Merge development into main: visibility-notification pruning + CSRF UX + custom field type validation (#48, #50, #57, #73, #86)

- Prune watchers when a ticket's visibility is tightened (#73)
- Re-check ticket visibility before surfacing in-app notifications (#48)
- Use lt.api instead of raw fetch() in notification bell (#57)
- Auto-retry once after CSRF token resync in lt.api (#86)
- Validate field_type against the allowed enum in custom field definitions (#50)

api/notifications.php

@@ -15,8 +15,10 @@
 
 require_once __DIR__ . '/bootstrap.php';
 require_once dirname(__DIR__) . '/models/UserPreferencesModel.php';
+require_once dirname(__DIR__) . '/models/TicketModel.php';
 
 $prefsModel = new UserPreferencesModel($conn);
+$ticketModel = new TicketModel($conn);
 
 // ── POST: mark all read (update last_seen timestamp) ──────────────
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
@@ -204,7 +206,44 @@ foreach (array_merge($assignRows, $commentRows, $statusRows, $mentionRows) as $r
     $all[] = $row;
 }
 usort($all, fn($a, $b) => strcmp($b['created_at'], $a['created_at']));
-$all = array_slice($all, 0, 30);
+
+// Re-check current ticket visibility before surfacing anything: a
+// notification's audit_log entry reflects historical activity, but the
+// ticket's visibility (or the user's group/watcher standing) may have
+// tightened since. Without this, a notification still discloses the
+// ticket's title and that activity occurred to someone who currently
+// shouldn't see it, even though the ticket view's own access check would
+// correctly reject them from opening it.
+$candidateTicketIds = [];
+foreach ($all as $row) {
+    $details = json_decode($row['details'] ?? '{}', true) ?? [];
+    $actionType = ($row['action_type'] === 'create' && $row['entity_type'] === 'comment')
+        ? 'comment'
+        : $row['action_type'];
+    $tid = ($actionType === 'comment' || $actionType === 'mention')
+        ? ($details['ticket_id'] ?? 0)
+        : $row['entity_id'];
+    if ($tid) {
+        $candidateTicketIds[(string)$tid] = true;
+    }
+}
+$ticketsById = !empty($candidateTicketIds)
+    ? $ticketModel->getTicketsByIds(array_keys($candidateTicketIds))
+    : [];
+
+$all = array_filter($all, function ($row) use ($ticketsById, $currentUser, $ticketModel) {
+    $details = json_decode($row['details'] ?? '{}', true) ?? [];
+    $actionType = ($row['action_type'] === 'create' && $row['entity_type'] === 'comment')
+        ? 'comment'
+        : $row['action_type'];
+    $tid = (string)(($actionType === 'comment' || $actionType === 'mention')
+        ? ($details['ticket_id'] ?? 0)
+        : $row['entity_id']);
+    $ticket = $ticketsById[$tid] ?? null;
+    return $ticket && $ticketModel->canUserAccessTicket($ticket, $currentUser);
+});
+
+$all = array_slice(array_values($all), 0, 30);
 
 // Format for response
 $notifications = [];

