initial

public/api/ticket_update.php

@@ -0,0 +1,56 @@
+<?php
+declare(strict_types=1);
+require_once __DIR__ . '/../../src/bootstrap.php';
+
+if (!Auth::user()) {
+    json_out(['ok' => false, 'error' => 'unauthorized'], 401);
+}
+
+try {
+    Database::requireTicketsTable();
+} catch (RuntimeException $e) {
+    json_out(['ok' => false, 'error' => 'tickets_table_missing', 'hint' => $e->getMessage()], 503);
+}
+
+if (strtoupper($_SERVER['REQUEST_METHOD'] ?? 'GET') !== 'PUT' && strtoupper($_SERVER['REQUEST_METHOD'] ?? '') !== 'POST') {
+    json_out(['ok' => false, 'error' => 'method not allowed'], 405);
+}
+
+$raw = file_get_contents('php://input');
+$data = is_string($raw) && $raw !== '' ? json_decode($raw, true) : $_POST;
+if (!is_array($data)) {
+    json_out(['ok' => false, 'error' => 'invalid json'], 400);
+}
+$id = (int) ($data['id'] ?? 0);
+if ($id <= 0) {
+    json_out(['ok' => false, 'error' => 'invalid id'], 400);
+}
+
+$ticket = TicketRepository::getById($id);
+if (!$ticket) {
+    json_out(['ok' => false, 'error' => 'not found'], 404);
+}
+if (empty($ticket['can_edit'])) {
+    json_out(['ok' => false, 'error' => 'forbidden'], 403);
+}
+
+$fields = [];
+foreach (['title', 'brief', 'body', 'rating', 'owner_username', 'verified_by_username', 'workflow_state'] as $key) {
+    if (array_key_exists($key, $data)) {
+        $fields[$key] = $data[$key];
+    }
+}
+if (array_key_exists('assignees', $data)) {
+    $fields['assignees'] = $data['assignees'];
+}
+
+try {
+    TicketRepository::update($id, $fields);
+    $updated = TicketRepository::getById($id);
+    json_out(['ok' => true, 'ticket' => $updated]);
+} catch (InvalidArgumentException $e) {
+    json_out(['ok' => false, 'error' => $e->getMessage()], 400);
+} catch (Throwable $e) {
+    error_log('ticket_update: ' . $e->getMessage());
+    json_out(['ok' => false, 'error' => 'save failed'], 500);
+}