jaredandClaude Sonnet 5
86ef91abcb
status_transitions already has a DB-level UNIQUE KEY on (from_status, to_status), so a genuine duplicate pair was never actually possible to insert — but hitting that constraint raw surfaced as an opaque "An internal error occurred" to the admin instead of a clear message, since manage_workflows.php only validated from_status !== to_status before attempting the insert/update. Added an explicit existence check before insert/update in both the POST and PUT handlers (excluding the row's own ID on update), so the common case — an admin re-adding or renaming into a pair that already exists — gets a specific 409 with the conflicting pair named, instead of a generic 500. Also added ORDER BY transition_id to WorkflowModel::getAllTransitions() as a defense-in-depth backstop: since it collapses rows into a PHP array keyed by [from_status][to_status] with no defined winner otherwise, if the DB constraint were ever weakened or bypassed, this at least makes which row wins deterministic (most recently created). Verified against a real running server + real MariaDB: creating a duplicate active pair, a duplicate inactive pair, and updating a different row into an existing pair are all correctly rejected with the friendly message; updating a row to keep its own existing pair succeeds; and a genuinely different pair still creates normally. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Lhz7pGMaoTfL5sdYS5XiKv
264 lines
11 KiB
PHP
264 lines
11 KiB
PHP
<?php
|
|
|
|
/**
|
|
* Workflow/Status Transitions Management API
|
|
* CRUD operations for status_transitions table
|
|
*/
|
|
|
|
require_once dirname(__DIR__) . '/helpers/ErrorHandler.php';
|
|
ErrorHandler::init();
|
|
|
|
require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
|
|
require_once dirname(__DIR__) . '/models/WorkflowModel.php';
|
|
RateLimitMiddleware::apply('api');
|
|
|
|
try {
|
|
require_once dirname(__DIR__) . '/config/config.php';
|
|
require_once dirname(__DIR__) . '/helpers/Database.php';
|
|
require_once dirname(__DIR__) . '/models/AuditLogModel.php';
|
|
|
|
// Check authentication
|
|
if (session_status() === PHP_SESSION_NONE) {
|
|
session_start();
|
|
}
|
|
if (!isset($_SESSION['user']) || !isset($_SESSION['user']['user_id'])) {
|
|
http_response_code(401);
|
|
echo json_encode(['success' => false, 'error' => 'Authentication required']);
|
|
exit;
|
|
}
|
|
|
|
// Check admin privileges
|
|
if (!$_SESSION['user']['is_admin']) {
|
|
http_response_code(403);
|
|
echo json_encode(['success' => false, 'error' => 'Admin privileges required']);
|
|
exit;
|
|
}
|
|
|
|
// CSRF Protection for write operations
|
|
if ($_SERVER['REQUEST_METHOD'] !== 'GET') {
|
|
require_once dirname(__DIR__) . '/middleware/CsrfMiddleware.php';
|
|
$csrfToken = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
|
|
if (!CsrfMiddleware::validateToken($csrfToken)) {
|
|
http_response_code(403);
|
|
echo json_encode(['success' => false, 'error' => 'Invalid CSRF token', 'csrf_token' => CsrfMiddleware::getToken()]);
|
|
exit;
|
|
}
|
|
}
|
|
|
|
// Use centralized database connection
|
|
$conn = Database::getConnection();
|
|
|
|
// Initialize audit log
|
|
$auditLog = new AuditLogModel($conn);
|
|
$userId = $_SESSION['user']['user_id'];
|
|
|
|
header('Content-Type: application/json');
|
|
|
|
$method = $_SERVER['REQUEST_METHOD'];
|
|
$id = isset($_GET['id']) ? (int)$_GET['id'] : null;
|
|
|
|
switch ($method) {
|
|
case 'GET':
|
|
if ($id) {
|
|
// Get single transition
|
|
$stmt = $conn->prepare("SELECT * FROM status_transitions WHERE transition_id = ?");
|
|
$stmt->bind_param('i', $id);
|
|
$stmt->execute();
|
|
$result = $stmt->get_result();
|
|
$transition = $result->fetch_assoc();
|
|
$stmt->close();
|
|
echo json_encode(['success' => true, 'transition' => $transition]);
|
|
} else {
|
|
// Get all transitions
|
|
$result = $conn->query("SELECT * FROM status_transitions ORDER BY from_status, to_status");
|
|
$transitions = [];
|
|
while ($row = $result->fetch_assoc()) {
|
|