api/ticket_custom_fields.php

@@ -0,0 +1,87 @@
+<?php
+
+/**
+ * Save custom field values for a ticket.
+ *
+ * POST { ticket_id, values: { [field_id]: value, ... } }
+ *
+ * Only fields applicable to the ticket's current category (or category-less
+ * fields) are considered; anything else in `values` is ignored rather than
+ * persisted, so a value typed for a field that no longer applies (e.g. the
+ * category changed) can't linger as orphaned/misleading data.
+ */
+
+require_once __DIR__ . '/bootstrap.php';
+require_once dirname(__DIR__) . '/models/TicketModel.php';
+require_once dirname(__DIR__) . '/models/CustomFieldModel.php';
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+    http_response_code(405);
+    apiRespond(['success' => false, 'error' => 'Method not allowed']);
+}
+
+$data = json_decode(file_get_contents('php://input'), true);
+$ticketId = isset($data['ticket_id']) ? trim((string)$data['ticket_id']) : '';
+$values = is_array($data['values'] ?? null) ? $data['values'] : [];
+
+if ($ticketId === '') {
+    http_response_code(400);
+    apiRespond(['success' => false, 'error' => 'ticket_id required']);
+}
+
+$ticketModel = new TicketModel($conn);
+$ticket = $ticketModel->getTicketById($ticketId);
+if (!$ticket || !$ticketModel->canUserAccessTicket($ticket, $currentUser)) {
+    http_response_code(404);
+    apiRespond(['success' => false, 'error' => 'Ticket not found']);
+}
+
+$fieldModel = new CustomFieldModel($conn);
+$definitions = $fieldModel->getAllDefinitions($ticket['category'], true);
+
+$errors = [];
+$toSave = [];
+foreach ($definitions as $def) {
+    $fieldId = (int)$def['field_id'];
+    $raw = $values[$fieldId] ?? ($values[(string)$fieldId] ?? null);
+
+    if ($def['field_type'] === 'checkbox') {
+        $normalized = !empty($raw) ? '1' : '0';
+    } else {
+        $normalized = is_scalar($raw) ? trim((string)$raw) : '';
+    }
+
+    if (!empty($def['is_required']) && $def['field_type'] !== 'checkbox' && $normalized === '') {
+        $errors[] = $def['field_label'] . ' is required';
+        continue;
+    }
+
+    if ($def['field_type'] === 'select' && $normalized !== '') {
+        $allowedOptions = $def['field_options']['options'] ?? [];
+        if (!in_array($normalized, $allowedOptions, true)) {
+            $errors[] = $def['field_label'] . ' has an invalid selection';
+            continue;
+        }
+    }
+
+    if ($def['field_type'] === 'number' && $normalized !== '' && !is_numeric($normalized)) {
+        $errors[] = $def['field_label'] . ' must be a number';
+        continue;
+    }
+
+    $toSave[$fieldId] = $normalized;
+}
+
+if (!empty($errors)) {
+    http_response_code(422);
+    apiRespond(['success' => false, 'error' => implode('; ', $errors)]);
+}
+
+$fieldModel->setValues($ticketId, $toSave);
+
+require_once dirname(__DIR__) . '/models/AuditLogModel.php';
+(new AuditLogModel($conn))->log($userId, 'update', 'ticket', $ticketId, [
+    'reason' => 'custom fields updated',
+]);
+
+apiRespond(['success' => true]);

assets/js/base.js

@@ -2801,7 +2801,7 @@
   };
 
   // Patch lt.api — auth-aware wrapper (renamed to avoid strict-mode duplicate declaration)
-  async function _apiFetchAuth(method, url, body) {
+  async function _apiFetchAuth(method, url, body, retried) {
     if (_authAccess && auth.isExpiringSoon()) await auth.refresh();
     const opts = { method, headers: Object.assign({ 'Content-Type': 'application/json' }, csrfHeaders()) };
     if (_authAccess) opts.headers['Authorization'] = 'Bearer ' + _authAccess;
@@ -2821,6 +2821,15 @@
     // Resync CSRF token from any response body that carries a fresh one
     // (bootstrap rotates on success and returns the current token on rejection).
     if (data && data.csrf_token) global.CSRF_TOKEN = data.csrf_token;
+    // Auto-retry once on a stale-CSRF-token 403: the token lifetime (1h) is
+    // shorter than the session idle timeout (5h), so this is a routine,
+    // recoverable case (an hour of inactivity, or a write in another tab
+    // rotating the shared token) rather than a real rejection — resyncing
+    // above already has the fresh token, so silently resending once succeeds
+    // transparently instead of surfacing a confusing error on the first try.
+    if (resp.status === 403 && !retried && data && data.csrf_token) {
+      return _apiFetchAuth(method, url, body, true);
+    }
     if (!resp.ok) {
       const err = new Error(data.error || data.message || 'HTTP ' + resp.status);
       err.data = data;

controllers/TicketController.php

@@ -7,6 +7,7 @@ require_once dirname(__DIR__) . '/models/AuditLogModel.php';
 require_once dirname(__DIR__) . '/models/UserModel.php';
 require_once dirname(__DIR__) . '/models/WorkflowModel.php';
 require_once dirname(__DIR__) . '/models/TemplateModel.php';
+require_once dirname(__DIR__) . '/models/CustomFieldModel.php';
 require_once dirname(__DIR__) . '/helpers/UrlHelper.php';
 require_once dirname(__DIR__) . '/helpers/NotificationHelper.php';
 
