fix(facilities): secure facility get endpoints

Update allowed roles for findAll endpoint to include FACILITY_ADMIN and FACILITY_STAFF. Add request validation to findOne to restrict non-super admins to their own facility, and add required ForbiddenException import.

src/facilities/facilities.controller.ts

@@ -2,6 +2,7 @@ import {
   Body,
   Controller,
   Delete,
+  ForbiddenException,
   Get,
   Param,
   Patch,
@@ -46,7 +47,7 @@ export class FacilitiesController {
   }
 
   /** GET /facilities */
-  @Roles("SUPER_ADMIN")
+  @Roles("SUPER_ADMIN", "FACILITY_ADMIN", "FACILITY_STAFF")
   @Get()
   findAll() {
     return this.facilitiesService.findAll();
@@ -55,7 +56,15 @@ export class FacilitiesController {
   /** GET /facilities/:id */
   @Roles("SUPER_ADMIN", "FACILITY_ADMIN", "FACILITY_STAFF")
   @Get(":id")
-  findOne(@Param("id") id: string) {
+  findOne(@Param("id") id: string, @Req() req: any) {
+    const requesterRole = req.user?.role;
+    const requesterFacilityId = req.user?.healthcareWorker?.facilityId;
+    
+    // Only SUPER_ADMIN can access any facility, others can only access their own
+    if (requesterRole !== "SUPER_ADMIN" && requesterFacilityId !== id) {
+      throw new ForbiddenException("You are not authorized to access this facility");
+    }
+    
     return this.facilitiesService.findOne(id);
   }