fix: solución de bloqueos y estandarización de permisos

backend/api/v1/modules/public/reference_data/code_pedimento_regimens/routes.py

@@ -15,12 +15,15 @@ router = APIRouter(prefix="/code-pedimento-regimens")
 def list_code_pedimento_regimens(
     page: int = Query(1, ge=1, description="Número de página"),
     page_size: int = Query(50, ge=1, le=1000, description="Tamaño de página"),
+    company_id: int = Query(..., description="ID de la empresa"),
     code: str = Query(None, description="Filter by code"),
     regime: str = Query(None, description="Filter by regime"),
     type: str = Query(None, description="Filter by type"),
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_pedimento_regimens.view"])
     skip = (page - 1) * page_size
     query = db.query(CodePedimentoRegimen)
 

backend/api/v1/modules/public/reference_data/containers/routes.py

@@ -1,7 +1,7 @@
 from typing import Any, Dict
 
 from core.database import get_core_db
-from core.security import get_current_user, has_role
+from core.security import get_current_user, validate_access_to_resource
 from fastapi import APIRouter, Depends, HTTPException, Query
 from sqlalchemy.orm import Session
 
@@ -15,9 +15,13 @@ router = APIRouter(prefix="/containers")
 async def list_containers(
     page: int = Query(1, ge=1, description="Número de página"),
     page_size: int = Query(50, ge=1, le=100, description="Tamaño de página"),
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    # 🛡️ Permiso de Lectura (Listado)
+    validate_access_to_resource(db, company_id, current_user, required_permissions=["ref_containers.view"])
+    
     skip = (page - 1) * page_size
     query = db.query(Container)
     items = query.offset(skip).limit(page_size).all()
@@ -33,9 +37,13 @@ async def list_containers(
 @router.get("/{key}", response_model=ContainerDTO)
 async def get_container(
     key: str,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    # 🛡️ Permiso de Lectura (Individual)
+    validate_access_to_resource(db, company_id, current_user, required_permissions=["ref_containers.view"])
+    
     obj = db.query(Container).filter(Container.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -45,9 +53,13 @@ async def get_container(
 @router.post("/", response_model=ContainerDTO, status_code=201)
 async def create_container(
     data: ContainerDTO,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    # 🛡️ Permiso de Creación
+    validate_access_to_resource(db, company_id, current_user, required_permissions=["ref_containers.create"])
+    
     obj = Container(**data.dict())
     db.add(obj)
     db.commit()
@@ -59,9 +71,13 @@ async def create_container(
 async def update_container(
     key: str,
     data: ContainerDTO,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    # 🛡️ Permiso de Edición
+    validate_access_to_resource(db, company_id, current_user, required_permissions=["ref_containers.edit"])
+    
     obj = db.query(Container).filter(Container.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -75,12 +91,16 @@ async def update_container(
 @router.delete("/{key}", status_code=204)
 async def delete_container(
     key: str,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    # 🛡️ Permiso de Borrado
+    validate_access_to_resource(db, company_id, current_user, required_permissions=["ref_containers.delete"])
+    
     obj = db.query(Container).filter(Container.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
     db.delete(obj)
     db.commit()
-    return None
+    return None

backend/api/v1/modules/public/reference_data/countries/routes.py

@@ -1,7 +1,7 @@
 from typing import Any, Dict
 
 from core.database import get_core_db
-from core.security import get_current_user, has_role
+from core.security import get_current_user
 from fastapi import APIRouter, Depends, HTTPException, Query
 from sqlalchemy.orm import Session
 
@@ -15,10 +15,14 @@ router = APIRouter(prefix="/countries")
 async def list_countries(
     page: int = Query(1, ge=1, description="Número de página"),
     page_size: int = Query(50, ge=1, le=100, description="Tamaño de página"),
+    company_id: int = Query(..., description="ID de la empresa"),
     search: str = Query(None, description="Término de búsqueda"),
     db: Session = Depends(get_core_db),
+    current_user: dict = Depends(get_current_user),
 ):
-    """Endpoint público para obtener lista de países - no requiere autenticación"""
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_countries.view", "cat_countries.view"], require_all=False)
+    
     skip = (page - 1) * page_size
     query = db.query(Country)
     
