feat: enforce api permissions

backend/apps/tickets/api.py

@@ -6,6 +6,7 @@ from django.http import HttpResponse
 from django.utils import timezone
 from ninja import Router
 
+from apps.accounts.api import require_permission
 from apps.audit.models import OperationAuditLog
 from apps.tickets.models import Ticket, TicketAttachment, TicketComment, TicketEvent
 from apps.tickets.schemas import (
@@ -31,6 +32,7 @@ def next_ticket_no() -> str:
 
 @router.post("", response=TicketOut)
 def create_ticket(request, payload: TicketIn):
+    require_permission(request, "ticket.create")
     assignee = None
     if payload.assignee_id:
         assignee = get_user_model().objects.filter(id=payload.assignee_id).first()
@@ -55,6 +57,7 @@ def create_ticket(request, payload: TicketIn):
 
 @router.get("", response=list[TicketOut])
 def list_tickets(request, status: str | None = None, q: str | None = None):
+    require_permission(request, "ticket.view")
     queryset = Ticket.objects.all()
     if status:
         queryset = queryset.filter(status=status)
@@ -65,6 +68,7 @@ def list_tickets(request, status: str | None = None, q: str | None = None):
 
 @router.get("/export")
 def export_tickets(request):
+    require_permission(request, "ticket.export")
     response = HttpResponse(content_type="text/csv")
     response["Content-Disposition"] = 'attachment; filename="tickets.csv"'
     writer = csv.writer(response)
@@ -92,11 +96,13 @@ def export_tickets(request):
 
 @router.get("/{ticket_id}", response=TicketOut)
 def get_ticket(request, ticket_id: int):
+    require_permission(request, "ticket.view")
     return Ticket.objects.get(id=ticket_id)
 
 
 @router.patch("/{ticket_id}", response=TicketOut)
 def update_ticket(request, ticket_id: int, payload: TicketUpdateIn):
+    require_permission(request, "ticket.edit")
     ticket = Ticket.objects.get(id=ticket_id)
     before = {
         "title": ticket.title,
@@ -124,6 +130,7 @@ def update_ticket(request, ticket_id: int, payload: TicketUpdateIn):
 
 @router.post("/{ticket_id}/status", response=TicketOut)
 def update_ticket_status(request, ticket_id: int, payload: TicketStatusIn):
+    require_permission(request, "ticket.edit")
     ticket = Ticket.objects.get(id=ticket_id)
     return transition_ticket(
         ticket,
@@ -135,6 +142,7 @@ def update_ticket_status(request, ticket_id: int, payload: TicketStatusIn):
 
 @router.post("/{ticket_id}/comments", response=TicketCommentOut)
 def add_ticket_comment(request, ticket_id: int, payload: TicketCommentIn):
+    require_permission(request, "ticket.edit")
     ticket = Ticket.objects.get(id=ticket_id)
     comment = TicketComment.objects.create(
         ticket=ticket,
@@ -154,6 +162,7 @@ def add_ticket_comment(request, ticket_id: int, payload: TicketCommentIn):
 
 @router.post("/{ticket_id}/attachments", response=TicketAttachmentOut)
 def add_ticket_attachment(request, ticket_id: int, payload: TicketAttachmentIn):
+    require_permission(request, "ticket.edit")
     ticket = Ticket.objects.get(id=ticket_id)
     attachment = TicketAttachment.objects.create(ticket=ticket, **payload.dict())
     TicketEvent.objects.create(

backend/apps/tickets/tests/test_ticket_api.py

@@ -1,8 +1,8 @@
 from apps.tickets.models import Ticket, TicketEvent
 
 
-def test_create_ticket_returns_ticket_detail(client, db):
-    response = client.post(
+def test_create_ticket_returns_ticket_detail(admin_client, db):
+    response = admin_client.post(
         "/api/tickets",
         data={
             "title": "Payment callback fails",
@@ -23,11 +23,11 @@ def test_create_ticket_returns_ticket_detail(client, db):
     assert TicketEvent.objects.filter(ticket_id=payload["id"], event_type="created").exists()
 
 
-def test_list_tickets_filters_by_status(client, db):
+def test_list_tickets_filters_by_status(admin_client, db):
     Ticket.objects.create(ticket_no="TK202606300001", title="A", description="A", status="pending")
     Ticket.objects.create(ticket_no="TK202606300002", title="B", description="B", status="resolved")
 
-    response = client.get("/api/tickets?status=pending")
+    response = admin_client.get("/api/tickets?status=pending")
 
     assert response.status_code == 200
     payload = response.json()
@@ -35,7 +35,7 @@ def test_list_tickets_filters_by_status(client, db):
     assert payload[0]["ticket_no"] == "TK202606300001"
 
 
-def test_transition_ticket_status_creates_event(client, db):
+def test_transition_ticket_status_creates_event(admin_client, db):
     ticket = Ticket.objects.create(
         ticket_no="TK202606300003",
         title="A",
@@ -43,7 +43,7 @@ def test_transition_ticket_status_creates_event(client, db):
         status="pending",
     )
 
-    response = client.post(
+    response = admin_client.post(
         f"/api/tickets/{ticket.id}/status",
         data={"status": "in_progress", "remark": "Start handling"},
         content_type="application/json",

backend/apps/tickets/tests/test_ticket_export.py

@@ -2,10 +2,10 @@ from apps.audit.models import OperationAuditLog
 from apps.tickets.models import Ticket
 
 
-def test_add_comment_to_ticket(client, db):
+def test_add_comment_to_ticket(admin_client, db):
     ticket = Ticket.objects.create(ticket_no="TK202606300010", title="A", description="A")
 
-    response = client.post(
+    response = admin_client.post(
         f"/api/tickets/{ticket.id}/comments",
         data={
             "content": "Checked logs",
@@ -20,10 +20,10 @@ def test_add_comment_to_ticket(client, db):
     assert ticket.comments.count() == 1
 
 
-def test_add_attachment_to_ticket(client, db):
+def test_add_attachment_to_ticket(admin_client, db):
     ticket = Ticket.objects.create(ticket_no="TK202606300011", title="A", description="A")
 
-    response = client.post(
+    response = admin_client.post(
         f"/api/tickets/{ticket.id}/attachments",
         data={
             "file_name": "error.log",
@@ -38,10 +38,10 @@ def test_add_attachment_to_ticket(client, db):
     assert response.json()["file_name"] == "error.log"
 
 
-def test_export_tickets_returns_csv_and_audit_log(client, db):
+def test_export_tickets_returns_csv_and_audit_log(admin_client, db):
     Ticket.objects.create(ticket_no="TK202606300012", title="Export me", description="A")
 
-    response = client.get("/api/tickets/export")
+    response = admin_client.get("/api/tickets/export")
 
     assert response.status_code == 200
     assert response["content-type"].startswith("text/csv")