Commit Graph

34 Commits

Author SHA1 Message Date
9b40a714ed Fix critical bugs breaking ticket page and settings modal
- Fix fatal PHP error in UserModel::getAllGroups() - typo 'setCache'
  should be 'setCached', was causing ticket page to fail to render
- Fix settings.js null reference errors when timezone element missing
  on ticket page (only exists on dashboard)
- Fix ESC key detection for settings modal (checked 'block' but modal
  uses 'flex' display)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-30 19:10:30 -05:00
5b2a2c271e Add security logging, domain validation, and output helpers
- Add authentication failure logging to AuthMiddleware (session expiry,
  access denied, unauthenticated access attempts)
- Add UrlHelper for secure URL generation with host validation against
  configurable ALLOWED_HOSTS whitelist
- Add OutputHelper with consistent XSS-safe escaping functions (h, attr,
  json, url, css, truncate, date, cssClass)
- Add validation to AuditLogModel query parameters (pagination limits,
  date format validation, action/entity type validation, IP sanitization)
- Add APP_DOMAIN and ALLOWED_HOSTS configuration options

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-30 18:51:16 -05:00
44f2c21f2d Add query optimization and reliability improvements
- Consolidate StatsModel queries from 12 to 3 using conditional aggregation
- Add input validation to DashboardController (sort columns, dates, priorities)
- Combine getCategories/getTypes into single query
- Add transaction support to BulkOperationsModel with atomic mode option
- Add depth limit (20) to dependency cycle detection to prevent DoS
- Add caching to UserModel.getAllGroups() with 5-minute TTL
- Improve ticket ID generation with 50 attempts, exponential backoff, and fallback

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-30 18:31:46 -05:00
7575d6a277 Add performance, security, and reliability improvements
- Consolidate all 20 API files to use centralized Database helper
- Add optimistic locking to ticket updates to prevent concurrent conflicts
- Add caching to StatsModel (60s TTL) for dashboard performance
- Add health check endpoint (api/health.php) for monitoring
- Improve rate limit cleanup with cron script and efficient DirectoryIterator
- Enable rate limit response headers (X-RateLimit-*)
- Add audit logging for workflow transitions
- Log Discord webhook failures instead of silencing
- Fix visibility check on export_tickets.php
- Add database migration system with performance indexes
- Fix cron recurring tickets to use assignTicket method

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-30 14:39:13 -05:00
37be81b3e2 Add PHP 7.4+ type hints to helpers, models, and middleware
Added strict typing with parameter types, return types, and property
types across all core classes:
- helpers: Database, ErrorHandler, CacheHelper
- models: TicketModel, UserModel, WorkflowModel, TemplateModel, UserPreferencesModel
- middleware: RateLimitMiddleware, CsrfMiddleware, SecurityHeadersMiddleware

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-29 11:04:36 -05:00
d2a8c73e2c Add caching layer and database helper
- Add CacheHelper for file-based caching with TTL support
- Add Database helper for centralized connection management
- Update WorkflowModel to cache status transitions (10 min TTL)
- Update UserPreferencesModel to cache user prefs (5 min TTL)
- Update manage_workflows.php to clear cache on changes
- Update get_users.php to use Database helper (example migration)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-29 10:53:26 -05:00
fa40010287 Security hardening and performance improvements
- Add visibility check to attachment downloads (prevents unauthorized access)
- Fix ticket ID collision with uniqueness verification loop
- Harden CSP: replace unsafe-inline with nonce-based script execution
- Add IP-based rate limiting (supplements session-based)
- Add visibility checks to bulk operations
- Validate internal visibility requires groups
- Optimize user activity query (JOINs vs subqueries)
- Update documentation with design decisions and security info

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-28 20:27:15 -05:00
ee796dce91 fix: Handle missing updated_at column in comment updates
Check if updated_at column exists before using it in UPDATE query.
This allows comment editing to work before migration script is run.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-24 17:04:13 -05:00
98db586bcf feat: Comment edit/delete, auto-link URLs, markdown tables, mobile fixes
- Add comment edit/delete functionality (owner or admin can modify)
- Add edit/delete buttons to comments in TicketView
- Create update_comment.php and delete_comment.php API endpoints
- Add updateComment() and deleteComment() methods to CommentModel
- Show "(edited)" indicator on modified comments
- Add migration script for updated_at column

