
+        return Ok(new MeResponse(
+            user.Id,
+            user.Username,
+            user.FK_RoleId,
+            user.Role?.Name ?? string.Empty,
+            user.Role?.Level ?? 0));
     }
 
     [HttpPost("logout")]
-    [Authorize]
-    public async Task<IActionResult> Logout(CancellationToken ct)
+    [AllowAnonymous]
+    public IActionResult Logout()
     {
-        var token = Request.Headers.Authorization.ToString().Replace("Bearer ", "", StringComparison.OrdinalIgnoreCase);
-        return ToActionResult(await service.LogoutAsync(token, ct));
+        Response.Cookies.Delete("access-token", new CookieOptions
+        {
+            HttpOnly = true,
+            SameSite = SameSiteMode.Lax,
+            Path = "/",
+            Secure = Request.IsHttps,
+        });
+        return Ok(new { success = true });
     }
 }

Distribution/Features/Auth/AuthDTOs.cs

@@ -1,5 +1,16 @@
 namespace Distribution.Features.Auth;
 
-public record LoginRequest(string Username, string Password);
+public record LoginRequest(
+    string Identifier,
+    string Password,
+    Guid? UserTypeId = null,
+    string DeviceName = "Unknown Device");
 
-public record RegisterRequest(string Username, string Password, string? FullName);
+public record RegisterRequest(string Username, string email, string Password, string? FullName);
+
+public record MeResponse(
+    Guid UserId,
+    string Username,
+    Guid RoleId,
+    string RoleCode,
+    int RoleLevel);

Distribution/Features/Auth/AuthHexClient.cs

@@ -0,0 +1,20 @@
+using System.Net.Http.Json;
+
+namespace Distribution.Features.Auth;
+
+/// <summary>
+/// Proxies own-user auth calls (login/register/getUserDetails/logout) to the external AuthHex
+/// identity service. AuthHex owns credentials and issues the RS256-signed JWT this app validates;
+/// this app never sees or stores a plaintext/hashed password.
+/// </summary>
+public class AuthHexClient(HttpClient http) : IAuthHexClient
+{
+    public async Task<AuthHexResponse> CallAsync(string functionName, object? payload, string? reference = null, CancellationToken ct = default)
+    {
+        var body = new { functionName, payload, reference };
+        var response = await http.PostAsJsonAsync("/api/user", body, ct);
+
+        var result = await response.Content.ReadFromJsonAsync<AuthHexResponse>(cancellationToken: ct);
+        return result ?? new AuthHexResponse((int)response.StatusCode, false, "Empty response from AuthHex.", null);
+    }
+}

Distribution/Features/Auth/AuthHexResponse.cs

@@ -0,0 +1,11 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+
+namespace Distribution.Features.Auth;
+
+/// <summary>Raw response shape returned by AuthHex's `/api/user` endpoint for every functionName.</summary>
+public record AuthHexResponse(
+    [property: JsonPropertyName("statusCode")] int StatusCode,
+    [property: JsonPropertyName("success")] bool Success,
+    [property: JsonPropertyName("message")] string? Message,
+    [property: JsonPropertyName("data")] JsonElement? Data);

Distribution/Features/Auth/AuthService.cs

@@ -1,17 +1,21 @@
-using Distribution.Infra.Authorization;
 
 namespace Distribution.Features.Auth;
 
 /// <summary>
 /// Own-user auth is fully delegated to AuthHex — this service only proxies the four functions
 /// AuthHex exposes (loginUser/registerUser/getUserDetails/LogoutUser). No local password check or
-/// token issuance happens here; AuthHex owns credentials and signs the JWT this app validates
-/// (see Program.cs's JwtBearer registration + OnTokenValidated role mapping).
+/// token issuance happens here; AuthHex owns credentials and signs the JWT this app validates.
 /// </summary>
 public class AuthService(IAuthHexClient authHex)
 {
     public Task<AuthHexResponse> LoginAsync(LoginRequest request, CancellationToken ct = default) =>
-        authHex.CallAsync("loginUser", request, reference: Guid.NewGuid().ToString(), ct: ct);
+        authHex.CallAsync("loginUser", new
+        {
+            identifier = request.Identifier,
+            password = request.Password,
+            userTypeId = request.UserTypeId,
+            deviceName = request.DeviceName
+        }, reference: Guid.NewGuid().ToString(), ct: ct);
 
     public Task<AuthHexResponse> RegisterAsync(RegisterRequest request, CancellationToken ct = default) =>
         authHex.CallAsync("registerUser", request, reference: Guid.NewGuid().ToString(), ct: ct);

Distribution/Features/Auth/AuthServiceClient.cs

@@ -1,20 +0,0 @@
-namespace Distribution.Features.Auth;
-
-/// <summary>
-/// Typed HttpClient that proxies requests to the external Auth Service.
-/// Registered via AddHttpClient&lt;AuthServiceClient&gt; in Program.cs.
-/// BaseAddress is configured from AuthService:BaseUrl in appsettings.json.
-///
-/// TODO: Implement methods once Auth Service contract is agreed.
-/// </summary>
-public class AuthServiceClient(HttpClient http) : IAuthServiceClient
-{
-    // TODO: implement proxy methods, e.g.:
-    //
-    // public async Task<AuthServiceResponse?> LoginAsync(LoginRequest request, CancellationToken ct)
-    // {
-    //     var response = await http.PostAsJsonAsync("/TODO_AUTH_SERVICE_LOGIN_PATH", request, ct);
-    //     if (!response.IsSuccessStatusCode) return null;
-    //     return await response.Content.ReadFromJsonAsync<AuthServiceResponse>(ct);
-    // }
-}

Distribution/Features/Auth/AuthServiceOptions.cs

@@ -1,11 +0,0 @@
-namespace Distribution.Features.Auth;
-
-public class AuthServiceOptions
-{
-    public const string SectionName = "AuthService";
-
-    /// <summary>Base URL of the external Auth Service, e.g. "https://auth.internal".</summary>
-    public string BaseUrl { get; set; } = string.Empty;
-
-    // TODO: add other config (API keys, timeout, etc.) once Auth Service is defined.
-}

Distribution/Features/Auth/IAuthHexClient.cs

@@ -0,0 +1,6 @@
+namespace Distribution.Features.Auth;
+
+public interface IAuthHexClient
+{
+    Task<AuthHexResponse> CallAsync(string functionName, object? payload, string? reference = null, CancellationToken ct = default);
+}

Distribution/Features/Auth/IAuthServiceClient.cs

@@ -1,16 +0,0 @@
-namespace Distribution.Features.Auth;
-
-/// <summary>
-/// Connector to the external Auth Service. This backend proxies all auth
-/// traffic from the Next.js frontend through to the Auth Service — the
-/// frontend never calls the Auth Service directly.
-///
-/// TODO: Fill in the method signatures once the Auth Service contract is agreed.
-/// </summary>
-public interface IAuthServiceClient
-{
-    // TODO: define methods based on Auth Service contract, e.g.:
-    // Task<AuthServiceResponse?> LoginAsync(LoginRequest request, CancellationToken ct);
-    // Task<AuthServiceResponse?> RefreshAsync(string refreshToken, CancellationToken ct);
-    // Task LogoutAsync(string token, CancellationToken ct);
-}