tinker_tickets/services/DependencyService.php

<?php

/**
 * Listing, adding and removing ticket dependencies (blocks / blocked_by /
 * relates_to / duplicates): access checks on the tickets involved,
 * DependencyModel's duplicate/inverse/cycle checks, and audit logging.
 *
 * Shared by the web UI (api/ticket_dependencies.php) and the MCP
 * link_tickets / unlink_tickets / get_ticket tools so both run one code path.
 * Extracted from ticket_dependencies.php with the same checks, order and
 * error messages. Returns result arrays; failures carry 'http_status' for
 * HTTP callers. Callers own sessions/CSRF/responses.
 */

require_once dirname(__DIR__) . '/models/DependencyModel.php';
require_once dirname(__DIR__) . '/models/AuditLogModel.php';
require_once dirname(__DIR__) . '/models/TicketModel.php';

class DependencyService
{
    public const TYPES = ['blocks', 'blocked_by', 'relates_to', 'duplicates'];

    /**
     * Links from and to a ticket, limited to linked tickets the user can see.
     *
     * @param array $currentUser Authenticated user row (user_id, groups, is_admin)
     * @return array ['success' => true, 'dependencies' => [type => rows], 'dependents' => rows]
     */
    public static function list(mysqli $conn, array $currentUser, $ticketId): array
    {
        if (!$ticketId) {
            return ['success' => false, 'error' => 'Ticket ID required', 'http_status' => 400];
        }

        // Verify user can access this ticket
        $ticketModel = new TicketModel($conn);
        $ticket = $ticketModel->getTicketById($ticketId);
        if (!$ticket || !$ticketModel->canUserAccessTicket($ticket, $currentUser)) {
            return ['success' => false, 'error' => 'Ticket not found', 'http_status' => 404];
        }

        $dependencyModel = new DependencyModel($conn);
        [$userId, $userGroups, $isAdmin] = self::viewer($currentUser);
        try {
            $dependencies = $dependencyModel->getDependencies($ticketId, $userId, $userGroups, $isAdmin);
            $dependents = $dependencyModel->getDependentTickets($ticketId, $userId, $userGroups, $isAdmin);
        } catch (Exception $e) {
            error_log('DependencyService::list query error: ' . $e->getMessage());
            return ['success' => false, 'error' => 'Failed to retrieve dependencies', 'http_status' => 500];
        }

        return ['success' => true, 'dependencies' => $dependencies, 'dependents' => $dependents];
    }

    /**
     * @param array $data ticket_id, depends_on_id, dependency_type (default "blocks")
     * @return array ['success' => true, 'dependency_id' => int] or an error
     */
    public static function add(mysqli $conn, array $currentUser, array $data): array
    {
        $ticketId = $data['ticket_id'] ?? null;
        $dependsOnId = $data['depends_on_id'] ?? null;
        $type = $data['dependency_type'] ?? 'blocks';

        if (!$ticketId || !$dependsOnId) {
            return ['success' => false, 'error' => 'Both ticket_id and depends_on_id are required', 'http_status' => 400];
        }

        // Verify user can access both tickets before creating dependency
        $ticketModel = new TicketModel($conn);
        $srcTicket = $ticketModel->getTicketById($ticketId);
        if (!$srcTicket || !$ticketModel->canUserAccessTicket($srcTicket, $currentUser)) {
            return ['success' => false, 'error' => 'Ticket not found', 'http_status' => 404];
        }
        $tgtTicket = $ticketModel->getTicketById($dependsOnId);
        if (!$tgtTicket || !$ticketModel->canUserAccessTicket($tgtTicket, $currentUser)) {
            return ['success' => false, 'error' => 'Target ticket not found', 'http_status' => 404];
        }

        $result = (new DependencyModel($conn))->addDependency($ticketId, $dependsOnId, $type, $currentUser['user_id']);
        if (!$result['success']) {
            return ['success' => false, 'error' => $result['error'], 'http_status' => 400];
        }