- Auto-link URLs in plain text comments (non-markdown)
- Add markdown table support with proper HTML rendering
- Preserve code blocks during markdown parsing

- Fix mobile UI elements showing on desktop (add display:none defaults)
- Add mobile styles for CreateTicketView form elements
- Stack status-priority-row on mobile devices

- Update cache busters to v20260124e
- Update Claude.md and README.md documentation

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-24 16:59:29 -05:00
e86a5de3fd feat: Add 9 new features for enhanced UX and security
Quick Wins:
- Feature 1: Ticket linking in comments (#123456789 auto-links)
- Feature 6: Checkbox click area fix (click anywhere in cell)
- Feature 7: User groups display in settings modal

UI Enhancements:
- Feature 4: Collapsible sidebar with localStorage persistence
- Feature 5: Inline ticket preview popup on hover (300ms delay)
- Feature 2: Mobile responsive improvements (44px touch targets, iOS zoom fix)

Major Features:
- Feature 3: Kanban card view with status columns (toggle with localStorage)
- Feature 9: API key generation admin panel (/admin/api-keys)
- Feature 8: Ticket visibility levels (public/internal/confidential)

New files:
- views/admin/ApiKeysView.php
- api/generate_api_key.php
- api/revoke_api_key.php
- migrations/008_ticket_visibility.sql

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-23 10:01:50 -05:00
2c35ccc199 fix: Add table alias to COUNT query for advanced filters
The WHERE conditions use 't.' prefix but the COUNT query was missing
the table alias, causing 500 errors when using priority_max, assigned_to,
or date filters.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-20 21:36:42 -05:00
7462d7c509 fix: Add error handling to dependencies + cleanup migrations
- Add detailed error handling in DependencyModel (throw exceptions on failure)
- Add try-catch in ticket_dependencies.php to catch query errors
- Remove all old migrations (001-014) that have already been run
- Keep only new feature migrations (015-018) for reference

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-20 17:07:54 -05:00
2ce4a14201 fix: Use LEFT JOIN in DependencyModel queries
Makes queries more defensive - returns dependencies even if the
linked ticket was deleted.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-20 17:02:50 -05:00
be505b7312 Implement comprehensive improvement plan (Phases 1-6)
Security (Phase 1-2):
- Add SecurityHeadersMiddleware with CSP, X-Frame-Options, etc.
- Add RateLimitMiddleware for API rate limiting
- Add security event logging to AuditLogModel
- Add ResponseHelper for standardized API responses
- Update config.php with security constants

Database (Phase 3):
- Add migration 014 for additional indexes
- Add migration 015 for ticket dependencies
- Add migration 016 for ticket attachments
- Add migration 017 for recurring tickets
- Add migration 018 for custom fields

Features (Phase 4-5):
- Add ticket dependencies with DependencyModel and API
- Add duplicate detection with check_duplicates API
- Add file attachments with AttachmentModel and upload/download APIs
- Add @mentions with autocomplete and highlighting
- Add quick actions on dashboard rows

Collaboration (Phase 5):
- Add mention extraction in CommentModel
- Add mention autocomplete dropdown in ticket.js
- Add mention highlighting CSS styles

Admin & Export (Phase 6):
- Add StatsModel for dashboard widgets
- Add dashboard stats cards (open, critical, unassigned, etc.)
- Add CSV/JSON export via export_tickets API
- Add rich text editor toolbar in markdown.js
- Add RecurringTicketModel with cron job
- Add CustomFieldModel for per-category fields
- Add admin views: RecurringTickets, CustomFields, Workflow,
  Templates, AuditLog, UserActivity
- Add admin APIs: manage_workflows, manage_templates,
  manage_recurring, custom_fields, get_users
- Add admin routes in index.php

