From e8294af60d4bfc7bd19e3a4ba4abaca531949914 Mon Sep 17 00:00:00 2001
From: Kevin Rosales <krosales@aduanasoft.com.mx>
Date: Sat, 1 Nov 2025 11:33:40 -0600
Subject: [PATCH] public endpoints

---
 .../code_pedimento_regimens/routes.py         | 20 ++++++++++++++---
 .../reference_data/containers/routes.py       | 20 ++++++++++++++---
 .../public/reference_data/countries/routes.py | 20 ++++++++++++++---
 .../reference_data/currency_types/routes.py   | 20 ++++++++++++++---
 .../reference_data/customs_sections/routes.py | 20 ++++++++++++++---
 .../customs_warehouses/routes.py              | 22 ++++++++++++++++---
 .../public/reference_data/incoterms/routes.py | 20 ++++++++++++++---
 .../reference_data/invoice_types/routes.py    | 20 ++++++++++++++---
 .../reference_data/material_types/routes.py   | 20 ++++++++++++++---
 .../reference_data/payment_methods/routes.py  | 20 ++++++++++++++---
 .../reference_data/pedimento_codes/routes.py  | 20 ++++++++++++++---
 .../pedimento_regimens/routes.py              | 20 ++++++++++++++---
 .../public/reference_data/sectors/routes.py   | 20 ++++++++++++++---
 .../public/reference_data/states/routes.py    | 20 ++++++++++++++---
 .../reference_data/transport_modes/routes.py  | 20 ++++++++++++++---
 .../reference_data/transport_types/routes.py  | 20 ++++++++++++++---
 .../valuation_methods/routes.py               | 20 ++++++++++++++---
 docker-compose.yml                            |  6 ++---
 frontend/Dockerfile                           |  2 +-
 frontend/vite.config.ts                       |  2 +-
 start.sh                                      |  2 +-
 21 files changed, 297 insertions(+), 57 deletions(-)

diff --git a/backend/api/v1/modules/public/reference_data/code_pedimento_regimens/routes.py b/backend/api/v1/modules/public/reference_data/code_pedimento_regimens/routes.py
index 6db9386a..747045fe 100644
--- a/backend/api/v1/modules/public/reference_data/code_pedimento_regimens/routes.py
+++ b/backend/api/v1/modules/public/reference_data/code_pedimento_regimens/routes.py
@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import CodePedimentoRegimen
 from .dto import CodePedimentoRegimenDTO
 
@@ -19,7 +20,11 @@ def get_code_pedimento_regimen(id: int, db: Session = Depends(get_core_db)):
     return CodePedimentoRegimenDTO.model_validate(obj)
 
 @router.post("/", response_model=CodePedimentoRegimenDTO, status_code=201)
-def create_code_pedimento_regimen(data: CodePedimentoRegimenDTO, db: Session = Depends(get_core_db)):
+def create_code_pedimento_regimen(
+    data: CodePedimentoRegimenDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = CodePedimentoRegimen(**data.model_dump())
     db.add(obj)
     db.commit()
@@ -27,7 +32,12 @@ def create_code_pedimento_regimen(data: CodePedimentoRegimenDTO, db: Session = D
     return CodePedimentoRegimenDTO.model_validate(obj)
 
 @router.put("/{id}", response_model=CodePedimentoRegimenDTO)
-def update_code_pedimento_regimen(id: int, data: CodePedimentoRegimenDTO, db: Session = Depends(get_core_db)):
+def update_code_pedimento_regimen(
+    id: int,
+    data: CodePedimentoRegimenDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(CodePedimentoRegimen).filter(CodePedimentoRegimen.id == id).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -38,7 +48,11 @@ def update_code_pedimento_regimen(id: int, data: CodePedimentoRegimenDTO, db: Se
     return CodePedimentoRegimenDTO.model_validate(obj)
 
