04/06 implement creating ticket on behalf of another user for IT staff

app/routes/api.py

@@ -145,4 +145,46 @@ def on_join_ticket(data):
 def on_leave_ticket(data):
     if current_user.is_authenticated:
         ticket_id = data.get('ticket_id')
-        leave_room(f'ticket_{ticket_id}')
+        leave_room(f'ticket_{ticket_id}')
+
+# ─── User Search API (IT Only) ────────────────────────────────────────────────
+
+@api_bp.route('/users/search')
+@login_required
+def search_users():
+    """Return active employees matching a search query.
+
+    Used by the 'create on behalf' form to populate the employee selector.
+    Restricted to IT staff to prevent employees from enumerating all users.
+
+    Query params
+    ------------
+    q   : str  – search term matched against full_name, email, department
+    limit : int – max results (default 20, max 50)
+    """
+    if not current_user.is_it_staff:
+        return jsonify({'error': 'Forbidden'}), 403
+
+    q     = request.args.get('q', '').strip()
+    limit = min(request.args.get('limit', 20, type=int), 50)
+
+    from app.models import User, UserRole
+    query = User.query.filter(User.is_active == True)
+    if q:
+        query = query.filter(
+            User.full_name.ilike(f'%{q}%') |
+            User.email.ilike(f'%{q}%') |
+            User.department.ilike(f'%{q}%')
+        )
+    users = query.order_by(User.full_name).limit(limit).all()
+
+    return jsonify({'users': [
+        {
+            'id'        : u.id,
+            'full_name' : u.full_name,
+            'email'     : u.email,
+            'department': u.department or '',
+            'role'      : u.role,
+        }
+        for u in users
+    ]})