tinker_tickets/controllers/TicketController.php

<?php

// Use absolute paths for model includes
require_once dirname(__DIR__) . '/models/TicketModel.php';
require_once dirname(__DIR__) . '/models/CommentModel.php';
require_once dirname(__DIR__) . '/models/AuditLogModel.php';
require_once dirname(__DIR__) . '/models/UserModel.php';
require_once dirname(__DIR__) . '/models/WorkflowModel.php';
require_once dirname(__DIR__) . '/models/TemplateModel.php';
require_once dirname(__DIR__) . '/models/CustomFieldModel.php';
require_once dirname(__DIR__) . '/helpers/UrlHelper.php';
require_once dirname(__DIR__) . '/helpers/NotificationHelper.php';

class TicketController
{
    private $ticketModel;
    private $commentModel;
    private $auditLogModel;
    private $userModel;
    private $workflowModel;
    private $templateModel;
    private $customFieldModel;
    private $conn;

    public function __construct($conn)
    {
        $this->conn = $conn;
        $this->ticketModel = new TicketModel($conn);
        $this->commentModel = new CommentModel($conn);
        $this->auditLogModel = new AuditLogModel($conn);
        $this->userModel = new UserModel($conn);
        $this->workflowModel = new WorkflowModel($conn);
        $this->templateModel = new TemplateModel($conn);
        $this->customFieldModel = new CustomFieldModel($conn);
    }

    public function view($id)
    {
        // Get current user
        $currentUser = $GLOBALS['currentUser'] ?? null;
        $userId = $currentUser['user_id'] ?? null;

        // Get ticket data
        $ticket = $this->ticketModel->getTicketById($id);

        if (!$ticket || !$this->ticketModel->canUserAccessTicket($ticket, $currentUser)) {
            http_response_code(404);
            include dirname(__DIR__) . '/views/error_404.php';
            return;
        }

        // Load first page of comments; show "load more" if ticket has many
        $commentPageSize  = 50;
        $totalComments    = $this->commentModel->getCommentCount((int)$id);
        $comments         = $this->commentModel->getCommentsByTicketId($id, true, $commentPageSize, 0);

        // Get timeline for this ticket
        $timeline = $this->auditLogModel->getTicketTimeline($id);

        // Get all users for assignment dropdown
        $allUsers = $this->userModel->getAllUsers();

        // Get allowed status transitions for this ticket
        $allowedTransitions = $this->workflowModel->getAllowedTransitions($ticket['status']);

        // Custom fields applicable to this ticket's category, with any
        // already-saved values for it
        $customFieldDefs = $this->customFieldModel->getAllDefinitions($ticket['category'], true);
        $customFieldValues = $this->customFieldModel->getValuesForTicket($id);

        // Make $conn available to view for visibility groups
        $conn = $this->conn;

        // Load the view
        include dirname(__DIR__) . '/views/TicketView.php';
    }

    public function create()
    {
        // Get current user
        $currentUser = $GLOBALS['currentUser'] ?? null;
        $userId = $currentUser['user_id'] ?? null;

        // All active custom field definitions (every category, plus
        // category-less ones) — the create form renders them all and toggles
        // visibility client-side as the Category select changes, since the
        // ticket doesn't exist yet to scope the query to one category.
        $allCustomFieldDefs = $this->customFieldModel->getAllDefinitions(null, true);

        // Check if form was submitted
        if ($_SERVER['REQUEST_METHOD'] === 'POST') {
            // Validate CSRF token
            require_once dirname(__DIR__) . '/middleware/CsrfMiddleware.php';
            $csrfToken = $_POST['csrf_token'] ?? '';
            if (!CsrfMiddleware::validateToken($csrfToken)) {
                $error = "Invalid or expired security token. Please try again.";
                $templates = $this->templateModel->getAllTemplates();
                $allUsers = $this->userModel->getAllUsers();
                $conn = $this->conn;
                include dirname(__DIR__) . '/views/CreateTicketView.php';
                return;
            }

            // Handle visibility groups (comes as array from checkboxes)
            $visibilityGroups = null;
            if (isset($_POST['visibility_groups']) && is_array($_POST['visibility_groups'])) {
                $visibilityGroups = implode(',', array_map('trim', $_POST['visibility_groups']));
            }

            // Honor the posted status, validated against the app's canonical list
            $validStatuses = $GLOBALS['config']['TICKET_STATUSES'] ?? ['Open', 'Pending', 'In Progress', 'Closed'];
            $status = $_POST['status'] ?? 'Open';
            if (!in_array($status, $validStatuses, true)) {
                $status = 'Open';
            }

