feature/permisos-reference-data

backend/api/v1/modules/public/reference_data/countries/routes.py

@@ -7,18 +7,23 @@ from sqlalchemy.orm import Session
 
 from .dto import CountryDTO
 from .models import Country
+from ..rbac import require_ref_view
 
 router = APIRouter(prefix="/countries")
 
 
-@router.get("/", response_model=Dict[str, Any])
+@router.get(
+    "/",
+    response_model=Dict[str, Any],
+    dependencies=[Depends(require_ref_view("ref_countries.view"))],
+)
 async def list_countries(
     page: int = Query(1, ge=1, description="Número de página"),
     page_size: int = Query(50, ge=1, le=100, description="Tamaño de página"),
     search: str = Query(None, description="Término de búsqueda"),
     db: Session = Depends(get_core_db),
 ):
-    """Endpoint público para obtener lista de países - no requiere autenticación"""
+    """Lista de países protegida por permiso ref_countries.view"""
     skip = (page - 1) * page_size
     query = db.query(Country)
     
@@ -43,7 +48,11 @@ async def list_countries(
     }
 
 
-@router.get("/{m3_key}", response_model=CountryDTO)
+@router.get(
+    "/{m3_key}",
+    response_model=CountryDTO,
+    dependencies=[Depends(require_ref_view("ref_countries.view"))],
+)
 async def get_country(
     m3_key: str,
     db: Session = Depends(get_core_db),