toga-ai 1.0.838 → 1.0.839

package/knowledge/1.0/apps/togaview/INDEX.md

@@ -7,5 +7,6 @@
 | [MSP Dashboard & Ticket Visibility Rules](features/msp-dashboard.md) | Why tickets "disappear" in the TOGa View client portal — the per-page ticket scoping and the `tickets.customerid` / `SMBContracts` dependencies; open when an MS |
 | [Retail Commerce Lifecycle (winback, purchase, claims, activation)](features/retail-commerce-lifecycle.md) | TOGa View retail tech-support commerce flows (winback renewal, purchase, service activation, AIG claims — chiefly ODP, Walmart B2B, Staples Protection); open fo |
 | [Ticket Detail Page Security & Its Three Forks (common/*/ticket.php)](features/ticket-detail-page.md) | Security of the TOGa View ticket detail page `common/*/ticket.php` and its THREE near-duplicate forks (IDOR ownership checks, int-cast, name-split guard, sqlPro |
+| [MSP Ticket Export (.xlsx)](features/ticket-export.md) | The MSP dashboard "Export Tickets" .xlsx download — single-request design, why a two-request (build then download) export cannot work behind the shared load bal |
 | [Git & php -l Tooling Against the `_/` App Root (MSYS path mangling)](workflows/git-and-php-tooling-under-the-underscore-app-root.md) | Git Bash/MSYS on Windows mangles any `_/`-prefixed path argument (empty diff, misfired `php -l`), and togaview's app root IS `_/`; open before running git/php a |
 | [Route 53 Hosted Zone Migration Between AWS Accounts](workflows/route53-cross-account-zone-migration.md) | Playbook to move a Route 53 hosted zone's records between AWS accounts (export → new zone → import → repoint NS); used for `togaview.com`; open for any cross-ac |

package/knowledge/1.0/apps/togaview/architecture.md

@@ -6,7 +6,7 @@ project: TOGa View
 client: shared
 type: architecture
 status: active
-updated: 2026-09-16
+updated: 2026-09-18
 owners: ["mhammontree", "jcardinal"]
 files:
   - index.php
@@ -20,6 +20,7 @@ related:
   - 1.0/apps/togadesk/architecture.md
   - 1.0/apps/togaview/features/login-flows.md
   - 1.0/apps/togaview/features/msp-dashboard.md
+  - 1.0/apps/togaview/features/ticket-export.md
   - 1.0/apps/togaview/features/ticket-detail-page.md
   - 1.0/apps/togaview/features/retail-commerce-lifecycle.md
 ---
@@ -59,7 +60,7 @@ Architecturally it is a **multi-tenant, single-codebase MVC portal**: one deploy
 - `App_MVC::parseRoute()` (in `library`) turns the request URI into route parts and resolves `mvc/<route…>/<method>.php`, where `<method>` is `get` or `post` (from the HTTP verb, overridable via a `_method` POST param). It matches longest-to-shortest, so overlapping paths can surprise — keep route folders distinct.
 - **GET** (`get.php`) selects a template via the fallback chain above and passes data to it (no central master-layout system — each `common/<…>/<page>.php` is self-contained).
 - **POST** (`post.php`) reads input with `App_Page::getVar()/getVarIfSet()`, does the work, then `header("Location: …"); exit;`. Login/auth, ticket creation, user management live here.
-- AJAX requests dispatch through `App_Framework::ajaxHandler()`; `?fileId=` downloads route through `App_MVC::loadFile()`. `mvc/_TEMPLATE/` is the scaffold for new pages.
+- AJAX requests dispatch through `App_Framework::ajaxHandler()`. **`?fileId` is the "skip the page shell" flag, not a filename** — a GET without it renders the shell, which flushes output (`App_Page::flushCapture`, `library/app/page.php:213`) before the route runs, so any `header()` then fails. Every download/binary route must carry a `fileId` (the value can be a fixed marker); with it, the request goes straight to `App_MVC::loadFile()`. See [MSP ticket export](features/ticket-export.md). `mvc/_TEMPLATE/` is the scaffold for new pages.
 
