toga-ai 1.0.503 → 1.0.504

package/knowledge/sessions/2026-08-04-true-80139-togadesk-rumcsi-url-review-mhammontree.md

@@ -0,0 +1,64 @@
+---
+type: session
+slug: true-80139-togadesk-rumcsi-url-review
+title: TRUE-80139 — impact review of new RUMCSI togadesk hostname
+author: mhammontree
+repos: [togadesk, togaview, library]
+framework: "1.0"
+client: rumcsi
+status: active
+created: 2026-08-04
+updated: 2026-08-04
+---
+
+# Session: true-80139-togadesk-rumcsi-url-review
+**Date:** 2026-08-04
+**Project/Repo:** togadesk (1.0)
+**Task:** TRUE-80139 — a new AWS DNS record was created so `https://rumcsi.togadesk.togatech.com` resolves; review the TOGa Desk 1.0 code to determine whether the new hostname breaks or degrades the RUMCSI (Richmond University Medical Center, clientId 146) experience. Read-only review — no code was changed.
+
+---
+
+## What WORKED
+- **Confirmed the new hostname needs no code change.** `getRestrictedClient()` in `togadesk/desk/includes/functions.php` (~L1513-1592) lowercases `HTTP_HOST`, strips the port (L1516), and matches a hardcoded switch of per-client subdomains. `rumcsi.togadesk.togatech.com` is **already** a case at L1538 returning `CLIENT_RUMCSI` (=146, L1498). Evidence: read the switch directly; the `.togatech.com` variants for all 7 envs are present alongside the legacy `.agilantsolutions.com` ones.
+- **Traced what the restriction actually gates.** `restrictByClient()` (L1508) drives nav/menu visibility in `togadesk/desk/template/header.php` (~L1638-1665: policies, issues) and the ticket datatables in `togadesk/_/browser/datatable/tickets/{all,active,highpriority,awaitingreply}.php` (each at ~L36 and ~L240). Record-level tenancy comes from the session `clientid`, not the host — confirmed via `_/app/ajax.php` and `desk/includes/controllers/modals.php` which branch on `$liu['clientid'] == CLIENT_RUMCSI`.
+- **Confirmed the HTTPS redirect is host-preserving.** `togadesk/ebs/http_to_https.php` writes `RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}` keyed off `X-Forwarded-Proto` — no hardcoded domain, so it follows the new host.
+- **Confirmed no SAML/SSO redirect-URI exposure in togadesk.** Grepped all `config.*.ini` for `saml|acs|entityid|sso` — zero hits. TOGa Desk's AD login is direct LDAP bind (`.ebextensions/008_setup_ldap.config`), which has no per-host callback URL to re-register. (The SAML concern is a *togaview* concern, not togadesk.)
+- **Confirmed no host allowlist at the web-server layer.** `ebs/apache_settings.php` only tunes prefork/MaxRequestWorkers; root `.htaccess` is empty. Nothing rejects an unrecognized `Host` header.
+- **Capture published.** `knowledge/1.0/apps/togadesk/features/per-client-host-restriction.md` and `knowledge/clients/rumcsi/profile.md` created and pushed to `_main` (validate OK, 30 repos; index rebuilt, 312 docs; mirrored to `C:\WWW\.claude\knowledge`).
+
+## What did NOT work — DO NOT RETRY THESE
+- **Do NOT trust the `context-primer` briefing on this topic — it was wrong.** The primer asserted "TogaDesk (`desk/`) is staff-only — it resolves the logged-in user via session, not via subdomain/hostname… there isn't any host-based branching in TogaDesk architecture doc," and concluded a new hostname "doesn't map into TogaDesk's client-selection logic at all." That is false: `getRestrictedClient()` is exactly that logic. The primer was faithfully reporting `knowledge/1.0/apps/togadesk/architecture.md`, which **still** describes the request pipeline as having no host-based logic. Root cause is the stale architecture doc, not the agent. Read `desk/includes/functions.php` L1508-1592 as ground truth.
