Add role control

API/ROLAC.API/Controllers/MembersController.cs

@@ -1,5 +1,6 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using ROLAC.API.Authorization;
 using ROLAC.API.DTOs.Members;
 using ROLAC.API.Services;
 
@@ -15,7 +16,7 @@ public class MembersController : ControllerBase
 
     /// <summary>GET /api/members?page=1&pageSize=20&search=Chen&status=Member&hasUser=false</summary>
     [HttpGet]
-    [Authorize(Roles = "super_admin,secretary,pastor")]
+    [HasPermission(Modules.Members, PermissionActions.Read)]
     public async Task<IActionResult> GetPaged(
         [FromQuery] int     page     = 1,
         [FromQuery] int     pageSize = 20,
@@ -26,7 +27,7 @@ public class MembersController : ControllerBase
 
     /// <summary>GET /api/members/{id}</summary>
     [HttpGet("{id:int}")]
-    [Authorize(Roles = "super_admin,secretary,pastor")]
+    [HasPermission(Modules.Members, PermissionActions.Read)]
     public async Task<IActionResult> GetById(int id)
     {
         var dto = await _members.GetByIdAsync(id);
@@ -35,7 +36,7 @@ public class MembersController : ControllerBase
 
     /// <summary>POST /api/members</summary>
     [HttpPost]
-    [Authorize(Roles = "super_admin,secretary")]
+    [HasPermission(Modules.Members, PermissionActions.Write)]
     public async Task<IActionResult> Create([FromBody] CreateMemberRequest request)
     {
         var id = await _members.CreateAsync(request);
@@ -44,7 +45,7 @@ public class MembersController : ControllerBase
 
     /// <summary>PUT /api/members/{id}</summary>
     [HttpPut("{id:int}")]
-    [Authorize(Roles = "super_admin,secretary")]
+    [HasPermission(Modules.Members, PermissionActions.Write)]
     public async Task<IActionResult> Update(int id, [FromBody] UpdateMemberRequest request)
     {
         try   { await _members.UpdateAsync(id, request); return NoContent(); }
@@ -53,7 +54,7 @@ public class MembersController : ControllerBase
 
     /// <summary>DELETE /api/members/{id} — soft delete</summary>
     [HttpDelete("{id:int}")]
-    [Authorize(Roles = "super_admin,secretary")]
+    [HasPermission(Modules.Members, PermissionActions.Delete)]
     public async Task<IActionResult> Delete(int id)
     {
         try   { await _members.DeleteAsync(id); return NoContent(); }