 @router.delete("/{id}", status_code=204)
-def delete_code_pedimento_regimen(id: int, db: Session = Depends(get_core_db)):
+def delete_code_pedimento_regimen(
+    id: int,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(CodePedimentoRegimen).filter(CodePedimentoRegimen.id == id).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
diff --git a/backend/api/v1/modules/public/reference_data/containers/routes.py b/backend/api/v1/modules/public/reference_data/containers/routes.py
index bd11c091..13c8a147 100644
--- a/backend/api/v1/modules/public/reference_data/containers/routes.py
+++ b/backend/api/v1/modules/public/reference_data/containers/routes.py
@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import Container
 from .dto import ContainerDTO
 
@@ -18,7 +19,11 @@ def get_container(key: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=ContainerDTO, status_code=201)
-def create_container(data: ContainerDTO, db: Session = Depends(get_core_db)):
+def create_container(
+    data: ContainerDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = Container(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_container(data: ContainerDTO, db: Session = Depends(get_core_db)):
     return obj
 
 @router.put("/{key}", response_model=ContainerDTO)
-def update_container(key: str, data: ContainerDTO, db: Session = Depends(get_core_db)):
+def update_container(
+    key: str,
+    data: ContainerDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(Container).filter(Container.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_container(key: str, data: ContainerDTO, db: Session = Depends(get_cor
     return obj
 
 @router.delete("/{key}", status_code=204)
-def delete_container(key: str, db: Session = Depends(get_core_db)):
+def delete_container(
+    key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(Container).filter(Container.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
diff --git a/backend/api/v1/modules/public/reference_data/countries/routes.py b/backend/api/v1/modules/public/reference_data/countries/routes.py
index 3a55799b..7282e6b7 100644
--- a/backend/api/v1/modules/public/reference_data/countries/routes.py
+++ b/backend/api/v1/modules/public/reference_data/countries/routes.py
@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import Country
 from .dto import CountryDTO
 
@@ -18,7 +19,11 @@ def get_country(m3_key: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=CountryDTO, status_code=201)
-def create_country(data: CountryDTO, db: Session = Depends(get_core_db)):
+def create_country(
+    data: CountryDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = Country(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_country(data: CountryDTO, db: Session = Depends(get_core_db)):
     return obj
 
 @router.put("/{m3_key}", response_model=CountryDTO)
-def update_country(m3_key: str, data: CountryDTO, db: Session = Depends(get_core_db)):
+def update_country(
+    m3_key: str,
+    data: CountryDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(Country).filter(Country.m3_key == m3_key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_country(m3_key: str, data: CountryDTO, db: Session = Depends(get_core
     return obj
 
 @router.delete("/{m3_key}", status_code=204)
-def delete_country(m3_key: str, db: Session = Depends(get_core_db)):
+def delete_country(
+    m3_key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(Country).filter(Country.m3_key == m3_key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
diff --git a/backend/api/v1/modules/public/reference_data/currency_types/routes.py b/backend/api/v1/modules/public/reference_data/currency_types/routes.py
index 75d95f8d..627c2fe9 100644
--- a/backend/api/v1/modules/public/reference_data/currency_types/routes.py
+++ b/backend/api/v1/modules/public/reference_data/currency_types/routes.py
@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import CurrencyType
 from .dto import CurrencyTypeDTO
 
@@ -18,7 +19,11 @@ def get_currency_type(code: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=CurrencyTypeDTO, status_code=201)
-def create_currency_type(data: CurrencyTypeDTO, db: Session = Depends(get_core_db)):
+def create_currency_type(
+    data: CurrencyTypeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = CurrencyType(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_currency_type(data: CurrencyTypeDTO, db: Session = Depends(get_core_d
     return obj
 
 @router.put("/{code}", response_model=CurrencyTypeDTO)
-def update_currency_type(code: str, data: CurrencyTypeDTO, db: Session = Depends(get_core_db)):
+def update_currency_type(
+    code: str,
+    data: CurrencyTypeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(CurrencyType).filter(CurrencyType.code == code).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_currency_type(code: str, data: CurrencyTypeDTO, db: Session = Depends
     return obj
 
