From 9e55d52432be5dee62e4bc097cd60a3bdcea993a Mon Sep 17 00:00:00 2001 From: johnnyq Date: Wed, 14 Oct 2026 22:49:05 -0400 Subject: [PATCH] Vendors overhaul for daily MSP work: new vendor page built around calling them, with Call support (dials the extension), Email, Support site, a star, and a New menu (case/ticket with them, license from them, asset bought from them, portal login, document, upload, or expense and recurring expense for our own vendors), Support card (phone, hours, SLA, email, site), Account card (account number, PIN shown as dots with show and copy, account manager name, direct line and email), blur-to-save notes, an Also used by list of the agent's other clients with the same vendor by name or template, and tabs for Cases (open first, with their ticket number), Licenses (soonest renewal first), Assets (serial, order ref, warranty status), Domains (registrar, web host, DNS, mail), Services, Logins, Documents, Files and History; our own vendors show spend this year, last year and in all, recent expenses and recurring expenses; new vendor quick look; rebuilt vendors list with starred first, initials tiles coloured by vendor name, support line, hours and SLA, account number and PIN, chips for open cases, licenses, assets, domains, services and logins, an Ours / Clients' switch with an all-clients view in All Client Docs, wider search (account manager, emails, tags), tag filter and bulk Tags/Archive/Restore/Delete; shared tabbed vendor form (Details, Support, Account, Notes) with star, tags and start from template that fills every field; Add a Template to Clients to roll one vendor out to many clients, skipping those that have it; Admin Vendor Templates shows how many clients use each template and has Add to clients; vendor tags (tag type 6) with vendor tags in the Tags starter pack; ticket vendor block shows their ticket number, support line, hours, SLA, account number and PIN with copy buttons; vendor tiles in every vendor picker and quick look links across tickets, licenses, assets, domains, services and expense lists; search opens the vendor page; CSV export adds tags, open cases, account manager and PIN; logins, documents and files can be linked to a vendor and ones made from a vendor's page are linked to it; demo vendors get tags, a star and an account manager; database update 2.8.2 adds vendor_tags and vendor_contact_phone_country_code, vendor_contact_phone, vendor_contact_email (db.sql updated) and clears references to vendors that no longer exist; ticket vendor now validated against the ticket's client and removing a vendor from a ticket is logged as such; deleting a vendor from a template no longer unlinks every other vendor from that template; deleting a vendor clears it from assets, licenses, tickets and domains, and vendors with expenses, recurring expenses or payment provider fees are archived rather than deleted; vendor websites without a scheme open correctly; domain form vendor names escaped; new vendor templates keep the phone country code and pushing a template update with nothing ticked no longer errors; vendors API accepts the account manager fields; new functions/vendor.php (VENDOR_USES, vendorCan/vendorEnforce with client vendors on module_client and ours on module_financial, tile, link, website, PIN, form, tags, counts, delete check, reference clearing, also used by, spend, history), credential|vendor and file|vendor link relations, tag module_ours for our own vendors, handlers add_vendor_template_to_clients, favorite_vendor, unfavorite_vendor and ajax vendor_set_notes, vendor_model.php removed --- admin/database_updates/2.8.2.php | 36 + admin/modals/tag/tag_add.php | 2 + admin/modals/tag/tag_edit.php | 2 + admin/post/demo_data_model.php | 61 +- admin/post/starter_content_model.php | 16 +- admin/post/vendor_template.php | 7 +- admin/tags.php | 1 + admin/vendor_templates.php | 22 +- agent/ajax.php | 30 +- agent/asset.php | 2 +- agent/calendar.php | 2 +- agent/domains.php | 8 +- agent/expenses.php | 2 +- agent/includes/client_overview_side_nav.php | 16 + agent/includes/client_side_nav.php | 4 +- agent/includes/side_nav.php | 2 +- agent/js/tickets_add_modal.js | 10 +- agent/license.php | 10 +- agent/modals/asset/asset_add.php | 4 +- agent/modals/asset/asset_form.php | 6 +- agent/modals/credential/credential_add.php | 6 +- agent/modals/document/document_add.php | 6 +- agent/modals/domain/domain_add.php | 16 +- agent/modals/domain/domain_edit.php | 24 +- agent/modals/expense/expense_add.php | 6 +- agent/modals/expense/expense_copy.php | 4 +- agent/modals/expense/expense_edit.php | 4 +- agent/modals/file/file_upload.php | 8 +- agent/modals/link/link.php | 2 +- .../recurring_expense_add.php | 6 +- .../recurring_expense_edit.php | 4 +- agent/modals/service/service.php | 2 +- agent/modals/service/service_add.php | 4 +- agent/modals/service/service_edit.php | 6 +- agent/modals/software/software.php | 2 +- agent/modals/software/software_add.php | 3 +- agent/modals/software/software_form.php | 4 +- agent/modals/ticket/ticket_add.php | 3 +- agent/modals/ticket/ticket_edit.php | 8 +- agent/modals/ticket/ticket_edit_vendor.php | 7 +- agent/modals/vendor/vendor.php | 356 ++++++-- agent/modals/vendor/vendor_add.php | 163 +--- .../vendor/vendor_add_from_template.php | 52 +- agent/modals/vendor/vendor_edit.php | 213 +---- agent/modals/vendor/vendor_export.php | 59 +- agent/modals/vendor/vendor_form.php | 318 +++++++ .../modals/vendor/vendor_template_clients.php | 114 +++ agent/post/credential.php | 6 + agent/post/document.php | 10 +- agent/post/file.php | 6 +- agent/post/ticket.php | 32 +- agent/post/vendor.php | 505 ++++++----- agent/post/vendor_model.php | 16 - agent/recurring_expenses.php | 2 +- agent/software.php | 2 +- agent/ticket.php | 32 +- agent/vendor.php | 822 ++++++++++++++++++ agent/vendors.php | 495 +++++++---- api/v1/vendors/create.php | 2 +- api/v1/vendors/update.php | 2 +- api/v1/vendors/vendor_model.php | 24 + css/itflow_custom.css | 52 ++ db.sql | 20 + functions.php | 1 + functions/export.php | 14 +- functions/links.php | 24 +- functions/search.php | 13 +- functions/software.php | 2 +- functions/tags.php | 29 +- functions/vendor.php | 443 ++++++++++ js/app.js | 17 + 71 files changed, 3201 insertions(+), 1013 deletions(-) create mode 100644 admin/database_updates/2.8.2.php create mode 100644 agent/modals/vendor/vendor_form.php create mode 100644 agent/modals/vendor/vendor_template_clients.php delete mode 100644 agent/post/vendor_model.php create mode 100644 agent/vendor.php create mode 100644 functions/vendor.php diff --git a/admin/database_updates/2.8.2.php b/admin/database_updates/2.8.2.php new file mode 100644 index 000000000..7f4c02465 --- /dev/null +++ b/admin/database_updates/2.8.2.php @@ -0,0 +1,36 @@ + 0 AND `vendor_id` IS NULL"); + mysqli_query($mysqli, "UPDATE `software` LEFT JOIN `vendors` ON `vendor_id` = `software_vendor_id` SET `software_vendor_id` = 0 WHERE `software_vendor_id` > 0 AND `vendor_id` IS NULL"); + mysqli_query($mysqli, "UPDATE `tickets` LEFT JOIN `vendors` ON `vendor_id` = `ticket_vendor_id` SET `ticket_vendor_id` = 0 WHERE `ticket_vendor_id` > 0 AND `vendor_id` IS NULL"); + foreach (['domain_registrar', 'domain_webhost', 'domain_dnshost', 'domain_mailhost'] as $domain_vendor_column) { + mysqli_query($mysqli, "UPDATE `domains` LEFT JOIN `vendors` ON `vendor_id` = `$domain_vendor_column` SET `$domain_vendor_column` = 0 WHERE `$domain_vendor_column` > 0 AND `vendor_id` IS NULL"); + } diff --git a/admin/modals/tag/tag_add.php b/admin/modals/tag/tag_add.php index 4d8913bdb..473f61791 100644 --- a/admin/modals/tag/tag_add.php +++ b/admin/modals/tag/tag_add.php @@ -17,6 +17,8 @@ if (isset($_GET['type'])) { $type_display = "Credential"; } elseif ($type === 5) { $type_display = "Asset"; + } elseif ($type === 6) { + $type_display = "Vendor"; } } ob_start(); diff --git a/admin/modals/tag/tag_edit.php b/admin/modals/tag/tag_edit.php index 22c74ffac..f7cfc8a5d 100644 --- a/admin/modals/tag/tag_edit.php +++ b/admin/modals/tag/tag_edit.php @@ -22,6 +22,8 @@ if ($tag_type == 1) { $tag_type_display = "Credential"; } elseif ( $tag_type == 5) { $tag_type_display = "Asset"; +} elseif ($tag_type == 6) { + $tag_type_display = "Vendor"; } else { $tag_type_display = "Unknown"; } diff --git a/admin/post/demo_data_model.php b/admin/post/demo_data_model.php index d1361fbe5..dd116be30 100644 --- a/admin/post/demo_data_model.php +++ b/admin/post/demo_data_model.php @@ -410,6 +410,57 @@ function demoAttachTags($mysqli, $join_table, $join_column, $tag_column, $row_id } } +// ------------------------------ +// demoVendorTags / demoVendorManager +// What kind of vendor each demo vendor is, as Tags starter pack vendor tags, +// and the account manager who looks after the account - a name, a direct +// line and an email at the vendor's domain, the same every time it is seeded. +// ------------------------------ +function demoVendorTags($name, $description, $notes = '', $ours = false) { + if ($ours) { + $map = [ + 'Distribution' => ['Distributor', 'Hardware'], 'Netgate' => ['Hardware', 'Security'], 'Ubiquiti' => ['Hardware'], + 'Synology' => ['Hardware'], 'Proxmox' => ['Software'], 'Nextcloud' => ['Cloud', 'Hosting'], 'Licensing' => ['Cloud', 'Distributor'], + 'Colocation' => ['Hosting'], 'Bank' => ['Professional Services'], 'CPA' => ['Professional Services'], + 'Insurance' => ['Professional Services'], 'Property' => ['Professional Services'], + ]; + foreach ($map as $match => $tags) { + if (stripos($name, $match) !== false) { + return $tags; + } + } + return []; + } + $text = "$name $description"; + $tags = []; + if (preg_match('/internet|fibre|fiber|circuit|broadband|connect|wireless|cable/i', $text)) { + $tags[] = 'ISP'; + } + if (preg_match('/phone|telecom|voice/i', $text)) { + $tags[] = 'Telecom'; + } + if (!$tags) { + $tags[] = 'Line of Business'; + } + if (stripos($notes, 'authorised list') !== false) { + $tags[] = 'Authorised Contacts Only'; + } + return $tags; +} + +function demoVendorManager($name, $phone, $domain) { + $people = ['Dana Whitlock', 'Marcus Feld', 'Priya Raman', 'Owen Castell', 'Jolene Avery', 'Theo Marsh', 'Rosa Delgado', 'Ian Kowalski', 'Hannah Pryce', 'Victor Lund']; + $person = $people[crc32($name) % count($people)]; + $digits = preg_replace('/[^0-9]/', '', (string) $phone); + $direct = $digits !== '' ? substr($digits, 0, -2) . str_pad((string) ((intval(substr($digits, -2)) + 37) % 100), 2, '0', STR_PAD_LEFT) : ''; + return [ + 'vendor_contact_name' => $person, + 'vendor_contact_phone_country_code' => '1', + 'vendor_contact_phone' => $direct, + 'vendor_contact_email' => strtolower(str_replace(' ', '.', $person)) . '@' . $domain, + ]; +} + // ------------------------------ // demoLink // The relationship joins are all two integer columns. Linking assets to the @@ -475,10 +526,9 @@ function demoEnsureOrgVendors($mysqli) { $vendors[$vendor[0]] = intval($row['vendor_id']); continue; } - $vendors[$vendor[0]] = starterInsert($mysqli, 'vendors', [ + $vendors[$vendor[0]] = starterInsert($mysqli, 'vendors', demoVendorManager($vendor[0], $vendor[2], $vendor[3]) + [ 'vendor_name' => $vendor[0], 'vendor_description' => $vendor[1], - 'vendor_contact_name' => 'Account Manager', 'vendor_phone_country_code' => '1', 'vendor_phone' => $vendor[2], 'vendor_extension' => (string)(200 + (crc32($vendor[0]) % 90)), @@ -492,6 +542,7 @@ function demoEnsureOrgVendors($mysqli) { 'vendor_client_id' => 0, 'vendor_created_at' => demoMonthDateTime(24, 2, 9, 0), ]); + demoAttachTags($mysqli, 'vendor_tags', 'vendor_id', 'tag_id', $vendors[$vendor[0]], 6, demoVendorTags($vendor[0], $vendor[1], '', true)); } return $vendors; @@ -1170,10 +1221,9 @@ function demoBuildClient($mysqli, $profile, $index, $context, &$counts) { // The client's own vendors - who they buy their line of business kit from $vendor_ids = []; foreach ($profile['vendors'] as $vendor_index => $vendor) { - $vendor_ids[] = starterInsert($mysqli, 'vendors', [ + $vendor_id = starterInsert($mysqli, 'vendors', demoVendorManager($vendor[0], $vendor[2], $vendor[3]) + [ 'vendor_name' => $vendor[0], 'vendor_description' => $vendor[1], - 'vendor_contact_name' => 'Business Support', 'vendor_phone_country_code' => '1', 'vendor_phone' => $vendor[2], 'vendor_email' => 'support@' . $vendor[3], @@ -1183,9 +1233,12 @@ function demoBuildClient($mysqli, $profile, $index, $context, &$counts) { 'vendor_code' => demoSerial($profile['abbreviation'] . $vendor[0], 6), 'vendor_account_number' => demoSerial($profile['abbreviation'] . 'acct' . $vendor_index, 8), 'vendor_notes' => $vendor[5], + 'vendor_favorite' => $vendor_index === 0 ? 1 : 0, 'vendor_client_id' => $client_id, 'vendor_created_at' => demoMonthDateTime($months, 5, 13, 0), ]); + demoAttachTags($mysqli, 'vendor_tags', 'vendor_id', 'tag_id', $vendor_id, 6, demoVendorTags($vendor[0], $vendor[1], $vendor[5])); + $vendor_ids[] = $vendor_id; $counts['documentation']++; } $primary_vendor_id = $vendor_ids[0] ?? 0; diff --git a/admin/post/starter_content_model.php b/admin/post/starter_content_model.php index 96a406f7d..e578e67bb 100644 --- a/admin/post/starter_content_model.php +++ b/admin/post/starter_content_model.php @@ -30,7 +30,7 @@ function starterContentPacks() { 'tags' => [ 'label' => 'Tags', 'icon' => 'fa-tags', - 'description' => 'Client, location, contact, credential and asset tags.', + 'description' => 'Client, location, contact, credential, asset and vendor tags.', ], 'ticket_templates' => [ 'label' => 'Ticket Templates', @@ -661,6 +661,20 @@ function starterContentTags() { [5, 'Leased', '#6c757d', 'file-contract'], [5, 'Spare Stock', '#795548', 'boxes'], [5, 'Patch Excluded', '#ffc107', 'ban'], + + // Vendor + [6, 'ISP', '#007bff', 'wifi'], + [6, 'Telecom', '#28a745', 'phone-alt'], + [6, 'Line of Business', '#6f42c1', 'cubes'], + [6, 'Software', '#20c997', 'window-restore'], + [6, 'Hardware', '#001f3f', 'server'], + [6, 'Cloud', '#0078d4', 'cloud'], + [6, 'Security', '#dc3545', 'shield-alt'], + [6, 'Distributor', '#795548', 'truck'], + [6, 'Printing', '#6c757d', 'print'], + [6, 'Hosting', '#17a2b8', 'globe'], + [6, 'Professional Services', '#343a40', 'briefcase'], + [6, 'Authorised Contacts Only', '#d81b60', 'user-lock'], ]; return $tags; diff --git a/admin/post/vendor_template.php b/admin/post/vendor_template.php index fb4777d7d..edbca17b9 100644 --- a/admin/post/vendor_template.php +++ b/admin/post/vendor_template.php @@ -25,7 +25,7 @@ if (isset($_POST['add_vendor_template'])) { $code = escapeSql($_POST['code']); $notes = escapeSql($_POST['notes']); - mysqli_query($mysqli,"INSERT INTO vendor_templates SET vendor_template_name = '$name', vendor_template_description = '$description', vendor_template_contact_name = '$contact_name', vendor_template_phone = '$phone', vendor_template_extension = '$extension', vendor_template_email = '$email', vendor_template_website = '$website', vendor_template_hours = '$hours', vendor_template_sla = '$sla', vendor_template_code = '$code', vendor_template_account_number = '$account_number', vendor_template_notes = '$notes'"); + mysqli_query($mysqli,"INSERT INTO vendor_templates SET vendor_template_name = '$name', vendor_template_description = '$description', vendor_template_contact_name = '$contact_name', vendor_template_phone_country_code = '$phone_country_code', vendor_template_phone = '$phone', vendor_template_extension = '$extension', vendor_template_email = '$email', vendor_template_website = '$website', vendor_template_hours = '$hours', vendor_template_sla = '$sla', vendor_template_code = '$code', vendor_template_account_number = '$account_number', vendor_template_notes = '$notes'"); $vendor_template_id = mysqli_insert_id($mysqli); @@ -132,7 +132,10 @@ if (isset($_POST['edit_vendor_template'])) { // Remove the first comma to prevent MySQL error $sql = preg_replace('/,/', '', $sql, 1); - mysqli_query($mysqli,"UPDATE vendors SET $sql WHERE vendor_template_id = $vendor_template_id"); + // Nothing ticked to push - nothing to update, rather than an empty SET + if (trim($sql) !== '') { + mysqli_query($mysqli,"UPDATE vendors SET $sql WHERE vendor_template_id = $vendor_template_id"); + } } logAudit("Vendor Template", "Edit", "$session_name edited vendor template $name", 0, $vendor_template_id); diff --git a/admin/tags.php b/admin/tags.php index e3a8ce76c..8d2320d86 100644 --- a/admin/tags.php +++ b/admin/tags.php @@ -19,6 +19,7 @@ $tag_types = [ 3 => ['label' => 'Contact', 'icon' => 'fa-address-book'], 4 => ['label' => 'Credential', 'icon' => 'fa-key'], 5 => ['label' => 'Asset', 'icon' => 'fa-desktop'], + 6 => ['label' => 'Vendor', 'icon' => 'fa-building'], ]; // Label for the selected type diff --git a/admin/vendor_templates.php b/admin/vendor_templates.php index 0b44072d6..46a905c63 100644 --- a/admin/vendor_templates.php +++ b/admin/vendor_templates.php @@ -17,6 +17,13 @@ $sql = mysqli_query( $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); +// How many clients have a vendor made from each template +$template_use = []; +$sql_template_use = mysqli_query($mysqli, "SELECT vendor_template_id, COUNT(DISTINCT vendor_client_id) FROM vendors WHERE vendor_template_id > 0 AND vendor_client_id > 0 AND vendor_archived_at IS NULL GROUP BY vendor_template_id"); +while ($use_row = mysqli_fetch_row($sql_template_use)) { + $template_use[intval($use_row[0])] = intval($use_row[1]); +} + ?>