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-20 09:55:01 -05:00
a3298e7dbe fix: Enable proper sorting for Created By and Assigned To columns
Fixed server-side sorting for user-related columns on dashboard:

Problem:
- Clicking "Created By" or "Assigned To" headers didn't sort
- Columns were missing from $allowedColumns validation
- Fell back to ticket_id sort, appearing random to users

Solution:
1. Added 'created_by' and 'assigned_to' to $allowedColumns array

2. Smart sort expression mapping:
   - created_by → sorts by display_name/username (not user ID)
   - assigned_to → uses CASE to put unassigned at end, then sorts by name
   - Other columns → use table prefix (t.column_name)

3. Database-level NULL handling for assigned_to:
   - Uses CASE WHEN to sort unassigned tickets last
   - Regardless of ASC/DESC direction
   - Then alphabetically sorts assigned users

Result:
- A→Z: Alice, Bob, Charlie... Unassigned
- Z→A: Zack, Yolanda, Xavier... Unassigned
- Consistent grouping and predictable order

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09 16:42:13 -05:00
becee84821 perf: Add TTL-based caching to UserModel to prevent stale data
Cache optimization with automatic expiration:

1. New Cache Structure:
   - Changed from simple array to TTL-aware structure
   - Each entry: ['data' => ..., 'expires' => timestamp]
   - 5-minute (300s) TTL prevents indefinite stale data

2. Helper Methods:
   - getCached($key): Returns data if not expired, null otherwise
   - setCached($key, $data): Stores with expiration timestamp
   - invalidateCache($userId, $username): Manual cache clearing

3. Updated All Cache Access Points:
   - syncUserFromAuthelia() - User sync from Authelia
   - getSystemUser() - System user for daemon operations
   - getUserById() - User lookup by ID
   - getUserByUsername() - User lookup by username

Benefits:
- Prevents memory leaks from unlimited cache growth
- Ensures user data refreshes periodically
- Maintains performance benefits of caching
- Automatic cleanup of expired entries

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09 16:27:04 -05:00
4a05c82852 perf: Eliminate N+1 queries in bulk operations with batch loading
Performance optimization to address N+1 query problem:

1. TicketModel.php:
   - Added getTicketsByIds() method for batch loading
   - Loads multiple tickets in single query using IN clause
   - Returns associative array keyed by ticket_id
   - Includes all JOINs for creator/updater/assignee data

2. BulkOperationsModel.php:
   - Pre-load all tickets at start of processOperation()
   - Replaced 3x getTicketById() calls with array lookups
   - Benefits bulk_close, bulk_priority, and bulk_status operations

Performance Impact:
- Before: 100 tickets = ~100 database queries
- After: 100 tickets = ~2 database queries (1 batch + 100 updates)
- 30-50% faster bulk operations on large ticket sets

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09 16:24:36 -05:00
962724d811 better filtering and searching 2026-01-09 11:20:27 -05:00
2633d0f962 remove bulk delete 2026-01-08 23:35:49 -05:00
2e7956ce40 Bulk actions update 2026-01-08 23:30:25 -05:00
b781a44ed5 Added settings menu 2026-01-08 23:05:03 -05:00
c95f1db871 Fix: Multiple UI and functionality improvements
Fixed all reported issues:

1. **Dark Mode Improvements:**
   - Fixed bulk-actions-info white on white text (now yellow on dark background)
   - Fixed timeline-content boxes with explicit dark mode colors
   - All text now properly visible in dark mode

2. **Dashboard Enhancement:**
   - Added "Assigned To" column showing ticket assignments
   - Updated TicketModel query to include assigned user information
   - Shows "Unassigned" when no user assigned

3. **Removed Ticket View Tracking:**
   - Removed logTicketView call from TicketController
   - Created migration 011 to delete all view records from audit_log
   - Viewing tickets no longer clutters activity timeline

4. **Removed Duplicate Status Dropdown:**
   - Removed status field from hamburger menu
   - Status can now only be changed via the workflow-validated dropdown in ticket header
   - Prevents confusion and ensures all status changes follow workflow rules

