Merge development into main: search filter merge, workflow dup rejection, recurring-ticket loss alert, preview debounce (#58, #62, #88, #108)

- Merge into current URL params instead of replacing them in Advanced Search (#58)
- Reject duplicate workflow transitions with a clear error (#62)
- Alert and record a lost recurring-ticket occurrence on creation failure (#88)
- Debounce the live markdown preview (#108)

.env.example

@@ -84,3 +84,9 @@ LDAP_BASE_DN="dc=example,dc=com"
 LDAP_USER_BASE="ou=people,dc=example,dc=com"
 ; How long to cache avatar images locally (seconds, default 3600)
 AVATAR_CACHE_TTL=3600
+
+; Session-based rate limits (requests per 60s window). These govern
+; browser/session traffic on general and API endpoints respectively;
+; Bearer-key API traffic is rate-limited separately, per API key.
+RATE_LIMIT_DEFAULT=100
+RATE_LIMIT_API=60

api/manage_workflows.php

@@ -97,13 +97,39 @@ try {
                 exit;
             }
 
+            $wf_active  = (int)($data['is_active'] ?? 1);
+
+            // status_transitions already has a DB-level UNIQUE KEY on
+            // (from_status, to_status) (regardless of is_active), so a
+            // duplicate pair can't actually be inserted — but hitting that
+            // constraint raw surfaces as an opaque "internal error occurred"
+            // to the admin instead of a clear message. Check first so the
+            // common case (an admin re-adding a pair that already exists)
+            // gets a friendly, specific error.
+            $dupCheck = $conn->prepare(
+                "SELECT transition_id FROM status_transitions WHERE from_status = ? AND to_status = ?"
+            );
+            $dupCheck->bind_param('ss', $data['from_status'], $data['to_status']);
+            $dupCheck->execute();
+            if ($dupCheck->get_result()->fetch_assoc()) {
+                $dupCheck->close();
+                http_response_code(409);
+                echo json_encode([
+                    'success' => false,
+                    'error' => 'A transition already exists for '
+                        . $data['from_status'] . ' → ' . $data['to_status']
+                        . ' — edit that row instead of creating a duplicate.',
+                ]);
+                exit;
+            }
+            $dupCheck->close();
+
             $stmt = $conn->prepare("INSERT INTO status_transitions (from_status, to_status, requires_comment, requires_admin, is_active)
                                     VALUES (?, ?, ?, ?, ?)");
             $wf_from    = $data['from_status'];
             $wf_to      = $data['to_status'];
             $wf_comment = (int)($data['requires_comment'] ?? 0);
             $wf_admin   = (int)($data['requires_admin'] ?? 0);
-            $wf_active  = (int)($data['is_active'] ?? 1);
             $stmt->bind_param('ssiii', $wf_from, $wf_to, $wf_comment, $wf_admin, $wf_active);
 
             if ($stmt->execute()) {
@@ -149,6 +175,28 @@ try {
                 exit;
             }
 
+            $wf_active  = (int)($data['is_active'] ?? 1);
+
+            // Same duplicate-pair guard as create, excluding this row itself.
+            $dupCheck = $conn->prepare(
+                "SELECT transition_id FROM status_transitions
+                 WHERE from_status = ? AND to_status = ? AND transition_id != ?"
+            );
+            $dupCheck->bind_param('ssi', $data['from_status'], $data['to_status'], $id);
+            $dupCheck->execute();
+            if ($dupCheck->get_result()->fetch_assoc()) {
+                $dupCheck->close();
+                http_response_code(409);
+                echo json_encode([
+                    'success' => false,
+                    'error' => 'A transition already exists for '
+                        . $data['from_status'] . ' → ' . $data['to_status']
+                        . ' — edit that row instead of creating a duplicate.',
+                ]);
+                exit;
+            }
+            $dupCheck->close();
+
             $stmt = $conn->prepare("UPDATE status_transitions SET
                                     from_status = ?, to_status = ?, requires_comment = ?, requires_admin = ?, is_active = ?
                                     WHERE transition_id = ?");
@@ -156,7 +204,6 @@ try {
             $wf_to      = $data['to_status'];
             $wf_comment = (int)($data['requires_comment'] ?? 0);
             $wf_admin   = (int)($data['requires_admin'] ?? 0);
-            $wf_active  = (int)($data['is_active'] ?? 1);
             $stmt->bind_param('ssiiii', $wf_from, $wf_to, $wf_comment, $wf_admin, $wf_active, $id);
 