@@ -59,6 +66,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); Contact + Used by Action @@ -95,7 +103,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); - + + + + + client + + - + +
+ +
PIN
+
Phone
@@ -285,7 +289,7 @@ if (!$license || ($client_url && intval($license['software_client_id']) !== intv
-
Website
+
Website
Hours
diff --git a/agent/modals/asset/asset_add.php b/agent/modals/asset/asset_add.php index 76322934d..7cace027e 100644 --- a/agent/modals/asset/asset_add.php +++ b/agent/modals/asset/asset_add.php @@ -21,7 +21,9 @@ $asset_ip = $asset_ipv6 = $asset_nat_ip = $asset_mac = $asset_uri = $asset_uri_2 $asset_status = $asset_purchase_reference = $asset_purchase_date = $asset_install_date = $asset_warranty_expire = ''; $asset_physical_location = $asset_notes = $asset_photo = ''; $asset_favorite = 0; -$asset_vendor_id = $asset_network_id = 0; +$asset_network_id = 0; +// Opened from a vendor's page - bought from them +$asset_vendor_id = $client_id ? assetClientOwnedId('vendor', $_GET['vendor_id'] ?? 0, $client_id) : 0; // Opened from a location's page - start at that location $asset_location_id = $client_id ? assetClientOwnedId('location', $_GET['location_id'] ?? 0, $client_id) : 0; $asset_contact_id = intval($_GET['contact_id'] ?? 0); diff --git a/agent/modals/asset/asset_form.php b/agent/modals/asset/asset_form.php index d1c492983..5a5efde36 100644 --- a/agent/modals/asset/asset_form.php +++ b/agent/modals/asset/asset_form.php @@ -53,9 +53,9 @@ if ($client_id) { while ($row = mysqli_fetch_assoc($sql)) { $network_options[] = $row; } - $sql = mysqli_query($mysqli, "SELECT vendor_archived_at, vendor_id, vendor_name FROM vendors + $sql = mysqli_query($mysqli, "SELECT vendor_archived_at, vendor_id, vendor_name, vendor_description FROM vendors WHERE vendor_client_id = $client_id AND (vendor_archived_at IS NULL OR vendor_id = $asset_vendor_id) - ORDER BY vendor_name ASC"); + ORDER BY vendor_favorite DESC, vendor_name ASC"); while ($row = mysqli_fetch_assoc($sql)) { $vendor_options[] = $row; } @@ -384,7 +384,7 @@ $asset_form_icons = [ - +
diff --git a/agent/modals/credential/credential_add.php b/agent/modals/credential/credential_add.php index b2d0fcf92..8ff05da0e 100644 --- a/agent/modals/credential/credential_add.php +++ b/agent/modals/credential/credential_add.php @@ -5,16 +5,20 @@ require_once '../../../includes/modal_header.php'; $client_id = intval($_GET['client_id'] ?? 0); $contact_id = intval($_GET['contact_id'] ?? 0); $asset_id = intval($_GET['asset_id'] ?? 0); +// Opened from a vendor's page - their portal login, linked to them +$vendor_id = $client_id ? assetClientOwnedId('vendor', $_GET['vendor_id'] ?? 0, $client_id) : 0; +$vendor_name = $vendor_id ? getFieldById('vendors', $vendor_id, 'vendor_name') : ''; ob_start(); ?>
-
New Credential
+
New Credential for
+
diff --git a/agent/modals/document/document_add.php b/agent/modals/document/document_add.php index aa9549812..9e300c2a2 100644 --- a/agent/modals/document/document_add.php +++ b/agent/modals/document/document_add.php @@ -2,7 +2,7 @@ /* * New document - in the folder it was opened from, or linked to the asset, - * contact, license or location it was opened from. + * contact, license, location or vendor it was opened from. */ require_once '../../../includes/modal_header.php'; @@ -18,7 +18,8 @@ $asset_id = $asset && intval($asset['client_id']) === $client_id ? intval($asset $software = linkRecord('software', $_GET['software_id'] ?? 0); $software_id = $software && intval($software['client_id']) === $client_id ? intval($software['id']) : 0; $location_id = assetClientOwnedId('location', $_GET['location_id'] ?? 0, $client_id); -$link_name = $asset_id ? $asset['name'] : ($contact_id ? getFieldById('contacts', $contact_id, 'contact_name') : ($software_id ? $software['name'] : ($location_id ? getFieldById('locations', $location_id, 'location_name') : ''))); +$vendor_id = assetClientOwnedId('vendor', $_GET['vendor_id'] ?? 0, $client_id); +$link_name = $asset_id ? $asset['name'] : ($contact_id ? getFieldById('contacts', $contact_id, 'contact_name') : ($software_id ? $software['name'] : ($location_id ? getFieldById('locations', $location_id, 'location_name') : ($vendor_id ? getFieldById('vendors', $vendor_id, 'vendor_name') : '')))); $document_form_mode = 'add'; $document_name = $document_description = $document_content = ''; @@ -39,6 +40,7 @@ ob_start(); +
diff --git a/agent/modals/domain/domain_add.php b/agent/modals/domain/domain_add.php index eaa422f21..4afcbe92f 100644 --- a/agent/modals/domain/domain_add.php +++ b/agent/modals/domain/domain_add.php @@ -85,12 +85,12 @@ ob_start(); - +
@@ -104,12 +104,12 @@ ob_start(); - +
@@ -123,12 +123,12 @@ ob_start(); - + @@ -142,12 +142,12 @@ ob_start(); - + diff --git a/agent/modals/domain/domain_edit.php b/agent/modals/domain/domain_edit.php index d9f8780e6..5a6f034ba 100644 --- a/agent/modals/domain/domain_edit.php +++ b/agent/modals/domain/domain_edit.php @@ -92,12 +92,12 @@ ob_start(); - + @@ -132,12 +132,12 @@ ob_start(); - + diff --git a/agent/modals/expense/expense_add.php b/agent/modals/expense/expense_add.php index a7f2a5486..e0b5def43 100644 --- a/agent/modals/expense/expense_add.php +++ b/agent/modals/expense/expense_add.php @@ -3,6 +3,8 @@ require_once '../../../includes/modal_header.php'; $client_id = intval($_GET['client_id'] ?? 0); +// Opened from one of our vendors' pages - that vendor +$prefill_vendor_id = intval($_GET['vendor_id'] ?? 0); ob_start(); @@ -80,12 +82,12 @@ ob_start(); - + - + '$expense_created_at' OR vendor_archived_at IS NULL) ORDER BY vendor_name ASC"); + $sql_select = mysqli_query($mysqli, "SELECT vendor_id, vendor_name, vendor_description FROM vendors WHERE vendor_client_id = 0 AND (vendor_archived_at > '$expense_created_at' OR vendor_archived_at IS NULL OR vendor_id = $expense_vendor_id) ORDER BY vendor_favorite DESC, vendor_name ASC"); while ($row = mysqli_fetch_assoc($sql_select)) { $vendor_id_select = intval($row['vendor_id']); $vendor_name_select = escapeHtml($row['vendor_name']); ?> - + "> +
diff --git a/agent/modals/ticket/ticket_add.php b/agent/modals/ticket/ticket_add.php index b27f68edb..7cd3063fb 100644 --- a/agent/modals/ticket/ticket_add.php +++ b/agent/modals/ticket/ticket_add.php @@ -7,6 +7,7 @@ $contact_id = intval($_GET['contact_id'] ?? 0); $project_id = intval($_GET['project_id'] ?? 0); $asset_id = intval($_GET['asset_id'] ?? 0); $location_id = intval($_GET['location_id'] ?? 0); +$vendor_id = intval($_GET['vendor_id'] ?? 0); // A ticket started from somewhere that knows what it is about (a license's // Renewal Ticket) - plain text in, escaped here @@ -247,7 +248,7 @@ ob_start();
-
diff --git a/agent/modals/ticket/ticket_edit.php b/agent/modals/ticket/ticket_edit.php index d47642e8d..4d41c77d0 100644 --- a/agent/modals/ticket/ticket_edit.php +++ b/agent/modals/ticket/ticket_edit.php @@ -306,12 +306,14 @@ ob_start(); - + No vendor - + 'That vendor no longer exists.']); + exit; +} +$client_id = intval($vendor['vendor_client_id']); if ($client_id) { + enforceUserPermission('module_client'); enforceClientAccess(); } -// Licenses bought through this vendor - soonest renewal first -$vendor_licenses = []; -if (lookupUserPermission('module_support') >= 1) { - $sql_vendor_licenses = mysqli_query($mysqli, "SELECT software_id AS id, software_name AS name, software_type, software_version, software_license_type, +$vendor_name = escapeHtml($vendor['vendor_name']); +$vendor_archived = !empty($vendor['vendor_archived_at']); +$vendor_phone = contactPhoneLink($vendor['vendor_phone'], $vendor['vendor_phone_country_code'], $vendor['vendor_extension']); +$vendor_dial = vendorDialNumber($vendor['vendor_phone'], $vendor['vendor_phone_country_code']); +$vendor_email = escapeHtml($vendor['vendor_email']); +$vendor_website_url = vendorWebsiteUrl($vendor['vendor_website']); +$vendor_account = escapeHtml($vendor['vendor_account_number']); +$vendor_pin = vendorSecretHtml($vendor['vendor_code']); +$vendor_notes = escapeHtml($vendor['vendor_notes']); +$manager_phone = contactPhoneLink($vendor['vendor_contact_phone'], $vendor['vendor_contact_phone_country_code']); +$manager_email = escapeHtml($vendor['vendor_contact_email']); + +$can_edit = vendorCan($client_id, 2) && !$vendor_archived; +$can_support = lookupUserPermission('module_support') >= 1; +$can_support_edit = lookupUserPermission('module_support') >= 2; +$can_credentials = lookupUserPermission('module_credential') >= 1; +$can_financial = lookupUserPermission('module_financial') >= 1; + +$cases = $licenses = $assets = $logins = []; +if ($can_support) { + $sql = mysqli_query($mysqli, "SELECT ticket_id, ticket_prefix, ticket_number, ticket_subject, ticket_vendor_ticket_number, ticket_status_name, ticket_status_color + FROM tickets + LEFT JOIN ticket_statuses ON ticket_status_id = ticket_status + WHERE ticket_client_id = $client_id AND ticket_vendor_id = $vendor_id AND ticket_resolved_at IS NULL AND ticket_closed_at IS NULL + ORDER BY ticket_number DESC"); + while ($row = mysqli_fetch_assoc($sql)) { + $cases[] = $row; + } + $sql = mysqli_query($mysqli, "SELECT software_id AS id, software_name AS name, software_type, software_version, software_license_type, software_seats, software_expire, " . softwareSeatsUsedSql('software.software_id') . " AS seats_used FROM software - WHERE software_vendor_id = $vendor_id AND software_archived_at IS NULL " . clientScopeSql('software_client_id') . " + WHERE software_client_id = $client_id AND software_vendor_id = $vendor_id AND software_archived_at IS NULL ORDER BY software_expire IS NULL, software_expire ASC, software_name ASC"); - while ($vendor_license = mysqli_fetch_assoc($sql_vendor_licenses)) { - $vendor_licenses[] = $vendor_license; + while ($row = mysqli_fetch_assoc($sql)) { + $licenses[] = $row; + } + $sql = mysqli_query($mysqli, "SELECT asset_id AS id, asset_name AS name, asset_type, asset_make, asset_model, asset_warranty_expire + FROM assets + WHERE asset_client_id = $client_id AND asset_vendor_id = $vendor_id AND asset_archived_at IS NULL + ORDER BY asset_type ASC, asset_name ASC"); + while ($row = mysqli_fetch_assoc($sql)) { + $assets[] = $row; } } +if ($can_credentials && $client_id) { + $logins = linkedRecords('vendor', $vendor_id, 'credential'); +} +$spend = !$client_id && $can_financial ? vendorSpend($vendor_id) : null; + +$quick_tabs = array_filter([ + 'cases' => ['label' => 'Open cases', 'count' => count($cases)], + 'licenses' => ['label' => 'Licenses', 'count' => count($licenses)], + 'assets' => ['label' => 'Assets', 'count' => count($assets)], + 'logins' => ['label' => 'Logins', 'count' => count($logins)], +], function ($tab) { + return $tab['count'] > 0; +}); +$first_tab = array_key_first($quick_tabs); +$quick_id = "vendor-quick-$vendor_id"; +$page_url = 'vendor.php?' . ($client_id ? "client_id=$client_id&" : '') . "vendor_id=$vendor_id"; ob_start(); ?> -
-
- -
-
-
+
+
+ +
+
+ + + Archived +
+
+ + +
- +
-
+
- -
-
-
Vendor Details
-
-
-
Account Number:
-
Hours:
-
SLA:
-
-
-
Code:
-
Website: ' . $website . '' : 'Not Available' ?>
-
+ +
+
+
+ + No support line' ?>
+ +
+ + +
+ + +
+ + +
+ + +
+ + +
+ +
+
+
+ + ' . $vendor_account . '' : 'No account number' ?> +
+ +
+ + +
+ + +
+ + + + · +
+ +
+ + +
+ + this year · last +
+
- -
-
-
Contact Information
-
-
-
Contact Name:
-
Phone:
-
-
-
Email: ' . $email . '' : 'Not Available' ?>
-
-
+ +
+ + Call support + + + Email + + + Support site + + + New case +
-
+ - - -
-
-
Licenses
-
    - -
    • - -
+ + + + + + +
+
    + $tab) { ?> + + +
+ +
+ +
+
+ + + + + + + + + + + +
Theirs
+
+
+ + + ['software', $licenses], 'logins' => ['credential', $logins]] as $pane => [$to, $rows]) { + if (!$rows) { + continue; + } ?> +
+
    + +
    • + +
+
+ + + +
+
    + +
  • + + + + +
    • + +
+
+
- -
-
-
Notes
-
- -
-
-
-
+
+ Open vendor + + + + +
+ + + $value) { + if ($field === 'vendor_template_id') { + $vendor_template_id = intval($value); + } else { + ${"vendor_$field"} = escapeHtml($value); + } + } } ob_start(); ?>
-
New Vendor
+
New Vendor
- + + +
- - -
- -
-
-
- -
- - -
-
- -
- -
- - -
-
- -
- -
- - -
-
- -
- -
- - -
-
-
- -
- -
-
-
-
- - - -
-
-
-
-
- -
-
-
- -
- -
- - -
-
- -
- -
- - -
-
- -
- -
- - -
-
- -
- -
- - -
-
- -
- -
- - -
-
-
- -
-
- -
-
- -
- +
- +
- -
-
New Vendor from Template
- -
-
- - - -
- - -
-
- - -
-
- -
- -
- - -
-
- - 'That vendor no longer exists.']); + exit; } +$client_id = intval($vendor['vendor_client_id']); +vendorEnforce($client_id, 2); + +$vendor_form_mode = 'edit'; +$vendor_pick_client = false; +$vendor_name = escapeHtml($vendor['vendor_name']); +$vendor_description = escapeHtml($vendor['vendor_description']); +$vendor_account_number = escapeHtml($vendor['vendor_account_number']); +$vendor_code = escapeHtml($vendor['vendor_code']); +$vendor_contact_name = escapeHtml($vendor['vendor_contact_name']); +$vendor_contact_phone_country_code = escapeHtml($vendor['vendor_contact_phone_country_code']); +$vendor_contact_phone = escapeHtml(formatPhoneNumber($vendor['vendor_contact_phone'], $vendor['vendor_contact_phone_country_code'], false)); +$vendor_contact_email = escapeHtml($vendor['vendor_contact_email']); +$vendor_phone_country_code = escapeHtml($vendor['vendor_phone_country_code']); +$vendor_phone = escapeHtml(formatPhoneNumber($vendor['vendor_phone'], $vendor['vendor_phone_country_code'], false)); +$vendor_extension = escapeHtml($vendor['vendor_extension']); +$vendor_email = escapeHtml($vendor['vendor_email']); +$vendor_website = escapeHtml($vendor['vendor_website']); +$vendor_hours = escapeHtml($vendor['vendor_hours']); +$vendor_sla = escapeHtml($vendor['vendor_sla']); +$vendor_notes = escapeHtml($vendor['vendor_notes']); +$vendor_favorite = intval($vendor['vendor_favorite']); +$vendor_template_id = intval($vendor['vendor_template_id']); +$vendor_tag_ids = array_map(function ($tag) { + return intval($tag['tag_id']); +}, tagsForRecord('vendor', $vendor_id)); ob_start(); ?> -
-
Editing vendor:
+
Editing vendor:
+
- - - -
- -
- -
- -
- -
- - " required> -
-
- -
- -
- - -
-
- -
- -
- - -
-
- -
- -
- - -
-
- -
- -
- - -
-
- -
- -
- - -
-
-
-
- - - -
-
-
-
-
- -
-
-
- -
- -
- - -
-
- -
- -
- - -
-
- -
- -
- - -
-
- -
- -
- - -
-
- -
- -
- - -
-
- -
- -
- -
- -
- -

