Hardened API and catered for Partner role query filter bypass

PostFundManagement.Api/Program.cs

@@ -29,6 +29,7 @@ builder.Services.AddApiVersioning(options =>
 });
 
 builder.Services.AddScoped<ActiveUserFilter>();
+builder.Services.AddScoped<UserRoleFilter>();
 builder.Services.AddTransient<ITenantContextService, TenantContextService>();
 
 builder.Services.AddEndpoints(Assembly.GetExecutingAssembly());
@@ -156,6 +157,15 @@ var versionGroups = new Dictionary<int, RouteGroupBuilder>
 
                 var filter = context.HttpContext.RequestServices.GetRequiredService<ActiveUserFilter>();
 
+                return await filter.InvokeAsync(context, next);
+            })
+            .AddEndpointFilter(async (context, next) =>
+            {
+                if (HttpMethods.IsOptions(context.HttpContext.Request.Method))
+                    return await next(context);
+
+                var filter = context.HttpContext.RequestServices.GetRequiredService<UserRoleFilter>();
+
                 return await filter.InvokeAsync(context, next);
             })
     }