toga-ai 1.0.514 → 1.0.516

package/knowledge/1.0/apps/togadesk/INDEX.md

@@ -2,7 +2,7 @@
 
 | Doc | Summary | Files |
 |-----|---------|-------|
-| [TOGa Desk Architecture](architecture.md) | TOGa Desk is the staff-facing support desk **and field-service platform** (analysts work at `/desk/`). | desk/index.php, desk/includes/loader.php, desk/config.php, desk/includes/controllers/actions.php, desk/includes/controllers/data.php, desk/includes/controllers/modals.php, desk/includes/classes/class.app.php, desk/includes/classes/class.ticket.php, desk/api/index.php, desk/api/resources/tickets.php, crons/tickets.php |
+| [TOGa Desk Architecture](architecture.md) | TOGa Desk is the staff-facing support desk **and field-service platform** (analysts work at `/desk/`). | desk/index.php, desk/includes/loader.php, desk/config.php, desk/includes/controllers/actions.php, desk/includes/controllers/data.php, desk/includes/controllers/modals.php, desk/includes/classes/class.app.php, desk/includes/classes/class.ticket.php, desk/api/index.php, desk/api/resources/tickets.php, crons/tickets.php, desk/includes/functions.php, desk/template/header.php, ebs/setup_phpini.php |
 | [Email-to-Ticket Intake (crons/tickets.php)](features/email-to-ticket-intake.md) | TOGa Desk ingests support email into tickets through a cron-driven IMAP poller (`crons/tickets.php`) plus a postfix pipe variant (`crons/pipe.php`). | crons/tickets.php, crons/tickets_prod.php, crons/pipe.php, desk/includes/classes/class.ticket.php, vendor/classes/class.imap.php |
 | [Field-Service Dispatch (central / repair orders)](features/field-service-dispatch.md) | The **central** subsystem is TOGa Desk's field-service dispatch domain: repair-order lifecycle, technician scheduling, onsite vs depot service, parts, and shipm | desk/includes/controllers/actions/central/, desk/includes/classes/class.repair.php, desk/includes/classes/class.repairhistory.php, desk/_/browser/datatable/central.php, desk/template/pages/central.php, desk/template/pages/central/view.php, desk/template/modals/central/addTracking.php, library/app/model/togadesk/repairorder.php, library/app/model/togadesk/repairordertracking.php, library/app/api/carrier/ups.php |
 | [Managed Service Order Create Flow (New MSO modal → tickets/add)](features/managed-service-order-create.md) | The **Managed Service Order (MSO) create flow** is how a TOGa Desk user manually creates a managed service order: pick an End User (or a Client Location), choos | desk/includes/controllers/actions/tickets/add.php, desk/template/modals/tickets/addNew.php, desk/template/pages/managed.php, desk/template/pages/getinfo.php, desk/template/footer.php, library/app/model/togadesk/repairorder.php |

package/knowledge/1.0/apps/togadesk/architecture.md

@@ -6,7 +6,7 @@ project: TOGa Desk
 client: shared
 type: architecture
 status: active
-updated: 2026-06-15
+updated: 2026-08-04
 owners: ["mhammontree", "jcardinal"]
 files:
   - desk/index.php
@@ -20,7 +20,11 @@ files:
   - desk/api/index.php
   - desk/api/resources/tickets.php
   - crons/tickets.php
+  - desk/includes/functions.php
+  - desk/template/header.php
+  - ebs/setup_phpini.php
 related:
+  - 1.0/apps/togadesk/features/per-client-host-restriction.md
   - 1.0/apps/togaview/architecture.md
   - 1.0/apps/togadesk/features/ticket-lifecycle.md
   - 1.0/apps/togadesk/features/smb-contract-editing.md
@@ -65,6 +69,12 @@ sibling repo `togaview`).
   | actions | `?action=` | `controllers/actions.php` | CRUD; `isAuthorized()` → domain class → status code → `reroute()` |
   | data | always | `controllers/data.php` | populate page context; route-specific `controllers/data/<route>.php` |
 - **Render** (when no modal/qa): `template/header.php` + `template/pages/<route>.php` + `template/footer.php`.
+- **Host-based per-client restriction.** `getRestrictedClient()` in `desk/includes/functions.php`
+  (~L1513-1592) maps the request `HTTP_HOST` to a `CLIENT_*` constant via a hardcoded switch
+  (e.g. `rumcsi.togadesk.togatech.com` → `CLIENT_RUMCSI`), and `restrictByClient()` (L1508) gates
+  navigation/menus in `desk/template/header.php` (~L1638-1665) and the ticket datatables under
+  `_/browser/datatable/tickets/*`. This is an entry/UI gate only — **record-level tenancy still
+  comes from the session `clientid`, not the host.** See the per-client-host-restriction feature doc.
 - Unmatched `?action=` values fall back to `controllers/actions/<action>.php` — so actions live
   either inline in `actions.php` or as files under `controllers/actions/<domain>/`.
 