Vendor ID:

- -
- -
- +
- +
-
Export Vendors
+
Export
@@ -31,6 +42,7 @@ ob_start();
+
@@ -39,15 +51,50 @@ ob_start();
- - + + +
+
+ + +
+ +
+ + +
+
+ + +
+ +
+ +
- + > + + + + + +
+
Fills in their support line, hours and site - then add this client's account number and PIN.
+
+ + +
+ +
+ + +
+
+ +
+ +
+ + > +
+
+
+ +
+ > + +
+
+
+ +
+ + +
+
+
+ + +
+ + + + + +
+
+ +
+ +
+ + +
+
Template changes can be pushed to every vendor based on it, from Admin › Vendor Templates.
+
+ + + +
+ +

Vendor ID

+ +
+ + +
+
+
+ +
+ + + +
+
+
+ + +
+
+ +
+ + +
+
+
+ +
+ + +
+
+
+ +
+ + +
+
+
+ +
+ + +
+
Link the portal login itself from the vendor's Logins tab.
+
+
+
+ + +
+
+
+ +
+ + +
+
+
+ +
+ + +
+
+
+
What support asks for before they will talk - shown beside the support line, the PIN as dots until it is asked for.
+
+
+ +
+ + +
+
+
+ +
+ + + +
+
+
+ +
+ + +
+
+
+
+ + +
+ + +
Shown on the vendor's page and its quick look.
+
+ +
+ + diff --git a/agent/modals/vendor/vendor_template_clients.php b/agent/modals/vendor/vendor_template_clients.php new file mode 100644 index 000000000..5a4b9360e --- /dev/null +++ b/agent/modals/vendor/vendor_template_clients.php @@ -0,0 +1,114 @@ + + * Vendor Templates, so it posts to the agent handler by its full path. A client that already has a vendor made from the + * template is shown as having it and is left alone. + */ + +require_once '../../../includes/modal_header.php'; + +enforceUserPermission('module_client', 2); + +$templates = []; +$sql = mysqli_query($mysqli, "SELECT vendor_template_id, vendor_template_name, vendor_template_description FROM vendor_templates WHERE vendor_template_archived_at IS NULL ORDER BY vendor_template_name ASC"); +while ($row = mysqli_fetch_assoc($sql)) { + $templates[] = $row; +} +if (!$templates) { + echo json_encode(['error' => 'There are no vendor templates yet - an admin adds them under Admin > Vendor Templates.']); + exit; +} + +$template_id = intval($_GET['template_id'] ?? 0); +$template_ids = array_map(function ($t) { return intval($t['vendor_template_id']); }, $templates); +if (!in_array($template_id, $template_ids, true)) { + $template_id = $template_ids[0]; +} + +// Which clients already have a vendor from each template +$has = []; +$sql = mysqli_query($mysqli, "SELECT DISTINCT vendor_template_id, vendor_client_id FROM vendors WHERE vendor_template_id > 0 AND vendor_client_id > 0"); +while ($row = mysqli_fetch_row($sql)) { + $has[intval($row[0])][intval($row[1])] = true; +} + +$clients = []; +$sql = mysqli_query($mysqli, "SELECT client_id, client_name, client_abbreviation FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC"); +while ($row = mysqli_fetch_assoc($sql)) { + $clients[] = $row; +} + +ob_start(); + +?> +
+
Add a Vendor to Clients
+ +
+ + + +
+
+ +
+ + +
+
+ + +
> + +
+ + +
+
Each gets its own copy - add their account number and PIN after.
+
+ +
+
+ + +
+ + + + +" . trim($_POST['name']) . " created"); - // From an asset, a contact, a license or a location, back to it; otherwise to the new document - redirect(($contact_id || $asset_id || $software_id || $location_id) ? null : "document.php?client_id=$client_id&document_id=$document_id"); + // From an asset, a contact, a license, a location or a vendor, back to it; otherwise to the new document + redirect(($contact_id || $asset_id || $software_id || $location_id || $vendor_id) ? null : "document.php?client_id=$client_id&document_id=$document_id"); } diff --git a/agent/post/file.php b/agent/post/file.php index 9fa4f130a..eb9820fd1 100644 --- a/agent/post/file.php +++ b/agent/post/file.php @@ -28,7 +28,7 @@ if (isset($_POST['upload_files'])) { enforceClientAccess(); - // Only the client's own folder, contact, asset, license and location + // Only the client's own folder, contact, asset, license, location and vendor $folder_id = folderOwnedId($_POST['folder_id'] ?? 0, $client_id); $contact_id = assetClientOwnedId('contact', $_POST['contact_id'] ?? 0, $client_id); $asset = linkRecord('asset', $_POST['asset_id'] ?? 0); @@ -36,6 +36,7 @@ if (isset($_POST['upload_files'])) { $software = linkRecord('software', $_POST['software_id'] ?? 0); $software_id = $software && intval($software['client_id']) === $client_id ? intval($software['id']) : 0; $location_id = assetClientOwnedId('location', $_POST['location_id'] ?? 0, $client_id); + $vendor_id = assetClientOwnedId('vendor', $_POST['vendor_id'] ?? 0, $client_id); if (!is_dir($client_dir)) { mkdir($client_dir, 0755, true); @@ -106,6 +107,9 @@ if (isset($_POST['upload_files'])) { if ($location_id) { mysqli_query($mysqli, "INSERT IGNORE INTO location_files SET location_id = $location_id, file_id = $file_id"); } + if ($vendor_id) { + mysqli_query($mysqli, "INSERT IGNORE INTO vendor_files SET vendor_id = $vendor_id, file_id = $file_id"); + } logAudit("File", "Upload", "$session_name uploaded file $file_name", $client_id, $file_id); diff --git a/agent/post/ticket.php b/agent/post/ticket.php index 2e37b98fd..b8a722ace 100644 --- a/agent/post/ticket.php +++ b/agent/post/ticket.php @@ -74,8 +74,9 @@ if (isset($_POST['add_ticket'])) { //Generate a unique URL key for clients to access $url_key = randomString(32); - // Only one of the ticket's own client's locations + // Only the ticket's own client's location and vendor $location_id = assetClientOwnedId('location', $location_id, $client_id); + $vendor_id = assetClientOwnedId('vendor', $vendor_id, $client_id); mysqli_query($mysqli, "INSERT INTO tickets SET ticket_prefix = '$config_ticket_prefix', ticket_number = $ticket_number, ticket_source = 'Agent', ticket_category = $category_id, ticket_subject = '$subject', ticket_details = '$details', ticket_priority = '$priority', ticket_billable = '$billable', ticket_status = '$ticket_status', ticket_vendor_ticket_number = '$vendor_ticket_number', ticket_vendor_id = $vendor_id, ticket_location_id = $location_id, ticket_asset_id = $asset_id, ticket_created_by = $session_user_id, ticket_assigned_to = $assigned_to, ticket_contact_id = $contact_id, ticket_url_key = '$url_key', ticket_due_at = $due, ticket_client_id = $client_id, ticket_invoice_id = 0, ticket_project_id = $project_id"); @@ -258,8 +259,9 @@ if (isset($_POST['edit_ticket'])) { * priority and assign handlers record - so read the originals first and * record the same changes when they come through here instead */ - // Only one of the ticket's own client's locations + // Only the ticket's own client's location and vendor $location_id = assetClientOwnedId('location', $location_id, $client_id); + $vendor_id = assetClientOwnedId('vendor', $vendor_id, $client_id); $original_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT ticket_priority, ticket_assigned_to FROM tickets WHERE ticket_id = $ticket_id")); $original_priority = escapeSql($original_row['ticket_priority']); @@ -775,6 +777,9 @@ if (isset($_POST['edit_ticket_vendor'])) { enforceClientAccess(); } + // Only the ticket's own client's vendors + $vendor_id = assetClientOwnedId('vendor', $vendor_id, $client_id); + mysqli_query($mysqli, "UPDATE tickets SET ticket_vendor_id = $vendor_id WHERE ticket_id = $ticket_id"); // The vendor modal now carries the vendor's own ticket number too. Only touched when the @@ -785,22 +790,21 @@ if (isset($_POST['edit_ticket_vendor'])) { } // Get ticket / vendor details for logging - $sql = mysqli_query($mysqli, "SELECT vendor_name, ticket_prefix, ticket_number, ticket_status_name, ticket_client_id FROM vendors - LEFT JOIN tickets ON ticket_vendor_id = $vendor_id - LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id - WHERE ticket_id = $ticket_id" - ); - $row = mysqli_fetch_assoc($sql); + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT ticket_prefix, ticket_number, vendor_name FROM tickets + LEFT JOIN vendors ON vendor_id = ticket_vendor_id + WHERE ticket_id = $ticket_id")); $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_status_name = escapeSql($row['ticket_status_name']); - $vendor_name = escapeSql($row['vendor_name']); - $client_id = intval($row['ticket_client_id']); + $vendor_name = (string) $row['vendor_name']; - logAudit("Ticket", "Edit", "$session_name set vendor to $vendor_name for ticket $ticket_prefix$ticket_number", $client_id, $ticket_id); - - flashAlert("Set vendor to $vendor_name for ticket $ticket_prefix$ticket_number"); + if ($vendor_id) { + logAudit("Ticket", "Edit", "$session_name set vendor to " . escapeSql($vendor_name) . " for ticket $ticket_prefix$ticket_number", $client_id, $ticket_id); + flashAlert("Set vendor to $vendor_name for ticket $ticket_prefix$ticket_number"); + } else { + logAudit("Ticket", "Edit", "$session_name removed the vendor from ticket $ticket_prefix$ticket_number", $client_id, $ticket_id); + flashAlert("Removed the vendor from ticket $ticket_prefix$ticket_number"); + } redirect(); diff --git a/agent/post/vendor.php b/agent/post/vendor.php index ca0bca4f2..9a921da77 100644 --- a/agent/post/vendor.php +++ b/agent/post/vendor.php @@ -2,87 +2,70 @@ /* * ITFlow - GET/POST request handler for vendors + * + * A client's vendors are the client module's; ours (no client) are the + * financial module's - vendorEnforce() (functions/vendor.php) checks the right + * one, and the client access, for the vendor a request names rather than for + * whatever the form says. Documents, files and portal logins are linked to a + * vendor through post/link.php; the notes save through ajax.php. */ - // Todo: 2026-03-02 JQ - Need Permssions reworked as we have client vendors and Global Vendors basically check the referral url if it has client_id then Perm check client else perm check financial. - defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); -if (isset($_POST['add_vendor_from_template'])) { - - validateCSRFToken(); - - // GET POST Data - $client_id = intval($_POST['client_id']); //Used if this vendor is under a contact otherwise its 0 for under company and or template - - // Permission check - if ($client_id) { - enforceUserPermission('module_client', 2); - enforceClientAccess(); - } else { - enforceUserPermission('module_financial', 2); +/** The vendor a request names, once the agent may do this to it - or back with an error if it is gone. */ +function vendorForRequest($vendor_id, $level) { + global $client_id; + $row = vendorRow($vendor_id); + if (!$row) { + flashAlert('That vendor no longer exists.', 'error'); + redirect(); } - - $vendor_template_id = intval($_POST['vendor_template_id']); - - //GET Vendor Info - $sql_vendor_templates = mysqli_query($mysqli,"SELECT vendor_template_account_number, vendor_template_code, vendor_template_contact_name, - vendor_template_description, vendor_template_email, vendor_template_extension, - vendor_template_hours, vendor_template_name, vendor_template_notes, vendor_template_phone, - vendor_template_phone_country_code, vendor_template_sla, vendor_template_website FROM vendor_templates WHERE vendor_template_id = $vendor_template_id"); - - $row = mysqli_fetch_assoc($sql_vendor_templates); - - $name = escapeSql($row['vendor_template_name']); - $description = escapeSql($row['vendor_template_description']); - $account_number = escapeSql($row['vendor_template_account_number']); - $contact_name = escapeSql($row['vendor_template_contact_name']); - $phone_country_code = preg_replace("/[^0-9]/", '',$row['vendor_template_phone_country_code']); - $phone = preg_replace("/[^0-9]/", '',$row['vendor_template_phone']); - $extension = preg_replace("/[^0-9]/", '',$row['vendor_template_extension']); - $email = escapeSql($row['vendor_template_email']); - $website = escapeSql($row['vendor_template_website']); - $hours = escapeSql($row['vendor_template_hours']); - $sla = escapeSql($row['vendor_template_sla']); - $code = escapeSql($row['vendor_template_code']); - $notes = escapeSql($row['vendor_template_notes']); - - // Vendor add query - mysqli_query($mysqli,"INSERT INTO vendors SET vendor_name = '$name', vendor_description = '$description', vendor_contact_name = '$contact_name', vendor_phone_country_code = '$phone_country_code', vendor_phone = '$phone', vendor_extension = '$extension', vendor_email = '$email', vendor_website = '$website', vendor_hours = '$hours', vendor_sla = '$sla', vendor_code = '$code', vendor_account_number = '$account_number', vendor_notes = '$notes', vendor_client_id = $client_id, vendor_template_id = $vendor_template_id"); - - $vendor_id = mysqli_insert_id($mysqli); - - logAudit("Vendor", "Create", "$session_name created vendor $name using a template", $client_id, $vendor_id); - - flashAlert("Vendor $name created from template"); - - redirect(); - + $client_id = intval($row['vendor_client_id']); + vendorEnforce($client_id, $level); + return $row; } -// Vendors +/** Back to the list a vendor was on - its own page is gone once it is deleted. */ +function vendorRedirectAfterDelete($client_id) { + if (strpos($_SERVER['HTTP_REFERER'] ?? '', '/vendor.php') !== false) { + redirect($client_id ? "vendors.php?client_id=$client_id&archived=1" : 'vendors.php?archived=1'); + } + redirect(); +} + +/** Insert a vendor from a form's fields for this client - the new id, or 0 without a name. */ +function vendorCreate($fields, $client_id) { + global $mysqli; + $set = vendorFormSet($fields); + if ($set === null) { + return 0; + } + mysqli_query($mysqli, "INSERT INTO vendors SET $set, vendor_client_id = " . intval($client_id)); + return mysqli_insert_id($mysqli); +} if (isset($_POST['add_vendor'])) { validateCSRFToken(); - require_once 'vendor_model.php'; - - $client_id = intval($_POST['client_id']); // Used if this vendor is under a contact otherwise its 0 for under company - - // Permission check - if ($client_id) { - enforceUserPermission('module_client', 2); - enforceClientAccess(); - } else { - enforceUserPermission('module_financial', 2); + $client_id = intval($_POST['client_id'] ?? 0); + vendorEnforce($client_id, 2); + if ($client_id && !getFieldById('clients', $client_id, 'client_name')) { + flashAlert('That client no longer exists.', 'error'); + redirect(); } - mysqli_query($mysqli,"INSERT INTO vendors SET vendor_name = '$name', vendor_description = '$description', vendor_contact_name = '$contact_name', vendor_phone_country_code = '$phone_country_code', vendor_phone = '$phone', vendor_extension = '$extension', vendor_email = '$email', vendor_website = '$website', vendor_hours = '$hours', vendor_sla = '$sla', vendor_code = '$code', vendor_account_number = '$account_number', vendor_notes = '$notes', vendor_client_id = $client_id"); + $vendor_id = vendorCreate($_POST, $client_id); + if (!$vendor_id) { + flashAlert('A vendor needs a name.', 'error'); + redirect(); + } - $vendor_id = mysqli_insert_id($mysqli); + vendorSetTags($vendor_id, $_POST['tags'] ?? []); - logAudit("Vendor", "Create", "$session_name created vendor $name", $client_id, $vendor_id); + $name = trim($_POST['name']); + $template_note = intval($_POST['vendor_template_id'] ?? 0) ? ' from a template' : ''; + logAudit("Vendor", "Create", "$session_name created vendor " . escapeSql($name) . $template_note, $client_id, $vendor_id); flashAlert("Vendor $name created"); @@ -90,31 +73,109 @@ if (isset($_POST['add_vendor'])) { } +// Kept for anything still posting the old New from Template form - the vendor form now does both +if (isset($_POST['add_vendor_from_template'])) { + + validateCSRFToken(); + + $client_id = intval($_POST['client_id'] ?? 0); + vendorEnforce($client_id, 2); + + $template = vendorTemplateRow($_POST['vendor_template_id'] ?? 0); + if (!$template) { + flashAlert('That template no longer exists.', 'error'); + redirect(); + } + + $vendor_id = vendorCreate(vendorTemplateFormFields($template), $client_id); + + logAudit("Vendor", "Create", "$session_name created vendor " . escapeSql($template['vendor_template_name']) . " from a template", $client_id, $vendor_id); + + flashAlert("Vendor {$template['vendor_template_name']} created from template"); + + redirect(); + +} + +/* + * One template, added as a vendor to several clients at once - a new standard + * vendor rolled out everywhere. A client that already has a vendor made from + * this template is left alone. + */ +if (isset($_POST['add_vendor_template_to_clients'])) { + + validateCSRFToken(); + + enforceUserPermission('module_client', 2); + + $template = vendorTemplateRow($_POST['vendor_template_id'] ?? 0); + if (!$template) { + flashAlert('That template no longer exists.', 'error'); + redirect(); + } + $template_id = intval($template['vendor_template_id']); + $fields = vendorTemplateFormFields($template); + + $added = $already = 0; + foreach (array_unique(array_filter(array_map('intval', (array) ($_POST['client_ids'] ?? [])))) as $target_client_id) { + if (!hasClientAccess($target_client_id) || !getFieldById('clients', $target_client_id, 'client_name')) { + continue; + } + if (mysqli_num_rows(mysqli_query($mysqli, "SELECT 1 FROM vendors WHERE vendor_client_id = $target_client_id AND vendor_template_id = $template_id LIMIT 1"))) { + $already++; + continue; + } + $vendor_id = vendorCreate($fields, $target_client_id); + logAudit("Vendor", "Create", "$session_name created vendor " . escapeSql($template['vendor_template_name']) . " from a template", $target_client_id, $vendor_id); + $added++; + } + + flashAlert("Added {$template['vendor_template_name']} to $added client" . ($added === 1 ? '' : 's') . ($already ? " - $already already had it" : '')); + + redirect(); + +} + if (isset($_POST['edit_vendor'])) { validateCSRFToken(); - require_once 'vendor_model.php'; + $row = vendorForRequest($_POST['vendor_id'] ?? 