             $success = $stmt->execute();

api/update_comment.php

@@ -104,7 +104,10 @@ try {
             'update',
             'comment',
             (string)$commentId,
-            ['comment_text_preview' => substr($commentText, 0, 100)]
+            [
+                'ticket_id' => $comment['ticket_id'] ?? null,
+                'comment_text_preview' => substr($commentText, 0, 100),
+            ]
         );
     }
 

assets/js/advanced-search.js

@@ -61,25 +61,46 @@ function populateCurrentFilters() {
     const urlParams = new URLSearchParams(window.location.search);
 
     // Search text
-    if (urlParams.has('search')) {
+    document.getElementById('adv-search-text').value = urlParams.get('search') || '';
-        document.getElementById('adv-search-text').value = urlParams.get('search');
-    }
 
     // Status
-    if (urlParams.has('status')) {
+    const statuses = urlParams.has('status') ? urlParams.get('status').split(',') : [];
-        const statuses = urlParams.get('status').split(',');
     const statusSelect = document.getElementById('adv-status');
     Array.from(statusSelect.options).forEach(option => {
         option.selected = statuses.includes(option.value);
     });
-    }
+
+    // Date ranges
+    document.getElementById('adv-created-from').value = urlParams.get('created_from') || '';
+    document.getElementById('adv-created-to').value = urlParams.get('created_to') || '';
+    document.getElementById('adv-updated-from').value = urlParams.get('updated_from') || '';
+    document.getElementById('adv-updated-to').value = urlParams.get('updated_to') || '';
+
+    // Priority range
+    document.getElementById('adv-priority-min').value = urlParams.get('priority_min') || '';
+    document.getElementById('adv-priority-max').value = urlParams.get('priority_max') || '';
+
+    // Users
+    document.getElementById('adv-created-by').value = urlParams.get('created_by') || '';
+    document.getElementById('adv-assigned-to').value = urlParams.get('assigned_to') || '';
 }
 
 // Perform advanced search
 function performAdvancedSearch(event) {
     event.preventDefault();
 
-    const params = new URLSearchParams();
+    // Start from the CURRENT URL's params, not a fresh set, so a filter this
+    // form doesn't represent (e.g. a category/type filter applied via a
+    // dashboard quick-filter pill or stats-widget click) isn't silently
+    // dropped on submit. Only the params this form actually controls are
+    // set/cleared below; everything else passes through untouched.
+    const params = new URLSearchParams(window.location.search);
+    const advParams = [
+        'search', 'created_from', 'created_to', 'updated_from', 'updated_to',
+        'status', 'priority_min', 'priority_max', 'created_by', 'assigned_to',
+    ];
+    advParams.forEach(key => params.delete(key));
+    params.delete('page'); // filters changed — reset to page 1
 
     // Search text
     const searchText = document.getElementById('adv-search-text').value.trim();

assets/js/ticket.js

@@ -357,12 +357,17 @@ function togglePreview() {
 
     if (isPreviewEnabled) {
         preview.innerHTML = parseMarkdown(textarea.value);
-        textarea.addEventListener('input', updatePreview);
+        textarea.addEventListener('input', debouncedUpdatePreview);
     } else {
-        textarea.removeEventListener('input', updatePreview);
+        textarea.removeEventListener('input', debouncedUpdatePreview);
     }
 }
 
+// Re-running the full markdown parser on every single keystroke is wasted
+// work while the user is still mid-word; 150ms debounce keeps the preview
+// feeling live without re-parsing on every keystroke.
+const debouncedUpdatePreview = window.lt ? lt.debounce(updatePreview, 150) : updatePreview;
+
 function updatePreview() {
     const textarea = document.getElementById('newComment');
     const previewDiv = document.getElementById('markdownPreview');

config/config.php

@@ -141,9 +141,9 @@ $GLOBALS['config'] = [
     ],
     'UPLOAD_DIR' => __DIR__ . '/../uploads',
 
-    // Rate limiting
+    // Rate limiting (requests per minute; read by RateLimitMiddleware)
-    'RATE_LIMIT_DEFAULT' => 100, // Requests per minute for general
+    'RATE_LIMIT_DEFAULT' => (int)($envVars['RATE_LIMIT_DEFAULT'] ?? 100), // Session-based, general endpoints
-    'RATE_LIMIT_API' => 60, // Requests per minute for API
+    'RATE_LIMIT_API' => (int)($envVars['RATE_LIMIT_API'] ?? 60),          // Session-based, API endpoints
 
