auth layer implemented

Distribution/Features/User/UserController.cs

@@ -1,4 +1,5 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.User;
 
@@ -7,10 +8,12 @@ namespace Distribution.Features.User;
 public class UserController(UserService service) : ControllerBase
 {
     [HttpGet]
+    [Authorize("user.view")]
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
     [HttpGet("{id:guid}")]
+    [Authorize("user.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -18,6 +21,7 @@ public class UserController(UserService service) : ControllerBase
     }
 
     [HttpPost]
+    [Authorize("user.manage")]
     public async Task<IActionResult> Create(CreateUserRequest request, CancellationToken ct)
     {
         var result = await service.CreateAsync(request, ct);
@@ -25,6 +29,7 @@ public class UserController(UserService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}")]
+    [Authorize("user.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateUserRequest request, CancellationToken ct)
     {
         var result = await service.UpdateAsync(id, request, ct);
@@ -32,6 +37,7 @@ public class UserController(UserService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/role")]
+    [Authorize("user.manage")]
     public async Task<IActionResult> AssignRole(Guid id, AssignUserRoleRequest request, CancellationToken ct)
     {
         var result = await service.AssignRoleAsync(id, request, ct);
@@ -39,6 +45,7 @@ public class UserController(UserService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/scope")]
+    [Authorize("user.manage")]
     public async Task<IActionResult> AssignScope(Guid id, AssignUserScopeRequest request, CancellationToken ct)
     {
         var updated = await service.AssignScopeAsync(id, request, ct);
@@ -46,6 +53,7 @@ public class UserController(UserService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}")]
+    [Authorize("user.manage")]
     public async Task<IActionResult> Deactivate(Guid id, CancellationToken ct)
     {
         var deactivated = await service.DeactivateAsync(id, ct);