feature: RBAC + Clinical Audit Logging

VigilCareClinicalAPI/Controllers/AlertThresholdsController.cs

@@ -1,3 +1,4 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 
@@ -7,6 +8,7 @@ using Microsoft.AspNetCore.Mvc;
 [ApiController]
 [Route("api/v1/alert-thresholds")]
 [Produces("application/json")]
+[Authorize]
 public class AlertThresholdsController : ControllerBase
 {
     private readonly IAlertThresholdService _thresholds;
@@ -19,6 +21,7 @@ public class AlertThresholdsController : ControllerBase
     /// <param name="req">Threshold bounds and display metadata.</param>
     /// <returns>The created threshold.</returns>
     [HttpPost]
+    [AuthorizePermission(ClinicalPermissions.ThresholdsWrite)]
     [ProducesResponseType(typeof(ApiResponse<AlertThreshold>), StatusCodes.Status201Created)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status409Conflict)]
     public async Task<IActionResult> Create([FromBody] AlertThresholdRequest req)
@@ -32,6 +35,7 @@ public class AlertThresholdsController : ControllerBase
     /// </summary>
     /// <returns>All configured thresholds.</returns>
     [HttpGet]
+    [AuthorizePermission(ClinicalPermissions.ThresholdsRead)]
     [ProducesResponseType(typeof(ApiResponse<List<AlertThreshold>>), StatusCodes.Status200OK)]
     public async Task<IActionResult> List()
     {
@@ -45,6 +49,7 @@ public class AlertThresholdsController : ControllerBase
     /// <param name="id">Threshold id.</param>
     /// <returns>The threshold record.</returns>
     [HttpGet("{id:guid}")]
+    [AuthorizePermission(ClinicalPermissions.ThresholdsRead)]
     [ProducesResponseType(typeof(ApiResponse<AlertThreshold>), StatusCodes.Status200OK)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status404NotFound)]
     public async Task<IActionResult> Get(Guid id)
@@ -60,6 +65,7 @@ public class AlertThresholdsController : ControllerBase
     /// <param name="req">Updated threshold bounds and display metadata.</param>
     /// <returns>The updated threshold.</returns>
     [HttpPut("{id:guid}")]
+    [AuthorizePermission(ClinicalPermissions.ThresholdsWrite)]
     [ProducesResponseType(typeof(ApiResponse<AlertThreshold>), StatusCodes.Status200OK)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status404NotFound)]
     public async Task<IActionResult> Update(Guid id, [FromBody] AlertThresholdRequest req)
@@ -67,4 +73,4 @@ public class AlertThresholdsController : ControllerBase
         var threshold = await _thresholds.UpdateAsync(id, req);
         return Ok(ApiResponse<AlertThreshold>.Ok(threshold));
     }
-}
+}