fix(src/tickets): prevent moving tickets to completed status without admin rights

Non-admin users cannot move tickets to completed statuses to avoid accidental closure.

src/tickets/views.py

@@ -8,6 +8,7 @@ from src.tickets.models import (
     TicketComment,
     TicketHistory,
     TicketPriority,
+    TicketStatus,
 )
 from src.tickets.serializers import (
     TicketCommentSerializer,
@@ -107,6 +108,14 @@ def move_ticket_view(request, pk):
     ticket = generics.get_object_or_404(Ticket, pk=pk)
     new_status_id = request.data.get("status_id")
     if new_status_id:
+        new_status = generics.get_object_or_404(TicketStatus, pk=new_status_id)
+
+        if not request.user.is_admin and new_status.is_completed:
+            return Response(
+                {"error": "Members cannot move tickets to completed statuses."},
+                status=403,
+            )
+
         old_status_id = ticket.status_id
         ticket.status_id = new_status_id
         ticket.save()