Joel Wedemire
5a83263f7a
my-tickets and prefs.save carried only `app.access:ticketing`, which means "you hold ANY ticketing.* permission" — so ticketing.settings alone opened the submitter's own surface. They now require ticketing.view or ticketing.manage, matching the either-or this route file already uses everywhere else; ticketing.view is literally described as "Submit tickets and view own ticket history", so it is the right key. attachments.show stays UNGATED on purpose. TicketAttachmentController::show already authorises submitter-or-agent for that specific attachment, which is finer than any permission can be — a key in front of it would either duplicate the check or contradict it, and contradiction is what this consolidation exists to remove. Part of consolidating Central onto one authorisation mechanism: permissions, held by groups. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RDA3fQbsa3gaHCFoV1Q8Gg