V13-FE-006: consolidate approved UI and contract hardening

src/KArtSell.Modules.ModelOperations/Features/ApprovalWorkflow/Endpoints.cs

@@ -22,7 +22,7 @@ public class CreateApprovalEndpoint : EndpointWithoutRequest<CreateApprovalRespo
     public override void Configure()
     {
         Post("/approvals");
-        AllowAnonymous();
+        Roles("Maker");
     }
 
     public override async Task HandleAsync(CancellationToken ct)
@@ -51,7 +51,7 @@ public class GetApprovalsEndpoint : Endpoint<GetApprovalsRequest, GetApprovalsRe
     public override void Configure()
     {
         Get("/approvals");
-        AllowAnonymous();
+        Roles("Maker", "Checker", "SRE");
     }
 
     public override async Task HandleAsync(GetApprovalsRequest req, CancellationToken ct)
@@ -76,7 +76,7 @@ public class ProposeForReviewEndpoint : EndpointWithoutRequest<ProposeForReviewR
     public override void Configure()
     {
         Post("/approvals/{id}/propose");
-        AllowAnonymous();
+        Roles("Maker");
     }
 
     public override async Task HandleAsync(CancellationToken ct)
@@ -111,7 +111,7 @@ public class ActivateApprovalEndpoint : EndpointWithoutRequest<ActivateApprovalR
     public override void Configure()
     {
         Post("/approvals/{id}/activate");
-        AllowAnonymous();
+        Roles("SRE");
     }
 
     public override async Task HandleAsync(CancellationToken ct)
@@ -140,7 +140,7 @@ public class GetApprovalByIdEndpoint : EndpointWithoutRequest<ApprovalDetailResp
     public override void Configure()
     {
         Get("/approvals/{id}");
-        AllowAnonymous();
+        Roles("Maker", "Checker", "SRE");
     }
 
     public override async Task HandleAsync(CancellationToken ct)
@@ -183,7 +183,7 @@ public class ApproveApprovalEndpoint : Endpoint<ApproveApprovalRequest, ApproveA
     public override void Configure()
     {
         Post("/approvals/{id}/approve");
-        AllowAnonymous();
+        Roles("Checker");
     }
 
     public override async Task HandleAsync(ApproveApprovalRequest req, CancellationToken ct)