Solution Review: Enforcing Role-Based Authorization

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

namespace DemoApp.Controllers;

[Authorize(Roles = "admin")]
[Route("api/[controller]")]
[ApiController]
public class ManagementController : ControllerBase
{
    [HttpGet()]
    public IActionResult GetManagementConsole()
    {
        return Ok("Management console opened.");
    }

    [AllowAnonymous]
    [HttpGet("health")]
    public IActionResult GetApplicationHealth()
    {
        return Ok("Application is running.");
    }

    [HttpPost()]
    public IActionResult UpdateSettings()
    {
        return Ok("Settings updated.");
    }

    [HttpGet("users/{userId}")]
    public IActionResult GetUserDetails(int userId)
    {
        return Ok($"Details retrieved for user {userId}.");
    }

    [Authorize("superadmin")]
    [HttpDelete("users/{userId}")]
    public IActionResult DeleteUser(int userId)
    {
        return Ok($"User {userId} deleted.");
    }
}