v0.2

internal/tickets/auth.go

@@ -27,6 +27,19 @@ func NewAuthService(cfg *config.Provider) *AuthService {
 	return &AuthService{Config: cfg}
 }
 
+// CanClose returns true if the user can close the given ticket.
+// Ticket owner can close if status is 'open' (not yet claimed). Staff/admin can always close.
+func (a *AuthService) CanClose(memberRoles []string, userID string, ticket *db.Ticket) bool {
+	if ticket == nil {
+		return false
+	}
+	// Owner can close their own unclaimed ticket
+	if userID == ticket.UserID && ticket.Status == "open" {
+		return true
+	}
+	return a.Can(memberRoles, ActionClose, ticket)
+}
+
 // Can returns true if the member (by their role IDs) is authorized to perform action on ticket.
 // ticket may be nil for actions that don't require a specific ticket context (e.g. ActionAdmin, ActionConvocation).
 func (a *AuthService) Can(memberRoles []string, action Action, ticket *db.Ticket) bool {

internal/tickets/auth_test.go

@@ -88,8 +88,40 @@ func TestCanConvocation(t *testing.T) {
 
 func TestCanNilTicket(t *testing.T) {
 	auth := NewAuthService(makeProvider())
-	// Should not panic and should return false for staff actions without ticket
 	if auth.Can([]string{"staff-role"}, ActionClaim, nil) {
 		t.Error("should not claim nil ticket")
 	}
 }
+
+func TestCanCloseOwner(t *testing.T) {
+	auth := NewAuthService(makeProvider())
+	ticket := &db.Ticket{Panel: "support_panel", Type: "support", UserID: "owner-123", Status: "open"}
+
+	// Owner can close if open
+	if !auth.CanClose([]string{}, "owner-123", ticket) {
+		t.Error("owner should close open ticket")
+	}
+
+	// Owner cannot close once claimed
+	ticket.Status = "claimed"
+	if auth.CanClose([]string{}, "owner-123", ticket) {
+		t.Error("owner should not close claimed ticket")
+	}
+
+	// Non-owner without staff role cannot close
+	ticket.Status = "open"
+	if auth.CanClose([]string{}, "other-user", ticket) {
+		t.Error("non-owner without staff should not close")
+	}
+
+	// Staff can still close claimed tickets
+	ticket.Status = "claimed"
+	if !auth.CanClose([]string{"staff-role"}, "other-user", ticket) {
+		t.Error("staff should close claimed ticket")
+	}
+
+	// Admin can always close
+	if !auth.CanClose([]string{"admin-role"}, "other-user", ticket) {
+		t.Error("admin should always close")
+	}
+}