@@ -49,6 +53,8 @@ async def get_country(
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource as validate_perm
+    validate_perm(current_user, "cat_countries", "view")
     obj = db.query(Country).filter(Country.m3_key == m3_key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -59,8 +65,10 @@ async def get_country(
 async def create_country(
     data: CountryDTO,
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource as validate_perm
+    validate_perm(current_user, "cat_countries", "create")
     obj = Country(**data.dict())
     db.add(obj)
     db.commit()
@@ -73,8 +81,10 @@ async def update_country(
     m3_key: str,
     data: CountryDTO,
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource as validate_perm
+    validate_perm(current_user, "cat_countries", "edit")
     obj = db.query(Country).filter(Country.m3_key == m3_key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -89,8 +99,10 @@ async def update_country(
 async def delete_country(
     m3_key: str,
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource as validate_perm
+    validate_perm(current_user, "cat_countries", "delete")
     obj = db.query(Country).filter(Country.m3_key == m3_key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/currency_types/routes.py

@@ -1,7 +1,7 @@
 from typing import Any, Dict
 
 from core.database import get_core_db
-from core.security import get_current_user, has_role
+from core.security import get_current_user
 from fastapi import APIRouter, Depends, HTTPException, Query
 from sqlalchemy.orm import Session
 
@@ -15,9 +15,12 @@ router = APIRouter(prefix="/currency-types")
 async def list_currency_types(
     page: int = Query(1, ge=1, description="Número de página"),
     page_size: int = Query(50, ge=1, le=100, description="Tamaño de página"),
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_currency_types.view", "cat_currency.view"], require_all=False)
     skip = (page - 1) * page_size
     query = db.query(CurrencyType)
     items = query.offset(skip).limit(page_size).all()
@@ -36,6 +39,8 @@ async def get_currency_type(
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource as validate_perm
+    validate_perm(current_user, "cat_currency_types", "view")
     obj = db.query(CurrencyType).filter(CurrencyType.code == code).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -46,8 +51,10 @@ async def get_currency_type(
 async def create_currency_type(
     data: CurrencyTypeDTO,
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource as validate_perm
+    validate_perm(current_user, "cat_currency_types", "create")
     obj = CurrencyType(**data.dict())
     db.add(obj)
     db.commit()
@@ -60,8 +67,10 @@ async def update_currency_type(
     code: str,
     data: CurrencyTypeDTO,
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource as validate_perm
+    validate_perm(current_user, "cat_currency_types", "edit")
     obj = db.query(CurrencyType).filter(CurrencyType.code == code).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -76,8 +85,10 @@ async def update_currency_type(
 async def delete_currency_type(
     code: str,
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource as validate_perm
+    validate_perm(current_user, "cat_currency_types", "delete")
     obj = db.query(CurrencyType).filter(CurrencyType.code == code).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/customs_sections/routes.py

@@ -15,9 +15,12 @@ router = APIRouter(prefix="/customs-sections")
 def list_customs_sections(
     page: int = Query(1, ge=1, description="Número de página"),
     page_size: int = Query(50, ge=1, le=100, description="Tamaño de página"),
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_customs_sections.view"])
     skip = (page - 1) * page_size
     query = db.query(CustomsSection)
     items = query.offset(skip).limit(page_size).all()
@@ -33,9 +36,12 @@ def list_customs_sections(
 @router.get("/{customs_code}", response_model=CustomsSectionDTO)
 def get_customs_section(
     customs_code: str,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_customs_sections.view"])
     obj = (
         db.query(CustomsSection)
         .filter(CustomsSection.customs_code == customs_code)
@@ -49,9 +55,12 @@ def get_customs_section(
 @router.post("/", response_model=CustomsSectionDTO, status_code=201)
 def create_customs_section(
     data: CustomsSectionDTO,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_customs_sections.edit"])
     obj = CustomsSection(**data.dict())
     db.add(obj)
     db.commit()
@@ -63,9 +72,12 @@ def create_customs_section(
 def update_customs_section(
     customs_code: str,
     data: CustomsSectionDTO,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_customs_sections.edit"])
     obj = (
         db.query(CustomsSection)
         .filter(CustomsSection.customs_code == customs_code)
@@ -83,9 +95,12 @@ def update_customs_section(
 @router.delete("/{customs_code}", status_code=204)
 def delete_customs_section(
     customs_code: str,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_customs_sections.edit"])
     obj = (
         db.query(CustomsSection)
         .filter(CustomsSection.customs_code == customs_code)