 @router.delete("/{code}", status_code=204)
-def delete_currency_type(code: str, db: Session = Depends(get_core_db)):
+def delete_currency_type(
+    code: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(CurrencyType).filter(CurrencyType.code == code).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
diff --git a/backend/api/v1/modules/public/reference_data/customs_sections/routes.py b/backend/api/v1/modules/public/reference_data/customs_sections/routes.py
index 29c3c518..403e8904 100644
--- a/backend/api/v1/modules/public/reference_data/customs_sections/routes.py
+++ b/backend/api/v1/modules/public/reference_data/customs_sections/routes.py
@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import CustomsSection
 from .dto import CustomsSectionDTO
 
@@ -18,7 +19,11 @@ def get_customs_section(customs_code: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=CustomsSectionDTO, status_code=201)
-def create_customs_section(data: CustomsSectionDTO, db: Session = Depends(get_core_db)):
+def create_customs_section(
+    data: CustomsSectionDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = CustomsSection(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_customs_section(data: CustomsSectionDTO, db: Session = Depends(get_co
     return obj
 
 @router.put("/{customs_code}", response_model=CustomsSectionDTO)
-def update_customs_section(customs_code: str, data: CustomsSectionDTO, db: Session = Depends(get_core_db)):
+def update_customs_section(
+    customs_code: str,
+    data: CustomsSectionDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(CustomsSection).filter(CustomsSection.customs_code == customs_code).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_customs_section(customs_code: str, data: CustomsSectionDTO, db: Sessi
     return obj
 
 @router.delete("/{customs_code}", status_code=204)
-def delete_customs_section(customs_code: str, db: Session = Depends(get_core_db)):
+def delete_customs_section(
+    customs_code: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(CustomsSection).filter(CustomsSection.customs_code == customs_code).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
diff --git a/backend/api/v1/modules/public/reference_data/customs_warehouses/routes.py b/backend/api/v1/modules/public/reference_data/customs_warehouses/routes.py
index 05aab750..417faf33 100644
--- a/backend/api/v1/modules/public/reference_data/customs_warehouses/routes.py
+++ b/backend/api/v1/modules/public/reference_data/customs_warehouses/routes.py
@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import CustomsWarehouse
 from .dto import CustomsWarehouseDTO
 
@@ -18,7 +19,11 @@ def get_customs_warehouse(key: str, customs: str, db: Session = Depends(get_core
     return obj
 
 @router.post("/", response_model=CustomsWarehouseDTO, status_code=201)
-def create_customs_warehouse(data: CustomsWarehouseDTO, db: Session = Depends(get_core_db)):
+def create_customs_warehouse(
+    data: CustomsWarehouseDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = CustomsWarehouse(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,13 @@ def create_customs_warehouse(data: CustomsWarehouseDTO, db: Session = Depends(ge
     return obj
 
 @router.put("/{key}/{customs}", response_model=CustomsWarehouseDTO)
-def update_customs_warehouse(key: str, customs: str, data: CustomsWarehouseDTO, db: Session = Depends(get_core_db)):
+def update_customs_warehouse(
+    key: str,
+    customs: str,
+    data: CustomsWarehouseDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(CustomsWarehouse).filter(CustomsWarehouse.key == key, CustomsWarehouse.customs == customs).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +48,12 @@ def update_customs_warehouse(key: str, customs: str, data: CustomsWarehouseDTO,
     return obj
 
 @router.delete("/{key}/{customs}", status_code=204)
-def delete_customs_warehouse(key: str, customs: str, db: Session = Depends(get_core_db)):
+def delete_customs_warehouse(
+    key: str,
+    customs: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(CustomsWarehouse).filter(CustomsWarehouse.key == key, CustomsWarehouse.customs == customs).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
diff --git a/backend/api/v1/modules/public/reference_data/incoterms/routes.py b/backend/api/v1/modules/public/reference_data/incoterms/routes.py
index 985f6575..b873cba8 100644
--- a/backend/api/v1/modules/public/reference_data/incoterms/routes.py
+++ b/backend/api/v1/modules/public/reference_data/incoterms/routes.py
@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import Incoterm
 from .dto import IncotermDTO
 
