Jared Vititoe
7575d6a277
- Consolidate all 20 API files to use centralized Database helper - Add optimistic locking to ticket updates to prevent concurrent conflicts - Add caching to StatsModel (60s TTL) for dashboard performance - Add health check endpoint (api/health.php) for monitoring - Improve rate limit cleanup with cron script and efficient DirectoryIterator - Enable rate limit response headers (X-RateLimit-*) - Add audit logging for workflow transitions - Log Discord webhook failures instead of silencing - Fix visibility check on export_tickets.php - Add database migration system with performance indexes - Fix cron recurring tickets to use assignTicket method Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
122 lines
3.7 KiB
PHP
122 lines
3.7 KiB
PHP
<?php
|
|
// Apply rate limiting
|
|
require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
|
|
RateLimitMiddleware::apply('api');
|
|
|
|
session_start();
|
|
require_once dirname(__DIR__) . '/config/config.php';
|
|
require_once dirname(__DIR__) . '/helpers/Database.php';
|
|
require_once dirname(__DIR__) . '/models/BulkOperationsModel.php';
|
|
require_once dirname(__DIR__) . '/models/TicketModel.php';
|
|
require_once dirname(__DIR__) . '/models/AuditLogModel.php';
|
|
|
|
header('Content-Type: application/json');
|
|
|
|
// Check authentication
|
|
if (!isset($_SESSION['user']) || !isset($_SESSION['user']['user_id'])) {
|
|
echo json_encode(['success' => false, 'error' => 'Not authenticated']);
|
|
exit;
|
|
}
|
|
|
|
// CSRF Protection
|
|
require_once dirname(__DIR__) . '/middleware/CsrfMiddleware.php';
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
|
$csrfToken = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
|
|
if (!CsrfMiddleware::validateToken($csrfToken)) {
|
|
http_response_code(403);
|
|
echo json_encode(['success' => false, 'error' => 'Invalid CSRF token']);
|
|
exit;
|
|
}
|
|
}
|
|
|
|
// Check admin status - bulk operations are admin-only
|
|
$isAdmin = $_SESSION['user']['is_admin'] ?? false;
|
|
if (!$isAdmin) {
|
|
echo json_encode(['success' => false, 'error' => 'Admin access required']);
|
|
exit;
|
|
}
|
|
|
|
// Get request data
|
|
$data = json_decode(file_get_contents('php://input'), true);
|
|
$operationType = $data['operation_type'] ?? null;
|
|
$ticketIds = $data['ticket_ids'] ?? [];
|
|
$parameters = $data['parameters'] ?? null;
|
|
|
|
// Validate input
|
|
if (!$operationType || empty($ticketIds)) {
|
|
echo json_encode(['success' => false, 'error' => 'Operation type and ticket IDs required']);
|
|
exit;
|
|
}
|
|
|
|
// Validate ticket IDs are integers
|
|
foreach ($ticketIds as $ticketId) {
|
|
if (!is_numeric($ticketId)) {
|
|
echo json_encode(['success' => false, 'error' => 'Invalid ticket ID format']);
|
|
exit;
|
|
}
|
|
}
|
|
|
|
// Use centralized database connection
|
|
$conn = Database::getConnection();
|
|
|
|
$bulkOpsModel = new BulkOperationsModel($conn);
|
|
$ticketModel = new TicketModel($conn);
|
|
|
|
// Verify user can access all tickets in the bulk operation
|
|
// (Admins can access all, but this is defense-in-depth)
|
|
$accessibleTicketIds = [];
|
|
$inaccessibleCount = 0;
|
|
$tickets = $ticketModel->getTicketsByIds($ticketIds);
|
|
|
|
foreach ($ticketIds as $ticketId) {
|
|
$ticketId = trim($ticketId);
|
|
$ticket = $tickets[$ticketId] ?? null;
|
|
|
|
if ($ticket && $ticketModel->canUserAccessTicket($ticket, $_SESSION['user'])) {
|
|
$accessibleTicketIds[] = $ticketId;
|
|
} else {
|
|
$inaccessibleCount++;
|
|
}
|
|
}
|
|
|
|
if (empty($accessibleTicketIds)) {
|
|
echo json_encode(['success' => false, 'error' => 'No accessible tickets in selection']);
|
|
exit;
|
|
}
|
|
|
|
// Use only accessible ticket IDs
|
|
$ticketIds = $accessibleTicketIds;
|
|
|
|
// Create bulk operation record
|
|
$operationId = $bulkOpsModel->createBulkOperation($operationType, $ticketIds, $_SESSION['user']['user_id'], $parameters);
|
|
|
|
if (!$operationId) {
|
|
echo json_encode(['success' => false, 'error' => 'Failed to create bulk operation']);
|
|
exit;
|
|
}
|
|
|
|
// Process the bulk operation
|
|
$result = $bulkOpsModel->processBulkOperation($operationId);
|
|
|
|
$conn->close();
|
|
|
|
if (isset($result['error'])) {
|
|
echo json_encode([
|
|
'success' => false,
|
|
'error' => $result['error']
|
|
]);
|
|
} else {
|
|
$message = "Bulk operation completed: {$result['processed']} succeeded, {$result['failed']} failed";
|
|
if ($inaccessibleCount > 0) {
|
|
$message .= " ($inaccessibleCount skipped - no access)";
|
|
}
|
|
echo json_encode([
|
|
'success' => true,
|
|
'operation_id' => $operationId,
|
|
'processed' => $result['processed'],
|
|
'failed' => $result['failed'],
|
|
'skipped' => $inaccessibleCount,
|
|
'message' => $message
|
|
]);
|
|
}
|