$transitions[] = $row;
|
|
}
|
|
echo json_encode(['success' => true, 'transitions' => $transitions]);
|
|
}
|
|
break;
|
|
|
|
case 'POST':
|
|
$data = json_decode(file_get_contents('php://input'), true);
|
|
|
|
$wfValid = $GLOBALS['config']['TICKET_STATUSES'] ?? ['Open', 'Pending', 'In Progress', 'Closed'];
|
|
if (
|
|
!in_array($data['from_status'] ?? '', $wfValid, true)
|
|
|| !in_array($data['to_status'] ?? '', $wfValid, true)
|
|
) {
|
|
http_response_code(400);
|
|
echo json_encode(['success' => false, 'error' => 'from_status and to_status must be valid ticket statuses']);
|
|
exit;
|
|
}
|
|
if (($data['from_status'] ?? '') === ($data['to_status'] ?? '')) {
|
|
http_response_code(400);
|
|
echo json_encode(['success' => false, 'error' => 'From Status and To Status cannot be the same']);
|
|
exit;
|
|
}
|
|
|
|
$wf_active = (int)($data['is_active'] ?? 1);
|
|
|
|
// status_transitions already has a DB-level UNIQUE KEY on
|
|
// (from_status, to_status) (regardless of is_active), so a
|
|
// duplicate pair can't actually be inserted — but hitting that
|
|
// constraint raw surfaces as an opaque "internal error occurred"
|
|
// to the admin instead of a clear message. Check first so the
|
|
// common case (an admin re-adding a pair that already exists)
|
|
// gets a friendly, specific error.
|
|
$dupCheck = $conn->prepare(
|
|
"SELECT transition_id FROM status_transitions WHERE from_status = ? AND to_status = ?"
|
|
);
|
|
$dupCheck->bind_param('ss', $data['from_status'], $data['to_status']);
|
|
$dupCheck->execute();
|
|
if ($dupCheck->get_result()->fetch_assoc()) {
|
|
$dupCheck->close();
|
|
http_response_code(409);
|
|
echo json_encode([
|
|
'success' => false,
|
|
'error' => 'A transition already exists for '
|
|
. $data['from_status'] . ' → ' . $data['to_status']
|
|
. ' — edit that row instead of creating a duplicate.',
|
|
]);
|
|
exit;
|
|
}
|
|
$dupCheck->close();
|
|
|
|
$stmt = $conn->prepare("INSERT INTO status_transitions (from_status, to_status, requires_comment, requires_admin, is_active)
|
|
VALUES (?, ?, ?, ?, ?)");
|
|
$wf_from = $data['from_status'];
|
|
$wf_to = $data['to_status'];
|
|
$wf_comment = (int)($data['requires_comment'] ?? 0);
|
|
$wf_admin = (int)($data['requires_admin'] ?? 0);
|
|
$stmt->bind_param('ssiii', $wf_from, $wf_to, $wf_comment, $wf_admin, $wf_active);
|
|
|
|
if ($stmt->execute()) {
|
|
$transitionId = $conn->insert_id;
|
|
WorkflowModel::clearCache(); // Clear workflow cache
|
|
|
|
// Audit log: workflow transition created
|
|
$auditLog->log($userId, 'create', 'workflow_transition', (string)$transitionId, [
|
|
'from_status' => $data['from_status'],
|
|
'to_status' => $data['to_status'],
|
|
'requires_comment' => $data['requires_comment'] ?? 0,
|
|
'requires_admin' => $data['requires_admin'] ?? 0
|
|
]);
|
|
|
|
echo json_encode(['success' => true, 'transition_id' => $transitionId]);
|
|
} else {
|
|
error_log("Workflow creation failed: " . $stmt->error);
|
|
echo json_encode(['success' => false, 'error' => 'Failed to create workflow transition']);
|
|
}
|
|
$stmt->close();
|
|
break;
|
|
|
|
case 'PUT':
|
|
if (!$id) {
|
|
echo json_encode(['success' => false, 'error' => 'ID required']);
|
|
exit;
|
|
}
|
|
|
|
$data = json_decode(file_get_contents('php://input'), true);
|
|
|
|
$wfValid = $GLOBALS['config']['TICKET_STATUSES'] ?? ['Open', 'Pending', 'In Progress', 'Closed'];
|
|
if (
|
|
!in_array($data['from_status'] ?? '', $wfValid, true)
|
|
|| !in_array($data['to_status'] ?? '', $wfValid, true)
|
|
) {
|
|
http_response_code(400);
|
|
echo json_encode(['success' => false, 'error' => 'from_status and to_status must be valid ticket statuses']);
|
|
exit;
|
|
}
|
|
if (($data['from_status'] ?? '') === ($data['to_status'] ?? '')) {
|
|
http_response_code(400);
|
|
echo json_encode(['success' => false, 'error' => 'From Status and To Status cannot be the same']);
|
|
exit;
|
|
}
|
|
|
|
$wf_active = (int)($data['is_active'] ?? 1);
|
|
|
|
// Same duplicate-pair guard as create, excluding this row itself.