0, 2); + $vendor_id = intval($row['vendor_id']); - $vendor_id = intval($_POST['vendor_id']); - $vendor_template_id = intval($_POST['vendor_template_id']); - - // Get Client ID - $client_id = intval(getFieldById('vendors', $vendor_id, 'vendor_client_id')); - - // Permission check - if ($client_id) { - enforceUserPermission('module_client', 2); - enforceClientAccess(); - } else { - enforceUserPermission('module_financial', 2); + $set = vendorFormSet($_POST); + if ($set === null) { + flashAlert('A vendor needs a name.', 'error'); + redirect(); } - mysqli_query($mysqli,"UPDATE vendors SET vendor_name = '$name', vendor_description = '$description', vendor_contact_name = '$contact_name', vendor_phone_country_code = '$phone_country_code', vendor_phone = '$phone', vendor_extension = '$extension', vendor_email = '$email', vendor_website = '$website', vendor_hours = '$hours', vendor_sla = '$sla', vendor_code = '$code',vendor_account_number = '$account_number', vendor_notes = '$notes', vendor_template_id = $vendor_template_id WHERE vendor_id = $vendor_id"); + mysqli_query($mysqli, "UPDATE vendors SET $set WHERE vendor_id = $vendor_id"); - logAudit("Vendor", "Edit", "$session_name edited vendor $name", $client_id, $vendor_id); + // Only a form that showed the tags changes them + if (isset($_POST['tags_form'])) { + vendorSetTags($vendor_id, $_POST['tags'] ?? []); + } - flashAlert("Vendor $name edited"); + $name = trim($_POST['name']); + logAudit("Vendor", "Edit", "$session_name edited vendor " . escapeSql($name), $client_id, $vendor_id); + + flashAlert("Vendor $name updated"); + + redirect(); + +} + +if (isset($_GET['favorite_vendor']) || isset($_GET['unfavorite_vendor'])) { + + validateCSRFToken(); + + $favorite = isset($_GET['favorite_vendor']) ? 1 : 0; + $row = vendorForRequest($favorite ? $_GET['favorite_vendor'] : $_GET['unfavorite_vendor'], 2); + $vendor_id = intval($row['vendor_id']); + + mysqli_query($mysqli, "UPDATE vendors SET vendor_favorite = $favorite WHERE vendor_id = $vendor_id"); + + logAudit("Vendor", "Edit", "$session_name " . ($favorite ? 'starred' : 'unstarred') . " vendor " . escapeSql($row['vendor_name']), $client_id, $vendor_id); redirect(); @@ -124,57 +185,31 @@ if (isset($_GET['archive_vendor'])) { validateCSRFToken(); - $vendor_id = intval($_GET['archive_vendor']); + $row = vendorForRequest($_GET['archive_vendor'], 2); + $vendor_id = intval($row['vendor_id']); - //Get Vendor Name - $sql = mysqli_query($mysqli,"SELECT vendor_client_id, vendor_name FROM vendors WHERE vendor_id = $vendor_id"); - $row = mysqli_fetch_assoc($sql); - $vendor_name = escapeSql($row['vendor_name']); - $client_id = intval($row['vendor_client_id']); + mysqli_query($mysqli, "UPDATE vendors SET vendor_archived_at = NOW() WHERE vendor_id = $vendor_id"); - // Permission check - if ($client_id) { - enforceUserPermission('module_client', 2); - enforceClientAccess(); - } else { - enforceUserPermission('module_financial', 2); - } + logAudit("Vendor", "Archive", "$session_name archived vendor " . escapeSql($row['vendor_name']), $client_id, $vendor_id); - mysqli_query($mysqli,"UPDATE vendors SET vendor_archived_at = NOW() WHERE vendor_id = $vendor_id"); - - logAudit("Vendor", "Archive", "$session_name archived vendor $vendor_name", $client_id, $vendor_id); - - flashAlert("Vendor $vendor_name archived", 'error'); + flashAlert("Vendor {$row['vendor_name']} archived", 'error'); redirect(); } -if(isset($_GET['restore_vendor'])){ +if (isset($_GET['restore_vendor'])) { validateCSRFToken(); - $vendor_id = intval($_GET['restore_vendor']); + $row = vendorForRequest($_GET['restore_vendor'], 2); + $vendor_id = intval($row['vendor_id']); - // Get Name and Client ID for logging and alert message - $sql = mysqli_query($mysqli,"SELECT vendor_name, vendor_client_id FROM vendors WHERE vendor_id = $vendor_id"); - $row = mysqli_fetch_assoc($sql); - $vendor_name = escapeSql($row['vendor_name']); - $client_id = intval($row['vendor_client_id']); + mysqli_query($mysqli, "UPDATE vendors SET vendor_archived_at = NULL WHERE vendor_id = $vendor_id"); - // Permission check - if ($client_id) { - enforceUserPermission('module_client', 2); - enforceClientAccess(); - } else { - enforceUserPermission('module_financial', 2); - } + logAudit("Vendor", "Restore", "$session_name restored vendor " . escapeSql($row['vendor_name']), $client_id, $vendor_id); - mysqli_query($mysqli,"UPDATE vendors SET vendor_archived_at = NULL WHERE vendor_id = $vendor_id"); - - logAudit("Vendor", "Restore", "$session_name restored vendor $vendor_name", $client_id, $vendor_id); - - flashAlert("Vendor $vendor_name restored"); + flashAlert("Vendor {$row['vendor_name']} restored"); redirect(); @@ -184,35 +219,24 @@ if (isset($_GET['delete_vendor'])) { validateCSRFToken(); - $vendor_id = intval($_GET['delete_vendor']); + $row = vendorForRequest($_GET['delete_vendor'], 3); + $vendor_id = intval($row['vendor_id']); - //Get Vendor Name - $sql = mysqli_query($mysqli,"SELECT vendor_client_id, vendor_name, vendor_template_id FROM vendors WHERE vendor_id = $vendor_id"); - $row = mysqli_fetch_assoc($sql); - $vendor_name = escapeSql($row['vendor_name']); - $client_id = intval($row['vendor_client_id']); - $vendor_template_id = intval($row['vendor_template_id']); - - // Permission check - if ($client_id) { - enforceUserPermission('module_client', 3); - enforceClientAccess(); - } else { - enforceUserPermission('module_financial', 3); + $blocker = vendorDeleteBlocker($vendor_id); + if ($blocker) { + flashAlert("{$row['vendor_name']} was not deleted - $blocker.", 'error'); + redirect(); } - // If its a template reset all vendors based off this template to no template base - if ($vendor_template_id > 0) { - mysqli_query($mysqli,"UPDATE vendors SET vendor_template_id = 0 WHERE vendor_template_id = $vendor_template_id"); - } + // What came from them stays, from no vendor; tags and links go with it + vendorClearReferences($vendor_id); + mysqli_query($mysqli, "DELETE FROM vendors WHERE vendor_id = $vendor_id"); - mysqli_query($mysqli,"DELETE FROM vendors WHERE vendor_id = $vendor_id"); + logAudit("Vendor", "Delete", "$session_name deleted vendor " . escapeSql($row['vendor_name']), $client_id); - logAudit("Vendor", "Delete", "$session_name deleted vendor $vendor_name", $client_id); + flashAlert("Vendor {$row['vendor_name']} deleted", 'error'); - flashAlert("Vendor $vendor_name deleted", 'error'); - - redirect(); + vendorRedirectAfterDelete($client_id); } @@ -220,41 +244,21 @@ if (isset($_POST['bulk_archive_vendors'])) { validateCSRFToken(); - if (isset($_POST['vendor_ids'])) { - - // Get Selected Count - $count = count($_POST['vendor_ids']); - - // Cycle through array and archive each record - foreach ($_POST['vendor_ids'] as $vendor_id) { - - $vendor_id = intval($vendor_id); - - // Get Name and Client ID for logging and alert message - $sql = mysqli_query($mysqli,"SELECT vendor_name, vendor_client_id FROM vendors WHERE vendor_id = $vendor_id"); - $row = mysqli_fetch_assoc($sql); - $vendor_name = escapeSql($row['vendor_name']); - $client_id = intval($row['vendor_client_id']); - - // Permission check - if ($client_id) { - enforceUserPermission('module_client', 2); - enforceClientAccess(); - } else { - enforceUserPermission('module_financial', 2); - } - - mysqli_query($mysqli,"UPDATE vendors SET vendor_archived_at = NOW() WHERE vendor_id = $vendor_id"); - - logAudit("Vendor", "Archive", "$session_name archived vendor $vendor_name", $client_id, $vendor_id); + $count = 0; + foreach (array_unique(array_map('intval', (array) ($_POST['vendor_ids'] ?? []))) as $vendor_id) { + $row = vendorRow($vendor_id); + if (!$row || $row['vendor_archived_at']) { + continue; } - - logAudit("Vendor", "Bulk Archive", "$session_name archived $count vendor(s)"); - - flashAlert("Archived $count vendor(s)", 'error'); - + $client_id = intval($row['vendor_client_id']); + vendorEnforce($client_id, 2); + mysqli_query($mysqli, "UPDATE vendors SET vendor_archived_at = NOW() WHERE vendor_id = $vendor_id"); + logAudit("Vendor", "Archive", "$session_name archived vendor " . escapeSql($row['vendor_name']), $client_id, $vendor_id); + $count++; } + flashAlert("Archived $count vendor" . ($count === 1 ? '' : 's'), 'error'); + redirect(); } @@ -263,42 +267,21 @@ if (isset($_POST['bulk_restore_vendors'])) { validateCSRFToken(); - if (isset($_POST['vendor_ids'])) { - - // Get Selected Count - $count = count($_POST['vendor_ids']); - - // Cycle through array and unarchive each record - foreach ($_POST['vendor_ids'] as $vendor_id) { - - $vendor_id = intval($vendor_id); - - // Get Name and Client ID for logging and alert message - $sql = mysqli_query($mysqli,"SELECT vendor_name, vendor_client_id FROM vendors WHERE vendor_id = $vendor_id"); - $row = mysqli_fetch_assoc($sql); - $vendor_name = escapeSql($row['vendor_name']); - $client_id = intval($row['vendor_client_id']); - - // Permission check - if ($client_id) { - enforceUserPermission('module_client', 2); - enforceClientAccess(); - } else { - enforceUserPermission('module_financial', 2); - } - - mysqli_query($mysqli,"UPDATE vendors SET vendor_archived_at = NULL WHERE vendor_id = $vendor_id"); - - logAudit("Vendor", "Restore", "$session_name restored vendor $vendor_name", $client_id, $vendor_id); - + $count = 0; + foreach (array_unique(array_map('intval', (array) ($_POST['vendor_ids'] ?? []))) as $vendor_id) { + $row = vendorRow($vendor_id); + if (!$row || !$row['vendor_archived_at']) { + continue; } - - logAudit("Vendor", "Bulk Restore", "$session_name restored $count vendor(s)"); - - flashAlert("Restored $count vendor(s)"); - + $client_id = intval($row['vendor_client_id']); + vendorEnforce($client_id, 2); + mysqli_query($mysqli, "UPDATE vendors SET vendor_archived_at = NULL WHERE vendor_id = $vendor_id"); + logAudit("Vendor", "Restore", "$session_name restored vendor " . escapeSql($row['vendor_name']), $client_id, $vendor_id); + $count++; } + flashAlert("Restored $count vendor" . ($count === 1 ? '' : 's')); + redirect(); } @@ -307,48 +290,27 @@ if (isset($_POST['bulk_delete_vendors'])) { validateCSRFToken(); - if (isset($_POST['vendor_ids'])) { - - // Get Selected Count - $count = count($_POST['vendor_ids']); - - // Cycle through array and delete each record - foreach ($_POST['vendor_ids'] as $vendor_id) { - - $vendor_id = intval($vendor_id); - - // Get Name and Client ID for logging and alert message - $sql = mysqli_query($mysqli,"SELECT vendor_name, vendor_client_id, vendor_template_id FROM vendors WHERE vendor_id = $vendor_id"); - $row = mysqli_fetch_assoc($sql); - $vendor_name = escapeSql($row['vendor_name']); - $client_id = intval($row['vendor_client_id']); - $vendor_template_id = intval($row['vendor_template_id']); - - // Permission check - if ($client_id) { - enforceUserPermission('module_client', 3); - enforceClientAccess(); - } else { - enforceUserPermission('module_financial', 3); - } - - // If its a template reset all vendors based off this template to no template base - if ($vendor_template_id > 0) { - mysqli_query($mysqli,"UPDATE vendors SET vendor_template_id = 0 WHERE vendor_template_id = $vendor_template_id"); - } - - mysqli_query($mysqli, "DELETE FROM vendors WHERE vendor_id = $vendor_id AND vendor_client_id = $client_id"); - - logAudit("Vendor", "Delete", "$session_name deleted vendor $vendor_name", $client_id); - + $count = 0; + $kept = []; + foreach (array_unique(array_map('intval', (array) ($_POST['vendor_ids'] ?? []))) as $vendor_id) { + $row = vendorRow($vendor_id); + if (!$row) { + continue; } - - logAudit("Vendor", "Bulk Delete", "$session_name deleted $count vendor(s)"); - - flashAlert("Deleted $count vendor(s)", 'error'); - + $client_id = intval($row['vendor_client_id']); + vendorEnforce($client_id, 3); + if (vendorDeleteBlocker($vendor_id)) { + $kept[] = $row['vendor_name']; + continue; + } + vendorClearReferences($vendor_id); + mysqli_query($mysqli, "DELETE FROM vendors WHERE vendor_id = $vendor_id"); + logAudit("Vendor", "Delete", "$session_name deleted vendor " . escapeSql($row['vendor_name']), $client_id); + $count++; } + flashAlert("Deleted $count vendor" . ($count === 1 ? '' : 's') . ($kept ? ' - kept ' . implode(', ', $kept) . ', which have expenses booked to them' : ''), 'error'); + redirect(); } @@ -357,9 +319,6 @@ if (isExportRequest('export_vendors')) { validateCSRFToken(); - // Exports are reads - see CONTRIBUTING.md - enforceUserPermission('module_client'); - $format = resolveExportFormat($_POST['export_vendors']); // Filters inherited from the vendors page - mirrors agent/vendors.php @@ -370,23 +329,50 @@ if (isExportRequest('export_vendors')) { if ($archived) { $filter_summary['Archived'] = 'Archived only'; } + $archive_query = $archived ? "vendor_archived_at IS NOT NULL" : "vendor_archived_at IS NULL"; if (!empty($_POST['client_id'])) { + // One client's vendors $client_id = intval($_POST['client_id']); + enforceUserPermission('module_client'); + enforceClientAccess(); $client_query = "AND vendor_client_id = $client_id"; $client_name = getFieldById('clients', $client_id, 'client_name'); $file_name_prepend = "$client_name-"; $filter_summary['Client'] = $client_name; - - enforceClientAccess(); - } else { - // Global vendors only, same as the vendors page - $client_query = "AND vendor_client_id = 0"; + } elseif (($_POST['view'] ?? '') === 'clients') { + // Every client's vendors this agent may see + enforceUserPermission('module_client'); $client_id = 0; // for Logging + $client_query = "AND vendor_client_id > 0"; + $file_name_prepend = "$session_company_name-Client-"; + $filter_summary['Vendors'] = 'Client vendors'; + if (!empty($_POST['client'])) { + $filter_client_id = intval($_POST['client']); + $client_query = "AND vendor_client_id = $filter_client_id"; + $filter_summary['Client'] = getFieldById('clients', $filter_client_id, 'client_name'); + } + $archive_query = $archived ? "(client_archived_at IS NOT NULL OR vendor_archived_at IS NOT NULL)" : "(client_archived_at IS NULL AND vendor_archived_at IS NULL)"; + } else { + // Ours, same as the vendors page + $client_id = 0; // for Logging + $client_query = "AND vendor_client_id = 0"; $file_name_prepend = "$session_company_name-"; } - $archive_query = $archived ? "vendor_archived_at IS NOT NULL" : "vendor_archived_at IS NULL"; + // Tags Filter - a vendor with any of them + $tag_query = ''; + if (isset($_POST['tags']) && is_array($_POST['tags']) && !empty($_POST['tags'])) { + $tag_filter = implode(",", array_map('intval', $_POST['tags'])); + $tag_query = "AND vendors.vendor_id IN (SELECT vendor_id FROM vendor_tags WHERE tag_id IN ($tag_filter))"; + + $tag_names = []; + $sql_tags = mysqli_query($mysqli, "SELECT tag_name FROM tags WHERE tag_id IN ($tag_filter) ORDER BY tag_name ASC"); + while ($tag_row = mysqli_fetch_assoc($sql_tags)) { + $tag_names[] = $tag_row['tag_name']; + } + $filter_summary['Tags'] = implode(', ', $tag_names); + } // Search Filter $q = escapeSql($_POST['q'] ?? ''); @@ -396,13 +382,18 @@ if (isExportRequest('export_vendors')) { $sql = mysqli_query( $mysqli, - "SELECT * FROM vendors + "SELECT vendors.*, client_name, + (SELECT GROUP_CONCAT(tag_name ORDER BY tag_name SEPARATOR ', ') FROM vendor_tags JOIN tags ON tags.tag_id = vendor_tags.tag_id WHERE vendor_tags.vendor_id = vendors.vendor_id) AS vendor_tags, + (SELECT COUNT(*) FROM tickets WHERE ticket_client_id = vendor_client_id AND ticket_vendor_id = vendors.vendor_id AND ticket_resolved_at IS NULL AND ticket_closed_at IS NULL) AS open_case_count + FROM vendors LEFT JOIN clients ON client_id = vendor_client_id WHERE $archive_query - AND (vendor_name LIKE '%$q%' OR vendor_description LIKE '%$q%' OR vendor_account_number LIKE '%$q%' OR vendor_website LIKE '%$q%' OR vendor_contact_name LIKE '%$q%' OR vendor_email LIKE '%$q%' OR vendor_phone LIKE '%$q%') + AND (vendor_name LIKE '%$q%' OR vendor_description LIKE '%$q%' OR vendor_account_number LIKE '%$q%' OR vendor_website LIKE '%$q%' + OR vendor_contact_name LIKE '%$q%' OR vendor_email LIKE '%$q%' OR vendor_contact_email LIKE '%$q%' OR vendor_phone LIKE '%$q%' OR vendor_notes LIKE '%$q%') $client_query + $tag_query " . clientScopeSql('vendor_client_id') . " - ORDER BY vendor_name ASC" + ORDER BY client_name ASC, vendor_name ASC" ); $num_rows = mysqli_num_rows($sql); diff --git a/agent/post/vendor_model.php b/agent/post/vendor_model.php deleted file mode 100644 index a6413f91c..000000000 --- a/agent/post/vendor_model.php +++ /dev/null @@ -1,16 +0,0 @@ -
- + true]) : '-' ?> diff --git a/agent/software.php b/agent/software.php index 2a0706015..23e3b3f7a 100644 --- a/agent/software.php +++ b/agent/software.php @@ -463,7 +463,7 @@ while ($license_type_row = mysqli_fetch_row($sql_license_types)) { - + - diff --git a/agent/ticket.php b/agent/ticket.php index 544f29ca5..813e65a2a 100644 --- a/agent/ticket.php +++ b/agent/ticket.php @@ -1452,28 +1452,38 @@ if (isset($_GET['ticket_id'])) {
Vendor
-
- +
+ !empty($ticket['vendor_archived_at'])]) ?>
-
Their ticket
+
Their ticket
- -
+ +
- -
+ +
+ + +
+ + PIN +
- -
+ +
diff --git a/agent/vendor.php b/agent/vendor.php new file mode 100644 index 000000000..3413fedbb --- /dev/null +++ b/agent/vendor.php @@ -0,0 +1,822 @@ +

