Merge development into main: dashboard status chart excludes Closed (#110)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117oBw2jN4kALYeS8HPq4zV

.env.example

@@ -1,60 +1,92 @@
-# Tinker Tickets Environment Configuration
+; Tinker Tickets Environment Configuration
-# Copy this file to .env and fill in your values
+; Copy this file to .env and fill in your values
-#
+;
-# NOTE: This file is parsed with parse_ini_file(). Any value containing special
+; NOTE: This file is parsed with PHP's parse_ini_file. Any value containing
-# characters (#, ;, =, quotes, spaces, etc.) MUST be wrapped in double quotes,
+; special characters -- #, ;, =, quotes, spaces, etc. -- MUST be wrapped in
-# e.g. DB_PASS="p@ss;word#1". The application now fails loudly (dies with a clear
+; double quotes, e.g. DB_PASS="p@ss;word#1". The application now fails loudly
-# error) if the .env file cannot be parsed, so an unquoted special character will
+; -- dies with a clear error -- if the .env file cannot be parsed, so an
-# take the whole app down rather than silently using a wrong value.
+; unquoted special character will take the whole app down rather than
+; silently using a wrong value.
+;
+; Comments in this file use ";" rather than "#": PHP's ini parser treats "#"
+; comments as fragile -- punctuation like parentheses or quotes inside a "#"
+; comment can produce a syntax error even though the line is meant to be
+; inert, silently breaking every value below it. ";" comments don't have this
+; problem, so keep using ";" for any comment added to this file.
 
-# Database Configuration
+; Database Configuration
 DB_HOST=10.10.10.50
 DB_USER=tinkertickets
 DB_PASS=your_password_here
 DB_NAME=ticketing_system
 
-# Matrix Webhook (optional - for notifications via matrix-hookshot)
+; Matrix Webhook (optional - for notifications via matrix-hookshot)
-# Set to your hookshot generic webhook URL, e.g.:
+; Set to your hookshot generic webhook URL, e.g.:
-#   https://matrix.lotusguild.org/webhook/<uuid>
+;   https://matrix.lotusguild.org/webhook/uuid-goes-here
 MATRIX_WEBHOOK_URL=
 
-# Matrix users to @mention on every new ticket (comma-separated Matrix user IDs)
+; Matrix users to @mention on every new ticket (comma-separated Matrix user IDs)
-# e.g. @jared:matrix.lotusguild.org,@alice:matrix.lotusguild.org
+; e.g. @jared:matrix.lotusguild.org,@alice:matrix.lotusguild.org
 MATRIX_NOTIFY_USERS=
 
-# Application Domain (required for Matrix webhook ticket links)
+; Matrix homeserver domain (used to build Matrix user IDs from LLDAP usernames)
-# Set this to your public domain (e.g., t.lotusguild.org)
+MATRIX_DOMAIN=
+
+; Synapse internal URL and admin token (used to resolve usernames -> Matrix IDs
+; for watcher DMs)
+SYNAPSE_ADMIN_URL=
+SYNAPSE_ADMIN_TOKEN=
+
+; Optional: send a Matrix notification on comments and/or assignments (0/1)
+MATRIX_NOTIFY_COMMENTS=0
+MATRIX_NOTIFY_ASSIGNMENTS=0
+
+; Application Domain (required for Matrix webhook ticket links)
+; Set this to your public domain, e.g. t.lotusguild.org
 APP_DOMAIN=
 
-# Allowed Hosts for HTTP_HOST validation (comma-separated)
+; Allowed Hosts for HTTP_HOST validation (comma-separated)
-# Include all domains that can access this application
+; Include all domains that can access this application
 ALLOWED_HOSTS=localhost,127.0.0.1
 
-# Trusted reverse proxy IP(s), comma-separated (e.g. the Authelia/nginx proxy).
+; ============================================================================
-# Set this to the IP address(es) of your reverse proxy. Authelia forward-auth
+; REQUIRED FOR PRODUCTION -- READ BEFORE DEPLOYING -- TRUSTED_PROXIES
-# headers (Remote-User / Remote-Groups) and forwarded client IPs are only
+; ============================================================================
-# trusted when REMOTE_ADDR is in this list.
+; Trusted reverse proxy IPs, comma-separated -- e.g. the Authelia/nginx proxy.
-#
+; Set this to the IP address(es) of your reverse proxy. Authelia forward-auth
-# Leaving this EMPTY disables reverse-proxy verification entirely: the app then
+; headers (Remote-User / Remote-Groups) and forwarded client IPs are only
-# trusts Remote-User / Remote-Groups headers from ANY source. That is unsafe if
+; trusted when REMOTE_ADDR is in this list.
-# the PHP backend is reachable directly (bypassing the proxy), because a client
+;
-# can then spoof those headers and log in as an admin. Only leave it empty when
+; Leaving this EMPTY disables reverse-proxy verification entirely: the app then
-# network topology guarantees PHP is reachable solely via the trusted proxy.
+; trusts Remote-User / Remote-Groups headers from ANY source. If the PHP
-#
+; backend is reachable directly -- a misconfigured firewall rule, a container
-# Exact IP match only (no CIDR). Example (single proxy): TRUSTED_PROXIES=10.10.10.27
+; network accidentally exposing the port, SSRF from another internal service
-# Example (multiple):                                     TRUSTED_PROXIES=10.10.10.27,10.10.10.28
+; -- ANYONE can set Remote-User: admin themselves and fully impersonate any
+; user, including an admin, with ZERO authentication. Only leave it empty when
+; network topology guarantees PHP is reachable solely via the trusted proxy
+; (e.g. local development), never in a real deployment.
+;
+; Exact IP match only (no CIDR). Example (single proxy): TRUSTED_PROXIES=10.10.10.27
+; Example (multiple):                                     TRUSTED_PROXIES=10.10.10.27,10.10.10.28
+; ============================================================================
 TRUSTED_PROXIES=
 
-# Timezone (default: America/New_York)
+; Timezone (default: America/New_York)
 TIMEZONE=America/New_York
 
-# LDAP / lldap (for user avatar lookups)
+; LDAP / lldap (for user avatar lookups)
 LDAP_ENABLED=true
 LDAP_HOST=10.10.10.39
 LDAP_PORT=3890
-LDAP_BIND_DN=uid=tinker-tickets,ou=people,dc=example,dc=com
+LDAP_BIND_DN="uid=tinker-tickets,ou=people,dc=example,dc=com"
 LDAP_BIND_PW=
-LDAP_BASE_DN=dc=example,dc=com
+LDAP_BASE_DN="dc=example,dc=com"
-LDAP_USER_BASE=ou=people,dc=example,dc=com
+LDAP_USER_BASE="ou=people,dc=example,dc=com"
-# How long to cache avatar images locally (seconds, default 3600)
+; How long to cache avatar images locally (seconds, default 3600)
 AVATAR_CACHE_TTL=3600
+
+; Session-based rate limits (requests per 60s window). These govern
+; browser/session traffic on general and API endpoints respectively;
+; Bearer-key API traffic is rate-limited separately, per API key.
+RATE_LIMIT_DEFAULT=100
+RATE_LIMIT_API=60

.eslintrc.json

@@ -20,6 +20,6 @@
         "no-useless-escape": "warn",
         "no-regex-spaces": "warn",
         "semi": ["error", "always"],
-        "eqeqeq": "warn"
+        "eqeqeq": ["warn", "smart"]
     }
 }

README.md

@@ -255,6 +255,7 @@ Content-Type: application/json
 
 - `migrations/000_baseline.sql` is the full schema baseline for the whole database. It is written to be safe to re-run (idempotent) and is the source of truth for a fresh install.
 - `php migrations/migrate.php` applies any pending migration files in `migrations/` in order, tracking applied files in the `migrations` table. Use `--status` to list state and `--dry-run` to preview without executing.
+- Numbered migrations on top of the baseline (all idempotent, safe to re-run): `001_widen_bulk_operations_status.sql`, `002_fix_collation_consistency.sql`, `003_fk_on_delete_set_null.sql`, `004_fix_ticket_watchers_type.sql`. A fresh install via `000_baseline.sql` already includes all of these; they only matter for upgrading an existing database.
 
 ### API Endpoints
 
@@ -348,7 +349,9 @@ tinker_tickets/
 │   └── images/
 │       └── favicon.png
 ├── config/
-│   └── config.php                        # Config + .env loading
+│   ├── config.php                        # Config + .env loading
+│   └── requirements.php                  # PHP version/extension requirements (single source of
+│                                          #   truth for scripts/check_requirements.php + api/health.php)
 ├── controllers/
 │   ├── CommentController.php             # Comment create/edit/delete + notifications
 │   ├── DashboardController.php           # Dashboard with stats + filters
@@ -362,7 +365,6 @@ tinker_tickets/
 │   ├── Database.php                      # Centralized mysqli connection
 │   ├── ErrorHandler.php                  # Global error/exception handler
 │   ├── NotificationHelper.php            # Matrix hookshot webhook events
-│   ├── OutputHelper.php                  # Safe HTML output helpers
 │   ├── ResponseHelper.php                # JSON API response helpers
 │   ├── SynapseHelper.php                 # Resolves usernames → Matrix IDs via Synapse admin API
 │   └── UrlHelper.php                     # Canonical ticket URLs using APP_DOMAIN
@@ -390,6 +392,10 @@ tinker_tickets/
 │   └── WorkflowModel.php                 # Status transition workflows
 ├── migrations/
 │   ├── 000_baseline.sql                  # Full schema baseline (safe to re-run)
+│   ├── 001_widen_bulk_operations_status.sql  # Upgrade-only (already in baseline for fresh installs)
+│   ├── 002_fix_collation_consistency.sql     # Upgrade-only (already in baseline for fresh installs)
+│   ├── 003_fk_on_delete_set_null.sql         # Upgrade-only (already in baseline for fresh installs)
+│   ├── 004_fix_ticket_watchers_type.sql      # Upgrade-only (already in baseline for fresh installs)
 │   └── migrate.php                       # CLI migration runner (tracks applied migrations)
 ├── scripts/
 │   ├── check_requirements.php            # Verify PHP extensions/config prerequisites
@@ -407,6 +413,9 @@ tinker_tickets/
 │   │   └── WorkflowDesignerView.php      # Workflow transition designer
 │   ├── CreateTicketView.php              # Ticket creation with visibility
 │   ├── DashboardView.php                 # Dashboard with kanban + sidebar + charts
+│   ├── error_403.php                     # Access-denied error page
+│   ├── error_404.php                     # Not-found error page
+│   ├── error_500.php                     # Fatal-error page (self-contained, no app-state deps)
 │   ├── layout_footer.php                 # Shared footer (notification polling, boot sequence)
 │   ├── layout_header.php                 # Shared header (nav, command palette, theme toggle)
 │   └── TicketView.php                    # Ticket view with timeline, SLA, watcher avatars
@@ -448,6 +457,21 @@ APP_DOMAIN=your.domain.example
 TIMEZONE=America/New_York
 ```
 
+**⚠️ REQUIRED FOR PRODUCTION — `TRUSTED_PROXIES`:** This app trusts Authelia
+forward-auth headers (`Remote-User`, `Remote-Groups`, etc.) to identify who's
+logged in. `TRUSTED_PROXIES` restricts that trust to requests that actually
+came through your reverse proxy — **leaving it empty disables that check
+entirely**, and anyone who can reach the PHP backend directly (a
+misconfigured firewall rule, an exposed container port, SSRF from another
+internal service) can set `Remote-User: admin` themselves and fully
+impersonate any user with zero authentication. Set it to your reverse proxy's
+IP address(es) before deploying anywhere reachable beyond your own machine:
+```env
+TRUSTED_PROXIES=10.10.10.27
+```
+`GET /api/health.php` reports a `warning` on the `trusted_proxies` check if
+this is left empty, so it doesn't go unnoticed after deployment.
+
 Matrix notification variables (all optional):
 ```env
 # hookshot generic webhook URL — send events to Matrix room
@@ -556,7 +580,7 @@ Key conventions and gotchas for working with this codebase:
 21. **Confirm dialogs**: Never use browser `confirm()`. Use `showConfirmModal(title, message, type, onConfirm)` (defined in `utils.js`, available on all pages). Types: `'warning'` | `'error'` | `'info'`.
 22. **`utils.js` on all pages**: `utils.js` is loaded by all views (including admin). It provides `escapeHtml()`, `getTicketIdFromUrl()`, and `showConfirmModal()`.
 23. **No `toast.js`**: `toast.js` is deprecated and no longer loaded by any view. Use `lt.toast.success/error/warning/info()` directly from `base.js`.
-24. **Stats cache**: `StatsModel` caches stats for 60 s. Any path that modifies ticket state must call `(new StatsModel($conn))->invalidateCache()` after the change. Callers: `TicketController::create` (manual create), `create_ticket_api.php` (external API create/escalate/reopen), `cron/create_recurring_tickets.php`, `bulk_operation`, `assign_ticket`, `update_ticket`, and `clone_ticket`.
+24. **Stats cache**: `StatsModel` caches stats for 60 s. Any path that modifies ticket state must call `(new StatsModel($conn))->invalidateCache()` after the change. Callers: `TicketController::create` (manual create), `create_ticket_api.php` (external API create/escalate/reopen), `cron/create_recurring_tickets.php`, `bulk_operation`, `assign_ticket`, `update_ticket`, `clone_ticket`, and `ticket_status_api.php` (Bearer API status-change endpoint).
 25. **External API (`create_ticket_api.php`)**: Uses `ApiKeyAuth` (Bearer token), not session auth. Served directly by the web server from the document root — not through the index.php router. Includes deduplication logic (SHA-256 hash, no time window) that updates/escalates an existing open duplicate or reopens a closed one rather than creating a new ticket.
 
 ## File Reference

api/add_comment.php

@@ -1,8 +1,8 @@
 <?php
 
 // Disable error display in the output
-ini_set('display_errors', 0);
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
-error_reporting(E_ALL);
+ErrorHandler::init();
 
 // Apply rate limiting
 require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
@@ -99,6 +99,11 @@ try {
         exit;
     }
 
+    // Persist the trimmed text (not the raw client value) — matches update_comment.php
+    // and keeps stored comment_text free of leading whitespace that could shift a
+    // markdown-enabled comment's first line out of column 0 on reload.
+    $data['comment_text'] = $commentTextRaw;
+
     // Never trust a client-supplied display name — always attribute the comment to
     // the authenticated session user.
     $data['user_name'] = $currentUser['display_name'] ?? $currentUser['username'] ?? 'User';
@@ -172,9 +177,16 @@ try {
         $ticketTitle   = $ticket['title'] ?? "Ticket #{$ticketId}";
         $ticketVisibility = $ticket['visibility'] ?? 'public';
 
-        // @mention notifications — resolve usernames → Matrix IDs via Synapse Admin API
+        // @mention notifications — resolve usernames → Matrix IDs via Synapse Admin API.
-        if (!empty($mentionedUsers)) {
+        // Only notify mentioned users who actually have access to this ticket;
-            $mentionedUsernames = array_column($mentionedUsers, 'username');
+        // otherwise a mention would DM them the ticket's title and comment text
+        // even though canUserAccessTicket() would deny them the ticket itself.
+        $accessibleMentionedUsers = array_filter(
+            $mentionedUsers,
+            fn($u) => $ticketModel->canUserAccessTicket($ticket, $u)
+        );
+        if (!empty($accessibleMentionedUsers)) {
+            $mentionedUsernames = array_column($accessibleMentionedUsers, 'username');
             $mentionedMatrixIds = SynapseHelper::resolveUsernames($mentionedUsernames);
             if (!empty($mentionedMatrixIds)) {
                 NotificationHelper::sendMentionNotification($ticketId, $ticketTitle, $commentText, $authorDisplay, $mentionedMatrixIds);

api/assign_ticket.php

@@ -76,7 +76,8 @@ if ($assignedTo === null || $assignedTo === '') {
                 $ticket['title'] ?? "Ticket #{$ticketId}",
                 $assigneeName,
                 $assigneeMatrix,
-                $changedByDisplay
+                $changedByDisplay,
+                $ticket['visibility'] ?? 'public'
             );
         }
     }

api/bootstrap.php

@@ -10,8 +10,8 @@
  *   // $conn, $currentUser, $userId, $isAdmin are now available
  */
 
-ini_set('display_errors', 0);
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
-error_reporting(E_ALL);
+ErrorHandler::init();
 
 // Rate limiting (also starts session)
 require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';

api/bulk_operation.php

@@ -1,5 +1,8 @@
 <?php
 
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
+ErrorHandler::init();
+
 // Apply rate limiting
 require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
 RateLimitMiddleware::apply('api');
@@ -25,7 +28,7 @@ if (!in_array($_SERVER['REQUEST_METHOD'], ['GET', 'HEAD'], true)) {
     $csrfToken = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
     if (!CsrfMiddleware::validateToken($csrfToken)) {
         http_response_code(403);
-        echo json_encode(['success' => false, 'error' => 'Invalid CSRF token']);
+        echo json_encode(['success' => false, 'error' => 'Invalid CSRF token', 'csrf_token' => CsrfMiddleware::getToken()]);
         exit;
     }
 }
@@ -128,12 +131,19 @@ if (isset($result['error'])) {
     if ($inaccessibleCount > 0) {
         $message .= " ($inaccessibleCount skipped - no access)";
     }
-    echo json_encode([
+    $response = [
         'success' => true,
         'operation_id' => $operationId,
         'processed' => $result['processed'],
         'failed' => $result['failed'],
         'skipped' => $inaccessibleCount,
         'message' => $message
-    ]);
+    ];
+    // Best-effort batches (the default; see processBulkOperation()'s docblock)
+    // can partially fail — surface the per-ticket reasons so the admin isn't
+    // just told a count. The dashboard's bulkResultMessage() already expects this.
+    if (!empty($result['errors'])) {
+        $response['errors'] = $result['errors'];
+    }
+    echo json_encode($response);
 }

api/clone_ticket.php

@@ -5,8 +5,8 @@
  * Creates a copy of an existing ticket with the same properties
  */
 
-ini_set('display_errors', 0);
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
-error_reporting(E_ALL);
+ErrorHandler::init();
 
 header('Content-Type: application/json');
 
@@ -34,7 +34,7 @@ try {
     $csrfToken = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
     if (!CsrfMiddleware::validateToken($csrfToken)) {
         http_response_code(403);
-        echo json_encode(['success' => false, 'error' => 'Invalid CSRF token']);
+        echo json_encode(['success' => false, 'error' => 'Invalid CSRF token', 'csrf_token' => CsrfMiddleware::getToken()]);
         exit;
     }
 

api/custom_fields.php

@@ -5,8 +5,8 @@
  * CRUD operations for custom field definitions
  */
 
-ini_set('display_errors', 0);
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
-error_reporting(E_ALL);
+ErrorHandler::init();
 
 require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
 RateLimitMiddleware::apply('api');
@@ -40,7 +40,7 @@ try {
         $csrfToken = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
         if (!CsrfMiddleware::validateToken($csrfToken)) {
             http_response_code(403);
-            echo json_encode(['success' => false, 'error' => 'Invalid CSRF token']);
+            echo json_encode(['success' => false, 'error' => 'Invalid CSRF token', 'csrf_token' => CsrfMiddleware::getToken()]);
             exit;
         }
     }

api/delete_attachment.php

@@ -7,8 +7,8 @@
  */
 
 // Capture errors for debugging
-ini_set('display_errors', 0);
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
-error_reporting(E_ALL);
+ErrorHandler::init();
 
 // Apply rate limiting (also starts session)
 require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
@@ -48,7 +48,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
 // Verify CSRF token
 $csrfToken = $input['csrf_token'] ?? $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
 if (!CsrfMiddleware::validateToken($csrfToken)) {
-    ResponseHelper::forbidden('Invalid CSRF token');
+    ResponseHelper::error('Invalid CSRF token', 403, ['csrf_token' => CsrfMiddleware::getToken()]);
 }
 
 // Get attachment ID
@@ -94,6 +94,15 @@ try {
         }
     }
 
+    // Delete the generated preview thumbnail alongside the original, if one exists.
+    if (!empty($attachment['thumbnail_filename'])) {
+        $thumbPath = $uploadDir . '/' . $attachment['ticket_id'] . '/' . $attachment['thumbnail_filename'];
+        $realThumbPath = realpath($thumbPath);
+        if ($realThumbPath !== false && strncmp($realThumbPath, $uploadDir . DIRECTORY_SEPARATOR, strlen($uploadDir) + 1) === 0) {
+            @unlink($realThumbPath);
+        }
+    }
+
     // Delete from database
     if (!$attachmentModel->deleteAttachment($attachmentId)) {
         ResponseHelper::serverError('Failed to delete attachment record');

api/delete_comment.php

@@ -5,8 +5,8 @@
  */
 
 // Disable error display in the output
-ini_set('display_errors', 0);
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
-error_reporting(E_ALL);
+ErrorHandler::init();
 
 // Apply rate limiting
 require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
@@ -49,7 +49,7 @@ try {
     if (!CsrfMiddleware::validateToken($csrfToken)) {
         http_response_code(403);
         header('Content-Type: application/json');
-        echo json_encode(['success' => false, 'error' => 'Invalid CSRF token']);
+        echo json_encode(['success' => false, 'error' => 'Invalid CSRF token', 'csrf_token' => CsrfMiddleware::getToken()]);
         exit;
     }
 

api/download_attachment.php

@@ -6,6 +6,9 @@
  * Serves file downloads for ticket attachments
  */
 
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
+ErrorHandler::init();
+
 require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
 RateLimitMiddleware::apply('api');
 
@@ -66,9 +69,21 @@ try {
 
     $conn->close();
 
+    // Serve the resized preview thumbnail instead of the full-size original
+    // when requested and one was actually generated at upload time; falls
+    // through to the full original otherwise (older attachments predating
+    // thumbnail generation, non-images, or a GD failure at upload time).
+    $wantsThumb = isset($_GET['thumb']) && $_GET['thumb'] === '1';
+    $servedFilename = $attachment['filename'];
+    $servedMimeType = $attachment['mime_type'];
+    if ($wantsThumb && !empty($attachment['thumbnail_filename'])) {
+        $servedFilename = $attachment['thumbnail_filename'];
+        $servedMimeType = 'image/jpeg';
+    }
+
     // Build file path
     $uploadDir = $GLOBALS['config']['UPLOAD_DIR'] ?? dirname(__DIR__) . '/uploads';
-    $filePath = $uploadDir . '/' . $attachment['ticket_id'] . '/' . $attachment['filename'];
+    $filePath = $uploadDir . '/' . $attachment['ticket_id'] . '/' . $servedFilename;
 
     // Security: Verify the resolved path is within the uploads directory (prevent path traversal)
     $realUploadDir = realpath($uploadDir);
@@ -97,17 +112,55 @@ try {
     $inlineTypes = ['image/jpeg', 'image/png', 'image/gif', 'image/webp', 'application/pdf', 'text/plain'];
 
     // Set headers
-    $disposition = ($inline && in_array($attachment['mime_type'], $inlineTypes)) ? 'inline' : 'attachment';
+    $disposition = ($inline && in_array($servedMimeType, $inlineTypes)) ? 'inline' : 'attachment';
 
     // Sanitize filename for Content-Disposition
     $safeFilename = preg_replace('/[^\w\s\-\.]/', '_', $attachment['original_filename']);
 
-    header('Content-Type: ' . $attachment['mime_type']);
+    $fileSize = filesize($filePath);
+
+    // Parse a single-range "Range: bytes=start-end" request header (RFC 7233).
+    // Multi-range requests aren't supported; they fall through to a full 200 response.
+    $rangeStart = 0;
+    $rangeEnd = $fileSize - 1;
+    $isRangeRequest = false;
+
+    if (isset($_SERVER['HTTP_RANGE']) && preg_match('/^bytes=(\d*)-(\d*)$/', trim($_SERVER['HTTP_RANGE']), $m)) {
+        if ($m[1] === '' && $m[2] === '') {
+            // Malformed ("bytes=-") — ignore and serve the full file.
+        } elseif ($m[1] === '') {
+            // Suffix range: last N bytes
+            $suffixLength = (int)$m[2];
+            $rangeStart = max(0, $fileSize - $suffixLength);
+            $rangeEnd = $fileSize - 1;
+            $isRangeRequest = true;
+        } else {
+            $rangeStart = (int)$m[1];
+            $rangeEnd = ($m[2] === '') ? $fileSize - 1 : min((int)$m[2], $fileSize - 1);
+            $isRangeRequest = true;
+        }
+
+        if ($isRangeRequest && ($rangeStart > $rangeEnd || $rangeStart >= $fileSize)) {
+            http_response_code(416);
+            header('Content-Range: bytes */' . $fileSize);
+            exit;
+        }
+    }
+
+    $rangeLength = $rangeEnd - $rangeStart + 1;
+
+    header('Accept-Ranges: bytes');
+    header('Content-Type: ' . $servedMimeType);
     header('Content-Disposition: ' . $disposition . '; filename="' . $safeFilename . '"');
-    header('Content-Length: ' . $attachment['file_size']);
     header('Cache-Control: private, max-age=3600');
     header('X-Content-Type-Options: nosniff');
 
+    if ($isRangeRequest) {
+        http_response_code(206);
+        header('Content-Range: bytes ' . $rangeStart . '-' . $rangeEnd . '/' . $fileSize);
+    }
+    header('Content-Length: ' . $rangeLength);
+
     // Prevent PHP from timing out on large files
     set_time_limit(0);
 
@@ -125,9 +178,18 @@ try {
         exit;
     }
 
-    while (!feof($handle)) {
+    fseek($handle, $rangeStart);
-        echo fread($handle, 8192);
+    $remaining = $rangeLength;
+    $chunkSize = 8192;
+    while ($remaining > 0 && !feof($handle)) {
+        $read = ($remaining < $chunkSize) ? $remaining : $chunkSize;
+        $data = fread($handle, $read);
+        if ($data === false) {
+            break;
+        }
+        echo $data;
         flush();
+        $remaining -= strlen($data);
     }
 
     fclose($handle);

api/export_tickets.php

@@ -8,8 +8,8 @@
  */
 
 // Disable error display in the output
-ini_set('display_errors', 0);
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
-error_reporting(E_ALL);
+ErrorHandler::init();
 
 // Apply rate limiting
 require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';

api/generate_api_key.php

@@ -1,8 +1,8 @@
 <?php
 
 // API endpoint for generating API keys (Admin only)
-error_reporting(E_ALL);
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
-ini_set('display_errors', 0);
+ErrorHandler::init();
 
 // Apply rate limiting
 require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
@@ -39,8 +39,15 @@ try {
     if ($_SERVER['REQUEST_METHOD'] === 'POST') {
         $csrfToken = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
         if (!CsrfMiddleware::validateToken($csrfToken)) {
+            ob_end_clean();
             http_response_code(403);
-            throw new Exception("Invalid CSRF token");
+            header('Content-Type: application/json');
+            echo json_encode([
+                'success' => false,
+                'error' => 'Invalid CSRF token',
+                'csrf_token' => CsrfMiddleware::getToken()
+            ]);
+            exit;
         }
     }
 

api/get_users.php

@@ -8,8 +8,10 @@
 require_once __DIR__ . '/bootstrap.php';
 
 try {
-    // Get all users for mentions/assignment
+    // Get all users for mentions/assignment. Capped as defense-in-depth against
-    $result = Database::query("SELECT user_id, username, display_name FROM users ORDER BY display_name, username");
+    // a single call scraping an unbounded user list — every caller only needs
+    // this for typeahead/dropdown filtering, never a literal full roster.
+    $result = Database::query("SELECT user_id, username, display_name FROM users ORDER BY display_name, username LIMIT 500");
 
     if (!$result) {
         throw new Exception("Failed to query users");

api/health.php

@@ -11,6 +11,9 @@
  * - 503 Service Unavailable: System has issues
  */
 
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
+ErrorHandler::init();
+
 // Don't apply rate limiting to health checks - they should always respond
 header('Content-Type: application/json');
 header('Cache-Control: no-cache, no-store, must-revalidate');
@@ -129,6 +132,54 @@ if (version_compare(PHP_VERSION, $requirements['min_php_version'], '>=')) {
     $healthy = false;
 }
 
+// Check 7: memory_limit / max_execution_time sanity (warnings, not fatal — a
+// low default doesn't fail requests until something large actually runs, so
+// surface it here rather than waiting for a mysterious failure under load).
+$memLimitIni = ini_get('memory_limit');
+$memLimitUnit = strtolower(substr(trim($memLimitIni), -1));
+$memLimitBytes = $memLimitIni === '-1'
+    ? -1
+    : (int)$memLimitIni * match ($memLimitUnit) {
+        'g' => 1024 * 1024 * 1024,
+        'm' => 1024 * 1024,
+        'k' => 1024,
+        default => 1,
+    };
+$minMemBytes = $requirements['min_memory_limit_mb'] * 1024 * 1024;
+if ($memLimitBytes === -1 || $memLimitBytes >= $minMemBytes) {
+    $checks['memory_limit'] = ['status' => 'ok', 'message' => $memLimitIni];
+} else {
+    $checks['memory_limit'] = [
+        'status' => 'warning',
+        'message' => sprintf('%s is below the recommended minimum %dM', $memLimitIni, $requirements['min_memory_limit_mb'])
+    ];
+}
+
+$maxExecTime = (int)ini_get('max_execution_time');
+if ($maxExecTime === 0 || $maxExecTime >= $requirements['min_max_execution_time']) {
+    $checks['max_execution_time'] = ['status' => 'ok', 'message' => (string)$maxExecTime];
+} else {
+    $checks['max_execution_time'] = [
+        'status' => 'warning',
+        'message' => sprintf('%ds is below the recommended minimum %ds', $maxExecTime, $requirements['min_max_execution_time'])
+    ];
+}
+
+// Check 8: TRUSTED_PROXIES configured. Empty disables enforceTrustedProxy()'s
+// allowlist entirely, meaning anything that can reach this app directly can
+// spoof the Authelia forward-auth Remote-* headers and impersonate any user,
+// including an admin. Not fatal (a fresh/dev install may not sit behind a
+// proxy yet), but should never go unnoticed on a real deployment.
+if (!empty($GLOBALS['config']['TRUSTED_PROXIES'] ?? [])) {
+    $checks['trusted_proxies'] = ['status' => 'ok', 'message' => 'configured'];
+} else {
+    $checks['trusted_proxies'] = [
+        'status' => 'warning',
+        'message' => 'TRUSTED_PROXIES is empty — forward-auth headers are NOT verified; '
+            . 'anything that can reach this app directly can impersonate any user'
+    ];
+}
+
 // Calculate response time
 $responseTime = round((microtime(true) - $startTime) * 1000, 2);
 

api/manage_recurring.php

@@ -5,8 +5,8 @@
  * CRUD operations for recurring_tickets table
  */
 
-ini_set('display_errors', 0);
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
-error_reporting(E_ALL);
+ErrorHandler::init();
 
 require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
 RateLimitMiddleware::apply('api');
@@ -42,7 +42,7 @@ try {
         $csrfToken = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
         if (!CsrfMiddleware::validateToken($csrfToken)) {
             http_response_code(403);
-            echo json_encode(['success' => false, 'error' => 'Invalid CSRF token']);
+            echo json_encode(['success' => false, 'error' => 'Invalid CSRF token', 'csrf_token' => CsrfMiddleware::getToken()]);
             exit;
         }
     }

api/manage_templates.php

@@ -5,8 +5,8 @@
  * CRUD operations for ticket_templates table
  */
 
-ini_set('display_errors', 0);
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
-error_reporting(E_ALL);
+ErrorHandler::init();
 
 require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
 RateLimitMiddleware::apply('api');
@@ -39,7 +39,7 @@ try {
         $csrfToken = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
         if (!CsrfMiddleware::validateToken($csrfToken)) {
             http_response_code(403);
-            echo json_encode(['success' => false, 'error' => 'Invalid CSRF token']);
+            echo json_encode(['success' => false, 'error' => 'Invalid CSRF token', 'csrf_token' => CsrfMiddleware::getToken()]);
             exit;
         }
     }

api/manage_workflows.php

@@ -5,8 +5,8 @@
  * CRUD operations for status_transitions table
  */
 
-ini_set('display_errors', 0);
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
-error_reporting(E_ALL);
+ErrorHandler::init();
 
 require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
 require_once dirname(__DIR__) . '/models/WorkflowModel.php';
@@ -40,7 +40,7 @@ try {
         $csrfToken = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
         if (!CsrfMiddleware::validateToken($csrfToken)) {
             http_response_code(403);
-            echo json_encode(['success' => false, 'error' => 'Invalid CSRF token']);
+            echo json_encode(['success' => false, 'error' => 'Invalid CSRF token', 'csrf_token' => CsrfMiddleware::getToken()]);
             exit;
         }
     }
@@ -97,13 +97,39 @@ try {
                 exit;
             }
 
+            $wf_active  = (int)($data['is_active'] ?? 1);
+
+            // status_transitions already has a DB-level UNIQUE KEY on
+            // (from_status, to_status) (regardless of is_active), so a
+            // duplicate pair can't actually be inserted — but hitting that
+            // constraint raw surfaces as an opaque "internal error occurred"
+            // to the admin instead of a clear message. Check first so the
+            // common case (an admin re-adding a pair that already exists)
+            // gets a friendly, specific error.
+            $dupCheck = $conn->prepare(
+                "SELECT transition_id FROM status_transitions WHERE from_status = ? AND to_status = ?"
+            );
+            $dupCheck->bind_param('ss', $data['from_status'], $data['to_status']);
+            $dupCheck->execute();
+            if ($dupCheck->get_result()->fetch_assoc()) {
+                $dupCheck->close();
+                http_response_code(409);
+                echo json_encode([
+                    'success' => false,
+                    'error' => 'A transition already exists for '
+                        . $data['from_status'] . ' → ' . $data['to_status']
+                        . ' — edit that row instead of creating a duplicate.',
+                ]);
+                exit;
+            }
+            $dupCheck->close();
+
             $stmt = $conn->prepare("INSERT INTO status_transitions (from_status, to_status, requires_comment, requires_admin, is_active)
                                     VALUES (?, ?, ?, ?, ?)");
             $wf_from    = $data['from_status'];
             $wf_to      = $data['to_status'];
             $wf_comment = (int)($data['requires_comment'] ?? 0);
             $wf_admin   = (int)($data['requires_admin'] ?? 0);
-            $wf_active  = (int)($data['is_active'] ?? 1);
             $stmt->bind_param('ssiii', $wf_from, $wf_to, $wf_comment, $wf_admin, $wf_active);
 
             if ($stmt->execute()) {
@@ -149,6 +175,28 @@ try {
                 exit;
             }
 
