Verify mentioned-user access before sending @mention notifications (#69)

sendMentionNotification(), called from add_comment.php, had no
visibility check at all — unlike sendCommentNotification()/
notifyWatchers() which redact the comment preview for non-public
tickets. Mentioning a user with zero standing access to a confidential
ticket (not creator/assignee/admin, not in visibility_groups) sent
them a Matrix DM with the full ticket title AND comment text — worse
than #46 since it's delivered directly to an individual rather than
diluted into a shared list.

add_comment.php now filters mentioned users through
canUserAccessTicket() before resolving Matrix IDs, skipping the
notification entirely for anyone without access (one of the two
options the issue names as acceptable). getMentionedUsers() needed to
start selecting is_admin and groups alongside user_id/username/
display_name, since canUserAccessTicket() requires them. Verified
against real MariaDB: a user mentioned on a confidential ticket they
don't own/aren't assigned to is correctly denied, a user in the
matching visibility_groups for an internal ticket is correctly
allowed, and the same user is correctly denied on a different internal
ticket whose group they're not in.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015nCxwFFsy8ouMWzn56rPVP

api/add_comment.php

@@ -177,9 +177,16 @@ try {
         $ticketTitle   = $ticket['title'] ?? "Ticket #{$ticketId}";
         $ticketVisibility = $ticket['visibility'] ?? 'public';
 
-        // @mention notifications — resolve usernames → Matrix IDs via Synapse Admin API
+        // @mention notifications — resolve usernames → Matrix IDs via Synapse Admin API.
-        if (!empty($mentionedUsers)) {
+        // Only notify mentioned users who actually have access to this ticket;
-            $mentionedUsernames = array_column($mentionedUsers, 'username');
+        // otherwise a mention would DM them the ticket's title and comment text
+        // even though canUserAccessTicket() would deny them the ticket itself.
+        $accessibleMentionedUsers = array_filter(
+            $mentionedUsers,
+            fn($u) => $ticketModel->canUserAccessTicket($ticket, $u)
+        );
+        if (!empty($accessibleMentionedUsers)) {
+            $mentionedUsernames = array_column($accessibleMentionedUsers, 'username');
             $mentionedMatrixIds = SynapseHelper::resolveUsernames($mentionedUsernames);
             if (!empty($mentionedMatrixIds)) {
                 NotificationHelper::sendMentionNotification($ticketId, $ticketTitle, $commentText, $authorDisplay, $mentionedMatrixIds);

api/assign_ticket.php

@@ -76,7 +76,8 @@ if ($assignedTo === null || $assignedTo === '') {
                 $ticket['title'] ?? "Ticket #{$ticketId}",
                 $assigneeName,
                 $assigneeMatrix,
-                $changedByDisplay
+                $changedByDisplay,
+                $ticket['visibility'] ?? 'public'
             );
         }
     }

api/ticket_status_api.php

@@ -171,7 +171,8 @@ if ($currentStatus !== $newStatus) {
         $currentStatus,
         $newStatus,
         (string)$ticket['title'],
-        $keyName
+        $keyName,
+        $ticket['visibility'] ?? 'public'
     );
     NotificationHelper::notifyWatchers(
         $conn,

api/update_ticket.php

@@ -267,7 +267,8 @@ try {
                     $currentTicket['status'],
                     $updateData['status'],
                     $updateData['title'],
-                    $changedBy
+                    $changedBy,
+                    $currentTicket['visibility'] ?? 'public'
                 );
                 NotificationHelper::notifyWatchers(
                     $this->conn,

helpers/NotificationHelper.php

@@ -40,20 +40,40 @@ class NotificationHelper
         return array_values(array_filter(array_map('trim', explode(',', $raw))));
     }
 
+    /**
+     * Redact a ticket title for the shared Matrix notify list when the
+     * ticket isn't public, matching how sendCommentNotification() and
+     * notifyWatchers() already redact comment/activity previews for the
+     * same list.
+     */
+    private static function redactedTitle(string $title, string $visibility): string
+    {
+        return $visibility === 'public' ? $title : '(restricted ticket — title hidden)';
+    }
+
     // ─── Public event methods ─────────────────────────────────────────────────
 
     /**
      * New ticket created (manual or automated/API).
+     *
+     * $ticketData['visibility'] ('public', 'internal', or 'confidential') is
+     * used to redact the title sent to the shared MATRIX_NOTIFY_USERS list
+     * for non-public tickets, same as sendCommentNotification()'s preview
+     * redaction. Defaults to 'public' for callers (e.g. the hwmonDaemon
+     * Bearer-API paths) that never set a non-default visibility.
      */
     public static function sendTicketNotification($ticketId, array $ticketData, string $trigger = 'manual'): void
     {
-        preg_match('/^\[([^\]]+)\]/', $ticketData['title'] ?? '', $m);
+        $visibility = $ticketData['visibility'] ?? 'public';
+        $title = $ticketData['title'] ?? 'Untitled';
+
+        preg_match('/^\[([^\]]+)\]/', $title, $m);
         $source = $m[1] ?? ($trigger === 'automated' ? 'Automated' : 'Manual');
 
