Fix some issues

app/routes/chatbot.py

@@ -76,11 +76,33 @@ def chat():
             end   = reply_text.rfind('}') + 1
             parsed = json.loads(reply_text[start:end])
             if parsed.get('action') == 'create_ticket':
+                # Validate AI-provided enum values against allowed sets to
+                # prevent arbitrary strings reaching the database.
+                _valid_categories = {
+                    TicketCategory.HARDWARE, TicketCategory.SOFTWARE,
+                    TicketCategory.NETWORK,  TicketCategory.ACCESS,
+                    TicketCategory.EMAIL,    TicketCategory.PRINTER,
+                    TicketCategory.PHONE,    TicketCategory.SECURITY,
+                    TicketCategory.OTHER,
+                }
+                _valid_priorities = {
+                    TicketPriority.LOW,    TicketPriority.MEDIUM,
+                    TicketPriority.HIGH,   TicketPriority.CRITICAL,
+                }
+                raw_category = parsed.get('category', TicketCategory.OTHER)
+                raw_priority = parsed.get('priority', TicketPriority.MEDIUM)
+                safe_category = raw_category if raw_category in _valid_categories else TicketCategory.OTHER
+                safe_priority = raw_priority if raw_priority in _valid_priorities else TicketPriority.MEDIUM
+                if raw_category != safe_category:
+                    logger.warning(f'[CHATBOT VALIDATION] invalid category="{raw_category}" coerced to "{safe_category}"')
+                if raw_priority != safe_priority:
+                    logger.warning(f'[CHATBOT VALIDATION] invalid priority="{raw_priority}" coerced to "{safe_priority}"')
+
                 ticket = Ticket(
                     title         = parsed.get('title', 'Untitled Issue'),
                     description   = parsed.get('description', ''),
-                    category      = parsed.get('category', TicketCategory.OTHER),
-                    priority      = parsed.get('priority', TicketPriority.MEDIUM),
+                    category      = safe_category,
+                    priority      = safe_priority,
                     location      = parsed.get('location', ''),
                     asset_tag     = parsed.get('asset_tag', ''),
                     created_by_id = current_user.id,
@@ -89,10 +111,9 @@ def chat():
                 )
                 ticket.ticket_number = ticket.generate_ticket_number()
                 db.session.add(ticket)
-                db.session.commit()
-
                 log_action(current_user.id, 'ticket_create_chatbot', 'ticket', ticket.id,
                            f'ticket_number={ticket.ticket_number} ai_generated=True')
+                db.session.commit()
                 logger.info(f'[CHATBOT TICKET CREATE] ticket_id={ticket.id} number={ticket.ticket_number} user_id={current_user.id}')
                 notify_new_ticket(ticket)