+            $wf_active  = (int)($data['is_active'] ?? 1);
+
+            // Same duplicate-pair guard as create, excluding this row itself.
+            $dupCheck = $conn->prepare(
+                "SELECT transition_id FROM status_transitions
+                 WHERE from_status = ? AND to_status = ? AND transition_id != ?"
+            );
+            $dupCheck->bind_param('ssi', $data['from_status'], $data['to_status'], $id);
+            $dupCheck->execute();
+            if ($dupCheck->get_result()->fetch_assoc()) {
+                $dupCheck->close();
+                http_response_code(409);
+                echo json_encode([
+                    'success' => false,
+                    'error' => 'A transition already exists for '
+                        . $data['from_status'] . ' → ' . $data['to_status']
+                        . ' — edit that row instead of creating a duplicate.',
+                ]);
+                exit;
+            }
+            $dupCheck->close();
+
             $stmt = $conn->prepare("UPDATE status_transitions SET
                                     from_status = ?, to_status = ?, requires_comment = ?, requires_admin = ?, is_active = ?
                                     WHERE transition_id = ?");
@@ -156,7 +204,6 @@ try {
             $wf_to      = $data['to_status'];
             $wf_comment = (int)($data['requires_comment'] ?? 0);
             $wf_admin   = (int)($data['requires_admin'] ?? 0);
-            $wf_active  = (int)($data['is_active'] ?? 1);
             $stmt->bind_param('ssiiii', $wf_from, $wf_to, $wf_comment, $wf_admin, $wf_active, $id);
 
             $success = $stmt->execute();

api/notifications.php

@@ -15,8 +15,10 @@
 
 require_once __DIR__ . '/bootstrap.php';
 require_once dirname(__DIR__) . '/models/UserPreferencesModel.php';
+require_once dirname(__DIR__) . '/models/TicketModel.php';
 
 $prefsModel = new UserPreferencesModel($conn);
+$ticketModel = new TicketModel($conn);
 
 // ── POST: mark all read (update last_seen timestamp) ──────────────
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
@@ -138,7 +140,7 @@ $statusSql = "SELECT DISTINCT
     COALESCE(u.display_name, u.username, 'System') AS actor_name
   FROM audit_log al
   LEFT JOIN users u ON al.user_id = u.user_id
-  INNER JOIN ticket_watchers tw ON tw.ticket_id = CAST(al.entity_id AS UNSIGNED) AND tw.user_id = ?
+  INNER JOIN ticket_watchers tw ON tw.ticket_id = al.entity_id AND tw.user_id = ?
   WHERE al.action_type = 'update'
     AND al.entity_type = 'ticket'
     AND al.user_id != ?
@@ -204,7 +206,44 @@ foreach (array_merge($assignRows, $commentRows, $statusRows, $mentionRows) as $r
     $all[] = $row;
 }
 usort($all, fn($a, $b) => strcmp($b['created_at'], $a['created_at']));
-$all = array_slice($all, 0, 30);
+
+// Re-check current ticket visibility before surfacing anything: a
+// notification's audit_log entry reflects historical activity, but the
+// ticket's visibility (or the user's group/watcher standing) may have
+// tightened since. Without this, a notification still discloses the
+// ticket's title and that activity occurred to someone who currently
+// shouldn't see it, even though the ticket view's own access check would
+// correctly reject them from opening it.
+$candidateTicketIds = [];
+foreach ($all as $row) {
+    $details = json_decode($row['details'] ?? '{}', true) ?? [];
+    $actionType = ($row['action_type'] === 'create' && $row['entity_type'] === 'comment')
+        ? 'comment'
+        : $row['action_type'];
+    $tid = ($actionType === 'comment' || $actionType === 'mention')
+        ? ($details['ticket_id'] ?? 0)
+        : $row['entity_id'];
+    if ($tid) {
+        $candidateTicketIds[(string)$tid] = true;
+    }
+}
+$ticketsById = !empty($candidateTicketIds)
+    ? $ticketModel->getTicketsByIds(array_keys($candidateTicketIds))
+    : [];
+
+$all = array_filter($all, function ($row) use ($ticketsById, $currentUser, $ticketModel) {
+    $details = json_decode($row['details'] ?? '{}', true) ?? [];
+    $actionType = ($row['action_type'] === 'create' && $row['entity_type'] === 'comment')
+        ? 'comment'
+        : $row['action_type'];
+    $tid = (string)(($actionType === 'comment' || $actionType === 'mention')
+        ? ($details['ticket_id'] ?? 0)
+        : $row['entity_id']);
+    $ticket = $ticketsById[$tid] ?? null;
+    return $ticket && $ticketModel->canUserAccessTicket($ticket, $currentUser);
+});
+
+$all = array_slice(array_values($all), 0, 30);
 
 // Format for response
 $notifications = [];
@@ -225,10 +264,21 @@ foreach ($all as $row) {
         'comment' => "{$row['actor_name']} commented on ticket #{$ticketId}",
         'mention' => "{$row['actor_name']} mentioned you on ticket #{$ticketId}",
         'update'  => (function () use ($row, $details, $ticketId) {
-            // logTicketUpdate stores delta as {"status": {"from": "Open", "to": "In Progress"}}
+            // Visibility changes log a flat {field, from, to} shape (api/update_ticket.php).
-            $from = $details['status']['from'] ?? ($details['old_value'] ?? '?');
+            if (isset($details['field'], $details['from'], $details['to'])) {
-            $to   = $details['status']['to']   ?? ($details['new_value'] ?? '?');
+                return "{$row['actor_name']} changed {$details['field']} on #{$ticketId}: {$details['from']} → {$details['to']}";
-            return "{$row['actor_name']} changed status on #{$ticketId}: {$from} → {$to}";
+            }
+
+            // Single/bulk field updates log a per-field delta, e.g.
+            // {"status": {"from": "Open", "to": "In Progress"}}. Only one field
+            // changed at a time is reported, in priority order below.
+            foreach (['status', 'priority', 'title', 'category', 'type', 'description'] as $field) {
+                if (isset($details[$field]['from'], $details[$field]['to'])) {
+                    return "{$row['actor_name']} changed {$field} on #{$ticketId}: {$details[$field]['from']} → {$details[$field]['to']}";
+                }
+            }
+
+            return "{$row['actor_name']} updated ticket #{$ticketId}";
         })(),
         default   => "{$row['actor_name']} updated ticket #{$ticketId}",
     };

api/revoke_api_key.php

@@ -1,8 +1,8 @@
 <?php
 
 // API endpoint for revoking API keys (Admin only)
-error_reporting(E_ALL);
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
-ini_set('display_errors', 0);
+ErrorHandler::init();
 
 // Apply rate limiting
 require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
@@ -39,8 +39,15 @@ try {
     if ($_SERVER['REQUEST_METHOD'] === 'POST') {
         $csrfToken = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
         if (!CsrfMiddleware::validateToken($csrfToken)) {
+            ob_end_clean();
             http_response_code(403);
-            throw new Exception("Invalid CSRF token");
+            header('Content-Type: application/json');
+            echo json_encode([
+                'success' => false,
+                'error' => 'Invalid CSRF token',
+                'csrf_token' => CsrfMiddleware::getToken()
+            ]);
+            exit;
         }
     }
 

api/ticket_comment_api.php

@@ -18,8 +18,8 @@
 
 header('Content-Type: application/json');
 
-error_reporting(E_ALL);
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
-ini_set('display_errors', 0);
+ErrorHandler::init();
 
 require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
 RateLimitMiddleware::apply('api');

api/ticket_custom_fields.php

@@ -0,0 +1,87 @@
+<?php
+
+/**
+ * Save custom field values for a ticket.
+ *
+ * POST { ticket_id, values: { [field_id]: value, ... } }
+ *
+ * Only fields applicable to the ticket's current category (or category-less
+ * fields) are considered; anything else in `values` is ignored rather than
+ * persisted, so a value typed for a field that no longer applies (e.g. the
+ * category changed) can't linger as orphaned/misleading data.
+ */
+
+require_once __DIR__ . '/bootstrap.php';
+require_once dirname(__DIR__) . '/models/TicketModel.php';
+require_once dirname(__DIR__) . '/models/CustomFieldModel.php';
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+    http_response_code(405);
+    apiRespond(['success' => false, 'error' => 'Method not allowed']);
+}
+
+$data = json_decode(file_get_contents('php://input'), true);
+$ticketId = isset($data['ticket_id']) ? trim((string)$data['ticket_id']) : '';
+$values = is_array($data['values'] ?? null) ? $data['values'] : [];
+
+if ($ticketId === '') {
+    http_response_code(400);
+    apiRespond(['success' => false, 'error' => 'ticket_id required']);
+}
+
+$ticketModel = new TicketModel($conn);
+$ticket = $ticketModel->getTicketById($ticketId);
+if (!$ticket || !$ticketModel->canUserAccessTicket($ticket, $currentUser)) {
+    http_response_code(404);
+    apiRespond(['success' => false, 'error' => 'Ticket not found']);
+}
+
+$fieldModel = new CustomFieldModel($conn);
+$definitions = $fieldModel->getAllDefinitions($ticket['category'], true);
+
+$errors = [];
+$toSave = [];
+foreach ($definitions as $def) {
+    $fieldId = (int)$def['field_id'];
+    $raw = $values[$fieldId] ?? ($values[(string)$fieldId] ?? null);
+
+    if ($def['field_type'] === 'checkbox') {
+        $normalized = !empty($raw) ? '1' : '0';
+    } else {
+        $normalized = is_scalar($raw) ? trim((string)$raw) : '';
+    }
+
+    if (!empty($def['is_required']) && $def['field_type'] !== 'checkbox' && $normalized === '') {
+        $errors[] = $def['field_label'] . ' is required';
+        continue;
+    }
+
+    if ($def['field_type'] === 'select' && $normalized !== '') {
+        $allowedOptions = $def['field_options']['options'] ?? [];
+        if (!in_array($normalized, $allowedOptions, true)) {
+            $errors[] = $def['field_label'] . ' has an invalid selection';
+            continue;
+        }
+    }
+
+    if ($def['field_type'] === 'number' && $normalized !== '' && !is_numeric($normalized)) {
+        $errors[] = $def['field_label'] . ' must be a number';
+        continue;
+    }
+
+    $toSave[$fieldId] = $normalized;
+}
+
+if (!empty($errors)) {
+    http_response_code(422);
+    apiRespond(['success' => false, 'error' => implode('; ', $errors)]);
+}
+
+$fieldModel->setValues($ticketId, $toSave);
+
+require_once dirname(__DIR__) . '/models/AuditLogModel.php';
+(new AuditLogModel($conn))->log($userId, 'update', 'ticket', $ticketId, [
+    'reason' => 'custom fields updated',
+]);
+
+apiRespond(['success' => true]);

api/ticket_dependencies.php

@@ -98,7 +98,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' || $_SERVER['REQUEST_METHOD'] === 'DEL
     require_once dirname(__DIR__) . '/middleware/CsrfMiddleware.php';
     $csrfToken = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
     if (!CsrfMiddleware::validateToken($csrfToken)) {
-        ResponseHelper::forbidden('Invalid CSRF token');
+        ResponseHelper::error('Invalid CSRF token', 403, ['csrf_token' => CsrfMiddleware::getToken()]);
     }
 }
 

api/ticket_status_api.php

@@ -22,8 +22,8 @@
 
 header('Content-Type: application/json');
 
-error_reporting(E_ALL);
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
-ini_set('display_errors', 0);
+ErrorHandler::init();
 
 require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
 RateLimitMiddleware::apply('api');
@@ -126,23 +126,6 @@ if ($workflowModel->transitionRequiresComment($currentStatus, $newStatus) && $co
     exit;
 }
 
-// Post the comment first (per-key label) so a close-with-reason is one call.
-if ($comment !== '') {
-    $commentModel = new CommentModel($conn);
-    $commentResult = $commentModel->addComment($ticketId, [
-        'user_name' => $keyName,
-        'comment_text' => $comment,
-        'markdown_enabled' => !empty($data['markdown_enabled']),
-    ], $createdBy);
-    if (empty($commentResult['success'])) {
-        error_log('ticket_status_api: addComment failed for ticket ' . $ticketId
-            . ': ' . ($commentResult['error'] ?? 'unknown'));
-        http_response_code(500);
-        echo json_encode(['success' => false, 'error' => 'Failed to add comment']);
-        exit;
-    }
-}
-
 // Apply the status change. updateTicket sets updated_by/updated_at and handles
 // closed_at (set on close, cleared on reopen) via its own SQL.
 $updateData = [
@@ -155,10 +138,33 @@ $updateData = [
     'priority' => (int)$ticket['priority'],
 ];
 
-$updateResult = $ticketModel->updateTicket($updateData, $createdBy);
+// Post the comment and apply the status change in one transaction, so a
-if (empty($updateResult['success'])) {
+// failure partway through can't leave a "reason" comment persisted with no
-    error_log('ticket_status_api: updateTicket failed for ticket ' . $ticketId
+// matching status change (previously these were two independent writes with
-        . ': ' . ($updateResult['error'] ?? 'unknown'));
+// no shared rollback).
+$conn->begin_transaction();
+try {
+    if ($comment !== '') {
+        $commentModel = new CommentModel($conn);
+        $commentResult = $commentModel->addComment($ticketId, [
+            'user_name' => $keyName,
+            'comment_text' => $comment,
+            'markdown_enabled' => !empty($data['markdown_enabled']),
+        ], $createdBy);
+        if (empty($commentResult['success'])) {
+            throw new Exception($commentResult['error'] ?? 'Failed to add comment');
+        }
+    }
+
+    $updateResult = $ticketModel->updateTicket($updateData, $createdBy);
+    if (empty($updateResult['success'])) {
+        throw new Exception($updateResult['error'] ?? 'Failed to update ticket status');
+    }
+
+    $conn->commit();
+} catch (Exception $e) {
+    $conn->rollback();
+    error_log('ticket_status_api: transaction failed for ticket ' . $ticketId . ': ' . $e->getMessage());
     http_response_code(500);
     echo json_encode(['success' => false, 'error' => 'Failed to update ticket status']);
     exit;
@@ -171,7 +177,8 @@ if ($currentStatus !== $newStatus) {
         $currentStatus,
         $newStatus,
         (string)$ticket['title'],
-        $keyName
+        $keyName,
+        $ticket['visibility'] ?? 'public'
     );
     NotificationHelper::notifyWatchers(
         $conn,

api/tickets_api.php

@@ -14,8 +14,8 @@
 
 header('Content-Type: application/json');
 
-error_reporting(E_ALL);
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
-ini_set('display_errors', 0);
+ErrorHandler::init();
 
 // Rate limiting (same pattern as the other Bearer API endpoints)
 require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';

api/update_comment.php

@@ -5,8 +5,8 @@
  */
 
 // Disable error display in the output
-ini_set('display_errors', 0);
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
-error_reporting(E_ALL);
+ErrorHandler::init();
 
 // Apply rate limiting
 require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
@@ -104,7 +104,10 @@ try {
             'update',
             'comment',
             (string)$commentId,
-            ['comment_text_preview' => substr($commentText, 0, 100)]
+            [
+                'ticket_id' => $comment['ticket_id'] ?? null,
+                'comment_text_preview' => substr($commentText, 0, 100),
+            ]
         );
     }
 

api/update_ticket.php

@@ -1,8 +1,8 @@
 <?php
 
 // Enable error reporting for debugging
-error_reporting(E_ALL);
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
-ini_set('display_errors', 0); // Don't display errors in the response
+ErrorHandler::init();
 
 // Apply rate limiting
 require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
@@ -195,8 +195,8 @@ try {
 
                 // Enforce requires_comment transitions server-side.
                 if ($this->workflowModel->transitionRequiresComment($currentTicket['status'], $updateData['status'])) {
-                    $comment = trim((string)($data['comment'] ?? $data['comment_text'] ?? ''));
+                    $statusChangeComment = trim((string)($data['comment'] ?? $data['comment_text'] ?? ''));
-                    if ($comment === '') {
+                    if ($statusChangeComment === '') {
                         return [
                             'success' => false,
                             'error' => 'A comment is required for this status change',
@@ -207,40 +207,67 @@ try {
                 }
             }
 
-            // Update ticket with user tracking and optional optimistic locking
+            // A comment accompanying a status change (required or optional) is
-            $expectedUpdatedAt = $data['expected_updated_at'] ?? null;
+            // persisted in the SAME transaction as the status update below, so
-            $result = $this->ticketModel->updateTicket($updateData, $this->userId, $expectedUpdatedAt);
+            // a failure partway through can't leave an orphaned "reason"
+            // comment attached with no matching status change — the two
+            // previously ran as separate, non-transactional HTTP calls from
+            // the client (add_comment.php then update_ticket.php).
+            $statusChangeComment = $statusChangeComment ?? trim((string)($data['comment'] ?? $data['comment_text'] ?? ''));
 
-            // Handle conflict case
+            $result = null;
-            if (!$result['success']) {
+            $this->conn->begin_transaction();
-                $response = [
+            try {
-                    'success' => false,
+                if ($statusChangeComment !== '' && $currentTicket['status'] !== $updateData['status']) {
-                    'error' => $result['error'] ?? 'Failed to update ticket in database'
+                    $commentResult = $this->commentModel->addComment($id, [
-                ];
+                        'user_name' => $this->currentUser['display_name'] ?? $this->currentUser['username'] ?? 'User',
-                if (!empty($result['conflict'])) {
+                        'comment_text' => $statusChangeComment,
+                        'markdown_enabled' => !empty($data['markdown_enabled']),
+                    ], $this->userId);
+                    if (empty($commentResult['success'])) {
+                        throw new Exception($commentResult['error'] ?? 'Failed to add comment');
+                    }
+                }
+
+                // Update ticket with user tracking and optional optimistic locking
+                $expectedUpdatedAt = $data['expected_updated_at'] ?? null;
+                $result = $this->ticketModel->updateTicket($updateData, $this->userId, $expectedUpdatedAt);
+                if (!$result['success']) {
+                    throw new Exception($result['error'] ?? 'Failed to update ticket in database');
+                }
+
+                // Handle visibility update if provided (already validated above)
+                if (isset($data['visibility'])) {
+                    $visResult = $this->ticketModel->updateVisibility($id, $data['visibility'], $visibilityGroups, $this->userId);
+                    if (!$visResult) {
+                        throw new Exception('Failed to update ticket visibility');
+                    }
+                }
+
+                $this->conn->commit();
+            } catch (Exception $e) {
+                $this->conn->rollback();
+                $response = ['success' => false, 'error' => $e->getMessage()];
+                if (is_array($result) && !empty($result['conflict'])) {
                     $response['conflict'] = true;
                     $response['current_updated_at'] = $result['current_updated_at'] ?? null;
                 }
                 return $response;
             }
 
-            // Handle visibility update if provided (already validated above)
+            if (isset($data['visibility']) && $this->userId) {
-            if (isset($data['visibility'])) {
+                $this->auditLog->log(
-                $visResult = $this->ticketModel->updateVisibility($id, $data['visibility'], $visibilityGroups, $this->userId);
+                    $this->userId,
-                if ($visResult && $this->userId) {
+                    'update',
-                    $this->auditLog->log(
+                    'ticket',
-                        $this->userId,
+                    (string)$id,
-                        'update',
+                    [
-                        'ticket',
+                        'field'      => 'visibility',
-                        (string)$id,
+                        'from'       => $currentTicket['visibility'] ?? 'public',
-                        [
+                        'to'         => $data['visibility'],
-                            'field'      => 'visibility',
+                        'groups'     => $visibilityGroups
-                            'from'       => $currentTicket['visibility'] ?? 'public',
+                    ]
-                            'to'         => $data['visibility'],
+                );
-                            'groups'     => $visibilityGroups
-                        ]
-                    );
-                }
             }
 
             // Log ticket update to audit log — only the changed fields (delta)
@@ -267,7 +294,8 @@ try {
                     $currentTicket['status'],
                     $updateData['status'],
                     $updateData['title'],
-                    $changedBy
+                    $changedBy,
+                    $currentTicket['visibility'] ?? 'public'
                 );
                 NotificationHelper::notifyWatchers(
                     $this->conn,
@@ -275,7 +303,8 @@ try {
                     $updateData['title'],
                     'status_changed',
                     ['old_status' => $currentTicket['status'], 'new_status' => $updateData['status'], 'changed_by' => $changedBy],
-                    (int)$this->userId
+                    (int)$this->userId,
+                    $currentTicket['visibility'] ?? 'public'
                 );
             }
 

api/upload_attachment.php

@@ -7,8 +7,8 @@
  */
 
 // Capture errors for debugging
-ini_set('display_errors', 0);
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
-error_reporting(E_ALL);
+ErrorHandler::init();
 
 // Apply rate limiting (also starts session)
 require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
@@ -29,6 +29,139 @@ require_once dirname(__DIR__) . '/middleware/CsrfMiddleware.php';
 
 header('Content-Type: application/json');
 
+/**
+ * Strip EXIF/metadata (including GPS) from an image file in place by
+ * decoding and re-encoding it via GD, which drops metadata chunks that
+ * aren't part of the pixel data. Best-effort: leaves the file untouched on
+ * any failure (corrupt image, unsupported format, GD unavailable) rather
+ * than blocking the upload — original bytes are what would have been stored
+ * anyway before this existed.
+ *
+ * download_attachment.php streams attachments back byte-for-byte to any user
+ * with ticket visibility, so an unstripped phone photo's embedded GPS data
+ * would otherwise leak a data center/office's physical location even on a
+ * Confidential-visibility ticket.
+ */
+function stripImageMetadata(string $path, string $mimeType): void
+{
+    if (!extension_loaded('gd')) {
+        return;
+    }
+
+    // Guard against a decompression-bomb-style crafted image (small file,
+    // huge decoded pixel buffer) exhausting memory during decode.
+    $dims = @getimagesize($path);
+    if ($dims === false) {
+        return;
+    }
+    [$width, $height] = $dims;
+    if ($width * $height > 40_000_000) { // ~40 MP cap
+        return;
+    }
+
+    $loaders = [
+        'image/jpeg' => 'imagecreatefromjpeg',
+        'image/png'  => 'imagecreatefrompng',
+        'image/gif'  => 'imagecreatefromgif',
+        'image/webp' => 'imagecreatefromwebp',
+    ];
+    $loader = $loaders[$mimeType] ?? null;
+    if ($loader === null || !function_exists($loader)) {
+        return;
+    }
+
+    $image = @$loader($path);
+    if ($image === false) {
+        return;
+    }
+
+    // Preserve transparency for formats that support it.
+    imagesavealpha($image, true);
+    imagealphablending($image, false);
+
+    $tmpPath = $path . '.tmp';
+    $saved = match ($mimeType) {
+        'image/jpeg' => imagejpeg($image, $tmpPath, 90),
+        'image/png'  => imagepng($image, $tmpPath, 6),
+        'image/gif'  => imagegif($image, $tmpPath),
+        'image/webp' => imagewebp($image, $tmpPath, 90),
+        default      => false,
+    };
+    imagedestroy($image);
+
+    if ($saved && file_exists($tmpPath)) {
+        rename($tmpPath, $path);
+    } elseif (file_exists($tmpPath)) {
+        unlink($tmpPath);
+    }
+}
+
+/**
+ * Generate a resized preview thumbnail for an uploaded image, saved as a JPEG
+ * alongside the original regardless of source format (a thumbnail is a small
+ * lossy preview, not an archival copy). Longest side capped at
+ * THUMBNAIL_MAX_DIMENSION; images already at or below that size are still
+ * re-encoded (cheap) rather than skipped, so the thumbnail is guaranteed to
+ * be a JPEG the grid can always request the same way.
+ *
+ * Best-effort like stripImageMetadata(): returns null on any failure
+ * (corrupt image, unsupported format, GD unavailable) rather than blocking
+ * the upload, and the caller falls back to serving the full-size original.
+ *
+ * @return string|null Basename of the generated thumbnail file, or null
+ */
+function generateThumbnail(string $path, string $mimeType, string $destDir): ?string
+{
+    if (!extension_loaded('gd')) {
+        return null;
+    }
+
+    // Same decompression-bomb guard as stripImageMetadata().
+    $dims = @getimagesize($path);
+    if ($dims === false) {
+        return null;
+    }
+    [$width, $height] = $dims;
+    if ($width * $height > 40_000_000) { // ~40 MP cap
+        return null;
+    }
+
+    $loaders = [
+        'image/jpeg' => 'imagecreatefromjpeg',
+        'image/png'  => 'imagecreatefrompng',
+        'image/gif'  => 'imagecreatefromgif',
+        'image/webp' => 'imagecreatefromwebp',
+    ];
+    $loader = $loaders[$mimeType] ?? null;
+    if ($loader === null || !function_exists($loader)) {
+        return null;
+    }
+
+    $source = @$loader($path);
+    if ($source === false) {
+        return null;
+    }
+
+    $maxDimension = 300;
+    $scale = min(1.0, $maxDimension / max($width, $height));
+    $thumbWidth  = max(1, (int)round($width * $scale));
+    $thumbHeight = max(1, (int)round($height * $scale));
+
+    $thumb = imagecreatetruecolor($thumbWidth, $thumbHeight);
+    // Flatten transparency onto white — thumbnails are always opaque JPEGs.
+    $white = imagecolorallocate($thumb, 255, 255, 255);
+    imagefill($thumb, 0, 0, $white);
+    imagecopyresampled($thumb, $source, 0, 0, 0, 0, $thumbWidth, $thumbHeight, $width, $height);
+    imagedestroy($source);
+
+    $thumbFilename = pathinfo($path, PATHINFO_FILENAME) . '_thumb.jpg';
+    $thumbPath = rtrim($destDir, '/') . '/' . $thumbFilename;
+    $saved = imagejpeg($thumb, $thumbPath, 80);
+    imagedestroy($thumb);
+
+    return $saved ? $thumbFilename : null;
+}
+
 // Check authentication
 if (!isset($_SESSION['user']) || !isset($_SESSION['user']['user_id'])) {
     ResponseHelper::unauthorized();
@@ -47,6 +180,9 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
         ResponseHelper::error('Invalid ticket ID format');
     }
 
+    $offset = isset($_GET['offset']) ? max(0, (int)$_GET['offset']) : 0;
+    $limit  = isset($_GET['limit'])  ? min(100, max(1, (int)$_GET['limit'])) : 40;
+
     try {
         $conn = Database::getConnection();
         $ticketModel = new TicketModel($conn);
@@ -56,15 +192,24 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
         }
 
         $attachmentModel = new AttachmentModel($conn);
-        $attachments = $attachmentModel->getAttachments($ticketId);
+        $total = $attachmentModel->getAttachmentCount($ticketId);
+        $attachments = $attachmentModel->getAttachments($ticketId, $limit, $offset);
 
         // Add formatted file size and icon to each attachment
         foreach ($attachments as &$att) {
             $att['file_size_formatted'] = AttachmentModel::formatFileSize($att['file_size']);
             $att['icon'] = AttachmentModel::getFileIcon($att['mime_type']);
+            $att['has_thumbnail'] = !empty($att['thumbnail_filename']);
+            unset($att['thumbnail_filename']); // internal storage detail, not needed by the client
         }
 
-        ResponseHelper::success(['attachments' => $attachments]);
+        ResponseHelper::success([
+            'attachments' => $attachments,
+            'total'       => $total,
+            'offset'      => $offset,
+            'limit'       => $limit,
+            'has_more'    => ($offset + $limit) < $total,
+        ]);
     } catch (Exception $e) {
         ResponseHelper::serverError('Failed to load attachments');
     }
@@ -78,7 +223,7 @@ if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
 // Verify CSRF token
 $csrfToken = $_POST['csrf_token'] ?? $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
 if (!CsrfMiddleware::validateToken($csrfToken)) {
-    ResponseHelper::forbidden('Invalid CSRF token');
+    ResponseHelper::error('Invalid CSRF token', 403, ['csrf_token' => CsrfMiddleware::getToken()]);
 }
 
 // Get ticket ID
@@ -127,6 +272,23 @@ if ($file['size'] > $maxSize) {
     ResponseHelper::error('File size exceeds maximum allowed (' . AttachmentModel::formatFileSize($maxSize) . ')');
 }
 
+// Check per-ticket attachment count/storage quota — bounds an authenticated
+// low-privilege user slowly filling the uploads/ disk across many tickets,
+// which was previously bounded only by the request-rate limiter, not volume.
+$attachmentModel = new AttachmentModel($conn);
+$maxAttachments = $GLOBALS['config']['MAX_ATTACHMENTS_PER_TICKET'] ?? 50;
+if ($attachmentModel->getAttachmentCount($ticketId) >= $maxAttachments) {
+    ResponseHelper::error("This ticket already has the maximum of {$maxAttachments} attachments");
+}
+
+$maxTotalSize = $GLOBALS['config']['MAX_TOTAL_ATTACHMENT_SIZE_PER_TICKET'] ?? 104857600;
+if ($attachmentModel->getTotalSizeForTicket($ticketId) + $file['size'] > $maxTotalSize) {
+    ResponseHelper::error(
+        'This upload would exceed the ticket\'s total attachment size limit of '
+        . AttachmentModel::formatFileSize($maxTotalSize)
+    );
+}
+
 // Get MIME type
 $finfo = new finfo(FILEINFO_MIME_TYPE);
 $mimeType = $finfo->file($file['tmp_name']);
@@ -184,6 +346,16 @@ if (!move_uploaded_file($file['tmp_name'], $targetPath)) {
     ResponseHelper::serverError('Failed to move uploaded file');
 }
 
+// Strip EXIF/GPS metadata from image uploads before it's ever served back,
+// then generate a resized preview thumbnail from the (now metadata-stripped)
+// original so the grid never has to transfer the full-size file just to
+// render a small preview.
+$thumbnailFilename = null;
+if (str_starts_with($mimeType, 'image/')) {
+    stripImageMetadata($targetPath, $mimeType);
+    $thumbnailFilename = generateThumbnail($targetPath, $mimeType, $ticketDir);
+}
+
 // Sanitize original filename
 $originalFilename = basename($file['name']);
 $originalFilename = preg_replace('/[^\w\s\-\.]/', '', $originalFilename);
@@ -193,19 +365,22 @@ if (empty($originalFilename)) {
 
 // Save to database
 try {
-    $attachmentModel = new AttachmentModel($conn);
     $attachmentId = $attachmentModel->addAttachment(
         $ticketId,
         $uniqueFilename,
         $originalFilename,
         $file['size'],
         $mimeType,
-        $_SESSION['user']['user_id']
+        $_SESSION['user']['user_id'],
+        $thumbnailFilename
     );
 
     if (!$attachmentId) {
-        // Clean up file if database insert fails
+        // Clean up file (and any thumbnail) if database insert fails
         unlink($targetPath);
+        if ($thumbnailFilename !== null) {
+            @unlink($ticketDir . '/' . $thumbnailFilename);
+        }
         ResponseHelper::serverError('Failed to save attachment record');
     }
 
@@ -232,13 +407,17 @@ try {
         'file_size_formatted' => AttachmentModel::formatFileSize($file['size']),
         'mime_type' => $mimeType,
         'icon' => AttachmentModel::getFileIcon($mimeType),
+        'has_thumbnail' => $thumbnailFilename !== null,
         'uploaded_by' => $_SESSION['user']['display_name'] ?? $_SESSION['user']['username'],
         'uploaded_at' => date('Y-m-d H:i:s')
     ], 'File uploaded successfully');
 } catch (Exception $e) {
-    // Clean up file on error
+    // Clean up file (and any thumbnail) on error
     if (file_exists($targetPath)) {
         unlink($targetPath);
     }
+    if (isset($thumbnailFilename) && $thumbnailFilename !== null) {
+        @unlink($ticketDir . '/' . $thumbnailFilename);
+    }
     ResponseHelper::serverError('Failed to process attachment');
 }

api/user_avatar.php

@@ -11,8 +11,8 @@
  *   Returns 404 if the user has no avatar set in lldap.
  */
 
-ini_set('display_errors', 0);
+require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
-error_reporting(E_ALL);
+ErrorHandler::init();
 
 require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
 RateLimitMiddleware::apply('api');

api/watch_ticket.php

@@ -12,40 +12,43 @@ require_once dirname(__DIR__) . '/models/TicketModel.php';
 
 $data = json_decode(file_get_contents('php://input'), true) ?? [];
 
-$ticketId = isset($_GET['ticket_id'])
+$ticketIdRaw = isset($_GET['ticket_id']) ? $_GET['ticket_id'] : ($data['ticket_id'] ?? '');
-    ? (int)$_GET['ticket_id']
-    : (int)($data['ticket_id'] ?? 0);
 
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
-    $ticketId = (int)($data['ticket_id'] ?? 0);
+    $ticketIdRaw = $data['ticket_id'] ?? '';
-    $action   = $data['action'] ?? '';
+    $action      = $data['action'] ?? '';
 
-    if ($ticketId <= 0 || !in_array($action, ['watch', 'unwatch'], true)) {
+    if ($ticketIdRaw === '' || !in_array($action, ['watch', 'unwatch'], true)) {
         http_response_code(400);
         echo json_encode(['success' => false, 'error' => 'Invalid parameters']);
         exit;
     }
 
     $ticketModel = new TicketModel($conn);
-    $ticket = $ticketModel->getTicketById($ticketId);
+    $ticket = $ticketModel->getTicketById((string)$ticketIdRaw);
     if (!$ticket || !$ticketModel->canUserAccessTicket($ticket, $currentUser)) {
         http_response_code(404);
         echo json_encode(['success' => false, 'error' => 'Ticket not found']);
         exit;
     }
 
+    // Use the canonical ticket_id string from the fetched ticket row, not the
+    // raw request value, so ticket_watchers always stores exactly what's in
+    // tickets.ticket_id.
+    $ticketId = $ticket['ticket_id'];
+
     if ($action === 'watch') {
         $stmt = $conn->prepare(
             "INSERT IGNORE INTO ticket_watchers (ticket_id, user_id) VALUES (?, ?)"
         );
-        $stmt->bind_param("ii", $ticketId, $userId);
+        $stmt->bind_param("si", $ticketId, $userId);
         $stmt->execute();
         $stmt->close();
     } else {
         $stmt = $conn->prepare(
             "DELETE FROM ticket_watchers WHERE ticket_id = ? AND user_id = ?"
         );
-        $stmt->bind_param("ii", $ticketId, $userId);
+        $stmt->bind_param("si", $ticketId, $userId);
         $stmt->execute();
         $stmt->close();
     }
@@ -54,7 +57,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     $countStmt = $conn->prepare(
         "SELECT COUNT(*) as cnt FROM ticket_watchers WHERE ticket_id = ?"
     );
-    $countStmt->bind_param("i", $ticketId);
+    $countStmt->bind_param("s", $ticketId);
     $countStmt->execute();
     $count = (int)$countStmt->get_result()->fetch_assoc()['cnt'];
     $countStmt->close();
@@ -73,7 +76,7 @@ if ($_SERVER['REQUEST_METHOD'] !== 'GET') {
     exit;
 }
 
-if ($ticketId <= 0) {
+if ($ticketIdRaw === '') {
     http_response_code(400);
     echo json_encode(['success' => false, 'error' => 'ticket_id required']);
     exit;
@@ -83,17 +86,19 @@ if ($ticketId <= 0) {
 // restricted ticket's watcher list and count aren't disclosed (the POST path
 // already checks this).
 $ticketModel = new TicketModel($conn);
-$ticket = $ticketModel->getTicketById($ticketId);
+$ticket = $ticketModel->getTicketById((string)$ticketIdRaw);
 if (!$ticket || !$ticketModel->canUserAccessTicket($ticket, $currentUser)) {
     http_response_code(404);
     echo json_encode(['success' => false, 'error' => 'Ticket not found']);
     exit;
 }
 
