From a9a39adcf8b15263530b2b44b9a6b26c5ccab8bd Mon Sep 17 00:00:00 2001
From: Jared Vititoe <jjvititoe1@gmail.com>
Date: Tue, 8 Sep 2026 21:28:18 -0400
Subject: [PATCH] Add missing rate limiting to create_ticket_api.php (#27)

Every other Bearer-key endpoint (ticket_status_api.php,
ticket_comment_api.php) calls RateLimitMiddleware::apply('api') before
opening a DB connection; create_ticket_api.php didn't, contradicting
README.md's claim that the whole Bearer API is rate-limited. A leaked
or guessed API key could hammer ticket creation unthrottled, each
insert also firing a Matrix webhook.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015nCxwFFsy8ouMWzn56rPVP
---
 create_ticket_api.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/create_ticket_api.php b/create_ticket_api.php
index 62b6fcc..e4a85a9 100644
--- a/create_ticket_api.php
+++ b/create_ticket_api.php
@@ -5,6 +5,9 @@ header('Content-Type: application/json');
 error_reporting(E_ALL);
 ini_set('display_errors', 0);
 
+require_once __DIR__ . '/middleware/RateLimitMiddleware.php';
+RateLimitMiddleware::apply('api');
+
 // Load environment variables with error check
 $envFile = __DIR__ . '/.env';
 if (!file_exists($envFile)) {