Nothing to see here

Go Back"; + +} else { + + $client_id = $vendor_client_id; + if ($client_id) { + enforceUserPermission('module_client'); + enforceClientAccess(); + } + $is_ours = !$client_id; + + $vendor_name = escapeHtml($vendor['vendor_name']); + $vendor_description = escapeHtml($vendor['vendor_description']); + $vendor_archived_at = escapeHtml($vendor['vendor_archived_at']); + $vendor_created_at = escapeHtml($vendor['vendor_created_at']); + $vendor_favorite = intval($vendor['vendor_favorite']); + $vendor_phone = contactPhoneLink($vendor['vendor_phone'], $vendor['vendor_phone_country_code'], $vendor['vendor_extension']); + $vendor_phone_text = $vendor['vendor_phone'] ? formatPhoneNumber($vendor['vendor_phone'], $vendor['vendor_phone_country_code']) : ''; + $vendor_dial = vendorDialNumber($vendor['vendor_phone'], $vendor['vendor_phone_country_code']); + $vendor_email = escapeHtml($vendor['vendor_email']); + $vendor_website_url = vendorWebsiteUrl($vendor['vendor_website']); + $vendor_website_label = escapeHtml(vendorWebsiteLabel($vendor['vendor_website'])); + $vendor_hours = escapeHtml($vendor['vendor_hours']); + $vendor_sla = escapeHtml($vendor['vendor_sla']); + $vendor_account = escapeHtml($vendor['vendor_account_number']); + $vendor_pin = vendorSecretHtml($vendor['vendor_code']); + $vendor_notes = escapeHtml($vendor['vendor_notes']); + $manager_name = escapeHtml($vendor['vendor_contact_name']); + $manager_phone = contactPhoneLink($vendor['vendor_contact_phone'], $vendor['vendor_contact_phone_country_code']); + $manager_email = escapeHtml($vendor['vendor_contact_email']); + + $can_edit = vendorCan($client_id, 2); + $can_delete = vendorCan($client_id, 3) && !empty($config_destructive_deletes_enable); + $can_support = lookupUserPermission('module_support') >= 1; + $can_support_edit = lookupUserPermission('module_support') >= 2; + $can_credentials = lookupUserPermission('module_credential') >= 1; + $can_credentials_edit = lookupUserPermission('module_credential') >= 2; + $can_financial = lookupUserPermission('module_financial') >= 1; + $can_financial_edit = lookupUserPermission('module_financial') >= 2; + + // Override Tab Title // No Sanitizing needed as this var will only be used in the tab title + $page_title = $vendor['vendor_name']; + + $list_url = $is_ours ? 'vendors.php' : "vendors.php?client_id=$client_id"; + $vendor_tags_display = tagPills('vendor', $vendor_id, tagsForRecord('vendor', $vendor_id), ($is_ours ? 'vendors.php?' : "vendors.php?client_id=$client_id&"), $can_edit); + + // Cases - every open one, then the most recent closed ones + $cases = []; + $case_count = $case_open_count = 0; + $licenses = $assets = $domains = $services = $logins = $documents = $files = []; + if ($can_support) { + $row = mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*), COALESCE(SUM(ticket_resolved_at IS NULL AND ticket_closed_at IS NULL), 0) FROM tickets WHERE ticket_client_id = $client_id AND ticket_vendor_id = $vendor_id")); + [$case_count, $case_open_count] = [intval($row[0]), intval($row[1])]; + $sql = mysqli_query($mysqli, "SELECT ticket_id, ticket_prefix, ticket_number, ticket_subject, ticket_vendor_ticket_number, ticket_created_at, ticket_updated_at, + ticket_resolved_at, ticket_closed_at, ticket_assigned_to, user_name, user_avatar, ticket_status_name, ticket_status_color + FROM tickets + LEFT JOIN users ON ticket_assigned_to = user_id + LEFT JOIN ticket_statuses ON ticket_status_id = ticket_status + WHERE ticket_client_id = $client_id AND ticket_vendor_id = $vendor_id + ORDER BY (ticket_resolved_at IS NULL AND ticket_closed_at IS NULL) DESC, ticket_number DESC + LIMIT " . max(25, $case_open_count)); + while ($row = mysqli_fetch_assoc($sql)) { + $cases[] = $row; + } + + if (!$is_ours) { + $sql = mysqli_query($mysqli, "SELECT software_id AS id, software_name AS name, software_type, software_version, software_license_type, + software_seats, software_expire, software_purchase_reference, " . softwareSeatsUsedSql('software.software_id') . " AS seats_used + FROM software + WHERE software_client_id = $client_id AND software_vendor_id = $vendor_id AND software_archived_at IS NULL + ORDER BY software_expire IS NULL, software_expire ASC, software_name ASC"); + while ($row = mysqli_fetch_assoc($sql)) { + $licenses[] = $row; + } + $sql = mysqli_query($mysqli, "SELECT asset_id, asset_name, asset_type, asset_make, asset_model, asset_serial, asset_purchase_date, asset_purchase_reference, asset_warranty_expire + FROM assets + WHERE asset_client_id = $client_id AND asset_vendor_id = $vendor_id AND asset_archived_at IS NULL + ORDER BY asset_warranty_expire IS NULL, asset_warranty_expire ASC, asset_name ASC"); + while ($row = mysqli_fetch_assoc($sql)) { + $assets[] = $row; + } + $sql = mysqli_query($mysqli, "SELECT domain_id, domain_name, domain_description, domain_expire, domain_registrar, domain_webhost, domain_dnshost, domain_mailhost + FROM domains + WHERE domain_client_id = $client_id AND domain_archived_at IS NULL + AND $vendor_id IN (domain_registrar, domain_webhost, domain_dnshost, domain_mailhost) + ORDER BY domain_name ASC"); + while ($row = mysqli_fetch_assoc($sql)) { + $domains[] = $row; + } + $sql = mysqli_query($mysqli, "SELECT services.service_id, service_name, service_description, service_category, service_importance + FROM service_vendors JOIN services ON services.service_id = service_vendors.service_id + WHERE service_vendors.vendor_id = $vendor_id AND service_client_id = $client_id + ORDER BY service_name ASC"); + while ($row = mysqli_fetch_assoc($sql)) { + $services[] = $row; + } + $documents = linkedRecords('vendor', $vendor_id, 'document'); + $files = linkedRecords('vendor', $vendor_id, 'file'); + } + } + if ($can_credentials && !$is_ours) { + $logins = linkedRecords('vendor', $vendor_id, 'credential'); + } + + // What we spend with one of ours + $expenses = $recurring = []; + $spend = null; + if ($is_ours && $can_financial) { + $spend = vendorSpend($vendor_id); + $sql = mysqli_query($mysqli, "SELECT expense_id, expense_date, expense_amount, expense_currency_code, expense_description, expense_reference, category_name, account_name + FROM expenses + LEFT JOIN categories ON category_id = expense_category_id + LEFT JOIN accounts ON account_id = expense_account_id + WHERE expense_vendor_id = $vendor_id AND expense_archived_at IS NULL + ORDER BY expense_date DESC, expense_id DESC + LIMIT 25"); + while ($row = mysqli_fetch_assoc($sql)) { + $expenses[] = $row; + } + $sql = mysqli_query($mysqli, "SELECT recurring_expense_id, recurring_expense_frequency, recurring_expense_next_date, recurring_expense_status, recurring_expense_amount, + recurring_expense_currency_code, recurring_expense_description, category_name + FROM recurring_expenses + LEFT JOIN categories ON category_id = recurring_expense_category_id + WHERE recurring_expense_vendor_id = $vendor_id AND recurring_expense_archived_at IS NULL + ORDER BY recurring_expense_status DESC, recurring_expense_next_date ASC"); + while ($row = mysqli_fetch_assoc($sql)) { + $recurring[] = $row; + } + } + + $elsewhere = lookupUserPermission('module_client') >= 1 ? vendorElsewhere($vendor) : []; + $history = vendorHistory($vendor_id, 100); + + if ($is_ours) { + $vendor_tabs = [ + 'expenses' => ['label' => 'Expenses', 'icon' => 'fa-receipt', 'count' => $spend ? $spend['count'] : 0], + 'recurring' => ['label' => 'Recurring', 'icon' => 'fa-redo-alt', 'count' => count($recurring)], + 'cases' => ['label' => 'Cases', 'icon' => 'fa-life-ring', 'count' => $case_count, 'badge' => $case_open_count], + 'history' => ['label' => 'History', 'icon' => 'fa-history', 'count' => count($history)], + ]; + if (!$can_financial) { + unset($vendor_tabs['expenses'], $vendor_tabs['recurring']); + } + if (!$case_count) { + unset($vendor_tabs['cases']); + } + } else { + $vendor_tabs = [ + 'cases' => ['label' => 'Cases', 'icon' => 'fa-life-ring', 'count' => $case_count, 'badge' => $case_open_count], + 'licenses' => ['label' => 'Licenses', 'icon' => 'fa-cube', 'count' => count($licenses)], + 'assets' => ['label' => 'Assets', 'icon' => 'fa-desktop', 'count' => count($assets)], + 'domains' => ['label' => 'Domains', 'icon' => 'fa-globe', 'count' => count($domains)], + 'services' => ['label' => 'Services', 'icon' => 'fa-stream', 'count' => count($services)], + 'logins' => ['label' => 'Logins', 'icon' => 'fa-key', 'count' => count($logins)], + 'documents' => ['label' => 'Documents', 'icon' => 'fa-file-alt', 'count' => count($documents)], + 'files' => ['label' => 'Files', 'icon' => 'fa-paperclip', 'count' => count($files)], + 'history' => ['label' => 'History', 'icon' => 'fa-history', 'count' => count($history)], + ]; + if (!$can_support) { + unset($vendor_tabs['cases'], $vendor_tabs['licenses'], $vendor_tabs['assets'], $vendor_tabs['domains'], $vendor_tabs['services'], $vendor_tabs['documents'], $vendor_tabs['files']); + } + if (!$can_credentials) { + unset($vendor_tabs['logins']); + } + } + + $link_url = "modals/link/link.php?from=vendor&id=$vendor_id&to="; + $unlink_url = function ($to, $other_id) use ($vendor_id) { + return "post.php?unlink_item&from=vendor&id=$vendor_id&to=$to&other=" . intval($other_id) . "&csrf_token=" . $_SESSION['csrf_token']; + }; + $new_case_url = "modals/ticket/ticket_add.php?client_id=$client_id&vendor_id=$vendor_id"; + $can_new = !$vendor_archived_at && (($is_ours && $can_financial_edit) || (!$is_ours && ($can_support_edit || $can_credentials_edit))); + + ?> + +
    + +
  1. Vendors
    2. + +
    3. +
  3. Vendors
    4. + +
    5. +
+ + +
+
+ + +
+

+ + + + + + + + + Our vendor + Archived +

+
+ + + +
+ +
+ +
+ +
+ + Call support + + + Email + + + Support site + + +
+ +
+ + + Expense + + + Recurring expense + + + + + Case with them + + + License from them + + + Asset bought from them + + + + + Portal login + + + +
+ + Document + + + Upload File(s) + + + +
+
+ + + +
+ +
+ + + Restore + + + + Delete + + + + + Archive + + +
+
+ +
+
+
+ +
+ + +
+ +
+
+

Support

+
+
+
+
Phone
+
+ + + + Not recorded + +
+
Hours
+
Not recorded' ?>
+ +
SLA
+ + +
Email
+
+ + +
Site
+
+ +
+
+
+ +
+
+

Account

+
+
+
+
Account
+
' . $vendor_account . '' : 'Not recorded' ?>
+
PIN
+
Not recorded' ?>
+
Manager
+
+ +
+
+
+ + Not recorded + +
+
Added
+
+
+
+ +
+
+