+$ticketId = $ticket['ticket_id'];
+
 $watchingStmt = $conn->prepare(
     "SELECT COUNT(*) as cnt FROM ticket_watchers WHERE ticket_id = ? AND user_id = ?"
 );
-$watchingStmt->bind_param("ii", $ticketId, $userId);
+$watchingStmt->bind_param("si", $ticketId, $userId);
 $watchingStmt->execute();
 $watching = (bool)$watchingStmt->get_result()->fetch_assoc()['cnt'];
 $watchingStmt->close();
@@ -107,7 +112,7 @@ $watchersStmt = $conn->prepare(
       ORDER BY tw.created_at ASC
       LIMIT 6"
 );
-$watchersStmt->bind_param("i", $ticketId);
+$watchersStmt->bind_param("s", $ticketId);
 $watchersStmt->execute();
 $watchersResult = $watchersStmt->get_result();
 $watchers = [];
@@ -118,7 +123,7 @@ $watchersStmt->close();
 
 // True watcher count (the list above is capped at 6 for the avatar group)
 $countStmt = $conn->prepare("SELECT COUNT(*) AS cnt FROM ticket_watchers WHERE ticket_id = ?");
-$countStmt->bind_param("i", $ticketId);
+$countStmt->bind_param("s", $ticketId);
 $countStmt->execute();
 $count = (int)$countStmt->get_result()->fetch_assoc()['cnt'];
 $countStmt->close();

assets/css/base.css

@@ -66,6 +66,7 @@
   --accent-green-bright: #33FFAA;
   --accent-green-dim:    rgba(0,255,136,0.10);
   --accent-green-border: rgba(0,255,136,0.22);
+  --shadow-color:        rgba(0,0,0,0.5);
 
   /* --- Error / Critical --- */
   --accent-red:     #FF2D55;
@@ -3640,6 +3641,8 @@ html[data-theme="light"] {
   --accent-red-dim:      rgba(181,0,31,0.10);
   --accent-amber-dim:    rgba(138,90,0,0.10);
   --accent-cyan-border:  rgba(0,98,184,0.28);
+  --accent-green-border: rgba(0,109,53,0.28);
+  --shadow-color:        rgba(50,80,130,0.18);
 
   /* — Glows become subtle drop shadows in light mode — */
   --glow-orange:         0 0 0 1px rgba(196,78,0,0.25),  0 1px 6px rgba(196,78,0,0.18);
@@ -3737,6 +3740,25 @@ html[data-theme="light"] .lt-textarea:focus-visible {
   border-color: var(--accent-cyan);
   box-shadow: var(--box-glow-cyan);
 }
+
+/* Native <select> popup in light mode.
+   `.lt-select` sets `color-scheme: dark` on the element itself, which beats the
+   `color-scheme: light` declared on <html>, so the browser drew the dropdown with
+   dark chrome even in light mode. Reset it per element, and re-tint the option
+   list, which is otherwise hardcoded to #0d1117 for the dark theme. */
+html[data-theme="light"] .lt-select { color-scheme: light; }
+html[data-theme="light"] .lt-select option,
+html[data-theme="light"] select option {
+  background: var(--bg-input);
+  color: var(--text-primary);
+}
+html[data-theme="light"] .lt-select option:hover,
+html[data-theme="light"] .lt-select option:focus,
+html[data-theme="light"] .lt-select option:checked,
+html[data-theme="light"] select option:checked {
+  background: var(--accent-orange-dim);
+  color: var(--accent-orange);
+}
 html[data-theme="light"] .lt-label { color: var(--text-muted); }
 
 /* — Buttons — */

assets/css/dashboard.css

@@ -338,17 +338,22 @@ kbd {
 }
 
 /* ── Ticket preview popup ────────────────────────────────────── */
+/* --lt-surface is not defined anywhere, so the background always fell through to
+   the hardcoded #0a0e14 — a near-black panel in light mode, with no colour set at
+   all, so the inherited near-black body text was invisible on it. These tokens
+   are redefined for light mode in base.css. */
 .ticket-preview-popup {
   position: fixed;
   z-index: 9999;
-  background: var(--lt-surface, #0a0e14);
+  background: var(--bg-card);
-  border: 1px solid rgba(0, 255, 65, 0.4);
+  color: var(--text-primary);
+  border: 1px solid var(--accent-green-border);
   padding: 0.75rem;
   min-width: 280px;
   max-width: 360px;
   font-size: 0.75rem;
   pointer-events: auto;
-  box-shadow: 0 4px 20px rgba(0,0,0,0.5);
+  box-shadow: 0 4px 20px var(--shadow-color);
 }
 .ticket-preview-popup .preview-header {
   display: flex;
@@ -356,7 +361,7 @@ kbd {
   align-items: center;
   margin-bottom: 0.4rem;
 }
-.ticket-preview-popup .preview-id   { color: var(--lt-cyan, #00ffff); font-weight: 700; }
+.ticket-preview-popup .preview-id   { color: var(--accent-cyan); font-weight: 700; }
 .ticket-preview-popup .preview-title { font-weight: 600; margin-bottom: 0.4rem; }
 .ticket-preview-popup .preview-meta { opacity: 0.7; display: flex; flex-direction: column; gap: 0.1rem; }
 .ticket-preview-popup .preview-footer { margin-top: 0.4rem; opacity: 0.5; font-size: 0.65rem; }

assets/css/ticket.css

@@ -54,10 +54,18 @@ body.edit-mode .editable-metadata {
   text-transform: uppercase;
   letter-spacing: 0.05em;
 }
-.lt-status-select.lt-status-open      { color: var(--lt-success, #00ff41); border-color: var(--lt-success, #00ff41); }
+/* --lt-success / --lt-amber / --lt-cyan / --lt-danger are not defined anywhere,
-.lt-status-select.lt-status-pending   { color: var(--lt-amber,   #ffb000); border-color: var(--lt-amber,   #ffb000); }
+   so these always fell through to the hardcoded neon fallbacks — unreadable on
-.lt-status-select.lt-status-in-progress { color: var(--lt-cyan,  #00ffff); border-color: var(--lt-cyan,   #00ffff); }
+   the light theme's white input background. The --accent-* tokens carry the same
-.lt-status-select.lt-status-closed    { color: var(--lt-danger,  #ff4d4d); border-color: var(--lt-danger, #ff4d4d); }
+   hues and are redefined for light mode in base.css.
+
+   The leading .lt-select is needed for specificity: base.css's
+   `html[data-theme="light"] .lt-select` (0,2,1) would otherwise outrank a plain
+   two-class selector and repaint every status the same near-black. */
+.lt-select.lt-status-select.lt-status-open        { color: var(--accent-green); border-color: var(--accent-green); }
+.lt-select.lt-status-select.lt-status-pending     { color: var(--accent-amber); border-color: var(--accent-amber); }
+.lt-select.lt-status-select.lt-status-in-progress { color: var(--accent-cyan);  border-color: var(--accent-cyan); }
+.lt-select.lt-status-select.lt-status-closed      { color: var(--accent-red);   border-color: var(--accent-red); }
 
 /* ── Ticket meta KV grid ─────────────────────────────────────── */
 .ticket-meta-grid {

assets/js/advanced-search.js

@@ -61,25 +61,46 @@ function populateCurrentFilters() {
     const urlParams = new URLSearchParams(window.location.search);
 
     // Search text
-    if (urlParams.has('search')) {
+    document.getElementById('adv-search-text').value = urlParams.get('search') || '';
-        document.getElementById('adv-search-text').value = urlParams.get('search');
-    }
 
     // Status
-    if (urlParams.has('status')) {
+    const statuses = urlParams.has('status') ? urlParams.get('status').split(',') : [];
-        const statuses = urlParams.get('status').split(',');
+    const statusSelect = document.getElementById('adv-status');
-        const statusSelect = document.getElementById('adv-status');
+    Array.from(statusSelect.options).forEach(option => {
-        Array.from(statusSelect.options).forEach(option => {
+        option.selected = statuses.includes(option.value);
-            option.selected = statuses.includes(option.value);
+    });
-        });
+
-    }
+    // Date ranges
+    document.getElementById('adv-created-from').value = urlParams.get('created_from') || '';
+    document.getElementById('adv-created-to').value = urlParams.get('created_to') || '';
+    document.getElementById('adv-updated-from').value = urlParams.get('updated_from') || '';
+    document.getElementById('adv-updated-to').value = urlParams.get('updated_to') || '';
+
+    // Priority range
+    document.getElementById('adv-priority-min').value = urlParams.get('priority_min') || '';
+    document.getElementById('adv-priority-max').value = urlParams.get('priority_max') || '';
+
+    // Users
+    document.getElementById('adv-created-by').value = urlParams.get('created_by') || '';
+    document.getElementById('adv-assigned-to').value = urlParams.get('assigned_to') || '';
 }
 
 // Perform advanced search
 function performAdvancedSearch(event) {
     event.preventDefault();
 
-    const params = new URLSearchParams();
+    // Start from the CURRENT URL's params, not a fresh set, so a filter this
+    // form doesn't represent (e.g. a category/type filter applied via a
+    // dashboard quick-filter pill or stats-widget click) isn't silently
+    // dropped on submit. Only the params this form actually controls are
+    // set/cleared below; everything else passes through untouched.
+    const params = new URLSearchParams(window.location.search);
+    const advParams = [
+        'search', 'created_from', 'created_to', 'updated_from', 'updated_to',
+        'status', 'priority_min', 'priority_max', 'created_by', 'assigned_to',
+    ];
+    advParams.forEach(key => params.delete(key));
+    params.delete('page'); // filters changed — reset to page 1
 
     // Search text
     const searchText = document.getElementById('adv-search-text').value.trim();
@@ -87,11 +108,17 @@ function performAdvancedSearch(event) {
         params.set('search', searchText);
     }
 
-    // Date ranges
+    // Date ranges — swap if the user entered an end date before the start date
-    const createdFrom = document.getElementById('adv-created-from').value;
+    let createdFrom = document.getElementById('adv-created-from').value;
-    const createdTo = document.getElementById('adv-created-to').value;
+    let createdTo = document.getElementById('adv-created-to').value;
-    const updatedFrom = document.getElementById('adv-updated-from').value;
+    if (createdFrom && createdTo && createdFrom > createdTo) {
-    const updatedTo = document.getElementById('adv-updated-to').value;
+        [createdFrom, createdTo] = [createdTo, createdFrom];
+    }
+    let updatedFrom = document.getElementById('adv-updated-from').value;
+    let updatedTo = document.getElementById('adv-updated-to').value;
+    if (updatedFrom && updatedTo && updatedFrom > updatedTo) {
+        [updatedFrom, updatedTo] = [updatedTo, updatedFrom];
+    }
 
     if (createdFrom) params.set('created_from', createdFrom);
     if (createdTo) params.set('created_to', createdTo);
@@ -105,9 +132,12 @@ function performAdvancedSearch(event) {
         params.set('status', selectedStatuses.join(','));
     }
 
-    // Priority range
+    // Priority range — swap if min > max so the range is always satisfiable
-    const priorityMin = document.getElementById('adv-priority-min').value;
+    let priorityMin = document.getElementById('adv-priority-min').value;
-    const priorityMax = document.getElementById('adv-priority-max').value;
+    let priorityMax = document.getElementById('adv-priority-max').value;
+    if (priorityMin && priorityMax && Number(priorityMin) > Number(priorityMax)) {
+        [priorityMin, priorityMax] = [priorityMax, priorityMin];
+    }
     if (priorityMin) params.set('priority_min', priorityMin);
     if (priorityMax) params.set('priority_max', priorityMax);
 

assets/js/base.js

@@ -41,6 +41,16 @@
  *  32.  Drag & Drop Upload
  *  33.  Intersection Observer
  *  34.  Full Initialisation
+ *
+ * NOTE ON EMPTY CATCH BLOCKS: throughout this file, `try { ... } catch (_) {}`
+ * around localStorage/sessionStorage access (persisted tab/theme/column-
+ * visibility state, recent command-palette entries, etc.) and the terminal
+ * beep's AudioContext calls is intentional, not an oversight — these are
+ * best-effort UX affordances that must silently no-op rather than break the
+ * surrounding feature if storage is disabled/full (private browsing, quota)
+ * or audio is blocked (autoplay policy). Swallowing errors from arbitrary
+ * caller-supplied callbacks (e.g. viewport-change listeners) is handled
+ * separately with real logging, since those can hide genuine bugs.
  */
 
 (function (global) {
@@ -241,6 +251,11 @@
         trigger.focus();
       }
     }
+    // Announce the close so whoever opened the modal can undo optimistic UI or
+    // clean up a dynamically-inserted overlay. A modal can be dismissed four
+    // ways — the ✕ button, a Cancel button, a backdrop click, and Escape — and
+    // the last two are handled globally here, so button-only listeners miss them.
+    el.dispatchEvent(new CustomEvent('lt:modalclose', { bubbles: true }));
   }
 
   function closeAllModals() {
@@ -1393,7 +1408,7 @@
     _vpCurrent = bp;
     if (bp !== prev) {
       const evt = { bp, w, h, prev };
-      _vpListeners.forEach(cb => { try { cb(evt); } catch (_) {} });
+      _vpListeners.forEach(cb => { try { cb(evt); } catch (e) { console.error('[lt.viewport] listener threw:', e); } });
       bus.emit('viewport:change', evt);
     }
   }
@@ -2470,6 +2485,101 @@
 
       list.addEventListener('drop', e => { e.preventDefault(); });
 
+      // Touch fallback — iOS Safari doesn't implement HTML5 drag-and-drop on
+      // arbitrary elements at all, and mobile Chrome's support is poor, so
+      // kanban drag was effectively unusable via touch without this. Touch
+      // events for a given touch point are always dispatched to the element
+      // touchstart fired on (per spec), so per-list local state here is safe;
+      // cross-list moves are resolved via elementFromPoint against the live
+      // finger position, same as dragover does via e.target above.
+      const DRAG_THRESHOLD = 8; // px of movement before a touch starts a drag
+      let _touchItem = null, _touchDragging = false;
+      let _touchStartX = 0, _touchStartY = 0, _touchOffsetX = 0, _touchOffsetY = 0;
+
+      function _touchTargetList(x, y) {
+        const el = document.elementFromPoint(x, y);
+        const found = el ? el.closest('[data-sortable-group]') : null;
+        return found && (found === list || _sameGroup(found)) ? found : null;
+      }
+
+      list.addEventListener('touchstart', e => {
+        const item = e.target.closest('[data-sortable-item]');
+        if (!item || !list.contains(item)) return;
+        if (handle && !e.target.closest(handle)) return;
+        const t = e.touches[0];
+        _touchItem = item;
+        _touchDragging = false;
+        _touchStartX = t.clientX;
+        _touchStartY = t.clientY;
+      }, { passive: true });
+
+      // touchmove/touchend/touchcancel are registered on document, not list:
+      // once the dragged item is reparented to document.body below, it's no
+      // longer a descendant of list, so events targeting it (touch events
+      // keep targeting their touchstart element for the whole gesture) would
+      // stop bubbling to a listener on list.
+      document.addEventListener('touchmove', e => {
+        if (!_touchItem) return;
+        const t = e.touches[0];
+
+        if (!_touchDragging) {
+          if (Math.abs(t.clientX - _touchStartX) < DRAG_THRESHOLD && Math.abs(t.clientY - _touchStartY) < DRAG_THRESHOLD) return;
+          // Drag intent confirmed — take over from here, blocking page scroll.
+          _touchDragging = true;
+          _srtDragging = _touchItem;
+          _srtSrcList  = list;
+          _srtPlaceholder = _makePlaceholder(_touchItem);
+          _touchItem.classList.add('is-dragging');
+          const rect = _touchItem.getBoundingClientRect();
+          _touchOffsetX = _touchStartX - rect.left;
+          _touchOffsetY = _touchStartY - rect.top;
+          _touchItem.parentNode.insertBefore(_srtPlaceholder, _touchItem);
+          _touchItem.style.position = 'fixed';
+          _touchItem.style.zIndex = '1000';
+          _touchItem.style.width = rect.width + 'px';
+          _touchItem.style.pointerEvents = 'none';
+          document.body.appendChild(_touchItem); // avoid clipping by an overflow:hidden ancestor
+        }
+
+        e.preventDefault();
+        _touchItem.style.left = (t.clientX - _touchOffsetX) + 'px';
+        _touchItem.style.top  = (t.clientY - _touchOffsetY) + 'px';
+
+        const targetList = _touchTargetList(t.clientX, t.clientY);
+        if (!targetList) return;
+        const overEl = document.elementFromPoint(t.clientX, t.clientY);
+        const over = overEl ? overEl.closest('[data-sortable-item]') : null;
+        if (over && over !== _srtDragging && targetList.contains(over)) {
+          const rect = over.getBoundingClientRect();
+          targetList.insertBefore(_srtPlaceholder, t.clientY < rect.top + rect.height / 2 ? over : over.nextSibling);
+        } else if (!targetList.contains(_srtPlaceholder)) {
+          targetList.appendChild(_srtPlaceholder);
+        }
+      }, { passive: false });
+
+      function _touchEnd() {
+        if (_touchDragging && _srtDragging) {
+          _srtDragging.classList.remove('is-dragging');
+          _srtDragging.style.position = '';
+          _srtDragging.style.zIndex = '';
+          _srtDragging.style.width = '';
+          _srtDragging.style.pointerEvents = '';
+          _srtDragging.style.left = '';
+          _srtDragging.style.top = '';
+          if (_srtPlaceholder && _srtPlaceholder.parentNode) {
+            _srtPlaceholder.parentNode.insertBefore(_srtDragging, _srtPlaceholder);
+            _srtPlaceholder.remove();
+          }
+          if (onSort) onSort(_getItems(), _srtDragging);
+          bus.emit('sortable:change', { list, items: _getItems(), moved: _srtDragging });
+        }
+        _touchItem = null; _touchDragging = false;
+        _srtDragging = null; _srtPlaceholder = null; _srtSrcList = null;
+      }
+
+      document.addEventListener('touchend', _touchEnd);
+      document.addEventListener('touchcancel', _touchEnd);
+
       return {
         refresh() { Array.from(list.children).forEach(child => { if (!child.hasAttribute('data-sortable-item')) _mark(child); }); },
         getOrder: () => _getItems().map(el => el.dataset.id || el.textContent.trim()),
@@ -2701,7 +2811,7 @@
   };
 
   // Patch lt.api — auth-aware wrapper (renamed to avoid strict-mode duplicate declaration)
-  async function _apiFetchAuth(method, url, body) {
+  async function _apiFetchAuth(method, url, body, retried) {
     if (_authAccess && auth.isExpiringSoon()) await auth.refresh();
     const opts = { method, headers: Object.assign({ 'Content-Type': 'application/json' }, csrfHeaders()) };
     if (_authAccess) opts.headers['Authorization'] = 'Bearer ' + _authAccess;
@@ -2721,6 +2831,15 @@
     // Resync CSRF token from any response body that carries a fresh one
     // (bootstrap rotates on success and returns the current token on rejection).
     if (data && data.csrf_token) global.CSRF_TOKEN = data.csrf_token;
+    // Auto-retry once on a stale-CSRF-token 403: the token lifetime (1h) is
+    // shorter than the session idle timeout (5h), so this is a routine,
+    // recoverable case (an hour of inactivity, or a write in another tab
+    // rotating the shared token) rather than a real rejection — resyncing
+    // above already has the fresh token, so silently resending once succeeds
+    // transparently instead of surfacing a confusing error on the first try.
+    if (resp.status === 403 && !retried && data && data.csrf_token) {
+      return _apiFetchAuth(method, url, body, true);
+    }
     if (!resp.ok) {
       const err = new Error(data.error || data.message || 'HTTP ' + resp.status);
       err.data = data;
@@ -2739,8 +2858,11 @@
      TICKET STATUS CHANGE (comment-aware)
      lt.ticketStatus.submit(ticketId, newStatus, { comment? }) → Promise<data>
      Posts /api/update_ticket.php. If the server rejects with
-     requires_comment, opens a comment modal, persists the comment via
+     requires_comment, opens a comment modal, then retries the update once
-     /api/add_comment.php, then retries the update once WITH the comment.
+     WITH the comment — update_ticket.php persists it in the same DB
+     transaction as the status change itself, so there's no separate
+     add_comment.php call that could leave an orphaned comment if the
+     status update then failed.
      Rejects with err.cancelled === true if the user cancels the modal.
      ================================================================ */
   function _statusCommentModal(newStatus) {
@@ -2774,6 +2896,9 @@
         setTimeout(() => { if (modalEl && modalEl.parentNode) modalEl.remove(); }, 300);
         resolve(value);
       };
+      // Any dismissal counts as "no comment given", including a backdrop click or
+      // Escape, which close the overlay through the global handlers above.
+      modalEl.addEventListener('lt:modalclose', () => finish(null));
       modalEl.querySelector('[data-modal-close]').addEventListener('click', () => finish(null));
       document.getElementById(modalId + '_cancel').addEventListener('click', () => finish(null));
       document.getElementById(modalId + '_confirm').addEventListener('click', () => {
@@ -2800,81 +2925,14 @@
             cancelErr.cancelled = true;
             throw cancelErr;
           }
-          // Persist the comment, then retry the status change with it included.
+          // Retry with the comment included — update_ticket.php persists it
-          return api.post('/api/add_comment.php', { ticket_id: id, comment_text: comment })
+          // transactionally with the status update itself.
-            .then(() => api.post('/api/update_ticket.php', { ticket_id: id, status: newStatus, comment: comment }));
+          return api.post('/api/update_ticket.php', { ticket_id: id, status: newStatus, comment: comment });
         });
       });
     },
   };
 
-  /* ================================================================
-     MODULE 54 — MARKDOWN RENDERER
-     lt.markdown.render(mdString)  → HTML string (sanitized)
-     lt.markdown.init(selector)    → renders all matching el's .textContent
-     Uses a built-in micro-renderer (no deps) for common syntax.
-     For full GFM, swap in marked.js: window.marked && marked.parse()
-     ================================================================ */
-  const markdown = {
-    render(md) {
-      // Always use the built-in XSS-safe micro-renderer. Do NOT delegate to
-      // window.marked / window.markdownit: their raw HTML output is not sanitized
-      // here, so delegating would enable stored XSS if such a lib were ever loaded.
-      // Micro-renderer: covers headings, bold, italic, code, links, lists, blockquote, hr
-      let html = escHtml(md)
-        // Fenced code blocks
-        .replace(/```(\w*)\n([\s\S]*?)```/g, (_, lang, code) => `<pre class="lt-code-block"><code class="lt-tok tok-${lang || 'plain'}">${code.trim()}</code></pre>`)
-        // Inline code
-        .replace(/`([^`]+)`/g, '<code>$1</code>')
-        // Headings
-        .replace(/^######\s(.+)$/gm, '<h6>$1</h6>')
-        .replace(/^#####\s(.+)$/gm,  '<h5>$1</h5>')
-        .replace(/^####\s(.+)$/gm,   '<h4>$1</h4>')
-        .replace(/^###\s(.+)$/gm,    '<h3>$1</h3>')
-        .replace(/^##\s(.+)$/gm,     '<h2>$1</h2>')
-        .replace(/^#\s(.+)$/gm,      '<h1>$1</h1>')
-        // Bold / italic
-        .replace(/\*\*\*(.+?)\*\*\*/g, '<strong><em>$1</em></strong>')
-        .replace(/\*\*(.+?)\*\*/g,     '<strong>$1</strong>')
-        .replace(/\*(.+?)\*/g,         '<em>$1</em>')
-        .replace(/__(.+?)__/g,         '<strong>$1</strong>')
-        .replace(/_(.+?)_/g,           '<em>$1</em>')
-        // Links — block javascript: and data: URIs
-        .replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_, text, url) => {
-          const safeUrl = /^(https?:\/\/|\/|#|\.\.?\/)/i.test(url) ? url : '#';
-          return `<a href="${safeUrl}" target="_blank" rel="noopener noreferrer">${escHtml(text)}</a>`;
-        })
-        // Images — block javascript: and data: URIs
-        .replace(/!\[([^\]]*)\]\(([^)]+)\)/g, (_, alt, src) => {
-          const safeSrc = /^(https?:\/\/|\/|\.\.?\/)/i.test(src) ? src : '';
-          return `<img src="${safeSrc}" alt="${escHtml(alt)}" style="max-width:100%">`;
-        })
-        // Blockquote
-        .replace(/^&gt;\s(.+)$/gm, '<blockquote>$1</blockquote>')
-        // Horizontal rule
-        .replace(/^(-{3,}|\*{3,}|_{3,})$/gm, '<hr>')
-        // Unordered list items
-        .replace(/^[-*+]\s(.+)$/gm, '<li>$1</li>')
-        .replace(/(<li>[\s\S]+?<\/li>\n?)+/g, m => `<ul>${m}</ul>`)
-        // Ordered list items
-        .replace(/^\d+\.\s(.+)$/gm, '<li>$1</li>')
-        // Paragraphs (double newline)
-        .replace(/\n{2,}/g, '</p><p>')
-        .replace(/\n/g, '<br>');
-      return `<p>${html}</p>`
-        .replace(/<p>(<(?:pre|ul|ol|h[1-6]|blockquote|hr)[^>]*>)/g, '$1')
-        .replace(/(<\/(?:pre|ul|ol|h[1-6]|blockquote|hr)>)<\/p>/g, '$1');
-    },
-
-    init(selector) {
-      document.querySelectorAll(selector).forEach(el => {
-        const raw = el.getAttribute('data-markdown') || el.textContent;
-        el.innerHTML = markdown.render(raw);
-        el.classList.add('lt-markdown');
-      });
-    },
-  };
-
   /* ================================================================
      MODULE 55 — PAGINATION
      lt.pagination.init(navEl, opts)
@@ -3037,7 +3095,6 @@
     timer,
     lightbox,
     auth,
-    markdown,
     ticketStatus,
     pagination,
     sidebarSubmenus: { init: initSidebarSubmenus },

assets/js/dashboard.js

@@ -140,25 +140,25 @@ document.addEventListener('DOMContentLoaded', function() {
                 break;
             // Bulk operation perform actions
             case 'perform-bulk-assign':
-                performBulkAssign();
+                performBulkAssign(target);
                 break;
             case 'close-bulk-assign-modal':
                 closeBulkAssignModal();
                 break;
             case 'perform-bulk-priority':
-                performBulkPriority();
+                performBulkPriority(target);
                 break;
             case 'close-bulk-priority-modal':
                 closeBulkPriorityModal();
                 break;
             case 'perform-bulk-status':
-                performBulkStatusChange();
+                performBulkStatusChange(target);
                 break;
             case 'close-bulk-status-modal':
                 closeBulkStatusModal();
                 break;
             case 'perform-bulk-close':
-                performBulkCloseAction();
+                performBulkCloseAction(undefined, target);
                 break;
             case 'close-bulk-close-modal':
                 closeBulkCloseModal();
@@ -297,8 +297,12 @@ function clearAllFilters() {
     params.delete('type');
     params.delete('assigned_to');
     params.delete('search');
-    params.delete('date_from');
+    params.delete('created_from');
-    params.delete('date_to');
+    params.delete('created_to');
+    params.delete('updated_from');
+    params.delete('updated_to');
+    params.delete('closed_from');
+    params.delete('closed_to');
     params.delete('page');
 
     // Keep sort parameters
@@ -357,14 +361,9 @@ function initSidebarFilters() {
     }
 
     if (clearFiltersBtn) {
-        clearFiltersBtn.addEventListener('click', () => {
+        // Delegate to clearAllFilters() so both controls always clear the same
-            const params = new URLSearchParams(window.location.search);
+        // complete set of filter params instead of two independently-maintained lists.
-            ['status','category','type',
+        clearFiltersBtn.addEventListener('click', clearAllFilters);
-             'created_from','created_to','updated_from','updated_to','closed_from','closed_to'
-            ].forEach(k => params.delete(k));
-            params.set('page', '1');
-            window.location.search = params.toString();
-        });
     }
 }
 
@@ -381,73 +380,6 @@ function initSettingsModal() {
     }
 }
 
-function sortTable(table, column) {
-    const headers = table.querySelectorAll('th');
-    headers.forEach(header => {
-        header.classList.remove('sort-asc', 'sort-desc');
-    });
-
-    const rows = Array.from(table.querySelectorAll('tbody tr'));
-    const currentDirection = table.dataset.sortColumn == column 
-        ? (table.dataset.sortDirection === 'asc' ? 'desc' : 'asc')
-        : 'asc';
-    
-    table.dataset.sortColumn = column;
-    table.dataset.sortDirection = currentDirection;
-    
-    rows.sort((a, b) => {
-        const aValue = a.children[column].textContent.trim();
-        const bValue = b.children[column].textContent.trim();
-
-        // Check if this is a date column — prefer data-ts attribute over text (which may be relative)
-        const headerText = headers[column].textContent.toLowerCase();
-        if (headerText === 'created' || headerText === 'updated') {
-            const cellA = a.children[column];
-            const cellB = b.children[column];
-            const dateA = new Date(cellA.dataset.ts || aValue);
-            const dateB = new Date(cellB.dataset.ts || bValue);
-            return currentDirection === 'asc' ? dateA - dateB : dateB - dateA;
-        }
-
-        // Special handling for "Assigned To" column
-        if (headerText === 'assigned to') {
-            const aUnassigned = aValue === 'Unassigned';
-            const bUnassigned = bValue === 'Unassigned';
-
-            // Both unassigned - equal
-            if (aUnassigned && bUnassigned) return 0;
-
-            // Put unassigned at the end regardless of sort direction
-            if (aUnassigned) return 1;
-            if (bUnassigned) return -1;
-
-            // Otherwise sort names normally
-            return currentDirection === 'asc'
-                ? aValue.localeCompare(bValue)
-                : bValue.localeCompare(aValue);
-        }
-
-        // Numeric comparison
-        const numA = parseFloat(aValue);
-        const numB = parseFloat(bValue);
-
-        if (!isNaN(numA) && !isNaN(numB)) {
-            return currentDirection === 'asc' ? numA - numB : numB - numA;
-        }
-
-        // String comparison
-        return currentDirection === 'asc'
-            ? aValue.localeCompare(bValue)
-            : bValue.localeCompare(aValue);
-    });
-    
-    const currentHeader = headers[column];
-    currentHeader.classList.add(currentDirection === 'asc' ? 'sort-asc' : 'sort-desc');
-    
-    const tbody = table.querySelector('tbody');
-    rows.forEach(row => tbody.appendChild(row));
-}
-
 // Old settings modal functions removed - now using settings.js with new settings modal
 
 
@@ -550,7 +482,7 @@ function bulkClose() {
     `;
 
     document.body.insertAdjacentHTML('beforeend', modalHtml);
-    lt.modal.open('bulkCloseModal');
+    openModalWithDismiss('bulkCloseModal', closeBulkCloseModal);
 }
 
 function closeBulkCloseModal() {
@@ -559,7 +491,10 @@ function closeBulkCloseModal() {
     if (modal) setTimeout(() => modal.remove(), 300);
 }
 
-function performBulkCloseAction(ticketIds) {
+function performBulkCloseAction(ticketIds, btn) {
+    if (btn && btn.disabled) return; // already in flight — guards against a double-click firing two requests
+    if (btn) btn.disabled = true;
+
     ticketIds = ticketIds || getSelectedTicketIds();
     const commentEl = document.getElementById('bulkCloseComment');
     const comment = commentEl ? commentEl.value.trim() : '';
@@ -592,7 +527,8 @@ function performBulkCloseAction(ticketIds) {
         }
         closeBulkCloseModal();
         lt.toast.error('Bulk close failed: ' + error.message, 5000);
-    });
+    })
+    .finally(() => { if (btn) btn.disabled = false; });
 }
 
 var _bulkAssignUserId = null;
@@ -633,7 +569,7 @@ function showBulkAssignModal() {
     `;
 
     document.body.insertAdjacentHTML('beforeend', modalHtml);
-    lt.modal.open('bulkAssignModal');
+    openModalWithDismiss('bulkAssignModal', closeBulkAssignModal);
     setTimeout(() => { const inp = document.getElementById('bulkAssignUserInput'); if (inp) inp.focus(); }, 120);
 
     lt.api.get('/api/get_users.php')
@@ -664,7 +600,8 @@ function closeBulkAssignModal() {
     if (modal) setTimeout(() => modal.remove(), 300);
 }
 
-function performBulkAssign() {
+function performBulkAssign(btn) {
+    if (btn && btn.disabled) return; // already in flight — guards against a double-click firing two requests
     const userId = _bulkAssignUserId;
     const ticketIds = getSelectedTicketIds();
 
@@ -673,6 +610,8 @@ function performBulkAssign() {
         return;
     }
 
+    if (btn) btn.disabled = true;
+
     lt.api.post('/api/bulk_operation.php', {
         operation_type: 'bulk_assign',
         ticket_ids: ticketIds,
@@ -693,7 +632,8 @@ function performBulkAssign() {
     })
     .catch(error => {
         lt.toast.error('Bulk assign failed: ' + error.message, 5000);
-    });
+    })
+    .finally(() => { if (btn) btn.disabled = false; });
 }
 
 function showBulkPriorityModal() {
@@ -731,7 +671,7 @@ function showBulkPriorityModal() {
     `;
 
     document.body.insertAdjacentHTML('beforeend', modalHtml);
-    lt.modal.open('bulkPriorityModal');
+    openModalWithDismiss('bulkPriorityModal', closeBulkPriorityModal);
 }
 
 function closeBulkPriorityModal() {
@@ -740,7 +680,8 @@ function closeBulkPriorityModal() {
     if (modal) setTimeout(() => modal.remove(), 300);
 }
 
-function performBulkPriority() {
+function performBulkPriority(btn) {
+    if (btn && btn.disabled) return; // already in flight — guards against a double-click firing two requests
     const priorityEl = document.getElementById('bulkPriority');
     if (!priorityEl) return;
     const priority = priorityEl.value;
@@ -751,6 +692,8 @@ function performBulkPriority() {
         return;
     }
 
+    if (btn) btn.disabled = true;
+
     lt.api.post('/api/bulk_operation.php', {
         operation_type: 'bulk_priority',
         ticket_ids: ticketIds,
@@ -771,7 +714,8 @@ function performBulkPriority() {
     })
     .catch(error => {
         lt.toast.error('Bulk priority update failed: ' + error.message, 5000);
-    });
+    })
+    .finally(() => { if (btn) btn.disabled = false; });
 }
 
 // Make table rows clickable
@@ -845,7 +789,7 @@ function showBulkStatusModal() {
     `;
 
     document.body.insertAdjacentHTML('beforeend', modalHtml);
-    lt.modal.open('bulkStatusModal');
+    openModalWithDismiss('bulkStatusModal', closeBulkStatusModal);
 }
 
 function closeBulkStatusModal() {
@@ -854,7 +798,8 @@ function closeBulkStatusModal() {
     if (modal) setTimeout(() => modal.remove(), 300);
 }
 