     // Audit log settings
     'AUDIT_LOG_RETENTION_DAYS' => 90,

cron/create_recurring_tickets.php

@@ -29,6 +29,38 @@ function logMessage($message)
     echo "[" . date('Y-m-d H:i:s') . "] " . $message . "\n";
 }
 
+/**
+ * Record a recurring-ticket occurrence that was claimed (next_run_at already
+ * advanced to the next future run) but then failed to actually produce a
+ * ticket. That claim-then-fail ordering is deliberate — it stops a failing
+ * creation from re-firing and flooding duplicates on every subsequent cron
+ * tick — but means this specific occurrence has no other record anywhere an
+ * admin would normally look: no audit_log entry (nothing was created), no
+ * Matrix "ticket created" alert, no failure table. Without this, it's simply
+ * gone, silently, forever.
+ */
+function recordMissedOccurrence($auditLog, $recurring, $reason)
+{
+    $auditLog->log(
+        $recurring['created_by'],
+        'error',
+        'recurring_ticket',
+        (string)$recurring['recurring_id'],
+        [
+            'reason' => $reason,
+            'title_template' => $recurring['title_template'],
+            'schedule_type' => $recurring['schedule_type'],
+        ]
+    );
+
+    NotificationHelper::sendSystemAlert(
+        "Recurring ticket occurrence lost: schedule #{$recurring['recurring_id']} "
+            . "(\"{$recurring['title_template']}\") was claimed for this run but ticket "
+            . "creation failed, so this occurrence will not be created or retried.",
+        ['reason' => $reason, 'recurring_id' => $recurring['recurring_id']]
+    );
+}
+
 logMessage("Starting recurring tickets cron job");
 
 try {
@@ -100,11 +132,17 @@ try {
 
                 $created++;
             } else {
-                logMessage("ERROR: Failed to create ticket - " . ($result['error'] ?? 'Unknown error'));
+                $reason = $result['error'] ?? 'Unknown error';
+                logMessage("ERROR: Failed to create ticket - " . $reason);
+                recordMissedOccurrence($auditLog, $recurring, $reason);
                 $errors++;
             }
         } catch (Exception $e) {
             logMessage("ERROR: Exception processing recurring ticket - " . $e->getMessage());
+            // claimForRun() already advanced next_run_at before this point, so
+            // this occurrence is permanently gone unless recorded somewhere an
+            // admin would actually look — a cron log line alone doesn't count.
+            recordMissedOccurrence($auditLog, $recurring, $e->getMessage());
             $errors++;
         }
     }

helpers/NotificationHelper.php

@@ -20,6 +20,12 @@ class NotificationHelper
         curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));
         curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
         curl_setopt($ch, CURLOPT_TIMEOUT, 10);
+        // A slow-but-not-fully-hung hookshot endpoint could otherwise add up
+        // to the full CURLOPT_TIMEOUT per fire() call, and a single request
+        // can call fire() (via notifyWatchers/sendCommentNotification/etc.)
+        // more than once sequentially — capping just the connect phase keeps
+        // that from stacking into tens of seconds of added latency.
+        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 3);
 
         $response  = curl_exec($ch);
         $httpCode  = curl_getinfo($ch, CURLINFO_HTTP_CODE);
@@ -53,6 +59,23 @@ class NotificationHelper
 
     // ─── Public event methods ─────────────────────────────────────────────────
 
+    /**
+     * Generic operational alert with no associated ticket (e.g. a recurring
+     * schedule whose ticket creation failed after its next_run_at was
+     * already advanced, so the missed occurrence has no other record an
+     * admin would normally see). Always sent to the shared
+     * MATRIX_NOTIFY_USERS list, regardless of any per-event notify toggle.
+     */
+    public static function sendSystemAlert(string $message, array $context = []): void
+    {
+        self::fire(array_merge([
+            'event'   => 'system_alert',
+            'message' => $message,
+        ], $context, [
+            'notify_users' => self::notifyUsers(),
+        ]));
+    }
+
     /**
      * New ticket created (manual or automated/API).
      *

