// Core/Phoenix.Core/Controllers/PhoenixController.cs
[Authorize]                         // All endpoints require login by default
[ApiController]
public abstract class PhoenixController : ControllerBase
{
    // Common services: DbContext, ICurrentUser, IPermissionService
    // All inheriting controllers automatically require authentication
}

// Public endpoint example — explicit opt-in
[AllowAnonymous]                     // Explicitly marks endpoint as public
[HttpGet("api/geography/countries")]
public async Task<IActionResult> GetCountries()
{
    // Only for freely available, non-sensitive data
    return Ok(await _countryService.GetAllAsync());
}

// Restrict endpoint to Global Admin role only
[Authorize(Roles = "Global Admin")]
[HttpPost("api/admin/users")]
public async Task<IActionResult> CreateUser(CreateUserDto dto)
{
    // Only Global Admins can create new users
    return Ok(await _userService.CreateAsync(dto));
}

// Multiple roles allowed
[Authorize(Roles = "Global Admin,Reporting Admin")]
[HttpGet("api/reports/dashboard")]
public async Task<IActionResult> GetDashboard()
{
    return Ok(await _reportService.GetDashboardAsync());
}

// Core/Phoenix.Core/Models/Permission.cs
public class Permission : BaseEntity
{
    public int RoleId { get; set; }
    public string Schema { get; set; }    // "*" = all schemas
    public string Table { get; set; }     // "*" = all tables in schema
    public bool Create { get; set; }
    public bool Read { get; set; }
    public bool Update { get; set; }
    public bool Delete { get; set; }
}

// Usage on controller actions
[PermissionAuthorize("Products.Product.C")]  // Require Create on Products.Product
[HttpPost("api/products")]
public async Task<IActionResult> CreateProduct(ProductDto dto)
{
    return Ok(await _productService.CreateAsync(dto));
}

[PermissionAuthorize("Reporting.SalesReport.R")]  // Require Read on Reporting.SalesReport
[HttpGet("api/reports/sales")]
public async Task<IActionResult> GetSalesReport()
{
    return Ok(await _reportService.GetSalesAsync());
}

// Format: "Schema.Table.Operation"
// Operations: C = Create, R = Read, U = Update, D = Delete

// Simplified permission evaluation pseudocode
var permissions = GetPermissionsForRole(user.RoleId);

// Sort by specificity (most specific first)
var sorted = permissions
    .OrderByDescending(p => GetSpecificity(p))
    .ToList();

// Specificity scoring:
//   Schema=*,  Table=*  → 0 (broadest)
//   Schema=X,  Table=*  → 1
//   Schema=X,  Table=Y  → 2 (most specific, wins)

var match = sorted.FirstOrDefault(p =>
    MatchesSchema(p.Schema, requestedSchema) &&
    MatchesTable(p.Table, requestedTable));

if (match == null || !match.HasOperation(requestedOp))
    return Forbid(); // 403