-function performBulkStatusChange() {
+function performBulkStatusChange(btn) {
+    if (btn && btn.disabled) return; // already in flight — guards against a double-click firing two requests
     const bulkStatusEl = document.getElementById('bulkStatus');
     if (!bulkStatusEl) return;
     const status = bulkStatusEl.value;
@@ -868,6 +813,8 @@ function performBulkStatusChange() {
     const commentEl = document.getElementById('bulkStatusComment');
     const comment = commentEl ? commentEl.value.trim() : '';
 
+    if (btn) btn.disabled = true;
+
     lt.api.post('/api/bulk_operation.php', {
         operation_type: 'bulk_status',
         ticket_ids: ticketIds,
@@ -897,7 +844,8 @@ function performBulkStatusChange() {
         }
         closeBulkStatusModal();
         lt.toast.error('Bulk status change failed: ' + error.message, 5000);
-    });
+    })
+    .finally(() => { if (btn) btn.disabled = false; });
 }
 
 /**
@@ -942,7 +890,7 @@ function showBulkDeleteModal() {
     `;
 
     document.body.insertAdjacentHTML('beforeend', modalHtml);
-    lt.modal.open('bulkDeleteModal');
+    openModalWithDismiss('bulkDeleteModal', closeBulkDeleteModal);
 }
 
 function closeBulkDeleteModal() {
@@ -1032,6 +980,22 @@ function showInputModal(title, label, placeholder = '', onSubmit, onCancel = nul
     input.addEventListener('keypress', (e) => { if (e.key === 'Enter') handleSubmit(); });
     document.getElementById(`${modalId}_cancel`).addEventListener('click', () => cleanup(onCancel));
     modal.querySelector('[data-modal-close]').addEventListener('click', () => cleanup(onCancel));
+    // Backdrop click / Escape close the overlay via base.js's global handlers.
+    modal.addEventListener('lt:modalclose', () => cleanup(onCancel));
+}
+
+/**
+ * Open a dynamically-inserted modal and make sure it tears itself down however it
+ * is dismissed. base.js handles backdrop clicks and Escape globally, so wiring
+ * only the ✕/Cancel buttons leaves the overlay in the DOM — and the next open
+ * inserts a second element with the same id, which then shadows the live one.
+ */
+function openModalWithDismiss(modalId, onDismiss) {
+    lt.modal.open(modalId);
+    const el = document.getElementById(modalId);
+    // lt.modal.close() early-returns once .is-open is gone, so the close call
+    // inside onDismiss cannot re-enter this listener.
+    if (el) el.addEventListener('lt:modalclose', onDismiss);
 }
 
 // ========================================
@@ -1069,7 +1033,7 @@ function quickStatusChange(ticketId, currentStatus) {
     `;
 
     document.body.insertAdjacentHTML('beforeend', modalHtml);
-    lt.modal.open('quickStatusModal');
+    openModalWithDismiss('quickStatusModal', closeQuickStatusModal);
 }
 
 function closeQuickStatusModal() {
@@ -1119,12 +1083,11 @@ function quickAssign(ticketId) {
                 <div class="lt-modal-body">
                     <p class="lt-mb-xs lt-text-muted lt-text-xs">Ticket #${lt.escHtml(String(ticketId))}</p>
                     <label class="lt-label">Assign to:</label>
-                    <div class="lt-combobox" id="quickAssignCombobox">
+                    <div class="lt-typeahead" id="quickAssignTypeahead" style="position:relative">
-                        <div class="lt-combobox-input-wrap">
+                        <input type="text" class="lt-input lt-w-full" id="quickAssignInput"
-                            <input type="text" class="lt-combobox-input" id="quickAssignInput"
+                               placeholder="Search users…" autocomplete="off" spellcheck="false"
-                                   placeholder="Search users…" autocomplete="off" aria-label="Search users">
+                               aria-label="Search users" aria-autocomplete="list">
-                        </div>
+                        <div class="lt-typeahead-dropdown" id="quickAssignDropdown"></div>
-                        <ul class="lt-combobox-list" role="listbox" aria-hidden="true"></ul>
                     </div>
                 </div>
                 <div class="lt-modal-footer">
@@ -1136,7 +1099,7 @@ function quickAssign(ticketId) {
     `;
 
     document.body.insertAdjacentHTML('beforeend', modalHtml);
-    lt.modal.open('quickAssignModal');
+    openModalWithDismiss('quickAssignModal', closeQuickAssignModal);
 
     lt.api.get('/api/get_users.php')
         .then(data => {
@@ -1150,7 +1113,9 @@ function quickAssign(ticketId) {
                         label: u.display_name || u.username
                     }))
                 ];
-                lt.combobox.init(input, items, {
+                lt.typeahead.init(input, items, {
+                    minChars: 1,
+                    maxResults: 8,
                     onSelect: function(item) { _quickAssignUserId = item.value || null; }
                 });
             }
@@ -1199,7 +1164,6 @@ function setViewMode(mode) {
     if (mode === 'card') {
         populateKanbanCards();
     }
-    localStorage.setItem('ticketViewMode', mode);
 }
 
 /**

assets/js/markdown.js

@@ -354,6 +354,33 @@ window.renderMarkdownElements = renderMarkdownElements;
 // Rich Text Editor Toolbar Functions
 // ========================================
 
+/**
+ * Replace textarea.value.substring(selStart, selEnd) with replacementText,
+ * preserving the browser's native undo/redo stack via
+ * document.execCommand('insertText', ...) -- the same mechanism real typing
+ * uses -- instead of a direct .value assignment, which discards the entire
+ * undo history. Falls back to a direct assignment (losing undo, matching the
+ * old behavior) only if execCommand is unavailable or unsuccessful.
+ */
+function insertTextPreservingUndo(textarea, replacementText, selStart, selEnd) {
+    textarea.focus();
+    textarea.setSelectionRange(selStart, selEnd);
+
+    let inserted = false;
+    if (typeof document.execCommand === 'function') {
+        try {
+            inserted = document.execCommand('insertText', false, replacementText);
+        } catch (e) {
+            inserted = false;
+        }
+    }
+
+    if (!inserted) {
+        const text = textarea.value;
+        textarea.value = text.substring(0, selStart) + replacementText + text.substring(selEnd);
+    }
+}
+
 /**
  * Insert markdown formatting around selection
  */
@@ -363,16 +390,13 @@ function insertMarkdownFormat(textareaId, prefix, suffix) {
 
     const start = textarea.selectionStart;
     const end = textarea.selectionEnd;
-    const text = textarea.value;
+    const selectedText = textarea.value.substring(start, end);
-    const selectedText = text.substring(start, end);
 
-    // Insert formatting
+    insertTextPreservingUndo(textarea, prefix + selectedText + suffix, start, end);
-    const newText = text.substring(0, start) + prefix + selectedText + suffix + text.substring(end);
-    textarea.value = newText;
 
     // Set cursor position
     if (selectedText) {
-        textarea.setSelectionRange(start + prefix.length, end + prefix.length);
+        textarea.setSelectionRange(start + prefix.length, start + prefix.length + selectedText.length);
     } else {
         textarea.setSelectionRange(start + prefix.length, start + prefix.length);
     }
@@ -391,9 +415,10 @@ function insertMarkdownText(textareaId, text) {
     if (!textarea) return;
 
     const start = textarea.selectionStart;
-    const value = textarea.value;
 
-    textarea.value = value.substring(0, start) + text + value.substring(start);
+    // Matches the prior behavior: insert before the selection start without
+    // deleting any currently-selected text (a collapsed replace range).
+    insertTextPreservingUndo(textarea, text, start, start);
     textarea.setSelectionRange(start + text.length, start + text.length);
     textarea.focus();
 
@@ -453,7 +478,7 @@ function toolbarList(textareaId) {
     }
 
     // Insert list marker at beginning of line
-    textarea.value = text.substring(0, lineStart) + '- ' + text.substring(lineStart);
+    insertTextPreservingUndo(textarea, '- ', lineStart, lineStart);
     textarea.setSelectionRange(start + 2, start + 2);
     textarea.focus();
 
@@ -474,13 +499,32 @@ function toolbarHeading(textareaId) {
     }
 
     // Insert heading marker at beginning of line
-    textarea.value = text.substring(0, lineStart) + '## ' + text.substring(lineStart);
+    insertTextPreservingUndo(textarea, '## ', lineStart, lineStart);
     textarea.setSelectionRange(start + 3, start + 3);
     textarea.focus();
 
     textarea.dispatchEvent(new Event('input', { bubbles: true }));
 }
 
+function toolbarTable(textareaId) {
+    const textarea = document.getElementById(textareaId);
+    if (!textarea) return;
+
+    const start = textarea.selectionStart;
+    const text = textarea.value;
+
+    // Insert on its own line(s), matching the blank-line-before convention
+    // toolbarList/toolbarHeading rely on the surrounding text for — a table
+    // needs a full line to itself both before and after the separator row.
+    const needsLeadingNewline = start > 0 && text[start - 1] !== '\n';
+    const template = (needsLeadingNewline ? '\n' : '')
+        + '| Header 1 | Header 2 |\n'
+        + '| --- | --- |\n'
+        + '| Cell 1 | Cell 2 |\n';
+
+    insertMarkdownText(textareaId, template);
+}
+
 function toolbarQuote(textareaId) {
     const textarea = document.getElementById(textareaId);
     if (!textarea) return;
@@ -495,7 +539,7 @@ function toolbarQuote(textareaId) {
     }
 
     // Insert quote marker at beginning of line
-    textarea.value = text.substring(0, lineStart) + '> ' + text.substring(lineStart);
+    insertTextPreservingUndo(textarea, '> ', lineStart, lineStart);
     textarea.setSelectionRange(start + 2, start + 2);
     textarea.focus();
 
@@ -519,6 +563,7 @@ function createEditorToolbar(textareaId, containerId) {
         <button type="button" data-toolbar-action="heading" data-textarea="${textareaId}" title="Heading">H</button>
         <button type="button" data-toolbar-action="list" data-textarea="${textareaId}" title="List">≡</button>
         <button type="button" data-toolbar-action="quote" data-textarea="${textareaId}" title="Quote">"</button>
+        <button type="button" data-toolbar-action="table" data-textarea="${textareaId}" title="Table">▦</button>
         <span class="toolbar-separator"></span>
         <button type="button" data-toolbar-action="link" data-textarea="${textareaId}" title="Link">[ @ ]</button>
     `;
@@ -538,6 +583,7 @@ function createEditorToolbar(textareaId, containerId) {
             case 'heading': toolbarHeading(targetId); break;
             case 'list': toolbarList(targetId); break;
             case 'quote': toolbarQuote(targetId); break;
+            case 'table': toolbarTable(targetId); break;
             case 'link': toolbarLink(targetId); break;
         }
     });
@@ -553,6 +599,7 @@ window.toolbarLink = toolbarLink;
 window.toolbarList = toolbarList;
 window.toolbarHeading = toolbarHeading;
 window.toolbarQuote = toolbarQuote;
+window.toolbarTable = toolbarTable;
 window.createEditorToolbar = createEditorToolbar;
 window.insertMarkdownFormat = insertMarkdownFormat;
 window.insertMarkdownText = insertMarkdownText;

assets/js/ticket.js

@@ -183,15 +183,35 @@ function toggleEditMode() {
 }
 
 /**
- * Compute avatar color class from display name (mirrors PHP crc32 % 4 logic)
+ * CRC-32 (IEEE 802.3 / zlib polynomial), matching PHP's crc32(). Operates on
+ * the UTF-8 byte sequence, same as PHP, so results agree for non-ASCII names.
+ */
+function crc32(str) {
+    var bytes = unescape(encodeURIComponent(str));
+    var table = crc32._table || (crc32._table = (function () {
+        var t = [];
+        for (var n = 0; n < 256; n++) {
+            var c = n;
+            for (var k = 0; k < 8; k++) {
+                c = (c & 1) ? (0xEDB88320 ^ (c >>> 1)) : (c >>> 1);
+            }
+            t[n] = c;
+        }
+        return t;
+    })());
+    var crc = -1;
+    for (var i = 0; i < bytes.length; i++) {
+        crc = (crc >>> 8) ^ table[(crc ^ bytes.charCodeAt(i)) & 0xFF];
+    }
+    return (crc ^ -1) >>> 0;
+}
+
+/**
+ * Compute avatar color class from display name (mirrors PHP's crc32 % 4 logic)
  */
 function avatarColorClass(displayName) {
     var colors = ['lt-avatar--orange', 'lt-avatar--green', 'lt-avatar--purple', ''];
-    var h = 0;
+    return colors[crc32(displayName) % 4];
-    for (var i = 0; i < displayName.length; i++) {
-        h = ((h << 5) - h + displayName.charCodeAt(i)) | 0;
-    }
-    return colors[Math.abs(h) % 4];
 }
 
 /**
@@ -284,7 +304,15 @@ function addComment() {
             // Clear the comment box
             const nc = document.getElementById('newComment');
             if (nc) nc.value = '';
-            
+
+            // Clear the live preview — clearing the textarea programmatically
+            // does not fire 'input', so updatePreview() never runs
+            const previewDiv = document.getElementById('markdownPreview');
+            if (previewDiv) {
+                previewDiv.innerHTML = '';
+                previewDiv.classList.add('is-hidden');
+            }
+
             // Format the comment text for display
             let displayText;
             if (isMarkdownEnabled) {
@@ -329,12 +357,17 @@ function togglePreview() {
 
     if (isPreviewEnabled) {
         preview.innerHTML = parseMarkdown(textarea.value);
-        textarea.addEventListener('input', updatePreview);
+        textarea.addEventListener('input', debouncedUpdatePreview);
     } else {
-        textarea.removeEventListener('input', updatePreview);
+        textarea.removeEventListener('input', debouncedUpdatePreview);
     }
 }
 
+// Re-running the full markdown parser on every single keystroke is wasted
+// work while the user is still mid-word; 150ms debounce keeps the preview
+// feeling live without re-parsing on every keystroke.
+const debouncedUpdatePreview = window.lt ? lt.debounce(updatePreview, 150) : updatePreview;
+
 function updatePreview() {
     const textarea = document.getElementById('newComment');
     const previewDiv = document.getElementById('markdownPreview');
@@ -424,6 +457,140 @@ function handleAssignmentChange() {
     });
 }
 
+// ========================================
+// SLA Priority-Alert Banner
+// ========================================
+
+const SLA_TARGET_HOURS = { 1: 8, 2: 24 };
+const SLA_META = {
+    1: { cls: 'lt-sla-p1', icon: '[ ! ]', label: 'P1 Critical' },
+    2: { cls: 'lt-sla-p2', icon: '[ ~ ]', label: 'P2 High' },
+};
+
+let slaTickTimer = null;
+
+function stopSlaTicker() {
+    if (slaTickTimer) {
+        clearInterval(slaTickTimer);
+        slaTickTimer = null;
+    }
+}
+
+function startSlaTicker(banner) {
+    stopSlaTicker();
+
+    const createdAt = parseInt(banner.dataset.createdAt, 10) * 1000;
+    const slaMs = parseInt(banner.dataset.slaHours, 10) * 3600 * 1000;
+    const deadline = createdAt + slaMs;
+    const elapsedEl = document.getElementById('slaElapsedTimer');
+    const countdownEl = document.getElementById('slaCountdownTimer');
+    const overrunEl = document.getElementById('slaOverrunTimer');
+    const fillBar = document.getElementById('slaProgressBar');
+    const progressWrap = document.getElementById('slaProgress');
+
+    function fmtHMS(ms) {
+        const s = Math.floor(Math.abs(ms) / 1000);
+        const h = Math.floor(s / 3600), m = Math.floor((s % 3600) / 60), ss = s % 60;
+        return [h, m, ss].map(n => String(n).padStart(2, '0')).join(':');
+    }
+
+    function tick() {
+        const now = Date.now();
+        const elapsed = now - createdAt;
+        const remaining = deadline - now;
+        const pct = Math.min(100, Math.round((elapsed / slaMs) * 100));
+
+        if (elapsedEl) elapsedEl.textContent = fmtHMS(elapsed);
+        if (fillBar) fillBar.style.width = pct + '%';
+        if (progressWrap) progressWrap.setAttribute('aria-label', 'SLA progress ' + pct + '%');
+
+        if (remaining > 0) {
+            if (countdownEl) countdownEl.textContent = fmtHMS(remaining) + ' remaining';
+        } else if (overrunEl) {
+            overrunEl.textContent = fmtHMS(-remaining);
+        }
+    }
+
+    tick();
+    slaTickTimer = setInterval(tick, 1000);
+}
+
+/**
+ * Render, update, or remove the SLA priority-alert banner for the given
+ * priority, matching what a fresh page load would show. Called on initial
+ * load and again whenever the ticket's priority changes client-side, so the
+ * banner never goes stale until a reload.
+ */
+function renderSlaBanner(priorityNum) {
+    const anchor = document.getElementById('priorityAlertBannerAnchor');
+    const existing = document.getElementById('priorityAlertBanner');
+    const meta = SLA_META[priorityNum];
+    const status = window.ticketData && window.ticketData.status;
+
+    if (!meta || status === 'Closed') {
+        if (existing) {
+            stopSlaTicker();
+            existing.remove();
+        }
+        return;
+    }
+
+    const createdAtSec = window.ticketData && window.ticketData.created_at_ts;
+    if (!createdAtSec || !anchor) return;
+
+    const slaTargetHours = SLA_TARGET_HOURS[priorityNum];
+    const elapsedSeconds = Math.floor(Date.now() / 1000) - createdAtSec;
+    const slaBreached = elapsedSeconds >= slaTargetHours * 3600;
+    const slaPct = Math.min(100, Math.round((elapsedSeconds / (slaTargetHours * 3600)) * 100));
+    const slaId = 'sla-' + window.ticketData.id;
+
+    let dismissed = false;
+    try {
+        dismissed = !!sessionStorage.getItem('lt_sla_dismissed_' + slaId);
+    } catch (e) { /* sessionStorage unavailable */ }
+
+    const banner = existing || document.createElement('div');
+    if (!existing) {
+        banner.id = 'priorityAlertBanner';
+        banner.setAttribute('role', 'alert');
+        banner.setAttribute('aria-live', 'polite');
+        banner.style.marginBottom = '0.75rem';
+        anchor.appendChild(banner);
+    }
+    banner.className = meta.cls;
+    banner.dataset.slaId = slaId;
+    banner.dataset.createdAt = String(createdAtSec);
+    banner.dataset.slaHours = String(slaTargetHours);
+    banner.hidden = dismissed;
+
+    banner.innerHTML =
+        `<span class="lt-sla-icon" aria-hidden="true">${meta.icon}</span>` +
+        '<div class="lt-sla-info">' +
+        `<div class="lt-sla-title">${lt.escHtml(meta.label)} — SLA: <span id="slaElapsedTimer"></span> elapsed of ${slaTargetHours}h limit` +
+        (slaBreached ? '&nbsp;<span class="lt-text-danger" id="slaBreachLabel">BREACHED</span>' : '') +
+        '</div>' +
+        `<div class="lt-sla-bar" aria-label="SLA progress ${slaPct}%" id="slaProgress">` +
+        `<div class="lt-sla-fill" id="slaProgressBar" style="width:${slaPct}%"></div>` +
+        '</div>' +
+        '</div>' +
+        (slaBreached
+            ? `<div class="lt-sla-meta lt-text-danger" id="slaCountdownTimer">+<span id="slaOverrunTimer">${Math.round((elapsedSeconds - slaTargetHours * 3600) / 360) / 10}h</span> over</div>`
+            : '<div class="lt-sla-meta" id="slaCountdownTimer"></div>') +
+        '<button type="button" class="lt-sla-dismiss" aria-label="Dismiss">&#x2715;</button>';
+
+    banner.querySelector('.lt-sla-dismiss').addEventListener('click', function() {
+        banner.hidden = true;
+        stopSlaTicker();
+        try { sessionStorage.setItem('lt_sla_dismissed_' + slaId, '1'); } catch (e) { /* ignore */ }
+    });
+
+    if (dismissed) {
+        stopSlaTicker();
+    } else {
+        startSlaTicker(banner);
+    }
+}
+
 /**
  * Handle metadata field changes (priority, category, type)
  */
@@ -447,10 +614,12 @@ function handleMetadataChanges() {
                 // Update window.ticketData
                 window.ticketData[fieldName] = fieldName === 'priority' ? parseInt(newValue) : newValue;
 
-                // For priority, update the TDS frame border accent
+                // For priority, update the TDS frame border accent and the
+                // SLA banner (which otherwise stays stale until reload)
                 if (fieldName === 'priority') {
                     const ticketFrame = document.querySelector('.lt-frame-ticket');
                     if (ticketFrame) ticketFrame.setAttribute('data-priority', newValue);
+                    renderSlaBanner(window.ticketData.priority);
                 }
             }
         })
@@ -521,7 +690,19 @@ function updateTicketStatus() {
         `);
         const modal = document.getElementById(modalId);
         lt.modal.open(modalId);
-        const cleanup = (ok) => { lt.modal.close(modalId); setTimeout(() => modal.remove(), 300); if (!ok) statusSelect.selectedIndex = 0; };
+        let settled = false;
+        const cleanup = (ok) => {
+            if (settled) return;   // lt.modal.close() below re-enters via lt:modalclose
+            settled = true;
+            lt.modal.close(modalId);
+            setTimeout(() => modal.remove(), 300);
+            if (!ok) statusSelect.selectedIndex = 0;
+        };
+        // Backdrop click and Escape close the overlay through base.js's global
+        // handlers. Without this the dropdown kept displaying the new status
+        // while the server was never called, so the ticket looked closed until
+        // a reload revealed it was still open.
+        modal.addEventListener('lt:modalclose', () => cleanup(false));
         modal.querySelector('[data-modal-close]').addEventListener('click', () => cleanup(false));
         document.getElementById(`${modalId}_cancel`).addEventListener('click', () => cleanup(false));
         document.getElementById(`${modalId}_confirm`).addEventListener('click', () => {
@@ -532,12 +713,13 @@ function updateTicketStatus() {
                 return;
             }
             cleanup(true);
-            // Post comment first (persists it), then change status with the same
+            // The comment is sent as part of the status-change request itself
-            // comment included so the server's requires_comment check passes.
+            // (update_ticket.php persists it in the same DB transaction as the
-            const ticketId = getTicketIdFromUrl();
+            // status update) rather than as a separate prior add_comment.php
-            lt.api.post('/api/add_comment.php', { ticket_id: ticketId, comment_text: comment })
+            // call — previously those were two independent, non-transactional
-            .then(() => performStatusChange(statusSelect, selectedOption, newStatus, comment))
+            // writes, so a failure partway through could leave the "reason"
-            .catch(() => performStatusChange(statusSelect, selectedOption, newStatus, comment));
+            // comment persisted with no matching status change ever applied.
+            performStatusChange(statusSelect, selectedOption, newStatus, comment);
         });
         // Focus textarea on open
         setTimeout(() => { const ta = document.getElementById(`${modalId}_comment`); if (ta) ta.focus(); }, 100);
@@ -987,35 +1169,62 @@ function resetUploadUI() {
     }
 }
 
-function loadAttachments() {
+const ATTACHMENT_PAGE_SIZE = 40;
-    const ticketId = window.ticketData.id;
+let attachmentOffset = 0;
-    const container = document.getElementById('attachmentsList');
+let attachmentTotal = 0;
 
+function loadAttachments() {
+    const container = document.getElementById('attachmentsList');
     if (!container) return;
 
-    lt.api.get(`/api/upload_attachment.php?ticket_id=${ticketId}`)
+    attachmentOffset = 0;
+    attachmentTotal = 0;
+    fetchAttachmentsPage(false);
+}
+
+function fetchAttachmentsPage(append) {
+    const ticketId = window.ticketData.id;
+    const container = document.getElementById('attachmentsList');
+    if (!container) return;
+
+    const loadMoreBtn = document.getElementById('attachmentsLoadMoreBtn');
+    if (loadMoreBtn) {
+        loadMoreBtn.disabled = true;
+        loadMoreBtn.textContent = 'Loading…';
+    }
+
+    lt.api.get(`/api/upload_attachment.php?ticket_id=${ticketId}&offset=${attachmentOffset}&limit=${ATTACHMENT_PAGE_SIZE}`)
         .then(data => {
             if (data.success) {
-                renderAttachments(data.attachments || []);
+                attachmentTotal = data.total;
-            } else {
+                attachmentOffset += (data.attachments || []).length;
+                renderAttachments(data.attachments || [], append, data.has_more);
+            } else if (!append) {
                 container.innerHTML = '<p class="lt-text-muted">Error loading attachments.</p>';
+            } else {
+                lt.toast.error('Error loading more attachments');
             }
         })
         .catch(error => {
-            container.innerHTML = '<p class="lt-text-muted">Error loading attachments.</p>';
+            if (!append) {
+                container.innerHTML = '<p class="lt-text-muted">Error loading attachments.</p>';
+            } else {
+                lt.toast.error('Error loading more attachments');
+            }
         });
 }
 
-function renderAttachments(attachments) {
+function renderAttachments(attachments, append, hasMore) {
     const container = document.getElementById('attachmentsList');
     if (!container) return;
 
-    if (attachments.length === 0) {
+    if (!append && attachments.length === 0) {
         container.innerHTML = '<p class="lt-text-muted">No files attached to this ticket.</p>';
         return;
     }
 
-    let html = '<div class="attachments-grid">';
+    let grid = append ? container.querySelector('.attachments-grid') : null;
+    let html = '';
 
     attachments.forEach(att => {
         const uploaderName = att.display_name || att.username || 'Unknown';
@@ -1028,11 +1237,16 @@ function renderAttachments(attachments) {
         });
         const uploadDate = `<span class="ts-cell" data-ts="${lt.escHtml(att.uploaded_at)}" title="${lt.escHtml(uploadDateFormatted)}">${lt.time.ago(att.uploaded_at)}</span>`;
 
-        const isImage = /\.(png|jpe?g|gif|webp|svg|bmp)$/i.test(att.original_filename);
+        const isImage = /^image\//i.test(att.mime_type || '');
-        const imgUrl  = `/api/download_attachment.php?id=${att.attachment_id}&inline=1`;
+        const imgUrl   = `/api/download_attachment.php?id=${att.attachment_id}&inline=1`;
+        // Grid preview requests the resized thumbnail (server falls back to the
+        // full-size original for attachments with none, e.g. uploaded before
+        // thumbnail generation existed); the lightbox link stays on the
+        // full-size original since that's what it displays when opened.
+        const thumbUrl = `${imgUrl}&thumb=1`;
         const iconHtml = isImage
             ? `<a href="${imgUrl}" class="lt-lightbox-trigger" data-lightbox="ticket-attachments" title="${lt.escHtml(att.original_filename)}">
-                   <img src="${imgUrl}" alt="${lt.escHtml(att.original_filename)}" class="attachment-thumb" loading="lazy">
+                   <img src="${thumbUrl}" alt="${lt.escHtml(att.original_filename)}" class="attachment-thumb" loading="lazy">
                </a>`
             : `<div class="attachment-icon">${lt.escHtml(att.icon || '[ f ]')}</div>`;
 
@@ -1055,8 +1269,34 @@ function renderAttachments(attachments) {
         </div>`;
     });
 
-    html += '</div>';
+    if (grid) {
-    container.innerHTML = html;
+        const temp = document.createElement('div');
+        temp.innerHTML = html;
+        while (temp.firstChild) {
+            grid.appendChild(temp.firstChild);
+        }
+    } else {
+        container.innerHTML = '<div class="attachments-grid">' + html + '</div>';
+    }
+
+    const remaining = attachmentTotal - attachmentOffset;
+    let loadMoreBtn = document.getElementById('attachmentsLoadMoreBtn');
+    if (hasMore && remaining > 0) {
+        if (!loadMoreBtn) {
+            loadMoreBtn = document.createElement('button');
+            loadMoreBtn.type = 'button';
+            loadMoreBtn.id = 'attachmentsLoadMoreBtn';
+            loadMoreBtn.className = 'lt-btn lt-btn-sm lt-w-full';
+            loadMoreBtn.style.marginTop = '0.6rem';
+            loadMoreBtn.addEventListener('click', function() { fetchAttachmentsPage(true); });
+            container.appendChild(loadMoreBtn);
+        }
+        loadMoreBtn.disabled = false;
+        loadMoreBtn.textContent = `Load more attachments (${remaining} remaining)`;
+    } else if (loadMoreBtn) {
+        loadMoreBtn.remove();
+    }
+
     // Initialize lightbox on image thumbnails
     if (window.lt && lt.lightbox) {
         lt.lightbox.init('.lt-lightbox-trigger', { caption: 'title', loop: true });

config/config.php

@@ -106,6 +106,11 @@ $GLOBALS['config'] = [
     'SESSION_TIMEOUT' => 18000, // 5 hours in seconds
     'SESSION_REGENERATE_INTERVAL' => 300, // Regenerate session ID every 5 minutes
 
+    // How often an already-logged-in session re-validates Remote-User/
+    // Remote-Groups against current Authelia/LLDAP state (AuthMiddleware).
+    // Without this, a revoked admin keeps full access for up to SESSION_TIMEOUT.
+    'PRIVILEGE_RESYNC_INTERVAL' => 300, // 5 minutes
+
     // CSRF settings
     'CSRF_LIFETIME' => 3600, // 1 hour in seconds
 
@@ -115,6 +120,8 @@ $GLOBALS['config'] = [
 
     // File upload settings
     'MAX_UPLOAD_SIZE' => 10485760, // 10MB in bytes
+    'MAX_ATTACHMENTS_PER_TICKET' => 50,
+    'MAX_TOTAL_ATTACHMENT_SIZE_PER_TICKET' => 104857600, // 100MB in bytes
     'ALLOWED_FILE_TYPES' => [
         'image/jpeg',
         'image/png',
@@ -134,9 +141,9 @@ $GLOBALS['config'] = [
     ],
     'UPLOAD_DIR' => __DIR__ . '/../uploads',
 
-    // Rate limiting
+    // Rate limiting (requests per minute; read by RateLimitMiddleware)
-    'RATE_LIMIT_DEFAULT' => 100, // Requests per minute for general
+    'RATE_LIMIT_DEFAULT' => (int)($envVars['RATE_LIMIT_DEFAULT'] ?? 100), // Session-based, general endpoints
-    'RATE_LIMIT_API' => 60, // Requests per minute for API
+    'RATE_LIMIT_API' => (int)($envVars['RATE_LIMIT_API'] ?? 60),          // Session-based, API endpoints
 
     // Audit log settings
     'AUDIT_LOG_RETENTION_DAYS' => 90,

config/requirements.php

@@ -25,4 +25,11 @@ return [
         'fileinfo', // api/upload_attachment.php — MIME validation
         'json',     // request/response encoding (bundled, but assert anyway)
     ],
+
+    // Sanity-check thresholds (warnings, not hard failures). A host with a low
+    // default memory_limit passes a bare extension/version check cleanly and
+    // only surfaces as a mysterious failure under real load — a large CSV
+    // export, an oversized dashboard query on a big install.
+    'min_memory_limit_mb' => 256,
+    'min_max_execution_time' => 30, // seconds; 0 (unlimited) always passes
 ];

controllers/TicketController.php

@@ -7,6 +7,7 @@ require_once dirname(__DIR__) . '/models/AuditLogModel.php';
 require_once dirname(__DIR__) . '/models/UserModel.php';
 require_once dirname(__DIR__) . '/models/WorkflowModel.php';
 require_once dirname(__DIR__) . '/models/TemplateModel.php';
+require_once dirname(__DIR__) . '/models/CustomFieldModel.php';
 require_once dirname(__DIR__) . '/helpers/UrlHelper.php';
 require_once dirname(__DIR__) . '/helpers/NotificationHelper.php';
 
@@ -18,6 +19,7 @@ class TicketController
     private $userModel;
     private $workflowModel;
     private $templateModel;
+    private $customFieldModel;
     private $conn;
 
     public function __construct($conn)
@@ -29,6 +31,7 @@ class TicketController
         $this->userModel = new UserModel($conn);
         $this->workflowModel = new WorkflowModel($conn);
         $this->templateModel = new TemplateModel($conn);
+        $this->customFieldModel = new CustomFieldModel($conn);
     }
 
     public function view($id)
@@ -60,6 +63,11 @@ class TicketController
         // Get allowed status transitions for this ticket
         $allowedTransitions = $this->workflowModel->getAllowedTransitions($ticket['status']);
 
+        // Custom fields applicable to this ticket's category, with any
+        // already-saved values for it
+        $customFieldDefs = $this->customFieldModel->getAllDefinitions($ticket['category'], true);
+        $customFieldValues = $this->customFieldModel->getValuesForTicket($id);
+
         // Make $conn available to view for visibility groups
         $conn = $this->conn;
 
@@ -73,6 +81,12 @@ class TicketController
         $currentUser = $GLOBALS['currentUser'] ?? null;
         $userId = $currentUser['user_id'] ?? null;
 
+        // All active custom field definitions (every category, plus
+        // category-less ones) — the create form renders them all and toggles
+        // visibility client-side as the Category select changes, since the
+        // ticket doesn't exist yet to scope the query to one category.
+        $allCustomFieldDefs = $this->customFieldModel->getAllDefinitions(null, true);
+
         // Check if form was submitted
         if ($_SERVER['REQUEST_METHOD'] === 'POST') {
             // Validate CSRF token
@@ -131,6 +145,38 @@ class TicketController
                 return;
             }
 
+            // Custom fields applicable to the submitted category — validate
+            // is_required server-side (the form is novalidate, and a field
+            // hidden by the client-side category toggle must not silently
+            // bypass a requirement that applies to the category actually
+            // submitted).
+            $submittedCustomFields = is_array($_POST['custom_fields'] ?? null) ? $_POST['custom_fields'] : [];
+            $applicableFieldDefs = array_filter(
+                $allCustomFieldDefs,
+                fn($def) => $def['category'] === null || $def['category'] === $ticketData['category']
+            );
+            $customFieldsToSave = [];
+            foreach ($applicableFieldDefs as $def) {
+                $fieldId = (int)$def['field_id'];
+                $raw = $submittedCustomFields[$fieldId] ?? null;
+                $normalized = $def['field_type'] === 'checkbox'
+                    ? (!empty($raw) ? '1' : '0')
+                    : (is_scalar($raw) ? trim((string)$raw) : '');
+
+                if (!empty($def['is_required']) && $def['field_type'] !== 'checkbox' && $normalized === '') {
+                    $error = $def['field_label'] . ' is required';
+                    $templates = $this->templateModel->getAllTemplates();
+                    $allUsers = $this->userModel->getAllUsers();
+                    $conn = $this->conn;
+                    include dirname(__DIR__) . '/views/CreateTicketView.php';
+                    return;
+                }
+
+                if ($normalized !== '') {
+                    $customFieldsToSave[$fieldId] = $normalized;
+                }
+            }
+
             // Create ticket with user tracking
             $result = $this->ticketModel->createTicket($ticketData, $userId);
 
