feat: enforce role section permissions and add a leads permission

Unticking a section hides it from the menu, closes its routes and blocks its writes on the server; existing roles keep their current access via migration.

apps/api/src/contacts/companies.controller.ts

@@ -18,6 +18,7 @@ import { FileInterceptor } from '@nestjs/platform-express';
 import { memoryStorage } from 'multer';
 import type { Response } from 'express';
 import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { RequirePermission, SectionPermissionGuard } from '../auth/section-permission.guard';
 import { CurrentUser } from '../auth/current-user.decorator';
 import type { Actor } from '../common/record-scope';
 import { CompaniesService } from './companies.service';
@@ -31,7 +32,8 @@ const excelUpload = FileInterceptor('file', {
 });
 
 @Controller('companies')
-@UseGuards(JwtAuthGuard)
+@UseGuards(JwtAuthGuard, SectionPermissionGuard)
+@RequirePermission('customers')
 export class CompaniesController {
   constructor(
     private readonly companiesService: CompaniesService,

apps/api/src/contacts/people.controller.ts

@@ -18,6 +18,7 @@ import { FileInterceptor } from '@nestjs/platform-express';
 import { memoryStorage } from 'multer';
 import type { Response } from 'express';
 import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { RequirePermission, SectionPermissionGuard } from '../auth/section-permission.guard';
 import { CurrentUser } from '../auth/current-user.decorator';
 import type { Actor } from '../common/record-scope';
 import { OrgModuleGuard } from '../billing/org-module.guard';
@@ -33,8 +34,9 @@ const excelUpload = FileInterceptor('file', {
 });
 
 @Controller('people')
-@UseGuards(JwtAuthGuard, OrgModuleGuard)
+@UseGuards(JwtAuthGuard, OrgModuleGuard, SectionPermissionGuard)
 @RequireOrgModule('customers')
+@RequirePermission('customers')
 export class PeopleController {
   constructor(
     private readonly peopleService: PeopleService,