public endpoints

backend/api/v1/modules/public/reference_data/code_pedimento_regimens/routes.py

@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import CodePedimentoRegimen
 from .dto import CodePedimentoRegimenDTO
 
@@ -19,7 +20,11 @@ def get_code_pedimento_regimen(id: int, db: Session = Depends(get_core_db)):
     return CodePedimentoRegimenDTO.model_validate(obj)
 
 @router.post("/", response_model=CodePedimentoRegimenDTO, status_code=201)
-def create_code_pedimento_regimen(data: CodePedimentoRegimenDTO, db: Session = Depends(get_core_db)):
+def create_code_pedimento_regimen(
+    data: CodePedimentoRegimenDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = CodePedimentoRegimen(**data.model_dump())
     db.add(obj)
     db.commit()
@@ -27,7 +32,12 @@ def create_code_pedimento_regimen(data: CodePedimentoRegimenDTO, db: Session = D
     return CodePedimentoRegimenDTO.model_validate(obj)
 
 @router.put("/{id}", response_model=CodePedimentoRegimenDTO)
-def update_code_pedimento_regimen(id: int, data: CodePedimentoRegimenDTO, db: Session = Depends(get_core_db)):
+def update_code_pedimento_regimen(
+    id: int,
+    data: CodePedimentoRegimenDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(CodePedimentoRegimen).filter(CodePedimentoRegimen.id == id).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -38,7 +48,11 @@ def update_code_pedimento_regimen(id: int, data: CodePedimentoRegimenDTO, db: Se
     return CodePedimentoRegimenDTO.model_validate(obj)
 
 @router.delete("/{id}", status_code=204)
-def delete_code_pedimento_regimen(id: int, db: Session = Depends(get_core_db)):
+def delete_code_pedimento_regimen(
+    id: int,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(CodePedimentoRegimen).filter(CodePedimentoRegimen.id == id).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/containers/routes.py

@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import Container
 from .dto import ContainerDTO
 
@@ -18,7 +19,11 @@ def get_container(key: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=ContainerDTO, status_code=201)
-def create_container(data: ContainerDTO, db: Session = Depends(get_core_db)):
+def create_container(
+    data: ContainerDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = Container(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_container(data: ContainerDTO, db: Session = Depends(get_core_db)):
     return obj
 
 @router.put("/{key}", response_model=ContainerDTO)
-def update_container(key: str, data: ContainerDTO, db: Session = Depends(get_core_db)):
+def update_container(
+    key: str,
+    data: ContainerDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(Container).filter(Container.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_container(key: str, data: ContainerDTO, db: Session = Depends(get_cor
     return obj
 
 @router.delete("/{key}", status_code=204)
-def delete_container(key: str, db: Session = Depends(get_core_db)):
+def delete_container(
+    key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(Container).filter(Container.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/countries/routes.py

@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import Country
 from .dto import CountryDTO
 
@@ -18,7 +19,11 @@ def get_country(m3_key: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=CountryDTO, status_code=201)
-def create_country(data: CountryDTO, db: Session = Depends(get_core_db)):
+def create_country(
+    data: CountryDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = Country(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_country(data: CountryDTO, db: Session = Depends(get_core_db)):
     return obj
 
 @router.put("/{m3_key}", response_model=CountryDTO)
-def update_country(m3_key: str, data: CountryDTO, db: Session = Depends(get_core_db)):
+def update_country(
+    m3_key: str,
+    data: CountryDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(Country).filter(Country.m3_key == m3_key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_country(m3_key: str, data: CountryDTO, db: Session = Depends(get_core
     return obj
 
 @router.delete("/{m3_key}", status_code=204)
-def delete_country(m3_key: str, db: Session = Depends(get_core_db)):
+def delete_country(
+    m3_key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(Country).filter(Country.m3_key == m3_key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/currency_types/routes.py

@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import CurrencyType
 from .dto import CurrencyTypeDTO
 
@@ -18,7 +19,11 @@ def get_currency_type(code: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=CurrencyTypeDTO, status_code=201)
-def create_currency_type(data: CurrencyTypeDTO, db: Session = Depends(get_core_db)):
+def create_currency_type(
+    data: CurrencyTypeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = CurrencyType(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_currency_type(data: CurrencyTypeDTO, db: Session = Depends(get_core_d
     return obj
 
