Implement ticket access control and status workflow

src/main/java/org/example/alfs/controllers/TicketController.java

@@ -1,9 +1,11 @@
 package org.example.alfs.controllers;
 
 import jakarta.validation.Valid;
+import org.example.alfs.dto.ticket.TicketAssignDTO;
 import org.example.alfs.dto.ticket.TicketCreateDTO;
+import org.example.alfs.dto.ticket.TicketStatusUpdateDTO;
 import org.example.alfs.dto.ticket.TicketViewDTO;
-import org.example.alfs.entities.Ticket;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.example.alfs.services.TicketService;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.Model;
@@ -16,7 +18,7 @@
 @RequestMapping
 public class TicketController {
 
-    TicketService ticketService;
+    private final TicketService ticketService;
 
 
     public TicketController(TicketService ticketService) {
@@ -25,14 +27,15 @@ public TicketController(TicketService ticketService) {
     }
 
     //create ticket
-
+    @PreAuthorize("hasRole('REPORTER')") // should change later for anonymous access
     @GetMapping("/create")
     public String createNewTicketForm(Model model) {
         model.addAttribute("ticket", new TicketCreateDTO());
         return "create";
     }
 
     //TODO REDIRECT, WHERE??
+    @PreAuthorize("hasRole('REPORTER')") // should change later for anonymous access
     @PostMapping("/create")
     public String createNewTicket(@ModelAttribute("ticket") @Valid TicketCreateDTO ticketCreateDTO,  BindingResult bindingResult) {
         if (bindingResult.hasErrors()) {
@@ -46,7 +49,7 @@ public String createNewTicket(@ModelAttribute("ticket") @Valid TicketCreateDTO t
     }
 
     //view ticket by token
-
+    //TODO, FIX SO ANONYMOUS USERS CAN USE
     @GetMapping("/view/token/{token}")
     public String viewTicketByToken(@PathVariable String token, Model model) {
 
@@ -57,6 +60,7 @@ public String viewTicketByToken(@PathVariable String token, Model model) {
     }
 
     //view ticket by id
+    @PreAuthorize("hasAnyRole('ADMIN','INVESTIGATOR','REPORTER')")
     @GetMapping("/view/id/{id}")
     public String viewTicketById(@PathVariable Long id, Model model) {
 
@@ -66,18 +70,42 @@ public String viewTicketById(@PathVariable Long id, Model model) {
         return "view";
     }
 
+
     //assign ticket
-    // TODO implement DTO + service
+    @PreAuthorize("hasRole('ADMIN')")
     @PostMapping("/{id}/assign")
-    public String assignTicket(@PathVariable Long id) {
-        return "redirect:/tickets/" + id;
+    public String assignTicket(@PathVariable Long id, @Valid @ModelAttribute TicketAssignDTO dto) {
+
+        ticketService.assignInvestigator(id, dto.getInvestigatorId());
+
+        return "redirect:/view/id/" + id;
     }
 
     //update status
-    // TODO implement DTO + service
     @PostMapping("/{id}/status")
-    public String updateStatus(@PathVariable Long id) {
-        return "redirect:/tickets/" + id;
+    @PreAuthorize("hasAnyRole('ADMIN','INVESTIGATOR')")
+    public String updateStatus(@PathVariable Long id, @Valid @ModelAttribute TicketStatusUpdateDTO dto) {
+
+        ticketService.updateTicketStatus(id, dto.getStatus());
+
+        return "redirect:/view/id/" + id;
+    }
+
+
+    @PreAuthorize("hasRole('REPORTER')")
+    @GetMapping("/my")
+    public String myTickets(Model model) {
+
+        model.addAttribute("tickets", ticketService.getMyTickets());
+        return "my-tickets";
+    }
+
+    @PreAuthorize("hasRole('INVESTIGATOR')")
+    @GetMapping("/assigned")
+    public String myAssignedTickets(Model model) {
+
+        model.addAttribute("tickets", ticketService.getMyAssignedTickets());
+        return "assigned-tickets";
     }
 
     //create comment