Listing owners can self-flag a listing as closed without moderator action

When listing owners cannot close their own listings without contacting support, closed or defunct businesses remain in the directory indefinitely — polluting search results, misleading visitors, and generating dead-end clicks. GDPR Art. 17 (right to erasure) creates an obligation to honor removal requests promptly; routing that through a support ticket introduces unnecessary delay. CWE-285 applies when the authorization model lacks a scope the owner clearly should have: control over their own content.

Add a close action to the owner dashboard that sets status = 'closed' and soft-hides the listing. Never hard-delete: keep the row for audit history and allow the owner to reopen later:

// app/api/listings/[id]/close/route.ts
export async function POST(req: Request) {
  const user = await requireAuth(req)
  const listing = await db.listings.findUniqueOrThrow({ where: { id: params.listingId } })
  if (listing.owner_id !== user.id) {
    return Response.json({ error: 'Unauthorized' }, { status: 403 })
  }
  await db.listings.update({
    where: { id: listing.id },
    data: { status: 'closed', closed_at: new Date() }
  })
  return Response.json({ message: 'Listing closed' })
}

In app/dashboard/listings/[id]/page.tsx, surface a "Close Listing" button that calls this route. Filter status = 'closed' from all public listing queries the same way you filter 'pending' and 'rejected'.