toga-ai 1.0.502 → 1.0.503

package/knowledge/1.0/apps/togadesk/INDEX.md

@@ -7,6 +7,7 @@
 | [Field-Service Dispatch (central / repair orders)](features/field-service-dispatch.md) | The **central** subsystem is TOGa Desk's field-service dispatch domain: repair-order lifecycle, technician scheduling, onsite vs depot service, parts, and shipm | desk/includes/controllers/actions/central/, desk/includes/classes/class.repair.php, desk/includes/classes/class.repairhistory.php, desk/_/browser/datatable/central.php, desk/template/pages/central.php, desk/template/pages/central/view.php, desk/template/modals/central/addTracking.php, library/app/model/togadesk/repairorder.php, library/app/model/togadesk/repairordertracking.php, library/app/api/carrier/ups.php |
 | [Managed Service Order Create Flow (New MSO modal → tickets/add)](features/managed-service-order-create.md) | The **Managed Service Order (MSO) create flow** is how a TOGa Desk user manually creates a managed service order: pick an End User (or a Client Location), choos | desk/includes/controllers/actions/tickets/add.php, desk/template/modals/tickets/addNew.php, desk/template/pages/managed.php, desk/template/pages/getinfo.php, desk/template/footer.php, library/app/model/togadesk/repairorder.php |
 | [Ticket Email Notifications (notifications table)](features/notifications.md) | Which TOGa Desk emails fire for a given client is driven **entirely by data**, not code: the `TOGaDeskSupport.notifications` table holds one row per `(clientid, | desk/includes/classes/class.notification.php, crons/tickets.php, crons/tickets_prod.php |
+| [Per-Client Hostname Restriction (getRestrictedClient)](features/per-client-host-restriction.md) | TOGa Desk supports **per-client branded URLs** (e.g. | desk/includes/functions.php, desk/template/header.php, _/browser/datatable/tickets, desk/includes/classes/class.ticket.php, ebs/setup_phpini.php, ebs/http_to_https.php, desk/template/modals/kb/viewDocument.php, desk/template/modals/files/aws-view.php, desk/template/modals/files/contract-view.php, template/pages/documents/view.php, template/pages/tasks/view.php |
 | [REST API (RPC-over-POST) & API-Key Auth](features/rest-api.md) | TOGa Desk exposes a programmatic API at `desk/api/`. | desk/api/index.php, desk/api/resources/tickets.php, desk/api/resources/assets.php, desk/api/resources/authenticate.php, desk/includes/classes/class.apikey.php, desk/includes/functions.php |
 | [SMB Contract Editing & the clientMspId Corruption Trap](features/smb-contract-editing.md) | The SMB contracts page (`/desk/?route=toga/smbcontracts&togaClientId=<id>`) edits `TOGA_*.SMBContracts` rows via a modal. | desk/template/modals/toga/smbcontracts/smbContract.php, desk/includes/controllers/modals/toga/smbcontracts/smbContract.php, desk/includes/controllers/actions/toga/smbcontracts/smbContract.php, desk/includes/controllers/actions/toga/smbcontracts/edit.php |
 | [Ticket Lifecycle (class.ticket.php)](features/ticket-lifecycle.md) | All TOGa Desk ticket creation and reply handling funnels through `Ticket` in `desk/includes/classes/class.ticket.php`. | desk/includes/classes/class.ticket.php, desk/includes/controllers/actions.php, desk/includes/controllers/actions/tickets/addReply.php, desk/api/resources/tickets.php, desk/api/resources/ticket_replies.php, crons/tickets.php, crons/pipe.php, desk/includes/controllers/actions/tickets/merge.php |