            $ticketData = [
                'title' => trim($_POST['title'] ?? ''),
                'description' => $_POST['description'] ?? '',
                'priority' => $_POST['priority'] ?? '4',
                'category' => $_POST['category'] ?? 'General',
                'type' => $_POST['type'] ?? 'Issue',
                'status' => $status,
                'visibility' => $_POST['visibility'] ?? 'public',
                'visibility_groups' => $visibilityGroups,
                'assigned_to' => !empty($_POST['assigned_to']) ? $_POST['assigned_to'] : null
            ];

            // Validate input (server-side; form is novalidate)
            if ($ticketData['title'] === '') {
                $error = "Title is required";
                $templates = $this->templateModel->getAllTemplates();
                $allUsers = $this->userModel->getAllUsers();
                $conn = $this->conn; // Make $conn available to view
                include dirname(__DIR__) . '/views/CreateTicketView.php';
                return;
            }

            if (trim($ticketData['description']) === '') {
                $error = "Description is required";
                $templates = $this->templateModel->getAllTemplates();
                $allUsers = $this->userModel->getAllUsers();
                $conn = $this->conn; // Make $conn available to view
                include dirname(__DIR__) . '/views/CreateTicketView.php';
                return;
            }

            // Custom fields applicable to the submitted category — validate
            // is_required server-side (the form is novalidate, and a field
            // hidden by the client-side category toggle must not silently
            // bypass a requirement that applies to the category actually
            // submitted).
            $submittedCustomFields = is_array($_POST['custom_fields'] ?? null) ? $_POST['custom_fields'] : [];
            $applicableFieldDefs = array_filter(
                $allCustomFieldDefs,
                fn($def) => $def['category'] === null || $def['category'] === $ticketData['category']
            );
            $customFieldsToSave = [];
            foreach ($applicableFieldDefs as $def) {
                $fieldId = (int)$def['field_id'];
                $raw = $submittedCustomFields[$fieldId] ?? null;
                $normalized = $def['field_type'] === 'checkbox'
                    ? (!empty($raw) ? '1' : '0')
                    : (is_scalar($raw) ? trim((string)$raw) : '');

                if (!empty($def['is_required']) && $def['field_type'] !== 'checkbox' && $normalized === '') {
                    $error = $def['field_label'] . ' is required';
                    $templates = $this->templateModel->getAllTemplates();
                    $allUsers = $this->userModel->getAllUsers();
                    $conn = $this->conn;
                    include dirname(__DIR__) . '/views/CreateTicketView.php';
                    return;
                }

                if ($normalized !== '') {
                    $customFieldsToSave[$fieldId] = $normalized;
                }
            }

            // Create ticket with user tracking
            $result = $this->ticketModel->createTicket($ticketData, $userId);

            if ($result['success']) {
                // Log ticket creation to audit log
                if (isset($GLOBALS['auditLog']) && $userId) {
                    $GLOBALS['auditLog']->logTicketCreate($userId, $result['ticket_id'], $ticketData);
                }

                // Ticket counts changed — invalidate the cached dashboard stats
                require_once dirname(__DIR__) . '/models/StatsModel.php';
                (new StatsModel($this->conn))->invalidateCache();

                // Persist custom field values for the fields applicable to
                // this ticket's category
                if (!empty($customFieldsToSave)) {
                    $this->customFieldModel->setValues($result['ticket_id'], $customFieldsToSave);
                }

                // Auto-link as duplicate if requested from create form
                $linkDupOfRaw = trim($_POST['link_duplicate_of'] ?? '');
                if ($linkDupOfRaw !== '' && ctype_digit($linkDupOfRaw)) {
                    $depSql = "INSERT IGNORE INTO ticket_dependencies (ticket_id, depends_on_id, dependency_type, created_by)
                               VALUES (?, ?, 'duplicates', ?)";
                    $depStmt = $this->conn->prepare($depSql);
                    $depStmt->bind_param("ssi", $result['ticket_id'], $linkDupOfRaw, $userId);
                    $depStmt->execute();
                    $depStmt->close();
                }

                // Send Matrix notification for new ticket
                NotificationHelper::sendTicketNotification($result['ticket_id'], $ticketData, 'manual');

                // Redirect to the new ticket
                header("Location: " . $GLOBALS['config']['BASE_URL'] . "/ticket/" . $result['ticket_id']);
                exit;
            } else {
                $error = $result['error'];
                $templates = $this->templateModel->getAllTemplates();
                $allUsers = $this->userModel->getAllUsers();
                $conn = $this->conn; // Make $conn available to view
                include dirname(__DIR__) . '/views/CreateTicketView.php';
                return;
            }
        } else {
            // Get all templates for the template selector
            $templates = $this->templateModel->getAllTemplates();
            // Get all users for assignment dropdown
            $allUsers = $this->userModel->getAllUsers();
            $conn = $this->conn; // Make $conn available to view

            // Display the create ticket form
            include dirname(__DIR__) . '/views/CreateTicketView.php';
        }
    }
}