v0.2

internal/tickets/auth_test.go

@@ -88,8 +88,40 @@ func TestCanConvocation(t *testing.T) {
 
 func TestCanNilTicket(t *testing.T) {
 	auth := NewAuthService(makeProvider())
-	// Should not panic and should return false for staff actions without ticket
 	if auth.Can([]string{"staff-role"}, ActionClaim, nil) {
 		t.Error("should not claim nil ticket")
 	}
 }
+
+func TestCanCloseOwner(t *testing.T) {
+	auth := NewAuthService(makeProvider())
+	ticket := &db.Ticket{Panel: "support_panel", Type: "support", UserID: "owner-123", Status: "open"}
+
+	// Owner can close if open
+	if !auth.CanClose([]string{}, "owner-123", ticket) {
+		t.Error("owner should close open ticket")
+	}
+
+	// Owner cannot close once claimed
+	ticket.Status = "claimed"
+	if auth.CanClose([]string{}, "owner-123", ticket) {
+		t.Error("owner should not close claimed ticket")
+	}
+
+	// Non-owner without staff role cannot close
+	ticket.Status = "open"
+	if auth.CanClose([]string{}, "other-user", ticket) {
+		t.Error("non-owner without staff should not close")
+	}
+
+	// Staff can still close claimed tickets
+	ticket.Status = "claimed"
+	if !auth.CanClose([]string{"staff-role"}, "other-user", ticket) {
+		t.Error("staff should close claimed ticket")
+	}
+
+	// Admin can always close
+	if !auth.CanClose([]string{"admin-role"}, "other-user", ticket) {
+		t.Error("admin should always close")
+	}
+}