You can search for an iterator with given key from multi_index first.
iterator found: already created item, require_auth(user)
iterator not found: not created item, require_auth(admin)
Permission check can be done in any step of your method. (Even you call require_auth() at the last time of your method, its failure reverts all changes made during that ...
Cool idea. I guess the bidding & auction system is possible, but with some limitations.
Data Storage & Computation
This are just normal transactions storing information who has bid when. You can use the multi_index to store that.
It may not be 100% fair because of the synchronization of bidding timings, regarding when a transaction/bid ...