+- **Searching `config.*.ini` for the session cookie domain found nothing** — not a failed approach so much as a null result worth not repeating: there is no `session.cookie_domain` and no `session_set_cookie_params()` anywhere in the repo. `ebs/setup_phpini.php` sets only `session.save_handler=rediscluster`, `session.save_path` (the `asi-session-cache` cluster endpoint), and `session.gc_maxlifetime=345600`. Cookie scoping is therefore PHP's host-only default, by omission.
+
+## Not tried yet (candidates for next session)
+- **Verify the TLS cert and ALB listener rule** for the 4-label host `rumcsi.togadesk.togatech.com`. A `*.togatech.com` wildcard does **not** cover it — it needs `*.togadesk.togatech.com` or that exact SAN, plus a host-header rule routing to the togadesk environment. Not verifiable from this repo; `ebs/register_instance_to_shared_application_load_balancer.php` contains no host/rule logic (grepped: zero matches for host|rule|rumcsi|togadesk).
+- **Post-cutover smoke test of Office document previews.** `desk/template/modals/kb/viewDocument.php` (~L28) and `desk/template/modals/files/aws-view.php` (~L21), plus `desk/template/modals/files/contract-view.php`, `template/pages/documents/view.php` (~L38), `template/pages/tasks/view.php` (~L48) embed `https://{HTTP_HOST}/...` into `docs.google.com/gview` and `view.officeapps.live.com`, which fetch **server-side**. An untrusted cert breaks Word/Excel/PPT previews silently while same-origin PDF iframes keep working. Test one Office doc on the new host.
+- **Fix the cross-tenant login hole** at `desk/includes/functions.php` ~L627-631 — needs its own ticket (see Decisions).
+- **Apply the 4 held edits to `knowledge/1.0/apps/togadesk/architecture.md`** — drafted by the capture agent, unapplied, still accurate. Needs `jcardinal`'s sign-off (co-owner).
+- **Check whether RUMCSI end users were also given a togaview hostname.** `togaview/_/app/framework.php` has its own `switch ($_SERVER['HTTP_HOST'])` setting `$_SESSION['stylePath']` and the rumcsi SAML branch; an unregistered host falls through to default branding and skips SAML. Not read this session — sourced from the togaview architecture doc, so treat as unverified.
+- **Decide the fate of the legacy `agilantsolutions.com` domain.** `desk/includes/classes/class.ticket.php` L485-486 and L886-887 hardcode `https://togadesk[-env].agilantsolutions.com/uploads/` when rewriting inline ticket images, so outbound ticket emails keep serving images from the old domain regardless of which host the staff member used. Other hardcoded old-domain links: `csat.agilantsolutions.com` (`class.ticket.php` L902, `class.repair.php` L605), `toga.agilantsolutions.com` (`desk/template/pages/tickets/manage.php` L1203, `toga/smbcontracts/manage.php` L106), `yourcloudhq.togaview.agilantsolutions.com` (`toga/smbcontracts/resendemail.php` L36, `resendToAllEmail.php` L38), and `toga_payment_easyurl`/`toga_payment_fullurl` in every `config.*.ini`.
