auth layer implemented

Distribution/Features/Scheme/SchemeController.cs

@@ -1,4 +1,5 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Scheme;
 
@@ -7,10 +8,12 @@ namespace Distribution.Features.Scheme;
 public class SchemeController(SchemeService service) : ControllerBase
 {
     [HttpGet]
+    [Authorize("scheme.view")]
     public async Task<IActionResult> GetAll([FromQuery] Guid? regionId) =>
         Ok(await service.GetAllAsync(regionId));
 
     [HttpGet("{id:guid}")]
+    [Authorize("scheme.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -18,6 +21,7 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpPost]
+    [Authorize("scheme.manage")]
     public async Task<IActionResult> Create(CreateSchemeRequest request, CancellationToken ct)
     {
         try
@@ -32,6 +36,7 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}")]
+    [Authorize("scheme.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateSchemeRequest request, CancellationToken ct)
     {
         try
@@ -46,6 +51,7 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}")]
+    [Authorize("scheme.manage")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteAsync(id, ct);
@@ -53,6 +59,7 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/free-goods-rule")]
+    [Authorize("scheme.manage")]
     public async Task<IActionResult> SetFreeGoodsRule(Guid id, SetFreeGoodsRuleRequest request, CancellationToken ct)
     {
         try
@@ -67,6 +74,7 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}/free-goods-rule")]
+    [Authorize("scheme.manage")]
     public async Task<IActionResult> ClearFreeGoodsRule(Guid id, CancellationToken ct)
     {
         var result = await service.ClearFreeGoodsRuleAsync(id, ct);
@@ -74,6 +82,7 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/bundle-components/{itemId:guid}")]
+    [Authorize("scheme.manage")]
     public async Task<IActionResult> UpsertBundleComponent(Guid id, Guid itemId, UpsertBundleComponentRequest request, CancellationToken ct)
     {
         try
@@ -88,6 +97,7 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}/bundle-components/{itemId:guid}")]
+    [Authorize("scheme.manage")]
     public async Task<IActionResult> RemoveBundleComponent(Guid id, Guid itemId, CancellationToken ct)
     {
         var result = await service.RemoveBundleComponentAsync(id, itemId, ct);
@@ -95,6 +105,7 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpGet("eligible")]
+    [Authorize("scheme.view")]
     public async Task<IActionResult> GetEligible([FromQuery] Guid storeId, [FromQuery] Guid orderId)
     {
         var result = await service.EvaluateEligibilityAsync(storeId, orderId);
@@ -102,6 +113,7 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpGet("{id:guid}/spend")]
+    [Authorize("scheme.view")]
     public async Task<IActionResult> GetSpend(Guid id)
     {
         var result = await service.GetSpendAsync(id);
@@ -109,6 +121,7 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpGet("{id:guid}/roi")]
+    [Authorize("scheme.view")]
     public async Task<IActionResult> GetROI(Guid id)
     {
         var result = await service.GetROIAsync(id);
@@ -121,6 +134,7 @@ public class SchemeController(SchemeService service) : ControllerBase
 public class SchemeOrderController(SchemeService service) : ControllerBase
 {
     [HttpPost("{id:guid}/apply-scheme")]
+    [Authorize("scheme.manage")]
     public async Task<IActionResult> ApplyScheme(Guid id, ApplySchemeRequest request, CancellationToken ct)
     {
         try