jaredandClaude Sonnet 5
60bafae8a0
sendAssignmentNotification() had the same missing-visibility gap as #46 in a separate function: assigning a user to a confidential/internal ticket broadcast the ticket title to the shared Matrix notify list unconditionally when MATRIX_NOTIFY_ASSIGNMENTS is enabled. Threaded visibility through using the same redactedTitle() helper added for #46, wired up from the already-fetched ticket row in assign_ticket.php. The assignee is still DMed directly regardless, since being assigned gives them standing access to the ticket — but because notify_users is one shared payload, they see the same redacted title as everyone else on it rather than a personalized one. Verified end-to-end with a local HTTP server capturing the webhook payload for both public and confidential tickets. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nCxwFFsy8ouMWzn56rPVP
94 lines
3.4 KiB
PHP
94 lines
3.4 KiB
PHP
<?php
|
|
|
|
require_once __DIR__ . '/bootstrap.php';
|
|
require_once dirname(__DIR__) . '/models/TicketModel.php';
|
|
require_once dirname(__DIR__) . '/models/AuditLogModel.php';
|
|
require_once dirname(__DIR__) . '/models/UserModel.php';
|
|
require_once dirname(__DIR__) . '/helpers/NotificationHelper.php';
|
|
require_once dirname(__DIR__) . '/helpers/SynapseHelper.php';
|
|
|
|
// Get request data
|
|
$data = json_decode(file_get_contents('php://input'), true);
|
|
if (!is_array($data)) {
|
|
http_response_code(400);
|
|
echo json_encode(['success' => false, 'error' => 'Invalid JSON body']);
|
|
exit;
|
|
}
|
|
|
|
$ticketIdRaw = isset($data['ticket_id']) ? trim((string)$data['ticket_id']) : '';
|
|
$assignedTo = $data['assigned_to'] ?? null;
|
|
|
|
if (!ctype_digit($ticketIdRaw) || (int)$ticketIdRaw <= 0) {
|
|
http_response_code(400);
|
|
echo json_encode(['success' => false, 'error' => 'Ticket ID required']);
|
|
exit;
|
|
}
|
|
$ticketId = $ticketIdRaw;
|
|
|
|
$ticketModel = new TicketModel($conn);
|
|
$auditLogModel = new AuditLogModel($conn);
|
|
$userModel = new UserModel($conn);
|
|
|
|
// Verify ticket exists and user can access it
|
|
$ticket = $ticketModel->getTicketById($ticketId);
|
|
if (!$ticket || !$ticketModel->canUserAccessTicket($ticket, $currentUser)) {
|
|
http_response_code(404);
|
|
echo json_encode(['success' => false, 'error' => 'Ticket not found']);
|
|
exit;
|
|
}
|
|
|
|
// Authorization: only admins or the ticket creator/assignee can reassign
|
|
if (!$isAdmin && (int)$ticket['created_by'] !== (int)$userId && (int)$ticket['assigned_to'] !== (int)$userId) {
|
|
http_response_code(403);
|
|
echo json_encode(['success' => false, 'error' => 'Permission denied']);
|
|
exit;
|
|
}
|
|
|
|
if ($assignedTo === null || $assignedTo === '') {
|
|
// Unassign ticket
|
|
$success = $ticketModel->unassignTicket($ticketId, $userId);
|
|
if ($success) {
|
|
$auditLogModel->log($userId, 'unassign', 'ticket', $ticketId);
|
|
}
|
|
} else {
|
|
// Validate assigned_to is a valid user ID
|
|
$assignedTo = (int)$assignedTo;
|
|
$targetUser = $userModel->getUserById($assignedTo);
|
|
if (!$targetUser) {
|
|
http_response_code(400);
|
|
echo json_encode(['success' => false, 'error' => 'Invalid user ID']);
|
|
exit;
|
|
}
|
|
|
|
// Assign ticket
|
|
$success = $ticketModel->assignTicket($ticketId, $assignedTo, $userId);
|
|
if ($success) {
|
|
$auditLogModel->log($userId, 'assign', 'ticket', $ticketId, ['assigned_to' => $assignedTo]);
|
|
|
|
if (!empty($GLOBALS['config']['MATRIX_NOTIFY_ASSIGNMENTS'])) {
|
|
$changedByDisplay = $currentUser['display_name'] ?? $currentUser['username'] ?? null;
|
|
$assigneeName = $targetUser['display_name'] ?? $targetUser['username'] ?? null;
|
|
$assigneeMatrix = isset($targetUser['username'])
|
|
? SynapseHelper::resolveUsername($targetUser['username'])
|
|
: null;
|
|
NotificationHelper::sendAssignmentNotification(
|
|
$ticketId,
|
|
$ticket['title'] ?? "Ticket #{$ticketId}",
|
|
$assigneeName,
|
|
$assigneeMatrix,
|
|
$changedByDisplay,
|
|
$ticket['visibility'] ?? 'public'
|
|
);
|
|
}
|
|
}
|
|
}
|
|
|
|
if (!$success) {
|
|
http_response_code(500);
|
|
apiRespond(['success' => false, 'error' => 'Failed to update ticket assignment']);
|
|
} else {
|
|
require_once dirname(__DIR__) . '/models/StatsModel.php';
|
|
(new StatsModel($conn))->invalidateCache();
|
|
apiRespond(['success' => true]);
|
|
}
|