Add role control

API/ROLAC.API/Controllers/DisbursementsController.cs

@@ -1,6 +1,7 @@
 using System.Security.Claims;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using ROLAC.API.Authorization;
 using ROLAC.API.DTOs.Disbursement;
 using ROLAC.API.Services;
 
@@ -8,17 +9,19 @@ namespace ROLAC.API.Controllers;
 
 [ApiController]
 [Route("api/disbursements")]
-[Authorize(Roles = "finance,super_admin")]
+[Authorize]
 public class DisbursementsController : ControllerBase
 {
     private readonly IDisbursementService _svc;
     public DisbursementsController(IDisbursementService svc) => _svc = svc;
 
     [HttpGet("approved-unpaid")]
+    [HasPermission(Modules.Disbursements, PermissionActions.Read)]
     public async Task<IActionResult> GetApprovedUnpaid()
         => Ok(await _svc.GetApprovedUnpaidGroupedAsync());
 
     [HttpPost("issue")]
+    [HasPermission(Modules.Disbursements, PermissionActions.Write)]
     public async Task<IActionResult> Issue([FromBody] IssueChecksRequest r)
     {
         try { return Ok(await _svc.IssueChecksAsync(r)); }
@@ -27,12 +30,14 @@ public class DisbursementsController : ControllerBase
     }
 
     [HttpGet("checks")]
+    [HasPermission(Modules.Disbursements, PermissionActions.Read)]
     public async Task<IActionResult> GetRegister(
         [FromQuery] int page = 1, [FromQuery] int pageSize = 20, [FromQuery] string? status = null,
         [FromQuery] string? search = null, [FromQuery] DateOnly? from = null, [FromQuery] DateOnly? to = null)
         => Ok(await _svc.GetRegisterAsync(page, pageSize, status, search, from, to));
 
     [HttpGet("checks/{id:int}")]
+    [HasPermission(Modules.Disbursements, PermissionActions.Read)]
     public async Task<IActionResult> GetById(int id)
     {
         var dto = await _svc.GetByIdAsync(id);
@@ -40,6 +45,7 @@ public class DisbursementsController : ControllerBase
     }
 
     [HttpPost("checks/{id:int}/void")]
+    [HasPermission(Modules.Disbursements, PermissionActions.Delete)]
     public async Task<IActionResult> Void(int id, [FromBody] VoidCheckRequest r)
     {
         try { await _svc.VoidAsync(id, r.Reason); return NoContent(); }
@@ -48,6 +54,7 @@ public class DisbursementsController : ControllerBase
     }
 
     [HttpGet("checks/{id:int}/pdf")]
+    [HasPermission(Modules.Disbursements, PermissionActions.Read)]
     public async Task<IActionResult> GetPdf(int id)
     {
         var result = await _svc.RenderPdfAsync(id);
@@ -56,6 +63,7 @@ public class DisbursementsController : ControllerBase
     }
 
     [HttpGet("checks/{id:int}/receipt-pdf")]
+    [HasPermission(Modules.Disbursements, PermissionActions.Read)]
     public async Task<IActionResult> GetReceiptPdf(int id)
     {
         var result = await _svc.RenderReceiptPdfAsync(id);
@@ -64,6 +72,7 @@ public class DisbursementsController : ControllerBase
     }
 
     [HttpPost("checks/{id:int}/acknowledge")]
+    [HasPermission(Modules.Disbursements, PermissionActions.Approve)]
     [RequestSizeLimit(5_242_880)]
     public async Task<IActionResult> Acknowledge(int id, [FromForm] IFormFile signature, [FromForm] string signedName)
     {
@@ -82,6 +91,7 @@ public class DisbursementsController : ControllerBase
     }
 
     [HttpGet("checks/{id:int}/signature")]
+    [HasPermission(Modules.Disbursements, PermissionActions.Read)]
     public async Task<IActionResult> GetSignature(int id)
     {
         try