middleware/RateLimitMiddleware.php

@@ -3,21 +3,34 @@
 /**
  * Rate Limiting Middleware
  *
- * Implements both session-based and IP-based rate limiting to prevent abuse.
+ * Implements session-based, IP-based, and (for Bearer-authenticated
- * IP-based limiting prevents attackers from bypassing limits by creating new sessions.
+ * requests) API-key-based rate limiting to prevent abuse.
+ * IP-based limiting prevents attackers from bypassing limits by creating new
+ * sessions; API-key-based limiting keeps distinct Bearer clients from
+ * starving each other's shared IP bucket.
  */
 class RateLimitMiddleware
 {
-    // Default limits
+    // Fallback limits, used only if $GLOBALS['config'] isn't populated
+    // (e.g. very early in bootstrap, or a test harness). Normal requests read
+    // RATE_LIMIT_DEFAULT/RATE_LIMIT_API from config (backed by .env).
     public const DEFAULT_LIMIT = 100;      // requests per window (session)
     public const API_LIMIT = 60;           // API requests per window (session)
     public const IP_LIMIT = 300;           // IP-based requests per window (more generous)
     public const IP_API_LIMIT = 120;       // IP-based API requests per window
+    public const API_KEY_LIMIT = 120;      // Per-Bearer-token requests per window
     public const WINDOW_SECONDS = 60;      // 1 minute window
 
     // Directory for IP rate limit storage
     private static ?string $rateLimitDir = null;
 
+    private static function sessionLimit(string $type): int
+    {
+        $configKey = $type === 'api' ? 'RATE_LIMIT_API' : 'RATE_LIMIT_DEFAULT';
+        $fallback = $type === 'api' ? self::API_LIMIT : self::DEFAULT_LIMIT;
+        return (int)($GLOBALS['config'][$configKey] ?? $fallback);
+    }
+
     /**
      * Get the rate limit storage directory
      *
@@ -69,24 +82,47 @@ class RateLimitMiddleware
     }
 
     /**
-     * Check IP-based rate limit
+     * Extract the raw Bearer token from the Authorization header, if present.
+     * Deliberately independent of ApiKeyAuth: rate limiting must be cheap and
+     * must not require a DB round-trip to validate the key before counting
+     * the request, and needs to run whether or not the token turns out to be
+     * valid. The raw token string (not the validated api_key_id) is hashed as
+     * the bucket identifier — good enough to isolate distinct keys/clients
+     * from each other without needing to authenticate first.
      *
-     * @param string $type 'default' or 'api'
+     * @return string|null
-     * @return bool True if request is allowed, false if rate limited
      */
-    private static function checkIpRateLimit(string $type = 'default'): bool
+    private static function getBearerToken(): ?string
     {
-        $ip = self::getClientIp();
+        $header = $_SERVER['HTTP_AUTHORIZATION']
-        $limit = $type === 'api' ? self::IP_API_LIMIT : self::IP_LIMIT;
+            ?? $_SERVER['REDIRECT_HTTP_AUTHORIZATION']
-        $now = time();
+            ?? null;
+        if ($header === null && function_exists('getallheaders')) {
+            $headers = getallheaders();
+            $header = $headers['Authorization'] ?? null;
+        }
+        if ($header && preg_match('/^Bearer\s+(.+)$/i', $header, $m)) {
+            return $m[1];
+        }
+        return null;
+    }
 
-        // Create a hash of the IP for the filename (security + filesystem safety)
+    /**
-        $ipHash = hash('sha256', $ip . '_' . $type);
+     * Generic file-based sliding-window counter, shared by the IP-based and
-        $filePath = self::getRateLimitDir() . '/' . $ipHash . '.json';
+     * API-key-based buckets below.
+     *
+     * @param string $bucketKey Stable identifier for this bucket (already hashed)
+     * @param int    $limit     Max requests allowed per window
+     * @return bool True if this request is within the limit
+     */
+    private static function checkCounter(string $bucketKey, int $limit): bool
+    {
+        $now = time();
+        $filePath = self::getRateLimitDir() . '/' . $bucketKey . '.json';
 
         // Hold an exclusive lock across the whole read-modify-write so concurrent
-        // requests from the same IP can't both read the same count and each write
+        // requests from the same bucket can't both read the same count and each
-        // count+1 (which would undercount and let the limit be exceeded).
+        // write count+1 (which would undercount and let the limit be exceeded).
         $fh = @fopen($filePath, 'c+');
         if ($fh === false) {
             // Can't open the counter file — fail open (don't block legitimate traffic).
@@ -122,10 +158,60 @@ class RateLimitMiddleware
         flock($fh, LOCK_UN);
         fclose($fh);
 
-        // Check if over limit
         return $rateData['count'] <= $limit;
     }
 