@@ -19,7 +20,11 @@ def get_incoterm(key: str, db: Session = Depends(get_core_db)):
     return IncotermDTO.model_validate(obj)
 
 @router.post("/", response_model=IncotermDTO, status_code=201)
-def create_incoterm(data: IncotermDTO, db: Session = Depends(get_core_db)):
+def create_incoterm(
+    data: IncotermDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = Incoterm(**data.model_dump())
     db.add(obj)
     db.commit()
@@ -27,7 +32,12 @@ def create_incoterm(data: IncotermDTO, db: Session = Depends(get_core_db)):
     return IncotermDTO.model_validate(obj)
 
 @router.put("/{key}", response_model=IncotermDTO)
-def update_incoterm(key: str, data: IncotermDTO, db: Session = Depends(get_core_db)):
+def update_incoterm(
+    key: str,
+    data: IncotermDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(Incoterm).filter(Incoterm.code == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -38,7 +48,11 @@ def update_incoterm(key: str, data: IncotermDTO, db: Session = Depends(get_core_
     return IncotermDTO.model_validate(obj)
 
 @router.delete("/{key}", status_code=204)
-def delete_incoterm(key: str, db: Session = Depends(get_core_db)):
+def delete_incoterm(
+    key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(Incoterm).filter(Incoterm.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
diff --git a/backend/api/v1/modules/public/reference_data/invoice_types/routes.py b/backend/api/v1/modules/public/reference_data/invoice_types/routes.py
index 2f9496bc..01bdda44 100644
--- a/backend/api/v1/modules/public/reference_data/invoice_types/routes.py
+++ b/backend/api/v1/modules/public/reference_data/invoice_types/routes.py
@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import InvoiceType
 from .dto import InvoiceTypeDTO
 
@@ -19,7 +20,11 @@ def get_invoice_type(key: str, db: Session = Depends(get_core_db)):
     return InvoiceTypeDTO.model_validate(obj)
 
 @router.post("/", response_model=InvoiceTypeDTO, status_code=201)
-def create_invoice_type(data: InvoiceTypeDTO, db: Session = Depends(get_core_db)):
+def create_invoice_type(
+    data: InvoiceTypeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = InvoiceType(**data.model_dump())
     db.add(obj)
     db.commit()
@@ -27,7 +32,12 @@ def create_invoice_type(data: InvoiceTypeDTO, db: Session = Depends(get_core_db)
     return InvoiceTypeDTO.model_validate(obj)
 
 @router.put("/{key}", response_model=InvoiceTypeDTO)
-def update_invoice_type(key: str, data: InvoiceTypeDTO, db: Session = Depends(get_core_db)):
+def update_invoice_type(
+    key: str,
+    data: InvoiceTypeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(InvoiceType).filter(InvoiceType.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -38,7 +48,11 @@ def update_invoice_type(key: str, data: InvoiceTypeDTO, db: Session = Depends(ge
     return InvoiceTypeDTO.model_validate(obj)
 
 @router.delete("/{key}", status_code=204)
-def delete_invoice_type(key: str, db: Session = Depends(get_core_db)):
+def delete_invoice_type(
+    key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(InvoiceType).filter(InvoiceType.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
diff --git a/backend/api/v1/modules/public/reference_data/material_types/routes.py b/backend/api/v1/modules/public/reference_data/material_types/routes.py
index 5f5b3f09..367b2cae 100644
--- a/backend/api/v1/modules/public/reference_data/material_types/routes.py
+++ b/backend/api/v1/modules/public/reference_data/material_types/routes.py
@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import MaterialType
 from .dto import MaterialTypeDTO
 
@@ -18,7 +19,11 @@ def get_material_type(key: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=MaterialTypeDTO, status_code=201)
-def create_material_type(data: MaterialTypeDTO, db: Session = Depends(get_core_db)):
+def create_material_type(
+    data: MaterialTypeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = MaterialType(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_material_type(data: MaterialTypeDTO, db: Session = Depends(get_core_d
     return obj
 