 @router.put("/{code}", response_model=CurrencyTypeDTO)
-def update_currency_type(code: str, data: CurrencyTypeDTO, db: Session = Depends(get_core_db)):
+def update_currency_type(
+    code: str,
+    data: CurrencyTypeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(CurrencyType).filter(CurrencyType.code == code).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_currency_type(code: str, data: CurrencyTypeDTO, db: Session = Depends
     return obj
 
 @router.delete("/{code}", status_code=204)
-def delete_currency_type(code: str, db: Session = Depends(get_core_db)):
+def delete_currency_type(
+    code: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(CurrencyType).filter(CurrencyType.code == code).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/customs_sections/routes.py

@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import CustomsSection
 from .dto import CustomsSectionDTO
 
@@ -18,7 +19,11 @@ def get_customs_section(customs_code: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=CustomsSectionDTO, status_code=201)
-def create_customs_section(data: CustomsSectionDTO, db: Session = Depends(get_core_db)):
+def create_customs_section(
+    data: CustomsSectionDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = CustomsSection(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_customs_section(data: CustomsSectionDTO, db: Session = Depends(get_co
     return obj
 
 @router.put("/{customs_code}", response_model=CustomsSectionDTO)
-def update_customs_section(customs_code: str, data: CustomsSectionDTO, db: Session = Depends(get_core_db)):
+def update_customs_section(
+    customs_code: str,
+    data: CustomsSectionDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(CustomsSection).filter(CustomsSection.customs_code == customs_code).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_customs_section(customs_code: str, data: CustomsSectionDTO, db: Sessi
     return obj
 
 @router.delete("/{customs_code}", status_code=204)
-def delete_customs_section(customs_code: str, db: Session = Depends(get_core_db)):
+def delete_customs_section(
+    customs_code: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(CustomsSection).filter(CustomsSection.customs_code == customs_code).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/customs_warehouses/routes.py

@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import CustomsWarehouse
 from .dto import CustomsWarehouseDTO
 
@@ -18,7 +19,11 @@ def get_customs_warehouse(key: str, customs: str, db: Session = Depends(get_core
     return obj
 
 @router.post("/", response_model=CustomsWarehouseDTO, status_code=201)
-def create_customs_warehouse(data: CustomsWarehouseDTO, db: Session = Depends(get_core_db)):
+def create_customs_warehouse(
+    data: CustomsWarehouseDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = CustomsWarehouse(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,13 @@ def create_customs_warehouse(data: CustomsWarehouseDTO, db: Session = Depends(ge
     return obj
 
 @router.put("/{key}/{customs}", response_model=CustomsWarehouseDTO)
-def update_customs_warehouse(key: str, customs: str, data: CustomsWarehouseDTO, db: Session = Depends(get_core_db)):
+def update_customs_warehouse(
+    key: str,
+    customs: str,
+    data: CustomsWarehouseDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(CustomsWarehouse).filter(CustomsWarehouse.key == key, CustomsWarehouse.customs == customs).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +48,12 @@ def update_customs_warehouse(key: str, customs: str, data: CustomsWarehouseDTO,
     return obj
 
 @router.delete("/{key}/{customs}", status_code=204)
-def delete_customs_warehouse(key: str, customs: str, db: Session = Depends(get_core_db)):
+def delete_customs_warehouse(
+    key: str,
+    customs: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(CustomsWarehouse).filter(CustomsWarehouse.key == key, CustomsWarehouse.customs == customs).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/incoterms/routes.py

@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import Incoterm
 from .dto import IncotermDTO
 
@@ -19,7 +20,11 @@ def get_incoterm(key: str, db: Session = Depends(get_core_db)):
     return IncotermDTO.model_validate(obj)
 
 @router.post("/", response_model=IncotermDTO, status_code=201)
-def create_incoterm(data: IncotermDTO, db: Session = Depends(get_core_db)):
+def create_incoterm(
+    data: IncotermDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = Incoterm(**data.model_dump())
     db.add(obj)
     db.commit()
@@ -27,7 +32,12 @@ def create_incoterm(data: IncotermDTO, db: Session = Depends(get_core_db)):
     return IncotermDTO.model_validate(obj)
 
