Cooked

controllers/incident_controller.py

@@ -76,7 +76,18 @@ def process_incident_sync(current_user, incident_id):
             return jsonify({'message': 'Incident not found'}), 404
             
         # Check if user has permission to process this incident
-        if not current_user.is_admin and str(incident.user_id) != str(current_user._id) and str(incident.department_id) != str(current_user.department_id):
+        # An Admin can process any incident in their department.
+        # A regular user can only process their own incidents.
+        is_admin = current_user.permissions == 'Admin'
+        is_owner = str(incident.user_id) == str(current_user._id)
+        in_department = str(incident.department_id) == str(current_user.department_id)
+
+        # Check permissions based on role
+        if not in_department:
+             # Should generally not happen if incidents are fetched correctly, but good failsafe
+             return jsonify({'message': 'Cannot process incidents outside your department'}), 403
+             
+        if not is_admin and not is_owner:
             return jsonify({'message': 'You do not have permission to process this incident'}), 403
             
         # Get the workflow for this incident