@@ -144,6 +190,12 @@ class TicketController
                 require_once dirname(__DIR__) . '/models/StatsModel.php';
                 (new StatsModel($this->conn))->invalidateCache();
 
+                // Persist custom field values for the fields applicable to
+                // this ticket's category
+                if (!empty($customFieldsToSave)) {
+                    $this->customFieldModel->setValues($result['ticket_id'], $customFieldsToSave);
+                }
+
                 // Auto-link as duplicate if requested from create form
                 $linkDupOfRaw = trim($_POST['link_duplicate_of'] ?? '');
                 if ($linkDupOfRaw !== '' && ctype_digit($linkDupOfRaw)) {

create_ticket_api.php

@@ -2,12 +2,16 @@
 
 header('Content-Type: application/json');
 
-error_reporting(E_ALL);
+require_once __DIR__ . '/helpers/ErrorHandler.php';
-ini_set('display_errors', 0);
+ErrorHandler::init();
 
-// Load environment variables with error check
+require_once __DIR__ . '/middleware/RateLimitMiddleware.php';
-$envFile = __DIR__ . '/.env';
+RateLimitMiddleware::apply('api');
-if (!file_exists($envFile)) {
+
+// Early friendly JSON error if .env is missing, before config.php's own
+// (plain-text die()) handling would otherwise run — this is a JSON API
+// endpoint and must always respond with a JSON body.
+if (!file_exists(__DIR__ . '/.env')) {
     echo json_encode([
         'success' => false,
         'error' => 'Configuration file not found'
@@ -15,37 +19,17 @@ if (!file_exists($envFile)) {
     exit;
 }
 
-$envVars = parse_ini_file($envFile, false, INI_SCANNER_TYPED);
+// Load application config so UrlHelper can resolve APP_DOMAIN, and so the
-if (!$envVars) {
+// DB connection below (via Database::getConnection()) gets the same
-    echo json_encode([
+// charset/timezone sync as every other endpoint instead of a hand-rolled
-        'success' => false,
+// second connection.
-        'error' => 'Invalid configuration file'
+require_once __DIR__ . '/config/config.php';
-    ]);
+require_once __DIR__ . '/helpers/Database.php';
-    exit;
-}
 
-// Strip quotes from values if present (parse_ini_file may include them)
+try {
-foreach ($envVars as $key => $value) {
+    $conn = Database::getConnection();
-    if (is_string($value)) {
+} catch (\Throwable $e) {
-        if (
+    error_log('create_ticket_api: DB connection failed: ' . $e->getMessage());
-            (substr($value, 0, 1) === '"' && substr($value, -1) === '"') ||
-            (substr($value, 0, 1) === "'" && substr($value, -1) === "'")
-        ) {
-            $envVars[$key] = substr($value, 1, -1);
-        }
-    }
-}
-
-// Database connection with detailed error handling
-$conn = new mysqli(
-    $envVars['DB_HOST'],
-    $envVars['DB_USER'],
-    $envVars['DB_PASS'],
-    $envVars['DB_NAME']
-);
-
-if ($conn->connect_error) {
-    error_log('create_ticket_api: DB connection failed: ' . $conn->connect_error);
     http_response_code(500);
     echo json_encode([
         'success' => false,
@@ -54,13 +38,12 @@ if ($conn->connect_error) {
     exit;
 }
 
-// Load application config so UrlHelper can resolve APP_DOMAIN
-require_once __DIR__ . '/config/config.php';
-
 // Authenticate via API key
 require_once __DIR__ . '/middleware/ApiKeyAuth.php';
 require_once __DIR__ . '/models/AuditLogModel.php';
 require_once __DIR__ . '/models/StatsModel.php';
+require_once __DIR__ . '/models/TicketModel.php';
+require_once __DIR__ . '/models/WorkflowModel.php';
 require_once __DIR__ . '/helpers/UrlHelper.php';
 
 $apiKeyAuth = new ApiKeyAuth($conn);
@@ -249,256 +232,353 @@ $priority = (int)$priority;
 $ticketHash = generateTicketHash($data);
 $auditLog   = new AuditLogModel($conn);
 
-// Look up any existing ticket with this hash (open OR closed)
+// Everything from here through either updating/reopening the matched ticket
-$checkStmt = $conn->prepare("SELECT ticket_id, status, title, priority FROM tickets WHERE hash = ? ORDER BY created_at DESC LIMIT 1");
+// or inserting a brand-new one runs inside one transaction with a row lock
-$checkStmt->bind_param("s", $ticketHash);
+// on the hash lookup. Without this, two concurrent requests carrying the
-$checkStmt->execute();
+// same dedup hash (e.g. overlapping monitoring runs) could both read the
-$existing = $checkStmt->get_result()->fetch_assoc();
+// same pre-update snapshot and each independently apply an escalation. FOR
-$checkStmt->close();
+// UPDATE on this equality lookup against the unique-indexed hash column also
+// takes a lock on the "gap" where no row currently exists, so two concurrent
+// requests for a genuinely new hash are still safe from a duplicate row —
+// but that gap lock is shared, not exclusive, so both can reach the INSERT
+// below and deadlock with each other rather than one blocking cleanly on the
+// other's row. See the retry loop and comment near the INSERT's catch block
+// for how that case is handled.
+// Retried once if the INSERT below deadlocks with another connection's
+// concurrent insert into the same not-yet-existing hash (see comment
+// above the INSERT's catch block) — the retry's own SELECT ... FOR UPDATE
+// will then find the winner's already-committed row and take the
+// update/escalate branch instead of erroring out.
+$maxDedupAttempts = 2;
+for ($dedupAttempt = 1; $dedupAttempt <= $maxDedupAttempts; $dedupAttempt++) {
+    $conn->begin_transaction();
 
-if ($existing) {
+    // Look up any existing ticket with this hash (open OR closed)
-    $existingId       = $existing['ticket_id'];
+    $checkStmt = $conn->prepare("SELECT ticket_id, status, title, priority FROM tickets WHERE hash = ? ORDER BY created_at DESC LIMIT 1 FOR UPDATE");
-    $existingStatus   = $existing['status'];
+    $checkStmt->bind_param("s", $ticketHash);
-    $existingTitle    = $existing['title'];
+    $checkStmt->execute();
-    $existingPriority = (int)$existing['priority'];
+    $existing = $checkStmt->get_result()->fetch_assoc();
-    $newPriority      = (int)$priority;
+    $checkStmt->close();
 
-    if ($existingStatus !== 'Closed') {
+    if ($existing) {
-        // Ticket is still active — update title, escalate priority, and refresh
+        $existingId       = $existing['ticket_id'];
-        // description with latest sensor data.
+        $existingStatus   = $existing['status'];
-        $changes   = [];
+        $existingTitle    = $existing['title'];
-        $updateSql = "UPDATE tickets SET updated_at = NOW(), updated_by = ?";
+        $existingPriority = (int)$existing['priority'];
-        $bindTypes = "i";
+        $newPriority      = (int)$priority;
-        $bindVals  = [$userId];
 
-        if ($title !== $existingTitle) {
+        if ($existingStatus !== 'Closed') {
-            $updateSql .= ", title = ?";
+            // Ticket is still active — update title, escalate priority, and refresh
-            $bindTypes .= "s";
+            // description with latest sensor data.
-            $bindVals[] = $title;
+            $changes   = [];
-            $changes['title'] = ['from' => $existingTitle, 'to' => $title];
+            $updateSql = "UPDATE tickets SET updated_at = NOW(), updated_by = ?";
-        }
+            $bindTypes = "i";
+            $bindVals  = [$userId];
 
-        if ($newPriority < $existingPriority) {
+            if ($title !== $existingTitle) {
-            $updateSql .= ", priority = ?";
+                $updateSql .= ", title = ?";
-            $bindTypes .= "i";
+                $bindTypes .= "s";
-            $bindVals[] = $newPriority;
+                $bindVals[] = $title;
-            $changes['priority'] = ['from' => $existingPriority, 'to' => $newPriority];
+                $changes['title'] = ['from' => $existingTitle, 'to' => $title];
-        }
-
-        // Always refresh the description so the ticket body shows current sensor data
-        if (!empty($description)) {
-            $updateSql .= ", description = ?";
-            $bindTypes .= "s";
-            $bindVals[] = $description;
-            $changes['description_refreshed'] = true;
-        }
-
-        if (!empty($changes)) {
-            $updateSql .= " WHERE ticket_id = ?";
-            $bindTypes .= "s";
-            $bindVals[] = $existingId;
-
-            $updStmt = $conn->prepare($updateSql);
-            $updStmt->bind_param($bindTypes, ...$bindVals);
-            $updStmt->execute();
-            $updStmt->close();
-
-            // Only post a comment on priority escalation — title and description updates
-            // are silent (title changes like rising counters would spam a comment every run).
-            // Keep it short: the full sensor data is refreshed in the ticket description,
-            // so the comment just records the bump + a brief reason (no ASCII dump).
-            if (isset($changes['priority'])) {
-                $pLabels = [1 => 'P1 (Critical)', 2 => 'P2 (High)', 3 => 'P3 (Medium)', 4 => 'P4 (Low)', 5 => 'P5 (Minimal)'];
-                $fromP = (int)$changes['priority']['from'];
-                $toP   = (int)$changes['priority']['to'];
-                $fromL = $pLabels[$fromP] ?? "P{$fromP}";
-                $toL   = $pLabels[$toP] ?? "P{$toP}";
-                $commentText = "**hwmonDaemon raised priority {$fromL} → {$toL}.**\n\n"
-                    . "The latest monitoring scan reported a more severe condition for this issue, "
-                    . "so it now needs faster attention. Current sensor data is in the ticket description above.";
-                $commentStmt = $conn->prepare(
-                    "INSERT INTO ticket_comments (ticket_id, user_id, user_name, comment_text, markdown_enabled) VALUES (?, ?, 'hwmonDaemon', ?, 1)"
-                );
-                $commentStmt->bind_param("sis", $existingId, $userId, $commentText);
-                $commentStmt->execute();
-                $commentStmt->close();
             }
 
-            $auditLog->log($userId, 'update', 'ticket', $existingId, array_merge(
+            if ($newPriority < $existingPriority) {
-                array_diff_key($changes, ['description_refreshed' => true]),
+                $updateSql .= ", priority = ?";
-                ['reason' => 'auto-updated by hwmonDaemon (condition worsened)']
+                $bindTypes .= "i";
-            ));
+                $bindVals[] = $newPriority;
-
+                $changes['priority'] = ['from' => $existingPriority, 'to' => $newPriority];
-            // Only notify on priority escalation — title-only updates (e.g. rising
-            // Power_On_Hours counter) should not generate a Matrix ping every hour.
-            if (isset($changes['priority'])) {
-                require_once __DIR__ . '/helpers/NotificationHelper.php';
-                NotificationHelper::sendTicketNotification($existingId, [
-                    'title'    => $title,
-                    'priority' => $changes['priority']['to'],
-                    'category' => $category,
-                    'type'     => $type,
-                    'status'   => $existingStatus,
-                ], 'automated');
             }
 
-            // Ticket state (priority/title/description) changed — refresh dashboard stats.
+            // Always refresh the description so the ticket body shows current sensor data
+            if (!empty($description)) {
+                $updateSql .= ", description = ?";
+                $bindTypes .= "s";
+                $bindVals[] = $description;
+                $changes['description_refreshed'] = true;
+            }
+
+            if (!empty($changes)) {
+                $updateSql .= " WHERE ticket_id = ?";
+                $bindTypes .= "s";
+                $bindVals[] = $existingId;
+
+                $updStmt = $conn->prepare($updateSql);
+                $updStmt->bind_param($bindTypes, ...$bindVals);
+                $updStmt->execute();
+                $updStmt->close();
+
+                // Only post a comment on priority escalation — title and description updates
+                // are silent (title changes like rising counters would spam a comment every run).
+                // Keep it short: the full sensor data is refreshed in the ticket description,
+                // so the comment just records the bump + a brief reason (no ASCII dump).
+                if (isset($changes['priority'])) {
+                    $pLabels = [1 => 'P1 (Critical)', 2 => 'P2 (High)', 3 => 'P3 (Medium)', 4 => 'P4 (Low)', 5 => 'P5 (Minimal)'];
+                    $fromP = (int)$changes['priority']['from'];
+                    $toP   = (int)$changes['priority']['to'];
+                    $fromL = $pLabels[$fromP] ?? "P{$fromP}";
+                    $toL   = $pLabels[$toP] ?? "P{$toP}";
+                    $commentText = "**hwmonDaemon raised priority {$fromL} → {$toL}.**\n\n"
+                        . "The latest monitoring scan reported a more severe condition for this issue, "
+                        . "so it now needs faster attention. Current sensor data is in the ticket description above.";
+                    $commentStmt = $conn->prepare(
+                        "INSERT INTO ticket_comments (ticket_id, user_id, user_name, comment_text, markdown_enabled) VALUES (?, ?, 'hwmonDaemon', ?, 1)"
+                    );
+                    $commentStmt->bind_param("sis", $existingId, $userId, $commentText);
+                    $commentStmt->execute();
+                    $commentStmt->close();
+                }
+
+                $auditLog->log($userId, 'update', 'ticket', $existingId, array_merge(
+                    array_diff_key($changes, ['description_refreshed' => true]),
+                    ['reason' => 'auto-updated by hwmonDaemon (condition worsened)']
+                ));
+
+                // Only notify on priority escalation — title-only updates (e.g. rising
+                // Power_On_Hours counter) should not generate a Matrix ping every hour.
+                if (isset($changes['priority'])) {
+                    require_once __DIR__ . '/helpers/NotificationHelper.php';
+                    NotificationHelper::sendTicketNotification($existingId, [
+                        'title'    => $title,
+                        'priority' => $changes['priority']['to'],
+                        'category' => $category,
+                        'type'     => $type,
+                        'status'   => $existingStatus,
+                    ], 'automated');
+                }
+
+                // Ticket state (priority/title/description) changed — refresh dashboard stats.
+                (new StatsModel($conn))->invalidateCache();
+            }
+
+            $conn->commit();
+            Database::close();
+            echo json_encode([
+                'success'            => true,
+                'ticket_id'          => $existingId,
+                'message'            => empty($changes) ? 'Duplicate — no change' : 'Existing ticket updated',
+                'action'             => empty($changes) ? 'deduplicated' : 'updated',
+                'changes'            => $changes,
+            ]);
+            exit;
+        }
+
+        // Ticket was closed — reopen it and add a recurrence comment. Route
+        // through the Workflow Designer like every other status-write path in
+        // the app, rather than forcing status='Open' via raw SQL regardless of
+        // configured transition rules.
+        $workflowModel = new WorkflowModel($conn);
+        $reopenStatus = 'Open';
+        if (!$workflowModel->isTransitionAllowed('Closed', 'Open', false)) {
+            // Direct Closed->Open isn't configured — fall back to any transition
+            // the Workflow Designer does allow from Closed that this unattended,
+            // non-admin automation can actually satisfy (no comment prompt, no
+            // admin elevation). If even that doesn't exist, leave the ticket
+            // Closed rather than force an unconfigured state.
+            $reopenStatus = null;
+            foreach ($workflowModel->getAllowedTransitions('Closed') as $transition) {
+                if (!$transition['requires_comment'] && !$transition['requires_admin']) {
+                    $reopenStatus = $transition['to_status'];
+                    break;
+                }
+            }
+        }
+
+        if ($reopenStatus !== null) {
+            $ticketModel = new TicketModel($conn);
+            $ticketModel->updateTicket([
+                'ticket_id'   => $existingId,
+                'title'       => $title,
+                'description' => $description,
+                'category'    => $category,
+                'type'        => $type,
+                'status'      => $reopenStatus,
+                'priority'    => $priority,
+            ], $userId);
+        } else {
+            error_log("create_ticket_api: hwmonDaemon recurrence for ticket $existingId — "
+                . "no admin-free, comment-free transition from Closed is configured; leaving ticket Closed");
+        }
+
+        $commentText = "**Issue recurred — ticket reopened automatically.**\n\n" .
+                       "hwmonDaemon detected this condition again. The ticket description reflects the "
+                       . "original report; see this comment's timestamp for when the issue recurred.";
+        if ($reopenStatus === null) {
+            $commentText = "**Issue recurred, but the ticket could not be reopened automatically.**\n\n"
+                . "hwmonDaemon detected this condition again. No Workflow Designer transition from "
+                . "Closed is configured that this automation can perform unattended (no comment/admin "
+                . "requirement); the ticket remains Closed. Please review and reopen manually if appropriate.";
+        }
+        $commentStmt = $conn->prepare(
+            "INSERT INTO ticket_comments (ticket_id, user_id, user_name, comment_text, markdown_enabled) VALUES (?, ?, 'hwmonDaemon', ?, 1)"
+        );
+        $commentStmt->bind_param("sis", $existingId, $userId, $commentText);
+        $commentStmt->execute();
+        $commentStmt->close();
+
+        if ($reopenStatus !== null) {
+            $auditLog->log($userId, 'update', 'ticket', $existingId, [
+                'status' => ['from' => 'Closed', 'to' => $reopenStatus],
+                'reason' => 'auto-reopened by hwmonDaemon (issue recurred)',
+            ]);
+
+            // Ticket reopened — refresh dashboard stats.
             (new StatsModel($conn))->invalidateCache();
+        } else {
+            $auditLog->log($userId, 'update', 'ticket', $existingId, [
+                'reason' => 'hwmonDaemon recurrence detected but no valid reopen transition configured; ticket left Closed',
+            ]);
+        }
+
+        $conn->commit();
+        Database::close();
+
+        if ($reopenStatus !== null) {
+            require_once __DIR__ . '/helpers/NotificationHelper.php';
+            NotificationHelper::sendTicketNotification($existingId, [
+                'title'    => $title,
+                'priority' => $priority,
+                'category' => $category,
+                'type'     => $type,
+                'status'   => $reopenStatus,
+            ], 'automated');
         }
 
-        $conn->close();
         echo json_encode([
-            'success'            => true,
+            'success'   => true,
-            'ticket_id'          => $existingId,
+            'ticket_id' => $existingId,
-            'message'            => empty($changes) ? 'Duplicate — no change' : 'Existing ticket updated',
+            'message'   => $reopenStatus !== null
-            'action'             => empty($changes) ? 'deduplicated' : 'updated',
+                ? 'Existing closed ticket reopened'
-            'changes'            => $changes,
+                : 'Recurrence noted; ticket left Closed (no valid workflow transition configured)',
+            'action'    => $reopenStatus !== null ? 'reopened' : 'recurrence_noted',
         ]);
         exit;
     }
 
-    // Ticket was closed — reopen it and add a recurrence comment
+    // No existing ticket — create a new one. Still inside the transaction opened
-    $reopenStmt = $conn->prepare(
+    // above, so a concurrent request for the same hash is blocked on its own
-        "UPDATE tickets SET status = 'Open', closed_at = NULL, updated_at = NOW(), updated_by = ? WHERE ticket_id = ?"
+    // SELECT ... FOR UPDATE until this one commits or rolls back (see comment
+    // there) rather than racing this INSERT.
+    //
+    // Note on FOR UPDATE over a not-yet-existing key: InnoDB's gap lock in that
+    // case is a shared lock, not exclusive — two concurrent transactions can
+    // both acquire it and both reach this INSERT. The conflict only surfaces
+    // when they each request the insert-intention lock for the same gap,
+    // which InnoDB resolves as a deadlock (error 1213), not by blocking one
+    // of the SELECTs. The outer loop above retries that case: the loser rolls
+    // back and re-runs its own SELECT ... FOR UPDATE, which by then finds the
+    // winner's committed row and takes the update/escalate branch instead.
+    //
+    // Generate a collision-safe unique ticket_id with a pre-check + retry loop (same
+    // approach as TicketModel::createTicket) so a ticket_id clash cannot happen. That
+    // way a 1062 on INSERT below can only be the unique_hash (dedup) key — and with
+    // the FOR UPDATE lock above, only in the unlikely case of a hash collision from
+    // two genuinely different reports, not the same-hash race this used to be.
+    $ticket_id = null;
+    $maxAttempts = 50;
+    $attempts = 0;
+    do {
+        try {
+            $candidateId = sprintf('%09d', random_int(100000000, 999999999));
+        } catch (Exception $e) {
+            $candidateId = sprintf('%09d', mt_rand(100000000, 999999999));
+        }
+
+        $idCheckStmt = $conn->prepare("SELECT ticket_id FROM tickets WHERE ticket_id = ? LIMIT 1");
+        $idCheckStmt->bind_param("s", $candidateId);
+        $idCheckStmt->execute();
+        $idExists = $idCheckStmt->get_result()->num_rows > 0;
+        $idCheckStmt->close();
+
+        if (!$idExists) {
+            $ticket_id = $candidateId;
+        }
+        $attempts++;
+    } while ($ticket_id === null && $attempts < $maxAttempts);
+
+    if ($ticket_id === null) {
+        $conn->rollback();
+        error_log('create_ticket_api: failed to generate a unique ticket_id after ' . $maxAttempts . ' attempts');
+        http_response_code(500);
+        echo json_encode(['success' => false, 'error' => 'Internal server error']);
+        exit;
+    }
+
+    $insertStmt = $conn->prepare(
+        "INSERT INTO tickets (ticket_id, title, description, status, priority, category, type, hash, created_by)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"
     );
-    $reopenStmt->bind_param("is", $userId, $existingId);
+    $insertStmt->bind_param(
-    $reopenStmt->execute();
+        "ssssssssi",
-    $reopenStmt->close();
+        $ticket_id,
-
+        $title,
-    $commentText = "**Issue recurred — ticket reopened automatically.**\n\n" .
+        $description,
-                   "hwmonDaemon detected this condition again. The ticket description reflects the "
+        $status,
-                   . "original report; see this comment's timestamp for when the issue recurred.";
+        $priority,
-    $commentStmt = $conn->prepare(
+        $category,
-        "INSERT INTO ticket_comments (ticket_id, user_id, user_name, comment_text, markdown_enabled) VALUES (?, ?, 'hwmonDaemon', ?, 1)"
+        $type,
+        $ticketHash,
+        $userId
     );
-    $commentStmt->bind_param("sis", $existingId, $userId, $commentText);
-    $commentStmt->execute();
-    $commentStmt->close();
 
-    $auditLog->log($userId, 'update', 'ticket', $existingId, [
-        'status' => ['from' => 'Closed', 'to' => 'Open'],
-        'reason' => 'auto-reopened by hwmonDaemon (issue recurred)',
-    ]);
-
-    // Ticket reopened (Closed → Open) — refresh dashboard stats.
-    (new StatsModel($conn))->invalidateCache();
-
-    $conn->close();
-
-    require_once __DIR__ . '/helpers/NotificationHelper.php';
-    NotificationHelper::sendTicketNotification($existingId, [
-        'title'    => $title,
-        'priority' => $priority,
-        'category' => $category,
-        'type'     => $type,
-        'status'   => 'Open',
-    ], 'automated');
-
-    echo json_encode([
-        'success'   => true,
-        'ticket_id' => $existingId,
-        'message'   => 'Existing closed ticket reopened',
-        'action'    => 'reopened',
-    ]);
-    exit;
-}
-
-// No existing ticket — create a new one.
-// Generate a collision-safe unique ticket_id with a pre-check + retry loop (same
-// approach as TicketModel::createTicket) so a ticket_id clash cannot happen. That
-// way a 1062 on INSERT below can only be the unique_hash (dedup) key racing, and
-// is correctly reported as a duplicate rather than a dropped hardware alert.
-$ticket_id = null;
-$maxAttempts = 50;
-$attempts = 0;
-do {
     try {
-        $candidateId = sprintf('%09d', random_int(100000000, 999999999));
+        $inserted = $insertStmt->execute();
-    } catch (Exception $e) {
+    } catch (mysqli_sql_exception $e) {
-        $candidateId = sprintf('%09d', mt_rand(100000000, 999999999));
+        $insertStmt->close();
+        $conn->rollback();
+        if (in_array($e->getCode(), [1213, 1205], true) && $dedupAttempt < $maxDedupAttempts) {
+            // Deadlock (1213) or lock wait timeout (1205) from a concurrent
+            // insert into the same not-yet-existing hash gap — see the note
+            // above. Retry: the next iteration's own SELECT ... FOR UPDATE
+            // will find whichever side won and take the update/escalate path.
+            continue;
+        }
+        if ($e->getCode() === 1062) {
+            // Should be unreachable in the same-hash race this issue was filed
+            // for now that the SELECT above takes FOR UPDATE — kept as a
+            // defensive fallback in case of a genuine hash collision between two
+            // different reports.
+            echo json_encode(['success' => false, 'error' => 'Duplicate ticket']);
+        } else {
+            error_log('create_ticket_api: insert failed: ' . $e->getMessage());
+            http_response_code(500);
+            echo json_encode(['success' => false, 'error' => 'Internal server error']);
+        }
+        exit;
     }
-
-    $idCheckStmt = $conn->prepare("SELECT ticket_id FROM tickets WHERE ticket_id = ? LIMIT 1");
-    $idCheckStmt->bind_param("s", $candidateId);
-    $idCheckStmt->execute();
-    $idExists = $idCheckStmt->get_result()->num_rows > 0;
-    $idCheckStmt->close();
-
-    if (!$idExists) {
-        $ticket_id = $candidateId;
-    }
-    $attempts++;
-} while ($ticket_id === null && $attempts < $maxAttempts);
-
-if ($ticket_id === null) {
-    error_log('create_ticket_api: failed to generate a unique ticket_id after ' . $maxAttempts . ' attempts');
-    http_response_code(500);
-    echo json_encode(['success' => false, 'error' => 'Internal server error']);
-    exit;
-}
-
-$insertStmt = $conn->prepare(
-    "INSERT INTO tickets (ticket_id, title, description, status, priority, category, type, hash, created_by)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"
-);
-$insertStmt->bind_param(
-    "ssssssssi",
-    $ticket_id,
-    $title,
-    $description,
-    $status,
-    $priority,
-    $category,
-    $type,
-    $ticketHash,
-    $userId
-);
-
-try {
-    $inserted = $insertStmt->execute();
-} catch (mysqli_sql_exception $e) {
     $insertStmt->close();
-    if ($e->getCode() === 1062) {
+
-        // Race condition: another node inserted the same hash between our SELECT and INSERT
+    if ($inserted) {
-        echo json_encode(['success' => false, 'error' => 'Duplicate ticket']);
+        $auditLog->logTicketCreate($userId, $ticket_id, [
+            'title'    => $title,
+            'priority' => $priority,
+            'category' => $category,
+            'type'     => $type,
+        ]);
+
+        // New ticket created — refresh dashboard stats.
+        (new StatsModel($conn))->invalidateCache();
+
+        $conn->commit();
+        Database::close();
+
+        require_once __DIR__ . '/helpers/NotificationHelper.php';
+        NotificationHelper::sendTicketNotification($ticket_id, [
+            'title'    => $title,
+            'priority' => $priority,
+            'category' => $category,
+            'type'     => $type,
+            'status'   => $status,
+        ], 'automated');
+
+        echo json_encode([
+            'success'    => true,
+            'ticket_id'  => $ticket_id,
+            'message'    => 'Ticket created successfully',
+        ]);
     } else {
-        error_log('create_ticket_api: insert failed: ' . $e->getMessage());
+        $conn->rollback();
+        error_log('create_ticket_api: ticket insert reported failure: ' . $conn->error);
         http_response_code(500);
         echo json_encode(['success' => false, 'error' => 'Internal server error']);
     }
-    exit;
-}
-$insertStmt->close();
-
-if ($inserted) {
-    $auditLog->logTicketCreate($userId, $ticket_id, [
-        'title'    => $title,
-        'priority' => $priority,
-        'category' => $category,
-        'type'     => $type,
-    ]);
-
-    // New ticket created — refresh dashboard stats.
-    (new StatsModel($conn))->invalidateCache();
-
-    $conn->close();
-
-    require_once __DIR__ . '/helpers/NotificationHelper.php';
-    NotificationHelper::sendTicketNotification($ticket_id, [
-        'title'    => $title,
-        'priority' => $priority,
-        'category' => $category,
-        'type'     => $type,
-        'status'   => $status,
-    ], 'automated');
-
-    echo json_encode([
-        'success'    => true,
-        'ticket_id'  => $ticket_id,
-        'message'    => 'Ticket created successfully',
-    ]);
-} else {
-    error_log('create_ticket_api: ticket insert reported failure: ' . $conn->error);
-    http_response_code(500);
-    echo json_encode(['success' => false, 'error' => 'Internal server error']);
 }

cron/create_recurring_tickets.php

@@ -29,6 +29,38 @@ function logMessage($message)
     echo "[" . date('Y-m-d H:i:s') . "] " . $message . "\n";
 }
 
+/**
+ * Record a recurring-ticket occurrence that was claimed (next_run_at already
+ * advanced to the next future run) but then failed to actually produce a
+ * ticket. That claim-then-fail ordering is deliberate — it stops a failing
+ * creation from re-firing and flooding duplicates on every subsequent cron
+ * tick — but means this specific occurrence has no other record anywhere an
+ * admin would normally look: no audit_log entry (nothing was created), no
+ * Matrix "ticket created" alert, no failure table. Without this, it's simply
+ * gone, silently, forever.
+ */
+function recordMissedOccurrence($auditLog, $recurring, $reason)
+{
+    $auditLog->log(
+        $recurring['created_by'],
+        'error',
+        'recurring_ticket',
+        (string)$recurring['recurring_id'],
+        [
+            'reason' => $reason,
+            'title_template' => $recurring['title_template'],
+            'schedule_type' => $recurring['schedule_type'],
+        ]
+    );
+
+    NotificationHelper::sendSystemAlert(
+        "Recurring ticket occurrence lost: schedule #{$recurring['recurring_id']} "
+            . "(\"{$recurring['title_template']}\") was claimed for this run but ticket "
+            . "creation failed, so this occurrence will not be created or retried.",
+        ['reason' => $reason, 'recurring_id' => $recurring['recurring_id']]
+    );
+}
+
 logMessage("Starting recurring tickets cron job");
 
 try {
@@ -100,11 +132,17 @@ try {
 
                 $created++;
             } else {
-                logMessage("ERROR: Failed to create ticket - " . ($result['error'] ?? 'Unknown error'));
+                $reason = $result['error'] ?? 'Unknown error';
+                logMessage("ERROR: Failed to create ticket - " . $reason);
+                recordMissedOccurrence($auditLog, $recurring, $reason);
                 $errors++;
             }
         } catch (Exception $e) {
             logMessage("ERROR: Exception processing recurring ticket - " . $e->getMessage());
+            // claimForRun() already advanced next_run_at before this point, so
+            // this occurrence is permanently gone unless recorded somewhere an
+            // admin would actually look — a cron log line alone doesn't count.
+            recordMissedOccurrence($auditLog, $recurring, $e->getMessage());
             $errors++;
         }
     }

helpers/CacheHelper.php

@@ -121,6 +121,33 @@ class CacheHelper
         return $written;
     }
 
+    /**
+     * Read the current invalidation epoch for a prefix (0 if never bumped).
+     * Used by remember() to detect an invalidation that happened while a
+     * cache-miss recomputation was in flight.
+     */
+    private static function getEpoch(string $prefix): int
+    {
+        $safePrefix = preg_replace('/[^a-zA-Z0-9_]/', '_', $prefix);
+        $file = self::getCacheDir() . '/' . $safePrefix . '.epoch';
+        $val = @file_get_contents($file);
+        return $val !== false ? (int)$val : 0;
+    }
+
+    /**
+     * Bump a prefix's invalidation epoch. Called whenever anything under the
+     * prefix is invalidated.
+     */
+    private static function bumpEpoch(string $prefix): void
+    {
+        $safePrefix = preg_replace('/[^a-zA-Z0-9_]/', '_', $prefix);
+        $file = self::getCacheDir() . '/' . $safePrefix . '.epoch';
+        $next = self::getEpoch($prefix) + 1;
+        if (@file_put_contents($file, (string)$next, LOCK_EX) !== false) {
+            @chmod($file, 0600);
+        }
+    }
+
     /**
      * Delete cached data
      *
@@ -130,6 +157,8 @@ class CacheHelper
      */
     public static function delete(string $prefix, $identifier = null): bool
     {
+        self::bumpEpoch($prefix);
+
         if ($identifier !== null) {
             $key = self::makeKey($prefix, $identifier);
             unset(self::$memoryCache[$key]);
@@ -192,8 +221,14 @@ class CacheHelper
         $data = self::get($prefix, $identifier, $ttl);
 
         if ($data === null) {
+            // Snapshot the epoch before running the (possibly slow) callback so
+            // a concurrent invalidation mid-computation can be detected below —
+            // otherwise this request's stale pre-invalidation result could
+            // overwrite a newer request's fresher write, extending staleness by
+            // up to another full TTL.
+            $epochBefore = self::getEpoch($prefix);
             $data = $callback();
-            if ($data !== null) {
+            if ($data !== null && self::getEpoch($prefix) === $epochBefore) {
                 self::set($prefix, $identifier, $data);
             }
         }

helpers/ErrorHandler.php

@@ -10,26 +10,36 @@ class ErrorHandler
 {
     private static ?string $logFile = null;
     private static bool $initialized = false;
+    private static string $responseMode = 'json';
 
     /**
      * Initialize error handling
      *
-     * @param bool $displayErrors Whether to display errors (false in production)
+     * @param bool   $displayErrors Whether to display errors (false in production)
+     * @param string $responseMode 'json' (API endpoints) or 'html' (page views —
+     *                              renders views/error_500.php instead of a JSON body)
      */
-    public static function init(bool $displayErrors = false): void
+    public static function init(bool $displayErrors = false, string $responseMode = 'json'): void
     {
         if (self::$initialized) {
             return;
         }
 
+        self::$responseMode = $responseMode;
+
         // Set error reporting
         error_reporting(E_ALL);
         ini_set('display_errors', $displayErrors ? '1' : '0');
         ini_set('log_errors', '1');
 
-        // Set up log file
+        // Deliberately does NOT override the 'error_log' ini setting: doing so
-        self::$logFile = sys_get_temp_dir() . '/tinker_tickets_errors.log';
+        // used to redirect every error_log() call in the request to a fixed
-        ini_set('error_log', self::$logFile);
+        // /tmp file, silently diverting logs away from wherever the server is
+        // actually configured to send them (php-fpm's error_log, stdout in a
+        // container, etc.) the moment this got wired into more than one
+        // endpoint. self::$logFile / getRecentErrors() are unused (no callers
+        // app-wide) and exist only as an opt-in helper if something later
+        // wants a dedicated log file.
 
