LotusGuild/tinker_tickets
4
0
Fork 0
Code Issues 46 Pull Requests Actions Packages Projects Releases Wiki Activity

Redact ticket title for non-public tickets in assignment notifications (#72)

Browse Source 
sendAssignmentNotification() had the same missing-visibility gap as
#46 in a separate function: assigning a user to a confidential/internal
ticket broadcast the ticket title to the shared Matrix notify list
unconditionally when MATRIX_NOTIFY_ASSIGNMENTS is enabled.

Threaded visibility through using the same redactedTitle() helper
added for #46, wired up from the already-fetched ticket row in
assign_ticket.php. The assignee is still DMed directly regardless,
since being assigned gives them standing access to the ticket — but
because notify_users is one shared payload, they see the same redacted
title as everyone else on it rather than a personalized one. Verified
end-to-end with a local HTTP server capturing the webhook payload for
both public and confidential tickets.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015nCxwFFsy8ouMWzn56rPVP
This commit is contained in:
jared
2026-09-08 21:49:34 -04:00
co-authored by Claude Sonnet 5
parent 90d798966b
commit 60bafae8a0
2 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/assign_ticket.php
+2 -1
View File
@@ -76,7 +76,8 @@ if ($assignedTo === null || $assignedTo === '') {
$ticket['title'] ?? "Ticket #{$ticketId}", $ticket['title'] ?? "Ticket #{$ticketId}",
$assigneeName, $assigneeName,
$assigneeMatrix, $assigneeMatrix,
$changedByDisplay $changedByDisplay,
$ticket['visibility'] ?? 'public'
); );
} }
} }
helpers/NotificationHelper.php
+8 -2
View File
@@ -280,8 +280,14 @@ class NotificationHelper
* @param string|null $assigneeName Display name of new assignee * @param string|null $assigneeName Display name of new assignee
* @param string|null $assigneeMatrix Matrix user ID of new assignee (to DM) * @param string|null $assigneeMatrix Matrix user ID of new assignee (to DM)
* @param string|null $changedByDisplay * @param string|null $changedByDisplay
* @param string $visibility Ticket visibility; non-public titles are
* redacted before being sent to the shared
* notify list, same as sendTicketNotification().
* The assignee is DMed directly regardless,
* since they now have standing access to the
* ticket by virtue of being assigned to it.
*/ */
public static function sendAssignmentNotification($ticketId, string $ticketTitle, ?string $assigneeName, ?string $assigneeMatrix, ?string $changedByDisplay = null): void public static function sendAssignmentNotification($ticketId, string $ticketTitle, ?string $assigneeName, ?string $assigneeMatrix, ?string $changedByDisplay = null, string $visibility = 'public'): void
{ {
$notifyUsers = self::notifyUsers(); $notifyUsers = self::notifyUsers();
// Also notify the assignee directly if we know their Matrix ID // Also notify the assignee directly if we know their Matrix ID
@@ -295,7 +301,7 @@ class NotificationHelper
self::fire([ self::fire([
'event' => 'assigned', 'event' => 'assigned',
'ticket_id' => $ticketId, 'ticket_id' => $ticketId,
'title' => $ticketTitle, 'title' => self::redactedTitle($ticketTitle, $visibility),
'assignee' => $assigneeName, 'assignee' => $assigneeName,
'changed_by' => $changedByDisplay, 'changed_by' => $changedByDisplay,
'url' => UrlHelper::ticketUrl($ticketId), 'url' => UrlHelper::ticketUrl($ticketId),