diff --git a/CHANGELOG.md b/CHANGELOG.md index 7bdf419e7..308e8933b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,7 +6,7 @@ This file documents all notable changes made to ITFlow. ### Upgrading -Update from Maintenance > Update — Update ITFlow hands the job to cron, which updates the files and applies this release's five database changes (3.5.4 to 3.5.9) in the same pass. Nothing else is required. Everyone is signed out once after the update, agents and client portal contacts alike - see Security. The new Payment Provider Fees job in Maintenance > Cron is set up by itself, and so are Manager Check-in and Managed Instances on an install whose config.php turns managed mode on (see New Features & Updates). +Update from Maintenance > Update — Update ITFlow hands the job to cron, which updates the files and applies this release's eight database changes (3.5.4 to 3.6.1) in the same pass. Nothing else is required. Everyone is signed out once after the update, agents and client portal contacts alike - see Security. The new Payment Provider Fees and Text Messages jobs in Maintenance > Cron are set up by themselves, and so are Manager Check-in and Managed Instances on an install whose config.php turns managed mode on (see New Features & Updates). ### Security @@ -27,6 +27,12 @@ Update from Maintenance > Update — Update ITFlow hands the job to cron, which - API keys: agents are notified in ITFlow a week before an API key expires, so an integration doesn't stop without warning. - Payment Providers: Stripe's fee on a card payment is now recorded as an expense about 15 minutes after the payment, instead of the next morning. A new Payment Provider Fees job in Maintenance > Cron does it, and you can run it more often there. Record fees now still works any time. - Payment Providers: clients can pay the card fee. Turn on Clients pay the card fee on Stripe in Admin > Payment Providers and enter what Stripe charges you, as 2.9% plus 0.30. Each card payment is then made bigger by Stripe's fee on it, so you get the full invoice. The fee goes on the invoice as a Card Fee line, with no tax, when the payment goes through. Clients see it before they pay: on Pay invoices and the checkout page in the client portal, on the page an invoice's link opens, and next to autopay. It applies to payments in the client portal, through an invoice's link, by autopay, and when you charge a saved card, where the Charge Saved Card window shows it too. One payment for several invoices has one fee, shared over them. A client can be let off it with No card fee on their Billing tab. Refunding a card payment from ITFlow takes its Card Fee line back off the invoice. It is off until you turn it on. Card surcharges have rules where you and your clients are - in the US, for one, the card networks cap them and don't allow them on debit cards - so check them before turning it on. +- Text messaging: ITFlow can text through Skyetel, from one support number. Set it up in Admin > Integrations > Text Messaging with your Skyetel SID, secret and number, paste the address it shows into the number's SMS Callback URL in Skyetel's portal, and send a test text. A US number has to be registered for texting in Skyetel's portal, or carriers block what it sends. +- Tickets: a text from one of your contacts opens a ticket for them, and they're texted back its number. What they text next goes on it as their reply, with any photos attached, and opens it again if it was resolved. Pick **Text reply** on a ticket to answer by text - it goes to the contact's mobile as plain text and shows in the conversation with whether it went. Turn this off, or open tickets for unknown numbers too, in Admin > Settings > Tickets > Text to ticket. +- Texts: a new page under Support for what comes to your number that isn't a contact. Unmatched holds texts from numbers that aren't a contact's - open a ticket from one (saving the number on the contact as you go), dismiss it, or mark it spam, which blocks the number. Codes holds verification and MFA codes, kept out of tickets: only agents who can view credentials see them, each code is masked until revealed (every reveal is in the audit log), it can be revealed for 15 minutes, and its words are wiped after a day. Spam holds texts from blocked numbers and the usual bait. +- Texts to clients: contacts who agree to texts hear about their work by text - a ticket opened for them and resolved (and, if you choose, each emailed reply), a visit or remote work booked or cancelled, a reminder before it, and invoices and payment reminders with a link to pay. Replying to a text about a ticket adds to the ticket, and a reply to the resolved text opens it again. Choose which in Admin > Settings > Notifications > Texts to clients. Texts ITFlow sends by itself that would land between 9pm and 8am wait for the morning. +- Contacts: nobody is texted these until they agree. Turn on **Texts** on a contact (with their