@@ -18,6 +19,7 @@ class TicketController
     private $userModel;
     private $workflowModel;
     private $templateModel;
+    private $customFieldModel;
     private $conn;
 
     public function __construct($conn)
@@ -29,6 +31,7 @@ class TicketController
         $this->userModel = new UserModel($conn);
         $this->workflowModel = new WorkflowModel($conn);
         $this->templateModel = new TemplateModel($conn);
+        $this->customFieldModel = new CustomFieldModel($conn);
     }
 
     public function view($id)
@@ -60,6 +63,11 @@ class TicketController
         // Get allowed status transitions for this ticket
         $allowedTransitions = $this->workflowModel->getAllowedTransitions($ticket['status']);
 
+        // Custom fields applicable to this ticket's category, with any
+        // already-saved values for it
+        $customFieldDefs = $this->customFieldModel->getAllDefinitions($ticket['category'], true);
+        $customFieldValues = $this->customFieldModel->getValuesForTicket($id);
+
         // Make $conn available to view for visibility groups
         $conn = $this->conn;
 
@@ -73,6 +81,12 @@ class TicketController
         $currentUser = $GLOBALS['currentUser'] ?? null;
         $userId = $currentUser['user_id'] ?? null;
 
+        // All active custom field definitions (every category, plus
+        // category-less ones) — the create form renders them all and toggles
+        // visibility client-side as the Category select changes, since the
+        // ticket doesn't exist yet to scope the query to one category.
+        $allCustomFieldDefs = $this->customFieldModel->getAllDefinitions(null, true);
+
         // Check if form was submitted
         if ($_SERVER['REQUEST_METHOD'] === 'POST') {
             // Validate CSRF token
@@ -131,6 +145,38 @@ class TicketController
                 return;
             }
 
+            // Custom fields applicable to the submitted category — validate
+            // is_required server-side (the form is novalidate, and a field
+            // hidden by the client-side category toggle must not silently
+            // bypass a requirement that applies to the category actually
+            // submitted).
+            $submittedCustomFields = is_array($_POST['custom_fields'] ?? null) ? $_POST['custom_fields'] : [];
+            $applicableFieldDefs = array_filter(
+                $allCustomFieldDefs,
+                fn($def) => $def['category'] === null || $def['category'] === $ticketData['category']
+            );
+            $customFieldsToSave = [];
+            foreach ($applicableFieldDefs as $def) {
+                $fieldId = (int)$def['field_id'];
+                $raw = $submittedCustomFields[$fieldId] ?? null;
+                $normalized = $def['field_type'] === 'checkbox'
+                    ? (!empty($raw) ? '1' : '0')
+                    : (is_scalar($raw) ? trim((string)$raw) : '');
+
+                if (!empty($def['is_required']) && $def['field_type'] !== 'checkbox' && $normalized === '') {
+                    $error = $def['field_label'] . ' is required';
+                    $templates = $this->templateModel->getAllTemplates();
+                    $allUsers = $this->userModel->getAllUsers();
+                    $conn = $this->conn;
+                    include dirname(__DIR__) . '/views/CreateTicketView.php';
+                    return;
+                }
+
+                if ($normalized !== '') {
+                    $customFieldsToSave[$fieldId] = $normalized;
+                }
+            }
+
             // Create ticket with user tracking
             $result = $this->ticketModel->createTicket($ticketData, $userId);
 
@@ -144,6 +190,12 @@ class TicketController
                 require_once dirname(__DIR__) . '/models/StatsModel.php';
                 (new StatsModel($this->conn))->invalidateCache();
 
+                // Persist custom field values for the fields applicable to
+                // this ticket's category
+                if (!empty($customFieldsToSave)) {
+                    $this->customFieldModel->setValues($result['ticket_id'], $customFieldsToSave);
+                }
+
                 // Auto-link as duplicate if requested from create form
                 $linkDupOfRaw = trim($_POST['link_duplicate_of'] ?? '');
                 if ($linkDupOfRaw !== '' && ctype_digit($linkDupOfRaw)) {

models/CustomFieldModel.php

@@ -8,6 +8,9 @@ class CustomFieldModel
 {
     private $conn;
 