+    /**
+     * Read (without incrementing) the current state of a counter bucket, for
+     * status/header reporting.
+     */
+    private static function peekCounter(string $bucketKey, int $limit): array
+    {
+        $now = time();
+        $filePath = self::getRateLimitDir() . '/' . $bucketKey . '.json';
+
+        $rateData = null;
+        $content = @file_get_contents($filePath);
+        if ($content !== false && $content !== '') {
+            $decoded = json_decode($content, true);
+            if (is_array($decoded)) {
+                $rateData = $decoded;
+            }
+        }
+
+        if ($rateData === null || $now - ($rateData['window_start'] ?? $now) >= self::WINDOW_SECONDS) {
+            return ['limit' => $limit, 'remaining' => $limit, 'reset' => $now + self::WINDOW_SECONDS];
+        }
+
+        return [
+            'limit' => $limit,
+            'remaining' => max(0, $limit - $rateData['count']),
+            'reset' => $rateData['window_start'] + self::WINDOW_SECONDS,
+        ];
+    }
+
+    private static function ipBucketKey(string $type): string
+    {
+        return hash('sha256', self::getClientIp() . '_' . $type);
+    }
+
+    private static function apiKeyBucketKey(string $token): string
+    {
+        return hash('sha256', 'apikey_' . $token);
+    }
+
+    /**
+     * Check IP-based rate limit
+     *
+     * @param string $type 'default' or 'api'
+     * @return bool True if request is allowed, false if rate limited
+     */
+    private static function checkIpRateLimit(string $type = 'default'): bool
+    {
+        $limit = $type === 'api' ? self::IP_API_LIMIT : self::IP_LIMIT;
+        return self::checkCounter(self::ipBucketKey($type), $limit);
+    }
+
     /**
      * Clean up old rate limit files (call periodically)
      *
@@ -185,7 +271,14 @@ class RateLimitMiddleware
     }
 
     /**
-     * Check rate limit for current request (both session and IP)
+     * Check rate limit for current request.
+     *
+     * Bearer-authenticated requests (Authorization: Bearer ...) are limited
+     * by a per-token bucket instead of a session — a stateless API client
+     * never sends a session cookie back, so the session-based counter never
+     * accumulates and starting a session for it is pure overhead. The
+     * IP-based bucket still applies underneath as defense-in-depth against
+     * volumetric abuse from one network path.
      *
      * @param string $type 'default' or 'api'
      * @return bool True if request is allowed, false if rate limited
@@ -197,12 +290,17 @@ class RateLimitMiddleware
             return false;
         }
 
+        $token = self::getBearerToken();
+        if ($token !== null) {
+            return self::checkCounter(self::apiKeyBucketKey($token), self::API_KEY_LIMIT);
+        }
+
         // Then check session-based rate limit
         if (session_status() === PHP_SESSION_NONE) {
             session_start();
         }
 
-        $limit = $type === 'api' ? self::API_LIMIT : self::DEFAULT_LIMIT;
+        $limit = self::sessionLimit($type);
         $key = 'rate_limit_' . $type;
         $now = time();
 
@@ -270,18 +368,28 @@ class RateLimitMiddleware
     }
 
     /**
-     * Get current rate limit status
+     * Get current rate limit status.
+     *
+     * For a Bearer-authenticated request, reports the per-API-key bucket
+     * (the one that actually governs it) rather than the session-based
+     * counter, which is meaningless for a client that never sends a session
+     * cookie back.
      *
      * @param string $type 'default' or 'api'
      * @return array Rate limit status
      */
     public static function getStatus(string $type = 'default'): array
     {
+        $token = self::getBearerToken();
+        if ($token !== null) {
+            return self::peekCounter(self::apiKeyBucketKey($token), self::API_KEY_LIMIT);
+        }
+
         if (session_status() === PHP_SESSION_NONE) {
             session_start();
         }
 
-        $limit = $type === 'api' ? self::API_LIMIT : self::DEFAULT_LIMIT;
+        $limit = self::sessionLimit($type);
         $key = 'rate_limit_' . $type;
         $now = time();
 

models/WorkflowModel.php

@@ -31,9 +31,15 @@ class WorkflowModel
             return $cached;
         }
 
+        // ORDER BY makes which row wins deterministic (most recently created,
+        // by transition_id) in the pathological case where two active rows
+        // exist for the same (from_status, to_status) pair — manage_workflows.php
+        // now rejects creating that duplicate going forward, but this is a
+        // defense-in-depth backstop against any duplicate already in the DB.
         $sql = "SELECT from_status, to_status, requires_comment, requires_admin
                 FROM status_transitions
-                WHERE is_active = TRUE";
+                WHERE is_active = TRUE
+                ORDER BY transition_id ASC";
         $result = $this->conn->query($sql);
 
         if (!$result) {