Notes

+
+ +
+ + +
+
+

Also used by

+
+
    + +
  • + + +
    • + +
+
Clients with a vendor of the same name or template - who else an outage hits.
+
+ + +
+ + +
+
+
+
    + $tab) { ?> + + +
+
+
+ + + +
+
+ Tickets waiting on or worked with them, open first - with their reference. + + + +
+ +
+ + + + + + + + + + + + + + +
TicketSubjectTheir refStatusAssignedUpdated
-
+
+ count($cases)) { ?> +
Showing every open case and the most recent closed of .
+ + +
No cases with them. Set the vendor on a ticket, with their reference, when you log a call with them.
+ +
+ + + + +
+
+ Licenses and subscriptions bought through them, soonest renewal first. + + + +
+ +
    + +
  • + + +
    • + +
+ +
No licenses from them.
+ +
+ + + + +
+
+ Bought from them, warranty ending soonest first - what to have to hand for a claim. + + + +
+ +
+ + + + + + + + + + + + + +
AssetSerialOrder refPurchasedWarranty
+
+ +
+ +
+
+
+ 		--' ?>-' ?> + + + + + + - + +
+
+ +
No assets bought from them.
+ +
+ + + + +
+
+ Domains they register or host, and for what. +
+ +
+ + + + $role) { + if (intval($domain[$column]) === $vendor_id) { + $roles[] = $role; + } + } + $expiry = softwareRenewal($domain['domain_expire']); ?> + + + + + + + +
DomainThey areExpires
+ +
+ 		-' ?>
+
+ +
No domains with them.
+ +
+ + + + +
+
+ The client's services that depend on them. +
+ +
    + +
  • + +
    +
    +
    +
    + +
    • + +
+ +
No services depend on them.
+ +
+ + + + ['credential', $logins, 'Their portal and support logins - linked from the client\'s credentials.', 'No logins linked.', $can_credentials_edit], + 'documents' => ['document', $documents, 'The contract, the escalation sheet, how to raise a case with them.', 'No documents linked.', $can_support_edit], + 'files' => ['file', $files, 'Quotes, invoices, the signed agreement.', 'No files linked.', $can_support_edit]] as $pane => [$to, $linked, $hint, $empty, $can_link]) { + if (!isset($vendor_tabs[$pane])) { + continue; + } ?> +
+
+ + +
+ + + + + + + + +
+ +
+ +
    + +
  • + + + + +
    • + +
+ +
+ +
+ + + + +
+
+ + this year + last year + in all + +
+ All + + + +
+
+ +
+ + + + + + + + + + + + +
DateWhat forAccountAmount
+
-' ?>
+
+
+
+ count($expenses)) { ?> +
The most recent of - see them all.
+ + +
Nothing spent with them yet.
+ +
+ + +
+
+ Subscriptions and contracts booked automatically. + + + +
+ +
+ + + + + + + + + + + + +
NextEveryWhat forAmount
Paused +
-' ?>
+
+
+
+ +
Nothing recurring with them.
+ +
+ + + +
+
+ Edits, links and notes - newest first. +
+ 'fa-plus', 'Edit' => 'fa-edit', 'Archive' => 'fa-archive', 'Restore' => 'fa-redo', 'Link' => 'fa-link', 'Unlink' => 'fa-unlink']; ?> +
    + +
  • + +
    +
    +
    ·
    +
    +
    • + +
+ +
Nothing logged yet.
+ +
+ +
+
+
+ +
+ + + + 0"; + $client_url = "view=clients&"; } else { + // Ours require_once "includes/inc_all.php"; + $view = 'ours'; $client_query = "AND vendor_client_id = 0"; $client_url = ''; } +// Overide Filter Header Archived +$archived = isset($_GET['archived']) && $_GET['archived'] == 1 ? 1 : 0; +if ($view === 'clients') { + $archive_query = $archived ? "(client_archived_at IS NOT NULL OR vendor_archived_at IS NOT NULL)" : "(client_archived_at IS NULL AND vendor_archived_at IS NULL)"; +} else { + $archive_query = $archived ? "vendor_archived_at IS NOT NULL" : "vendor_archived_at IS NULL"; +} + +// Perms - a client's vendors are the client module's; anyone may look up ours, the financial module changes them +if ($view !== 'ours') { + enforceUserPermission('module_client'); +} +$can_edit = $view === 'ours' ? lookupUserPermission('module_financial') >= 2 : lookupUserPermission('module_client') >= 2; +$can_delete = ($view === 'ours' ? lookupUserPermission('module_financial') >= 3 : lookupUserPermission('module_client') >= 3) && !empty($config_destructive_deletes_enable); +$can_support = lookupUserPermission('module_support') >= 1; +$can_credentials = lookupUserPermission('module_credential') >= 1; +$can_financial = lookupUserPermission('module_financial') >= 1; + +$client = ''; +if ($view === 'clients' && !empty($_GET['client'])) { + // Client Filter + $client = intval($_GET['client']); + $client_query = "AND vendor_client_id = $client"; +} + +// Tags Filter - a vendor with any of them +if (isset($_GET['tags']) && is_array($_GET['tags']) && !empty($_GET['tags'])) { + $tag_filter = implode(",", array_map('intval', $_GET['tags'])); + $tag_query = "AND vendors.vendor_id IN (SELECT vendor_id FROM vendor_tags WHERE tag_id IN ($tag_filter))"; +} else { + $tag_filter = 0; + $tag_query = ''; +} + +// Only these sort - filter_header.php will hand through any lowercase word, and +// an unknown column takes the page down with a mysqli exception +$sortable_columns = ['vendor_name', 'vendor_description', 'vendor_account_number', 'vendor_phone', 'vendor_contact_name', 'vendor_hours', 'client_name', 'vendor_created_at']; +if (!in_array($sort, $sortable_columns, true)) { + $sort = 'vendor_name'; +} + $sql = mysqli_query( $mysqli, - "SELECT SQL_CALC_FOUND_ROWS vendor_account_number, vendor_archived_at, vendor_code, vendor_contact_name, - vendor_created_at, vendor_description, vendor_email, vendor_extension, vendor_hours, - vendor_id, vendor_name, vendor_notes, vendor_phone, vendor_phone_country_code, vendor_sla, - vendor_templates.vendor_template_id, vendor_template_name, vendor_website FROM vendors + "SELECT SQL_CALC_FOUND_ROWS vendors.vendor_id, vendor_name, vendor_description, vendor_account_number, vendor_code, vendor_contact_name, + vendor_contact_phone, vendor_contact_phone_country_code, vendor_contact_email, vendor_phone, vendor_phone_country_code, vendor_extension, + vendor_email, vendor_website, vendor_hours, vendor_sla, vendor_favorite, vendor_archived_at, vendor_client_id, vendor_template_name, + client_id, client_name + FROM vendors LEFT JOIN clients ON client_id = vendor_client_id - LEFT JOIN vendor_templates ON vendors.vendor_template_id = vendor_templates.vendor_template_id - WHERE vendor_$archive_query - AND (vendor_name LIKE '%$q%' OR vendor_description LIKE '%$q%' OR vendor_account_number LIKE '%$q%' OR vendor_website LIKE '%$q%' OR vendor_contact_name LIKE '%$q%' OR vendor_email LIKE '%$q%' OR vendor_phone LIKE '%$phone_query%') + LEFT JOIN vendor_templates ON vendor_templates.vendor_template_id = vendors.vendor_template_id + WHERE $archive_query + $tag_query + AND (vendor_name LIKE '%$q%' OR vendor_description LIKE '%$q%' OR vendor_account_number LIKE '%$q%' OR vendor_website LIKE '%$q%' + OR vendor_contact_name LIKE '%$q%' OR vendor_email LIKE '%$q%' OR vendor_contact_email LIKE '%$q%' OR vendor_notes LIKE '%$q%' + OR vendor_phone LIKE '%$phone_query%' OR vendor_contact_phone LIKE '%$phone_query%'" . ($view === 'clients' ? " OR client_name LIKE '%$q%'" : '') . " + OR vendors.vendor_id IN (SELECT vendor_id FROM vendor_tags JOIN tags USING (tag_id) WHERE tag_name LIKE '%$q%')) $client_query " . clientScopeSql('vendor_client_id') . " - ORDER BY $sort $order LIMIT $record_from, $record_to" + ORDER BY vendor_favorite DESC, $sort $order, vendor_name ASC LIMIT $record_from, $record_to" ); $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); +$vendors = []; +while ($row = mysqli_fetch_assoc($sql)) { + $vendors[intval($row['vendor_id'])] = $row; +} + +// Tags and what each vendor is used for, for the whole page at once, not per row +$vendors_tags = tagsForRecords('vendor', array_keys($vendors)); +$vendors_counts = vendorCounts($vendors); + +$has_templates = (bool) mysqli_num_rows(mysqli_query($mysqli, "SELECT 1 FROM vendor_templates WHERE vendor_template_archived_at IS NULL LIMIT 1")); +$add_url = "modals/vendor/vendor_add.php?" . ($view === 'client' ? "client_id=$client_id" : ($view === 'clients' ? 'view=clients' : '')); + ?>
-

