diff --git a/apps/tickets/api/ticket.py b/apps/tickets/api/ticket.py index 79d49b37d..07b6ec89e 100644 --- a/apps/tickets/api/ticket.py +++ b/apps/tickets/api/ticket.py @@ -12,7 +12,7 @@ from common.permissions import IsValidUser, IsOrgAdmin from tickets import serializers from tickets.models import Ticket -from tickets.permissions.ticket import IsAssignee, NotClosed +from tickets.permissions.ticket import IsAssignee, IsAssigneeOrApplicant, NotClosed __all__ = ['TicketViewSet'] @@ -68,7 +68,7 @@ class TicketViewSet(CommonApiMixin, viewsets.ModelViewSet): instance.reject(processor=request.user) return Response(serializer.data) - @action(detail=True, methods=[PUT], permission_classes=[IsOrgAdmin, IsAssignee, NotClosed]) + @action(detail=True, methods=[PUT], permission_classes=[IsAssigneeOrApplicant, NotClosed]) def close(self, request, *args, **kwargs): instance = self.get_object() serializer = self.get_serializer(instance) diff --git a/apps/tickets/permissions/ticket.py b/apps/tickets/permissions/ticket.py index c16db9fe6..dbc74e6a9 100644 --- a/apps/tickets/permissions/ticket.py +++ b/apps/tickets/permissions/ticket.py @@ -7,6 +7,12 @@ class IsAssignee(permissions.BasePermission): return obj.has_assignee(request.user) +class IsAssigneeOrApplicant(IsAssignee): + + def has_object_permission(self, request, view, obj): + return super().has_object_permission(request, view, obj) or obj.applicant == request.user + + class NotClosed(permissions.BasePermission): def has_object_permission(self, request, view, obj): return not obj.status_closed