auth layer implemented

Distribution/Features/Item/ItemController.cs

@@ -1,4 +1,5 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Item;
 
@@ -7,6 +8,7 @@ namespace Distribution.Features.Item;
 public class ItemController(ItemService service) : ControllerBase
 {
     [HttpGet]
+    [Authorize("item.view")]
     public async Task<IActionResult> GetAll(
         [FromQuery] Guid? categoryId,
         [FromQuery] Guid? subCategoryId,
@@ -14,6 +16,7 @@ public class ItemController(ItemService service) : ControllerBase
         Ok(await service.GetAllAsync(categoryId, subCategoryId, brandId));
 
     [HttpGet("{id:guid}")]
+    [Authorize("item.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -21,6 +24,7 @@ public class ItemController(ItemService service) : ControllerBase
     }
 
     [HttpPost]
+    [Authorize("item.manage")]
     public async Task<IActionResult> Create(CreateItemRequest request, CancellationToken ct)
     {
         try
@@ -35,6 +39,7 @@ public class ItemController(ItemService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}")]
+    [Authorize("item.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateItemRequest request, CancellationToken ct)
     {
         var result = await service.UpdateAsync(id, request, ct);
@@ -42,6 +47,7 @@ public class ItemController(ItemService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}")]
+    [Authorize("item.manage")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteAsync(id, ct);
@@ -49,6 +55,7 @@ public class ItemController(ItemService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/uom-conversions")]
+    [Authorize("item.manage")]
     public async Task<IActionResult> ReplaceConversions(Guid id, ReplaceConversionsRequest request, CancellationToken ct)
     {
         var result = await service.ReplaceConversionsAsync(id, request, ct);