Protect distribution APIs with permissions and scope checks

Distribution/Features/Order/OrderService.cs

@@ -1,17 +1,33 @@
+using Distribution.Infra.Auth;
 using Distribution.Infra.UoW;
 
 namespace Distribution.Features.Order;
 
-public class OrderService(IOrderRepository repo, IUnitOfWork uow)
+public class OrderService(IOrderRepository repo, IUnitOfWork uow, ICurrentUserService currentUser, IScopeAccessService scopeAccess)
 {
+    private const int GlobalScopeRoleLevel = 50;
+
     private static OrderResponse ToResponse(Models.Order o, List<Models.OrderItem> items) =>
         new(o.Id, o.OrderDate, o.FK_StoreId, o.TotalAmount,
             items.Select(i => new OrderItemResponse(i.FK_ItemId, i.Quantity)).ToList(),
             o.IsActive, o.CreatedAt);
 
+    private bool HasGlobalScope => currentUser.RoleLevel >= GlobalScopeRoleLevel;
+
+    private async Task<bool> HasStoreScopeAsync(Guid storeId)
+    {
+        if (HasGlobalScope || currentUser.UserId is null) return HasGlobalScope;
+        return await scopeAccess.HasStoreScopeAsync(currentUser.UserId.Value, storeId);
+    }
+
     public async Task<List<OrderResponse>> GetAllAsync()
     {
         var orders = (await repo.GetAllAsync()).Where(o => o.IsActive).ToList();
+        if (!HasGlobalScope && currentUser.UserId is not null)
+        {
+            var accessibleStoreIds = (await scopeAccess.GetAccessibleStoreIdsAsync(currentUser.UserId.Value)).ToHashSet();
+            orders = orders.Where(o => accessibleStoreIds.Contains(o.FK_StoreId)).ToList();
+        }
         var result = new List<OrderResponse>();
         foreach (var order in orders)
         {
@@ -25,12 +41,14 @@ public class OrderService(IOrderRepository repo, IUnitOfWork uow)
     {
         var order = await repo.GetByIdAsync(id);
         if (order is null || !order.IsActive) return null;
+        if (!await HasStoreScopeAsync(order.FK_StoreId)) return null;
         var items = await repo.GetItemsByOrderIdAsync(id);
         return ToResponse(order, items);
     }
 
-    public async Task<List<OrderResponse>> GetByStoreIdAsync(Guid storeId)
+    public async Task<List<OrderResponse>?> GetByStoreIdAsync(Guid storeId)
     {
+        if (!await HasStoreScopeAsync(storeId)) return null;
         var orders = await repo.GetByStoreIdAsync(storeId);
         var result = new List<OrderResponse>();
         foreach (var order in orders)
@@ -41,8 +59,10 @@ public class OrderService(IOrderRepository repo, IUnitOfWork uow)
         return result;
     }
 
-    public async Task<OrderResponse> CreateAsync(CreateOrderRequest request, CancellationToken ct = default)
+    public async Task<OrderResponse?> CreateAsync(CreateOrderRequest request, CancellationToken ct = default)
     {
+        if (!await HasStoreScopeAsync(request.StoreId)) return null;
+
         var order = new Models.Order
         {
             FK_StoreId = request.StoreId,
@@ -75,6 +95,7 @@ public class OrderService(IOrderRepository repo, IUnitOfWork uow)
     {
         var order = await repo.GetByIdAsync(id);
         if (order is null || !order.IsActive) return null;
+        if (!await HasStoreScopeAsync(order.FK_StoreId)) return null;
         order.OrderDate = request.OrderDate;
         order.TotalAmount = request.TotalAmount;
         await uow.BeginAsync(ct);
@@ -96,6 +117,7 @@ public class OrderService(IOrderRepository repo, IUnitOfWork uow)
     {
         var order = await repo.GetByIdAsync(id);
         if (order is null || !order.IsActive) return false;
+        if (!await HasStoreScopeAsync(order.FK_StoreId)) return false;
         await uow.BeginAsync(ct);
         try
         {