Jared Vititoe jared
0 Followers · 0 Following
  • Joined on 2024-11-30
Repositories
1
 Projects Packages Public Activity Starred Repositories
4
jared pushed to main at LotusGuild/tinker_tickets 2026-09-11 14:49:47 -04:00
b6c17096b5 Merge development into main: search filter merge, workflow dup rejection, recurring-ticket loss alert, preview debounce (#58, #62, #88, #108)
6bd1bb082a Debounce the live markdown preview (#108)
a4828c1b7b Alert and record a lost recurring-ticket occurrence on creation failure (#88)
86ef91abcb Reject duplicate workflow transitions with a clear error (#62)
6d68af40e7 Merge into current URL params instead of replacing them in Advanced Search (#58)
Compare 5 commits »
jared pushed to development at LotusGuild/tinker_tickets 2026-09-11 14:28:50 -04:00
6bd1bb082a Debounce the live markdown preview (#108)
a4828c1b7b Alert and record a lost recurring-ticket occurrence on creation failure (#88)
86ef91abcb Reject duplicate workflow transitions with a clear error (#62)
6d68af40e7 Merge into current URL params instead of replacing them in Advanced Search (#58)
aa8173941a Merge development into main: webhook timeout, comment-edit timeline fix, Bearer rate-limiting overhaul (#77, #80, #81, #82, #83, #87)
Compare 5 commits »
jared commented on issue LotusGuild/tinker_tickets#87 2026-09-11 14:12:02 -04:00
Comment edits never appear on the ticket's own Activity Timeline — missing ticket_id in audit log details

Fixed and verified (real file-based rate-limit counters, session-file monitoring, real MariaDB, real webhook server). Merged to main in commit aa81739.

jared closed issue LotusGuild/tinker_tickets#87 2026-09-11 14:12:02 -04:00
Comment edits never appear on the ticket's own Activity Timeline — missing ticket_id in audit log details
jared closed issue LotusGuild/tinker_tickets#83 2026-09-11 14:12:01 -04:00
Every Bearer API request unnecessarily starts a new PHP session
jared commented on issue LotusGuild/tinker_tickets#80 2026-09-11 14:12:00 -04:00
RATE_LIMIT_DEFAULT/RATE_LIMIT_API config keys are dead — editing them in .env has zero effect

Fixed and verified (real file-based rate-limit counters, session-file monitoring, real MariaDB, real webhook server). Merged to main in commit aa81739.

jared closed issue LotusGuild/tinker_tickets#80 2026-09-11 14:12:00 -04:00
RATE_LIMIT_DEFAULT/RATE_LIMIT_API config keys are dead — editing them in .env has zero effect
jared commented on issue LotusGuild/tinker_tickets#81 2026-09-11 14:12:00 -04:00
Bearer API endpoints are rate-limited purely by shared IP, not by API key — one key can starve another

Fixed and verified (real file-based rate-limit counters, session-file monitoring, real MariaDB, real webhook server). Merged to main in commit aa81739.

jared closed issue LotusGuild/tinker_tickets#81 2026-09-11 14:12:00 -04:00
Bearer API endpoints are rate-limited purely by shared IP, not by API key — one key can starve another
jared commented on issue LotusGuild/tinker_tickets#82 2026-09-11 14:12:00 -04:00
X-RateLimit-* response headers are misleading for Bearer/API-key clients

Fixed and verified (real file-based rate-limit counters, session-file monitoring, real MariaDB, real webhook server). Merged to main in commit aa81739.

jared closed issue LotusGuild/tinker_tickets#82 2026-09-11 14:12:00 -04:00
X-RateLimit-* response headers are misleading for Bearer/API-key clients
jared commented on issue LotusGuild/tinker_tickets#83 2026-09-11 14:12:00 -04:00
Every Bearer API request unnecessarily starts a new PHP session

Fixed and verified (real file-based rate-limit counters, session-file monitoring, real MariaDB, real webhook server). Merged to main in commit aa81739.

jared commented on issue LotusGuild/tinker_tickets#77 2026-09-11 14:11:59 -04:00
Matrix webhook calls are synchronous with no connect-timeout — worst case ~30s added to a single comment's response time

Fixed and verified (real file-based rate-limit counters, session-file monitoring, real MariaDB, real webhook server). Merged to main in commit aa81739.

jared closed issue LotusGuild/tinker_tickets#77 2026-09-11 14:11:59 -04:00
Matrix webhook calls are synchronous with no connect-timeout — worst case ~30s added to a single comment's response time
jared pushed to main at LotusGuild/tinker_tickets 2026-09-11 14:11:51 -04:00
aa8173941a Merge development into main: webhook timeout, comment-edit timeline fix, Bearer rate-limiting overhaul (#77, #80, #81, #82, #83, #87)
1b1801696f Overhaul Bearer API rate limiting: real config, per-key isolation, skip session (#80, #81, #82, #83)
09cea2b388 Include ticket_id in comment-edit audit log so it appears on the timeline (#87)
9702aafacd Add connect-timeout to Matrix webhook calls (#77)
Compare 4 commits »
jared pushed to development at LotusGuild/tinker_tickets 2026-09-11 14:05:26 -04:00
1b1801696f Overhaul Bearer API rate limiting: real config, per-key isolation, skip session (#80, #81, #82, #83)
09cea2b388 Include ticket_id in comment-edit audit log so it appears on the timeline (#87)
9702aafacd Add connect-timeout to Matrix webhook calls (#77)
66bf82bf46 Merge development into main: visibility-notification pruning + CSRF UX + custom field type validation (#48, #50, #57, #73, #86)
Compare 4 commits »
jared closed issue LotusGuild/tinker_tickets#86 2026-09-11 13:48:33 -04:00
CSRF resync updates the token but never auto-retries the failed request — every stale-token case surfaces a user-visible error first
jared commented on issue LotusGuild/tinker_tickets#73 2026-09-11 13:48:32 -04:00
Watchers are never pruned when a ticket's visibility is tightened

Fixed and verified against real MariaDB, a real running server, and jsdom-mocked network scenarios. Merged to main in commit 66bf82b.

jared closed issue LotusGuild/tinker_tickets#73 2026-09-11 13:48:32 -04:00
Watchers are never pruned when a ticket's visibility is tightened
jared commented on issue LotusGuild/tinker_tickets#86 2026-09-11 13:48:32 -04:00
CSRF resync updates the token but never auto-retries the failed request — every stale-token case surfaces a user-visible error first

Fixed and verified against real MariaDB, a real running server, and jsdom-mocked network scenarios. Merged to main in commit 66bf82b.