Add user and role management features

Distribution/Features/User/UserController.cs

@@ -0,0 +1,63 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace Distribution.Features.User;
+
+[ApiController]
+[Route("api/users")]
+[Authorize]
+public class UserController(UserService service) : ControllerBase
+{
+    [HttpGet]
+    [Authorize(Policy = "users.view")]
+    public async Task<IActionResult> GetAll() =>
+        Ok(await service.GetAllAsync());
+
+    [HttpGet("{id:guid}")]
+    [Authorize(Policy = "users.view")]
+    public async Task<IActionResult> GetById(Guid id)
+    {
+        var result = await service.GetByIdAsync(id);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    [HttpPost]
+    [Authorize(Policy = "users.create")]
+    public async Task<IActionResult> Create(CreateUserRequest request, CancellationToken ct)
+    {
+        var result = await service.CreateAsync(request, ct);
+        return CreatedAtAction(nameof(GetById), new { id = result.Id }, result);
+    }
+
+    [HttpPut("{id:guid}")]
+    [Authorize(Policy = "users.update")]
+    public async Task<IActionResult> Update(Guid id, UpdateUserRequest request, CancellationToken ct)
+    {
+        var result = await service.UpdateAsync(id, request, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    [HttpPut("{id:guid}/role")]
+    [Authorize(Policy = "users.assign_role")]
+    public async Task<IActionResult> AssignRole(Guid id, AssignUserRoleRequest request, CancellationToken ct)
+    {
+        var result = await service.AssignRoleAsync(id, request, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    [HttpPut("{id:guid}/scope")]
+    [Authorize(Policy = "users.assign_scope")]
+    public async Task<IActionResult> AssignScope(Guid id, AssignUserScopeRequest request, CancellationToken ct)
+    {
+        var updated = await service.AssignScopeAsync(id, request, ct);
+        return updated ? NoContent() : NotFound();
+    }
+
+    [HttpDelete("{id:guid}")]
+    [Authorize(Policy = "users.deactivate")]
+    public async Task<IActionResult> Deactivate(Guid id, CancellationToken ct)
+    {
+        var deactivated = await service.DeactivateAsync(id, ct);
+        return deactivated ? NoContent() : NotFound();
+    }
+}