backend/api/v1/modules/public/reference_data/customs_warehouses/routes.py

@@ -15,9 +15,12 @@ router = APIRouter(prefix="/customs-warehouses")
 def list_customs_warehouses(
     page: int = Query(1, ge=1, description="Número de página"),
     page_size: int = Query(50, ge=1, le=100, description="Tamaño de página"),
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_customs_warehouses.view", "cat_warehouses.view"], require_all=False)
     skip = (page - 1) * page_size
     query = db.query(CustomsWarehouse)
     items = query.offset(skip).limit(page_size).all()

backend/api/v1/modules/public/reference_data/identifiers/routes.py

@@ -1,7 +1,7 @@
 from typing import Any, Dict
 
 from core.database import get_core_db
-from core.security import get_current_user, has_role
+from core.security import get_current_user
 from fastapi import APIRouter, Depends, HTTPException, Query
 from sqlalchemy import or_
 from sqlalchemy.orm import Session
@@ -21,6 +21,8 @@ async def list_identifiers(
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource as validate_perm
+    validate_perm(current_user, "cat_identifiers", "view")
     skip = (page - 1) * page_size
     query = db.query(IdentifierCatalog)
     
@@ -53,6 +55,8 @@ async def get_identifier(
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource as validate_perm
+    validate_perm(current_user, "cat_identifiers", "view")
     obj = db.query(IdentifierCatalog).filter(IdentifierCatalog.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -63,8 +67,10 @@ async def get_identifier(
 async def create_identifier(
     data: IdentifierDTO,
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource as validate_perm
+    validate_perm(current_user, "cat_identifiers", "create")
     # Check if already exists
     existing = db.query(IdentifierCatalog).filter(IdentifierCatalog.key == data.key).first()
     if existing:
@@ -82,8 +88,10 @@ async def update_identifier(
     key: str,
     data: IdentifierDTO,
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource as validate_perm
+    validate_perm(current_user, "cat_identifiers", "edit")
     obj = db.query(IdentifierCatalog).filter(IdentifierCatalog.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -98,8 +106,10 @@ async def update_identifier(
 async def delete_identifier(
     key: str,
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource as validate_perm
+    validate_perm(current_user, "cat_identifiers", "delete")
     obj = db.query(IdentifierCatalog).filter(IdentifierCatalog.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/incoterms/routes.py

@@ -15,11 +15,14 @@ router = APIRouter(prefix="/incoterms")
 async def list_incoterms(
     page: int = Query(1, ge=1, description="Número de página"),
     page_size: int = Query(50, ge=1, le=100, description="Tamaño de página"),
+    company_id: int = Query(..., description="ID de la empresa"),
     code: str = Query(None, description="Filtrar por clave"),
     description: str = Query(None, description="Filtrar por descripción"),
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_incoterms.view", "cat_incoterms.view"], require_all=False)
     skip = (page - 1) * page_size
     query = db.query(Incoterm)
     

backend/api/v1/modules/public/reference_data/invoice_types/routes.py

@@ -15,10 +15,14 @@ router = APIRouter(prefix="/invoice-types")
 def list_invoice_types(
     page: int = Query(1, ge=1),
     page_size: int = Query(50, ge=1, le=100),
+    company_id: int = Query(..., description="ID de la empresa"),
     type: Optional[str] = Query(None, description="Filter by type"),
     operation: Optional[str] = Query(None, description="Filter by operation type (imp, exp, both)"),
     db: Session = Depends(get_core_db),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_invoice_types.view", "cat_inv_types.view"], require_all=False)
     query = db.query(InvoiceType)
 