 @router.put("/{key}", response_model=IncotermDTO)
-def update_incoterm(key: str, data: IncotermDTO, db: Session = Depends(get_core_db)):
+def update_incoterm(
+    key: str,
+    data: IncotermDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(Incoterm).filter(Incoterm.code == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -38,7 +48,11 @@ def update_incoterm(key: str, data: IncotermDTO, db: Session = Depends(get_core_
     return IncotermDTO.model_validate(obj)
 
 @router.delete("/{key}", status_code=204)
-def delete_incoterm(key: str, db: Session = Depends(get_core_db)):
+def delete_incoterm(
+    key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(Incoterm).filter(Incoterm.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/invoice_types/routes.py

@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import InvoiceType
 from .dto import InvoiceTypeDTO
 
@@ -19,7 +20,11 @@ def get_invoice_type(key: str, db: Session = Depends(get_core_db)):
     return InvoiceTypeDTO.model_validate(obj)
 
 @router.post("/", response_model=InvoiceTypeDTO, status_code=201)
-def create_invoice_type(data: InvoiceTypeDTO, db: Session = Depends(get_core_db)):
+def create_invoice_type(
+    data: InvoiceTypeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = InvoiceType(**data.model_dump())
     db.add(obj)
     db.commit()
@@ -27,7 +32,12 @@ def create_invoice_type(data: InvoiceTypeDTO, db: Session = Depends(get_core_db)
     return InvoiceTypeDTO.model_validate(obj)
 
 @router.put("/{key}", response_model=InvoiceTypeDTO)
-def update_invoice_type(key: str, data: InvoiceTypeDTO, db: Session = Depends(get_core_db)):
+def update_invoice_type(
+    key: str,
+    data: InvoiceTypeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(InvoiceType).filter(InvoiceType.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -38,7 +48,11 @@ def update_invoice_type(key: str, data: InvoiceTypeDTO, db: Session = Depends(ge
     return InvoiceTypeDTO.model_validate(obj)
 
 @router.delete("/{key}", status_code=204)
-def delete_invoice_type(key: str, db: Session = Depends(get_core_db)):
+def delete_invoice_type(
+    key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(InvoiceType).filter(InvoiceType.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/material_types/routes.py

@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import MaterialType
 from .dto import MaterialTypeDTO
 
@@ -18,7 +19,11 @@ def get_material_type(key: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=MaterialTypeDTO, status_code=201)
-def create_material_type(data: MaterialTypeDTO, db: Session = Depends(get_core_db)):
+def create_material_type(
+    data: MaterialTypeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = MaterialType(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_material_type(data: MaterialTypeDTO, db: Session = Depends(get_core_d
     return obj
 
 @router.put("/{key}", response_model=MaterialTypeDTO)
-def update_material_type(key: str, data: MaterialTypeDTO, db: Session = Depends(get_core_db)):
+def update_material_type(
+    key: str,
+    data: MaterialTypeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(MaterialType).filter(MaterialType.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_material_type(key: str, data: MaterialTypeDTO, db: Session = Depends(
     return obj
 
 @router.delete("/{key}", status_code=204)
-def delete_material_type(key: str, db: Session = Depends(get_core_db)):
+def delete_material_type(
+    key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(MaterialType).filter(MaterialType.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/payment_methods/routes.py

@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import PaymentMethod
 from .dto import PaymentMethodDTO
 
@@ -18,7 +19,11 @@ def get_payment_method(key: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=PaymentMethodDTO, status_code=201)
-def create_payment_method(data: PaymentMethodDTO, db: Session = Depends(get_core_db)):
+def create_payment_method(
+    data: PaymentMethodDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = PaymentMethod(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_payment_method(data: PaymentMethodDTO, db: Session = Depends(get_core
     return obj
 
 @router.put("/{key}", response_model=PaymentMethodDTO)
-def update_payment_method(key: str, data: PaymentMethodDTO, db: Session = Depends(get_core_db)):
+def update_payment_method(
+    key: str,
+    data: PaymentMethodDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(PaymentMethod).filter(PaymentMethod.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_payment_method(key: str, data: PaymentMethodDTO, db: Session = Depend
     return obj
 
 @router.delete("/{key}", status_code=204)
-def delete_payment_method(key: str, db: Session = Depends(get_core_db)):
+def delete_payment_method(
+    key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(PaymentMethod).filter(PaymentMethod.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/pedimento_codes/routes.py

@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import PedimentoCode
 from .dto import PedimentoCodeDTO
 