 ## Browser subsystem (grids & modals)
 `_/browser/`: `Browser_Datatable_*` classes (`initialize()` registers fields/joins/DB link via `setDatabaseLinkString()` / `setTableJoins()`, `Browser_DataTableField` for cell rendering), `Browser_Modal_*` classes (capture HTML via `App_Page::startCapture()/stopCapture()`, e.g. `Browser_Modal_CreateNewTicket`, `CreatenewUser`), and `Browser_Pagination_TogaView`.
@@ -94,6 +95,7 @@ Read-only client-facing KB sourced from TOGa Desk's `db_togadesk` KB tables, gat
 - New client onboarding touches at minimum: the HTTP_HOST switch in `framework.php`, a login flow (or SAML branch), and possibly the `smbContractSkus` whitelist in `login/post.php`.
 
 ## Gotchas
+- **Never pass a file between two requests via local disk.** togaview runs on several EB instances behind a shared ALB, so `/var/www/cache` is per-instance — request 2 lands on another instance and 404s. Build and return in one request. See [MSP ticket export](features/ticket-export.md).
 - **Template fallback is per-page, not central.** Each `get.php` re-implements the host→stylePath→togaview chain; it's easy to miss a host-specific branch.
 - **`common/togaview/*` is the blast radius** — editing a generic page changes nearly every client at once.
 - **Divergent session shapes** across login flows (see Session model) — always use the `emailAddress`/`email` fallback and tolerate a missing `togadeskClientId`.
@@ -105,5 +107,6 @@ Read-only client-facing KB sourced from TOGa Desk's `db_togadesk` KB tables, gat
 - [TOGa Desk architecture](../togadesk/architecture.md)
 - [Login flows & session variables](features/login-flows.md)
 - [MSP dashboard & ticket visibility](features/msp-dashboard.md)
+- [MSP ticket export (.xlsx)](features/ticket-export.md)
 - [Ticket detail page security](features/ticket-detail-page.md)
 - [Retail commerce lifecycle](features/retail-commerce-lifecycle.md)

package/knowledge/1.0/apps/togaview/features/login-flows.md

@@ -6,7 +6,7 @@ project: TOGa View
 client: shared
 type: feature
 status: active
-updated: 2026-09-16
+updated: 2026-09-18
 owners: ["mhammontree"]
 files:
   - mvc/login/post.php
@@ -94,9 +94,13 @@ Also note the rumcsi SAML `acs` case (:459-472) sets **no** session variables on
 Only togadesk writes it (`desk/includes/functions.php:588/635/672/689`, plus `actions/user/loginAsAnother.php:17-18`). Both togaview login paths set session state only. So **`lastlogin` cannot measure portal usage** — a portal user logging in daily still shows NULL. See [TOGa Desk staff login](../../togadesk/features/staff-login-authentication.md).
 
 ### Other
+- **towfoundation has a real password login path despite being a SAML host** — `mvc/login/post.php:82-96` matches `people.password = sha1($pass)` + `isActive = 1` + `clientid` = TOW Foundation; `people.type = 'admin'` maps to `USERTYPE_ADMIN` and lands `/msp_dashboard`. Useful for testing a SAML tenant locally with no IdP.
 - **`people.password` is a bare SHA-1** (`mvc/login/post.php:21/96/471`) and the hash is also carried in `$_SESSION['Contact']['password']`. Known and accepted for now — togaview is migrating to 2.0, so no remediation is planned here; do not "fix" it as a side effect of another ticket.
 - Code consuming the session must read `emailAddress` with an `email` fallback (and tolerate missing `togadeskClientId`) or it rejects all staplesprotection users — this broke the ticket.php ownership check until the fallback was added (June 2026).
 