     # Filter by operation if provided

backend/api/v1/modules/public/reference_data/material_types/routes.py

@@ -15,10 +15,13 @@ router = APIRouter(prefix="/material-types")
 async def list_material_types(
     page: int = Query(1, ge=1, description="Número de página"),
     page_size: int = Query(50, ge=1, le=1000, description="Tamaño de página"),
+    company_id: int = Query(..., description="ID de la empresa"),
     type: str = Query(None, description="Filtrar por tipo (ACTIVO FIJO, MATERIALES, PRODUCTOS)"),
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_material_types.view", "cat_material_types.view"], require_all=False)
     skip = (page - 1) * page_size
     query = db.query(MaterialType)
     

backend/api/v1/modules/public/reference_data/payment_methods/routes.py

@@ -15,9 +15,12 @@ router = APIRouter(prefix="/payment-methods")
 def list_payment_methods(
     page: int = Query(1, ge=1, description="Número de página"),
     page_size: int = Query(50, ge=1, le=100, description="Tamaño de página"),
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["pedimentos_payments.view"])
     skip = (page - 1) * page_size
     query = db.query(PaymentMethod)
     items = query.offset(skip).limit(page_size).all()
@@ -33,9 +36,12 @@ def list_payment_methods(
 @router.get("/{key}", response_model=PaymentMethodDTO)
 def get_payment_method(
     key: str,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["pedimentos_payments.view"])
     obj = db.query(PaymentMethod).filter(PaymentMethod.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/pedimento_codes/routes.py

@@ -15,9 +15,12 @@ router = APIRouter(prefix="/pedimento-codes")
 def list_pedimento_codes(
     page: int = Query(1, ge=1, description="Número de página"),
     page_size: int = Query(50, ge=1, le=1000, description="Tamaño de página"),
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_pedimento_codes.view"])
     skip = (page - 1) * page_size
     query = db.query(PedimentoCode)
     items = query.offset(skip).limit(page_size).all()
@@ -33,9 +36,12 @@ def list_pedimento_codes(
 @router.get("/{code}", response_model=PedimentoCodeDTO)
 def get_pedimento_code(
     code: str,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_pedimento_codes .view"])
     obj = db.query(PedimentoCode).filter(PedimentoCode.code == code).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/pedimento_regimens/routes.py

@@ -1,7 +1,7 @@
 from typing import Any, Dict
 
 from core.database import get_core_db
-from core.security import get_current_user, has_role
+from core.security import get_current_user
 from fastapi import APIRouter, Depends, HTTPException, Query
 from sqlalchemy.orm import Session
 
@@ -15,9 +15,12 @@ router = APIRouter(prefix="/pedimento-regimens")
 def list_pedimento_regimens(
     page: int = Query(1, ge=1, description="Número de página"),
     page_size: int = Query(50, ge=1, le=100, description="Tamaño de página"),
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_pedimento_regimens.view"])
     skip = (page - 1) * page_size
     query = db.query(RegimenPedimento)
     items = query.offset(skip).limit(page_size).all()
@@ -33,9 +36,12 @@ def list_pedimento_regimens(
 @router.get("/{key}", response_model=RegimenPedimentoDTO)
 def get_pedimento_regimen(
     key: str,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_pedimento_regimens.view"])
     obj = db.query(RegimenPedimento).filter(RegimenPedimento.code == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -45,9 +51,13 @@ def get_pedimento_regimen(
 @router.post("/", response_model=RegimenPedimentoDTO, status_code=201)
 def create_pedimento_regimen(
     data: RegimenPedimentoDTO,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    # Mutation for reference data usually restricted to admin role or specific perm
+    validate_access_to_resource(db, company_id, current_user, ["ref_pedimento_regimens.edit"])
     obj = RegimenPedimento(**data.model_dump())
     db.add(obj)
     db.commit()
@@ -59,9 +69,12 @@ def create_pedimento_regimen(
 def update_pedimento_regimen(
     key: str,
     data: RegimenPedimentoDTO,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_pedimento_regimens.edit"])
     obj = db.query(RegimenPedimento).filter(RegimenPedimento.code == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -75,9 +88,12 @@ def update_pedimento_regimen(
 @router.delete("/{key}", status_code=204)
 def delete_pedimento_regimen(
     key: str,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_pedimento_regimens.edit"])
     obj = db.query(RegimenPedimento).filter(RegimenPedimento.code == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/pedimento_transport_catalog/routes.py

