feature: RBAC + Clinical Audit Logging

VigilCareClinicalAPI/Controllers/PatientsController.cs

@@ -1,3 +1,4 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 
@@ -7,6 +8,7 @@ using Microsoft.AspNetCore.Mvc;
 [ApiController]
 [Route("api/v1/patients")]
 [Produces("application/json")]
+[Authorize]
 public class PatientsController : ControllerBase
 {
     private readonly IPatientService _patients;
@@ -19,6 +21,7 @@ public class PatientsController : ControllerBase
     /// <param name="req">Patient demographics.</param>
     /// <returns>The created patient record.</returns>
     [HttpPost]
+    [AuthorizePermission(ClinicalPermissions.PatientsWrite)]
     [ProducesResponseType(typeof(ApiResponse<Patient>), StatusCodes.Status201Created)]
     public async Task<IActionResult> Register([FromBody] RegisterPatientRequest req)
     {
@@ -34,6 +37,7 @@ public class PatientsController : ControllerBase
     /// <param name="pageSize">Results per page.</param>
     /// <returns>A paginated list of patients.</returns>
     [HttpGet]
+    [AuthorizePermission(ClinicalPermissions.PatientsRead)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status200OK)]
     public async Task<IActionResult> List([FromQuery] string? q, [FromQuery] int page = 1, [FromQuery] int pageSize = 20)
     {
@@ -54,6 +58,7 @@ public class PatientsController : ControllerBase
     /// <param name="id">Patient id.</param>
     /// <returns>The patient record.</returns>
     [HttpGet("{id:guid}")]
+    [AuthorizePermission(ClinicalPermissions.PatientsRead)]
     [ProducesResponseType(typeof(ApiResponse<Patient>), StatusCodes.Status200OK)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status404NotFound)]
     public async Task<IActionResult> Get(Guid id)
@@ -69,6 +74,7 @@ public class PatientsController : ControllerBase
     /// <param name="req">Encounter type, department, and attending physician.</param>
     /// <returns>The created encounter.</returns>
     [HttpPost("{id:guid}/encounters")]
+    [AuthorizePermission(ClinicalPermissions.EncountersWrite)]
     [ProducesResponseType(typeof(ApiResponse<Encounter>), StatusCodes.Status201Created)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status404NotFound)]
     [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status409Conflict)]
@@ -77,4 +83,4 @@ public class PatientsController : ControllerBase
         var encounter = await _patients.OpenEncounterAsync(id, req);
         return StatusCode(201, ApiResponse<Encounter>.Created(encounter));
     }
-}
+}