@@ -18,7 +19,11 @@ def get_pedimento_code(code: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=PedimentoCodeDTO, status_code=201)
-def create_pedimento_code(data: PedimentoCodeDTO, db: Session = Depends(get_core_db)):
+def create_pedimento_code(
+    data: PedimentoCodeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = PedimentoCode(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_pedimento_code(data: PedimentoCodeDTO, db: Session = Depends(get_core
     return obj
 
 @router.put("/{code}", response_model=PedimentoCodeDTO)
-def update_pedimento_code(code: str, data: PedimentoCodeDTO, db: Session = Depends(get_core_db)):
+def update_pedimento_code(
+    code: str,
+    data: PedimentoCodeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(PedimentoCode).filter(PedimentoCode.code == code).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_pedimento_code(code: str, data: PedimentoCodeDTO, db: Session = Depen
     return obj
 
 @router.delete("/{code}", status_code=204)
-def delete_pedimento_code(code: str, db: Session = Depends(get_core_db)):
+def delete_pedimento_code(
+    code: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(PedimentoCode).filter(PedimentoCode.code == code).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/pedimento_regimens/routes.py

@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import RegimenPedimento
 from .dto import RegimenPedimentoDTO
 
@@ -19,7 +20,11 @@ def get_pedimento_regimen(key: str, db: Session = Depends(get_core_db)):
     return RegimenPedimentoDTO.model_validate(obj)
 
 @router.post("/", response_model=RegimenPedimentoDTO, status_code=201)
-def create_pedimento_regimen(data: RegimenPedimentoDTO, db: Session = Depends(get_core_db)):
+def create_pedimento_regimen(
+    data: RegimenPedimentoDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = RegimenPedimento(**data.model_dump())
     db.add(obj)
     db.commit()
@@ -27,7 +32,12 @@ def create_pedimento_regimen(data: RegimenPedimentoDTO, db: Session = Depends(ge
     return RegimenPedimentoDTO.model_validate(obj)
 
 @router.put("/{key}", response_model=RegimenPedimentoDTO)
-def update_pedimento_regimen(key: str, data: RegimenPedimentoDTO, db: Session = Depends(get_core_db)):
+def update_pedimento_regimen(
+    key: str,
+    data: RegimenPedimentoDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(RegimenPedimento).filter(RegimenPedimento.code == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -38,7 +48,11 @@ def update_pedimento_regimen(key: str, data: RegimenPedimentoDTO, db: Session =
     return RegimenPedimentoDTO.model_validate(obj)
 
 @router.delete("/{key}", status_code=204)
-def delete_pedimento_regimen(key: str, db: Session = Depends(get_core_db)):
+def delete_pedimento_regimen(
+    key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(RegimenPedimento).filter(RegimenPedimento.code == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/sectors/routes.py

@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import Sector
 from .dto import SectorDTO
 
@@ -18,7 +19,11 @@ def get_sector(key: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=SectorDTO, status_code=201)
-def create_sector(data: SectorDTO, db: Session = Depends(get_core_db)):
+def create_sector(
+    data: SectorDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = Sector(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_sector(data: SectorDTO, db: Session = Depends(get_core_db)):
     return obj
 
 @router.put("/{key}", response_model=SectorDTO)
-def update_sector(key: str, data: SectorDTO, db: Session = Depends(get_core_db)):
+def update_sector(
+    key: str,
+    data: SectorDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(Sector).filter(Sector.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_sector(key: str, data: SectorDTO, db: Session = Depends(get_core_db))
     return obj
 
 @router.delete("/{key}", status_code=204)
-def delete_sector(key: str, db: Session = Depends(get_core_db)):
+def delete_sector(
+    key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(Sector).filter(Sector.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/states/routes.py

@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import State
 from .dto import StateDTO
 
@@ -18,7 +19,11 @@ def get_state(m3_key: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=StateDTO, status_code=201)
-def create_state(data: StateDTO, db: Session = Depends(get_core_db)):
+def create_state(
+    data: StateDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = State(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_state(data: StateDTO, db: Session = Depends(get_core_db)):
     return obj
 
 @router.put("/{m3_key}", response_model=StateDTO)
-def update_state(m3_key: str, data: StateDTO, db: Session = Depends(get_core_db)):
+def update_state(
+    m3_key: str,
+    data: StateDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(State).filter(State.m3_key == m3_key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_state(m3_key: str, data: StateDTO, db: Session = Depends(get_core_db)
     return obj
 
