Restrict API keys to public-visibility tickets by default (#70)

api/tickets_api.php (both the single-ticket read and the list/triage
path) bypassed ticket visibility entirely for any 'read'-scope key,
regardless of who it was issued to or what it was for — any key got
blanket read access to Confidential and Internal ticket titles,
descriptions, and comments, with no way to scope a key more narrowly.

Added see_all_visibility to api_keys (migration 006), defaulting to
false for both new and existing keys — the prior blanket-access
behavior is what's being restricted here, so unlike scope's own
un-migrated-database fallback (which defaults toward preserving old
behavior), a missing/null value here defaults to the new, restrictive
one. An admin can opt a specific key in via a new checkbox in the API
Key Management UI when it genuinely needs the full queue.

tickets_api.php now builds a synthetic "no special access" user and
runs it through TicketModel's existing per-user visibility plumbing
(getVisibilityFilter/canUserAccessTicket) instead of a separate SQL
path, so this stays in lockstep with however visibility rules evolve
for real users. That synthetic user_id is -1, not 0: testing surfaced
that canUserAccessTicket()'s confidential-ticket check does a PHP-level
(int) cast, and (int)null === 0, so an unassigned confidential ticket's
NULL assigned_to would otherwise false-positive-match a user_id of 0.

Verified against real MariaDB with public/confidential/internal test
tickets: a public-only-scoped key's list only returns the public
ticket, and canUserAccessTicket() correctly returns false for both the
confidential ticket (unassigned, then reassigned to a real user — both
cases) and the internal one; a see_all_visibility key sees all three,
unchanged from the prior behavior. Also verified createKey()/
validateKey()'s default-false and explicit-true paths round-trip
correctly through the real DB.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117oBw2jN4kALYeS8HPq4zV

This commit is contained in:

jared

2026-09-12 01:17:53 -04:00

co-authored by

Claude Sonnet 5

parent e91f4547b6

commit 6609320c83

7 changed files with 94 additions and 17 deletions

									
										migrations/006_api_key_visibility_scope.sql
									
		+13
		
												View File
												
				@@ -0,0 +1,13 @@

				-- Restrict Bearer API keys to public-visibility tickets by default (#70).

				--

				-- Previously any 'read'-scope key bypassed ticket visibility entirely —

				-- Confidential and Internal tickets were readable by any key, regardless

				-- of who it was issued to. see_all_visibility is an explicit opt-in an

				-- admin sets per-key when a key genuinely needs to see non-public tickets;

				-- it defaults to 0 (public-only) for both new and existing keys, since the

				-- prior blanket-access behavior is the thing being restricted.

				--

				-- Safe to re-run.

				ALTER TABLE `api_keys`

				    ADD COLUMN IF NOT EXISTS `see_all_visibility` tinyint(1) NOT NULL DEFAULT 0 AFTER `scope`;