Add role control

API/ROLAC.API/Controllers/UsersController.cs

@@ -1,5 +1,6 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using ROLAC.API.Authorization;
 using ROLAC.API.DTOs.Users;
 using ROLAC.API.Services;
 
@@ -7,7 +8,7 @@ namespace ROLAC.API.Controllers;
 
 [ApiController]
 [Route("api/users")]
-[Authorize(Roles = "super_admin")]
+[Authorize]
 public class UsersController : ControllerBase
 {
     private readonly IUserManagementService _users;
@@ -15,6 +16,7 @@ public class UsersController : ControllerBase
 
     /// <summary>GET /api/users?page=1&pageSize=20&search=Chris</summary>
     [HttpGet]
+    [HasPermission(Modules.Users, PermissionActions.Read)]
     public async Task<IActionResult> GetPaged(
         [FromQuery] int     page     = 1,
         [FromQuery] int     pageSize = 20,
@@ -23,6 +25,7 @@ public class UsersController : ControllerBase
 
     /// <summary>GET /api/users/{id}</summary>
     [HttpGet("{id}")]
+    [HasPermission(Modules.Users, PermissionActions.Read)]
     public async Task<IActionResult> GetById(string id)
     {
         var dto = await _users.GetByIdAsync(id);
@@ -34,6 +37,7 @@ public class UsersController : ControllerBase
     /// TempPassword is returned ONCE — show it to the admin and never log it.
     /// </summary>
     [HttpPost]
+    [HasPermission(Modules.Users, PermissionActions.Write)]
     public async Task<IActionResult> Create([FromBody] CreateUserRequest request)
     {
         try
@@ -49,6 +53,7 @@ public class UsersController : ControllerBase
 
     /// <summary>PUT /api/users/{id} — update email, roles, IsActive</summary>
     [HttpPut("{id}")]
+    [HasPermission(Modules.Users, PermissionActions.Write)]
     public async Task<IActionResult> Update(string id, [FromBody] UpdateUserRequest request)
     {
         try   { await _users.UpdateAsync(id, request); return NoContent(); }
@@ -58,6 +63,7 @@ public class UsersController : ControllerBase
 
     /// <summary>DELETE /api/users/{id} — deactivates account (IsActive=false), does not delete</summary>
     [HttpDelete("{id}")]
+    [HasPermission(Modules.Users, PermissionActions.Delete)]
     public async Task<IActionResult> Deactivate(string id)
     {
         try   { await _users.DeactivateAsync(id); return NoContent(); }
@@ -66,6 +72,7 @@ public class UsersController : ControllerBase
 
     /// <summary>POST /api/users/{id}/reset-password — returns new temp password</summary>
     [HttpPost("{id}/reset-password")]
+    [HasPermission(Modules.Users, PermissionActions.Write)]
     public async Task<IActionResult> ResetPassword(string id)
     {
         try