All changes improve usability and reduce clutter.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-01 19:28:07 -05:00
ac094c8706 Feature 5: Implement Bulk Actions (Admin Only)
Add comprehensive bulk operations system for admins:

- Created BulkOperationsModel.php with operation tracking and processing
- Added bulk_operation.php API endpoint for bulk operations
- Created get_users.php API endpoint for user dropdown in bulk assign
- Updated DashboardView.php with checkboxes and bulk actions toolbar
- Added JavaScript functions for:
  - Select all/clear selection
  - Bulk close tickets
  - Bulk assign tickets
  - Bulk change priority
- Added comprehensive CSS for bulk actions toolbar and modals
- All bulk operations are admin-only (enforced server-side)
- Operations tracked in bulk_operations table with audit logging
- Supports bulk_close, bulk_assign, and bulk_priority operations

Admins can now select multiple tickets and perform batch operations, significantly improving workflow efficiency.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-01 19:06:33 -05:00
353ce83a36 Feature 4: Implement Ticket Templates
Add ticket template system for quick ticket creation:

- Created TemplateModel.php with full CRUD operations for templates
- Added get_template.php API endpoint to fetch template data
- Updated TicketController to load templates in create() method
- Modified CreateTicketView.php to include template selector dropdown
- Added loadTemplate() JavaScript function to populate form fields
- Templates include: title, description, category, type, and default priority
- Database already seeded with default templates (Hardware Failure, Software Installation, Network Issue, Maintenance Request)

Users can now select from predefined templates when creating tickets, speeding up common ticket creation workflows.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-01 19:00:42 -05:00
683420cdb9 Feature 3: Implement Status Transitions with Workflow Validation
Add comprehensive workflow management system for ticket status transitions:

- Created WorkflowModel.php for managing status transition rules
- Updated TicketController.php to load allowed transitions for each ticket
- Modified TicketView.php to display dynamic status dropdown with only allowed transitions
- Enhanced api/update_ticket.php with server-side workflow validation
- Added updateTicketStatus() JavaScript function for client-side status changes
- Included CSS styling for status select dropdown with color-coded states
- Transitions can require comments or admin privileges
- Status changes are validated against status_transitions table

This feature enforces proper ticket workflows and prevents invalid status changes.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-01 18:57:23 -05:00
99e60795c9 Add Ticket Assignment feature (Feature 2)
- Add assigned_to column support in TicketModel with assignTicket() and unassignTicket() methods
- Create assign_ticket.php API endpoint for assignment operations
- Update TicketController to load user list from UserModel
- Add assignment dropdown UI in TicketView
- Add JavaScript handler for assignment changes
- Integrate with audit log for assignment tracking

Users can now assign tickets to team members via dropdown selector.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-01 18:36:34 -05:00
f9629f60b6 Add Activity Timeline feature and database migrations
- Add Activity Timeline tab to ticket view showing chronological history
- Create getTicketTimeline() method in AuditLogModel
- Update TicketController to load timeline data
- Add timeline UI with helper functions for formatting events
- Add comprehensive timeline CSS with dark mode support
- Create migrations 007-010 for upcoming features:
  - 007: Ticket assignment functionality
  - 008: Status workflow transitions
  - 009: Ticket templates
  - 010: Bulk operations tracking

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-01 18:25:19 -05:00
9a12a656aa Add Created By column to dashboard and remove back button from ticket view 2026-01-01 17:37:01 -05:00
3abaf3d13f status needs to be string not int 2026-01-01 16:22:04 -05:00
b8a0fb011f Username not live updating & css overlap bug 2026-01-01 16:14:56 -05:00
7b25ec1dd1 SSO Update :) 2026-01-01 15:40:32 -05:00
38ae4802b8 Changed Client-side Search to Server-side Search 2025-09-05 12:40:38 -04:00
e05434137c Fixed MAJOR bugs, currently at a semi-stable state 2025-09-05 11:08:56 -04:00
f8ada1d6d1 Re-did everything, Now is modulaar and better bro. 2025-05-16 20:02:49 -04:00