feature: RBAC + Clinical Audit Logging

VigilCareClinicalAPI/Controllers/MedicationsController.cs

@@ -1,3 +1,4 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 
@@ -6,6 +7,7 @@ using Microsoft.AspNetCore.Mvc;
 /// </summary>
 [ApiController]
 [Produces("application/json")]
+[Authorize]
 public class MedicationsController : ControllerBase
 {
     private readonly IMedicationService _medications;
@@ -19,6 +21,7 @@ public class MedicationsController : ControllerBase
     /// <param name="req">Medication administration details.</param>
     /// <returns>The created medication administration record.</returns>
     [HttpPost("api/v1/encounters/{encounterId:guid}/medications")]
+    [AuthorizePermission(ClinicalPermissions.MedicationsWrite)]
     [ProducesResponseType(typeof(ApiResponse<MedicationAdministration>), StatusCodes.Status201Created)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status404NotFound)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status409Conflict)]
@@ -37,6 +40,7 @@ public class MedicationsController : ControllerBase
     /// <param name="pageSize">Results per page.</param>
     /// <returns>A paginated list of medication administrations.</returns>
     [HttpGet("api/v1/encounters/{encounterId:guid}/medications")]
+    [AuthorizePermission(ClinicalPermissions.EncountersRead)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status200OK)]
     public async Task<IActionResult> ListByEncounter(
         Guid encounterId,
@@ -61,6 +65,7 @@ public class MedicationsController : ControllerBase
     /// <param name="id">Medication administration id.</param>
     /// <returns>The medication administration record.</returns>
     [HttpGet("api/v1/medications/{id:guid}")]
+    [AuthorizePermission(ClinicalPermissions.EncountersRead)]
     [ProducesResponseType(typeof(ApiResponse<MedicationAdministration>), StatusCodes.Status200OK)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status404NotFound)]
     public async Task<IActionResult> Get(Guid id)