feat: require explicit dashboard read permission

src/govoplan_dashboard/backend/router.py

@@ -4,9 +4,10 @@ from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session
 
-from govoplan_core.auth import ApiPrincipal, get_api_principal
+from govoplan_core.auth import ApiPrincipal, get_api_principal, has_scope
 from govoplan_core.db.session import get_session
 from govoplan_dashboard.backend.db.models import DashboardLayout
+from govoplan_dashboard.backend.permissions import READ_SCOPE
 from govoplan_dashboard.backend.schemas import (
     DashboardLayoutResponse,
     DashboardLayoutUpdateRequest,
@@ -24,6 +25,14 @@ from govoplan_dashboard.backend.service import (
 router = APIRouter(prefix="/dashboard", tags=["dashboard"])
 
 
+def _require_read(principal: ApiPrincipal) -> None:
+    if not has_scope(principal, READ_SCOPE):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=f"Missing required scope: {READ_SCOPE}",
+        )
+
+
 def _response(
     layout: DashboardLayout | None,
     *,
@@ -51,6 +60,7 @@ def api_get_dashboard_layout(
     session: Session = Depends(get_session),
     principal: ApiPrincipal = Depends(get_api_principal),
 ) -> DashboardLayoutResponse:
+    _require_read(principal)
     return _response(
         get_dashboard_layout(
             session,
@@ -69,6 +79,7 @@ def api_save_dashboard_layout(
     session: Session = Depends(get_session),
     principal: ApiPrincipal = Depends(get_api_principal),
 ) -> DashboardLayoutResponse:
+    _require_read(principal)
     try:
         layout = save_dashboard_layout(
             session,
@@ -111,6 +122,7 @@ def api_delete_dashboard_layout(
     session: Session = Depends(get_session),
     principal: ApiPrincipal = Depends(get_api_principal),
 ) -> None:
+    _require_read(principal)
     delete_dashboard_layout(
         session,
         tenant_id=principal.tenant_id,