@@ -13,10 +13,14 @@ router = APIRouter(prefix="/pedimento-transport-catalog")
 
 @router.get("/", response_model=Dict[str, Any])
 async def list_pedimento_transport_catalog(
+    company_id: int = Query(..., description="ID de la empresa"),
     page: int = Query(1, ge=1, description="Numero de pagina"),
     page_size: int = Query(100, ge=1, le=200, description="Tamano de pagina"),
     db: Session = Depends(get_core_db),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["pedimentos_anexo22.view"])
     skip = (page - 1) * page_size
     query = db.query(PedimentoTransportCatalog).order_by(PedimentoTransportCatalog.code.asc())
     items = query.offset(skip).limit(page_size).all()
@@ -30,7 +34,14 @@ async def list_pedimento_transport_catalog(
 
 
 @router.get("/{code}", response_model=PedimentoTransportCatalogDTO)
-async def get_pedimento_transport_catalog(code: str, db: Session = Depends(get_core_db)):
+async def get_pedimento_transport_catalog(
+    code: str, 
+    company_id: int = Query(..., description="ID de la empresa"),
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(get_current_user),
+):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["pedimentos_anexo22.view"])
     obj = (
         db.query(PedimentoTransportCatalog)
         .filter(PedimentoTransportCatalog.code == code)
@@ -44,9 +55,12 @@ async def get_pedimento_transport_catalog(code: str, db: Session = Depends(get_c
 @router.post("/", response_model=PedimentoTransportCatalogDTO, status_code=201)
 async def create_pedimento_transport_catalog(
     data: PedimentoTransportCatalogDTO,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
-    user=Depends(get_current_user),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["pedimentos_anexo22.view"])
     obj = PedimentoTransportCatalog(**data.model_dump())
     db.add(obj)
     db.commit()
@@ -58,9 +72,12 @@ async def create_pedimento_transport_catalog(
 async def update_pedimento_transport_catalog(
     code: str,
     data: PedimentoTransportCatalogDTO,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
-    user=Depends(get_current_user),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["pedimentos_anexo22.view"])
     obj = (
         db.query(PedimentoTransportCatalog)
         .filter(PedimentoTransportCatalog.code == code)
@@ -78,9 +95,12 @@ async def update_pedimento_transport_catalog(
 @router.delete("/{code}", status_code=204)
 async def delete_pedimento_transport_catalog(
     code: str,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
-    user=Depends(get_current_user),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["pedimentos_anexo22.view"])
     obj = (
         db.query(PedimentoTransportCatalog)
         .filter(PedimentoTransportCatalog.code == code)

backend/api/v1/modules/public/reference_data/states/routes.py

@@ -15,9 +15,12 @@ router = APIRouter(prefix="/states")
 async def list_states(
     page: int = Query(1, ge=1, description="Número de página"),
     page_size: int = Query(50, ge=1, le=100, description="Tamaño de página"),
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_states.view"])
     skip = (page - 1) * page_size
     query = db.query(State)
     items = query.offset(skip).limit(page_size).all()

backend/api/v1/modules/public/reference_data/transport_modes/routes.py

@@ -1,7 +1,7 @@
 from typing import Any, Dict
 
 from core.database import get_core_db
-from core.security import get_current_user
+from core.security import get_current_user, validate_access_to_resource
 from fastapi import APIRouter, Depends, HTTPException, Query
 from sqlalchemy.orm import Session
 
