fix queue

tests/test_permission_architecture.py

@@ -135,6 +135,59 @@ def test_ticket_visibility_obeys_self_unit_and_global_scopes(organization):
     assert set(staff_ticket_rows(ceo)) == {public_sales, selected_sales, kimia_owned, warehouse_ticket, finance_ticket}
 
 
+def test_each_public_queue_and_staff_message_endpoint_is_strictly_unit_scoped(client, organization):
+    sales, finance = organization["sales"], organization["finance"]
+    sales_staff = User.objects.get(username="kimiya_ghaffari")
+    other_sales_staff = User.objects.get(username="zahra_jamali")
+    finance_staff = User.objects.get(username="fereshteh_yavari")
+    buyer = customer("isolated-queue-buyer", "09120007111")
+    sales_ticket = create_ticket(
+        customer=buyer,
+        unit=sales,
+        category=TicketCategory.objects.get(slug="sales-general"),
+        subject="صف عمومی فقط فروش",
+        body="پیام فروش",
+    )
+    finance_ticket = create_ticket(
+        customer=buyer,
+        unit=finance,
+        category=TicketCategory.objects.get(slug="finance-general"),
+        subject="صف عمومی فقط مالی",
+        body="پیام مالی",
+    )
+
+    assert set(staff_ticket_rows(sales_staff)) == {sales_ticket}
+    assert finance_ticket not in staff_ticket_rows(sales_staff)
+    assert set(staff_ticket_rows(finance_staff)) == {finance_ticket}
+    assert sales_ticket not in staff_ticket_rows(finance_staff)
+
+    client.force_login(sales_staff)
+    assert client.get(reverse("staff_tickets:detail", args=[finance_ticket.public_id])).status_code == 403
+    assert client.get(reverse("staff_tickets:messages", args=[finance_ticket.public_id])).status_code == 403
+    assert client.get(reverse("staff_tickets:poll", args=[finance_ticket.public_id])).status_code == 403
+
+    routed_ticket = create_ticket(
+        customer=buyer,
+        unit=sales,
+        category=TicketCategory.objects.get(slug="sales-general"),
+        subject="صف منتقل‌شده از فروش به مالی",
+        body="پیام منتقل‌شده",
+    )
+    routed_ticket.assigned_unit = finance
+    routed_ticket.save(update_fields=["assigned_unit", "updated_at"])
+    assert routed_ticket not in staff_ticket_rows(sales_staff)
+    assert not TicketPolicy.can_view(sales_staff, routed_ticket)
+    assert routed_ticket in staff_ticket_rows(finance_staff)
+    assert TicketPolicy.can_view(finance_staff, routed_ticket)
+
+    # Once a SELF-scope queue item is claimed, it is no longer visible to a
+    # different expert merely because both experts belong to the same unit.
+    sales_ticket.owner = other_sales_staff
+    sales_ticket.save(update_fields=["owner", "updated_at"])
+    assert sales_ticket not in staff_ticket_rows(sales_staff)
+    assert not TicketPolicy.can_view(sales_staff, sales_ticket)
+
+
 def test_staff_ticket_form_locks_primary_unit_and_rejects_tampered_unit_category_and_group(client, organization):
     kimia = User.objects.get(username="kimiya_ghaffari")
     sales, finance = organization["sales"], organization["finance"]