 @router.put("/{key}", response_model=MaterialTypeDTO)
-def update_material_type(key: str, data: MaterialTypeDTO, db: Session = Depends(get_core_db)):
+def update_material_type(
+    key: str,
+    data: MaterialTypeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(MaterialType).filter(MaterialType.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_material_type(key: str, data: MaterialTypeDTO, db: Session = Depends(
     return obj
 
 @router.delete("/{key}", status_code=204)
-def delete_material_type(key: str, db: Session = Depends(get_core_db)):
+def delete_material_type(
+    key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(MaterialType).filter(MaterialType.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
diff --git a/backend/api/v1/modules/public/reference_data/payment_methods/routes.py b/backend/api/v1/modules/public/reference_data/payment_methods/routes.py
index 83b011f7..3e989198 100644
--- a/backend/api/v1/modules/public/reference_data/payment_methods/routes.py
+++ b/backend/api/v1/modules/public/reference_data/payment_methods/routes.py
@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import PaymentMethod
 from .dto import PaymentMethodDTO
 
@@ -18,7 +19,11 @@ def get_payment_method(key: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=PaymentMethodDTO, status_code=201)
-def create_payment_method(data: PaymentMethodDTO, db: Session = Depends(get_core_db)):
+def create_payment_method(
+    data: PaymentMethodDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = PaymentMethod(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_payment_method(data: PaymentMethodDTO, db: Session = Depends(get_core
     return obj
 
 @router.put("/{key}", response_model=PaymentMethodDTO)
-def update_payment_method(key: str, data: PaymentMethodDTO, db: Session = Depends(get_core_db)):
+def update_payment_method(
+    key: str,
+    data: PaymentMethodDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(PaymentMethod).filter(PaymentMethod.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_payment_method(key: str, data: PaymentMethodDTO, db: Session = Depend
     return obj
 
 @router.delete("/{key}", status_code=204)
-def delete_payment_method(key: str, db: Session = Depends(get_core_db)):
+def delete_payment_method(
+    key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(PaymentMethod).filter(PaymentMethod.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
diff --git a/backend/api/v1/modules/public/reference_data/pedimento_codes/routes.py b/backend/api/v1/modules/public/reference_data/pedimento_codes/routes.py
index 27c86ef7..954a566b 100644
--- a/backend/api/v1/modules/public/reference_data/pedimento_codes/routes.py
+++ b/backend/api/v1/modules/public/reference_data/pedimento_codes/routes.py
@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import PedimentoCode
 from .dto import PedimentoCodeDTO
 
@@ -18,7 +19,11 @@ def get_pedimento_code(code: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=PedimentoCodeDTO, status_code=201)
-def create_pedimento_code(data: PedimentoCodeDTO, db: Session = Depends(get_core_db)):
+def create_pedimento_code(
+    data: PedimentoCodeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = PedimentoCode(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_pedimento_code(data: PedimentoCodeDTO, db: Session = Depends(get_core
     return obj
 
 @router.put("/{code}", response_model=PedimentoCodeDTO)
-def update_pedimento_code(code: str, data: PedimentoCodeDTO, db: Session = Depends(get_core_db)):
+def update_pedimento_code(
+    code: str,
+    data: PedimentoCodeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(PedimentoCode).filter(PedimentoCode.code == code).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_pedimento_code(code: str, data: PedimentoCodeDTO, db: Session = Depen
     return obj
 
 @router.delete("/{code}", status_code=204)
-def delete_pedimento_code(code: str, db: Session = Depends(get_core_db)):
+def delete_pedimento_code(
+    code: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(PedimentoCode).filter(PedimentoCode.code == code).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
diff --git a/backend/api/v1/modules/public/reference_data/pedimento_regimens/routes.py b/backend/api/v1/modules/public/reference_data/pedimento_regimens/routes.py
index a9b7760c..cf435fe7 100644
--- a/backend/api/v1/modules/public/reference_data/pedimento_regimens/routes.py
+++ b/backend/api/v1/modules/public/reference_data/pedimento_regimens/routes.py
@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import RegimenPedimento
 from .dto import RegimenPedimentoDTO
 
