feat: Added read role for reading specific endpoint

src/backend/api/Fusion.Resources.Api/Authorization/Extensions/RequirementsBuilderExtensions.cs

@@ -36,7 +36,7 @@ public static IAuthorizationRequirementRule FullControlExternal(this IAuthorizat
             return builder;
         }
 
-        public static IAuthorizationRequirementRule GlobalRoleAccess(this IAuthorizationRequirementRule builder, params string[] roles)
+       public static IAuthorizationRequirementRule GlobalRoleAccess(this IAuthorizationRequirementRule builder, params string[] roles)
         {
             return builder.AddRule(new GlobalRoleRequirement(roles));
         }
@@ -152,6 +152,17 @@ public static IAuthorizationRequirementRule FullControl(this IAuthorizationRequi
             return builder;
         }
 
+        public static IAuthorizationRequirementRule ResourcesRead(this IAuthorizationRequirementRule builder)
+        {
+            var policy = new AuthorizationPolicyBuilder()
+                .RequireAssertion(c => c.User.IsInRole("Fusion.Resources.Read"))
+                .Build();
+
+            builder.AddRule((auth, user) => auth.AuthorizeAsync(user, policy));
+
+            return builder;
+        }
+
         public static IAuthorizationRequirementRule CurrentUserIs(this IAuthorizationRequirementRule builder, PersonIdentifier personIdentifier)
         {
             builder.AddRule(new CurrentUserIsRequirement(personIdentifier));

src/backend/api/Fusion.Resources.Api/Controllers/Requests/InternalRequestsController.cs

@@ -501,6 +501,7 @@ public async Task<ActionResult<ApiCollection<ApiResourceAllocationRequest>>> Get
                         );
                         or.HaveOrgUnitScopedRole(DepartmentId.FromFullPath(departmentString), AccessRoles.ResourceOwner);
                     }
+                    or.ResourcesRead();
                 });
             });