         // Register handlers
         set_error_handler([self::class, 'handleError']);
@@ -151,6 +161,17 @@ class ErrorHandler
     {
         http_response_code($httpCode);
 
+        if (self::$responseMode === 'html') {
+            if (!headers_sent()) {
+                header('Content-Type: text/html; charset=utf-8');
+            }
+            // Deliberately not passed $message/$exception — see error_500.php's
+            // docblock on why the fatal-error page must render with zero
+            // dependency on request-specific state.
+            include dirname(__DIR__) . '/views/error_500.php';
+            exit;
+        }
+
         if (!headers_sent()) {
             header('Content-Type: application/json');
         }

helpers/NotificationHelper.php

@@ -20,6 +20,12 @@ class NotificationHelper
         curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));
         curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
         curl_setopt($ch, CURLOPT_TIMEOUT, 10);
+        // A slow-but-not-fully-hung hookshot endpoint could otherwise add up
+        // to the full CURLOPT_TIMEOUT per fire() call, and a single request
+        // can call fire() (via notifyWatchers/sendCommentNotification/etc.)
+        // more than once sequentially — capping just the connect phase keeps
+        // that from stacking into tens of seconds of added latency.
+        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 3);
 
         $response  = curl_exec($ch);
         $httpCode  = curl_getinfo($ch, CURLINFO_HTTP_CODE);
@@ -40,20 +46,57 @@ class NotificationHelper
         return array_values(array_filter(array_map('trim', explode(',', $raw))));
     }
 
+    /**
+     * Redact a ticket title for the shared Matrix notify list when the
+     * ticket isn't public, matching how sendCommentNotification() and
+     * notifyWatchers() already redact comment/activity previews for the
+     * same list.
+     */
+    private static function redactedTitle(string $title, string $visibility): string
+    {
+        return $visibility === 'public' ? $title : '(restricted ticket — title hidden)';
+    }
+
     // ─── Public event methods ─────────────────────────────────────────────────
 
+    /**
+     * Generic operational alert with no associated ticket (e.g. a recurring
+     * schedule whose ticket creation failed after its next_run_at was
+     * already advanced, so the missed occurrence has no other record an
+     * admin would normally see). Always sent to the shared
+     * MATRIX_NOTIFY_USERS list, regardless of any per-event notify toggle.
+     */
+    public static function sendSystemAlert(string $message, array $context = []): void
+    {
+        self::fire(array_merge([
+            'event'   => 'system_alert',
+            'message' => $message,
+        ], $context, [
+            'notify_users' => self::notifyUsers(),
+        ]));
+    }
+
     /**
      * New ticket created (manual or automated/API).
+     *
+     * $ticketData['visibility'] ('public', 'internal', or 'confidential') is
+     * used to redact the title sent to the shared MATRIX_NOTIFY_USERS list
+     * for non-public tickets, same as sendCommentNotification()'s preview
+     * redaction. Defaults to 'public' for callers (e.g. the hwmonDaemon
+     * Bearer-API paths) that never set a non-default visibility.
      */
     public static function sendTicketNotification($ticketId, array $ticketData, string $trigger = 'manual'): void
     {
-        preg_match('/^\[([^\]]+)\]/', $ticketData['title'] ?? '', $m);
+        $visibility = $ticketData['visibility'] ?? 'public';
+        $title = $ticketData['title'] ?? 'Untitled';
+
+        preg_match('/^\[([^\]]+)\]/', $title, $m);
         $source = $m[1] ?? ($trigger === 'automated' ? 'Automated' : 'Manual');
 
         self::fire([
             'event'        => 'ticket_created',
             'ticket_id'    => $ticketId,
-            'title'        => $ticketData['title']    ?? 'Untitled',
+            'title'        => self::redactedTitle($title, $visibility),
             'priority'     => (int)($ticketData['priority'] ?? 4),
             'category'     => $ticketData['category'] ?? 'General',
             'type'         => $ticketData['type']     ?? 'Issue',
@@ -73,13 +116,16 @@ class NotificationHelper
      * @param string     $newStatus
      * @param string     $ticketTitle
      * @param string|null $changedByDisplay  Display name of the user who changed status
+     * @param string      $visibility        Ticket visibility; non-public titles are
+     *                                        redacted before being sent to the shared
+     *                                        notify list, same as sendTicketNotification().
      */
-    public static function sendStatusChangeNotification($ticketId, string $oldStatus, string $newStatus, string $ticketTitle, ?string $changedByDisplay = null): void
+    public static function sendStatusChangeNotification($ticketId, string $oldStatus, string $newStatus, string $ticketTitle, ?string $changedByDisplay = null, string $visibility = 'public'): void
     {
         self::fire([
             'event'          => 'status_changed',
             'ticket_id'      => $ticketId,
-            'title'          => $ticketTitle,
+            'title'          => self::redactedTitle($ticketTitle, $visibility),
             'old_status'     => $oldStatus,
             'new_status'     => $newStatus,
             'changed_by'     => $changedByDisplay,
@@ -166,11 +212,12 @@ class NotificationHelper
      * @param array       $extraData    Merged into the payload (old_status/new_status, author, etc.)
      * @param int|null    $excludeUserId  Don't notify the actor themselves
      * @param string      $visibility   Ticket visibility: 'public', 'internal', or
-     *                                   'confidential'. notify_users includes the
+     *                                   'confidential'. The shared notify list may
-     *                                   shared list, which may contain users without
+     *                                   contain users without access to non-public
-     *                                   access to non-public tickets, so any comment
+     *                                   tickets, so for those tickets it's excluded
-     *                                   body preview in $extraData is redacted for
+     *                                   entirely (only actual watchers are notified)
-     *                                   non-public tickets.
+     *                                   and both the title and any comment/body
+     *                                   preview in $extraData are redacted.
      */
     public static function notifyWatchers(\mysqli $conn, $ticketId, string $ticketTitle, string $event, array $extraData = [], ?int $excludeUserId = null, string $visibility = 'public'): void
     {
@@ -204,9 +251,9 @@ class NotificationHelper
                 return;
             }
             if ($excludeUserId !== null) {
-                $stmt->bind_param("ii", $ticketId, $excludeUserId);
+                $stmt->bind_param("si", $ticketId, $excludeUserId);
             } else {
-                $stmt->bind_param("i", $ticketId);
+                $stmt->bind_param("s", $ticketId);
             }
             $stmt->execute();
             $result = $stmt->get_result();
@@ -230,13 +277,17 @@ class NotificationHelper
             return;
         }
 
-        // Remove the global notify list duplicates and build payload
+        // The shared notify list may include users without access to
-        $allNotify = array_unique(array_merge($matrixIds, self::notifyUsers()));
+        // non-public tickets, so only mix it in for public tickets — for
+        // internal/confidential tickets, notify actual watchers only.
+        $allNotify = $visibility === 'public'
+            ? array_unique(array_merge($matrixIds, self::notifyUsers()))
+            : $matrixIds;
 
         $payload = array_merge($extraData, [
             'event'        => $event,
             'ticket_id'    => $ticketId,
-            'title'        => $ticketTitle,
+            'title'        => self::redactedTitle($ticketTitle, $visibility),
             'url'          => UrlHelper::ticketUrl($ticketId),
             'notify_users' => array_values($allNotify),
         ]);
@@ -252,8 +303,14 @@ class NotificationHelper
      * @param string|null $assigneeName    Display name of new assignee
      * @param string|null $assigneeMatrix  Matrix user ID of new assignee (to DM)
      * @param string|null $changedByDisplay
+     * @param string      $visibility      Ticket visibility; non-public titles are
+     *                                      redacted before being sent to the shared
+     *                                      notify list, same as sendTicketNotification().
+     *                                      The assignee is DMed directly regardless,
+     *                                      since they now have standing access to the
+     *                                      ticket by virtue of being assigned to it.
      */
-    public static function sendAssignmentNotification($ticketId, string $ticketTitle, ?string $assigneeName, ?string $assigneeMatrix, ?string $changedByDisplay = null): void
+    public static function sendAssignmentNotification($ticketId, string $ticketTitle, ?string $assigneeName, ?string $assigneeMatrix, ?string $changedByDisplay = null, string $visibility = 'public'): void
     {
         $notifyUsers = self::notifyUsers();
         // Also notify the assignee directly if we know their Matrix ID
@@ -267,7 +324,7 @@ class NotificationHelper
         self::fire([
             'event'        => 'assigned',
             'ticket_id'    => $ticketId,
-            'title'        => $ticketTitle,
+            'title'        => self::redactedTitle($ticketTitle, $visibility),
             'assignee'     => $assigneeName,
             'changed_by'   => $changedByDisplay,
             'url'          => UrlHelper::ticketUrl($ticketId),

helpers/OutputHelper.php

@@ -1,212 +0,0 @@
-<?php
-
-/**
- * OutputHelper - Consistent output escaping utilities
- *
- * Provides secure HTML escaping functions to prevent XSS attacks.
- * Use these functions when outputting user-controlled data.
- */
-class OutputHelper
-{
-    /**
-     * Escape string for HTML output
-     *
-     * Use for text content inside HTML elements.
-     * Example: <p><?= OutputHelper::h($userInput) ?></p>
-     *
-     * @param string|null $string The string to escape
-     * @param int $flags htmlspecialchars flags (default: ENT_QUOTES | ENT_HTML5)
-     * @return string Escaped string
-     */
-    public static function h(?string $string, int $flags = ENT_QUOTES | ENT_HTML5): string
-    {
-        if ($string === null) {
-            return '';
-        }
-        return htmlspecialchars($string, $flags, 'UTF-8');
-    }
-
-    /**
-     * Escape string for HTML attribute context
-     *
-     * Use for values inside HTML attributes.
-     * Example: <input value="<?= OutputHelper::attr($userInput) ?>">
-     *
-     * @param string|null $string The string to escape
-     * @return string Escaped string
-     */
-    public static function attr(?string $string): string
-    {
-        if ($string === null) {
-            return '';
-        }
-        // More aggressive escaping for attribute context
-        return htmlspecialchars($string, ENT_QUOTES | ENT_HTML5 | ENT_SUBSTITUTE, 'UTF-8');
-    }
-
-    /**
-     * Encode data as JSON for JavaScript context
-     *
-     * Use when embedding data in JavaScript.
-     * Example: <script>const data = <?= OutputHelper::json($data) ?>;</script>
-     *
-     * @param mixed $data The data to encode
-     * @param int $flags json_encode flags
-     * @return string JSON encoded string (safe for script context)
-     */
-    public static function json($data, int $flags = 0): string
-    {
-        // Use HEX encoding for safety in HTML context
-        $safeFlags = JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP | $flags;
-        return json_encode($data, $safeFlags);
-    }
-
-    /**
-     * URL encode a string
-     *
-     * Use for values in URL query strings.
-     * Example: <a href="/search?q=<?= OutputHelper::url($query) ?>">
-     *
-     * @param string|null $string The string to encode
-     * @return string URL encoded string
-     */
-    public static function url(?string $string): string
-    {
-        if ($string === null) {
-            return '';
-        }
-        return rawurlencode($string);
-    }
-
-    /**
-     * Escape for CSS context
-     *
-     * Use for values in inline CSS.
-     * Example: <div style="color: <?= OutputHelper::css($color) ?>;">
-     *
-     * @param string|null $string The string to escape
-     * @return string Escaped string (only allows safe characters)
-     */
-    public static function css(?string $string): string
-    {
-        if ($string === null) {
-            return '';
-        }
-        // Only allow alphanumeric, hyphens, underscores, spaces, and common CSS values
-        if (!preg_match('/^[a-zA-Z0-9_\-\s#.,()%]+$/', $string)) {
-            return '';
-        }
-        return $string;
-    }
-
-    /**
-     * Format a number safely
-     *
-     * Ensures output is always a valid number.
-     *
-     * @param mixed $number The number to format
-     * @param int $decimals Number of decimal places
-     * @return string Formatted number
-     */
-    public static function number($number, int $decimals = 0): string
-    {
-        return number_format((float)$number, $decimals, '.', ',');
-    }
-
-    /**
-     * Format an integer safely
-     *
-     * @param mixed $value The value to format
-     * @return int Integer value
-     */
-    public static function int($value): int
-    {
-        return (int)$value;
-    }
-
-    /**
-     * Truncate string with ellipsis
-     *
-     * @param string|null $string The string to truncate
-     * @param int $length Maximum length
-     * @param string $suffix Suffix to add if truncated
-     * @return string Truncated and escaped string
-     */
-    public static function truncate(?string $string, int $length = 100, string $suffix = '...'): string
-    {
-        if ($string === null) {
-            return '';
-        }
-
-        if (mb_strlen($string, 'UTF-8') <= $length) {
-            return self::h($string);
-        }
-
-        return self::h(mb_substr($string, 0, $length, 'UTF-8')) . self::h($suffix);
-    }
-
-    /**
-     * Format a date safely
-     *
-     * @param string|int|null $date Date string, timestamp, or null
-     * @param string $format PHP date format
-     * @return string Formatted date
-     */
-    public static function date($date, string $format = 'Y-m-d H:i:s'): string
-    {
-        if ($date === null || $date === '') {
-            return '';
-        }
-
-        if (is_numeric($date)) {
-            return date($format, (int)$date);
-        }
-
-        $timestamp = strtotime($date);
-        if ($timestamp === false) {
-            return '';
-        }
-
-        return date($format, $timestamp);
-    }
-
-    /**
-     * Check if a string is safe for use as a CSS class name
-     *
-     * @param string $class The class name to validate
-     * @return bool True if safe
-     */
-    public static function isValidCssClass(string $class): bool
-    {
-        return preg_match('/^[a-zA-Z_][a-zA-Z0-9_-]*$/', $class) === 1;
-    }
-
-    /**
-     * Sanitize CSS class name(s)
-     *
-     * @param string|null $classes Space-separated class names
-     * @return string Sanitized class names
-     */
-    public static function cssClass(?string $classes): string
-    {
-        if ($classes === null || $classes === '') {
-            return '';
-        }
-
-        $classList = explode(' ', $classes);
-        $validClasses = array_filter($classList, [self::class, 'isValidCssClass']);
-
-        return implode(' ', $validClasses);
-    }
-}
-
-/**
- * Shorthand function for HTML escaping
- *
- * @param string|null $string The string to escape
- * @return string Escaped string
- */
-function h(?string $string): string
-{
-    return OutputHelper::h($string);
-}

index.php

@@ -1,10 +1,18 @@
 <?php
 
 // Main entry point for the application
+
+// Registered first, before anything else, so a genuine fatal anywhere below
+// (including during config.php's own env parsing) renders the styled 500
+// page instead of falling through to PHP's raw default error handling.
+require_once 'helpers/ErrorHandler.php';
+ErrorHandler::init(false, 'html');
+
 require_once 'config/config.php';
 require_once 'middleware/SecurityHeadersMiddleware.php';
 require_once 'middleware/AuthMiddleware.php';
 require_once 'models/AuditLogModel.php';
+require_once 'helpers/Database.php';
 
 // Apply security headers early
 SecurityHeadersMiddleware::apply();
@@ -17,15 +25,12 @@ $requestPath = strtok($request, '?');
 
 // Create database connection for non-API routes
 if (!str_starts_with($requestPath, '/api/')) {
-    $conn = new mysqli(
+    try {
-        $GLOBALS['config']['DB_HOST'],
+        $conn = Database::getConnection();
-        $GLOBALS['config']['DB_USER'],
+    } catch (\Throwable $e) {
-        $GLOBALS['config']['DB_PASS'],
+        error_log('index.php: database connection failed: ' . $e->getMessage());
-        $GLOBALS['config']['DB_NAME']
+        http_response_code(500);
-    );
+        die('Sorry, something went wrong. Please try again shortly.');
-
-    if ($conn->connect_error) {
-        die("Connection failed: " . $conn->connect_error);
     }
 
     // Authenticate user via Authelia forward auth
@@ -383,21 +388,34 @@ switch (true) {
                     GROUP BY user_id
                 ) cm ON u.user_id = cm.user_id
                 LEFT JOIN (
-                    SELECT assigned_to, COUNT(*) as tickets_assigned
+                    -- Assignment date, not ticket creation date: a ticket created
-                    FROM tickets
+                    -- outside the range but assigned within it should count, and
-                    WHERE DATE(created_at) BETWEEN ? AND ?
+                    -- one created in-range but assigned later shouldn't (until it
+                    -- is). Derived from audit_log's 'assign' events since tickets
+                    -- has no assigned_at column; COUNT(DISTINCT ...) so a ticket
+                    -- reassigned more than once to the same user in-range still
+                    -- counts once.
+                    SELECT
+                        CAST(JSON_UNQUOTE(JSON_EXTRACT(details, '$.assigned_to')) AS UNSIGNED) as assigned_to,
+                        COUNT(DISTINCT entity_id) as tickets_assigned
+                    FROM audit_log
+                    WHERE action_type = 'assign' AND entity_type = 'ticket'
+                        AND DATE(created_at) BETWEEN ? AND ?
                     GROUP BY assigned_to
                 ) ta ON u.user_id = ta.assigned_to
                 LEFT JOIN (
                     SELECT user_id, MAX(created_at) as last_activity
                     FROM audit_log
+                    WHERE DATE(created_at) BETWEEN ? AND ?
                     GROUP BY user_id
                 ) al ON u.user_id = al.user_id
                 ORDER BY tickets_created DESC, tickets_resolved DESC";
 
         $stmt = $conn->prepare($sql);
         $stmt->bind_param(
-            'ssssssss',
+            'ssssssssss',
+            $dateRange['from'],
+            $dateRange['to'],
             $dateRange['from'],
             $dateRange['to'],
             $dateRange['from'],
@@ -441,5 +459,5 @@ switch (true) {
 
 // Close database connection if it was opened
 if (isset($conn)) {
-    $conn->close();
+    Database::close();
 }

middleware/AuthMiddleware.php

@@ -92,6 +92,19 @@ class AuthMiddleware
             } else {
                 // Update last activity time
                 $_SESSION['last_activity'] = time();
+
+                // Periodically re-validate Remote-User/Remote-Groups against
+                // current Authelia/LLDAP state, so a revoked admin (or anyone
+                // dropped from the required groups) loses access promptly
+                // instead of keeping it for up to SESSION_TIMEOUT. Only the
+                // idle timer was checked above; nothing previously re-read
+                // these headers once a session already existed.
+                $resyncInterval = $GLOBALS['config']['PRIVILEGE_RESYNC_INTERVAL'] ?? 300;
+                $lastSync = $_SESSION['last_privilege_sync'] ?? 0;
+                if (time() - $lastSync > $resyncInterval) {
+                    $this->resyncPrivileges();
+                }
+
                 return $_SESSION['user'];
             }
         }
@@ -134,6 +147,7 @@ class AuthMiddleware
         // Store user in session
         $_SESSION['user'] = $user;
         $_SESSION['last_activity'] = time();
+        $_SESSION['last_privilege_sync'] = time();
 
         // Generate new CSRF token on login
         require_once __DIR__ . '/CsrfMiddleware.php';
@@ -142,6 +156,64 @@ class AuthMiddleware
         return $user;
     }
 
+    /**
+     * Re-validate the current session's Remote-User/Remote-Groups against
+     * this request's forward-auth headers, and re-sync or revoke access on
+     * mismatch. Called periodically (PRIVILEGE_RESYNC_INTERVAL) from an
+     * already-authenticated session — see authenticate().
+     *
+     * Best-effort: if this particular request doesn't carry forward-auth
+     * headers at all (e.g. a proxy hiccup), the session is left as-is rather
+     * than force-logging the user out, and the check is simply retried on
+     * the next request past the interval.
+     */
+    private function resyncPrivileges(): void
+    {
+        $username = $this->getHeader('HTTP_REMOTE_USER');
+        $groups = $this->getHeader('HTTP_REMOTE_GROUPS');
+
+        if (empty($username)) {
+            return;
+        }
+
+        $this->enforceTrustedProxy();
+
+        // A different Remote-User than the session's own means Authelia is
+        // now asserting a different identity entirely for this proxy path;
+        // don't silently relabel the session as that other user.
+        if ($username !== ($_SESSION['user']['username'] ?? null)) {
+            return;
+        }
+
+        if (!$this->checkGroupAccess($groups)) {
+            $this->logSecurityEvent('privilege_resync_revoked', [
+                'username' => $username,
+                'groups' => $groups ?: 'none',
+            ]);
+            session_unset();
+            session_destroy();
+            $this->redirectToAuth();
+            exit;
+        }
+
+        $displayName = $this->getHeader('HTTP_REMOTE_NAME');
+        $email = $this->getHeader('HTTP_REMOTE_EMAIL');
+
+        // Bypass UserModel's 5-minute in-process cache — that cache key isn't
+        // group-aware, so a stale cached hit here would silently keep serving
+        // the pre-revocation is_admin value for the rest of the cache's TTL.
+        UserModel::invalidateCache(null, $username);
+        $user = $this->userModel->syncUserFromAuthelia($username, $displayName, $email, $groups);
+
+        $wasAdmin = !empty($_SESSION['user']['is_admin']);
+        if ($wasAdmin && empty($user['is_admin'])) {
+            $this->logSecurityEvent('privilege_resync_admin_revoked', ['username' => $username]);
+        }
+
+        $_SESSION['user'] = $user;
+        $_SESSION['last_privilege_sync'] = time();
+    }
+
     /**
      * Reject forward-auth headers that did not arrive via a trusted proxy.
      *

middleware/RateLimitMiddleware.php

@@ -3,21 +3,34 @@
 /**
  * Rate Limiting Middleware
  *
- * Implements both session-based and IP-based rate limiting to prevent abuse.
+ * Implements session-based, IP-based, and (for Bearer-authenticated
- * IP-based limiting prevents attackers from bypassing limits by creating new sessions.
+ * requests) API-key-based rate limiting to prevent abuse.
+ * IP-based limiting prevents attackers from bypassing limits by creating new
+ * sessions; API-key-based limiting keeps distinct Bearer clients from
+ * starving each other's shared IP bucket.
  */
 class RateLimitMiddleware
 {
-    // Default limits
+    // Fallback limits, used only if $GLOBALS['config'] isn't populated
+    // (e.g. very early in bootstrap, or a test harness). Normal requests read
+    // RATE_LIMIT_DEFAULT/RATE_LIMIT_API from config (backed by .env).
     public const DEFAULT_LIMIT = 100;      // requests per window (session)
     public const API_LIMIT = 60;           // API requests per window (session)
     public const IP_LIMIT = 300;           // IP-based requests per window (more generous)
     public const IP_API_LIMIT = 120;       // IP-based API requests per window
+    public const API_KEY_LIMIT = 120;      // Per-Bearer-token requests per window
     public const WINDOW_SECONDS = 60;      // 1 minute window
 
     // Directory for IP rate limit storage
     private static ?string $rateLimitDir = null;
 
+    private static function sessionLimit(string $type): int
+    {
+        $configKey = $type === 'api' ? 'RATE_LIMIT_API' : 'RATE_LIMIT_DEFAULT';
+        $fallback = $type === 'api' ? self::API_LIMIT : self::DEFAULT_LIMIT;
+        return (int)($GLOBALS['config'][$configKey] ?? $fallback);
+    }
+
     /**
      * Get the rate limit storage directory
      *
@@ -69,24 +82,47 @@ class RateLimitMiddleware
     }
 
     /**
-     * Check IP-based rate limit
+     * Extract the raw Bearer token from the Authorization header, if present.
+     * Deliberately independent of ApiKeyAuth: rate limiting must be cheap and
+     * must not require a DB round-trip to validate the key before counting
+     * the request, and needs to run whether or not the token turns out to be
+     * valid. The raw token string (not the validated api_key_id) is hashed as
+     * the bucket identifier — good enough to isolate distinct keys/clients
+     * from each other without needing to authenticate first.
      *
-     * @param string $type 'default' or 'api'
+     * @return string|null
-     * @return bool True if request is allowed, false if rate limited
      */
-    private static function checkIpRateLimit(string $type = 'default'): bool
+    private static function getBearerToken(): ?string
     {
-        $ip = self::getClientIp();
+        $header = $_SERVER['HTTP_AUTHORIZATION']
-        $limit = $type === 'api' ? self::IP_API_LIMIT : self::IP_LIMIT;
+            ?? $_SERVER['REDIRECT_HTTP_AUTHORIZATION']
-        $now = time();
+            ?? null;
+        if ($header === null && function_exists('getallheaders')) {
+            $headers = getallheaders();
+            $header = $headers['Authorization'] ?? null;
+        }
+        if ($header && preg_match('/^Bearer\s+(.+)$/i', $header, $m)) {
+            return $m[1];
+        }
+        return null;
+    }
 
-        // Create a hash of the IP for the filename (security + filesystem safety)
+    /**
-        $ipHash = hash('sha256', $ip . '_' . $type);
+     * Generic file-based sliding-window counter, shared by the IP-based and
-        $filePath = self::getRateLimitDir() . '/' . $ipHash . '.json';
+     * API-key-based buckets below.
+     *
+     * @param string $bucketKey Stable identifier for this bucket (already hashed)
+     * @param int    $limit     Max requests allowed per window
+     * @return bool True if this request is within the limit
+     */
+    private static function checkCounter(string $bucketKey, int $limit): bool
+    {
+        $now = time();
+        $filePath = self::getRateLimitDir() . '/' . $bucketKey . '.json';
 
         // Hold an exclusive lock across the whole read-modify-write so concurrent
-        // requests from the same IP can't both read the same count and each write
+        // requests from the same bucket can't both read the same count and each
-        // count+1 (which would undercount and let the limit be exceeded).
+        // write count+1 (which would undercount and let the limit be exceeded).
         $fh = @fopen($filePath, 'c+');
         if ($fh === false) {
             // Can't open the counter file — fail open (don't block legitimate traffic).
@@ -122,10 +158,60 @@ class RateLimitMiddleware
         flock($fh, LOCK_UN);
         fclose($fh);
 
-        // Check if over limit
         return $rateData['count'] <= $limit;
     }
 
+    /**
+     * Read (without incrementing) the current state of a counter bucket, for
+     * status/header reporting.
+     */
+    private static function peekCounter(string $bucketKey, int $limit): array
+    {
+        $now = time();
+        $filePath = self::getRateLimitDir() . '/' . $bucketKey . '.json';
+
+        $rateData = null;
+        $content = @file_get_contents($filePath);
+        if ($content !== false && $content !== '') {
+            $decoded = json_decode($content, true);
+            if (is_array($decoded)) {
+                $rateData = $decoded;
+            }
+        }
+
+        if ($rateData === null || $now - ($rateData['window_start'] ?? $now) >= self::WINDOW_SECONDS) {
+            return ['limit' => $limit, 'remaining' => $limit, 'reset' => $now + self::WINDOW_SECONDS];
+        }
+
+        return [
+            'limit' => $limit,
+            'remaining' => max(0, $limit - $rateData['count']),
+            'reset' => $rateData['window_start'] + self::WINDOW_SECONDS,
+        ];
+    }
+
+    private static function ipBucketKey(string $type): string
+    {
+        return hash('sha256', self::getClientIp() . '_' . $type);
+    }
+
+    private static function apiKeyBucketKey(string $token): string
+    {
+        return hash('sha256', 'apikey_' . $token);
+    }
+
+    /**
+     * Check IP-based rate limit
+     *
+     * @param string $type 'default' or 'api'
+     * @return bool True if request is allowed, false if rate limited
+     */
+    private static function checkIpRateLimit(string $type = 'default'): bool
+    {
+        $limit = $type === 'api' ? self::IP_API_LIMIT : self::IP_LIMIT;
+        return self::checkCounter(self::ipBucketKey($type), $limit);
+    }
+
     /**
      * Clean up old rate limit files (call periodically)
      *
@@ -185,7 +271,14 @@ class RateLimitMiddleware
     }
 
     /**
-     * Check rate limit for current request (both session and IP)
+     * Check rate limit for current request.
+     *
+     * Bearer-authenticated requests (Authorization: Bearer ...) are limited
+     * by a per-token bucket instead of a session — a stateless API client
+     * never sends a session cookie back, so the session-based counter never
+     * accumulates and starting a session for it is pure overhead. The
+     * IP-based bucket still applies underneath as defense-in-depth against
+     * volumetric abuse from one network path.
      *
      * @param string $type 'default' or 'api'
      * @return bool True if request is allowed, false if rate limited
@@ -197,12 +290,17 @@ class RateLimitMiddleware
             return false;
         }
 
+        $token = self::getBearerToken();
+        if ($token !== null) {
+            return self::checkCounter(self::apiKeyBucketKey($token), self::API_KEY_LIMIT);
+        }
+
         // Then check session-based rate limit
         if (session_status() === PHP_SESSION_NONE) {
             session_start();
         }
 
-        $limit = $type === 'api' ? self::API_LIMIT : self::DEFAULT_LIMIT;
+        $limit = self::sessionLimit($type);
         $key = 'rate_limit_' . $type;
         $now = time();
 
@@ -270,18 +368,28 @@ class RateLimitMiddleware
     }
 
     /**
-     * Get current rate limit status
+     * Get current rate limit status.
+     *
+     * For a Bearer-authenticated request, reports the per-API-key bucket
+     * (the one that actually governs it) rather than the session-based
+     * counter, which is meaningless for a client that never sends a session
+     * cookie back.
      *
      * @param string $type 'default' or 'api'
      * @return array Rate limit status
      */
     public static function getStatus(string $type = 'default'): array
     {
+        $token = self::getBearerToken();
+        if ($token !== null) {
+            return self::peekCounter(self::apiKeyBucketKey($token), self::API_KEY_LIMIT);
+        }
+
         if (session_status() === PHP_SESSION_NONE) {
             session_start();
         }
 
-        $limit = $type === 'api' ? self::API_LIMIT : self::DEFAULT_LIMIT;
+        $limit = self::sessionLimit($type);
         $key = 'rate_limit_' . $type;
         $now = time();
 

migrations/000_baseline.sql

@@ -57,7 +57,7 @@ CREATE TABLE IF NOT EXISTS `bulk_operations` (
   `operation_id` int(11) NOT NULL AUTO_INCREMENT,
   `operation_type` varchar(50) NOT NULL,
   `ticket_ids` text NOT NULL,
-  `performed_by` int(11) NOT NULL,
+  `performed_by` int(11) DEFAULT NULL,
   `parameters` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL CHECK (json_valid(`parameters`)),
   -- 32, not 20: 'completed_with_errors' is 21 chars (see 001_widen_bulk_operations_status.sql)
   `status` varchar(32) DEFAULT 'pending',
@@ -69,7 +69,7 @@ CREATE TABLE IF NOT EXISTS `bulk_operations` (
   PRIMARY KEY (`operation_id`),
   KEY `idx_performed_by` (`performed_by`),
   KEY `idx_created_at` (`created_at`),
-  CONSTRAINT `bulk_operations_ibfk_1` FOREIGN KEY (`performed_by`) REFERENCES `users` (`user_id`)
+  CONSTRAINT `bulk_operations_ibfk_1` FOREIGN KEY (`performed_by`) REFERENCES `users` (`user_id`) ON DELETE SET NULL
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
 
 -- ============ custom_field_definitions ============
@@ -155,7 +155,7 @@ CREATE TABLE IF NOT EXISTS `saved_filters` (
   UNIQUE KEY `unique_user_filter_name` (`user_id`,`filter_name`),
   KEY `idx_user_filters` (`user_id`,`is_default`),
   CONSTRAINT `saved_filters_ibfk_1` FOREIGN KEY (`user_id`) REFERENCES `users` (`user_id`) ON DELETE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
 
 -- ============ status_transitions ============
 CREATE TABLE IF NOT EXISTS `status_transitions` (
@@ -185,7 +185,7 @@ CREATE TABLE IF NOT EXISTS `ticket_attachments` (
   KEY `idx_attachments_ticket` (`ticket_id`),
   KEY `idx_attachments_uploaded_by` (`uploaded_by`),
   CONSTRAINT `ticket_attachments_ibfk_1` FOREIGN KEY (`uploaded_by`) REFERENCES `users` (`user_id`) ON DELETE SET NULL
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
 
 -- ============ ticket_comments ============
 CREATE TABLE IF NOT EXISTS `ticket_comments` (
@@ -238,16 +238,17 @@ CREATE TABLE IF NOT EXISTS `ticket_templates` (
   PRIMARY KEY (`template_id`),
   KEY `created_by` (`created_by`),
   KEY `idx_template_name` (`template_name`),
-  CONSTRAINT `ticket_templates_ibfk_1` FOREIGN KEY (`created_by`) REFERENCES `users` (`user_id`)
+  CONSTRAINT `ticket_templates_ibfk_1` FOREIGN KEY (`created_by`) REFERENCES `users` (`user_id`) ON DELETE SET NULL
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
 
 -- ============ ticket_watchers ============
 CREATE TABLE IF NOT EXISTS `ticket_watchers` (
-  `ticket_id` int(11) NOT NULL,
+  `ticket_id` varchar(9) NOT NULL,
   `user_id` int(11) NOT NULL,
   `created_at` timestamp NOT NULL DEFAULT current_timestamp(),
   PRIMARY KEY (`ticket_id`,`user_id`),
-  KEY `idx_watcher_user` (`user_id`)
+  KEY `idx_watcher_user` (`user_id`),
+  CONSTRAINT `fk_watchers_ticket_id` FOREIGN KEY (`ticket_id`) REFERENCES `tickets` (`ticket_id`) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
 