@@ -15,8 +15,13 @@ router = APIRouter(prefix="/transport-modes")
 async def list_transport_modes(
     page: int = Query(1, ge=1, description="Número de página"),
     page_size: int = Query(50, ge=1, le=100, description="Tamaño de página"),
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
+    current_user: dict = Depends(get_current_user),
 ):
+    # 🛡️ Permiso de Lectura (Listado)
+    validate_access_to_resource(db, company_id, current_user, required_permissions=["ref_transport_modes.view"])
+    
     skip = (page - 1) * page_size
     query = db.query(TransportMode)
     items = query.offset(skip).limit(page_size).all()
@@ -30,7 +35,15 @@ async def list_transport_modes(
 
 
 @router.get("/{key}", response_model=TransportModeDTO)
-async def get_transport_mode(key: str, db: Session = Depends(get_core_db)):
+async def get_transport_mode(
+    key: str, 
+    company_id: int = Query(..., description="ID de la empresa"),
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(get_current_user),
+):
+    # 🛡️ Permiso de Lectura (Individual)
+    validate_access_to_resource(db, company_id, current_user, required_permissions=["ref_transport_modes.view"])
+    
     obj = db.query(TransportMode).filter(TransportMode.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -40,9 +53,13 @@ async def get_transport_mode(key: str, db: Session = Depends(get_core_db)):
 @router.post("/", response_model=TransportModeDTO, status_code=201)
 async def create_transport_mode(
     data: TransportModeDTO,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
-    user=Depends(get_current_user),
+    current_user: dict = Depends(get_current_user),
 ):
+    # 🛡️ Permiso de Creación
+    validate_access_to_resource(db, company_id, current_user, required_permissions=["ref_transport_modes.create"])
+    
     obj = TransportMode(**data.dict())
     db.add(obj)
     db.commit()
@@ -54,9 +71,13 @@ async def create_transport_mode(
 async def update_transport_mode(
     key: str,
     data: TransportModeDTO,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
-    user=Depends(get_current_user),
+    current_user: dict = Depends(get_current_user),
 ):
+    # 🛡️ Permiso de Edición
+    validate_access_to_resource(db, company_id, current_user, required_permissions=["ref_transport_modes.edit"])
+    
     obj = db.query(TransportMode).filter(TransportMode.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -69,11 +90,17 @@ async def update_transport_mode(
 
 @router.delete("/{key}", status_code=204)
 async def delete_transport_mode(
-    key: str, db: Session = Depends(get_core_db), user=Depends(get_current_user)
+    key: str, 
+    company_id: int = Query(..., description="ID de la empresa"),
+    db: Session = Depends(get_core_db), 
+    current_user: dict = Depends(get_current_user),
 ):
+    # 🛡️ Permiso de Borrado
+    validate_access_to_resource(db, company_id, current_user, required_permissions=["ref_transport_modes.delete"])
+    
     obj = db.query(TransportMode).filter(TransportMode.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
     db.delete(obj)
     db.commit()
-    return None
+    return None

backend/api/v1/modules/public/reference_data/transport_types/routes.py

@@ -15,8 +15,12 @@ router = APIRouter(prefix="/transport-types")
 def list_transport_types(
     page: int = Query(1, ge=1, description="Número de página"),
     page_size: int = Query(50, ge=1, le=100, description="Tamaño de página"),
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_transport_types.view"])
     skip = (page - 1) * page_size
     query = db.query(TransportType)
     items = query.offset(skip).limit(page_size).all()

backend/api/v1/modules/public/reference_data/valuation_methods/routes.py

@@ -15,9 +15,12 @@ router = APIRouter(prefix="/valuation-methods")
 async def list_valuation_methods(
     page: int = Query(1, ge=1, description="Número de página"),
     page_size: int = Query(50, ge=1, le=100, description="Tamaño de página"),
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_valuation_methods.view", "cat_valuation.view"], require_all=False)
     skip = (page - 1) * page_size
     query = db.query(ValuationMethod)
     items = query.offset(skip).limit(page_size).all()