From b76fcb13904d54a2aa9ff52a6d19d5aaded4ef41 Mon Sep 17 00:00:00 2001 From: Alonso Date: Wed, 18 Mar 2026 13:53:33 -0600 Subject: [PATCH] Permisos tickets --- backend/app/api/v1/endpoints/tickets.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/backend/app/api/v1/endpoints/tickets.py b/backend/app/api/v1/endpoints/tickets.py index 4de935e..6acee79 100644 --- a/backend/app/api/v1/endpoints/tickets.py +++ b/backend/app/api/v1/endpoints/tickets.py @@ -285,6 +285,8 @@ async def create_comment(ticket_id: str, comment: CommentCreate, db: AsyncSessio @router.delete("/{ticket_id}", status_code=status.HTTP_204_NO_CONTENT) async def delete_ticket(ticket_id: str, db: AsyncSession = Depends(get_db), current_user: User = Depends(get_current_user)): """Eliminar un ticket (solo admin/manager)""" + if current_user.role not in (UserRole.ADMIN, UserRole.SUPPORT_MANAGER): + raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="No tienes permisos para eliminar tickets") ticket_uuid = validate_uuid_param(ticket_id, "ticket ID") query = select(Ticket).where(Ticket.id == ticket_uuid, Ticket.tenant_id == current_user.tenant_id) result = await db.execute(query)