 -- ============ tickets ============

migrations/002_fix_collation_consistency.sql

@@ -0,0 +1,30 @@
+-- Fix collation inconsistency on saved_filters and ticket_attachments
+--
+-- README.md Developer Notes #12: "Database collation: Use
+-- utf8mb4_general_ci (not unicode_ci) for new tables." These two tables
+-- were created with utf8mb4_unicode_ci instead, inconsistent with every
+-- other table in the schema. Mixed collations don't break anything by
+-- themselves, but any future query joining/comparing these columns
+-- against general_ci columns needs explicit COLLATE casts or hits
+-- "Illegal mix of collations" errors.
+--
+-- Safe to re-run.
+
+ALTER TABLE `saved_filters`
+    CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
+
+-- saved_filters.filter_criteria is pinned to utf8mb4_bin (for the
+-- json_valid() CHECK constraint) — restore that after the table-wide
+-- CONVERT TO above, which resets it to general_ci. MariaDB drops the
+-- inline CHECK when the column is MODIFYed, so re-add it explicitly.
+ALTER TABLE `saved_filters`
+    MODIFY COLUMN `filter_criteria` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin NOT NULL;
+
+ALTER TABLE `saved_filters`
+    DROP CONSTRAINT IF EXISTS `saved_filters_filter_criteria_json`;
+
+ALTER TABLE `saved_filters`
+    ADD CONSTRAINT `saved_filters_filter_criteria_json` CHECK (json_valid(`filter_criteria`));
+
+ALTER TABLE `ticket_attachments`
+    CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;

migrations/003_fk_on_delete_set_null.sql

@@ -0,0 +1,32 @@
+-- Fix inconsistent FK ON DELETE behavior on bulk_operations.performed_by and
+-- ticket_templates.created_by
+--
+-- Every other user-reference FK in the schema (tickets.created_by/updated_by/
+-- assigned_to, ticket_attachments.uploaded_by, ticket_dependencies.created_by,
+-- recurring_tickets.created_by/assigned_to, api_keys.created_by, etc.) uses
+-- ON DELETE SET NULL. These two had no ON DELETE clause at all, which
+-- defaults to RESTRICT — so deleting a user who ever ran a bulk operation or
+-- created a template hard-fails at the DB level instead of nulling the
+-- reference, breaking the pattern used everywhere else and potentially
+-- blocking legitimate user offboarding/cleanup.
+--
+-- bulk_operations.performed_by is NOT NULL today; it must become nullable to
+-- support SET NULL, matching how every other SET NULL column in the schema
+-- is defined.
+--
+-- Safe to re-run.
+
+ALTER TABLE `bulk_operations`
+    MODIFY COLUMN `performed_by` int(11) DEFAULT NULL;
+
+ALTER TABLE `bulk_operations`
+    DROP FOREIGN KEY IF EXISTS `bulk_operations_ibfk_1`;
+
+ALTER TABLE `bulk_operations`
+    ADD CONSTRAINT `bulk_operations_ibfk_1` FOREIGN KEY (`performed_by`) REFERENCES `users` (`user_id`) ON DELETE SET NULL;
+
+ALTER TABLE `ticket_templates`
+    DROP FOREIGN KEY IF EXISTS `ticket_templates_ibfk_1`;
+
+ALTER TABLE `ticket_templates`
+    ADD CONSTRAINT `ticket_templates_ibfk_1` FOREIGN KEY (`created_by`) REFERENCES `users` (`user_id`) ON DELETE SET NULL;

migrations/004_fix_ticket_watchers_type.sql

@@ -0,0 +1,28 @@
+-- Fix ticket_watchers.ticket_id type mismatch and missing FK to tickets
+--
+-- ticket_watchers.ticket_id was int(11), while every other satellite table
+-- (ticket_comments, ticket_attachments, ticket_dependencies,
+-- custom_field_values) stores it as varchar(9)/varchar(10) matching
+-- tickets.ticket_id. There was also no FK constraint at all, unlike every
+-- other satellite table, so orphaned watcher rows could never be caught by
+-- referential integrity. Ticket IDs are always 9-digit numeric strings
+-- (see TicketModel::create's sprintf('%09d', ...)), so the int -> varchar(9)
+-- conversion below is lossless for real data.
+--
+-- Safe to re-run.
+
+-- Remove any watcher rows that no longer point at a real ticket (possible
+-- today precisely because there was no FK to prevent it) before adding the
+-- constraint, since orphans would make the ADD CONSTRAINT below fail.
+DELETE tw FROM `ticket_watchers` tw
+    LEFT JOIN `tickets` t ON tw.`ticket_id` = t.`ticket_id`
+    WHERE t.`ticket_id` IS NULL;
+
+ALTER TABLE `ticket_watchers`
+    MODIFY COLUMN `ticket_id` varchar(9) NOT NULL;
+
+ALTER TABLE `ticket_watchers`
+    DROP FOREIGN KEY IF EXISTS `fk_watchers_ticket_id`;
+
+ALTER TABLE `ticket_watchers`
+    ADD CONSTRAINT `fk_watchers_ticket_id` FOREIGN KEY (`ticket_id`) REFERENCES `tickets` (`ticket_id`) ON DELETE CASCADE;

migrations/005_attachment_thumbnails.sql

@@ -0,0 +1,14 @@
+-- Add a nullable thumbnail_filename column to ticket_attachments so an image
+-- upload can store a separately-generated, resized preview alongside the
+-- full-size original. NULL means no thumbnail exists (non-image, GD
+-- unavailable at upload time, or an attachment uploaded before this existed)
+-- and callers fall back to the full-size original.
+--
+-- scripts/cleanup_orphan_uploads.php's orphan lookup is updated in the same
+-- change to also match thumbnail_filename, so generated thumbnails aren't
+-- swept up as orphans.
+--
+-- Safe to re-run.
+
+ALTER TABLE `ticket_attachments`
+    ADD COLUMN IF NOT EXISTS `thumbnail_filename` varchar(255) DEFAULT NULL AFTER `filename`;

migrations/migrate.php

@@ -46,6 +46,23 @@ if (!$conn->query($createTable)) {
     exit(1);
 }
 
+// Tracks per-statement progress within a migration file. MySQL DDL statements
+// (ALTER/CREATE TABLE, etc.) cause an implicit commit, so begin_transaction()/
+// rollback() around a whole file can't actually undo DDL already executed
+// earlier in that same file. This table lets a re-run after a partial failure
+// resume from the statement after the last one that succeeded, instead of
+// re-executing already-applied DDL and wedging on "already exists" errors.
+$createProgressTable = "CREATE TABLE IF NOT EXISTS migration_progress (
+    filename VARCHAR(255) NOT NULL PRIMARY KEY,
+    last_statement_index INT NOT NULL,
+    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+)";
+
+if (!$conn->query($createProgressTable)) {
+    echo "Error: Could not create migration_progress table: " . $conn->error . "\n";
+    exit(1);
+}
+
 // Get list of completed migrations
 $completed = [];
 $result = $conn->query("SELECT filename FROM migrations ORDER BY id");
@@ -114,47 +131,87 @@ foreach ($pending as $file) {
         continue;
     }
 
-    // Execute migration - handle multiple statements
+    // Execute migration statement-by-statement, tracking progress as we go.
-    $conn->begin_transaction();
+    // No begin_transaction()/rollback() here: DDL statements auto-commit in
-
+    // MySQL/MariaDB regardless, so a transaction wrapper around the whole
+    // file would only create the illusion of atomicity while giving no real
+    // protection. Instead, each statement commits immediately (autocommit),
+    // and its index is durably recorded so a later re-run can resume exactly
+    // where a previous run left off rather than re-executing already-applied
+    // DDL.
     try {
         // Split by semicolon but respect statements properly
         // Note: This doesn't handle semicolons in strings, but our migrations are simple
-        $statements = array_filter(
+        $statements = array_values(array_filter(
             array_map('trim', explode(';', $sql)),
             function($stmt) {
                 // Remove comments and check if there's actual SQL
                 $cleaned = preg_replace('/--.*$/m', '', $stmt);
                 return !empty(trim($cleaned));
             }
-        );
+        ));
+
+        $resumeFrom = 0;
+        $progressStmt = $conn->prepare(
+            "SELECT last_statement_index FROM migration_progress WHERE filename = ?"
+        );
+        $progressStmt->bind_param('s', $filename);
+        $progressStmt->execute();
+        $progressRow = $progressStmt->get_result()->fetch_assoc();
+        $progressStmt->close();
+        if ($progressRow) {
+            $resumeFrom = (int)$progressRow['last_statement_index'] + 1;
+            echo "\n  Resuming from statement " . ($resumeFrom + 1) . " of " . count($statements)
+                . " after a previous partial failure... ";
+        }
+
+        foreach ($statements as $index => $statement) {
+            if ($index < $resumeFrom) {
+                continue;
+            }
 
-        foreach ($statements as $statement) {
             if (!$conn->query($statement)) {
                 // Some "errors" are acceptable (like "index already exists")
                 $error = $conn->error;
                 if (strpos($error, 'Duplicate key name') !== false ||
                     strpos($error, 'already exists') !== false) {
                     // Index already exists, that's fine
-                    continue;
+                } else {
+                    throw new Exception($error);
                 }
-                throw new Exception($error);
             }
+
+            // Record progress after every statement so a later run can
+            // resume from here even if a subsequent statement fails.
+            $upsert = $conn->prepare(
+                "INSERT INTO migration_progress (filename, last_statement_index) VALUES (?, ?)
+                 ON DUPLICATE KEY UPDATE last_statement_index = VALUES(last_statement_index)"
+            );
+            $upsert->bind_param('si', $filename, $index);
+            $upsert->execute();
+            $upsert->close();
         }
 
-        // Record the migration
+        // Record the migration as fully complete and clear its progress marker
         $stmt = $conn->prepare("INSERT INTO migrations (filename) VALUES (?)");
         $stmt->bind_param('s', $filename);
         if (!$stmt->execute()) {
             throw new Exception("Could not record migration: " . $conn->error);
         }
 
-        $conn->commit();
+        $clearProgress = $conn->prepare("DELETE FROM migration_progress WHERE filename = ?");
+        $clearProgress->bind_param('s', $filename);
+        $clearProgress->execute();
+        $clearProgress->close();
+
         echo "OK\n";
         $success++;
 
     } catch (Exception $e) {
-        $conn->rollback();
+        // Nothing to roll back: every statement up to the failure already
+        // committed (DDL implicitly, everything else via autocommit). The
+        // progress marker recorded above reflects exactly how far this file
+        // got, so the next run will resume right after the last success.
         echo "FAILED (" . $e->getMessage() . ")\n";
         $failed++;
     }

models/AttachmentModel.php

@@ -16,7 +16,7 @@ class AttachmentModel
     /**
      * Get all attachments for a ticket
      */
-    public function getAttachments($ticketId)
+    public function getAttachments($ticketId, int $limit = 0, int $offset = 0)
     {
         $sql = "SELECT a.*, u.username, u.display_name
                 FROM ticket_attachments a
@@ -24,8 +24,16 @@ class AttachmentModel
                 WHERE a.ticket_id = ?
                 ORDER BY a.uploaded_at DESC";
 
+        if ($limit > 0) {
+            $sql .= " LIMIT ? OFFSET ?";
+        }
+
         $stmt = $this->conn->prepare($sql);
-        $stmt->bind_param("s", $ticketId);
+        if ($limit > 0) {
+            $stmt->bind_param("sii", $ticketId, $limit, $offset);
+        } else {
+            $stmt->bind_param("s", $ticketId);
+        }
         $stmt->execute();
         $result = $stmt->get_result();
 
@@ -60,14 +68,19 @@ class AttachmentModel
 
     /**
      * Add a new attachment record
+     *
+     * @param string|null $thumbnailFilename Stored filename of a generated preview
+     *                                        thumbnail, or null if none was generated
+     *                                        (non-image, GD unavailable, etc.) — callers
+     *                                        fall back to the full-size original.
      */
-    public function addAttachment($ticketId, $filename, $originalFilename, $fileSize, $mimeType, $uploadedBy)
+    public function addAttachment($ticketId, $filename, $originalFilename, $fileSize, $mimeType, $uploadedBy, $thumbnailFilename = null)
     {
-        $sql = "INSERT INTO ticket_attachments (ticket_id, filename, original_filename, file_size, mime_type, uploaded_by)
+        $sql = "INSERT INTO ticket_attachments (ticket_id, filename, thumbnail_filename, original_filename, file_size, mime_type, uploaded_by)
-                VALUES (?, ?, ?, ?, ?, ?)";
+                VALUES (?, ?, ?, ?, ?, ?, ?)";
 
         $stmt = $this->conn->prepare($sql);
-        $stmt->bind_param("sssisi", $ticketId, $filename, $originalFilename, $fileSize, $mimeType, $uploadedBy);
+        $stmt->bind_param("ssssisi", $ticketId, $filename, $thumbnailFilename, $originalFilename, $fileSize, $mimeType, $uploadedBy);
         $result = $stmt->execute();
 
         if ($result) {

models/AuditLogModel.php

@@ -309,17 +309,28 @@ class AuditLogModel
      * @param int $daysToKeep Number of days of logs to keep
      * @return int Number of deleted records
      */
-    public function deleteOldLogs($daysToKeep = 90)
+    public function deleteOldLogs($daysToKeep = 90, $batchSize = 1000)
     {
+        // Batched to bound how long each statement holds row locks — an
+        // unbounded single DELETE on a large backlog (e.g. the first run after
+        // enabling/changing retention, or after the cron silently missed runs)
+        // would otherwise contend with the frequent concurrent INSERTs the
+        // audit log receives from live traffic.
         $stmt = $this->conn->prepare(
-            "DELETE FROM audit_log WHERE created_at < DATE_SUB(NOW(), INTERVAL ? DAY)"
+            "DELETE FROM audit_log WHERE created_at < DATE_SUB(NOW(), INTERVAL ? DAY) ORDER BY audit_id LIMIT ?"
         );
-        $stmt->bind_param("i", $daysToKeep);
+        $stmt->bind_param("ii", $daysToKeep, $batchSize);
-        $stmt->execute();
+
-        $affectedRows = $stmt->affected_rows;
+        $totalDeleted = 0;
+        do {
+            $stmt->execute();
+            $affected = $stmt->affected_rows;
+            $totalDeleted += $affected;
+        } while ($affected > 0);
+
         $stmt->close();
 
-        return $affectedRows;
+        return $totalDeleted;
     }
 
     /**

models/BulkOperationsModel.php

@@ -33,6 +33,23 @@ class BulkOperationsModel
         return $this->workflowModel;
     }
 
+    /**
+     * Re-fetch a ticket row inside the current transaction with a row lock
+     * (FOR UPDATE), so a concurrent transaction touching the same row blocks
+     * until this one commits or rolls back instead of both validating
+     * against the same stale snapshot. Must be called after
+     * begin_transaction() and before the row is written.
+     */
+    private function lockTicketForUpdate(string $ticketId): ?array
+    {
+        $stmt = $this->conn->prepare("SELECT * FROM tickets WHERE ticket_id = ? FOR UPDATE");
+        $stmt->bind_param('s', $ticketId);
+        $stmt->execute();
+        $row = $stmt->get_result()->fetch_assoc();
+        $stmt->close();
+        return $row ?: null;
+    }
+
     /**
      * The status a bulk operation is trying to move tickets into, or null for
      * operations that don't change status.
@@ -89,12 +106,18 @@ class BulkOperationsModel
     /**
      * Process a bulk operation
      *
-     * Uses database transaction to ensure atomicity - either all tickets
+     * Runs the whole batch inside one database transaction, but by default
-     * are updated or none are (on failure, changes are rolled back).
+     * ($atomic = false, which is what api/bulk_operation.php uses) that
+     * transaction is always committed: a per-ticket failure (e.g. a
+     * disallowed workflow transition) is recorded in $failed/$errors and
+     * skipped, while every other ticket in the batch still succeeds. This
+     * is a best-effort batch, not an all-or-nothing one — set $atomic to
+     * true to roll back the entire batch when any ticket fails.
      *
      * @param int $operationId Operation ID
      * @param bool $atomic If true, rollback all changes on any failure
-     * @return array Result with processed and failed counts
+     * @return array Result with processed/failed counts and an errors[] list of
+     *               per-ticket failure reasons (surfaced to the admin by the caller)
      */
     public function processBulkOperation($operationId, bool $atomic = false)
     {
@@ -125,13 +148,23 @@ class BulkOperationsModel
         $processed = 0;
         $failed = 0;
         $errors = [];
+        // Status-change notifications collected during the loop below and
+        // sent only after a successful commit, matching how the single-ticket
+        // and Bearer API paths never notify for a change that didn't durably
+        // land (and how an atomic-mode rollback must not fire any at all).
+        $notificationQueue = [];
 
         // Load required models
         require_once dirname(__DIR__) . '/models/TicketModel.php';
         require_once dirname(__DIR__) . '/models/AuditLogModel.php';
+        require_once dirname(__DIR__) . '/models/UserModel.php';
+        require_once dirname(__DIR__) . '/helpers/NotificationHelper.php';
 
         $ticketModel = new TicketModel($this->conn);
         $auditLogModel = new AuditLogModel($this->conn);
+        $userModel = new UserModel($this->conn);
+        $actor = $operation['performed_by'] ? $userModel->getUserById((int)$operation['performed_by']) : null;
+        $changedByDisplay = $actor['display_name'] ?? $actor['username'] ?? null;
 
         // Batch load all tickets in one query to eliminate N+1 problem
         $ticketsById = $ticketModel->getTicketsByIds($ticketIds);
@@ -173,13 +206,27 @@ class BulkOperationsModel
                 $success = false;
 
                 try {
+                    // Re-fetch and row-lock the ticket inside the transaction for any
+                    // operation that validates against or reads its current fields —
+                    // the pre-transaction $ticketsById snapshot (loaded before
+                    // begin_transaction()) can be stale by the time we get here if a
+                    // concurrent request (a single-ticket edit, or another bulk op)
+                    // changed the row in between. Validating a transition against a
+                    // stale status, or writing back stale title/description/etc.,
+                    // could silently bypass Workflow Designer rules or clobber a
+                    // concurrent edit. FOR UPDATE blocks a concurrent transaction
+                    // from reading/writing this row until ours commits or rolls back.
+                    $needsCurrentTicket = $targetStatus !== null || $operation['operation_type'] === 'bulk_priority';
+                    $currentTicket = $needsCurrentTicket
+                        ? $this->lockTicketForUpdate($ticketId)
+                        : ($ticketsById[$ticketId] ?? null);
+
                     // bulk_status / bulk_close enforce the same Workflow Designer
                     // rules as the single-ticket path: a transition the designer
                     // doesn't define is refused, and requires_comment is honoured
                     // (checked up front, above). requires_admin is satisfied because
                     // api/bulk_operation.php already gates the endpoint on admin.
                     if ($targetStatus !== null) {
-                        $currentTicket = $ticketsById[$ticketId] ?? null;
                         if ($currentTicket && $currentTicket['status'] === $targetStatus) {
                             // Already in the requested state — nothing to do, and
                             // reporting a no-op as a failure would just confuse.
@@ -201,8 +248,7 @@ class BulkOperationsModel
 
                     switch ($operation['operation_type']) {
                         case 'bulk_close':
-                            // Get current ticket from pre-loaded batch
+                            // $currentTicket is the fresh, row-locked read from above.
-                            $currentTicket = $ticketsById[$ticketId] ?? null;
                             if ($currentTicket) {
                                 $updateResult = $ticketModel->updateTicket([
                                 'ticket_id' => $ticketId,
@@ -221,8 +267,18 @@ class BulkOperationsModel
                                         'update',
                                         'ticket',
                                         $ticketId,
-                                        ['status' => 'Closed', 'bulk_operation_id' => $operationId]
+                                        [
+                                            'status' => ['from' => $currentTicket['status'], 'to' => 'Closed'],
+                                            'bulk_operation_id' => $operationId,
+                                        ]
                                     );
+                                    $notificationQueue[] = [
+                                        'ticketId' => $ticketId,
+                                        'title' => $currentTicket['title'],
+                                        'visibility' => $currentTicket['visibility'] ?? 'public',
+                                        'oldStatus' => $currentTicket['status'],
+                                        'newStatus' => 'Closed',
+                                    ];
                                 }
                             }
                             break;
@@ -244,7 +300,7 @@ class BulkOperationsModel
 
                         case 'bulk_priority':
                             if (isset($parameters['priority'])) {
-                                $currentTicket = $ticketsById[$ticketId] ?? null;
+                                // $currentTicket is the fresh, row-locked read from above.
                                 if ($currentTicket) {
                                     $updateResult = $ticketModel->updateTicket([
                                     'ticket_id' => $ticketId,
@@ -272,7 +328,7 @@ class BulkOperationsModel
 
                         case 'bulk_status':
                             if (isset($parameters['status'])) {
-                                $currentTicket = $ticketsById[$ticketId] ?? null;
+                                // $currentTicket is the fresh, row-locked read from above.
                                 if ($currentTicket) {
                                     $updateResult = $ticketModel->updateTicket([
                                     'ticket_id' => $ticketId,
@@ -291,8 +347,18 @@ class BulkOperationsModel
                                             'update',
                                             'ticket',
                                             $ticketId,
-                                            ['status' => $parameters['status'], 'bulk_operation_id' => $operationId]
+                                            [
+                                                'status' => ['from' => $currentTicket['status'], 'to' => $parameters['status']],
+                                                'bulk_operation_id' => $operationId,
+                                            ]
                                         );
+                                        $notificationQueue[] = [
+                                            'ticketId' => $ticketId,
+                                            'title' => $currentTicket['title'],
+                                            'visibility' => $currentTicket['visibility'] ?? 'public',
+                                            'oldStatus' => $currentTicket['status'],
+                                            'newStatus' => $parameters['status'],
+                                        ];
                                     }
                                 }
                             }
@@ -364,6 +430,35 @@ class BulkOperationsModel
                     @unlink($path);
                 }
             }
+
+            // Fire the same Matrix/watcher notifications the single-ticket and
+            // Bearer API status-change paths send, now that every change in
+            // this batch is durably committed. Best-effort: a notification
+            // failure must never turn an otherwise-successful bulk operation
+            // into an error.
+            foreach ($notificationQueue as $n) {
+                try {
+                    NotificationHelper::sendStatusChangeNotification(
+                        $n['ticketId'],
+                        $n['oldStatus'],
+                        $n['newStatus'],
+                        $n['title'],
+                        $changedByDisplay,
+                        $n['visibility']
+                    );
+                    NotificationHelper::notifyWatchers(
+                        $this->conn,
+                        $n['ticketId'],
+                        $n['title'],
+                        'status_changed',
+                        ['old_status' => $n['oldStatus'], 'new_status' => $n['newStatus'], 'changed_by' => $changedByDisplay],
+                        (int)$operation['performed_by'],
+                        $n['visibility']
+                    );
+                } catch (Throwable $e) {
+                    error_log("Bulk operation $operationId: notification failed for ticket {$n['ticketId']}: " . $e->getMessage());
+                }
+            }
         } catch (Exception $e) {
             // Rollback on any unexpected error
             $this->conn->rollback();

models/CommentModel.php

@@ -38,7 +38,7 @@ class CommentModel
         }
 
         $placeholders = str_repeat('?,', count($usernames) - 1) . '?';
-        $sql = "SELECT user_id, username, display_name FROM users WHERE username IN ($placeholders)";
+        $sql = "SELECT user_id, username, display_name, is_admin, `groups` FROM users WHERE username IN ($placeholders)";
         $stmt = $this->conn->prepare($sql);
 
         $types = str_repeat('s', count($usernames));

models/CustomFieldModel.php

@@ -8,6 +8,9 @@ class CustomFieldModel
 {
     private $conn;
 
+    // Must match custom_field_definitions.field_type's enum() in the schema.
+    private const ALLOWED_FIELD_TYPES = ['text', 'textarea', 'select', 'checkbox', 'date', 'number'];
+
     public function __construct($conn)
     {
         $this->conn = $conn;
@@ -87,6 +90,10 @@ class CustomFieldModel
      */
     public function createDefinition($data)
     {
+        if (!in_array($data['field_type'] ?? '', self::ALLOWED_FIELD_TYPES, true)) {
+            return ['success' => false, 'error' => 'Invalid field_type'];
+        }
+
         $options = null;
         if (isset($data['field_options']) && !empty($data['field_options'])) {
             $options = json_encode($data['field_options']);
@@ -129,6 +136,10 @@ class CustomFieldModel
      */
     public function updateDefinition($fieldId, $data)
     {
+        if (!in_array($data['field_type'] ?? '', self::ALLOWED_FIELD_TYPES, true)) {
+            return ['success' => false, 'error' => 'Invalid field_type'];
+        }
+
         $options = null;
         if (isset($data['field_options']) && !empty($data['field_options'])) {
             $options = json_encode($data['field_options']);

models/DependencyModel.php

@@ -172,6 +172,27 @@ class DependencyModel
         }
         $checkStmt->close();
 
+        // Also check the semantic inverse: "A blocks B" and "B blocked_by A"
+        // describe the same relationship, so adding one from either ticket's
+        // page must be rejected as a duplicate of the other. relates_to is
+        // its own inverse (symmetric); duplicates has no defined inverse type.
+        $inverseTypes = ['blocks' => 'blocked_by', 'blocked_by' => 'blocks', 'relates_to' => 'relates_to'];
+        if (isset($inverseTypes[$type])) {
+            $inverseType = $inverseTypes[$type];
+            $checkInverseSql = "SELECT dependency_id FROM ticket_dependencies
+                                 WHERE ticket_id = ? AND depends_on_id = ? AND dependency_type = ?";
+            $checkInverseStmt = $this->conn->prepare($checkInverseSql);
+            $checkInverseStmt->bind_param("sss", $dependsOnId, $ticketId, $inverseType);
+            $checkInverseStmt->execute();
+            $inverseResult = $checkInverseStmt->get_result();
+
+            if ($inverseResult->num_rows > 0) {
+                $checkInverseStmt->close();
+                return ['success' => false, 'error' => 'This relationship already exists'];
+            }
+            $checkInverseStmt->close();
+        }
+
         // Check for circular dependency
         if ($this->wouldCreateCycle($ticketId, $dependsOnId, $type)) {
             return ['success' => false, 'error' => 'This would create a circular dependency'];

models/RecurringTicketModel.php

@@ -189,30 +189,6 @@ class RecurringTicketModel
         return $claimed;
     }
 
-    /**
-     * Update last run and calculate next run time
-     */
-    public function updateAfterRun($recurringId)
-    {
-        $recurring = $this->getById($recurringId);
-        if (!$recurring) {
-            return false;
-        }
-
-        $nextRun = $this->calculateNextRunTime(
-            $recurring['schedule_type'],
-            $recurring['schedule_day'],
-            $recurring['schedule_time']
-        );
-
-        $sql = "UPDATE recurring_tickets SET last_run_at = NOW(), next_run_at = ? WHERE recurring_id = ?";
-        $stmt = $this->conn->prepare($sql);
-        $stmt->bind_param('si', $nextRun, $recurringId);
-        $success = $stmt->execute();
-        $stmt->close();
-        return $success;
-    }
-
     /**
      * Calculate the next run time based on schedule
      */
@@ -255,9 +231,33 @@ class RecurringTicketModel
      */
     public function toggleActive($recurringId)
     {
-        $sql = "UPDATE recurring_tickets SET is_active = NOT is_active WHERE recurring_id = ?";
+        $recurring = $this->getById($recurringId);
-        $stmt = $this->conn->prepare($sql);
+        if (!$recurring) {
-        $stmt->bind_param('i', $recurringId);
+            return ['success' => false];
+        }
+
+        $newActive = $recurring['is_active'] ? 0 : 1;
+
+        if ($newActive) {
+            // Re-enabling: recompute next_run_at from now, as if the schedule
+            // were freshly created. Otherwise a schedule paused while
+            // next_run_at was still in the future, then re-enabled after that
+            // date has passed, would fire immediately on the next cron tick
+            // instead of waiting for its next natural occurrence.
+            $nextRun = $this->calculateNextRunTime(
+                $recurring['schedule_type'],
+                $recurring['schedule_day'],
+                $recurring['schedule_time']
+            );
+            $sql = "UPDATE recurring_tickets SET is_active = ?, next_run_at = ? WHERE recurring_id = ?";
+            $stmt = $this->conn->prepare($sql);
+            $stmt->bind_param('isi', $newActive, $nextRun, $recurringId);
+        } else {
+            $sql = "UPDATE recurring_tickets SET is_active = ? WHERE recurring_id = ?";
+            $stmt = $this->conn->prepare($sql);
+            $stmt->bind_param('ii', $newActive, $recurringId);
+        }
+
         $success = $stmt->execute();
         $stmt->close();
         return ['success' => $success];

models/StatsModel.php

@@ -148,7 +148,7 @@ class StatsModel
             FROM tickets t WHERE status != 'Closed' AND ($visSQL) GROUP BY priority
             UNION ALL
             SELECT 'status' as type, status as label, COUNT(*) as count
-            FROM tickets t WHERE ($visSQL) GROUP BY status
+            FROM tickets t WHERE status != 'Closed' AND ($visSQL) GROUP BY status
             UNION ALL
             SELECT 'category' as type, category as label, COUNT(*) as count
             FROM tickets t WHERE status != 'Closed' AND ($visSQL) GROUP BY category";

models/TicketModel.php

@@ -726,7 +726,10 @@ class TicketModel
             $groupConditions = [];
             foreach ($userGroups as $group) {
                 $groupConditions[] = "FIND_IN_SET(?, REPLACE(t.visibility_groups, ' ', ''))";
-                $params[] = $group;
+                // Strip spaces from the bound value too, matching the REPLACE()
+                // applied to the column, so a group name like "IT Support" is
+                // normalized the same way on both sides of the comparison.
+                $params[] = str_replace(' ', '', $group);
                 $types .= 's';
             }
             $conditions[] = "(t.visibility = 'internal' AND (" . implode(' OR ', $groupConditions) . "))";
@@ -770,9 +773,68 @@ class TicketModel
         $stmt->bind_param("ssis", $visibility, $visibilityGroups, $updatedBy, $ticketId);
         $result = $stmt->execute();
         $stmt->close();
+
+        if ($result) {
+            $this->pruneWatchersForVisibility($ticketId, $visibility, $visibilityGroups);
+        }
+
         return $result;
     }
 
+    /**
+     * Remove any watchers who no longer qualify for a ticket's access rules
+     * after its visibility was tightened. Without this, a user watching a
+     * ticket that's later made confidential/internal (and who isn't
+     * creator/assignee/admin/in the new visibility_groups) keeps receiving
+     * Matrix notifications about a ticket canUserAccessTicket() would now
+     * reject them from opening directly.
+     */
+    private function pruneWatchersForVisibility(string $ticketId, string $visibility, ?string $visibilityGroups): void
+    {
+        $ticket = $this->getTicketById($ticketId);
+        if (!$ticket) {
+            return;
+        }
+        // getTicketById() reflects the just-committed UPDATE, but set these
+        // explicitly so pruning is correct even if a caller reorders things.
+        $ticket['visibility'] = $visibility;
+        $ticket['visibility_groups'] = $visibilityGroups;
+
+        $sql = "SELECT tw.user_id, u.is_admin, u.`groups`
+                FROM ticket_watchers tw
+                JOIN users u ON tw.user_id = u.user_id
+                WHERE tw.ticket_id = ?";
+        $stmt = $this->conn->prepare($sql);
+        $stmt->bind_param('s', $ticketId);
+        $stmt->execute();
+        $watchers = $stmt->get_result()->fetch_all(MYSQLI_ASSOC);
+        $stmt->close();
+
+        $toRemove = [];
+        foreach ($watchers as $watcher) {
+            $watcherUser = [
+                'user_id' => $watcher['user_id'],
+                'is_admin' => $watcher['is_admin'],
+                'groups' => $watcher['groups'],
+            ];
+            if (!$this->canUserAccessTicket($ticket, $watcherUser)) {
+                $toRemove[] = $watcher['user_id'];
+            }
+        }
+
+        if (empty($toRemove)) {
+            return;
+        }
+
+        $placeholders = implode(',', array_fill(0, count($toRemove), '?'));
+        $delSql = "DELETE FROM ticket_watchers WHERE ticket_id = ? AND user_id IN ($placeholders)";
+        $delStmt = $this->conn->prepare($delSql);
+        $types = 's' . str_repeat('i', count($toRemove));
+        $delStmt->bind_param($types, $ticketId, ...$toRemove);
+        $delStmt->execute();
+        $delStmt->close();
+    }
+
     /**
      * Delete a ticket and all its associated records.
      * Admin-only operation. Removes comments, attachments, watchers, dependencies.

models/UserModel.php

@@ -98,19 +98,30 @@ class UserModel
             $user['groups'] = $groups;
             $user['is_admin'] = $isAdmin;
         } else {
-            // Create new user
+            // Create new user. Uses INSERT ... ON DUPLICATE KEY UPDATE (rather than
+            // a plain INSERT) so two concurrent first-visit requests for the same
+            // brand-new username can't race: the losing request updates the row the
+            // winner just created instead of throwing an uncaught duplicate-key
+            // exception (users.username has a UNIQUE KEY, and mysqli throws on
+            // constraint violation under PHP 8.1+'s default report mode).
             $insertStmt = $this->conn->prepare(
-                "INSERT INTO users (username, display_name, email, `groups`, is_admin, last_login) VALUES (?, ?, ?, ?, ?, NOW())"
+                "INSERT INTO users (username, display_name, email, `groups`, is_admin, last_login)
+                 VALUES (?, ?, ?, ?, ?, NOW())
+                 ON DUPLICATE KEY UPDATE
+                     display_name = VALUES(display_name),
+                     email        = VALUES(email),
+                     `groups`     = VALUES(groups),
+                     is_admin     = VALUES(is_admin),
+                     last_login   = NOW()"
             );
             $insertStmt->bind_param("ssssi", $username, $displayName, $email, $groups, $isAdmin);
             $insertStmt->execute();
-
-            $userId = $this->conn->insert_id;
             $insertStmt->close();
 
-            // Get the newly created user
+            // Re-fetch by username — works whether this request won the insert or
-            $stmt = $this->conn->prepare("SELECT * FROM users WHERE user_id = ?");
+            // lost the race and only updated the winner's row.
-            $stmt->bind_param("i", $userId);
+            $stmt = $this->conn->prepare("SELECT * FROM users WHERE username = ?");
+            $stmt->bind_param("s", $username);
             $stmt->execute();
             $result = $stmt->get_result();
             $user = $result->fetch_assoc();

models/WorkflowModel.php

@@ -31,9 +31,15 @@ class WorkflowModel
             return $cached;
         }
 
+        // ORDER BY makes which row wins deterministic (most recently created,
+        // by transition_id) in the pathological case where two active rows
+        // exist for the same (from_status, to_status) pair — manage_workflows.php
+        // now rejects creating that duplicate going forward, but this is a
+        // defense-in-depth backstop against any duplicate already in the DB.
         $sql = "SELECT from_status, to_status, requires_comment, requires_admin
                 FROM status_transitions
-                WHERE is_active = TRUE";
+                WHERE is_active = TRUE
+                ORDER BY transition_id ASC";
         $result = $this->conn->query($sql);
 
         if (!$result) {

scripts/check_requirements.php

@@ -10,9 +10,30 @@
  * Usage: php scripts/check_requirements.php
  */
 
+/**
+ * Parse a php.ini size value (e.g. "128M", "1G", "-1") into bytes.
+ * Returns -1 for unlimited.
+ */
+function parseIniBytes(string $val): int
+{
+    $val = trim($val);
+    if ($val === '' || $val === '-1') {
+        return -1;
+    }
+    $unit = strtolower(substr($val, -1));
+    $num = (int)$val;
+    return match ($unit) {
+        'g' => $num * 1024 * 1024 * 1024,
+        'm' => $num * 1024 * 1024,
+        'k' => $num * 1024,
+        default => $num,
+    };
+}
+
 $req = require __DIR__ . '/../config/requirements.php';
 
 $errors = [];
+$warnings = [];
 
 // PHP version
 $minPhp = $req['min_php_version'];
@@ -27,6 +48,28 @@ foreach ($req['required_extensions'] as $ext) {
     }
 }
 
+// memory_limit / max_execution_time sanity checks (warnings, not hard
+// failures — see config/requirements.php for why these matter).
+$memLimitIni = ini_get('memory_limit');
+$memLimitBytes = parseIniBytes($memLimitIni);
+$minMemBytes = $req['min_memory_limit_mb'] * 1024 * 1024;
+if ($memLimitBytes !== -1 && $memLimitBytes < $minMemBytes) {
+    $warnings[] = sprintf(
+        'memory_limit is %s, below the recommended minimum %dM',
+        $memLimitIni,
+        $req['min_memory_limit_mb']
+    );
+}
+
+$maxExecTime = (int)ini_get('max_execution_time');
+if ($maxExecTime !== 0 && $maxExecTime < $req['min_max_execution_time']) {
+    $warnings[] = sprintf(
+        'max_execution_time is %ds, below the recommended minimum %ds',
+        $maxExecTime,
+        $req['min_max_execution_time']
+    );
+}
+
 if (!empty($errors)) {
     fwrite(STDERR, "Requirement check FAILED:\n");
     foreach ($errors as $err) {
@@ -35,6 +78,10 @@ if (!empty($errors)) {
     exit(1);
 }
 
