Add role control

API/ROLAC.API/Controllers/OfferingSessionsController.cs

@@ -1,5 +1,6 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using ROLAC.API.Authorization;
 using ROLAC.API.DTOs.Giving;
 using ROLAC.API.Services;
 
@@ -7,23 +8,26 @@ namespace ROLAC.API.Controllers;
 
 [ApiController]
 [Route("api/offering-sessions")]
-[Authorize(Roles = "finance,super_admin")]
+[Authorize]
 public class OfferingSessionsController : ControllerBase
 {
     private readonly IOfferingSessionService _svc;
     public OfferingSessionsController(IOfferingSessionService svc) => _svc = svc;
 
     [HttpGet]
+    [HasPermission(Modules.OfferingSessions, PermissionActions.Read)]
     public async Task<IActionResult> GetPaged(
         [FromQuery] int page = 1, [FromQuery] int pageSize = 20,
         [FromQuery] DateOnly? from = null, [FromQuery] DateOnly? to = null)
         => Ok(await _svc.GetPagedAsync(page, pageSize, from, to));
 
     [HttpGet("check-date")]
+    [HasPermission(Modules.OfferingSessions, PermissionActions.Read)]
     public async Task<IActionResult> CheckDate([FromQuery] DateOnly date)
         => Ok(new { exists = await _svc.DateExistsAsync(date) });
 
     [HttpGet("{id:int}")]
+    [HasPermission(Modules.OfferingSessions, PermissionActions.Read)]
     public async Task<IActionResult> GetById(int id)
     {
         var dto = await _svc.GetByIdAsync(id);
@@ -31,6 +35,7 @@ public class OfferingSessionsController : ControllerBase
     }
 
     [HttpPost]
+    [HasPermission(Modules.OfferingSessions, PermissionActions.Write)]
     public async Task<IActionResult> Create([FromBody] CreateOfferingSessionRequest request)
     {
         try
@@ -42,6 +47,7 @@ public class OfferingSessionsController : ControllerBase
     }
 
     [HttpPost("{id:int}/reopen")]
+    [HasPermission(Modules.OfferingSessions, PermissionActions.Approve)]
     public async Task<IActionResult> Reopen(int id)
     {
         try   { await _svc.ReopenAsync(id); return NoContent(); }
@@ -50,6 +56,7 @@ public class OfferingSessionsController : ControllerBase
     }
 
     [HttpPut("{id:int}")]
+    [HasPermission(Modules.OfferingSessions, PermissionActions.Write)]
     public async Task<IActionResult> Replace(int id, [FromBody] CreateOfferingSessionRequest request)
     {
         try   { await _svc.ReplaceAsync(id, request); return NoContent(); }
@@ -60,6 +67,7 @@ public class OfferingSessionsController : ControllerBase
     // ── Paper-proof PDF (merged client-side, one file per session) ───────────
 
     [HttpPost("{id:int}/proof")]
+    [HasPermission(Modules.OfferingSessions, PermissionActions.Write)]
     [RequestSizeLimit(52_428_800)]   // 50 MB — a merged multi-image PDF is larger than one receipt
     public async Task<IActionResult> UploadProof(int id, IFormFile file)
     {
@@ -75,6 +83,7 @@ public class OfferingSessionsController : ControllerBase
     }
 
     [HttpGet("{id:int}/proof")]
+    [HasPermission(Modules.OfferingSessions, PermissionActions.Read)]
     public async Task<IActionResult> GetProof(int id)
     {
         try
@@ -87,6 +96,7 @@ public class OfferingSessionsController : ControllerBase
     }
 
     [HttpDelete("{id:int}/proof")]
+    [HasPermission(Modules.OfferingSessions, PermissionActions.Delete)]
     public async Task<IActionResult> DeleteProof(int id)
     {
         try   { await _svc.DeleteProofAsync(id); return NoContent(); }