 @router.delete("/{m3_key}", status_code=204)
-def delete_state(m3_key: str, db: Session = Depends(get_core_db)):
+def delete_state(
+    m3_key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(State).filter(State.m3_key == m3_key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/transport_modes/routes.py

@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import TransportMode
 from .dto import TransportModeDTO
 
@@ -18,7 +19,11 @@ def get_transport_mode(key: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=TransportModeDTO, status_code=201)
-def create_transport_mode(data: TransportModeDTO, db: Session = Depends(get_core_db)):
+def create_transport_mode(
+    data: TransportModeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = TransportMode(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_transport_mode(data: TransportModeDTO, db: Session = Depends(get_core
     return obj
 
 @router.put("/{key}", response_model=TransportModeDTO)
-def update_transport_mode(key: str, data: TransportModeDTO, db: Session = Depends(get_core_db)):
+def update_transport_mode(
+    key: str,
+    data: TransportModeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(TransportMode).filter(TransportMode.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_transport_mode(key: str, data: TransportModeDTO, db: Session = Depend
     return obj
 
 @router.delete("/{key}", status_code=204)
-def delete_transport_mode(key: str, db: Session = Depends(get_core_db)):
+def delete_transport_mode(
+    key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(TransportMode).filter(TransportMode.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/transport_types/routes.py

@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import TransportType
 from .dto import TransportTypeDTO
 
@@ -18,7 +19,11 @@ def get_transport_type(transport_code: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=TransportTypeDTO, status_code=201)
-def create_transport_type(data: TransportTypeDTO, db: Session = Depends(get_core_db)):
+def create_transport_type(
+    data: TransportTypeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = TransportType(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_transport_type(data: TransportTypeDTO, db: Session = Depends(get_core
     return obj
 
 @router.put("/{transport_code}", response_model=TransportTypeDTO)
-def update_transport_type(transport_code: str, data: TransportTypeDTO, db: Session = Depends(get_core_db)):
+def update_transport_type(
+    transport_code: str,
+    data: TransportTypeDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(TransportType).filter(TransportType.transport_code == transport_code).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_transport_type(transport_code: str, data: TransportTypeDTO, db: Sessi
     return obj
 
 @router.delete("/{transport_code}", status_code=204)
-def delete_transport_type(transport_code: str, db: Session = Depends(get_core_db)):
+def delete_transport_type(
+    transport_code: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(TransportType).filter(TransportType.transport_code == transport_code).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")

backend/api/v1/modules/public/reference_data/valuation_methods/routes.py

@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from core.database import get_core_db
+from core.security import has_role
 from .models import ValuationMethod
 from .dto import ValuationMethodDTO
 
@@ -18,7 +19,11 @@ def get_valuation_method(key: str, db: Session = Depends(get_core_db)):
     return obj
 
 @router.post("/", response_model=ValuationMethodDTO, status_code=201)
-def create_valuation_method(data: ValuationMethodDTO, db: Session = Depends(get_core_db)):
+def create_valuation_method(
+    data: ValuationMethodDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = ValuationMethod(**data.dict())
     db.add(obj)
     db.commit()
@@ -26,7 +31,12 @@ def create_valuation_method(data: ValuationMethodDTO, db: Session = Depends(get_
     return obj
 
 @router.put("/{key}", response_model=ValuationMethodDTO)
-def update_valuation_method(key: str, data: ValuationMethodDTO, db: Session = Depends(get_core_db)):
+def update_valuation_method(
+    key: str,
+    data: ValuationMethodDTO,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(ValuationMethod).filter(ValuationMethod.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")
@@ -37,7 +47,11 @@ def update_valuation_method(key: str, data: ValuationMethodDTO, db: Session = De
     return obj
 
 @router.delete("/{key}", status_code=204)
-def delete_valuation_method(key: str, db: Session = Depends(get_core_db)):
+def delete_valuation_method(
+    key: str,
+    db: Session = Depends(get_core_db),
+    current_user: dict = Depends(has_role("admin"))
+):
     obj = db.query(ValuationMethod).filter(ValuationMethod.key == key).first()
     if not obj:
         raise HTTPException(status_code=404, detail="Not found")