Feat v0.3.4 team roles signoff (#18)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/handlers/workflow_assignment_handlers.go

@@ -30,12 +30,28 @@ func NewWorkflowAssignmentHandler(engine *workflow.Engine, stores store.Stores)
 func (h *WorkflowAssignmentHandler) Claim(c *gin.Context) {
 	userID := c.GetString("user_id")
 	assignmentID := c.Param("id")
+	ctx := c.Request.Context()
 
-	if err := h.stores.Workflows.ClaimAssignment(c.Request.Context(), assignmentID, userID); err != nil {
+	// Claim first, then verify role. Rollback if role check fails.
+	if err := h.stores.Workflows.ClaimAssignment(ctx, assignmentID, userID); err != nil {
 		c.JSON(http.StatusConflict, gin.H{"error": err.Error()})
 		return
 	}
 
+	// Role check: find the assignment in user's claimed list and verify role
+	claimed, _ := h.stores.Workflows.ListAssignmentsByUser(ctx, userID, models.AssignmentStatusClaimed)
+	for _, a := range claimed {
+		if a.ID == assignmentID {
+			if rerr := workflow.CheckClaimRole(ctx, h.stores, &a, userID); rerr != nil {
+				// Rollback: unclaim
+				h.stores.Workflows.UnclaimAssignment(ctx, assignmentID)
+				c.JSON(http.StatusForbidden, gin.H{"error": rerr.Error()})
+				return
+			}
+			break
+		}
+	}
+
 	c.JSON(http.StatusOK, gin.H{"claimed": true})
 }