fix: solución de bloqueos y estandarización de permisos

backend/api/v1/modules/public/reference_data/countries/routes.py

@@ -1,7 +1,7 @@
 from typing import Any, Dict
 
 from core.database import get_core_db
-from core.security import get_current_user, has_role
+from core.security import get_current_user
 from fastapi import APIRouter, Depends, HTTPException, Query
 from sqlalchemy.orm import Session
 
@@ -15,10 +15,14 @@ router = APIRouter(prefix="/countries")
 async def list_countries(
     page: int = Query(1, ge=1, description="Número de página"),
     page_size: int = Query(50, ge=1, le=100, description="Tamaño de página"),
+    company_id: int = Query(..., description="ID de la empresa"),
     search: str = Query(None, description="Término de búsqueda"),
     db: Session = Depends(get_core_db),
+    current_user: dict = Depends(get_current_user),
 ):
-    """Endpoint público para obtener lista de países - no requiere autenticación"""
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_countries.view", "cat_countries.view"], require_all=False)
+    
     skip = (page - 1) * page_size
     query = db.query(Country)
     
@@ -49,6 +53,8 @@ async def get_country(
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource as validate_perm
+    validate_perm(current_user, "cat_countries", "view")
     obj = db.query(Country).filter(Country.m3_key == m3_key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -59,8 +65,10 @@ async def get_country(
 async def create_country(
     data: CountryDTO,
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource as validate_perm
+    validate_perm(current_user, "cat_countries", "create")
     obj = Country(**data.dict())
     db.add(obj)
     db.commit()
@@ -73,8 +81,10 @@ async def update_country(
     m3_key: str,
     data: CountryDTO,
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource as validate_perm
+    validate_perm(current_user, "cat_countries", "edit")
     obj = db.query(Country).filter(Country.m3_key == m3_key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -89,8 +99,10 @@ async def update_country(
 async def delete_country(
     m3_key: str,
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource as validate_perm
+    validate_perm(current_user, "cat_countries", "delete")
     obj = db.query(Country).filter(Country.m3_key == m3_key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")