- Vendors -

-
+

+
+ = 1) { ?> + + + +
- - -
- - Create from Template - + + + + +
+ + + New from Template + + + + Add a Template to Clients + + + 0) { ?> -
+
+ data-modal-url=""> Export
+
- + + +
- -
+
- - + +
- -
-
- archived=" - class="btn btn-"> - Archived + +
+ +
+ +
+ +
+
+
+ = 1) { ?> + + + + Archived - -
-
- - text-nowrap"> +
+ text-nowrap table-light"> - + + + + - $row) { + $row_client_id = intval($row['vendor_client_id']); $vendor_name = escapeHtml($row['vendor_name']); $vendor_description = escapeHtml($row['vendor_description']); - if ($vendor_description) { - $vendor_description_display = $vendor_description; - } else { - $vendor_description_display = "-"; - } - $vendor_account_number = escapeHtml($row['vendor_account_number']); - if ($vendor_account_number) { - $vendor_account_number_display = "
Account #: $vendor_account_number
"; - } else { - $vendor_account_number_display = ''; - } - $vendor_contact_name = escapeHtml($row['vendor_contact_name']); - if ($vendor_contact_name) { - $vendor_contact_name_display = $vendor_contact_name; - } else { - $vendor_contact_name_display = "-"; - } - $vendor_phone_country_code = escapeHtml($row['vendor_phone_country_code']); - $vendor_phone = escapeHtml(formatPhoneNumber($row['vendor_phone'], $vendor_phone_country_code)); - $vendor_extension = escapeHtml($row['vendor_extension']); + $vendor_phone = contactPhoneLink($row['vendor_phone'], $row['vendor_phone_country_code'], $row['vendor_extension']); + $vendor_phone_text = $row['vendor_phone'] ? escapeHtml(formatPhoneNumber($row['vendor_phone'], $row['vendor_phone_country_code'])) : ''; $vendor_email = escapeHtml($row['vendor_email']); - $vendor_website = escapeHtml($row['vendor_website']); - if ($vendor_website) { - $vendor_website_display = "$vendor_website "; - } else { - $vendor_website_display = "-"; - } - $vendor_hours = escapeHtml($row['vendor_hours']); - $vendor_sla = escapeHtml($row['vendor_sla']); - $vendor_code = escapeHtml($row['vendor_code']); - $vendor_notes = escapeHtml($row['vendor_notes']); - $vendor_created_at = escapeHtml($row['vendor_created_at']); + $vendor_website_url = vendorWebsiteUrl($row['vendor_website']); + $vendor_support_when = escapeHtml(implode(' · ', array_filter([$row['vendor_hours'], $row['vendor_sla']]))); + $vendor_account = escapeHtml($row['vendor_account_number']); + $vendor_pin = vendorSecretHtml($row['vendor_code']); + $vendor_favorite = intval($row['vendor_favorite']); $vendor_archived_at = escapeHtml($row['vendor_archived_at']); - $vendor_template_id = intval($row['vendor_template_id']); - $vendor_template_name = escapeHtml($row['vendor_template_name']); - if ($vendor_template_id) { - $vendor_template_display = "
$vendor_template_name
"; - } else { - $vendor_template_display = ""; - } + $vendor_tags = $vendors_tags[$vendor_id] ?? []; + $counts = $vendors_counts[$vendor_id]; + $vendor_url = 'vendor.php?' . ($row_client_id ? "client_id=$row_client_id&" : '') . "vendor_id=$vendor_id"; + $row_can_edit = $can_edit; + $tag_base = $view === 'client' ? "vendors.php?client_id=$row_client_id&" : ($view === 'clients' ? 'vendors.php?view=clients&' : 'vendors.php?'); ?> + - - - - - + + + + + - +
+ +
- +
- + 		- + Vendor - - Description + + Support - - Contact + + Account - - Website + + Client Action
- +
- -
- -
-
-
-
+ + +
+
+ +
+ + + + Archived + +
+ + +
+
- +
- - - - -
- - -
- - -
+ 		+ +
+
+ +
+ + +
+ + - 		-
- + +
+ +
PIN
+
+ - +
+
+ + + + + + this year + + + + + + + + + ['licenses', 'fa-cube', 'license'], 'asset' => ['assets', 'fa-desktop', 'asset'], 'domain' => ['domains', 'fa-globe', 'domain'], 'service' => ['services', 'fa-stream', 'service']] as $kind => [$tab, $icon, $label]) { + if ($can_support && $counts[$kind]) { ?> + + + + + + + Nothing yet +
+ 		+
+
- - Edit + + Quick look - - -
- - Restore - - -
- - Delete + + + Edit + + + + -
- - Archive - + + + Restore + + + + Delete + + + + + Archive +
@@ -271,17 +438,19 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- + +
+ +
+
+ +
diff --git a/api/v1/vendors/create.php b/api/v1/vendors/create.php index 6ce73a5f2..9689a357b 100644 --- a/api/v1/vendors/create.php +++ b/api/v1/vendors/create.php @@ -13,7 +13,7 @@ $insert_id = false; if (!empty($name)) { // Insert vendor - $insert_sql = mysqli_query($mysqli, "INSERT INTO vendors SET vendor_name = '$name', vendor_description = '$description', vendor_contact_name = '$contact_name', vendor_phone_country_code = '$phone_country_code', vendor_phone = '$phone', vendor_extension = '$extension', vendor_email = '$email', vendor_website = '$website', vendor_hours = '$hours', vendor_sla = '$sla', vendor_code = '$code', vendor_account_number = '$account_number', vendor_notes = '$notes', vendor_client_id = $client_id"); + $insert_sql = mysqli_query($mysqli, "INSERT INTO vendors SET vendor_name = '$name', vendor_description = '$description', vendor_contact_name = '$contact_name', vendor_contact_phone_country_code = '$contact_phone_country_code', vendor_contact_phone = '$contact_phone', vendor_contact_email = '$contact_email', vendor_phone_country_code = '$phone_country_code', vendor_phone = '$phone', vendor_extension = '$extension', vendor_email = '$email', vendor_website = '$website', vendor_hours = '$hours', vendor_sla = '$sla', vendor_code = '$code', vendor_account_number = '$account_number', vendor_notes = '$notes', vendor_client_id = $client_id"); // Check insert & get insert ID if ($insert_sql) { diff --git a/api/v1/vendors/update.php b/api/v1/vendors/update.php index ed3b6bb8a..ecd87b061 100644 --- a/api/v1/vendors/update.php +++ b/api/v1/vendors/update.php @@ -18,7 +18,7 @@ if (!empty($vendor_id)) { require_once 'vendor_model.php'; if ($vendor_row) { - $update_sql = mysqli_query($mysqli, "UPDATE vendors SET vendor_name = '$name', vendor_description = '$description', vendor_contact_name = '$contact_name', vendor_phone_country_code = '$phone_country_code', vendor_phone = '$phone', vendor_extension = '$extension', vendor_email = '$email', vendor_website = '$website', vendor_hours = '$hours', vendor_sla = '$sla', vendor_code = '$code', vendor_account_number = '$account_number', vendor_notes = '$notes' WHERE vendor_id = $vendor_id AND vendor_client_id = $client_id AND vendor_archived_at IS NULL LIMIT 1"); + $update_sql = mysqli_query($mysqli, "UPDATE vendors SET vendor_name = '$name', vendor_description = '$description', vendor_contact_name = '$contact_name', vendor_contact_phone_country_code = '$contact_phone_country_code', vendor_contact_phone = '$contact_phone', vendor_contact_email = '$contact_email', vendor_phone_country_code = '$phone_country_code', vendor_phone = '$phone', vendor_extension = '$extension', vendor_email = '$email', vendor_website = '$website', vendor_hours = '$hours', vendor_sla = '$sla', vendor_code = '$code', vendor_account_number = '$account_number', vendor_notes = '$notes' WHERE vendor_id = $vendor_id AND vendor_client_id = $client_id AND vendor_archived_at IS NULL LIMIT 1"); // Check update & get affected rows if ($update_sql) { diff --git a/api/v1/vendors/vendor_model.php b/api/v1/vendors/vendor_model.php index 8ba3d3ac6..3c2f8d36b 100644 --- a/api/v1/vendors/vendor_model.php +++ b/api/v1/vendors/vendor_model.php @@ -34,6 +34,30 @@ if (isset($_POST['vendor_contact_name'])) { $contact_name = ''; } +if (isset($_POST['vendor_contact_phone_country_code'])) { + $contact_phone_country_code = preg_replace("/[^0-9]/", '', $_POST['vendor_contact_phone_country_code']); +} elseif ($vendor_row) { + $contact_phone_country_code = mysqli_real_escape_string($mysqli, (string) $vendor_row['vendor_contact_phone_country_code']); +} else { + $contact_phone_country_code = ''; +} + +if (isset($_POST['vendor_contact_phone'])) { + $contact_phone = preg_replace("/[^0-9]/", '', $_POST['vendor_contact_phone']); +} elseif ($vendor_row) { + $contact_phone = mysqli_real_escape_string($mysqli, (string) $vendor_row['vendor_contact_phone']); +} else { + $contact_phone = ''; +} + +if (isset($_POST['vendor_contact_email'])) { + $contact_email = escapeSql($_POST['vendor_contact_email']); +} elseif ($vendor_row) { + $contact_email = mysqli_real_escape_string($mysqli, (string) $vendor_row['vendor_contact_email']); +} else { + $contact_email = ''; +} + if (isset($_POST['vendor_phone_country_code'])) { $phone_country_code = preg_replace("/[^0-9]/", '', $_POST['vendor_phone_country_code']); } elseif ($vendor_row) { diff --git a/css/itflow_custom.css b/css/itflow_custom.css index ed64b45cd..a801bb0c6 100644 --- a/css/itflow_custom.css +++ b/css/itflow_custom.css @@ -4550,3 +4550,55 @@ img.itflow-contact-avatar { max-height: 7.5rem; overflow-y: auto; } + +/* Vendors - agent/vendors.php, agent/vendor.php, agent/modals/vendor/ + + A vendor's tile is its initials on a colour picked by its name + (functions/vendor.php vendorTile()), square like the asset and license + tiles, so one vendor is the same colour at every client. */ +.itflow-vendor-tile { + font-weight: 600; + font-size: .85rem; + letter-spacing: .02em; +} +.itflow-vendor-tile-lg { + font-size: 1.2rem; +} +.itflow-vendor-tile-sm { + font-size: .65rem; + letter-spacing: 0; +} +.itflow-vendor-tile-xs { + width: 1.25rem; + height: 1.25rem; + border-radius: .3rem; + font-size: .5rem; + letter-spacing: 0; +} +/* A PIN or code shown as dots until it is asked for */ +.itflow-secret { + font-family: var(--bs-font-monospace); +} +.itflow-secret:not(.is-shown) .itflow-secret-value { + display: none; +} +.itflow-secret.is-shown .itflow-secret-mask { + display: none; +} +.itflow-secret-toggle { + border: 0; + background: none; + padding: 0 .25rem; + color: var(--bs-secondary-color); + font-size: .8em; +} +.itflow-secret-toggle:hover { + color: var(--bs-emphasis-color); +} +/* The vendor list's support and account cells */ +.itflow-vendor-support-cell { + min-width: 13rem; +} +.itflow-vendor-email { + max-width: 16rem; +} diff --git a/db.sql b/db.sql index 0db65e075..eca08090f 100644 --- a/db.sql +++ b/db.sql @@ -3220,6 +3220,23 @@ CREATE TABLE `vendor_files` ( ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci; /*!40101 SET character_set_client = @saved_cs_client */; +-- +-- Table structure for table `vendor_tags` +-- + +DROP TABLE IF EXISTS `vendor_tags`; +/*!40101 SET @saved_cs_client = @@character_set_client */; +/*!40101 SET character_set_client = utf8mb4 */; +CREATE TABLE `vendor_tags` ( + `vendor_id` int(11) NOT NULL, + `tag_id` int(11) NOT NULL, + PRIMARY KEY (`vendor_id`,`tag_id`), + KEY `tag_id` (`tag_id`), + CONSTRAINT `vendor_tags_ibfk_1` FOREIGN KEY (`vendor_id`) REFERENCES `vendors` (`vendor_id`) ON DELETE CASCADE, + CONSTRAINT `vendor_tags_ibfk_2` FOREIGN KEY (`tag_id`) REFERENCES `tags` (`tag_id`) ON DELETE CASCADE +) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci; +/*!40101 SET character_set_client = @saved_cs_client */; + -- -- Table structure for table `vendor_templates` -- @@ -3261,6 +3278,9 @@ CREATE TABLE `vendors` ( `vendor_name` varchar(200) NOT NULL, `vendor_description` varchar(200) DEFAULT NULL, `vendor_contact_name` varchar(200) DEFAULT NULL, + `vendor_contact_phone_country_code` varchar(10) DEFAULT NULL, + `vendor_contact_phone` varchar(200) DEFAULT NULL, + `vendor_contact_email` varchar(200) DEFAULT NULL, `vendor_phone_country_code` varchar(10) DEFAULT NULL, `vendor_phone` varchar(200) DEFAULT NULL, `vendor_extension` varchar(200) DEFAULT NULL, diff --git a/functions.php b/functions.php index a650fee1f..8140e9d3f 100644 --- a/functions.php +++ b/functions.php @@ -23,6 +23,7 @@ require_once __DIR__ . '/functions/asset.php'; require_once __DIR__ . '/functions/contact.php'; require_once __DIR__ . '/functions/software.php'; require_once __DIR__ . '/functions/location.php'; +require_once __DIR__ . '/functions/vendor.php'; require_once __DIR__ . '/functions/links.php'; require_once __DIR__ . '/functions/auth.php'; require_once __DIR__ . '/functions/logging.php'; diff --git a/functions/export.php b/functions/export.php index 6ecb867ff..7e875bf3f 100644 --- a/functions/export.php +++ b/functions/export.php @@ -102,11 +102,21 @@ function getExportColumns($export_type) { 'vendors' => [ 'vendor_name' => ['label' => 'Name', 'weight' => 2], 'vendor_description' => ['label' => 'Description', 'weight' => 3], - 'vendor_contact_name' => ['label' => 'Contact Name'], - 'vendor_phone' => ['label' => 'Phone', 'format' => 'phone'], + 'vendor_tags' => ['label' => 'Tags', 'default' => false], + 'vendor_phone' => ['label' => 'Support Phone', 'format' => 'phone'], + 'vendor_extension' => ['label' => 'Extension', 'default' => false], + 'vendor_email' => ['label' => 'Support Email', 'weight' => 2], 'vendor_website' => ['label' => 'Website', 'weight' => 2], + 'vendor_hours' => ['label' => 'Hours'], + 'vendor_sla' => ['label' => 'SLA', 'default' => false], 'vendor_account_number' => ['label' => 'Account Number'], + 'vendor_code' => ['label' => 'PIN / Code', 'default' => false], + 'vendor_contact_name' => ['label' => 'Account Manager'], + 'vendor_contact_phone' => ['label' => 'Account Manager Phone', 'format' => 'phone', 'default' => false], + 'vendor_contact_email' => ['label' => 'Account Manager Email', 'default' => false], + 'open_case_count' => ['label' => 'Open Cases', 'format' => 'number', 'default' => false], 'vendor_notes' => ['label' => 'Notes', 'weight' => 3], + 'client_name' => ['label' => 'Client', 'default' => false], ], 'assets' => [ diff --git a/functions/links.php b/functions/links.php index 34e344083..ef2e92ec1 100644 --- a/functions/links.php +++ b/functions/links.php @@ -5,8 +5,9 @@ * contacts, licenses and vendors a document covers, the files attached to a * document, the assets and contacts a file belongs to - and the seats on a * license (the devices and users on it) and the credentials and files that - * go with it, and the documents and files about a location (a floor plan, a - * site runbook). + * go with it, the documents and files about a location (a floor plan, a + * site runbook), and a vendor's portal logins, documents and files (the + * contract, the escalation sheet). * * Every link is a row in a two-column table (asset_documents, document_files, * contact_files...) and they all work the same way, so they are described once @@ -55,6 +56,8 @@ const LINK_RELATIONS = [ 'file|software' => ['table' => 'software_files', 'module' => 'module_support'], 'document|location' => ['table' => 'location_documents', 'module' => 'module_support'], 'file|location' => ['table' => 'location_files', 'module' => 'module_support'], + 'credential|vendor' => ['table' => 'vendor_credentials', 'module' => 'module_credential'], + 'file|vendor' => ['table' => 'vendor_files', 'module' => 'module_support'], ]; /** The relation between two types, or null when they cannot be linked. */ @@ -69,9 +72,12 @@ function linkRelation($a, $b) { * a license's seats first - leaving out types this agent may not see. */ function linkTypesFor($from) { - $order = $from === 'software' - ? ['asset', 'contact', 'credential', 'document', 'file'] - : ['file', 'document', 'asset', 'contact', 'location', 'software', 'credential', 'vendor']; + $orders = [ + 'software' => ['asset', 'contact', 'credential', 'document', 'file'], + // A vendor's portal logins first - what is wanted on the phone to them + 'vendor' => ['credential', 'document', 'file'], + ]; + $order = $orders[$from] ?? ['file', 'document', 'asset', 'contact', 'location', 'software', 'credential', 'vendor']; return array_values(array_filter($order, function ($to) use ($from) { $view = LINK_ENTITIES[$to]['view'] ?? null; return $to !== $from && linkRelation($from, $to) && (!$view || lookupUserPermission($view) >= 1); @@ -107,7 +113,7 @@ function linkDisplayColumns($type) { 'file' => 'file_ext, file_size, file_mime_type, file_description', 'software' => 'software_type, software_version, software_license_type, software_seats, software_expire, ' . softwareSeatsUsedSql('t.software_id') . ' AS seats_used', 'credential' => 'credential_description, credential_uri, credential_username, credential_otp_secret, credential_favorite', - 'vendor' => 'vendor_description', + 'vendor' => 'vendor_description, vendor_account_number, vendor_phone, vendor_phone_country_code, vendor_extension', 'location' => 'location_address, location_city, location_state, location_zip, location_primary, location_photo, location_client_id', ][$type] ?? ''; } @@ -325,9 +331,9 @@ function linkRowHtml($to, $row, $client_id) { $detail = locationAddressText($row); break; case 'vendor': - $lead = ''; - $link = "$name"; - $detail = $row['vendor_description']; + $lead = vendorTile($row['name'], 'sm'); + $link = "$name"; + $detail = implode(' · ', array_filter([$row['vendor_description'], $row['vendor_phone'] ? formatPhoneNumber($row['vendor_phone'], $row['vendor_phone_country_code']) : ''])); break; default: return ''; diff --git a/functions/search.php b/functions/search.php index 4f1232e2d..8a0ea00ce 100644 --- a/functions/search.php +++ b/functions/search.php @@ -399,19 +399,20 @@ function globalSearchGroups($terms, $deep) { $vendor_phone_match = $phone ? "OR REGEXP_REPLACE(vendor_phone, '[^0-9]', '') LIKE '%$phone%'" : ''; $groups[] = [ 'key' => 'vendors', 'label' => 'Vendors', 'icon' => 'building', 'module' => 'module_client', - 'select' => 'vendor_id, vendor_name, vendor_description, vendor_client_id, client_name', + 'select' => 'vendor_id, vendor_name, vendor_description, vendor_phone, vendor_phone_country_code, vendor_client_id, client_name', 'from' => 'vendors LEFT JOIN clients ON vendor_client_id = client_id', 'where' => "vendor_archived_at IS NULL - AND (vendor_name LIKE '%$like%' OR vendor_description LIKE '%$like%' OR vendor_account_number LIKE '%$like%' $vendor_phone_match)", + AND (vendor_name LIKE '%$like%' OR vendor_description LIKE '%$like%' OR vendor_account_number LIKE '%$like%' + OR vendor_contact_name LIKE '%$like%' OR vendor_email LIKE '%$like%' OR vendor_contact_email LIKE '%$like%' $vendor_phone_match)", 'scope' => 'vendor_client_id', - 'order' => "(vendor_name = '$eq') DESC, (vendor_name LIKE '$like%') DESC, vendor_name", + 'order' => "(vendor_name = '$eq') DESC, (vendor_name LIKE '$like%') DESC, vendor_favorite DESC, vendor_name", 'list_url' => '/agent/vendors.php?' . http_build_query(['q' => $q]), 'item' => function ($row) { return [ 'title' => $row['vendor_name'], - 'subtitle' => $row['vendor_description'], - 'context' => $row['client_name'], - 'url' => globalSearchClientUrl('vendors.php', $row['vendor_client_id'], ['q' => $row['vendor_name']]), + 'subtitle' => implode(' · ', array_filter([$row['vendor_description'], $row['vendor_phone'] ? formatPhoneNumber($row['vendor_phone'], $row['vendor_phone_country_code']) : ''])), + 'context' => intval($row['vendor_client_id']) ? $row['client_name'] : 'Our vendor', + 'url' => globalSearchClientUrl('vendor.php', $row['vendor_client_id'], ['vendor_id' => intval($row['vendor_id'])]), ]; }, ]; diff --git a/functions/software.php b/functions/software.php index 791c38ae2..38141868a 100644 --- a/functions/software.php +++ b/functions/software.php @@ -218,7 +218,7 @@ function softwareRow($software_id) { } $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT software.*, client_id, client_name, vendor_id, vendor_name, vendor_description, vendor_account_number, vendor_phone, vendor_phone_country_code, vendor_extension, - vendor_email, vendor_website, vendor_hours, vendor_sla, vendor_archived_at, + vendor_email, vendor_website, vendor_hours, vendor_sla, vendor_code, vendor_archived_at, " . softwareSeatsUsedSql('software.software_id') . " AS seats_used FROM software LEFT JOIN clients ON client_id = software_client_id diff --git a/functions/tags.php b/functions/tags.php index bcda2ef76..5465b2bb3 100644 --- a/functions/tags.php +++ b/functions/tags.php @@ -1,7 +1,7 @@ [ @@ -43,6 +43,13 @@ function tagEntity($entity) { 'table' => 'assets', 'id' => 'asset_id', 'client' => 'asset_client_id', 'name' => 'asset_name', 'log' => 'Asset', 'list' => 'assets.php' ], + // A vendor of no client is one of ours - a supplier, which is the financial module's + 'vendor' => [ + 'type' => 6, 'label' => 'vendor', 'module' => 'module_client', 'module_ours' => 'module_financial', + 'link_table' => 'vendor_tags', 'link_record' => 'vendor_id', 'link_tag' => 'tag_id', + 'table' => 'vendors', 'id' => 'vendor_id', 'client' => 'vendor_client_id', 'name' => 'vendor_name', + 'log' => 'Vendor', 'list' => 'vendors.php' + ], ]; return $entities[$entity] ?? null; @@ -87,14 +94,15 @@ function tagsForRecord($entity, $record_id) { * this kind of record across all clients. Nothing at all comes back for a * record with no tags when the agent cannot add any. */ -function tagPills($entity, $record_id, array $tags, $filter = '') { +function tagPills($entity, $record_id, array $tags, $filter = '', $can_edit = null) { $config = tagEntity($entity); if (!$config) { return ''; } $record_id = intval($record_id); $filter = tagFilterBase($entity, $filter); - $can_edit = lookupUserPermission($config['module']) >= 2; + // The caller can say who may edit when the module alone does not (one of our own vendors) + $can_edit = $can_edit === null ? lookupUserPermission($config['module']) >= 2 : (bool) $can_edit; if (!$tags && !$can_edit) { return ''; } @@ -138,7 +146,12 @@ function tagRecordsEditable($entity, array $record_ids) { $config = tagEntity($entity); $record_ids = array_values(array_unique(array_filter(array_map('intval', $record_ids)))); - if (!