+    // Must match custom_field_definitions.field_type's enum() in the schema.
+    private const ALLOWED_FIELD_TYPES = ['text', 'textarea', 'select', 'checkbox', 'date', 'number'];
+
     public function __construct($conn)
     {
         $this->conn = $conn;
@@ -87,6 +90,10 @@ class CustomFieldModel
      */
     public function createDefinition($data)
     {
+        if (!in_array($data['field_type'] ?? '', self::ALLOWED_FIELD_TYPES, true)) {
+            return ['success' => false, 'error' => 'Invalid field_type'];
+        }
+
         $options = null;
         if (isset($data['field_options']) && !empty($data['field_options'])) {
             $options = json_encode($data['field_options']);
@@ -129,6 +136,10 @@ class CustomFieldModel
      */
     public function updateDefinition($fieldId, $data)
     {
+        if (!in_array($data['field_type'] ?? '', self::ALLOWED_FIELD_TYPES, true)) {
+            return ['success' => false, 'error' => 'Invalid field_type'];
+        }
+
         $options = null;
         if (isset($data['field_options']) && !empty($data['field_options'])) {
             $options = json_encode($data['field_options']);

models/TicketModel.php

@@ -773,9 +773,68 @@ class TicketModel
         $stmt->bind_param("ssis", $visibility, $visibilityGroups, $updatedBy, $ticketId);
         $result = $stmt->execute();
         $stmt->close();
+
+        if ($result) {
+            $this->pruneWatchersForVisibility($ticketId, $visibility, $visibilityGroups);
+        }
+
         return $result;
     }
 
+    /**
+     * Remove any watchers who no longer qualify for a ticket's access rules
+     * after its visibility was tightened. Without this, a user watching a
+     * ticket that's later made confidential/internal (and who isn't
+     * creator/assignee/admin/in the new visibility_groups) keeps receiving
+     * Matrix notifications about a ticket canUserAccessTicket() would now
+     * reject them from opening directly.
+     */
+    private function pruneWatchersForVisibility(string $ticketId, string $visibility, ?string $visibilityGroups): void
+    {
+        $ticket = $this->getTicketById($ticketId);
+        if (!$ticket) {
+            return;
+        }
+        // getTicketById() reflects the just-committed UPDATE, but set these
+        // explicitly so pruning is correct even if a caller reorders things.
+        $ticket['visibility'] = $visibility;
+        $ticket['visibility_groups'] = $visibilityGroups;
+
+        $sql = "SELECT tw.user_id, u.is_admin, u.`groups`
+                FROM ticket_watchers tw
+                JOIN users u ON tw.user_id = u.user_id
+                WHERE tw.ticket_id = ?";
+        $stmt = $this->conn->prepare($sql);
+        $stmt->bind_param('s', $ticketId);
+        $stmt->execute();
+        $watchers = $stmt->get_result()->fetch_all(MYSQLI_ASSOC);
+        $stmt->close();
+
+        $toRemove = [];
+        foreach ($watchers as $watcher) {
+            $watcherUser = [
+                'user_id' => $watcher['user_id'],
+                'is_admin' => $watcher['is_admin'],
+                'groups' => $watcher['groups'],
+            ];
+            if (!$this->canUserAccessTicket($ticket, $watcherUser)) {
+                $toRemove[] = $watcher['user_id'];
+            }
+        }
+
+        if (empty($toRemove)) {
+            return;
+        }
+
+        $placeholders = implode(',', array_fill(0, count($toRemove), '?'));
+        $delSql = "DELETE FROM ticket_watchers WHERE ticket_id = ? AND user_id IN ($placeholders)";
+        $delStmt = $this->conn->prepare($delSql);
+        $types = 's' . str_repeat('i', count($toRemove));
+        $delStmt->bind_param($types, $ticketId, ...$toRemove);
+        $delStmt->execute();
+        $delStmt->close();
+    }
+
     /**
      * Delete a ticket and all its associated records.
      * Admin-only operation. Removes comments, attachments, watchers, dependencies.

views/CreateTicketView.php

@@ -124,7 +124,7 @@ include __DIR__ . '/layout_header.php';
 
         <div class="lt-form-group">
           <label class="lt-label" for="category">Category</label>
-          <select id="category" name="category" class="lt-select">
+          <select id="category" name="category" class="lt-select" data-action="toggle-custom-fields">
             <option value="Hardware">Hardware</option>
             <option value="Software">Software</option>
             <option value="Network">Network</option>
@@ -211,6 +211,55 @@ include __DIR__ . '/layout_header.php';
     </div>
   </div>
 
