feat: enforce api permissions

backend/apps/audit/api.py

@@ -3,6 +3,7 @@ from typing import Any
 
 from ninja import Router, Schema
 
+from apps.accounts.api import require_permission
 from apps.audit.models import OperationAuditLog
 
 router = Router(tags=["audit"])
@@ -23,4 +24,5 @@ class OperationAuditLogOut(Schema):
 
 @router.get("/operation-logs", response=list[OperationAuditLogOut])
 def list_operation_logs(request):
+    require_permission(request, "system.audit.view")
     return OperationAuditLog.objects.all()[:100]

backend/apps/audit/tests/test_audit_api.py

@@ -1,7 +1,7 @@
 from apps.audit.models import OperationAuditLog
 
 
-def test_list_operation_logs_returns_recent_logs(client, db):
+def test_list_operation_logs_returns_recent_logs(admin_client, db):
     OperationAuditLog.objects.create(
         module="system",
         action="health_check",
@@ -11,7 +11,7 @@ def test_list_operation_logs_returns_recent_logs(client, db):
         request_snapshot={"path": "/api/system/health"},
     )
 
-    response = client.get("/api/audit/operation-logs")
+    response = admin_client.get("/api/audit/operation-logs")
 
     assert response.status_code == 200
     payload = response.json()