Jared Vititoe
7575d6a277
- Consolidate all 20 API files to use centralized Database helper - Add optimistic locking to ticket updates to prevent concurrent conflicts - Add caching to StatsModel (60s TTL) for dashboard performance - Add health check endpoint (api/health.php) for monitoring - Improve rate limit cleanup with cron script and efficient DirectoryIterator - Enable rate limit response headers (X-RateLimit-*) - Add audit logging for workflow transitions - Log Discord webhook failures instead of silencing - Fix visibility check on export_tickets.php - Add database migration system with performance indexes - Fix cron recurring tickets to use assignTicket method Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
74 lines
2.3 KiB
PHP
74 lines
2.3 KiB
PHP
<?php
|
|
// Apply rate limiting
|
|
require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
|
|
RateLimitMiddleware::apply('api');
|
|
|
|
session_start();
|
|
require_once dirname(__DIR__) . '/config/config.php';
|
|
require_once dirname(__DIR__) . '/helpers/Database.php';
|
|
require_once dirname(__DIR__) . '/models/TicketModel.php';
|
|
require_once dirname(__DIR__) . '/models/AuditLogModel.php';
|
|
require_once dirname(__DIR__) . '/models/UserModel.php';
|
|
|
|
header('Content-Type: application/json');
|
|
|
|
// Check authentication
|
|
if (!isset($_SESSION['user']) || !isset($_SESSION['user']['user_id'])) {
|
|
echo json_encode(['success' => false, 'error' => 'Not authenticated']);
|
|
exit;
|
|
}
|
|
|
|
// CSRF Protection
|
|
require_once dirname(__DIR__) . '/middleware/CsrfMiddleware.php';
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
|
$csrfToken = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
|
|
if (!CsrfMiddleware::validateToken($csrfToken)) {
|
|
http_response_code(403);
|
|
echo json_encode(['success' => false, 'error' => 'Invalid CSRF token']);
|
|
exit;
|
|
}
|
|
}
|
|
|
|
$userId = $_SESSION['user']['user_id'];
|
|
|
|
// Get request data
|
|
$data = json_decode(file_get_contents('php://input'), true);
|
|
$ticketId = $data['ticket_id'] ?? null;
|
|
$assignedTo = $data['assigned_to'] ?? null;
|
|
|
|
if (!$ticketId) {
|
|
echo json_encode(['success' => false, 'error' => 'Ticket ID required']);
|
|
exit;
|
|
}
|
|
|
|
// Use centralized database connection
|
|
$conn = Database::getConnection();
|
|
|
|
$ticketModel = new TicketModel($conn);
|
|
$auditLogModel = new AuditLogModel($conn);
|
|
$userModel = new UserModel($conn);
|
|
|
|
if ($assignedTo === null || $assignedTo === '') {
|
|
// Unassign ticket
|
|
$success = $ticketModel->unassignTicket($ticketId, $userId);
|
|
if ($success) {
|
|
$auditLogModel->log($userId, 'unassign', 'ticket', $ticketId);
|
|
}
|
|
} else {
|
|
// Validate assigned_to is a valid user ID
|
|
$assignedTo = (int)$assignedTo;
|
|
$targetUser = $userModel->getUserById($assignedTo);
|
|
if (!$targetUser) {
|
|
echo json_encode(['success' => false, 'error' => 'Invalid user ID']);
|
|
exit;
|
|
}
|
|
|
|
// Assign ticket
|
|
$success = $ticketModel->assignTicket($ticketId, $assignedTo, $userId);
|
|
if ($success) {
|
|
$auditLogModel->log($userId, 'assign', 'ticket', $ticketId, ['assigned_to' => $assignedTo]);
|
|
}
|
|
}
|
|
|
|
echo json_encode(['success' => $success]);
|