+  <?php if (!empty($allCustomFieldDefs)) : ?>
+  <!-- ── SECTION 5b: Custom Fields ─────────────────────────── -->
+  <div class="lt-frame lt-mb-md">
+    <span class="lt-frame-bl">╚</span><span class="lt-frame-br">╝</span>
+    <div class="lt-section-header">Additional Fields</div>
+    <div class="lt-section-body">
+        <?php foreach ($allCustomFieldDefs as $cfDef) : ?>
+        <div class="lt-form-group custom-field-group"
+             data-custom-field-category="<?= htmlspecialchars($cfDef['category'] ?? '', ENT_QUOTES, 'UTF-8') ?>">
+            <?php
+            $cfName = 'custom_fields[' . (int)$cfDef['field_id'] . ']';
+            $cfId   = 'custom_field_' . (int)$cfDef['field_id'];
+            ?>
+          <label class="lt-label" for="<?= $cfId ?>">
+            <?= htmlspecialchars($cfDef['field_label'], ENT_QUOTES, 'UTF-8') ?><?= $cfDef['is_required'] ? ' *' : '' ?>
+          </label>
+            <?php if ($cfDef['field_type'] === 'textarea') : ?>
+            <textarea id="<?= $cfId ?>" name="<?= $cfName ?>" class="lt-input lt-textarea" rows="3"
+                      <?= $cfDef['is_required'] ? 'data-custom-field-required="1"' : '' ?>></textarea>
+            <?php elseif ($cfDef['field_type'] === 'select') : ?>
+            <select id="<?= $cfId ?>" name="<?= $cfName ?>" class="lt-select"
+                    <?= $cfDef['is_required'] ? 'data-custom-field-required="1"' : '' ?>>
+              <option value="">— Select —</option>
+                <?php foreach (($cfDef['field_options']['options'] ?? []) as $opt) : ?>
+                <option value="<?= htmlspecialchars($opt, ENT_QUOTES, 'UTF-8') ?>"><?= htmlspecialchars($opt, ENT_QUOTES, 'UTF-8') ?></option>
+                <?php endforeach ?>
+            </select>
+            <?php elseif ($cfDef['field_type'] === 'checkbox') : ?>
+            <label class="lt-filter-option">
+              <input type="checkbox" class="lt-checkbox" id="<?= $cfId ?>" name="<?= $cfName ?>" value="1">
+                <?= htmlspecialchars($cfDef['field_label'], ENT_QUOTES, 'UTF-8') ?>
+            </label>
+            <?php elseif ($cfDef['field_type'] === 'date') : ?>
+            <input type="date" id="<?= $cfId ?>" name="<?= $cfName ?>" class="lt-input"
+                   <?= $cfDef['is_required'] ? 'data-custom-field-required="1"' : '' ?>>
+            <?php elseif ($cfDef['field_type'] === 'number') : ?>
+            <input type="number" id="<?= $cfId ?>" name="<?= $cfName ?>" class="lt-input"
+                   <?= $cfDef['is_required'] ? 'data-custom-field-required="1"' : '' ?>>
+            <?php else : ?>
+            <input type="text" id="<?= $cfId ?>" name="<?= $cfName ?>" class="lt-input"
+                   <?= $cfDef['is_required'] ? 'data-custom-field-required="1"' : '' ?>>
+            <?php endif ?>
+        </div>
+        <?php endforeach ?>
+      <p class="lt-form-hint">Fields shown depend on the selected Category.</p>
+    </div>
+  </div>
+  <?php endif ?>
+
   <!-- ── SECTION 6: Description ───────────────────────────── -->
   <div class="lt-frame lt-mb-md">
     <span class="lt-frame-bl">╚</span><span class="lt-frame-br">╝</span>
@@ -316,6 +365,15 @@ include __DIR__ . '/layout_header.php';
             .catch(function () { /* silent — duplicate check is non-critical */ });
     }
 