package/knowledge/1.0/apps/togadesk/features/per-client-host-restriction.md

@@ -0,0 +1,107 @@
+---
+title: Per-Client Hostname Restriction (getRestrictedClient)
+framework: "1.0"
+repo: togadesk
+project: TOGa Desk
+client: shared
+type: feature
+status: active
+updated: 2026-08-04
+owners: ["mhammontree"]
+files:
+  - desk/includes/functions.php
+  - desk/template/header.php
+  - _/browser/datatable/tickets
+  - desk/includes/classes/class.ticket.php
+  - ebs/setup_phpini.php
+  - ebs/http_to_https.php
+  - desk/template/modals/kb/viewDocument.php
+  - desk/template/modals/files/aws-view.php
+  - desk/template/modals/files/contract-view.php
+  - template/pages/documents/view.php
+  - template/pages/tasks/view.php
+related:
+  - ../architecture.md
+  - ../../togaview/architecture.md
+---
+
+## Summary
+
+TOGa Desk supports **per-client branded URLs** (e.g. `rumcsi.togadesk.togatech.com`). The whole
+mechanism is host-based: `getRestrictedClient()` in `desk/includes/functions.php` (~L1513-1592)
+derives a single "restricted client" from the request hostname, and `restrictByClient()` (L1508)
+is the gate used throughout the UI. Adding a new per-client URL is therefore **one switch case
+plus a lot of non-application work** (cert, sessions, hardcoded legacy domains).
+
+This contradicts the impression that togadesk has no host-based logic — it does, and this is the
+only place a new subdomain gets registered.
+
+## How it works
+
+1. `getRestrictedClient()` lowercases `$_SERVER['HTTP_HOST']`, strips the port, and matches a long
+   **hardcoded switch of per-client subdomains**, returning a `CLIENT_*` constant or `null`.
+2. Client-ID constants are defined in the same file (~L1488-1506):
+   `CLIENT_AGILANT=2`, `CLIENT_OFFICEDEPOT=3`, `CLIENT_RUMCSI=146`, `CLIENT_IMHOUSTON=167`,
+   `CLIENT_FORDHAM=179`.
+3. `restrictByClient()` (L1508) wraps that result and gates:
+   - navigation/menus in `desk/template/header.php` (~L1638-1665), and
+   - the ticket datatables under `_/browser/datatable/tickets/*`.
+4. Post-login data filtering keys off the **session `clientid`**, not the host — the host
+   restriction is a UI/entry gate, not the record-level tenancy boundary.
+
+**TOGa View resolves its host separately.** `togaview/_/app/framework.php` has its own
+`switch($_SERVER['HTTP_HOST'])` that sets `$_SESSION['stylePath']` and selects the RUMCSI SAML
+branch; an unregistered hostname falls through to default branding and **skips SAML**. So a
+togadesk-side DNS record is safe on its own, but any new *togaview* hostname must be added there
+too. _(Carried from the togaview architecture doc — not re-verified in code on 2026-08-04.)_
+
+## Adding a new per-client TOGa Desk URL — checklist
+
+The app code is the easy part. What actually bites:
+
+- **Register the host** in the `getRestrictedClient()` switch (and add a `CLIENT_*` constant if the
+  client is new). Verified 2026-08-04: `rumcsi.togadesk.togatech.com` is **already a case**, so the
+  RUMCSI AWS DNS record needs no code change.
+- **TLS cert.** A 4-label host such as `rumcsi.togadesk.togatech.com` is **not** covered by a