         self::fire([
             'event'        => 'ticket_created',
             'ticket_id'    => $ticketId,
-            'title'        => $ticketData['title']    ?? 'Untitled',
+            'title'        => self::redactedTitle($title, $visibility),
             'priority'     => (int)($ticketData['priority'] ?? 4),
             'category'     => $ticketData['category'] ?? 'General',
             'type'         => $ticketData['type']     ?? 'Issue',
@@ -73,13 +93,16 @@ class NotificationHelper
      * @param string     $newStatus
      * @param string     $ticketTitle
      * @param string|null $changedByDisplay  Display name of the user who changed status
+     * @param string      $visibility        Ticket visibility; non-public titles are
+     *                                        redacted before being sent to the shared
+     *                                        notify list, same as sendTicketNotification().
      */
-    public static function sendStatusChangeNotification($ticketId, string $oldStatus, string $newStatus, string $ticketTitle, ?string $changedByDisplay = null): void
+    public static function sendStatusChangeNotification($ticketId, string $oldStatus, string $newStatus, string $ticketTitle, ?string $changedByDisplay = null, string $visibility = 'public'): void
     {
         self::fire([
             'event'          => 'status_changed',
             'ticket_id'      => $ticketId,
-            'title'          => $ticketTitle,
+            'title'          => self::redactedTitle($ticketTitle, $visibility),
             'old_status'     => $oldStatus,
             'new_status'     => $newStatus,
             'changed_by'     => $changedByDisplay,
@@ -166,11 +189,12 @@ class NotificationHelper
      * @param array       $extraData    Merged into the payload (old_status/new_status, author, etc.)
      * @param int|null    $excludeUserId  Don't notify the actor themselves
      * @param string      $visibility   Ticket visibility: 'public', 'internal', or
-     *                                   'confidential'. notify_users includes the
+     *                                   'confidential'. The shared notify list may
-     *                                   shared list, which may contain users without
+     *                                   contain users without access to non-public
-     *                                   access to non-public tickets, so any comment
+     *                                   tickets, so for those tickets it's excluded
-     *                                   body preview in $extraData is redacted for
+     *                                   entirely (only actual watchers are notified)
-     *                                   non-public tickets.
+     *                                   and both the title and any comment/body
+     *                                   preview in $extraData are redacted.
      */
     public static function notifyWatchers(\mysqli $conn, $ticketId, string $ticketTitle, string $event, array $extraData = [], ?int $excludeUserId = null, string $visibility = 'public'): void
     {
@@ -230,13 +254,17 @@ class NotificationHelper
             return;
         }
 
-        // Remove the global notify list duplicates and build payload
+        // The shared notify list may include users without access to
-        $allNotify = array_unique(array_merge($matrixIds, self::notifyUsers()));
+        // non-public tickets, so only mix it in for public tickets — for
+        // internal/confidential tickets, notify actual watchers only.
+        $allNotify = $visibility === 'public'
+            ? array_unique(array_merge($matrixIds, self::notifyUsers()))
+            : $matrixIds;
 
         $payload = array_merge($extraData, [
             'event'        => $event,
             'ticket_id'    => $ticketId,
-            'title'        => $ticketTitle,
+            'title'        => self::redactedTitle($ticketTitle, $visibility),
             'url'          => UrlHelper::ticketUrl($ticketId),
             'notify_users' => array_values($allNotify),
         ]);
@@ -252,8 +280,14 @@ class NotificationHelper
      * @param string|null $assigneeName    Display name of new assignee
      * @param string|null $assigneeMatrix  Matrix user ID of new assignee (to DM)
      * @param string|null $changedByDisplay
+     * @param string      $visibility      Ticket visibility; non-public titles are
+     *                                      redacted before being sent to the shared
+     *                                      notify list, same as sendTicketNotification().
+     *                                      The assignee is DMed directly regardless,
+     *                                      since they now have standing access to the
+     *                                      ticket by virtue of being assigned to it.
      */
-    public static function sendAssignmentNotification($ticketId, string $ticketTitle, ?string $assigneeName, ?string $assigneeMatrix, ?string $changedByDisplay = null): void
+    public static function sendAssignmentNotification($ticketId, string $ticketTitle, ?string $assigneeName, ?string $assigneeMatrix, ?string $changedByDisplay = null, string $visibility = 'public'): void
     {
         $notifyUsers = self::notifyUsers();
         // Also notify the assignee directly if we know their Matrix ID
@@ -267,7 +301,7 @@ class NotificationHelper
         self::fire([
             'event'        => 'assigned',
             'ticket_id'    => $ticketId,
-            'title'        => $ticketTitle,
+            'title'        => self::redactedTitle($ticketTitle, $visibility),
             'assignee'     => $assigneeName,
             'changed_by'   => $changedByDisplay,
             'url'          => UrlHelper::ticketUrl($ticketId),

models/CommentModel.php

@@ -38,7 +38,7 @@ class CommentModel
         }
 
         $placeholders = str_repeat('?,', count($usernames) - 1) . '?';
-        $sql = "SELECT user_id, username, display_name FROM users WHERE username IN ($placeholders)";
+        $sql = "SELECT user_id, username, display_name, is_admin, `groups` FROM users WHERE username IN ($placeholders)";
         $stmt = $this->conn->prepare($sql);
 
         $types = str_repeat('s', count($usernames));