Fix ticket details page, comments updated real-time

app/routes/api.py

@@ -59,6 +59,45 @@ def mark_all_read():
     return jsonify({'ok': True})
 
 
+# ─── Ticket Comments API ──────────────────────────────────────────────────────
+
+@api_bp.route('/tickets/<int:ticket_id>/comments')
+@login_required
+def get_comments(ticket_id):
+    """Return all visible comments for a ticket as JSON."""
+    from app.models import Ticket, Comment, UserRole
+    ticket = Ticket.query.get_or_404(ticket_id)
+    # Employees may only see their own tickets
+    if not current_user.is_it_staff and ticket.created_by_id != current_user.id:
+        return jsonify({'error': 'Forbidden'}), 403
+
+    q = Comment.query.filter_by(ticket_id=ticket_id)
+    if not current_user.is_it_staff:
+        q = q.filter_by(is_internal=False)
+    comments = q.order_by(Comment.created_at.asc()).all()
+
+    return jsonify({'comments': [
+        {
+            'id'         : c.id,
+            'author_name': c.author.full_name,
+            'author_init': c.author.full_name[0].upper(),
+            'is_it_staff': c.author.is_it_staff,
+            'is_internal': c.is_internal,
+            'body'       : c.body,
+            'created_at' : c.created_at.strftime('%b %d, %Y %H:%M'),
+            'can_delete' : current_user.is_it_staff or c.author_id == current_user.id,
+            'attachments': [
+                {
+                    'id'      : a.id,
+                    'filename': a.filename,
+                }
+                for a in c.attachments.all()
+            ],
+        }
+        for c in comments
+    ]})
+
+
 # ─── Ticket Stats API (IT) ────────────────────────────────────────────────────
 
 @api_bp.route('/stats/tickets')