case 4712 - service schedule needs work order, quote or PM rights

Step 5 of 4712 (security review F16, staff side; contacts are already refused by
step 1). schedule/svc and schedule/user had no role check, so any login got the
whole service schedule (work order numbers, customer names, technicians). They
now need read rights on work orders, quotes or PMs, the test the client uses to
show the Schedule menu, so no role that sees the schedule loses it; only
Inventory and OpsAdmin roles (no menu) are refused.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/AyaNova/Controllers/ScheduleController.cs

@@ -60,6 +60,8 @@ namespace AyaNova.Api.Controllers
         {
             if (!serverState.IsOpen)
                 return StatusCode(503, new ApiErrorResponse(serverState.ApiErrorCode, null, serverState.Reason));
+            if (!CanSeeServiceSchedule())
+                return StatusCode(403, new ApiNotAuthorizedResponse());
             if (!ModelState.IsValid)
                 return BadRequest(new ApiErrorResponse(ModelState));
 
@@ -152,6 +154,8 @@ namespace AyaNova.Api.Controllers
         {
             if (!serverState.IsOpen)
                 return StatusCode(503, new ApiErrorResponse(serverState.ApiErrorCode, null, serverState.Reason));
+            if (!CanSeeServiceSchedule())
+                return StatusCode(403, new ApiNotAuthorizedResponse());
             if (!ModelState.IsValid)
                 return BadRequest(new ApiErrorResponse(ModelState));
 
@@ -460,6 +464,15 @@ namespace AyaNova.Api.Controllers
             return v.Serial.ToString() + " " + v.CustomerName;
         }
 
+        //case 4712: the service schedule (and its per user drill down) needs the same rights the client
+        //uses to show the Schedule menu: open work orders, quotes or PMs
+        private bool CanSeeServiceSchedule()
+        {
+            return Authorized.HasReadFullRole(HttpContext.Items, AyaType.WorkOrder)
+                || Authorized.HasReadFullRole(HttpContext.Items, AyaType.Quote)
+                || Authorized.HasReadFullRole(HttpContext.Items, AyaType.PM);
+        }
+
 
         public enum ScheduleWorkOrderColorSource : int
         {