+
+## Current file state
+| File | Status | Notes |
+|------|--------|-------|
+| `togadesk/**` | unchanged | Read-only review. No source file was created, modified, or deleted this session. |
+| `knowledge/1.0/apps/togadesk/features/per-client-host-restriction.md` | created + pushed | Owns all findings: host resolution, add-a-hostname checklist, `siteURL()` trap, cross-tenant login hole, togaview switch (flagged unverified). |
+| `knowledge/clients/rumcsi/profile.md` | created + pushed | New client onboarding — "Richmond University Medical Center", clientId 146 / `CLIENT_RUMCSI`, `apps: [togadesk, togaview, library]`. |
+| `knowledge/1.0/apps/togadesk/architecture.md` | **NOT modified — 4 edits held** | Elevated, co-owned by `jcardinal`. Held edits: bump `updated` to 2026-08-04; add `desk/includes/functions.php`, `desk/template/header.php`, `ebs/setup_phpini.php` to `files:` and the new feature doc to `related:`; add a host-based-restriction bullet under "Entry points & request pipeline"; add two Gotchas bullets (cross-tenant login hole, host-scoped sessions). Doc currently still claims the pipeline has no host-based logic — **incorrect**. |
+| `.claude/toga-ai.version` | updated | Harness auto-updated v1.0.500 → v1.0.502 during `/kickoff` Step 0. |
+
+## Decisions made
+- **Closed TRUE-80139 as no-code-change-required.** Rationale: the hostname is already registered in `getRestrictedClient()`, and Jonathan confirmed the site works with no issues observed. Rejected alternative: adding the host to the switch — unnecessary, it is already there at L1538.
+- **The cross-tenant login hole gets its own ticket, not a fix inside TRUE-80139.** At `desk/includes/functions.php` ~L627-631 the access condition is a chain of ORs; two clauses grant access regardless of which client's subdomain is in use — `(getRestrictedClient() != CLIENT_AGILANT && $restrictedClientId == CLIENT_IMHOUSTON)` lets an IM Houston user (167) log in on the RUMCSI host, and `(getRestrictedClient() != CLIENT_FORDHAM && $restrictedClientId == CLIENT_FORDHAM)` lets a Fordham user (179) do the same. Post-login filtering keys off the session `clientid`, so it is not an immediate record leak, but it defeats the per-client URL restriction and contradicts the comment directly above it at L627-629. Rationale for separating: pre-existing, not a regression from the DNS change, and the fix (an explicit per-restricted-client allowlist with guard clauses) is a behavior change needing its own testing. Rejected alternative: fixing it inline — would have expanded a read-only review into an auth change on a live client host.
+- **Published the two RUMCSI docs but held the `architecture.md` edits.** Rationale: the developer approved "the docs for RUMCSI"; `architecture.md` is co-owned by `jcardinal` and the edits are cross-references, so nothing substantive is lost by holding them — every finding lives in the feature doc. Rejected alternative: pushing all three — would have edited a senior-owned doc on an ambiguous approval.
+- **Treated "users will be logged out" as expected, not a defect.** Sessions are host-scoped by cookie default and `people.sessionid` is a single column updated on login (`functions.php` L635), so a domain switch forces re-login and a second-domain login invalidates the first session. Rationale: correct multi-tenant behavior; scoping the cookie to `.togatech.com` would share sessions across every client subdomain, which is worse.
+
+## Blockers
+- **`architecture.md` correction is blocked on `jcardinal`** (co-owner of an elevated doc). Until applied, the doc actively misleads: it says the TOGa Desk request pipeline has no host-based logic, which is what sent the `context-primer` down the wrong path this session.
+- **Cert/ALB verification is blocked on AWS access** — not answerable from the togadesk repo. Jonathan's confirmation that the site works is strong evidence the cert and listener rule are already correct, but the Office-preview path (third-party server-side fetch) has not been exercised.
+
+## Exact next step
+> Open a new ticket for the cross-tenant login hole at `togadesk/desk/includes/functions.php` L631, quoting the two offending OR clauses (`$restrictedClientId == CLIENT_IMHOUSTON` and `$restrictedClientId == CLIENT_FORDHAM`), and propose replacing the whole condition with an explicit per-restricted-client allowlist using guard clauses. Then ping `jcardinal` to approve the 4 held edits to `knowledge/1.0/apps/togadesk/architecture.md` (drafted in this session's capture — re-run `/capture` in `apply-approved` mode once he signs off).
+
+---
+_Saved by /session-save on 2026-08-04_

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.503",
+  "version": "1.0.504",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",