@@ -197,6 +207,16 @@ Invariants:
 - The API has **no pagination** — `get` returns full result sets; Medoo `filters` pass straight
   to the WHERE clause.
 - The prod O365 OAuth secret used by `crons/tickets_prod.php` has a **hard expiry (~2026-12-20)**.
+- **Cross-tenant login hole in the per-client host restriction (pre-existing, NOT fixed).** The
+  password-login access condition in `desk/includes/functions.php` (~L627-631) is a chain of ORs;
+  two clauses grant access regardless of which client's subdomain is in use, letting an IM Houston
+  or Fordham user sign in on another client's branded host. Post-login filtering keys off the
+  session `clientid` so it is not an immediate record leak, but it defeats the restriction and
+  contradicts the comment directly above it. Deserves its own ticket.
+- **Sessions are host-scoped, so a domain change logs everyone out.** `ebs/setup_phpini.php` sets
+  `session.save_handler=rediscluster` but no `session.cookie_domain`, and there is no
+  `session_set_cookie_params()` anywhere. Combined with `people.sessionid` being a **single
+  column**, logging in on a second domain invalidates the session on the first.
 
 ## Related docs
 - [TOGa View architecture](../togaview/architecture.md)

package/knowledge/1.0/apps/togadesk/features/per-client-host-restriction.md

@@ -70,15 +70,22 @@ The app code is the easy part. What actually bites:
   `redirectTo` NULL unless you specifically want a redirect. Example (RUMCSI cutover, 2026-08-04):
   `hostName = 'rumcsi.togadesk.togatech.com'`, `redirectTo = NULL` (id 253 — the id is
   auto-assigned and carries no meaning).
-  - **Enforcement location is UNVERIFIED / needs tracing.** The DB row and the behavior are
-    developer-confirmed, but the code performing the check was **not** found on 2026-08-04. Greps
-    across `togadesk`, `library`, `togaview` and `_underscore` for `CopyrightHosts`, `Vision_Log`,
-    `copyright`, `unauthoriz` and `hostName` surfaced no host-authorization check. The only related
-    hook is `App_Framework_Index::copyrightFooter()` (`library/app/frameworkindex.php` L152-157),
-    which emits the copyright footer div and registers a final JS call `initializeCopyright();` —
-    and `initializeCopyright` is **defined nowhere in the library repo** (that is its only call
-    site), suggesting the check is served remotely or lives in another app/asset. Start there if you
-    need to trace it; do not assume anything further.
+  - **Enforcement location is STILL UNLOCATED (behavior is confirmed; the code is not).** As of
+    2026-08-04 the check is **not present** in `togadesk`, `library`, `togaview`, `_underscore`, or
+    the shared front-end assets repo (`C:\WWW\resources`, not yet in `registry.json`) by grep for
+    `CopyrightHosts`, `Vision_Log`, `copyright`, `unauthoriz` and `hostName`.
+  - **The `copyrightFooter()` / `initializeCopyright()` lead is POSITIVELY EXCLUDED — do not
+    re-chase it.** `initializeCopyright()` *is* defined, in the shared assets repo at
+    `resources/library.js` L1075-1078, and it is **purely cosmetic**: it wires `window.onscroll`
+    plus a 300ms `setInterval` to `checkCopyrightPosition()` (L1068-1074), which only toggles
+    `position: relative` on `#copyrightFooter` when the document is taller than the window. No
+    network call, no hostname read, no license logic. The same repo has **no** first-party JS
+    reading `location.host` or `document.domain` (only vendored libraries match) and no
+    CopyrightHosts / unauthorized-use logic at all.
+  - **Remaining candidates to try next:** (a) a server-side check in another app that owns the
+    `Vision_Log` schema — i.e. the Vision/TOGa side, not the desk repos; (b) a minified or
+    obfuscated asset; (c) something entirely outside these repos. Until one is confirmed, treat the
+    behavior as authoritative and the mechanism as unknown.
   - **This check appears to be cross-app**, i.e. 1.0 apps generally (via `library`), not
     togadesk-specific — it is documented here because that is where it was discovered. If it is later
     confirmed framework-wide it may belong in a library/framework-level doc; flag that move rather
@@ -133,3 +140,8 @@ The app code is the easy part. What actually bites:
   `Vision_Log.CopyrightHosts` or the app shows an unauthorized-use screen. Row inserted for
   `rumcsi.togadesk.togatech.com`. Enforcement code not located — marked UNVERIFIED with the
   `copyrightFooter()` / `initializeCopyright()` lead. (mhammontree)
+- 2026-08-04 — Corrected the CopyrightHosts enforcement-location caveat: `initializeCopyright()` is
+  defined in `resources/library.js` (L1075-1078) and is purely cosmetic footer positioning, so that
+  lead is ruled out; the shared assets repo contains no host-authorization logic. Enforcement
+  remains unlocated; next candidates recorded. Behavior and the STEP 1 checklist entry unchanged.
+  (mhammontree)

package/knowledge/sessions/2026-08-04-true-80139-togadesk-rumcsi-url-review-mhammontree.md

@@ -26,11 +26,15 @@ updated: 2026-08-04
 - **Confirmed no host allowlist at the web-server layer.** `ebs/apache_settings.php` only tunes prefork/MaxRequestWorkers; root `.htaccess` is empty. Nothing rejects an unrecognized `Host` header.
 - **Capture published.** `knowledge/1.0/apps/togadesk/features/per-client-host-restriction.md` and `knowledge/clients/rumcsi/profile.md` created and pushed to `_main` (validate OK, 30 repos; index rebuilt, 312 docs; mirrored to `C:\WWW\.claude\knowledge`).
 
