import os import logging import uuid from datetime import datetime from flask import (Blueprint, render_template, redirect, url_for, flash, request, current_app, send_from_directory, abort) from flask_login import login_required, current_user from werkzeug.utils import secure_filename from app import db from app.models import (Ticket, Comment, Attachment, Notification, TicketStatus, TicketPriority, TicketCategory, User, UserRole, KnowledgeBase) from app.services.notification_service import ( notify_new_ticket, notify_status_change, notify_comment_added, notify_assignment, ) from app.services.log_service import log_action, log_ticket_history from app.services.validation_service import validate_file tickets_bp = Blueprint('tickets', __name__) logger = logging.getLogger(__name__) # Allowed extensions for ticket and comment attachments. # validate_file() uses this set for both extension and magic-byte checks. ALLOWED_EXT = {'png', 'jpg', 'jpeg', 'gif', 'pdf', 'doc', 'docx', 'txt', 'zip', 'log'} def save_attachment(file, ticket_id=None, comment_id=None, uploader_id=None): filename = secure_filename(file.filename) ext = filename.rsplit('.', 1)[1].lower() if '.' in filename else '' stored_name = f"{uuid.uuid4().hex}.{ext}" upload_dir = current_app.config['UPLOAD_FOLDER'] file.save(os.path.join(upload_dir, stored_name)) att = Attachment( ticket_id = ticket_id, comment_id = comment_id, filename = filename, stored_name= stored_name, file_size = os.path.getsize(os.path.join(upload_dir, stored_name)), mime_type = file.content_type, uploaded_by= uploader_id, ) db.session.add(att) return att # ─── Dashboard ──────────────────────────────────────────────────────────────── @tickets_bp.route('/') @tickets_bp.route('/dashboard') @login_required def dashboard(): if current_user.is_it_staff: open_count = Ticket.query.filter_by(status=TicketStatus.OPEN).count() in_progress_count= Ticket.query.filter_by(status=TicketStatus.IN_PROGRESS).count() pending_count = Ticket.query.filter_by(status=TicketStatus.PENDING).count() resolved_count = Ticket.query.filter_by(status=TicketStatus.RESOLVED).count() my_tickets = Ticket.query.filter_by(assigned_to_id=current_user.id).filter( Ticket.status.notin_([TicketStatus.CLOSED]) ).order_by(Ticket.created_at.desc()).limit(10).all() recent_tickets = Ticket.query.order_by(Ticket.created_at.desc()).limit(15).all() return render_template('tickets/dashboard_it.html', open_count=open_count, in_progress_count=in_progress_count, pending_count=pending_count, resolved_count=resolved_count, my_tickets=my_tickets, recent_tickets=recent_tickets, ) else: my_tickets = Ticket.query.filter_by(created_by_id=current_user.id).order_by( Ticket.created_at.desc()).limit(20).all() open_count = sum(1 for t in my_tickets if t.status == TicketStatus.OPEN) active_count = sum(1 for t in my_tickets if t.status == TicketStatus.IN_PROGRESS) resolved_count = sum(1 for t in my_tickets if t.status == TicketStatus.RESOLVED) articles = KnowledgeBase.query.filter_by(is_published=True).order_by( KnowledgeBase.view_count.desc()).limit(5).all() return render_template('tickets/dashboard_employee.html', my_tickets=my_tickets, open_count=open_count, active_count=active_count, resolved_count=resolved_count, articles=articles, ) # ─── Create Ticket ──────────────────────────────────────────────────────────── @tickets_bp.route('/tickets/new', methods=['GET', 'POST']) @login_required def create_ticket(): if request.method == 'POST': title = request.form.get('title', '').strip() description = request.form.get('description', '').strip() category = request.form.get('category', TicketCategory.OTHER) priority = request.form.get('priority', TicketPriority.MEDIUM) location = request.form.get('location', '').strip() asset_tag = request.form.get('asset_tag', '').strip() if not title or not description: flash('Title and description are required.', 'danger') return render_template('tickets/create.html', categories=_categories(), priorities=_priorities()) ticket = Ticket( title = title, description = description, category = category, priority = priority, location = location, asset_tag = asset_tag, created_by_id = current_user.id, status = TicketStatus.OPEN, ) ticket.ticket_number = ticket.generate_ticket_number() db.session.add(ticket) db.session.flush() # get ticket.id before attachments # Handle file uploads for f in request.files.getlist('attachments'): if f and f.filename: file_error = validate_file(f, ALLOWED_EXT) if file_error: logger.warning(f'[TICKET UPLOAD REJECTED] {file_error} filename="{f.filename}" user_id={current_user.id}') continue save_attachment(f, ticket_id=ticket.id, uploader_id=current_user.id) log_action(current_user.id, 'ticket_create', 'ticket', ticket.id, f'ticket_number={ticket.ticket_number} priority={priority} category={category}') db.session.commit() logger.info(f'[TICKET CREATE] ticket_id={ticket.id} number={ticket.ticket_number} by user_id={current_user.id}') notify_new_ticket(ticket) flash(f'Ticket {ticket.ticket_number} created successfully!', 'success') return redirect(url_for('tickets.ticket_detail', ticket_id=ticket.id)) return render_template('tickets/create.html', categories=_categories(), priorities=_priorities()) # ─── Ticket List ────────────────────────────────────────────────────────────── @tickets_bp.route('/tickets') @login_required def ticket_list(): page = request.args.get('page', 1, type=int) status = request.args.get('status', '') priority = request.args.get('priority', '') category = request.args.get('category', '') search = request.args.get('q', '') query = Ticket.query if not current_user.is_it_staff: query = query.filter_by(created_by_id=current_user.id) if status: query = query.filter_by(status=status) if priority: query = query.filter_by(priority=priority) if category: query = query.filter_by(category=category) if search: query = query.filter( Ticket.title.ilike(f'%{search}%') | Ticket.ticket_number.ilike(f'%{search}%') | Ticket.description.ilike(f'%{search}%') ) tickets = query.order_by(Ticket.created_at.desc()).paginate(page=page, per_page=20) return render_template('tickets/list.html', tickets=tickets, status=status, priority=priority, category=category, search=search, statuses=_statuses(), priorities=_priorities(), categories=_categories(), ) # ─── Ticket Detail ──────────────────────────────────────────────────────────── @tickets_bp.route('/tickets/', methods=['GET', 'POST']) @login_required def ticket_detail(ticket_id): ticket = Ticket.query.get_or_404(ticket_id) # Employees can only view their own tickets if not current_user.is_it_staff and ticket.created_by_id != current_user.id: abort(403) if request.method == 'POST': body = request.form.get('body', '').strip() is_internal = bool(request.form.get('is_internal')) and current_user.is_it_staff if not body: flash('Comment cannot be empty.', 'danger') else: comment = Comment( ticket_id = ticket.id, author_id = current_user.id, body = body, is_internal= is_internal, ) db.session.add(comment) db.session.flush() for f in request.files.getlist('attachments'): if f and f.filename: file_error = validate_file(f, ALLOWED_EXT) if file_error: logger.warning(f'[COMMENT UPLOAD REJECTED] {file_error} filename="{f.filename}" user_id={current_user.id}') continue save_attachment(f, ticket_id=ticket.id, comment_id=comment.id, uploader_id=current_user.id) log_action(current_user.id, 'comment_create', 'comment', comment.id, f'ticket_id={ticket.id} internal={is_internal}') db.session.commit() logger.info(f'[COMMENT CREATE] comment_id={comment.id} ticket_id={ticket.id} by user_id={current_user.id}') notify_comment_added(comment) flash('Comment added.', 'success') return redirect(url_for('tickets.ticket_detail', ticket_id=ticket.id)) comments = Comment.query.filter_by(ticket_id=ticket.id) if not current_user.is_it_staff: comments = comments.filter_by(is_internal=False) comments = comments.order_by(Comment.created_at.asc()).all() it_staff = User.query.filter( User.role.in_([UserRole.IT_STAFF, UserRole.ADMIN]), User.is_active == True, ).all() if current_user.is_it_staff else [] history = ticket.history.order_by('changed_at').all() return render_template('tickets/detail.html', ticket=ticket, comments=comments, it_staff=it_staff, history=history, statuses=_statuses(), priorities=_priorities(), ) # ─── Update Ticket (IT Only) ────────────────────────────────────────────────── @tickets_bp.route('/tickets//update', methods=['POST']) @login_required def update_ticket(ticket_id): if not current_user.is_it_staff: abort(403) ticket = Ticket.query.get_or_404(ticket_id) old_status = ticket.status old_priority = ticket.priority old_assigned = ticket.assigned_to_id new_status = request.form.get('status', ticket.status) new_priority = request.form.get('priority', ticket.priority) new_assigned = request.form.get('assigned_to_id', type=int) internal_notes= request.form.get('internal_notes', ticket.internal_notes) resolution = request.form.get('resolution_notes', ticket.resolution_notes) due_date_str = request.form.get('due_date', '') changes = [] if new_status != old_status: ticket.status = new_status log_ticket_history(ticket, 'status', old_status, new_status, current_user.id) changes.append(f'status: {old_status} → {new_status}') if new_status == TicketStatus.RESOLVED: ticket.resolved_at = datetime.utcnow() elif new_status == TicketStatus.CLOSED: ticket.closed_at = datetime.utcnow() if new_priority != old_priority: ticket.priority = new_priority log_ticket_history(ticket, 'priority', old_priority, new_priority, current_user.id) changes.append(f'priority: {old_priority} → {new_priority}') if new_assigned != old_assigned: # Resolve user IDs to full names for human-readable history entries. # None means unassigned. def _user_label(uid): if uid is None: return 'Unassigned' u = db.session.get(User, uid) return u.full_name if u else f'User #{uid}' ticket.assigned_to_id = new_assigned log_ticket_history(ticket, 'assigned_to', _user_label(old_assigned), _user_label(new_assigned), current_user.id) changes.append(f'assigned_to: {old_assigned} → {new_assigned}') # notify_assignment is called AFTER commit below — see Fix #13. ticket.internal_notes = internal_notes ticket.resolution_notes = resolution if due_date_str: try: ticket.due_date = datetime.strptime(due_date_str, '%Y-%m-%d') except ValueError: pass log_action(current_user.id, 'ticket_update', 'ticket', ticket.id, f'changes=[{"; ".join(changes)}]') db.session.commit() logger.info(f'[TICKET UPDATE] ticket_id={ticket.id} changes={changes} by user_id={current_user.id}') # Both notification calls are placed after commit so that create_notification's # independent commit never races against an uncommitted ticket state. If the # parent commit above had failed, neither notification would be sent — which # is the correct behaviour (no notification for a change that did not persist). if new_assigned != old_assigned: notify_assignment(ticket, current_user) if new_status != old_status: notify_status_change(ticket, old_status, current_user) flash('Ticket updated successfully.', 'success') return redirect(url_for('tickets.ticket_detail', ticket_id=ticket.id)) # ─── Delete Comment (IT Only) ───────────────────────────────────────────────── @tickets_bp.route('/comments//delete', methods=['POST']) @login_required def delete_comment(comment_id): comment = Comment.query.get_or_404(comment_id) if not current_user.is_it_staff and comment.author_id != current_user.id: abort(403) ticket_id = comment.ticket_id log_action(current_user.id, 'comment_delete', 'comment', comment.id, f'ticket_id={ticket_id}') logger.info(f'[COMMENT DELETE] comment_id={comment.id} ticket_id={ticket_id} by user_id={current_user.id}') db.session.delete(comment) db.session.commit() flash('Comment deleted.', 'success') return redirect(url_for('tickets.ticket_detail', ticket_id=ticket_id)) # ─── Attachment Download ────────────────────────────────────────────────────── @tickets_bp.route('/attachments/') @login_required def download_attachment(att_id): att = Attachment.query.get_or_404(att_id) # Authorization: employees may only download attachments belonging to # their own tickets. IT staff have unrestricted access across all tickets. # att.ticket_id is the authoritative link — comment attachments also carry # the parent ticket_id, so this check covers both ticket and comment files. if not current_user.is_it_staff: ticket = Ticket.query.get_or_404(att.ticket_id) if ticket.created_by_id != current_user.id: logger.warning( f'[ATTACHMENT ACCESS DENIED] att_id={att_id} ticket_id={att.ticket_id} ' f'user_id={current_user.id}' ) abort(403) upload_dir = current_app.config['UPLOAD_FOLDER'] return send_from_directory(upload_dir, att.stored_name, as_attachment=True, download_name=att.filename) # ─── Notifications ──────────────────────────────────────────────────────────── @tickets_bp.route('/notifications') @login_required def notifications(): notifs = Notification.query.filter_by(user_id=current_user.id).order_by( Notification.created_at.desc()).paginate(page=request.args.get('page', 1, type=int), per_page=30) return render_template('tickets/notifications.html', notifs=notifs) @tickets_bp.route('/notifications/mark-read', methods=['POST']) @login_required def mark_notifications_read(): Notification.query.filter_by(user_id=current_user.id, is_read=False).update({'is_read': True}) db.session.commit() return redirect(request.referrer or url_for('tickets.notifications')) # ─── Knowledge Base ─────────────────────────────────────────────────────────── @tickets_bp.route('/kb') @login_required def knowledge_base(): q = request.args.get('q', '').strip() category = request.args.get('category', '') sort = request.args.get('sort', 'popular') # 'popular' | 'newest' query = KnowledgeBase.query.filter_by(is_published=True) if q: query = query.filter( KnowledgeBase.title.ilike(f'%{q}%') | KnowledgeBase.tags.ilike(f'%{q}%') ) if category: query = query.filter_by(category=category) if sort == 'newest': query = query.order_by(KnowledgeBase.updated_at.desc()) else: query = query.order_by(KnowledgeBase.view_count.desc()) articles = query.all() categories = sorted({a.category for a in KnowledgeBase.query.filter_by(is_published=True).with_entities(KnowledgeBase.category).distinct() if a.category}) return render_template('tickets/knowledge_base.html', articles = articles, categories = categories, q = q, sel_category = category, sort = sort, ) @tickets_bp.route('/kb/') @login_required def kb_article(article_id): article = KnowledgeBase.query.get_or_404(article_id) # Increment view_count atomically at the SQL level. A Python-level # read-modify-write (article.view_count += 1) is not safe under concurrent # requests: two simultaneous reads both see the same value and one # increment is silently lost. The SQL expression KnowledgeBase.view_count + 1 # delegates the addition to the database, which serialises it correctly. from sqlalchemy import update as sa_update db.session.execute( sa_update(KnowledgeBase) .where(KnowledgeBase.id == article_id) .values(view_count=KnowledgeBase.view_count + 1) ) db.session.commit() # Re-fetch so the template receives the post-increment value. db.session.refresh(article) return render_template('tickets/kb_article.html', article=article) # ─── Helpers ───────────────────────────────────────────────────────────────── def _statuses(): return [TicketStatus.OPEN, TicketStatus.IN_PROGRESS, TicketStatus.PENDING, TicketStatus.RESOLVED, TicketStatus.CLOSED] def _priorities(): return [TicketPriority.LOW, TicketPriority.MEDIUM, TicketPriority.HIGH, TicketPriority.CRITICAL] def _categories(): return [TicketCategory.HARDWARE, TicketCategory.SOFTWARE, TicketCategory.NETWORK, TicketCategory.ACCESS, TicketCategory.EMAIL, TicketCategory.PRINTER, TicketCategory.PHONE, TicketCategory.SECURITY, TicketCategory.OTHER]