|
|
$dupCheck = $conn->prepare(
|
|
"SELECT transition_id FROM status_transitions
|
|
WHERE from_status = ? AND to_status = ? AND transition_id != ?"
|
|
);
|
|
$dupCheck->bind_param('ssi', $data['from_status'], $data['to_status'], $id);
|
|
$dupCheck->execute();
|
|
if ($dupCheck->get_result()->fetch_assoc()) {
|
|
$dupCheck->close();
|
|
http_response_code(409);
|
|
echo json_encode([
|
|
'success' => false,
|
|
'error' => 'A transition already exists for '
|
|
. $data['from_status'] . ' → ' . $data['to_status']
|
|
. ' — edit that row instead of creating a duplicate.',
|
|
]);
|
|
exit;
|
|
}
|
|
$dupCheck->close();
|
|
|
|
$stmt = $conn->prepare("UPDATE status_transitions SET
|
|
from_status = ?, to_status = ?, requires_comment = ?, requires_admin = ?, is_active = ?
|
|
WHERE transition_id = ?");
|
|
$wf_from = $data['from_status'];
|
|
$wf_to = $data['to_status'];
|
|
$wf_comment = (int)($data['requires_comment'] ?? 0);
|
|
$wf_admin = (int)($data['requires_admin'] ?? 0);
|
|
$stmt->bind_param('ssiiii', $wf_from, $wf_to, $wf_comment, $wf_admin, $wf_active, $id);
|
|
|
|
$success = $stmt->execute();
|
|
if ($success) {
|
|
WorkflowModel::clearCache(); // Clear workflow cache
|
|
|
|
// Audit log: workflow transition updated
|
|
$auditLog->log($userId, 'update', 'workflow_transition', (string)$id, [
|
|
'from_status' => $data['from_status'],
|
|
'to_status' => $data['to_status'],
|
|
'requires_comment' => $data['requires_comment'] ?? 0,
|
|
'requires_admin' => $data['requires_admin'] ?? 0
|
|
]);
|
|
}
|
|
echo json_encode(['success' => $success]);
|
|
$stmt->close();
|
|
break;
|
|
|
|
case 'DELETE':
|
|
if (!$id) {
|
|
echo json_encode(['success' => false, 'error' => 'ID required']);
|
|
exit;
|
|
}
|
|
|
|
// Get transition details before deletion for audit log
|
|
$getStmt = $conn->prepare("SELECT from_status, to_status FROM status_transitions WHERE transition_id = ?");
|
|
$getStmt->bind_param('i', $id);
|
|
$getStmt->execute();
|
|
$getResult = $getStmt->get_result();
|
|
$transitionData = $getResult->fetch_assoc();
|
|
$getStmt->close();
|
|
|
|
$stmt = $conn->prepare("DELETE FROM status_transitions WHERE transition_id = ?");
|
|
$stmt->bind_param('i', $id);
|
|
$success = $stmt->execute();
|
|
if ($success) {
|
|
WorkflowModel::clearCache(); // Clear workflow cache
|
|
|
|
// Audit log: workflow transition deleted
|
|
$auditLog->log($userId, 'delete', 'workflow_transition', (string)$id, [
|
|
'from_status' => $transitionData['from_status'] ?? 'unknown',
|
|
'to_status' => $transitionData['to_status'] ?? 'unknown'
|
|
]);
|
|
}
|
|
echo json_encode(['success' => $success]);
|
|
$stmt->close();
|
|
break;
|
|
|
|
default:
|
|
http_response_code(405);
|
|
echo json_encode(['success' => false, 'error' => 'Method not allowed']);
|
|
}
|
|
} catch (Exception $e) {
|
|
error_log("Workflow API error: " . $e->getMessage());
|
|
http_response_code(500);
|
|
echo json_encode(['success' => false, 'error' => 'An internal error occurred']);
|
|
}
|