+  `*.togatech.com` wildcard. You need `*.togadesk.togatech.com` or an exact SAN on the ALB
+  listener, plus a host-header rule.
+- **Sessions log everyone out on a domain change.** `ebs/setup_phpini.php` sets
+  `session.save_handler=rediscluster` but sets **no `session.cookie_domain`**, and there is no
+  `session_set_cookie_params()` anywhere — the cookie is host-scoped. Worse, `people.sessionid` is a
+  **single column**, so logging in on a second domain invalidates the session on the first.
+- **Smoke-test Office document previews.** `desk/template/modals/kb/viewDocument.php`,
+  `modals/files/aws-view.php`, `modals/files/contract-view.php`, `template/pages/documents/view.php`
+  and `template/pages/tasks/view.php` embed `https://{HTTP_HOST}/...` into third-party viewers
+  (`docs.google.com/gview`, `view.officeapps.live.com`) which fetch **server-side**. On a host with
+  an untrusted cert, Word/Excel/PPT previews fail **silently** while same-origin PDF iframes still
+  work — making this the best post-cutover check.
+- **Keep the old domain resolvable.** `class.ticket.php` L485-486 and L886-887 hardcode
+  `https://togadesk[-env].agilantsolutions.com/uploads/` when rewriting inline ticket images, so
+  outbound ticket emails keep serving images from the old domain. Other hardcoded legacy domains:
+  `csat.agilantsolutions.com`, `toga.agilantsolutions.com`,
+  `yourcloudhq.togaview.agilantsolutions.com`, and `toga_payment_easyurl` / `fullurl` in every
+  `config.*.ini`.
+
+## Gotchas / known issues
+
+- **Cross-tenant login hole (pre-existing, NOT fixed — deserves its own ticket).** The
+  password-login access condition in `desk/includes/functions.php` (~L627-631) is a chain of ORs,
+  and two clauses grant access **regardless of which client's subdomain is in use**:
+  `getRestrictedClient() != CLIENT_AGILANT && $restrictedClientId == CLIENT_IMHOUSTON` lets an IM
+  Houston user log in on the RUMCSI host, and
+  `getRestrictedClient() != CLIENT_FORDHAM && $restrictedClientId == CLIENT_FORDHAM` does the same
+  for Fordham. Post-login filtering keys off the session `clientid`, so it is not an immediate
+  record leak, but it **defeats the per-client URL restriction and contradicts the comment directly
+  above it** (L627-629). Recommended fix: replace with an explicit per-restricted-client allowlist
+  using guard clauses. Anyone touching login or adding a client URL must know this.
+- **`siteURL()` emits `http://` behind the ALB.** `desk/includes/functions.php` (~L22-31) only emits
+  `https` when `$_SERVER['HTTPS'] == 'on'`; behind the ALB only `X-Forwarded-Proto` is set (see
+  `ebs/http_to_https.php`). It currently has **no callers** in togadesk — a latent trap for any new
+  absolute-link code.
+- The host switch and the client-ID constants are hardcoded — there is no DB-driven mapping, so
+  every new branded URL is a code change.
+
+## Change history
+
+- 2026-08-04 — Documented from a read-only review (TRUE-80139) of the RUMCSI branded-URL cutover;
+  recorded the add-a-hostname checklist and the cross-tenant login hole. No code changed. (mhammontree)