+- **`Vision_Log.CopyrightHosts` row added (developer-supplied — the step this review MISSED).** TOGa 1.0 apps run a license/anti-piracy host-authorization check ("call home") against `Vision_Log.CopyrightHosts` keyed on `hostName`; with no matching row the app renders an **unauthorized-use error screen** instead of the application, regardless of DNS, cert, ALB, or `getRestrictedClient()`. The developer inserted the row: id 253, `hostName` = `rumcsi.togadesk.togatech.com`, `redirectTo` = NULL. This is now **step 1** of the add-a-hostname checklist in the feature doc.
+
 ## What did NOT work — DO NOT RETRY THESE
 - **Do NOT trust the `context-primer` briefing on this topic — it was wrong.** The primer asserted "TogaDesk (`desk/`) is staff-only — it resolves the logged-in user via session, not via subdomain/hostname… there isn't any host-based branching in TogaDesk architecture doc," and concluded a new hostname "doesn't map into TogaDesk's client-selection logic at all." That is false: `getRestrictedClient()` is exactly that logic. The primer was faithfully reporting `knowledge/1.0/apps/togadesk/architecture.md`, which **still** describes the request pipeline as having no host-based logic. Root cause is the stale architecture doc, not the agent. Read `desk/includes/functions.php` L1508-1592 as ground truth.
+- **Do NOT expect to find the CopyrightHosts enforcement code by grepping the repos — it is not there.** Searched togadesk, library, togaview and `_underscore` for `CopyrightHosts`, `Vision_Log`, `copyright`, `unauthoriz` and `hostName`: no host-authorization check exists in source. The only lead is `App_Framework_Index::copyrightFooter()` at `library/app/frameworkindex.php` L152-157, which emits the footer div and registers a final JS call `initializeCopyright();` — and `initializeCopyright` is **defined nowhere in the library repo** (that call site is the only occurrence). The check is therefore served remotely or lives in another app/asset. Treat the enforcement location as unverified; start tracing from `initializeCopyright`.
 - **Searching `config.*.ini` for the session cookie domain found nothing** — not a failed approach so much as a null result worth not repeating: there is no `session.cookie_domain` and no `session_set_cookie_params()` anywhere in the repo. `ebs/setup_phpini.php` sets only `session.save_handler=rediscluster`, `session.save_path` (the `asi-session-cache` cluster endpoint), and `session.gc_maxlifetime=345600`. Cookie scoping is therefore PHP's host-only default, by omission.
 
 ## Not tried yet (candidates for next session)
+- **Trace where the `Vision_Log.CopyrightHosts` check is actually enforced**, starting from `initializeCopyright()` (registered at `library/app/frameworkindex.php` L157, defined nowhere in `library`). Once located, this likely belongs in a `1.0` library/framework-level doc or a `1.0/standards` rule ("every new 1.0 hostname must be registered in `Vision_Log.CopyrightHosts`") rather than the togadesk feature doc — the capture agent flagged that placement change as deferred pending this trace. Also confirm what `redirectTo` does when non-NULL.
 - **Verify the TLS cert and ALB listener rule** for the 4-label host `rumcsi.togadesk.togatech.com`. A `*.togatech.com` wildcard does **not** cover it — it needs `*.togadesk.togatech.com` or that exact SAN, plus a host-header rule routing to the togadesk environment. Not verifiable from this repo; `ebs/register_instance_to_shared_application_load_balancer.php` contains no host/rule logic (grepped: zero matches for host|rule|rumcsi|togadesk).
 - **Post-cutover smoke test of Office document previews.** `desk/template/modals/kb/viewDocument.php` (~L28) and `desk/template/modals/files/aws-view.php` (~L21), plus `desk/template/modals/files/contract-view.php`, `template/pages/documents/view.php` (~L38), `template/pages/tasks/view.php` (~L48) embed `https://{HTTP_HOST}/...` into `docs.google.com/gview` and `view.officeapps.live.com`, which fetch **server-side**. An untrusted cert breaks Word/Excel/PPT previews silently while same-origin PDF iframes keep working. Test one Office doc on the new host.
 - **Fix the cross-tenant login hole** at `desk/includes/functions.php` ~L627-631 — needs its own ticket (see Decisions).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.514",
+  "version": "1.0.516",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",