@@ -19,7 +20,11 @@ def get_pedimento_regimen(key: str, db: Session = Depends(get_core_db)):
     return RegimenPedimentoDTO.model_validate(obj)
 
 @router.post("/", response_model=RegimenPedimentoDTO, status_code=201)
-def create_pedimento_regimen(data: RegimenPedimentoDTO, db: Session = Depends(get_core_db)):
+def create_pedimento_regimen(
+    data: RegimenPedimentoDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = RegimenPedimento(**data.model_dump())
     db.add(obj)
     db.commit()
@@ -27,7 +32,12 @@ def create_pedimento_regimen(data: RegimenPedimentoDTO, db: Session = Depends(ge
     return RegimenPedimentoDTO.model_validate(obj)
 
 @router.put("/{key}", response_model=RegimenPedimentoDTO)
-def update_pedimento_regimen(key: str, data: RegimenPedimentoDTO, db: Session = Depends(get_core_db)):
+def update_pedimento_regimen(
+    key: str,
+    data: RegimenPedimentoDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(RegimenPedimento).filter(RegimenPedimento.code == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -38,7 +48,11 @@ def update_pedimento_regimen(key: str, data: RegimenPedimentoDTO, db: Session =
     return RegimenPedimentoDTO.model_validate(obj)
 
 @router.delete("/{key}", status_code=204)
-def delete_pedimento_regimen(key: str, db: Session = Depends(get_core_db)):
+def delete_pedimento_regimen(
+    key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(RegimenPedimento).filter(RegimenPedimento.code == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
diff --git a/backend/api/v1/modules/public/reference_data/sectors/routes.py b/backend/api/v1/modules/public/reference_data/sectors/routes.py
index d526dfc0..59e21912 100644
--- a/backend/api/v1/modules/public/reference_data/sectors/routes.py
+++ b/backend/api/v1/modules/public/reference_data/sectors/routes.py
@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import Sector
 from .dto import SectorDTO
 
@@ -18,7 +19,11 @@ def get_sector(key: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=SectorDTO, status_code=201)
-def create_sector(data: SectorDTO, db: Session = Depends(get_core_db)):
+def create_sector(
+    data: SectorDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = Sector(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_sector(data: SectorDTO, db: Session = Depends(get_core_db)):
     return obj
 
 @router.put("/{key}", response_model=SectorDTO)
-def update_sector(key: str, data: SectorDTO, db: Session = Depends(get_core_db)):
+def update_sector(
+    key: str,
+    data: SectorDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(Sector).filter(Sector.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_sector(key: str, data: SectorDTO, db: Session = Depends(get_core_db))
     return obj
 
 @router.delete("/{key}", status_code=204)
-def delete_sector(key: str, db: Session = Depends(get_core_db)):
+def delete_sector(
+    key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(Sector).filter(Sector.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
diff --git a/backend/api/v1/modules/public/reference_data/states/routes.py b/backend/api/v1/modules/public/reference_data/states/routes.py
index f5d4e42c..1835c9d9 100644
--- a/backend/api/v1/modules/public/reference_data/states/routes.py
+++ b/backend/api/v1/modules/public/reference_data/states/routes.py
@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import State
 from .dto import StateDTO
 
@@ -18,7 +19,11 @@ def get_state(m3_key: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=StateDTO, status_code=201)
-def create_state(data: StateDTO, db: Session = Depends(get_core_db)):
+def create_state(
+    data: StateDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = State(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_state(data: StateDTO, db: Session = Depends(get_core_db)):
     return obj
 
