perf: 修改关闭工单API权限, 申请人有权限关闭工单

apps/tickets/api/ticket.py

@@ -12,7 +12,7 @@ from common.permissions import IsValidUser, IsOrgAdmin
 
 from tickets import serializers
 from tickets.models import Ticket
-from tickets.permissions.ticket import IsAssignee, NotClosed
+from tickets.permissions.ticket import IsAssignee, IsAssigneeOrApplicant, NotClosed
 
 
 __all__ = ['TicketViewSet']
@@ -68,7 +68,7 @@ class TicketViewSet(CommonApiMixin, viewsets.ModelViewSet):
         instance.reject(processor=request.user)
         return Response(serializer.data)
 
-    @action(detail=True, methods=[PUT], permission_classes=[IsOrgAdmin, IsAssignee, NotClosed])
+    @action(detail=True, methods=[PUT], permission_classes=[IsAssigneeOrApplicant, NotClosed])
     def close(self, request, *args, **kwargs):
         instance = self.get_object()
         serializer = self.get_serializer(instance)

apps/tickets/permissions/ticket.py

@@ -7,6 +7,12 @@ class IsAssignee(permissions.BasePermission):
         return obj.has_assignee(request.user)
 
 
+class IsAssigneeOrApplicant(IsAssignee):
+
+    def has_object_permission(self, request, view, obj):
+        return super().has_object_permission(request, view, obj) or obj.applicant == request.user
+
+
 class NotClosed(permissions.BasePermission):
     def has_object_permission(self, request, view, obj):
         return not obj.status_closed