Protect distribution APIs with permissions and scope checks

Distribution/Features/Store/StoreController.cs

@@ -1,16 +1,20 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Store;
 
 [ApiController]
 [Route("api/stores")]
+[Authorize]
 public class StoreController(StoreService service) : ControllerBase
 {
     [HttpGet]
+    [Authorize(Policy = "stores.view")]
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
     [HttpGet("{id:guid}")]
+    [Authorize(Policy = "stores.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -18,6 +22,7 @@ public class StoreController(StoreService service) : ControllerBase
     }
 
     [HttpPost]
+    [Authorize(Policy = "stores.create")]
     public async Task<IActionResult> Create(CreateStoreRequest request, CancellationToken ct)
     {
         var result = await service.CreateAsync(request, ct);
@@ -25,6 +30,7 @@ public class StoreController(StoreService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}")]
+    [Authorize(Policy = "stores.update")]
     public async Task<IActionResult> Update(Guid id, UpdateStoreRequest request, CancellationToken ct)
     {
         var result = await service.UpdateAsync(id, request, ct);
@@ -32,6 +38,7 @@ public class StoreController(StoreService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}")]
+    [Authorize(Policy = "stores.delete")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteAsync(id, ct);

Distribution/Features/Store/StoreService.cs

@@ -1,22 +1,39 @@
+using Distribution.Infra.Auth;
 using Distribution.Infra.UoW;
 
 namespace Distribution.Features.Store;
 
-public class StoreService(IStoreRepository repo, IUnitOfWork uow)
+public class StoreService(IStoreRepository repo, IUnitOfWork uow, ICurrentUserService currentUser, IScopeAccessService scopeAccess)
 {
+    private const int GlobalScopeRoleLevel = 50;
+
     private static StoreResponse ToResponse(Models.Store s) =>
         new(s.Id, s.OwnerName, s.StoreName, s.StoreAddress, s.Latitude, s.Longitude, s.OneTimeAmount, s.CreditAmount, s.IsActive, s.CreatedAt);
 
-    public async Task<List<StoreResponse>> GetAllAsync() =>
-        (await repo.GetAllAsync())
-            .Where(s => s.IsActive)
-            .Select(ToResponse)
-            .ToList();
+    private bool HasGlobalScope => currentUser.RoleLevel >= GlobalScopeRoleLevel;
+
+    private async Task<bool> HasStoreScopeAsync(Guid storeId)
+    {
+        if (HasGlobalScope || currentUser.UserId is null) return HasGlobalScope;
+        return await scopeAccess.HasStoreScopeAsync(currentUser.UserId.Value, storeId);
+    }
+
+    public async Task<List<StoreResponse>> GetAllAsync()
+    {
+        var stores = (await repo.GetAllAsync()).Where(s => s.IsActive).ToList();
+        if (!HasGlobalScope && currentUser.UserId is not null)
+        {
+            var accessibleStoreIds = (await scopeAccess.GetAccessibleStoreIdsAsync(currentUser.UserId.Value)).ToHashSet();
+            stores = stores.Where(s => accessibleStoreIds.Contains(s.Id)).ToList();
+        }
+        return stores.Select(ToResponse).ToList();
+    }
 
     public async Task<StoreResponse?> GetByIdAsync(Guid id)
     {
         var store = await repo.GetByIdAsync(id);
         if (store is null || !store.IsActive) return null;
+        if (!await HasStoreScopeAsync(id)) return null;
         return ToResponse(store);
     }
 
@@ -50,6 +67,7 @@ public class StoreService(IStoreRepository repo, IUnitOfWork uow)
     {
         var store = await repo.GetByIdAsync(id);
         if (store is null || !store.IsActive) return null;
+        if (!await HasStoreScopeAsync(id)) return null;
         store.OwnerName = request.OwnerName;
         store.StoreName = request.StoreName;
         store.StoreAddress = request.StoreAddress;
@@ -75,6 +93,7 @@ public class StoreService(IStoreRepository repo, IUnitOfWork uow)
     {
         var store = await repo.GetByIdAsync(id);
         if (store is null || !store.IsActive) return false;
+        if (!await HasStoreScopeAsync(id)) return false;
         await uow.BeginAsync(ct);
         try
         {