tinker_tickets/api/manage_templates.php

<?php

/**
 * Template Management API
 * CRUD operations for ticket_templates table
 */

ini_set('display_errors', 0);
error_reporting(E_ALL);

require_once dirname(__DIR__) . '/middleware/RateLimitMiddleware.php';
RateLimitMiddleware::apply('api');

try {
    require_once dirname(__DIR__) . '/config/config.php';
    require_once dirname(__DIR__) . '/helpers/Database.php';
    require_once dirname(__DIR__) . '/models/AuditLogModel.php';

    // Check authentication
    if (session_status() === PHP_SESSION_NONE) {
        session_start();
    }
    if (!isset($_SESSION['user']) || !isset($_SESSION['user']['user_id'])) {
        http_response_code(401);
        echo json_encode(['success' => false, 'error' => 'Authentication required']);
        exit;
    }

    // Check admin privileges for write operations
    if ($_SERVER['REQUEST_METHOD'] !== 'GET' && !$_SESSION['user']['is_admin']) {
        http_response_code(403);
        echo json_encode(['success' => false, 'error' => 'Admin privileges required']);
        exit;
    }

    // CSRF Protection for write operations
    if ($_SERVER['REQUEST_METHOD'] !== 'GET') {
        require_once dirname(__DIR__) . '/middleware/CsrfMiddleware.php';
        $csrfToken = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
        if (!CsrfMiddleware::validateToken($csrfToken)) {
            http_response_code(403);
            echo json_encode(['success' => false, 'error' => 'Invalid CSRF token', 'csrf_token' => CsrfMiddleware::getToken()]);
            exit;
        }
    }

    // Use centralized database connection
    $conn = Database::getConnection();

    header('Content-Type: application/json');

    $auditLog = new AuditLogModel($conn);
    $currentUserId = $_SESSION['user']['user_id'];
    $method = $_SERVER['REQUEST_METHOD'];
    $id = isset($_GET['id']) ? (int)$_GET['id'] : null;

    switch ($method) {
        case 'GET':
            if ($id) {
                // Get single template
                $stmt = $conn->prepare("SELECT * FROM ticket_templates WHERE template_id = ?");
                $stmt->bind_param('i', $id);
                $stmt->execute();
                $result = $stmt->get_result();
                $template = $result->fetch_assoc();
                $stmt->close();
                echo json_encode(['success' => true, 'template' => $template]);
            } else {
                // Get all templates
                $result = $conn->query("SELECT * FROM ticket_templates ORDER BY template_name");
                $templates = [];
                while ($row = $result->fetch_assoc()) {
                    $templates[] = $row;
                }
                echo json_encode(['success' => true, 'templates' => $templates]);
            }
            break;

        case 'POST':
            $data = json_decode(file_get_contents('php://input'), true);

            // Validate required fields and lengths
            $templateName = trim($data['template_name'] ?? '');
            $titleTemplate = trim($data['title_template'] ?? '');
            if (!$templateName || mb_strlen($templateName) > 100) {
                echo json_encode(['success' => false, 'error' => 'Template name is required (max 100 chars)']);
                exit;
            }
            if (!$titleTemplate || mb_strlen($titleTemplate) > 255) {
                echo json_encode(['success' => false, 'error' => 'Title template is required (max 255 chars)']);
                exit;
            }
            $allowedCategories = ['General','Hardware','Software','Network','Security'];
            $allowedTypes      = ['Issue','Maintenance','Install','Task','Upgrade','Problem'];
            $category = in_array($data['category'] ?? '', $allowedCategories) ? $data['category'] : 'General';
            $type     = in_array($data['type'] ?? '', $allowedTypes)      ? $data['type']     : 'Issue';
            $priority = max(1, min(5, (int)($data['default_priority'] ?? 4)));
            $isActive = $data['is_active'] ? 1 : 0;
            $description = mb_substr($data['description_template'] ?? '', 0, 65535);