$config || !$record_ids || lookupUserPermission($config['module']) < 2) { + if (!$config || !$record_ids) { + return false; + } + $can_module = lookupUserPermission($config['module']) >= 2; + $can_ours = isset($config['module_ours']) && lookupUserPermission($config['module_ours']) >= 2; + if (!$can_module && !$can_ours) { return false; } @@ -148,7 +161,11 @@ function tagRecordsEditable($entity, array $record_ids) { FROM {$config['table']} WHERE {$config['id']} IN (" . implode(',', $record_ids) . ")" ); while ($row = mysqli_fetch_assoc($sql)) { - if (!hasClientAccess(intval($row['client_id']))) { + if (intval($row['client_id']) === 0 && isset($config['module_ours'])) { + if (!$can_ours) { + return false; + } + } elseif (!$can_module || !hasClientAccess(intval($row['client_id']))) { return false; } $records[intval($row['record_id'])] = ['name' => $row['record_name'], 'client_id' => intval($row['client_id'])]; diff --git a/functions/vendor.php b/functions/vendor.php new file mode 100644 index 000000000..ff232c439 --- /dev/null +++ b/functions/vendor.php @@ -0,0 +1,443 @@ + ['table' => 'tickets', 'id' => 'ticket_id', 'columns' => ['ticket_vendor_id'], 'client' => 'ticket_client_id', 'archived' => 'ticket_archived_at', 'module' => 'module_support', 'label' => 'case', 'plural' => 'Cases', 'icon' => 'fa-life-ring'], + 'software' => ['table' => 'software', 'id' => 'software_id', 'columns' => ['software_vendor_id'], 'client' => 'software_client_id', 'archived' => 'software_archived_at', 'module' => 'module_support', 'label' => 'license', 'plural' => 'Licenses', 'icon' => 'fa-cube'], + 'asset' => ['table' => 'assets', 'id' => 'asset_id', 'columns' => ['asset_vendor_id'], 'client' => 'asset_client_id', 'archived' => 'asset_archived_at', 'module' => 'module_support', 'label' => 'asset', 'plural' => 'Assets', 'icon' => 'fa-desktop'], + 'domain' => ['table' => 'domains', 'id' => 'domain_id', 'columns' => ['domain_registrar', 'domain_webhost', 'domain_dnshost', 'domain_mailhost'], 'client' => 'domain_client_id', 'archived' => 'domain_archived_at', 'module' => 'module_support', 'label' => 'domain', 'plural' => 'Domains', 'icon' => 'fa-globe'], +]; + +/** What each domain column makes the vendor - shown beside the domain. */ +const VENDOR_DOMAIN_ROLES = ['domain_registrar' => 'Registrar', 'domain_webhost' => 'Web host', 'domain_dnshost' => 'DNS', 'domain_mailhost' => 'Mail']; + +/** The module a vendor belongs to - a client's are the client module's, ours the financial module's. */ +function vendorModule($client_id) { + return intval($client_id) ? 'module_client' : 'module_financial'; +} + +/** + * May this agent do this to a vendor of this client? 1 is to see it, 2 to + * change it, 3 to delete it. Anyone may look up one of our own vendors - + * their number is no secret - as it has always been. + */ +function vendorCan($client_id, $level) { + $client_id = intval($client_id); + if (!$client_id && $level <= 1) { + return true; + } + return lookupUserPermission(vendorModule($client_id)) >= $level && (!$client_id || hasClientAccess($client_id)); +} + +/** Stop here unless this agent may do this to a vendor of this client. */ +function vendorEnforce($client_id, $level) { + $client_id = intval($client_id); + if ($client_id) { + enforceUserPermission('module_client', $level); + enforceClientAccess($client_id); + } elseif ($level >= 2) { + enforceUserPermission('module_financial', $level); + } +} + +/** Up to two letters for a vendor's tile - "Keystone Business Fiber" is KB, "Netgate" is NE. */ +function vendorInitials($name) { + $name = trim(html_entity_decode((string) $name, ENT_QUOTES, 'UTF-8')); + $words = array_values(array_filter(preg_split('/[\s\-\/&,.]+/u', $name, -1, PREG_SPLIT_NO_EMPTY), function ($word) { + return !in_array(mb_strtolower($word), ['the', 'and', 'of', 'inc', 'llc', 'ltd'], true) && preg_match('/^[\p{L}\p{N}]/u', $word); + })); + if (!$words) { + return $name === '' ? '?' : mb_strtoupper(mb_substr($name, 0, 1)); + } + if (count($words) === 1) { + return mb_strtoupper(mb_substr($words[0], 0, 2)); + } + return mb_strtoupper(mb_substr($words[0], 0, 1) . mb_substr($words[1], 0, 1)); +} + +/** A vendor's colour, by name - so a vendor many clients use is the same colour for all of them. */ +function vendorTone($name) { + $tones = ['primary', 'success', 'info', 'warning', 'secondary']; + $key = mb_strtolower(trim(html_entity_decode((string) $name, ENT_QUOTES, 'UTF-8'))); + return $tones[crc32($key) % count($tones)]; +} + +/** The vendor's initials on its colour, in the same rounded square as the asset and license tiles. $size 'xs' | 'sm' | '' | 'lg'. */ +function vendorTile($name, $size = '') { + $size_class = in_array($size, ['xs', 'sm', 'lg'], true) ? " itflow-asset-icon-$size itflow-vendor-tile-$size" : ''; + $tone = vendorTone($name); + return ''; +} + +/** A vendor in a picker - its tile, and a quieter line under it. */ +function selectOptionVendor($name, $description = '') { + return selectOptionData(['initials' => vendorInitials($name), 'tone' => vendorTone($name), 'soft' => '1', 'description' => $description]); +} + +/** + * A vendor wherever a page mentions one: its tile, then its name, opening + * its quick look - or its page with 'page' => true (then 'client_id' too). + * 'archived' strikes the name through; 'class' goes on the link. + * Takes the name raw or already escaped. + */ +function vendorLink($vendor_id, $name, $options = []) { + $vendor_id = intval($vendor_id); + $name = html_entity_decode((string) $name, ENT_QUOTES, 'UTF-8'); + $label = escapeHtml($name !== '' ? $name : 'Unnamed vendor'); + $archived = !empty($options['archived']); + $class = trim('text-truncate ' . ($options['class'] ?? '') . ($archived ? ' text-decoration-line-through text-body-secondary' : '')); + $title = $archived ? ' title="Archived vendor"' : ''; + if (!empty($options['page'])) { + $client_id = intval($options['client_id'] ?? 0); + $href = 'vendor.php?' . ($client_id ? "client_id=$client_id&" : '') . "vendor_id=$vendor_id"; + $link = "$label"; + } else { + $link = "$label"; + } + return '' . vendorTile($name, 'xs') . $link . ''; +} + +/** The vendor's website as a link - with https:// when it was saved without a scheme. Raw in, raw out; '' without one. */ +function vendorWebsiteUrl($website) { + $website = trim(html_entity_decode((string) $website, ENT_QUOTES, 'UTF-8')); + if ($website === '') { + return ''; + } + return preg_match('#^[a-z][a-z0-9+.-]*://#i', $website) ? $website : "https://$website"; +} + +/** The website without its scheme or a trailing slash - how it reads on a page. Raw in, raw out. */ +function vendorWebsiteLabel($website) { + $website = trim(html_entity_decode((string) $website, ENT_QUOTES, 'UTF-8')); + return rtrim(preg_replace('#^https?://#i', '', $website), '/'); +} + +/** The support line to dial, with the country code - for a Call button. '' without one. */ +function vendorDialNumber($phone, $country_code) { + $digits = preg_replace('/[^0-9]/', '', (string) $phone); + if ($digits === '') { + return ''; + } + $country = preg_replace('/[^0-9]/', '', (string) $country_code); + return ($country !== '' ? "+$country" : '') . $digits; +} + +/** + * A PIN or code as dots, with an eye to show it and a copy button that works + * either way - so it is not read off a shared screen. '' when there is none. + * Takes the value raw or already escaped. + */ +function vendorSecretHtml($value, $what = 'PIN') { + $value = escapeHtml(trim(html_entity_decode((string) $value, ENT_QUOTES, 'UTF-8'))); + if ($value === '') { + return ''; + } + return '' . $value . '' + . '' + . ''; +} + +/** One vendor by id with its client and template names - raw, or null. */ +function vendorRow($vendor_id) { + global $mysqli; + $vendor_id = intval($vendor_id); + if (!$vendor_id) { + return null; + } + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT vendors.*, client_name, vendor_template_name + FROM vendors + LEFT JOIN clients ON client_id = vendor_client_id + LEFT JOIN vendor_templates ON vendor_templates.vendor_template_id = vendors.vendor_template_id + WHERE vendor_id = $vendor_id + LIMIT 1")); + return $row ?: null; +} + +/** + * The vendor fields a New / Edit form posts, as a SQL SET list - phone + * numbers as digits, the website without its scheme, only a template that + * exists. Null when there is no name. Fields missing from the post are blank. + */ +function vendorFormSet($post) { + global $mysqli; + $text = function ($field, $length = 200) use ($post) { + $value = trim((string) ($post[$field] ?? '')); + return "'" . escapeSql($length ? mb_substr($value, 0, $length) : $value) . "'"; + }; + $digits = function ($field, $length = 200) use ($post) { + return "'" . substr(preg_replace('/[^0-9]/', '', (string) ($post[$field] ?? '')), 0, $length) . "'"; + }; + + if (trim((string) ($post['name'] ?? '')) === '') { + return null; + } + + $template_id = intval($post['vendor_template_id'] ?? 0); + if ($template_id && !mysqli_num_rows(mysqli_query($mysqli, "SELECT 1 FROM vendor_templates WHERE vendor_template_id = $template_id"))) { + $template_id = 0; + } + $website = mb_substr(preg_replace('#^https?://#i', '', trim((string) ($post['website'] ?? ''))), 0, 200); + + $fields = [ + 'vendor_name' => $text('name'), + 'vendor_description' => $text('description'), + 'vendor_account_number' => $text('account_number'), + 'vendor_code' => $text('code'), + 'vendor_contact_name' => $text('contact_name'), + 'vendor_contact_phone_country_code' => $digits('contact_phone_country_code', 10), + 'vendor_contact_phone' => $digits('contact_phone'), + 'vendor_contact_email' => $text('contact_email'), + 'vendor_phone_country_code' => $digits('phone_country_code', 10), + 'vendor_phone' => $digits('phone'), + 'vendor_extension' => $digits('extension'), + 'vendor_email' => $text('email'), + 'vendor_website' => "'" . escapeSql($website) . "'", + 'vendor_hours' => $text('hours'), + 'vendor_sla' => $text('sla'), + 'vendor_notes' => $text('notes', 0), + 'vendor_favorite' => intval($post['favorite'] ?? 0) ? 1 : 0, + 'vendor_template_id' => $template_id, + ]; + $set = []; + foreach ($fields as $column => $value) { + $set[] = "$column = $value"; + } + return implode(', ', $set); +} + +/** Replace a vendor's tags with these - vendor tags (type 6) only. */ +function vendorSetTags($vendor_id, $tag_ids) { + global $mysqli; + $vendor_id = intval($vendor_id); + mysqli_query($mysqli, "DELETE FROM vendor_tags WHERE vendor_id = $vendor_id"); + $tag_ids = array_values(array_unique(array_filter(array_map('intval', (array) $tag_ids)))); + if (!$tag_ids) { + return; + } + mysqli_query($mysqli, "INSERT IGNORE INTO vendor_tags (vendor_id, tag_id) + SELECT $vendor_id, tag_id FROM tags WHERE tag_type = 6 AND tag_id IN (" . implode(',', $tag_ids) . ")"); +} + +/** A template's fields as they go on a vendor - for New from template. Raw, or null. */ +function vendorTemplateRow($template_id) { + global $mysqli; + $template_id = intval($template_id); + if (!$template_id) { + return null; + } + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM vendor_templates WHERE vendor_template_id = $template_id AND vendor_template_archived_at IS NULL LIMIT 1")); + return $row ?: null; +} + +/** A template as the fields of the vendor form - what New from template fills in. */ +function vendorTemplateFormFields($template) { + return [ + 'name' => $template['vendor_template_name'] ?? '', + 'description' => $template['vendor_template_description'] ?? '', + 'account_number' => $template['vendor_template_account_number'] ?? '', + 'code' => $template['vendor_template_code'] ?? '', + 'contact_name' => $template['vendor_template_contact_name'] ?? '', + 'phone_country_code' => $template['vendor_template_phone_country_code'] ?? '', + 'phone' => $template['vendor_template_phone'] ?? '', + 'extension' => $template['vendor_template_extension'] ?? '', + 'email' => $template['vendor_template_email'] ?? '', + 'website' => $template['vendor_template_website'] ?? '', + 'hours' => $template['vendor_template_hours'] ?? '', + 'sla' => $template['vendor_template_sla'] ?? '', + 'notes' => $template['vendor_template_notes'] ?? '', + 'vendor_template_id' => intval($template['vendor_template_id'] ?? 0), + ]; +} + +/** + * How much each vendor is used, for the list's chips and the page's tabs: + * open cases and cases, licenses, assets, domains, services, logins, + * documents and files, and - for our own vendors - expenses, what was spent + * with them this year, and recurring expenses. Only what belongs to the vendor's own client counts, which is + * also what lets these use the client indexes. + */ +function vendorCounts($vendors) { + global $mysqli; + $counts = []; + $clients = []; + foreach ((array) $vendors as $vendor) { + $id = intval($vendor['vendor_id']); + if (!$id) { + continue; + } + $counts[$id] = ['open' => 0, 'ticket' => 0, 'software' => 0, 'asset' => 0, 'domain' => 0, 'service' => 0, 'credential' => 0, 'document' => 0, 'file' => 0, 'expense' => 0, 'recurring' => 0, 'spend_year' => 0.0]; + $clients[intval($vendor['vendor_client_id'])] = true; + } + if (!$counts) { + return $counts; + } + $in = implode(',', array_keys($counts)); + $client_in = implode(',', array_keys($clients)); + + $sql = mysqli_query($mysqli, "SELECT ticket_vendor_id, COUNT(*), COALESCE(SUM(ticket_resolved_at IS NULL AND ticket_closed_at IS NULL), 0) + FROM tickets WHERE ticket_client_id IN ($client_in) AND ticket_vendor_id IN ($in) GROUP BY ticket_vendor_id"); + while ($row = mysqli_fetch_row($sql)) { + $counts[intval($row[0])]['ticket'] = intval($row[1]); + $counts[intval($row[0])]['open'] = intval($row[2]); + } + foreach (['software', 'asset'] as $kind) { + $use = VENDOR_USES[$kind]; + $column = $use['columns'][0]; + $sql = mysqli_query($mysqli, "SELECT $column, COUNT(*) FROM {$use['table']} + WHERE {$use['client']} IN ($client_in) AND $column IN ($in) AND {$use['archived']} IS NULL GROUP BY $column"); + while ($row = mysqli_fetch_row($sql)) { + $counts[intval($row[0])][$kind] = intval($row[1]); + } + } + // A domain counts once for a vendor however many of its roles the vendor has + $sql = mysqli_query($mysqli, "SELECT domain_registrar, domain_webhost, domain_dnshost, domain_mailhost FROM domains + WHERE domain_client_id IN ($client_in) AND domain_archived_at IS NULL + AND (domain_registrar IN ($in) OR domain_webhost IN ($in) OR domain_dnshost IN ($in) OR domain_mailhost IN ($in))"); + while ($row = mysqli_fetch_row($sql)) { + foreach (array_unique(array_map('intval', $row)) as $vendor_id) { + if (isset($counts[$vendor_id])) { + $counts[$vendor_id]['domain']++; + } + } + } + $joins = [ + 'service' => ['service_vendors', 'services', 'service_id', 'service_client_id IN (' . $client_in . ')'], + 'credential' => ['vendor_credentials', 'credentials', 'credential_id', 'credential_archived_at IS NULL'], + 'document' => ['vendor_documents', 'documents', 'document_id', 'document_archived_at IS NULL'], + 'file' => ['vendor_files', 'files', 'file_id', 'file_archived_at IS NULL'], + ]; + foreach ($joins as $kind => [$link_table, $table, $id, $where]) { + $sql = mysqli_query($mysqli, "SELECT l.vendor_id, COUNT(*) FROM $link_table l JOIN $table t ON t.$id = l.$id + WHERE l.vendor_id IN ($in) AND $where GROUP BY l.vendor_id"); + while ($row = mysqli_fetch_row($sql)) { + $counts[intval($row[0])][$kind] = intval($row[1]); + } + } + if (isset($clients[0])) { + $year = intval(date('Y')); + $sql = mysqli_query($mysqli, "SELECT expense_vendor_id, COUNT(*), COALESCE(SUM(IF(YEAR(expense_date) = $year, expense_amount, 0)), 0) + FROM expenses WHERE expense_vendor_id IN ($in) AND expense_archived_at IS NULL GROUP BY expense_vendor_id"); + while ($row = mysqli_fetch_row($sql)) { + $counts[intval($row[0])]['expense'] = intval($row[1]); + $counts[intval($row[0])]['spend_year'] = floatval($row[2]); + } + $sql = mysqli_query($mysqli, "SELECT recurring_expense_vendor_id, COUNT(*) FROM recurring_expenses WHERE recurring_expense_vendor_id IN ($in) AND recurring_expense_archived_at IS NULL GROUP BY recurring_expense_vendor_id"); + while ($row = mysqli_fetch_row($sql)) { + $counts[intval($row[0])]['recurring'] = intval($row[1]); + } + } + return $counts; +} + +/** + * Why this vendor cannot be deleted, or '' if it can. Expenses, recurring + * expenses and a payment provider's fees are the books - those vendors are + * archived instead, so the books keep saying who was paid. + */ +function vendorDeleteBlocker($vendor_id) { + global $mysqli; + $vendor_id = intval($vendor_id); + $reasons = []; + $expenses = intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM expenses WHERE expense_vendor_id = $vendor_id"))[0]); + if ($expenses) { + $reasons[] = $expenses === 1 ? '1 expense' : "$expenses expenses"; + } + $recurring = intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM recurring_expenses WHERE recurring_expense_vendor_id = $vendor_id"))[0]); + if ($recurring) { + $reasons[] = $recurring === 1 ? '1 recurring expense' : "$recurring recurring expenses"; + } + $providers = intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM payment_providers WHERE payment_provider_expense_vendor = $vendor_id"))[0]); + if ($providers) { + $reasons[] = 'a payment provider\'s fees'; + } + return $reasons ? 'it has ' . implode(' and ', $reasons) . ' booked to it - archive it instead' : ''; +} + +/** + * Before a vendor is deleted for good: everything that pointed at it points + * at no vendor instead of an id that no longer exists. Its tags, links to + * documents, files, logins and services go with it (the link tables cascade). + */ +function vendorClearReferences($vendor_id) { + global $mysqli; + $vendor_id = intval($vendor_id); + foreach (VENDOR_USES as $use) { + foreach ($use['columns'] as $column) { + mysqli_query($mysqli, "UPDATE {$use['table']} SET $column = 0 WHERE $column = $vendor_id"); + } + } +} + +/** + * The same vendor at the agent's other clients - by name, or made from the + * same template - so an outage at an ISP can be checked against every + * client that uses it. Archived vendors and clients are left out. + */ +function vendorElsewhere($vendor, $limit = 50) { + global $mysqli; + $vendor_id = intval($vendor['vendor_id']); + $name = escapeSql(mb_strtolower(trim((string) $vendor['vendor_name']))); + $template_id = intval($vendor['vendor_template_id'] ?? 0); + $match = "LOWER(TRIM(vendor_name)) = '$name'" . ($template_id ? " OR vendor_template_id = $template_id" : ''); + $sql = mysqli_query($mysqli, "SELECT vendor_id, vendor_name, vendor_account_number, vendor_client_id, client_name + FROM vendors + JOIN clients ON client_id = vendor_client_id + WHERE vendor_id != $vendor_id AND vendor_client_id > 0 AND vendor_archived_at IS NULL AND client_archived_at IS NULL + AND ($match) " . clientScopeSql('vendor_client_id') . " + ORDER BY client_name ASC + LIMIT " . max(1, intval($limit))); + $rows = []; + while ($row = mysqli_fetch_assoc($sql)) { + $rows[] = $row; + } + return $rows; +} + +/** What we have spent with one of our vendors: this year, last year and in all, from unarchived expenses. */ +function vendorSpend($vendor_id) { + global $mysqli; + $vendor_id = intval($vendor_id); + $year = intval(date('Y')); + $row = mysqli_fetch_row(mysqli_query($mysqli, "SELECT + COALESCE(SUM(IF(YEAR(expense_date) = $year, expense_amount, 0)), 0), + COALESCE(SUM(IF(YEAR(expense_date) = " . ($year - 1) . ", expense_amount, 0)), 0), + COALESCE(SUM(expense_amount), 0), + COUNT(*), + MAX(expense_date) + FROM expenses WHERE expense_vendor_id = $vendor_id AND expense_archived_at IS NULL")); + return ['year' => floatval($row[0]), 'last_year' => floatval($row[1]), 'total' => floatval($row[2]), 'count' => intval($row[3]), 'last' => $row[4]]; +} + +/** Who did what to a vendor - its audit log entries, newest first. */ +function vendorHistory($vendor_id, $limit = 50) { + global $mysqli; + $vendor_id = intval($vendor_id); + $limit = max(1, intval($limit)); + $sql = mysqli_query($mysqli, "SELECT log_action, log_description, log_created_at, user_name FROM logs + LEFT JOIN users ON user_id = log_user_id + WHERE log_type = 'Vendor' AND log_entity_id = $vendor_id + ORDER BY log_id DESC LIMIT $limit"); + $rows = []; + while ($row = mysqli_fetch_assoc($sql)) { + $rows[] = $row; + } + return $rows; +} diff --git a/js/app.js b/js/app.js index d4d68102e..debd96611 100644 --- a/js/app.js +++ b/js/app.js @@ -774,6 +774,23 @@ itflowBindOnce('itflowTinyMceFocus', 'focusin', '.tox-tinymce-aux', function (e) e.stopImmediatePropagation(); }); +// A PIN or code shown as dots (.itflow-secret) - the eye beside it shows it, and again hides it +itflowBindOnce('itflowSecret', 'click', '.itflow-secret-toggle', function (e) { + e.preventDefault(); + const secret = this.closest('.itflow-secret'); + if (!secret) { + return; + } + const shown = secret.classList.toggle('is-shown'); + const icon = this.querySelector('i'); + if (icon) { + icon.classList.toggle('fa-eye', !shown); + icon.classList.toggle('fa-eye-slash', shown); + } + this.setAttribute('title', shown ? 'Hide' : 'Show'); + this.setAttribute('aria-pressed', shown ? 'true' : 'false'); +}); + itflowBindOnce('itflowAllDay', 'change', '.event-all-day-toggle', function () { const allDay = this.checked;