 @router.put("/{m3_key}", response_model=StateDTO)
-def update_state(m3_key: str, data: StateDTO, db: Session = Depends(get_core_db)):
+def update_state(
+    m3_key: str,
+    data: StateDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(State).filter(State.m3_key == m3_key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_state(m3_key: str, data: StateDTO, db: Session = Depends(get_core_db)
     return obj
 
 @router.delete("/{m3_key}", status_code=204)
-def delete_state(m3_key: str, db: Session = Depends(get_core_db)):
+def delete_state(
+    m3_key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(State).filter(State.m3_key == m3_key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
diff --git a/backend/api/v1/modules/public/reference_data/transport_modes/routes.py b/backend/api/v1/modules/public/reference_data/transport_modes/routes.py
index 3ec1c3a3..224dc779 100644
--- a/backend/api/v1/modules/public/reference_data/transport_modes/routes.py
+++ b/backend/api/v1/modules/public/reference_data/transport_modes/routes.py
@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import TransportMode
 from .dto import TransportModeDTO
 
@@ -18,7 +19,11 @@ def get_transport_mode(key: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=TransportModeDTO, status_code=201)
-def create_transport_mode(data: TransportModeDTO, db: Session = Depends(get_core_db)):
+def create_transport_mode(
+    data: TransportModeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = TransportMode(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_transport_mode(data: TransportModeDTO, db: Session = Depends(get_core
     return obj
 
 @router.put("/{key}", response_model=TransportModeDTO)
-def update_transport_mode(key: str, data: TransportModeDTO, db: Session = Depends(get_core_db)):
+def update_transport_mode(
+    key: str,
+    data: TransportModeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(TransportMode).filter(TransportMode.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_transport_mode(key: str, data: TransportModeDTO, db: Session = Depend
     return obj
 
 @router.delete("/{key}", status_code=204)
-def delete_transport_mode(key: str, db: Session = Depends(get_core_db)):
+def delete_transport_mode(
+    key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(TransportMode).filter(TransportMode.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
diff --git a/backend/api/v1/modules/public/reference_data/transport_types/routes.py b/backend/api/v1/modules/public/reference_data/transport_types/routes.py
index 618f3397..7716fbf8 100644
--- a/backend/api/v1/modules/public/reference_data/transport_types/routes.py
+++ b/backend/api/v1/modules/public/reference_data/transport_types/routes.py
@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import TransportType
 from .dto import TransportTypeDTO
 
@@ -18,7 +19,11 @@ def get_transport_type(transport_code: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=TransportTypeDTO, status_code=201)
-def create_transport_type(data: TransportTypeDTO, db: Session = Depends(get_core_db)):
+def create_transport_type(
+    data: TransportTypeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = TransportType(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_transport_type(data: TransportTypeDTO, db: Session = Depends(get_core
     return obj
 
 @router.put("/{transport_code}", response_model=TransportTypeDTO)
-def update_transport_type(transport_code: str, data: TransportTypeDTO, db: Session = Depends(get_core_db)):
+def update_transport_type(
+    transport_code: str,
+    data: TransportTypeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(TransportType).filter(TransportType.transport_code == transport_code).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_transport_type(transport_code: str, data: TransportTypeDTO, db: Sessi
     return obj
 
 @router.delete("/{transport_code}", status_code=204)
-def delete_transport_type(transport_code: str, db: Session = Depends(get_core_db)):
+def delete_transport_type(
+    transport_code: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(TransportType).filter(TransportType.transport_code == transport_code).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
diff --git a/backend/api/v1/modules/public/reference_data/valuation_methods/routes.py b/backend/api/v1/modules/public/reference_data/valuation_methods/routes.py
index 4dd01f79..0fff8021 100644
--- a/backend/api/v1/modules/public/reference_data/valuation_methods/routes.py
+++ b/backend/api/v1/modules/public/reference_data/valuation_methods/routes.py
@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import ValuationMethod
 from .dto import ValuationMethodDTO
 
@@ -18,7 +19,11 @@ def get_valuation_method(key: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=ValuationMethodDTO, status_code=201)
-def create_valuation_method(data: ValuationMethodDTO, db: Session = Depends(get_core_db)):
+def create_valuation_method(
+    data: ValuationMethodDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = ValuationMethod(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_valuation_method(data: ValuationMethodDTO, db: Session = Depends(get_
     return obj
 
