feat: enforce api permissions

backend/apps/solutions/api.py

@@ -1,5 +1,6 @@
 from ninja import Router
 
+from apps.accounts.api import require_permission
 from apps.solutions.models import Solution, TicketSolutionLink
 from apps.solutions.schemas import (
     SolutionIn,
@@ -14,6 +15,7 @@ router = Router(tags=["solutions"])
 
 @router.post("", response=SolutionOut)
 def create_solution(request, payload: SolutionIn):
+    require_permission(request, "solution.manage")
     return Solution.objects.create(
         title=payload.title,
         problem_signature=payload.problem_signature,
@@ -29,6 +31,7 @@ def create_solution(request, payload: SolutionIn):
 
 @router.get("", response=list[SolutionOut])
 def list_solutions(request, status: str | None = None):
+    require_permission(request, "solution.view")
     queryset = Solution.objects.all()
     if status:
         queryset = queryset.filter(status=status)
@@ -37,11 +40,13 @@ def list_solutions(request, status: str | None = None):
 
 @router.get("/{solution_id}", response=SolutionOut)
 def get_solution(request, solution_id: int):
+    require_permission(request, "solution.view")
     return Solution.objects.get(id=solution_id)
 
 
 @router.post("/{solution_id}/link-ticket", response=TicketSolutionLinkOut)
 def link_solution_to_ticket(request, solution_id: int, payload: TicketSolutionLinkIn):
+    require_permission(request, "solution.manage")
     solution = Solution.objects.get(id=solution_id)
     ticket = Ticket.objects.get(id=payload.ticket_id)
     link, _ = TicketSolutionLink.objects.get_or_create(