+## Change history
+- 2026-09-18 — Recorded towfoundation's password login path (SAML host with a live sha1 password flow) (mhammontree)
+
 ## Related
 - [MSP dashboard & ticket visibility](msp-dashboard.md)
 - [Ticket detail page](ticket-detail-page.md)

package/knowledge/1.0/apps/togaview/features/msp-dashboard.md

@@ -6,7 +6,7 @@ project: TOGa View
 client: shared
 type: feature
 status: active
-updated: 2026-09-16
+updated: 2026-09-18
 owners: ["mhammontree"]
 files:
   - common/togaview/msp_dashboard.php
@@ -15,6 +15,7 @@ files:
   - mvc/support/support.php
 related:
   - 1.0/apps/togaview/features/login-flows.md
+  - 1.0/apps/togaview/features/ticket-export.md
   - 1.0/apps/togadesk/features/ticket-lifecycle.md
   - 1.0/apps/togadesk/features/smb-contract-editing.md
 ---
@@ -50,14 +51,18 @@ Different pages scope tickets **differently**, and the MSP pages depend on `tick
 - An MSP's "customers" are **TOGA-side `Customers` rows**, NOT togadesk clients. All of an MSP's tickets carry the MSP's own `tickets.clientid`.
 
 ### Client variations
-- The single-department pattern still exists in the `newcenturyholdingsllc` and `towfoundation` dashboard variants (not yet fixed there) and in enterprise_dashboard's `clientDepartmentId` filter for end users.
+- The single-department pattern still exists in the `newcenturyholdingsllc` and `towfoundation` dashboard variants (`departmentid = $_SESSION['clientDepartmentId']`, towfoundation `:271` + the count queries from `~:287`) and in enterprise_dashboard's `clientDepartmentId` filter for end users. **Those counters are the stale/buggy side — the unfinished half of the June 2026 fix.** The .xlsx export has never filtered by department and deliberately still does not (adding one would spread the bug) — so on those two forks the export legitimately returns more rows than the counters. See [Ticket export](ticket-export.md).
 - Only towfoundation / newcenturyholdingsllc have their own dashboard variants; everyone else runs the generic `common/togaview/` pages.
 
 ## Gotchas
 - "You have no assigned clients" usually means the MSP's `SMBContracts.clientMspId` was corrupted by the togadesk contract modal (see smb-contract-editing doc) — check data before debugging code.
 - An expired `SMBContracts.dateContractEnd` is display-only; it does not hide tickets.
 
+## Change history
+- 2026-09-18 — Noted the towfoundation/newcentury counters still use the single-department filter; export is department-wide by design (mhammontree)
+
 ## Related
 - [Login flows](login-flows.md)
+- [MSP ticket export (.xlsx)](ticket-export.md)
 - [TOGa Desk ticket lifecycle](../../togadesk/features/ticket-lifecycle.md)
 - [SMB contract editing](../../togadesk/features/smb-contract-editing.md)