 @router.put("/{key}", response_model=ValuationMethodDTO)
-def update_valuation_method(key: str, data: ValuationMethodDTO, db: Session = Depends(get_core_db)):
+def update_valuation_method(
+    key: str,
+    data: ValuationMethodDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(ValuationMethod).filter(ValuationMethod.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_valuation_method(key: str, data: ValuationMethodDTO, db: Session = De
     return obj
 
 @router.delete("/{key}", status_code=204)
-def delete_valuation_method(key: str, db: Session = Depends(get_core_db)):
+def delete_valuation_method(
+    key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(ValuationMethod).filter(ValuationMethod.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
diff --git a/docker-compose.yml b/docker-compose.yml
index 4a270727..22afde48 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -162,7 +162,7 @@ services:
       - KEYCLOAK_REALM=${KEYCLOAK_REALM:-master}
       - KEYCLOAK_CLIENT_ID=${KEYCLOAK_CLIENT_ID:-anexo76-backend}
       - KEYCLOAK_CLIENT_SECRET=${KEYCLOAK_CLIENT_SECRET:-dev-secret}
-      - CORS_ORIGINS=http://localhost:5173,http://localhost:3000
+      - CORS_ORIGINS=http://localhost:5180,http://localhost:3000
     ports:
       - "8000:8000"
     depends_on:
@@ -215,7 +215,7 @@ services:
       - PUBLIC_KEYCLOAK_CLIENT_ID=${KEYCLOAK_FRONTEND_CLIENT_ID:-anexo76-frontend}
       - VITE_HMR_HOST=localhost
     ports:
-      - "5173:5173"
+      - "5180:5180"
     depends_on:
       backend:
         condition: service_healthy
@@ -229,7 +229,7 @@ services:
     restart: unless-stopped
     command: ["pnpm", "run", "dev", "--", "--host", "0.0.0.0"]
     healthcheck:
-      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:5173/ || exit 1"]
+      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:5180/ || exit 1"]
       interval: 15s
       timeout: 5s
       retries: 5
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index bd5ede6d..478712b4 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -24,7 +24,7 @@ COPY . .
 # RUN pnpm run build
 
 # Exponer puerto
-EXPOSE 5173
+EXPOSE 5180
 
 # Comando por defecto (desarrollo)
 CMD ["pnpm", "run", "dev", "--", "--host", "0.0.0.0"]
diff --git a/frontend/vite.config.ts b/frontend/vite.config.ts
index 25db64e0..f1e73556 100644
--- a/frontend/vite.config.ts
+++ b/frontend/vite.config.ts
@@ -5,7 +5,7 @@ import { sveltekit } from '@sveltejs/kit/vite';
 
 export default defineConfig({
 	server: {
-		port: 5173,       // fija el puerto
+		port: 5180,       // fija el puerto
 		host: true,       // escucha en 0.0.0.0
 	},
 	plugins: [
diff --git a/start.sh b/start.sh
index 018d4373..2dae3050 100755
--- a/start.sh
+++ b/start.sh
@@ -155,7 +155,7 @@ echo -e "${GREEN}   ✓ Instalación Completada${NC}"
 echo "========================================="
 echo ""
 echo "Servicios disponibles:"
-echo -e "  ${GREEN}•${NC} Frontend:  ${BLUE}http://localhost:5173${NC}"
+echo -e "  ${GREEN}•${NC} Frontend:  ${BLUE}http://localhost:5180${NC}"
 echo -e "  ${GREEN}•${NC} Backend:   ${BLUE}http://localhost:8000${NC}"
 echo -e "  ${GREEN}•${NC} API Docs:  ${BLUE}http://localhost:8000/docs${NC}"
 echo -e "  ${GREEN}•${NC} Keycloak:  ${BLUE}http://localhost:8080${NC}"