+foreach ($warnings as $warn) {
+    fwrite(STDERR, "Requirement check WARNING: " . $warn . "\n");
+}
+
 printf(
     "Requirement check passed: PHP %s (>= %s); extensions: %s\n",
     PHP_VERSION,

scripts/cleanup_orphan_uploads.php

@@ -59,10 +59,11 @@ try {
     exit(1);
 }
 
-// Prepared lookup: does any attachment row reference this stored filename?
+// Prepared lookup: does any attachment row reference this stored filename,
-// Stored filenames are globally unique (uniqid), so filename alone is sufficient
+// either as the original file or as its generated preview thumbnail? Both
-// and safe — a match in any ticket means the file is a real attachment.
+// are globally unique (uniqid-derived), so filename alone is sufficient and
-$lookup = $conn->prepare('SELECT 1 FROM ticket_attachments WHERE filename = ? LIMIT 1');
+// safe — a match in any ticket means the file is a real, referenced file.
+$lookup = $conn->prepare('SELECT 1 FROM ticket_attachments WHERE filename = ? OR thumbnail_filename = ? LIMIT 1');
 if ($lookup === false) {
     logMessage('FATAL ERROR: could not prepare lookup statement: ' . $conn->error);
     exit(1);
@@ -101,8 +102,9 @@ foreach (new DirectoryIterator($uploadRoot) as $entry) {
             continue;
         }
 
-        // Keep the file if any attachment row references it.
+        // Keep the file if any attachment row references it (as the
-        $lookup->bind_param('s', $filename);
+        // original or as its thumbnail).
+        $lookup->bind_param('ss', $filename, $filename);
         $lookup->execute();
         $hasRow = $lookup->get_result()->num_rows > 0;
 

views/CreateTicketView.php

@@ -124,7 +124,7 @@ include __DIR__ . '/layout_header.php';
 
         <div class="lt-form-group">
           <label class="lt-label" for="category">Category</label>
-          <select id="category" name="category" class="lt-select">
+          <select id="category" name="category" class="lt-select" data-action="toggle-custom-fields">
             <option value="Hardware">Hardware</option>
             <option value="Software">Software</option>
             <option value="Network">Network</option>
@@ -211,6 +211,55 @@ include __DIR__ . '/layout_header.php';
     </div>
   </div>
 
+  <?php if (!empty($allCustomFieldDefs)) : ?>
+  <!-- ── SECTION 5b: Custom Fields ─────────────────────────── -->
+  <div class="lt-frame lt-mb-md">
+    <span class="lt-frame-bl">╚</span><span class="lt-frame-br">╝</span>
+    <div class="lt-section-header">Additional Fields</div>
+    <div class="lt-section-body">
+        <?php foreach ($allCustomFieldDefs as $cfDef) : ?>
+        <div class="lt-form-group custom-field-group"
+             data-custom-field-category="<?= htmlspecialchars($cfDef['category'] ?? '', ENT_QUOTES, 'UTF-8') ?>">
+            <?php
+            $cfName = 'custom_fields[' . (int)$cfDef['field_id'] . ']';
+            $cfId   = 'custom_field_' . (int)$cfDef['field_id'];
+            ?>
+          <label class="lt-label" for="<?= $cfId ?>">
+            <?= htmlspecialchars($cfDef['field_label'], ENT_QUOTES, 'UTF-8') ?><?= $cfDef['is_required'] ? ' *' : '' ?>
+          </label>
+            <?php if ($cfDef['field_type'] === 'textarea') : ?>
+            <textarea id="<?= $cfId ?>" name="<?= $cfName ?>" class="lt-input lt-textarea" rows="3"
+                      <?= $cfDef['is_required'] ? 'data-custom-field-required="1"' : '' ?>></textarea>
+            <?php elseif ($cfDef['field_type'] === 'select') : ?>
+            <select id="<?= $cfId ?>" name="<?= $cfName ?>" class="lt-select"
+                    <?= $cfDef['is_required'] ? 'data-custom-field-required="1"' : '' ?>>
+              <option value="">— Select —</option>
+                <?php foreach (($cfDef['field_options']['options'] ?? []) as $opt) : ?>
+                <option value="<?= htmlspecialchars($opt, ENT_QUOTES, 'UTF-8') ?>"><?= htmlspecialchars($opt, ENT_QUOTES, 'UTF-8') ?></option>
+                <?php endforeach ?>
+            </select>
+            <?php elseif ($cfDef['field_type'] === 'checkbox') : ?>
+            <label class="lt-filter-option">
+              <input type="checkbox" class="lt-checkbox" id="<?= $cfId ?>" name="<?= $cfName ?>" value="1">
+                <?= htmlspecialchars($cfDef['field_label'], ENT_QUOTES, 'UTF-8') ?>
+            </label>
+            <?php elseif ($cfDef['field_type'] === 'date') : ?>
+            <input type="date" id="<?= $cfId ?>" name="<?= $cfName ?>" class="lt-input"
+                   <?= $cfDef['is_required'] ? 'data-custom-field-required="1"' : '' ?>>
+            <?php elseif ($cfDef['field_type'] === 'number') : ?>
+            <input type="number" id="<?= $cfId ?>" name="<?= $cfName ?>" class="lt-input"
+                   <?= $cfDef['is_required'] ? 'data-custom-field-required="1"' : '' ?>>
+            <?php else : ?>
+            <input type="text" id="<?= $cfId ?>" name="<?= $cfName ?>" class="lt-input"
+                   <?= $cfDef['is_required'] ? 'data-custom-field-required="1"' : '' ?>>
+            <?php endif ?>
+        </div>
+        <?php endforeach ?>
+      <p class="lt-form-hint">Fields shown depend on the selected Category.</p>
+    </div>
+  </div>
+  <?php endif ?>
+
   <!-- ── SECTION 6: Description ───────────────────────────── -->
   <div class="lt-frame lt-mb-md">
     <span class="lt-frame-bl">╚</span><span class="lt-frame-br">╝</span>
@@ -316,6 +365,15 @@ include __DIR__ . '/layout_header.php';
             .catch(function () { /* silent — duplicate check is non-critical */ });
     }
 
+    // ── Custom fields: show only the selected category's fields ──
+    function toggleCustomFields() {
+        var category = document.getElementById('category').value;
+        document.querySelectorAll('.custom-field-group').forEach(function (group) {
+            var fieldCategory = group.getAttribute('data-custom-field-category');
+            group.classList.toggle('is-hidden', fieldCategory !== '' && fieldCategory !== category);
+        });
+    }
+
     // ── Visibility groups toggle ──────────────────────────────
     var visibilityHints = {
         'public':       'Everyone who is logged in can view this ticket.',
@@ -344,12 +402,23 @@ include __DIR__ . '/layout_header.php';
         var existingTitle = (document.getElementById('title').value || '').trim();
         var existingDesc  = (document.getElementById('description').value || '').trim();
         if (existingTitle || existingDesc) {
-            if (!confirm('Applying this template will overwrite your current title and description. Continue?')) {
+            showConfirmModal(
-                document.getElementById('templateSelect').value = '';
+                'Overwrite content?',
-                return;
+                'Applying this template will overwrite your current title and description. Continue?',
-            }
+                'warning',
+                applyTemplate,
+                function () { document.getElementById('templateSelect').value = ''; }
+            );
+            return;
         }
 
+        applyTemplate();
+    }
+
+    function applyTemplate() {
+        var tplId = document.getElementById('templateSelect').value;
+        if (!tplId) return;
+
         lt.api.get('/api/get_template.php?template_id=' + encodeURIComponent(tplId))
             .then(function (data) {
                 if (!data.success || !data.template) {
@@ -376,9 +445,11 @@ include __DIR__ . '/layout_header.php';
         switch (target.getAttribute('data-action')) {
             case 'load-template':             loadTemplate();             break;
             case 'toggle-visibility-groups':  toggleVisibilityGroups();   break;
+            case 'toggle-custom-fields':      toggleCustomFields();       break;
         }
     });
 
+    toggleCustomFields();
     if (window.lt) lt.keys.initDefaults();
 }());
 </script>

views/DashboardView.php

@@ -120,7 +120,6 @@ include __DIR__ . '/layout_header.php';
     ?>
 
   <div class="lt-stat-card stat-open" role="button" tabindex="0"
-       data-filter-key="status" data-filter-val="Open,Pending,In Progress"
        title="Click to filter by active tickets" aria-label="Open tickets">
     <div class="lt-stat-icon">[ # ]</div>
     <div class="lt-stat-info">
@@ -133,7 +132,6 @@ include __DIR__ . '/layout_header.php';
   </div>
 
   <div class="lt-stat-card stat-critical" role="button" tabindex="0"
-       data-filter-key="priority" data-filter-val="1"
        title="Click to filter critical (P1) tickets" aria-label="Critical P1 tickets">
     <div class="lt-stat-icon lt-text-danger">[ ! ]</div>
     <div class="lt-stat-info">
@@ -146,7 +144,6 @@ include __DIR__ . '/layout_header.php';
   </div>
 
   <div class="lt-stat-card stat-unassigned" role="button" tabindex="0"
-       data-filter-key="assigned_to" data-filter-val="unassigned"
        title="Click to filter unassigned tickets" aria-label="Unassigned tickets">
     <div class="lt-stat-icon lt-text-amber">[ @ ]</div>
     <div class="lt-stat-info">
@@ -171,7 +168,6 @@ include __DIR__ . '/layout_header.php';
   </div>
 
   <div class="lt-stat-card stat-resolved" role="button" tabindex="0"
-       data-filter-key="status" data-filter-val="Closed"
        title="Click to filter closed tickets" aria-label="Closed tickets today">
     <div class="lt-stat-icon lt-text-muted">[ OK ]</div>
     <div class="lt-stat-info">
@@ -277,9 +273,69 @@ include __DIR__ . '/layout_header.php';
       array_values($stats['by_category'] ?? [])
   ))) ?>;
 
+  // ── Click-to-filter ────────────────────────────────────────────────────────
+  // Charts navigate to the same URL filters the stat cards use.
+  //
+  // The status the click filters on has to be explicit rather than left to the
+  // default: with no `status` param the controller falls back to the viewer's
+  // default_status_filters preference, which can be anything, so the resulting
+  // list would not necessarily match what the chart counted. StatsModel builds
+  // by_priority, by_status, and by_category all with `status != 'Closed'` —
+  // closed tickets accumulate indefinitely and would otherwise dominate every
+  // breakdown over time — so chartPriority/chartCategory pin the open set
+  // explicitly, while chartStatus's clicked label is itself already one of
+  // the non-Closed statuses.
+  function openStatuses() {
+    var all = window.TICKET_STATUSES || ['Open', 'Pending', 'In Progress', 'Closed'];
+    return all.filter(function(s) { return s !== 'Closed'; }).join(',');
+  }
+
+  function gotoFilter(params) {
+    var qs = new URLSearchParams(window.location.search);
+    Object.keys(params).forEach(function(k) {
+      if (params[k] !== null && params[k] !== undefined && params[k] !== '') qs.set(k, params[k]);
+      else qs.delete(k);
+    });
+    window.location.href = '/?' + qs.toString();
+  }
+
+  // Each chart maps a clicked label to a filter. Returns null when the label
+  // can't be mapped, so the click is simply ignored.
+  var CHART_FILTERS = {
+    chartPriority: function(label) {
+      var m = /^P(\d+)$/.exec(label);
+      return m ? { priority: m[1], status: openStatuses() } : null;
+    },
+    chartStatus: function(label) {
+      return label ? { status: label } : null;
+    },
+    chartCategory: function(label) {
+      return label ? { category: label, status: openStatuses() } : null;
+    }
+  };
+
+  function filterOnClick(canvasId) {
+    return function(evt, elements, chart) {
+      if (!elements || !elements.length) return;
+      var label = chart.data.labels[elements[0].index];
+      var mapper = CHART_FILTERS[canvasId];
+      var params = mapper && mapper(label);
+      if (params) gotoFilter(params);
+    };
+  }
+
+  // Pointer cursor over clickable segments so the affordance is visible.
+  function filterOnHover(evt, elements) {
+    if (evt && evt.native && evt.native.target) {
+      evt.native.target.style.cursor = (elements && elements.length) ? 'pointer' : 'default';
+    }
+  }
+
   function makeDonut(canvasId, data, colorMap) {
     var ctx = document.getElementById(canvasId);
-    if (!ctx || !data.length) return;
+    if (!ctx) return;
+    if (!data.length) { showChartEmptyState(ctx); return; }
+    ctx.title = 'Click a segment to filter the ticket list';
     return new Chart(ctx, {
       type: 'doughnut',
       data: {
@@ -295,21 +351,37 @@ include __DIR__ . '/layout_header.php';
       },
       options: {
         responsive: true, maintainAspectRatio: false,
+        onClick: filterOnClick(canvasId),
+        onHover: filterOnHover,
         plugins: {
           legend: {
             position: 'bottom',
             labels: { color: '#8fa3b1', font: { family: 'monospace', size: 10 }, padding: 8, boxWidth: 10 }
           },
-          tooltip: { callbacks: { label: function(ctx) { return ' ' + ctx.label + ': ' + ctx.parsed; } } }
+          tooltip: { callbacks: { label: function(ctx) { return ' ' + ctx.label + ': ' + ctx.parsed + ' — click to filter'; } } }
         },
         cutout: '68%'
       }
     });
   }
 
+  function showChartEmptyState(canvas) {
+    canvas.style.display = 'none';
+    var wrap = canvas.parentElement;
+    if (wrap && !wrap.querySelector('.lt-chart-empty')) {
+      var msg = document.createElement('div');
+      msg.className = 'lt-chart-empty';
+      msg.style.cssText = 'display:flex;align-items:center;justify-content:center;height:100%;color:var(--text-muted);font-size:0.75rem';
+      msg.textContent = 'No data for current filters';
+      wrap.appendChild(msg);
+    }
+  }
+
   function makeBar(canvasId, data) {
     var ctx = document.getElementById(canvasId);
-    if (!ctx || !data.length) return;
+    if (!ctx) return;
+    if (!data.length) { showChartEmptyState(ctx); return; }
+    ctx.title = 'Click a bar to filter the ticket list';
     return new Chart(ctx, {
       type: 'bar',
       data: {
@@ -323,7 +395,12 @@ include __DIR__ . '/layout_header.php';
       },
       options: {
         indexAxis: 'y', responsive: true, maintainAspectRatio: false,
-        plugins: { legend: { display: false } },
+        onClick: filterOnClick(canvasId),
+        onHover: filterOnHover,
+        plugins: {
+          legend: { display: false },
+          tooltip: { callbacks: { label: function(ctx) { return ' ' + ctx.parsed.x + ' — click to filter'; } } }
+        },
         scales: {
           x: { ticks: { color: '#8fa3b1', font: { size: 10 } }, grid: { color: 'rgba(0,255,65,0.06)' } },
           y: { ticks: { color: '#8fa3b1', font: { family: 'monospace', size: 10 } }, grid: { display: false } }
@@ -1162,7 +1239,6 @@ window.TICKET_STATUSES = <?= json_encode($GLOBALS['config']['TICKET_STATUSES'])
 if (window.lt) {
     lt.keys.initDefaults();
     lt.tableNav.init('tickets-table');
-    lt.statsFilter.init();
 }
 
 // Saved filter pills — load on page init

views/TicketView.php

@@ -114,6 +114,7 @@ $json_priority   = json_encode($ticket['priority'], JSON_HEX_TAG);
 $json_category   = json_encode($ticket['category'], JSON_HEX_TAG);
 $json_type       = json_encode($ticket['type'], JSON_HEX_TAG);
 $json_updated_at     = json_encode($ticket['updated_at'], JSON_HEX_TAG);
+$json_created_at_ts  = json_encode((int)strtotime($ticket['created_at']), JSON_HEX_TAG);
 $json_total_comments = json_encode((int)$totalComments, JSON_HEX_TAG);
 $json_comment_page   = json_encode((int)$commentPageSize, JSON_HEX_TAG);
 $json_current_uid    = json_encode((int)($currentUser['user_id'] ?? 0), JSON_HEX_TAG);
@@ -127,6 +128,7 @@ window.ticketData = {
     category:       {$json_category},
     type:           {$json_type},
     updated_at:     {$json_updated_at},
+    created_at_ts:  {$json_created_at_ts},
     totalComments:  {$json_total_comments},
     commentOffset:  {$json_comment_page},
     commentPageSize:{$json_comment_page},
@@ -209,95 +211,17 @@ include __DIR__ . '/layout_header.php';
   </div>
 </div>
 
-<?php if ($priorityNum <= 2 && $ticket['status'] !== 'Closed') : ?>
+<?php // SLA banner (P1/P2, non-Closed tickets) is rendered and kept live by
-    <?php
+      // renderSlaBanner() in ticket.js, so it can also rebuild/tear itself
-    $slaTargetHours = match ($priorityNum) {
+      // down when priority changes client-side without a page reload. ?>
-        1 => 8, 2 => 24, default => 72
+<div id="priorityAlertBannerAnchor"></div>
-    };
-    $elapsedSeconds = time() - strtotime($ticket['created_at']);
-    $slaPct         = min(100, round(($elapsedSeconds / ($slaTargetHours * 3600)) * 100));
-    $slaBreached    = $elapsedSeconds >= ($slaTargetHours * 3600);
-    $slaClass       = $priorityNum === 1 ? 'lt-sla-p1' : 'lt-sla-p2';
-    $slaIcon        = $priorityNum === 1 ? '[ ! ]' : '[ ~ ]';
-    $slaLabel       = $priorityNum === 1 ? 'P1 Critical' : 'P2 High';
-    $slaId          = 'sla-' . htmlspecialchars($ticket['ticket_id'], ENT_QUOTES, 'UTF-8');
-    ?>
-<!-- SLA banner — P1/P2 only, dismissible per session -->
-<div class="<?= $slaClass ?>" id="priorityAlertBanner" role="alert" aria-live="polite"
-     data-sla-id="<?= $slaId ?>"
-     data-created-at="<?= (int)strtotime($ticket['created_at']) ?>"
-     data-sla-hours="<?= $slaTargetHours ?>"
-     style="margin-bottom:0.75rem">
-  <span class="lt-sla-icon" aria-hidden="true"><?= $slaIcon ?></span>
-  <div class="lt-sla-info">
-    <div class="lt-sla-title">
-      <?= $slaLabel ?> — SLA: <span id="slaElapsedTimer"></span> elapsed of <?= $slaTargetHours ?>h limit
-      <?php if ($slaBreached) : ?>
-        &nbsp;<span class="lt-text-danger" id="slaBreachLabel">BREACHED</span>
-      <?php endif ?>
-    </div>
-    <div class="lt-sla-bar" aria-label="SLA progress <?= $slaPct ?>%" id="slaProgress">
-      <div class="lt-sla-fill" id="slaProgressBar" style="width:<?= $slaPct ?>%"></div>
-    </div>
-  </div>
-    <?php if (!$slaBreached) : ?>
-        <div class="lt-sla-meta" id="slaCountdownTimer"></div>
-    <?php else : ?>
-        <div class="lt-sla-meta lt-text-danger" id="slaCountdownTimer">+<span id="slaOverrunTimer"><?= round(($elapsedSeconds - $slaTargetHours * 3600) / 3600, 1) ?>h</span> over</div>
-    <?php endif ?>
-  <button type="button" class="lt-sla-dismiss" aria-label="Dismiss">&#x2715;</button>
-</div>
 <script nonce="<?= htmlspecialchars($nonce, ENT_QUOTES, 'UTF-8') ?>">
-(function(){
+document.addEventListener('DOMContentLoaded', function() {
-  var banner = document.getElementById('priorityAlertBanner');
+    if (typeof renderSlaBanner === 'function') {
-  var id = banner.dataset.slaId;
+        renderSlaBanner(window.ticketData.priority);
-  try { if (id && sessionStorage.getItem('lt_sla_dismissed_' + id)) banner.hidden = true; } catch(e) {}
-
-  banner.querySelector('.lt-sla-dismiss').addEventListener('click', function() {
-    banner.hidden = true;
-    try { if (id) sessionStorage.setItem('lt_sla_dismissed_' + id, '1'); } catch(e) {}
-  });
-
-  document.addEventListener('DOMContentLoaded', function() {
-    if (banner.hidden) return;
-    var createdAt = parseInt(banner.dataset.createdAt, 10) * 1000;
-    var slaMs     = parseInt(banner.dataset.slaHours, 10) * 3600 * 1000;
-    var deadline  = new Date(createdAt + slaMs);
-    var elapsedEl   = document.getElementById('slaElapsedTimer');
-    var countdownEl = document.getElementById('slaCountdownTimer');
-    var overrunEl   = document.getElementById('slaOverrunTimer');
-    var fillBar     = document.getElementById('slaProgressBar');
-    var progressWrap = document.getElementById('slaProgress');
-
-    function fmtHMS(ms) {
-      var s = Math.floor(Math.abs(ms) / 1000);
-      var h = Math.floor(s / 3600), m = Math.floor((s % 3600) / 60), ss = s % 60;
-      return [h, m, ss].map(function(n){ return String(n).padStart(2,'0'); }).join(':');
     }
-
+});
-    function tick() {
-      var now      = Date.now();
-      var elapsed  = now - createdAt;
-      var remaining = deadline - now;
-      var pct      = Math.min(100, Math.round((elapsed / slaMs) * 100));
-
-      if (elapsedEl)   elapsedEl.textContent = fmtHMS(elapsed);
-      if (fillBar)     fillBar.style.width = pct + '%';
-      if (progressWrap) progressWrap.setAttribute('aria-label', 'SLA progress ' + pct + '%');
-
-      if (remaining > 0) {
-        if (countdownEl) countdownEl.textContent = fmtHMS(remaining) + ' remaining';
-      } else {
-        if (overrunEl) overrunEl.textContent = fmtHMS(-remaining);
-      }
-    }
-
-    tick();
-    setInterval(tick, 1000);
-  });
-})();
 </script>
-<?php endif ?>
 
 <!-- ═══════════════════════════════════════════════════════════
      TICKET DETAIL FRAME
@@ -473,6 +397,12 @@ include __DIR__ . '/layout_header.php';
           role="tab" data-tab="dependencies-panel" aria-selected="false" aria-controls="dependencies-panel">
     Dependencies
   </button>
+  <?php if (!empty($customFieldDefs)) : ?>
+  <button type="button" class="lt-tab" id="custom-fields-tab-btn"
+          role="tab" data-tab="custom-fields-panel" aria-selected="false" aria-controls="custom-fields-panel">
+    Custom Fields
+  </button>
+  <?php endif ?>
   <button type="button" class="lt-tab" id="activity-tab-btn"
           role="tab" data-tab="activity-panel" aria-selected="false" aria-controls="activity-panel">
     Activity
@@ -758,6 +688,60 @@ include __DIR__ . '/layout_header.php';
   </div>
 </div>
 
+<?php if (!empty($customFieldDefs)) : ?>
+<!-- ═══════════════════════════════════════════════════════════
+     TAB PANEL: CUSTOM FIELDS
+     ═══════════════════════════════════════════════════════════ -->
+<div id="custom-fields-panel" class="lt-tab-panel" role="tabpanel" aria-labelledby="custom-fields-tab-btn">
+  <div class="lt-frame">
+    <span class="lt-frame-bl">╚</span><span class="lt-frame-br">╝</span>
+    <div class="lt-section-header">Custom Fields</div>
+    <div class="lt-section-body">
+      <div id="customFieldsMsg" class="lt-msg is-hidden lt-mb-md" role="alert" aria-live="polite"></div>
+      <?php foreach ($customFieldDefs as $cfDef) :
+            $cfValue = $customFieldValues[$cfDef['field_name']]['field_value'] ?? '';
+            $cfName  = 'custom_fields[' . (int)$cfDef['field_id'] . ']';
+            $cfId    = 'ticket_custom_field_' . (int)$cfDef['field_id'];
+            ?>
+        <div class="lt-form-group">
+          <label class="lt-label" for="<?= $cfId ?>">
+            <?= htmlspecialchars($cfDef['field_label'], ENT_QUOTES, 'UTF-8') ?><?= $cfDef['is_required'] ? ' *' : '' ?>
+          </label>
+            <?php if ($cfDef['field_type'] === 'textarea') : ?>
+            <textarea id="<?= $cfId ?>" name="<?= $cfName ?>" class="lt-input lt-textarea" rows="3"
+                      ><?= htmlspecialchars($cfValue, ENT_QUOTES, 'UTF-8') ?></textarea>
+            <?php elseif ($cfDef['field_type'] === 'select') : ?>
+            <select id="<?= $cfId ?>" name="<?= $cfName ?>" class="lt-select">
+              <option value="">— Select —</option>
+                <?php foreach (($cfDef['field_options']['options'] ?? []) as $opt) : ?>
+                <option value="<?= htmlspecialchars($opt, ENT_QUOTES, 'UTF-8') ?>"
+                        <?= $opt === $cfValue ? 'selected' : '' ?>><?= htmlspecialchars($opt, ENT_QUOTES, 'UTF-8') ?></option>
+                <?php endforeach ?>
+            </select>
+            <?php elseif ($cfDef['field_type'] === 'checkbox') : ?>
+            <label class="lt-filter-option">
+              <input type="checkbox" class="lt-checkbox" id="<?= $cfId ?>" name="<?= $cfName ?>" value="1"
+                     <?= $cfValue === '1' ? 'checked' : '' ?>>
+                <?= htmlspecialchars($cfDef['field_label'], ENT_QUOTES, 'UTF-8') ?>
+            </label>
+            <?php elseif ($cfDef['field_type'] === 'date') : ?>
+            <input type="date" id="<?= $cfId ?>" name="<?= $cfName ?>" class="lt-input"
+                   value="<?= htmlspecialchars($cfValue, ENT_QUOTES, 'UTF-8') ?>">
+            <?php elseif ($cfDef['field_type'] === 'number') : ?>
+            <input type="number" id="<?= $cfId ?>" name="<?= $cfName ?>" class="lt-input"
+                   value="<?= htmlspecialchars($cfValue, ENT_QUOTES, 'UTF-8') ?>">
+            <?php else : ?>
+            <input type="text" id="<?= $cfId ?>" name="<?= $cfName ?>" class="lt-input"
+                   value="<?= htmlspecialchars($cfValue, ENT_QUOTES, 'UTF-8') ?>">
+            <?php endif ?>
+        </div>
+      <?php endforeach ?>
+      <button type="button" id="saveCustomFieldsBtn" class="lt-btn lt-btn-primary lt-btn-sm">SAVE CUSTOM FIELDS</button>
+    </div>
+  </div>
+</div>
+<?php endif ?>
+
 <!-- ═══════════════════════════════════════════════════════════
      TAB PANEL: ACTIVITY
      ═══════════════════════════════════════════════════════════ -->
@@ -1006,9 +990,7 @@ document.addEventListener('DOMContentLoaded', function () {
         shown.forEach(function (w) {
             var words = (w.display_name || '').trim().split(/\s+/).filter(Boolean);
             var initials = words.slice(0, 2).map(function (x) { return x[0].toUpperCase(); }).join('');
-            var hash = 0;
+            var color = avatarColors[crc32(w.display_name || '') % 4];
-            for (var i = 0; i < (w.display_name || '').length; i++) hash = ((hash << 5) - hash + (w.display_name || '').charCodeAt(i)) | 0;
-            var color = avatarColors[Math.abs(hash) % 4];
             html += '<div class="lt-avatar lt-avatar--xs ' + color + '" title="' + lt.escHtml(w.display_name) + '" aria-label="' + lt.escHtml(w.display_name) + '">' +
                     '<img src="/api/user_avatar.php?user_id=' + w.user_id + '" alt="" class="lt-avatar-img">' +
                     '<span class="lt-avatar-initials">' + lt.escHtml(initials) + '</span>' +
@@ -1091,6 +1073,46 @@ document.addEventListener('DOMContentLoaded', function () {
         });
     }
 
+    // Save custom fields button
+    var saveCustomFieldsBtn = document.getElementById('saveCustomFieldsBtn');
+    if (saveCustomFieldsBtn) {
+        saveCustomFieldsBtn.addEventListener('click', function () {
+            var panel = document.getElementById('custom-fields-panel');
+            var msg = document.getElementById('customFieldsMsg');
+            var values = {};
+            panel.querySelectorAll('[name^="custom_fields["]').forEach(function (el) {
+                var m = el.name.match(/custom_fields\[(\d+)\]/);
+                if (!m) return;
+                var fieldId = m[1];
+                if (el.type === 'checkbox') {
+                    values[fieldId] = el.checked ? '1' : '0';
+                } else {
+                    values[fieldId] = el.value;
+                }
+            });
+
+            saveCustomFieldsBtn.disabled = true;
+            msg.classList.add('is-hidden');
+
+            lt.api.post('/api/ticket_custom_fields.php', {
+                ticket_id: window.ticketData.id,
+                values: values
+            }).then(function (data) {
+                saveCustomFieldsBtn.disabled = false;
+                if (data.success) {
+                    lt.toast.success('Custom fields saved', 3000);
+                } else {
+                    msg.textContent = data.error || 'Failed to save custom fields';
+                    msg.className = 'lt-msg lt-msg-danger lt-mb-md';
+                }
+            }).catch(function (error) {
+                saveCustomFieldsBtn.disabled = false;
+                msg.textContent = 'Failed to save custom fields: ' + error.message;
+                msg.className = 'lt-msg lt-msg-danger lt-mb-md';
+            });
+        });
+    }
+
     // Settings save/cancel
     // Load user preference toggles on settings modal open
     (function() {
@@ -1219,7 +1241,7 @@ document.addEventListener('DOMContentLoaded', function () {
                 if (typeof parseMarkdown === 'function') {
                     list.querySelectorAll('.comment-text[data-markdown]').forEach(function (el) {
                         if (!el.dataset.rendered) {
-                            el.innerHTML = parseMarkdown(el.textContent);
+                            el.innerHTML = parseMarkdown(el.textContent.trim());
                             el.dataset.rendered = '1';
                         }
                     });
@@ -1252,13 +1274,9 @@ document.addEventListener('DOMContentLoaded', function () {
         var words    = displayName.trim().split(/\s+/).filter(Boolean);
         var initials = words.slice(0, 2).map(function (w) { return w[0].toUpperCase(); }).join('');
 
-        // Avatar color (same modulo logic as PHP: crc32 mod 4)
+        // Avatar color (real crc32, matching PHP's crc32 % 4 exactly)
         var avatarColors = ['lt-avatar--orange', 'lt-avatar--green', 'lt-avatar--purple', ''];
-        var hash = 0;
+        var avatarColor = avatarColors[crc32(displayName) % 4];
-        for (var i = 0; i < displayName.length; i++) {
-            hash = ((hash << 5) - hash + displayName.charCodeAt(i)) | 0;
-        }
-        var avatarColor = avatarColors[Math.abs(hash) % 4];
 
         // Format date
         var dateStr = c.created_at || '';

views/error_500.php

@@ -0,0 +1,38 @@
+<?php
+
+/**
+ * Standalone 500/fatal-error page, rendered by ErrorHandler for page-view
+ * (non-API) requests.
+ *
+ * Deliberately self-contained: a genuine fatal can happen before config.php
+ * finishes loading, mid-session-start, or mid-DB-query, so this view must
+ * not depend on $GLOBALS['config'], $GLOBALS['currentUser'], a session, or a
+ * DB connection being available/working. It links the static base.css
+ * stylesheet (served directly by the webserver, independent of PHP) to
+ * match the app's look without going through layout_header.php's app-state
+ * dependent setup.
+ */
+
+?>
+<!DOCTYPE html>
+<html lang="en" data-theme="dark">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>500 &mdash; Something Went Wrong</title>
+  <meta name="robots" content="noindex, nofollow">
+  <link rel="stylesheet" href="/assets/css/base.css">
+</head>
+<body>
+  <div class="lt-frame" style="max-width:32rem;margin:4rem auto">
+    <span class="lt-frame-bl">╚</span><span class="lt-frame-br">╝</span>
+    <div class="lt-section-header lt-text-danger">[ 500 ] SOMETHING WENT WRONG</div>
+    <div class="lt-section-body lt-text-center">
+      <p class="lt-text-muted lt-mb-md">
+        An unexpected error occurred. It's been logged; please try again shortly.
+      </p>
+      <a href="/" class="lt-btn lt-btn-primary">&larr; Dashboard</a>
+    </div>
+  </div>
+</body>
+</html>

views/layout_footer.php

@@ -235,11 +235,11 @@
       }
 
       function loadNotifications() {
-        fetch('/api/notifications.php', { credentials: 'same-origin' })
+        return lt.api.get('/api/notifications.php')
-          .then(function(r) { return r.json(); })
+          .then(function(data) { renderNotifications(data); return true; })
-          .then(renderNotifications)
           .catch(function() {
             list.innerHTML = '<div style="padding:0.75rem;font-size:0.75rem;color:var(--text-muted);text-align:center">Could not load</div>';
+            return false;
           });
       }
 
@@ -250,20 +250,41 @@
 
       if (clearBtn) {
         clearBtn.addEventListener('click', function() {
-          fetch('/api/notifications.php', {
+          lt.api.post('/api/notifications.php', { action: 'mark_read' }).then(loadNotifications);
-            method: 'POST', credentials: 'same-origin',
-            headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': window.CSRF_TOKEN || '' },
-            body: JSON.stringify({ action: 'mark_read' })
-          }).then(loadNotifications);
         });
       }
 
       document.addEventListener('click', function(e) { if (_open && wrapEl && !wrapEl.contains(e.target)) closePanel(); });
       document.addEventListener('keydown', function(e) { if (e.key === 'Escape' && _open) closePanel(); });
 
-      // Initial badge count + poll every 60s
+      // Poll every 60s while the tab is visible, backing off (up to 5 min) on
+      // repeated failures, and resuming immediately when the tab regains focus.
+      var POLL_INTERVAL = 60000;
+      var MAX_POLL_INTERVAL = 300000;
+      var _pollTimer = null;
+      var _failCount = 0;
+
+      function scheduleNextPoll(delay) {
+        clearTimeout(_pollTimer);
+        _pollTimer = setTimeout(pollNotifications, delay);
+      }
+
+      function pollNotifications() {
+        if (document.hidden) return;
+        loadNotifications().then(function(ok) {
+          _failCount = ok ? 0 : _failCount + 1;
+          var delay = ok ? POLL_INTERVAL : Math.min(POLL_INTERVAL * Math.pow(2, _failCount), MAX_POLL_INTERVAL);
+          scheduleNextPoll(delay);
+        });
+      }
+
+      document.addEventListener('visibilitychange', function() {
+        if (!document.hidden) pollNotifications();
+      });
+
+      // Initial badge count, then start the poll cycle
       loadNotifications();
-      setInterval(loadNotifications, 60000);
+      scheduleNextPoll(POLL_INTERVAL);
     })();
 <?php endif ?>