diff --git a/smoothschedule/tickets/views.py b/smoothschedule/tickets/views.py index 04686cf..87dca6e 100644 --- a/smoothschedule/tickets/views.py +++ b/smoothschedule/tickets/views.py @@ -81,22 +81,40 @@ class TicketViewSet(viewsets.ModelViewSet): def get_queryset(self): """ Filter tickets based on user role and ticket type. - - Platform Admins see all tickets (platform, customer, staff_request) - - Tenant Owners/Managers/Staff see customer/staff_request tickets for their tenant - and platform tickets they created - - Customers see customer tickets they created + - Platform Admins see ONLY PLATFORM tickets (support requests from business users) + - Tenant Owners/Managers/Staff see CUSTOMER, STAFF_REQUEST, INTERNAL tickets for their tenant + plus PLATFORM tickets they created (to track their own support requests) + - Customers see only CUSTOMER tickets they created """ user = self.request.user queryset = super().get_queryset() if is_platform_admin(user): - queryset = queryset # Platform admins see everything + # Platform admins ONLY see PLATFORM tickets (requests from business users) + # These are tickets where business users are asking the platform for help + queryset = queryset.filter( + ticket_type=Ticket.TicketType.PLATFORM, + tenant__isnull=False # Must have a tenant (from a business user) + ) elif hasattr(user, 'tenant') and user.tenant: - # Tenant-level users - q_filter = Q(tenant=user.tenant) | Q(creator=user, ticket_type=Ticket.TicketType.PLATFORM) - queryset = queryset.filter(q_filter).distinct() + # Tenant-level users see: + # 1. CUSTOMER, STAFF_REQUEST, INTERNAL tickets for their tenant + # 2. PLATFORM tickets they personally created (to track their support requests) + tenant_tickets = Q( + tenant=user.tenant, + ticket_type__in=[ + Ticket.TicketType.CUSTOMER, + Ticket.TicketType.STAFF_REQUEST, + Ticket.TicketType.INTERNAL, + ] + ) + own_platform_tickets = Q( + creator=user, + ticket_type=Ticket.TicketType.PLATFORM + ) + queryset = queryset.filter(tenant_tickets | own_platform_tickets).distinct() else: - # Regular users (e.g., customers without an associated tenant, if that's a case) + # Regular users (e.g., customers without an associated tenant) # They should only see tickets they created queryset = queryset.filter(creator=user)