Add role control

API/ROLAC.API/Controllers/MonthlyStatementsController.cs

@@ -1,5 +1,6 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using ROLAC.API.Authorization;
 using ROLAC.API.DTOs.Expense;
 using ROLAC.API.Services;
 
@@ -7,17 +8,19 @@ namespace ROLAC.API.Controllers;
 
 [ApiController]
 [Route("api/monthly-statements")]
-[Authorize(Roles = "finance,super_admin")]
+[Authorize]
 public class MonthlyStatementsController : ControllerBase
 {
     private readonly IMonthlyStatementService _svc;
     public MonthlyStatementsController(IMonthlyStatementService svc) => _svc = svc;
 
     [HttpGet]
+    [HasPermission(Modules.MonthlyStatements, PermissionActions.Read)]
     public async Task<IActionResult> GetAll([FromQuery] int? year = null)
         => Ok(await _svc.GetAllAsync(year));
 
     [HttpGet("{id:int}")]
+    [HasPermission(Modules.MonthlyStatements, PermissionActions.Read)]
     public async Task<IActionResult> GetById(int id)
     {
         var dto = await _svc.GetByIdAsync(id);
@@ -25,6 +28,7 @@ public class MonthlyStatementsController : ControllerBase
     }
 
     [HttpPost]
+    [HasPermission(Modules.MonthlyStatements, PermissionActions.Write)]
     public async Task<IActionResult> Create([FromBody] CreateMonthlyStatementRequest r)
     {
         try { return Ok(new { id = await _svc.CreateAsync(r) }); }
@@ -32,6 +36,7 @@ public class MonthlyStatementsController : ControllerBase
     }
 
     [HttpPut("{id:int}")]
+    [HasPermission(Modules.MonthlyStatements, PermissionActions.Write)]
     public async Task<IActionResult> Update(int id, [FromBody] UpdateMonthlyStatementRequest r)
     {
         try { await _svc.UpdateAsync(id, r); return NoContent(); }
@@ -40,6 +45,7 @@ public class MonthlyStatementsController : ControllerBase
     }
 
     [HttpPost("{id:int}/finalize")]
+    [HasPermission(Modules.MonthlyStatements, PermissionActions.Approve)]
     public async Task<IActionResult> Finalize(int id)
     {
         try { await _svc.FinalizeAsync(id); return NoContent(); }