+    // ── Custom fields: show only the selected category's fields ──
+    function toggleCustomFields() {
+        var category = document.getElementById('category').value;
+        document.querySelectorAll('.custom-field-group').forEach(function (group) {
+            var fieldCategory = group.getAttribute('data-custom-field-category');
+            group.classList.toggle('is-hidden', fieldCategory !== '' && fieldCategory !== category);
+        });
+    }
+
     // ── Visibility groups toggle ──────────────────────────────
     var visibilityHints = {
         'public':       'Everyone who is logged in can view this ticket.',
@@ -387,9 +445,11 @@ include __DIR__ . '/layout_header.php';
         switch (target.getAttribute('data-action')) {
             case 'load-template':             loadTemplate();             break;
             case 'toggle-visibility-groups':  toggleVisibilityGroups();   break;
+            case 'toggle-custom-fields':      toggleCustomFields();       break;
         }
     });
 
+    toggleCustomFields();
     if (window.lt) lt.keys.initDefaults();
 }());
 </script>

views/TicketView.php

@@ -397,6 +397,12 @@ document.addEventListener('DOMContentLoaded', function() {
           role="tab" data-tab="dependencies-panel" aria-selected="false" aria-controls="dependencies-panel">
     Dependencies
   </button>
+  <?php if (!empty($customFieldDefs)) : ?>
+  <button type="button" class="lt-tab" id="custom-fields-tab-btn"
+          role="tab" data-tab="custom-fields-panel" aria-selected="false" aria-controls="custom-fields-panel">
+    Custom Fields
+  </button>
+  <?php endif ?>
   <button type="button" class="lt-tab" id="activity-tab-btn"
           role="tab" data-tab="activity-panel" aria-selected="false" aria-controls="activity-panel">
     Activity
@@ -682,6 +688,60 @@ document.addEventListener('DOMContentLoaded', function() {
   </div>
 </div>
 
+<?php if (!empty($customFieldDefs)) : ?>
+<!-- ═══════════════════════════════════════════════════════════
+     TAB PANEL: CUSTOM FIELDS
+     ═══════════════════════════════════════════════════════════ -->
+<div id="custom-fields-panel" class="lt-tab-panel" role="tabpanel" aria-labelledby="custom-fields-tab-btn">
+  <div class="lt-frame">
+    <span class="lt-frame-bl">╚</span><span class="lt-frame-br">╝</span>
+    <div class="lt-section-header">Custom Fields</div>
+    <div class="lt-section-body">
+      <div id="customFieldsMsg" class="lt-msg is-hidden lt-mb-md" role="alert" aria-live="polite"></div>
+      <?php foreach ($customFieldDefs as $cfDef) :
+            $cfValue = $customFieldValues[$cfDef['field_name']]['field_value'] ?? '';
+            $cfName  = 'custom_fields[' . (int)$cfDef['field_id'] . ']';
+            $cfId    = 'ticket_custom_field_' . (int)$cfDef['field_id'];
+            ?>
+        <div class="lt-form-group">
+          <label class="lt-label" for="<?= $cfId ?>">
+            <?= htmlspecialchars($cfDef['field_label'], ENT_QUOTES, 'UTF-8') ?><?= $cfDef['is_required'] ? ' *' : '' ?>
+          </label>
+            <?php if ($cfDef['field_type'] === 'textarea') : ?>
+            <textarea id="<?= $cfId ?>" name="<?= $cfName ?>" class="lt-input lt-textarea" rows="3"
+                      ><?= htmlspecialchars($cfValue, ENT_QUOTES, 'UTF-8') ?></textarea>
+            <?php elseif ($cfDef['field_type'] === 'select') : ?>
+            <select id="<?= $cfId ?>" name="<?= $cfName ?>" class="lt-select">
+              <option value="">— Select —</option>
+                <?php foreach (($cfDef['field_options']['options'] ?? []) as $opt) : ?>
+                <option value="<?= htmlspecialchars($opt, ENT_QUOTES, 'UTF-8') ?>"
+                        <?= $opt === $cfValue ? 'selected' : '' ?>><?= htmlspecialchars($opt, ENT_QUOTES, 'UTF-8') ?></option>
+                <?php endforeach ?>
+            </select>
+            <?php elseif ($cfDef['field_type'] === 'checkbox') : ?>
+            <label class="lt-filter-option">
+              <input type="checkbox" class="lt-checkbox" id="<?= $cfId ?>" name="<?= $cfName ?>" value="1"
+                     <?= $cfValue === '1' ? 'checked' : '' ?>>
+                <?= htmlspecialchars($cfDef['field_label'], ENT_QUOTES, 'UTF-8') ?>
+            </label>
+            <?php elseif ($cfDef['field_type'] === 'date') : ?>
+            <input type="date" id="<?= $cfId ?>" name="<?= $cfName ?>" class="lt-input"
+                   value="<?= htmlspecialchars($cfValue, ENT_QUOTES, 'UTF-8') ?>">
+            <?php elseif ($cfDef['field_type'] === 'number') : ?>
+            <input type="number" id="<?= $cfId ?>" name="<?= $cfName ?>" class="lt-input"
+                   value="<?= htmlspecialchars($cfValue, ENT_QUOTES, 'UTF-8') ?>">
+            <?php else : ?>
+            <input type="text" id="<?= $cfId ?>" name="<?= $cfName ?>" class="lt-input"
+                   value="<?= htmlspecialchars($cfValue, ENT_QUOTES, 'UTF-8') ?>">
+            <?php endif ?>
+        </div>
+      <?php endforeach ?>
+      <button type="button" id="saveCustomFieldsBtn" class="lt-btn lt-btn-primary lt-btn-sm">SAVE CUSTOM FIELDS</button>
+    </div>
+  </div>
+</div>
+<?php endif ?>
+
 <!-- ═══════════════════════════════════════════════════════════
      TAB PANEL: ACTIVITY
      ═══════════════════════════════════════════════════════════ -->
@@ -1013,6 +1073,46 @@ document.addEventListener('DOMContentLoaded', function () {
         });
     }
 
