feature: RBAC + Clinical Audit Logging

VigilCareClinicalAPI/Controllers/ObservationsController.cs

@@ -1,3 +1,4 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 
@@ -7,6 +8,7 @@ using Microsoft.AspNetCore.Mvc;
 [ApiController]
 [Route("api/v1/encounters/{encounterId:guid}/observations")]
 [Produces("application/json")]
+[Authorize]
 public class ObservationsController : ControllerBase
 {
     private readonly IObservationService _ingest;
@@ -25,6 +27,7 @@ public class ObservationsController : ControllerBase
     /// <param name="req">Batch of observations to record.</param>
     /// <returns>Per-observation ingest results, including any generated alerts.</returns>
     [HttpPost]
+    [AuthorizePermission(ClinicalPermissions.ObservationsIngest)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status201Created)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status400BadRequest)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status404NotFound)]
@@ -67,6 +70,7 @@ public class ObservationsController : ControllerBase
     /// <param name="cursor">Opaque cursor from a previous page.</param>
     /// <returns>A page of observations with an optional next cursor.</returns>
     [HttpGet]
+    [AuthorizePermission(ClinicalPermissions.EncountersRead)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status200OK)]
     public async Task<IActionResult> History(
         Guid encounterId,
@@ -84,4 +88,4 @@ public class ObservationsController : ControllerBase
             hasMore = page.HasMore
         }));
     }
-}
+}