04/07 updated linking ticket

app/routes/api.py

@@ -188,3 +188,46 @@ def search_users():
         }
         for u in users
     ]})
+
+
+# ─── Ticket Search API ────────────────────────────────────────────────────────
+
+@api_bp.route('/tickets/search')
+@login_required
+def search_tickets():
+    """Return tickets matching a query string, used by the link-ticket picker.
+
+    Searches ticket_number and title (case-insensitive).
+    ?q=<search term>  — required, min 1 char
+    ?exclude=<id>     — ticket ID to exclude (the current ticket)
+    Restricted to IT staff only.
+    """
+    if not current_user.is_it_staff:
+        return jsonify({'error': 'Forbidden'}), 403
+
+    q          = request.args.get('q', '').strip()
+    exclude_id = request.args.get('exclude', 0, type=int)
+
+    if not q:
+        return jsonify({'tickets': []})
+
+    from app.models import Ticket
+    query = Ticket.query.filter(
+        Ticket.ticket_number.ilike(f'%{q}%') |
+        Ticket.title.ilike(f'%{q}%')
+    )
+    if exclude_id:
+        query = query.filter(Ticket.id != exclude_id)
+
+    results = query.order_by(Ticket.created_at.desc()).limit(10).all()
+    logger.info(f'[TICKET SEARCH] q="{q}" results={len(results)} user_id={current_user.id}')
+    return jsonify({'tickets': [
+        {
+            'id'           : t.id,
+            'ticket_number': t.ticket_number,
+            'title'        : t.title,
+            'status'       : t.status,
+            'priority'     : t.priority,
+        }
+        for t in results
+    ]})