auth layer implemented

Distribution/Features/Category/CategoryController.cs

@@ -1,4 +1,5 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Category;
 
@@ -6,10 +7,12 @@ namespace Distribution.Features.Category;
 public class CategoryController(CategoryService service) : ControllerBase
 {
     [HttpGet("api/categories")]
+    [Authorize("category.view")]
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
     [HttpGet("api/categories/{id:guid}")]
+    [Authorize("category.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -17,6 +20,7 @@ public class CategoryController(CategoryService service) : ControllerBase
     }
 
     [HttpPost("api/categories")]
+    [Authorize("category.manage")]
     public async Task<IActionResult> Create(CreateCategoryRequest request, CancellationToken ct)
     {
         var result = await service.CreateAsync(request, ct);
@@ -24,6 +28,7 @@ public class CategoryController(CategoryService service) : ControllerBase
     }
 
     [HttpPut("api/categories/{id:guid}")]
+    [Authorize("category.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateCategoryRequest request, CancellationToken ct)
     {
         var result = await service.UpdateAsync(id, request, ct);
@@ -31,6 +36,7 @@ public class CategoryController(CategoryService service) : ControllerBase
     }
 
     [HttpDelete("api/categories/{id:guid}")]
+    [Authorize("category.manage")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteAsync(id, ct);
@@ -38,6 +44,7 @@ public class CategoryController(CategoryService service) : ControllerBase
     }
 
     [HttpPost("api/categories/{categoryId:guid}/subcategories")]
+    [Authorize("category.manage")]
     public async Task<IActionResult> CreateSubCategory(Guid categoryId, CreateSubCategoryRequest request, CancellationToken ct)
     {
         var result = await service.CreateSubCategoryAsync(categoryId, request, ct);
@@ -45,6 +52,7 @@ public class CategoryController(CategoryService service) : ControllerBase
     }
 
     [HttpPut("api/subcategories/{id:guid}")]
+    [Authorize("category.manage")]
     public async Task<IActionResult> UpdateSubCategory(Guid id, UpdateSubCategoryRequest request, CancellationToken ct)
     {
         var result = await service.UpdateSubCategoryAsync(id, request, ct);
@@ -52,6 +60,7 @@ public class CategoryController(CategoryService service) : ControllerBase
     }
 
     [HttpDelete("api/subcategories/{id:guid}")]
+    [Authorize("category.manage")]
     public async Task<IActionResult> DeleteSubCategory(Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteSubCategoryAsync(id, ct);