auth layer implemented

Distribution/Features/Region/RegionController.cs

@@ -1,28 +1,39 @@
-using Microsoft.AspNetCore.Mvc;
+using Distribution.Infra.Authorization;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Region;
 
 [ApiController]
 [Route("api/regions")]
-public class RegionController(RegionService service) : ControllerBase
+public class RegionController(
+    RegionService service,
+    IScopeAccessService scopeAccess,
+    ICurrentUserService currentUser) : ControllerBase
 {
     [HttpGet]
+    [Authorize("region.view")]
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
-    // Suggested code for the Add Region form; the user may override it.
     [HttpGet("next-code")]
+    [Authorize("region.view")]
     public async Task<IActionResult> GetNextCode() =>
         Ok(await service.GetNextCodeAsync());
 
     [HttpGet("{id:guid}")]
+    [Authorize("region.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
+        var userId = currentUser.UserId;
+        if (userId.HasValue && !await scopeAccess.HasRegionScopeAsync(userId.Value, id))
+            return StatusCode(403);
         var result = await service.GetByIdAsync(id);
         return result is null ? NotFound() : Ok(result);
     }
 
     [HttpPost]
+    [Authorize("region.manage")]
     public async Task<IActionResult> Create(CreateRegionRequest request, CancellationToken ct)
     {
         var result = await service.CreateAsync(request, ct);
@@ -30,6 +41,7 @@ public class RegionController(RegionService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}")]
+    [Authorize("region.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateRegionRequest request, CancellationToken ct)
     {
         var result = await service.UpdateAsync(id, request, ct);
@@ -37,6 +49,7 @@ public class RegionController(RegionService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}")]
+    [Authorize("region.manage")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteAsync(id, ct);
@@ -44,6 +57,7 @@ public class RegionController(RegionService service) : ControllerBase
     }
 
     [HttpGet("{id:guid}/manager")]
+    [Authorize("region.view")]
     public async Task<IActionResult> GetManager(Guid id)
     {
         var result = await service.GetManagerAsync(id);
@@ -51,6 +65,7 @@ public class RegionController(RegionService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/manager")]
+    [Authorize("region.manage")]
     public async Task<IActionResult> SetManager(Guid id, SetRegionManagerRequest request, CancellationToken ct)
     {
         try
@@ -65,14 +80,15 @@ public class RegionController(RegionService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}/manager")]
+    [Authorize("region.manage")]
     public async Task<IActionResult> RemoveManager(Guid id, CancellationToken ct)
     {
         var removed = await service.RemoveManagerAsync(id, ct);
         return removed ? NoContent() : NotFound();
     }
 
-    //targets/budgets/agencies/tax-rule.
     [HttpPut("{id:guid}/manage")]
+    [Authorize("region.manage")]
     public async Task<IActionResult> Manage(Guid id, ManageRegionRequest request, CancellationToken ct)
     {
         var result = await service.ManageAsync(id, request, ct);
@@ -80,6 +96,7 @@ public class RegionController(RegionService service) : ControllerBase
     }
 
     [HttpGet("{id:guid}/hierarchy")]
+    [Authorize("region.view")]
     public async Task<IActionResult> GetHierarchy(Guid id)
     {
         var result = await service.GetHierarchyAsync(id);
@@ -87,18 +104,20 @@ public class RegionController(RegionService service) : ControllerBase
     }
 
     [HttpGet("{id:guid}/dashboard")]
+    [Authorize("region.view")]
     public async Task<IActionResult> GetDashboard(Guid id, [FromQuery] string period)
     {
         var result = await service.GetDashboardAsync(id, period);
         return result is null ? NotFound() : Ok(result);
     }
 
-    // Flat CRUD-list view over targets/budgets/tax-rules/agency-maps across all regions.
     [HttpGet("manage-entries")]
+    [Authorize("region.view")]
     public async Task<IActionResult> GetManageEntries() =>
         Ok(await service.GetManageEntriesAsync());
 
     [HttpDelete("manage-entries/{entryType}/{id:guid}")]
+    [Authorize("region.manage")]
     public async Task<IActionResult> DeleteManageEntry(RegionManageEntryType entryType, Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteManageEntryAsync(entryType, id, ct);