111 lines
4.2 KiB
PHP
111 lines
4.2 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Modules\Helpdesk\Http\Controllers;
|
|
|
|
use App\Http\Controllers\Controller;
|
|
use Illuminate\Http\RedirectResponse;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\Auth;
|
|
use Illuminate\Support\Facades\Gate;
|
|
use Illuminate\Support\Str;
|
|
use Illuminate\Validation\Rule;
|
|
use Modules\Helpdesk\Models\CannedResponse;
|
|
use Modules\Helpdesk\Models\Ticket;
|
|
use Modules\Helpdesk\Services\CannedResponseRenderer;
|
|
use Modules\Helpdesk\Services\TicketService;
|
|
|
|
final class TicketCommentStoreController extends Controller
|
|
{
|
|
/**
|
|
* Store a ticket conversation comment or nested reply using a normal HTTP POST.
|
|
*
|
|
* This keeps the conversation workflow reliable when rich-editor, Flux, or
|
|
* Livewire JavaScript event handling does not invoke the Livewire method.
|
|
*/
|
|
public function __invoke(Request $request, Ticket $ticket, TicketService $tickets, CannedResponseRenderer $renderer): RedirectResponse
|
|
{
|
|
Gate::authorize('comment', $ticket);
|
|
|
|
$maxUploadKilobytes = (int) config('helpdesk.max_upload_kb', 10240);
|
|
$allowedMimes = (array) config('helpdesk.allowed_mimes', ['jpg', 'jpeg', 'png', 'pdf', 'txt', 'log', 'zip']);
|
|
|
|
$validated = $request->validate([
|
|
'commentBody' => ['nullable', 'string'],
|
|
'internal' => ['nullable', 'boolean'],
|
|
'parent_id' => [
|
|
'nullable',
|
|
'integer',
|
|
Rule::exists('helpdesk_comments', 'id')->where('ticket_id', $ticket->id),
|
|
],
|
|
'canned_response_id' => ['nullable', 'integer', Rule::exists('helpdesk_canned_responses', 'id')],
|
|
'attachments' => ['nullable', 'array'],
|
|
'attachments.*' => ['file', 'max:'.$maxUploadKilobytes, 'mimes:'.implode(',', $allowedMimes)],
|
|
]);
|
|
|
|
$user = Auth::user();
|
|
abort_if($user === null, 403);
|
|
|
|
$body = trim((string) ($validated['commentBody'] ?? ''));
|
|
|
|
if ($body === '' && filled($validated['canned_response_id'] ?? null)) {
|
|
$response = CannedResponse::query()
|
|
->where('is_active', true)
|
|
->findOrFail((int) $validated['canned_response_id']);
|
|
|
|
$body = trim($response->body);
|
|
}
|
|
|
|
$body = $this->normaliseHtmlBody($renderer->render($body, $ticket, $user));
|
|
|
|
validator(['commentBody' => $body], [
|
|
'commentBody' => ['required', 'string', 'min:2'],
|
|
])->validate();
|
|
|
|
$uploadedFiles = $request->file('attachments', []);
|
|
$uploadedFiles = is_array($uploadedFiles) ? $uploadedFiles : [$uploadedFiles];
|
|
|
|
$tickets->comment(
|
|
ticket: $ticket,
|
|
user: $user,
|
|
body: $body,
|
|
internal: (bool) ($validated['internal'] ?? false) && $this->userCanCreateInternalNote($user),
|
|
files: $uploadedFiles,
|
|
parentId: filled($validated['parent_id'] ?? null) ? (int) $validated['parent_id'] : null,
|
|
);
|
|
|
|
return redirect()
|
|
->route('helpdesk.tickets.show', $ticket)
|
|
->with('ticket-comment-added', filled($validated['parent_id'] ?? null) ? 'Reply posted.' : 'Comment posted.');
|
|
}
|
|
/**
|
|
* Keep supported formatting tags but strip scripts and unsafe inline handlers.
|
|
*/
|
|
private function normaliseHtmlBody(string $body): string
|
|
{
|
|
$body = html_entity_decode($body, ENT_QUOTES | ENT_HTML5, 'UTF-8');
|
|
$body = preg_replace('/<\s*(script|style)[^>]*>.*?<\s*\/\s*\1\s*>/is', '', $body) ?: '';
|
|
$body = preg_replace('/\s+on[a-z]+\s*=\s*("[^"]*"|\'[^\']*\'|[^\s>]+)/i', '', $body) ?: '';
|
|
$body = preg_replace('/javascript\s*:/i', '', $body) ?: '';
|
|
|
|
return trim(strip_tags($body, '<p><br><strong><b><em><i><u><ul><ol><li><blockquote><pre><code><a>'));
|
|
}
|
|
|
|
/**
|
|
* Internal notes are restricted to MPBA/core-company users.
|
|
*/
|
|
private function userCanCreateInternalNote(mixed $user): bool
|
|
{
|
|
$company = $user?->company;
|
|
|
|
if ($company === null) {
|
|
return false;
|
|
}
|
|
|
|
return (bool) ($company->is_system_company ?? false)
|
|
|| Str::lower((string) ($company->slug ?? '')) === 'mpba-limited'
|
|
|| Str::contains(Str::lower((string) ($company->name ?? '')), 'mpba');
|
|
}
|
|
}
|