+    // Save custom fields button
+    var saveCustomFieldsBtn = document.getElementById('saveCustomFieldsBtn');
+    if (saveCustomFieldsBtn) {
+        saveCustomFieldsBtn.addEventListener('click', function () {
+            var panel = document.getElementById('custom-fields-panel');
+            var msg = document.getElementById('customFieldsMsg');
+            var values = {};
+            panel.querySelectorAll('[name^="custom_fields["]').forEach(function (el) {
+                var m = el.name.match(/custom_fields\[(\d+)\]/);
+                if (!m) return;
+                var fieldId = m[1];
+                if (el.type === 'checkbox') {
+                    values[fieldId] = el.checked ? '1' : '0';
+                } else {
+                    values[fieldId] = el.value;
+                }
+            });
+
+            saveCustomFieldsBtn.disabled = true;
+            msg.classList.add('is-hidden');
+
+            lt.api.post('/api/ticket_custom_fields.php', {
+                ticket_id: window.ticketData.id,
+                values: values
+            }).then(function (data) {
+                saveCustomFieldsBtn.disabled = false;
+                if (data.success) {
+                    lt.toast.success('Custom fields saved', 3000);
+                } else {
+                    msg.textContent = data.error || 'Failed to save custom fields';
+                    msg.className = 'lt-msg lt-msg-danger lt-mb-md';
+                }
+            }).catch(function (error) {
+                saveCustomFieldsBtn.disabled = false;
+                msg.textContent = 'Failed to save custom fields: ' + error.message;
+                msg.className = 'lt-msg lt-msg-danger lt-mb-md';
+            });
+        });
+    }
+
     // Settings save/cancel
     // Load user preference toggles on settings modal open
     (function() {

views/layout_footer.php

@@ -235,8 +235,7 @@
       }
 
       function loadNotifications() {
-        return fetch('/api/notifications.php', { credentials: 'same-origin' })
+        return lt.api.get('/api/notifications.php')
-          .then(function(r) { return r.json(); })
           .then(function(data) { renderNotifications(data); return true; })
           .catch(function() {
             list.innerHTML = '<div style="padding:0.75rem;font-size:0.75rem;color:var(--text-muted);text-align:center">Could not load</div>';
@@ -251,11 +250,7 @@
 
       if (clearBtn) {
         clearBtn.addEventListener('click', function() {
-          fetch('/api/notifications.php', {
+          lt.api.post('/api/notifications.php', { action: 'mark_read' }).then(loadNotifications);
-            method: 'POST', credentials: 'same-origin',
-            headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': window.CSRF_TOKEN || '' },
-            body: JSON.stringify({ action: 'mark_read' })
-          }).then(loadNotifications);
         });
       }