# Issue #211: Authorization Middleware Maintenance Burden

## Problem

The `AuthorizationMiddleware` requires manual maintenance for each new controller and method:

1. When adding a new admin-only controller, it must be added to the `beforeController` chain:
   ```php
   if ($controller instanceof ImportController
       || $controller instanceof PermissionController
       || $controller instanceof AuditController
       || $controller instanceof DsgvoController
       || $controller instanceof BackupController
       // NEW: Must add here
   ) { ... }
   ```

2. When adding an admin-only method, it must be added to a constant:
   ```php
   private const ADMIN_METHODS_MEMBER = ['revealAllergies', 'archive'];
   // NEW: Must add here
   ```

3. When adding a read-only method, it must be added to:
   ```php
   private const READ_METHODS = [
       'index', 'show', 'search', 'preview', ...
       // NEW: Must add here
   ];
   ```

## Impact

- Easy to forget to add a new controller/method to the right list
- Growing maintenance burden as the app expands
- Potential security issues if a write method is accidentally omitted
- Violates Open/Closed Principle

## Solution

Use PHP 8 attributes to declare permissions directly on controller methods:

```php
#[Attribute]
class RequirePermission {
    public function __construct(string $level) { ... }
}

class MemberController {
    #[RequirePermission('read')]
    public function index(): JSONResponse { ... }
    
    #[RequirePermission('write')]
    public function create(): JSONResponse { ... }
    
    #[RequirePermission('admin')]
    public function revealAllergies(): JSONResponse { ... }
}
```

Middleware then reads attributes via reflection.

## Tasks

- [ ] Create `RequirePermission` attribute class
- [ ] Add `#[RequirePermission]` attributes to all controller methods
- [ ] Refactor `AuthorizationMiddleware::beforeController()` to use reflection
- [ ] Remove hardcoded controller and method lists
- [ ] Add tests to verify permission enforcement
- [ ] Document the new attribute-based approach

## Labels

- refactoring
- backend
- security
- priority:medium
- architecture