Jared Vititoe

jared pushed to development at LotusGuild/tinker_tickets

2026-09-11 14:05:26 -04:00

1b1801696f Overhaul Bearer API rate limiting: real config, per-key isolation, skip session (#80, #81, #82, #83)

09cea2b388 Include ticket_id in comment-edit audit log so it appears on the timeline (#87)

9702aafacd Add connect-timeout to Matrix webhook calls (#77)

66bf82bf46 Merge development into main: visibility-notification pruning + CSRF UX + custom field type validation (#48, #50, #57, #73, #86)

Compare 4 commits »

jared closed issue LotusGuild/tinker_tickets#86

2026-09-11 13:48:33 -04:00

CSRF resync updates the token but never auto-retries the failed request — every stale-token case surfaces a user-visible error first

jared closed issue LotusGuild/tinker_tickets#57

2026-09-11 13:48:32 -04:00

Notification bell uses raw fetch() instead of lt.api, breaking CSRF token resync

jared commented on issue LotusGuild/tinker_tickets#73

2026-09-11 13:48:32 -04:00

Watchers are never pruned when a ticket's visibility is tightened

Fixed and verified against real MariaDB, a real running server, and jsdom-mocked network scenarios. Merged to main in commit 66bf82b.

jared closed issue LotusGuild/tinker_tickets#73

2026-09-11 13:48:32 -04:00

Watchers are never pruned when a ticket's visibility is tightened

jared commented on issue LotusGuild/tinker_tickets#86

2026-09-11 13:48:32 -04:00

CSRF resync updates the token but never auto-retries the failed request — every stale-token case surfaces a user-visible error first

Fixed and verified against real MariaDB, a real running server, and jsdom-mocked network scenarios. Merged to main in commit 66bf82b.

jared closed issue LotusGuild/tinker_tickets#48

2026-09-11 13:48:31 -04:00

api/notifications.php: in-app notifications don't re-check current ticket visibility

jared commented on issue LotusGuild/tinker_tickets#50

2026-09-11 13:48:31 -04:00

Custom field values have no server-side validation against field_type or select options

Fixed and verified against real MariaDB, a real running server, and jsdom-mocked network scenarios. Merged to main in commit 66bf82b.

jared closed issue LotusGuild/tinker_tickets#50

2026-09-11 13:48:31 -04:00

Custom field values have no server-side validation against field_type or select options

jared commented on issue LotusGuild/tinker_tickets#57

2026-09-11 13:48:31 -04:00

Notification bell uses raw fetch() instead of lt.api, breaking CSRF token resync

Fixed and verified against real MariaDB, a real running server, and jsdom-mocked network scenarios. Merged to main in commit 66bf82b.

jared commented on issue LotusGuild/tinker_tickets#48

2026-09-11 13:48:30 -04:00

api/notifications.php: in-app notifications don't re-check current ticket visibility

Fixed and verified against real MariaDB, a real running server, and jsdom-mocked network scenarios. Merged to main in commit 66bf82b.

jared pushed to main at LotusGuild/tinker_tickets

2026-09-11 13:48:22 -04:00

66bf82bf46 Merge development into main: visibility-notification pruning + CSRF UX + custom field type validation (#48, #50, #57, #73, #86)

fca0b42726 Validate field_type against the allowed enum in custom field definitions (#50)

ae12fcd6fd Auto-retry once after CSRF token resync in lt.api (#86)

5b96e75ff6 Use lt.api instead of raw fetch() in notification bell (#57)

3db3749c46 Re-check ticket visibility before surfacing in-app notifications (#48)

Compare 6 commits »

jared pushed to development at LotusGuild/tinker_tickets

2026-09-11 13:31:44 -04:00

fca0b42726 Validate field_type against the allowed enum in custom field definitions (#50)

ae12fcd6fd Auto-retry once after CSRF token resync in lt.api (#86)

5b96e75ff6 Use lt.api instead of raw fetch() in notification bell (#57)

3db3749c46 Re-check ticket visibility before surfacing in-app notifications (#48)

9e83f8903a Prune watchers when a ticket's visibility is tightened (#73)

Compare 6 commits »

jared commented on issue LotusGuild/tinker_tickets#47

2026-09-11 13:17:43 -04:00

Custom Fields feature is entirely disconnected from ticket creation/editing/viewing

Wired custom field rendering, persistence, and server-side is_required/select/number validation into ticket create and view. Verified end-to-end against real MariaDB and a running server. Merged…

jared closed issue LotusGuild/tinker_tickets#47

2026-09-11 13:17:43 -04:00

Custom Fields feature is entirely disconnected from ticket creation/editing/viewing

jared pushed to main at LotusGuild/tinker_tickets

2026-09-11 13:17:34 -04:00

cabdae35cc Merge development into main: Custom Fields wiring (#47)

3266373cdf Wire Custom Fields into ticket creation and viewing (#47)

Compare 2 commits »

jared pushed to development at LotusGuild/tinker_tickets

2026-09-11 13:12:53 -04:00

3266373cdf Wire Custom Fields into ticket creation and viewing (#47)

f342e446d3 Merge development into main: bulk-op notification/audit fixes + workflow-validated auto-reopen (#67, #68, #74)

Compare 2 commits »

jared closed issue LotusGuild/tinker_tickets#68

2026-09-11 12:44:17 -04:00

hwmonDaemon 'reopen closed duplicate' path bypasses Workflow Designer validation entirely via raw SQL

jared commented on issue LotusGuild/tinker_tickets#74

2026-09-11 12:44:17 -04:00

Bulk-operation audit_log entries use a different shape than every other status-change path, breaking the timeline and in-app notifications

Fixed and verified against real MariaDB and a real webhook-capturing server (notification firing, audit_log shape, all three workflow-fallback scenarios). Merged to main in commit f342e44.

jared closed issue LotusGuild/tinker_tickets#74

2026-09-11 12:44:17 -04:00

Bulk-operation audit_log entries use a different shape than every other status-change path, breaking the timeline and in-app notifications