fix: solución de bloqueos y estandarización de permisos

backend/api/v1/modules/public/reference_data/customs_sections/routes.py

@@ -15,9 +15,12 @@ router = APIRouter(prefix="/customs-sections")
 def list_customs_sections(
     page: int = Query(1, ge=1, description="Número de página"),
     page_size: int = Query(50, ge=1, le=100, description="Tamaño de página"),
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_customs_sections.view"])
     skip = (page - 1) * page_size
     query = db.query(CustomsSection)
     items = query.offset(skip).limit(page_size).all()
@@ -33,9 +36,12 @@ def list_customs_sections(
 @router.get("/{customs_code}", response_model=CustomsSectionDTO)
 def get_customs_section(
     customs_code: str,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
     current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_customs_sections.view"])
     obj = (
         db.query(CustomsSection)
         .filter(CustomsSection.customs_code == customs_code)
@@ -49,9 +55,12 @@ def get_customs_section(
 @router.post("/", response_model=CustomsSectionDTO, status_code=201)
 def create_customs_section(
     data: CustomsSectionDTO,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_customs_sections.edit"])
     obj = CustomsSection(**data.dict())
     db.add(obj)
     db.commit()
@@ -63,9 +72,12 @@ def create_customs_section(
 def update_customs_section(
     customs_code: str,
     data: CustomsSectionDTO,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_customs_sections.edit"])
     obj = (
         db.query(CustomsSection)
         .filter(CustomsSection.customs_code == customs_code)
@@ -83,9 +95,12 @@ def update_customs_section(
 @router.delete("/{customs_code}", status_code=204)
 def delete_customs_section(
     customs_code: str,
+    company_id: int = Query(..., description="ID de la empresa"),
     db: Session = Depends(get_core_db),
-    current_user: dict = Depends(has_role("admin")),
+    current_user: dict = Depends(get_current_user),
 ):
+    from core.security import validate_access_to_resource
+    validate_access_to_resource(db, company_id, current_user, ["ref_customs_sections.edit"])
     obj = (
         db.query(CustomsSection)
         .filter(CustomsSection.customs_code == customs_code)