        (new AuditLogModel($conn))->log($currentUser['user_id'], 'create', 'dependency', (string)$result['dependency_id'], [
            'ticket_id' => $ticketId,
            'depends_on_id' => $dependsOnId,
            'type' => $type
        ]);

        return $result;
    }

    /**
     * Remove one link, by dependency_id or by (ticket_id, depends_on_id, dependency_type).
     *
     * @return array ['success' => true, 'removed' => rows deleted] or an error
     */
    public static function remove(mysqli $conn, array $currentUser, array $data): array
    {
        $dependencyModel = new DependencyModel($conn);
        $ticketModel = new TicketModel($conn);
        $auditLog = new AuditLogModel($conn);
        $dependencyId = $data['dependency_id'] ?? null;

        // Alternative: delete by ticket IDs
        if (!$dependencyId && isset($data['ticket_id']) && isset($data['depends_on_id'])) {
            $ticketId = $data['ticket_id'];
            $dependsOnId = $data['depends_on_id'];
            $type = $data['dependency_type'] ?? 'blocks';

            // Validate dependency type
            if (!in_array($type, self::TYPES, true)) {
                return ['success' => false, 'error' => 'Invalid dependency type', 'http_status' => 400];
            }

            // Verify user can access the source ticket
            $srcTicket = $ticketModel->getTicketById($ticketId);
            if (!$srcTicket || !$ticketModel->canUserAccessTicket($srcTicket, $currentUser)) {
                return ['success' => false, 'error' => 'Ticket not found', 'http_status' => 404];
            }

            $removed = $dependencyModel->removeDependencyByTickets($ticketId, $dependsOnId, $type);
            if ($removed === false) {
                return ['success' => false, 'error' => 'Failed to remove dependency', 'http_status' => 400];
            }
            // Only audit a removal that happened (the web UI treats removing
            // a link that is already gone as success).
            if ($removed > 0) {
                $auditLog->log($currentUser['user_id'], 'delete', 'dependency', null, [
                    'ticket_id' => $ticketId,
                    'depends_on_id' => $dependsOnId,
                    'type' => $type
                ]);
            }
            return ['success' => true, 'removed' => $removed];
        }

        if (!$dependencyId) {
            return ['success' => false, 'error' => 'Dependency ID or ticket IDs required', 'http_status' => 400];
        }

        // Look up dependency to verify ticket access before deletion
        $depLookupStmt = $conn->prepare("SELECT ticket_id FROM ticket_dependencies WHERE dependency_id = ?");
        $depLookupStmt->bind_param("i", $dependencyId);
        $depLookupStmt->execute();
        $depRow = $depLookupStmt->get_result()->fetch_assoc();
        $depLookupStmt->close();

        if (!$depRow) {
            return ['success' => false, 'error' => 'Dependency not found', 'http_status' => 404];
        }

        $depTicket = $ticketModel->getTicketById($depRow['ticket_id']);
        if (!$depTicket || !$ticketModel->canUserAccessTicket($depTicket, $currentUser)) {
            return ['success' => false, 'error' => 'Access denied', 'http_status' => 403];
        }

        $removed = $dependencyModel->removeDependency($dependencyId);
        if ($removed === false) {
            return ['success' => false, 'error' => 'Failed to remove dependency', 'http_status' => 400];
        }
        $auditLog->log($currentUser['user_id'], 'delete', 'dependency', (string)$dependencyId);
        return ['success' => true, 'removed' => $removed];
    }

    /**
     * users.groups is a comma-separated string; the dependency model expects an array.
     *
     * @return array{0:mixed,1:array,2:bool}
     */
    private static function viewer(array $currentUser): array
    {
        return [
            $currentUser['user_id'] ?? null,
            array_values(array_filter(array_map('trim', explode(',', $currentUser['groups'] ?? '')))),
            (bool)($currentUser['is_admin'] ?? false),
        ];
    }
}