feature/permisos-reference-data

backend/api/v1/modules/public/reference_data/rbac.py

@@ -0,0 +1,25 @@
+from typing import Callable
+
+from core.database import get_core_db
+from core.security import get_current_user, validate_access_to_resource
+from fastapi import Depends, Query
+from sqlalchemy.orm import Session
+
+
+def require_ref_view(permission_code: str) -> Callable:
+    """
+    Dependency factory to enforce reference-data view permissions per company.
+
+    Endpoints using this dependency must receive `company_id` in query params.
+    """
+
+    async def _dep(
+        company_id: int = Query(..., description="Company ID"),
+        db: Session = Depends(get_core_db),
+        current_user: dict = Depends(get_current_user),
+    ) -> bool:
+        validate_access_to_resource(db, company_id, current_user, [permission_code])
+        return True
+
+    return _dep
+