new features

backend/src/controllers/issue.controller.ts

@@ -67,13 +67,25 @@ class IssueController {
       return;
     }
     try {
+      const userId = req.user!.id;
       const groups: string[] = (req.user as any).groups || [];
       const canManage = permissionService.hasPermission(groups, 'issues:manage');
-      if (!canManage) {
+
+      const existing = await issueService.getIssueById(id);
+      if (!existing) {
+        res.status(404).json({ success: false, message: 'Issue nicht gefunden' });
+        return;
+      }
+
+      const isOwner = existing.erstellt_von === userId;
+      if (!canManage && !isOwner) {
         res.status(403).json({ success: false, message: 'Keine Berechtigung' });
         return;
       }
-      const issue = await issueService.updateIssue(id, req.body);
+
+      // Owners without manage permission can only change status
+      const updateData = canManage ? req.body : { status: req.body.status };
+      const issue = await issueService.updateIssue(id, updateData);
       if (!issue) {
         res.status(404).json({ success: false, message: 'Issue nicht gefunden' });
         return;