package/knowledge/1.0/apps/togaview/features/ticket-export.md

@@ -0,0 +1,61 @@
+---
+title: MSP Ticket Export (.xlsx)
+framework: "1.0"
+repo: togaview
+project: TOGa View
+client: shared
+type: feature
+status: active
+updated: 2026-09-18
+owners: ["mhammontree"]
+files:
+  - _/app/export/ticketexport.php
+  - mvc/msp_dashboard/export/get.php
+  - common/togaview/msp_dashboard.php
+  - common/towfoundation/msp_dashboard.php
+  - common/newcenturyholdingsllc/msp_dashboard.php
+related:
+  - 1.0/apps/togaview/features/msp-dashboard.md
+  - 1.0/apps/togaview/architecture.md
+---
+
+The MSP dashboard "Export Tickets" .xlsx download — single-request design, why a two-request (build then download) export cannot work behind the shared load balancer, and the identity gate across the three dashboard forks.
+
+## Summary
+`App_Export_TicketExport` (`_/app/export/ticketexport.php`) builds the ticket workbook for all three msp_dashboard forks. `mvc/msp_dashboard/export/get.php` builds it **in one request**, reads it fully into memory, then sends download headers. Nothing touches shared disk and the endpoint takes **no** user input.
+
+## How it works
+1. Export button hits `mvc/msp_dashboard/export/get.php` with a `fileId` parameter (see gotcha — required, value is only a marker).
+2. Route gates on identity: userType in (CUSTOMER, MSP, ADMIN) **and** `$_SESSION['togadeskClientId']`; failure → `App_JavaScript::jsRedirect('/login')`.
+3. `App_Export_TicketExport` builds the workbook, writes it to `tempnam(sys_get_temp_dir(), …)`, `file_get_contents()` reads it back, `unlink()` in a `finally`.
+4. Only then are download headers + the bytes sent. On failure → redirect to `?exportFailed=1`.
+
+**Scope:** the export is deliberately **not** filtered by `departmentid` — it returns all of the client's tickets and therefore more rows than the dashboard counters. Verified on production (clientid 168: 693 tickets across departments 307/312/310/0, all owned by TOW Foundation). Not a leak — see [msp-dashboard](msp-dashboard.md) for the stale single-department counters on two forks.
+
+**Shared class, three forks.** Before 2026-09-18 each of `common/{togaview,towfoundation,newcenturyholdingsllc}/msp_dashboard.php` carried its own `getExportFileName()` copy (already drifted). All three now call `App_Export_TicketExport`. Autoload: `App_Export_TicketExport` → `__APPROOT__/app/export/ticketexport.php`, i.e. togaview's `_/` folder (same placement as `App_Framework_TogaView`).
+
+## Gotchas
+
+### Never pass a file between two requests via local disk (EB + shared ALB)
+The original export was two requests: request 1 wrote the .xlsx to `$config['internal']['cache_folder']` = `/var/www/cache` and echoed the name; request 2 downloaded it. togaview runs on several Elastic Beanstalk instances behind a **shared** Application Load Balancer (`.ebextensions/050_register_instance_to_shared_application_load_balancer.config`), and `/var/www/cache` is **per-instance** local disk (`.ebextensions/007_setup_export_cache_folders.config`). Request 2 usually landed on a different instance → "File not found. Please try exporting again." Intermittent, so it looked flaky, not broken. Applies to **any** 1.0 app on EB behind the shared ALB. The s3fs mount exists but `cache_folder` does not use it. *(Open: 007 + `ebs/setup_export_cache_folders.php` now have zero readers — dead infra, separate cleanup.)*
+
+### A download route in togaview MUST carry `fileId`
+`App_Framework_TogaView::renderIndex()` (`_/app/framework.php` ~1265): a GET **without** `fileId` renders the page shell, which calls `App_Page::flushCapture()` (`library/app/page.php:213`) and flushes output **before** the route file runs — any `header()` then fails with "Cannot modify header information". A GET **with** `fileId` skips the shell and goes straight to `App_MVC::loadFile()`. The value can be a fixed marker; it need not be a filename.
+
+### Build the whole file, then send headers — never stream
+`App_Error::handleError` turns **every** PHP warning into `handleException`, which `exit`s (`library/app/error.php` ~407 and ~671). Bytes already on the wire → HTTP 200 with a truncated .xlsx plus an error page: a silent corrupt file, worse than a visible error. Buffering first keeps a clean redirect possible.
+
+### The vendored PhpSpreadsheet Xlsx writer takes a filename, not a stream
+`library/PhpOffice/PhpSpreadsheet/Writer/Xlsx.php::save($pFilename)` (:173) calls `strtolower($pFilename)` (:181) — a stream resource fails with "strtolower() expects parameter 1 to be string, resource given". Stream support landed in a later release. Use `tempnam()` + `file_get_contents()` + `unlink()`; the temp file lives inside one request, so it cannot recreate the load-balancer bug.
+
+### Lint and run togaview with PHP 7.2
+Use `xampp_7_2_33`'s `php.exe`. Linting under PHP 8 passes, but a CLI run dies on a vendored PhpSpreadsheet deprecation (`Worksheet\Iterator::current()` return type), which is fatal under `App_Error` — a misleading failure.
+
+### Don't assume one userType across the forks
+`common/togaview/msp_dashboard.php:16` requires CUSTOMER or MSP; `common/towfoundation/msp_dashboard.php:234` and `common/newcenturyholdingsllc/msp_dashboard.php:235` require **ADMIN**. All three also require `togadeskClientId`. A shared gate must be the **union**, or every towfoundation/newcentury admin loses the button they can see.
+
+### Anti-pattern this replaced (was live in production)
+The old `mvc/msp_dashboard/export/get.php` gated only on `isset($_GET['fileId'])` — no login check — then `readfile()`d **and** `unlink()`d `$cacheDir . '/' . $fileName`, validated only by `substr($fileName, -5) === '.xlsx'` and `file_exists()`. `$_GET` passes through `App_String::xssProtect()` (= `htmlspecialchars()`), which touches neither `.` nor `/`, so `../` traversal worked: unauthenticated arbitrary read **and** arbitrary delete. Filenames were also `Tickets_Export_<unix timestamp>.xlsx` in one shared folder — a guessable cross-tenant read with no traversal at all. **An extension check plus `file_exists()` is not a traversal defense, and `htmlspecialchars()` is not path sanitization.** Same family as the TRUE-78835 / TRUE-80671 togaview IDORs.
+
+## Change history
+- 2026-09-18 — Export collapsed to one request (was broken by the shared ALB), extracted to `App_Export_TicketExport`, identity-gated, and the unauthenticated traversal/delete endpoint removed (TRUE-81955) (mhammontree)

