Fix CSRF token drift in add_comment and update_ticket endpoints

api/add_comment.php

@@ -52,9 +52,15 @@ try {
         if (!CsrfMiddleware::validateToken($csrfToken)) {
             http_response_code(403);
             header('Content-Type: application/json');
-            echo json_encode(['success' => false, 'error' => 'Invalid CSRF token']);
+            echo json_encode([
+                'success' => false, 
+                'error' => 'Invalid CSRF token',
+                'csrf_token' => CsrfMiddleware::getToken()
+            ]);
             exit;
         }
+        // Rotate token after successful validation
+        $newCsrfToken = CsrfMiddleware::rotateToken();
     }
 
     $currentUser = $_SESSION['user'];
@@ -208,6 +214,9 @@ try {
     if ($result['success']) {
         $result['user_name'] = $currentUser['display_name'] ?? $currentUser['username'];
         $result['user_id']   = $userId;
+        if (isset($newCsrfToken)) {
+            $result['csrf_token'] = $newCsrfToken;
+        }
     }
 
     // Discard any unexpected output

api/update_ticket.php

@@ -48,9 +48,14 @@ try {
         if (!CsrfMiddleware::validateToken($csrfToken)) {
             http_response_code(403);
             header('Content-Type: application/json');
-            echo json_encode(['success' => false, 'error' => 'Invalid CSRF token']);
+            echo json_encode([
+                'success' => false, 
+                'error' => 'Invalid CSRF token',
+                'csrf_token' => CsrfMiddleware::getToken()
+            ]);
             exit;
         }
+        $GLOBALS['newCsrfToken'] = CsrfMiddleware::rotateToken();
     }
 
     $currentUser = $_SESSION['user'];
@@ -279,7 +284,8 @@ try {
                 'status'     => $updateData['status'],
                 'priority'   => $updateData['priority'],
                 'updated_at' => date('Y-m-d H:i:s'),
-                'message'    => 'Ticket updated successfully'
+                'message'    => 'Ticket updated successfully',
+                'csrf_token' => $GLOBALS['newCsrfToken'] ?? null
             ];
         }
     }