auth layer implemented

Distribution/Features/Route/RouteController.cs

@@ -1,23 +1,34 @@
-using Microsoft.AspNetCore.Mvc;
+using Distribution.Infra.Authorization;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Route;
 
 [ApiController]
 [Route("api/routes")]
-public class RouteController(RouteService service) : ControllerBase
+public class RouteController(
+    RouteService service,
+    IScopeAccessService scopeAccess,
+    ICurrentUserService currentUser) : ControllerBase
 {
     [HttpGet]
+    [Authorize("route.view")]
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
     [HttpGet("{id:guid}")]
+    [Authorize("route.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
+        var userId = currentUser.UserId;
+        if (userId.HasValue && !await scopeAccess.HasRouteScopeAsync(userId.Value, id))
+            return StatusCode(403);
         var result = await service.GetByIdAsync(id);
         return result is null ? NotFound() : Ok(result);
     }
 
     [HttpPost]
+    [Authorize("route.manage")]
     public async Task<IActionResult> Create(CreateRouteRequest request, CancellationToken ct)
     {
         var result = await service.CreateAsync(request, ct);
@@ -25,6 +36,7 @@ public class RouteController(RouteService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}")]
+    [Authorize("route.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateRouteRequest request, CancellationToken ct)
     {
         var result = await service.UpdateAsync(id, request, ct);
@@ -32,6 +44,7 @@ public class RouteController(RouteService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/region")]
+    [Authorize("route.manage")]
     public async Task<IActionResult> AssignToRegion(Guid id, AssignRouteToRegionRequest request, CancellationToken ct)
     {
         var result = await service.AssignToRegionAsync(id, request, ct);
@@ -39,6 +52,7 @@ public class RouteController(RouteService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}")]
+    [Authorize("route.manage")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteAsync(id, ct);
@@ -46,6 +60,7 @@ public class RouteController(RouteService service) : ControllerBase
     }
 
     [HttpPost("{id:guid}/stores")]
+    [Authorize("route.manage")]
     public async Task<IActionResult> AssignStores(Guid id, AssignStoresToRouteRequest request, CancellationToken ct)
     {
         var result = await service.AssignStoresToRouteAsync(id, request, ct);
@@ -53,6 +68,7 @@ public class RouteController(RouteService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/owner")]
+    [Authorize("route.manage")]
     public async Task<IActionResult> AssignOwner(Guid id, AssignRouteOwnerRequest request, CancellationToken ct)
     {
         var result = await service.AssignOwnerAsync(id, request, ct);
@@ -60,10 +76,12 @@ public class RouteController(RouteService service) : ControllerBase
     }
 
     [HttpPost("{id:guid}/optimize")]
+    [Authorize("route.manage")]
     public IActionResult OptimizeSequence(Guid id) =>
         StatusCode(StatusCodes.Status501NotImplemented);
 
     [HttpPost("{id:guid}/visits/check-in")]
+    [Authorize("route.manage")]
     public async Task<IActionResult> CheckIn(Guid id, RecordCheckInRequest request, CancellationToken ct)
     {
         try
@@ -75,6 +93,7 @@ public class RouteController(RouteService service) : ControllerBase
     }
 
     [HttpPost("{id:guid}/visits/check-out")]
+    [Authorize("route.manage")]
     public async Task<IActionResult> CheckOut(Guid id, RecordCheckOutRequest request, CancellationToken ct)
     {
         var result = await service.RecordCheckOutAsync(id, request, ct);