feat: enforce api permissions

backend/apps/solutions/api.py

@@ -1,5 +1,6 @@
 from ninja import Router
 
+from apps.accounts.api import require_permission
 from apps.solutions.models import Solution, TicketSolutionLink
 from apps.solutions.schemas import (
     SolutionIn,
@@ -14,6 +15,7 @@ router = Router(tags=["solutions"])
 
 @router.post("", response=SolutionOut)
 def create_solution(request, payload: SolutionIn):
+    require_permission(request, "solution.manage")
     return Solution.objects.create(
         title=payload.title,
         problem_signature=payload.problem_signature,
@@ -29,6 +31,7 @@ def create_solution(request, payload: SolutionIn):
 
 @router.get("", response=list[SolutionOut])
 def list_solutions(request, status: str | None = None):
+    require_permission(request, "solution.view")
     queryset = Solution.objects.all()
     if status:
         queryset = queryset.filter(status=status)
@@ -37,11 +40,13 @@ def list_solutions(request, status: str | None = None):
 
 @router.get("/{solution_id}", response=SolutionOut)
 def get_solution(request, solution_id: int):
+    require_permission(request, "solution.view")
     return Solution.objects.get(id=solution_id)
 
 
 @router.post("/{solution_id}/link-ticket", response=TicketSolutionLinkOut)
 def link_solution_to_ticket(request, solution_id: int, payload: TicketSolutionLinkIn):
+    require_permission(request, "solution.manage")
     solution = Solution.objects.get(id=solution_id)
     ticket = Ticket.objects.get(id=payload.ticket_id)
     link, _ = TicketSolutionLink.objects.get_or_create(

backend/apps/solutions/tests/test_solution_api.py

@@ -1,8 +1,8 @@
 from apps.tickets.models import Ticket
 
 
-def test_create_and_list_solution(client, db):
-    response = client.post(
+def test_create_and_list_solution(admin_client, db):
+    response = admin_client.post(
         "/api/solutions",
         data={
             "title": "Restart callback worker",
@@ -17,20 +17,20 @@ def test_create_and_list_solution(client, db):
     assert response.status_code == 200
     solution_id = response.json()["id"]
 
-    response = client.get("/api/solutions")
+    response = admin_client.get("/api/solutions")
     assert response.status_code == 200
     assert response.json()[0]["id"] == solution_id
 
 
-def test_link_solution_to_ticket_increments_usage(client, db):
+def test_link_solution_to_ticket_increments_usage(admin_client, db):
     ticket = Ticket.objects.create(ticket_no="TK202606300020", title="A", description="A")
-    solution = client.post(
+    solution = admin_client.post(
         "/api/solutions",
         data={"title": "S", "problem_signature": "P", "root_cause": "R", "solution": "Do S"},
         content_type="application/json",
     ).json()
 
-    response = client.post(
+    response = admin_client.post(
         f"/api/solutions/{solution['id']}/link-ticket",
         data={"ticket_id": ticket.id, "link_type": "adopted"},
         content_type="application/json",