Protect distribution APIs with permissions and scope checks

Distribution/Features/Order/OrderController.cs

@@ -1,16 +1,20 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Order;
 
 [ApiController]
 [Route("api/orders")]
+[Authorize]
 public class OrderController(OrderService service) : ControllerBase
 {
     [HttpGet]
+    [Authorize(Policy = "orders.view")]
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
     [HttpGet("{id:guid}")]
+    [Authorize(Policy = "orders.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -18,17 +22,23 @@ public class OrderController(OrderService service) : ControllerBase
     }
 
     [HttpGet("store/{storeId:guid}")]
-    public async Task<IActionResult> GetByStore(Guid storeId) =>
-        Ok(await service.GetByStoreIdAsync(storeId));
+    [Authorize(Policy = "orders.view")]
+    public async Task<IActionResult> GetByStore(Guid storeId)
+    {
+        var result = await service.GetByStoreIdAsync(storeId);
+        return result is null ? Forbid() : Ok(result);
+    }
 
     [HttpPost]
+    [Authorize(Policy = "orders.create")]
     public async Task<IActionResult> Create(CreateOrderRequest request, CancellationToken ct)
     {
         var result = await service.CreateAsync(request, ct);
-        return CreatedAtAction(nameof(GetById), new { id = result.Id }, result);
+        return result is null ? Forbid() : CreatedAtAction(nameof(GetById), new { id = result.Id }, result);
     }
 
     [HttpPut("{id:guid}")]
+    [Authorize(Policy = "orders.update")]
     public async Task<IActionResult> Update(Guid id, UpdateOrderRequest request, CancellationToken ct)
     {
         var result = await service.UpdateAsync(id, request, ct);
@@ -36,6 +46,7 @@ public class OrderController(OrderService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}")]
+    [Authorize(Policy = "orders.delete")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteAsync(id, ct);