package/knowledge/INDEX.md

@@ -8,7 +8,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 - **worker** (Worker) — 18 doc(s) → [1.0/apps/worker/INDEX.md](1.0/apps/worker/INDEX.md)
 - **dbchanges** (Database Changes) _(framework core)_ — 1 doc(s) → [1.0/apps/dbchanges/INDEX.md](1.0/apps/dbchanges/INDEX.md)
 - **worker1.5** (Worker 1.5) — 0 doc(s) → [1.0/apps/worker1.5/INDEX.md](1.0/apps/worker1.5/INDEX.md)
-- **togadesk** (TOGa Desk) — 10 doc(s) → [1.0/apps/togadesk/INDEX.md](1.0/apps/togadesk/INDEX.md)
+- **togadesk** (TOGa Desk) — 11 doc(s) → [1.0/apps/togadesk/INDEX.md](1.0/apps/togadesk/INDEX.md)
 - **togaview** (TOGa View) — 6 doc(s) → [1.0/apps/togaview/INDEX.md](1.0/apps/togaview/INDEX.md)
 - **webhook** (Webhook) — 1 doc(s) → [1.0/apps/webhook/INDEX.md](1.0/apps/webhook/INDEX.md)
 - **walmarttechservices** (Walmart Tech Services) — 1 doc(s) → [1.0/apps/walmarttechservices/INDEX.md](1.0/apps/walmarttechservices/INDEX.md)
@@ -56,6 +56,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 - **Prudential Financial** (`prudential`) → [clients/prudential/INDEX.md](clients/prudential/INDEX.md)
 - **Quad Graphics** (`quad`) → [clients/quad/INDEX.md](clients/quad/INDEX.md)
 - **Rate** (`rate`) → [clients/rate/INDEX.md](clients/rate/INDEX.md)
+- **Richmond University Medical Center** (`rumcsi`) → [clients/rumcsi/INDEX.md](clients/rumcsi/INDEX.md)
 - **Tow Foundation** (`tow-foundation`) → [clients/tow-foundation/INDEX.md](clients/tow-foundation/INDEX.md)
 - **TOGA Technology** (`true`) → [clients/true/INDEX.md](clients/true/INDEX.md)
 - **Walmart Client Profile** (`walmart`) → [clients/walmart/INDEX.md](clients/walmart/INDEX.md)

package/knowledge/clients/rumcsi/INDEX.md

@@ -0,0 +1,5 @@
+# Client: Richmond University Medical Center `rumcsi`
+
+| Doc | Framework | Summary | Files |
+|-----|-----------|---------|-------|
+| [Richmond University Medical Center](profile.md) | 1.0 | Richmond University Medical Center (**RUMCSI**) is a framework **1.0** client served by **TOGa Desk** (staff/analyst side) and **TOGa View** (client portal). |  |

package/knowledge/clients/rumcsi/profile.md

@@ -0,0 +1,44 @@
+---
+title: "Richmond University Medical Center"
+framework: "1.0"
+apps:
+  - togadesk
+  - togaview
+  - library
+project: TOGa Desk
+client: rumcsi
+type: profile
+status: active
+updated: 2026-08-04
+owners: ["mhammontree"]
+files: []
+related:
+  - ../../1.0/apps/togadesk/features/per-client-host-restriction.md
+  - ../../1.0/apps/togadesk/architecture.md
+  - ../../1.0/apps/togaview/architecture.md
+---
+
+## Summary
+
+Richmond University Medical Center (**RUMCSI**) is a framework **1.0** client served by
+**TOGa Desk** (staff/analyst side) and **TOGa View** (client portal). Its TOGa Desk
+`clients.clientId` is **146**, exposed in code as the constant `CLIENT_RUMCSI` in
+`desk/includes/functions.php`.
+
+## Platform footprint
+
+- **Branded per-client URL.** RUMCSI is one of the clients gated by TOGa Desk's host-based
+  restriction: `rumcsi.togadesk.togatech.com` is already a case in `getRestrictedClient()`, which
+  returns `CLIENT_RUMCSI` and drives `restrictByClient()` nav/menu and ticket-datatable scoping.
+  See [Per-client hostname restriction](../../1.0/apps/togadesk/features/per-client-host-restriction.md)
+  for the full add-a-hostname checklist (cert scope, host-scoped sessions, hardcoded legacy domains).
+- **TOGa View SAML.** `togaview/_/app/framework.php` has a RUMCSI-specific host branch that selects
+  branding (`$_SESSION['stylePath']`) and the SAML login path — an unregistered togaview hostname
+  falls through to default branding and skips SAML.
+- **Hardcoded client-ID branching.** RUMCSI appears in TOGa Desk's hardcoded client-ID branching
+  (`central` dispatch, `tickets/add`) — verify the RUMCSI arm before changing shared logic.
+
+## Change history
+
+- 2026-08-04 — Client profile created during the TRUE-80139 read-only review of the RUMCSI branded
+  TOGa Desk URL. (mhammontree)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.502",
+  "version": "1.0.503",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",