package/knowledge/1.0/standards/backend-php.md

@@ -5,7 +5,7 @@ project: Library
 client: shared
 type: standard
 status: active
-updated: 2026-09-16
+updated: 2026-09-18
 owners: [jcardinal, rgirish, mhammontree, ajean]
 files: []
 related:
@@ -553,6 +553,18 @@ Note: the 2.0 metadata-driven API features (Record Scripts, API Payload Intercep
 - **Remove all `debugVar()` calls before merging.**
 - Don't extend `DOA_`-prefixed code; plan its removal when you touch the area and dependencies allow.
 
+## Binary downloads: build the whole file, then send headers
+
+Never stream a generated file straight to the browser. `App_Error::handleError` promotes every
+PHP warning to `handleException`, which `exit`s (`library/app/error.php` ~407 and ~671). If bytes
+are already on the wire, the user gets HTTP 200 with a truncated file plus an error page — a
+silent corrupt download, worse than a visible failure. Build it fully in memory (or a per-request
+`tempnam()`), then send headers, then echo. A failure before the headers can still redirect.
+
+Never persist a generated file on local disk to hand to a *second* request. Our EB apps run on
+several instances behind a shared load balancer, so per-instance paths like `/var/www/cache`
+are not shared and the follow-up request intermittently 404s. One request, start to finish.
+
 ## Documentation
 
 - Keep code well-documented with DocBlocks and usage examples.

package/knowledge/INDEX.md

@@ -9,7 +9,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 - **dbchanges** (Database Changes) _(framework core)_ — 1 doc(s) → [1.0/apps/dbchanges/INDEX.md](1.0/apps/dbchanges/INDEX.md)
 - **worker1.5** (Worker 1.5) — 0 doc(s) → [1.0/apps/worker1.5/INDEX.md](1.0/apps/worker1.5/INDEX.md)
 - **togadesk** (TOGa Desk) — 13 doc(s) → [1.0/apps/togadesk/INDEX.md](1.0/apps/togadesk/INDEX.md)
-- **togaview** (TOGa View) — 7 doc(s) → [1.0/apps/togaview/INDEX.md](1.0/apps/togaview/INDEX.md)
+- **togaview** (TOGa View) — 8 doc(s) → [1.0/apps/togaview/INDEX.md](1.0/apps/togaview/INDEX.md)
 - **webhook** (Webhook) — 1 doc(s) → [1.0/apps/webhook/INDEX.md](1.0/apps/webhook/INDEX.md)
 - **walmarttechservices** (Walmart Tech Services) — 1 doc(s) → [1.0/apps/walmarttechservices/INDEX.md](1.0/apps/walmarttechservices/INDEX.md)
 - **test** (Test) — 16 doc(s) → [1.0/apps/test/INDEX.md](1.0/apps/test/INDEX.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.838",
+  "version": "1.0.839",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",