            $stmt = $conn->prepare("INSERT INTO ticket_templates
                                    (template_name, title_template, description_template, category, type, default_priority, is_active)
                                    VALUES (?, ?, ?, ?, ?, ?, ?)");
            $stmt->bind_param(
                'sssssii',
                $templateName,
                $titleTemplate,
                $description,
                $category,
                $type,
                $priority,
                $isActive
            );

            if ($stmt->execute()) {
                $newTemplateId = $conn->insert_id;
                $auditLog->log($currentUserId, 'create', 'template', (string)$newTemplateId, [
                    'template_name' => $templateName,
                    'category' => $category,
                    'type' => $type
                ]);
                echo json_encode(['success' => true, 'template_id' => $newTemplateId]);
            } else {
                error_log("Template creation failed: " . $stmt->error);
                echo json_encode(['success' => false, 'error' => 'Failed to create template']);
            }
            $stmt->close();
            break;

        case 'PUT':
            if (!$id) {
                echo json_encode(['success' => false, 'error' => 'ID required']);
                exit;
            }

            $data = json_decode(file_get_contents('php://input'), true);

            // Validate required fields and lengths
            $templateName = trim($data['template_name'] ?? '');
            $titleTemplate = trim($data['title_template'] ?? '');
            if (!$templateName || mb_strlen($templateName) > 100) {
                echo json_encode(['success' => false, 'error' => 'Template name is required (max 100 chars)']);
                exit;
            }
            if (!$titleTemplate || mb_strlen($titleTemplate) > 255) {
                echo json_encode(['success' => false, 'error' => 'Title template is required (max 255 chars)']);
                exit;
            }
            $allowedCategories = ['General','Hardware','Software','Network','Security'];
            $allowedTypes      = ['Issue','Maintenance','Install','Task','Upgrade','Problem'];
            $category = in_array($data['category'] ?? '', $allowedCategories) ? $data['category'] : 'General';
            $type     = in_array($data['type'] ?? '', $allowedTypes)      ? $data['type']     : 'Issue';
            $priority = max(1, min(5, (int)($data['default_priority'] ?? 4)));
            $isActive = $data['is_active'] ? 1 : 0;
            $description = mb_substr($data['description_template'] ?? '', 0, 65535);

            $stmt = $conn->prepare("UPDATE ticket_templates SET
                                    template_name = ?, title_template = ?, description_template = ?,
                                    category = ?, type = ?, default_priority = ?, is_active = ?
                                    WHERE template_id = ?");
            $stmt->bind_param(
                'sssssiii',
                $templateName,
                $titleTemplate,
                $description,
                $category,
                $type,
                $priority,
                $isActive,
                $id
            );

            $updated = $stmt->execute();
            if ($updated) {
                $auditLog->log($currentUserId, 'update', 'template', (string)$id, [
                    'template_name' => $templateName,
                    'category' => $category,
                    'type' => $type
                ]);
            }
            echo json_encode(['success' => $updated]);
            $stmt->close();
            break;

        case 'DELETE':
            if (!$id) {
                echo json_encode(['success' => false, 'error' => 'ID required']);
                exit;
            }

            // Capture the name before deletion for the audit record.
            $nameStmt = $conn->prepare("SELECT template_name FROM ticket_templates WHERE template_id = ?");
            $nameStmt->bind_param('i', $id);
            $nameStmt->execute();
            $delRow = $nameStmt->get_result()->fetch_assoc();
            $nameStmt->close();

            $stmt = $conn->prepare("DELETE FROM ticket_templates WHERE template_id = ?");
            $stmt->bind_param('i', $id);
            $deleted = $stmt->execute();
            if ($deleted) {
                $auditLog->log($currentUserId, 'delete', 'template', (string)$id, [
                    'template_name' => $delRow['template_name'] ?? 'unknown'
                ]);
            }
            echo json_encode(['success' => $deleted]);
            $stmt->close();
            break;

        default:
            http_response_code(405);
            echo json_encode(['success' => false, 'error' => 'Method not allowed']);
    }
} catch (Exception $e) {
    error_log("Template API error: " . $e->getMessage());
    http_response_code(500);
    echo json_encode(['success' => false, 'error' => 'An internal error occurred']);
}