HaiLin/ai-ticket-platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: enforce api permissions

Browse Source
This commit is contained in:
hailin
2026-07-01 14:09:26 +08:00
parent 83e9960d18
commit 953f126277
9 changed files with 115 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
backend/apps/tickets/api.py
View File

@@ -6,6 +6,7 @@ from django.http import HttpResponse
from django.utils import timezone
from ninja import Router
from apps.accounts.api import require_permission
from apps.audit.models import OperationAuditLog
from apps.tickets.models import Ticket, TicketAttachment, TicketComment, TicketEvent
from apps.tickets.schemas import (
@@ -31,6 +32,7 @@ def next_ticket_no() -> str:
@router.post("", response=TicketOut)
def create_ticket(request, payload: TicketIn):
require_permission(request, "ticket.create")
assignee = None
if payload.assignee_id:
assignee = get_user_model().objects.filter(id=payload.assignee_id).first()
@@ -55,6 +57,7 @@ def create_ticket(request, payload: TicketIn):
@router.get("", response=list[TicketOut])
def list_tickets(request, status: str | None = None, q: str | None = None):
require_permission(request, "ticket.view")
queryset = Ticket.objects.all()
if status:
queryset = queryset.filter(status=status)
@@ -65,6 +68,7 @@ def list_tickets(request, status: str | None = None, q: str | None = None):
@router.get("/export")
def export_tickets(request):
require_permission(request, "ticket.export")
response = HttpResponse(content_type="text/csv")
response["Content-Disposition"] = 'attachment; filename="tickets.csv"'
writer = csv.writer(response)
@@ -92,11 +96,13 @@ def export_tickets(request):
@router.get("/{ticket_id}", response=TicketOut)
def get_ticket(request, ticket_id: int):
require_permission(request, "ticket.view")
return Ticket.objects.get(id=ticket_id)
@router.patch("/{ticket_id}", response=TicketOut)
def update_ticket(request, ticket_id: int, payload: TicketUpdateIn):
require_permission(request, "ticket.edit")
ticket = Ticket.objects.get(id=ticket_id)
before = {
"title": ticket.title,
@@ -124,6 +130,7 @@ def update_ticket(request, ticket_id: int, payload: TicketUpdateIn):
@router.post("/{ticket_id}/status", response=TicketOut)
def update_ticket_status(request, ticket_id: int, payload: TicketStatusIn):
require_permission(request, "ticket.edit")
ticket = Ticket.objects.get(id=ticket_id)
return transition_ticket(
ticket,
@@ -135,6 +142,7 @@ def update_ticket_status(request, ticket_id: int, payload: TicketStatusIn):
@router.post("/{ticket_id}/comments", response=TicketCommentOut)
def add_ticket_comment(request, ticket_id: int, payload: TicketCommentIn):
require_permission(request, "ticket.edit")
ticket = Ticket.objects.get(id=ticket_id)
comment = TicketComment.objects.create(
ticket=ticket,
@@ -154,6 +162,7 @@ def add_ticket_comment(request, ticket_id: int, payload: TicketCommentIn):
@router.post("/{ticket_id}/attachments", response=TicketAttachmentOut)
def add_ticket_attachment(request, ticket_id: int, payload: TicketAttachmentIn):
require_permission(request, "ticket.edit")
ticket = Ticket.objects.get(id=ticket_id)
attachment = TicketAttachment.objects.create(ticket=ticket, **payload.dict())
TicketEvent.objects.create(