v0.2

internal/tickets/auth.go

@@ -27,6 +27,19 @@ func NewAuthService(cfg *config.Provider) *AuthService {
 	return &AuthService{Config: cfg}
 }
 
+// CanClose returns true if the user can close the given ticket.
+// Ticket owner can close if status is 'open' (not yet claimed). Staff/admin can always close.
+func (a *AuthService) CanClose(memberRoles []string, userID string, ticket *db.Ticket) bool {
+	if ticket == nil {
+		return false
+	}
+	// Owner can close their own unclaimed ticket
+	if userID == ticket.UserID && ticket.Status == "open" {
+		return true
+	}
+	return a.Can(memberRoles, ActionClose, ticket)
+}
+
 // Can returns true if the member (by their role IDs) is authorized to perform action on ticket.
 // ticket may be nil for actions that don't require a specific ticket context (e.g. ActionAdmin, ActionConvocation).
 func (a *AuthService) Can(memberRoles []string, action Action, ticket *db.Ticket) bool {