say-so), use **Ask them by text** on their page - a YES turns them on - or they turn it on under Your account in the client portal. The contact's page says when and how they agreed, or that they replied STOP. +- Text messaging: STOP, START and HELP are answered as carriers require. A number that replies STOP gets nothing more until it replies START - Text reply is greyed out for it - and the ticket says so. Admin > Text Messaging lists who opted out and what is blocked; Maintenance > Text Messages has every text sent and received, with retry and cancel. - Managed mode: one ITFlow can now manage others - a client's, a reseller's or your own hosted ones. It's off until config.php turns it on, each side on its own: `$config_enable_managed_instances = true;` on the ITFlow that does the managing adds Admin > Managed Instances, and `$config_enable_managed_by = true;` on each one it manages adds Admin > Managed By. An install with neither line sees nothing of it - no menu, pages, cron jobs or sign-in. Then add one in Admin > Managed Instances, and paste the code it gives you into the other ITFlow's Admin > Managed By. From then on that ITFlow checks in every minute, and you see how each one is doing: its version and whether an update is waiting (a security one stands out), whether cron is running, its last backup, the errors it logged today, and its agents against its seat limit - and you're notified when one stops checking in. From the manager you can update an instance, or let it update itself a set number of days after a release comes out and straight away for a security release; set how many agents it can have and its white-label key; make it read-only, where its people can still sign in, look and export, or suspend it, with a message of your own; and sign in to it as support in a new tab, for two hours, with no password or seat of its own and every sign-in in its audit log. What the manager sets is locked on the instance, which says so - everything else stays the instance's own, and its admins can disconnect it unless its config.php keeps it managed (`$config_manager_required = true`, for a provider hosting it, which turns Managed By on as well). Instances only ever call the manager, so they can sit behind a firewall, and they send how they're doing - never client data. - Export Data: the documentation PDF can go out as a secure link, like a login, document or file. Share a link next to Download PDF - or Share the IT documentation on a client's Shared Links - makes the PDF from the parts you tick and gives you a link that works for as long and as many times as you set, with a passphrase or an emailed code first if you like, and tells you when it's downloaded. The PDF is made when the link is, so later changes aren't in it, and it's kept encrypted until the link stops working - then it's deleted. With passwords and 2FA secrets in it, the PDF is locked with a password of its own too, as a download is, and the page the link opens says so. - Maintenance > Update is easier to follow. It opens with where your install stands - up to date, an update available, an update running, or the database still to finish - and the one button for it, now Update ITFlow instead of Queue Update. Below it is what's new: the release notes for the versions between yours and the latest, read from the changelog each time ITFlow checks for updates, with the developer notes folded away and the commits behind them a click further. Before you update it lists what to do first, and says whether any of ITFlow's own files have been changed on your install, which updating would put back. Once you click Update ITFlow, the page shows the update running, refreshes itself until it's done, and then says when ITFlow was updated, or what stopped it. Alongside are this install's version, branch, database, when it last checked and updated, whether cron is running, and the command to run the same update from a shell, with the folder and user filled in for your server. @@ -43,6 +49,15 @@ Update from Maintenance > Update — Update ITFlow hands the job to cron, which ### Developer Updates +- Text messaging is `functions/sms.php`. Database 3.6.0 adds `sms_providers` (the service, its SID and secret, the number in E.164 digits, the key in its inbound address), `sms_messages` (every text both ways - `sms_message_direction` `out`/`in`, `sms_message_status` queued/sending/sent/failed/blocked/cancelled going out and ticket/unmatched/code/spam/keyword/dismissed coming in) and `sms_numbers` (a number's name, `sms_number_opted_out_at`, `sms_number_blocked_at`), and `settings.config_ticket_sms_parse`, `config_ticket_sms_unknown_senders` and `config_ticket_sms_acknowledge`, read where they're used by `smsTicketSettings()`. +- Sending: `smsQueue($e164, $text, $meta)` splits at `SMS_TEXT_LIMIT` and refuses a number that replied STOP (a `blocked` row) unless `force` - only the STOP answer itself. `smsSendQueued()` claims a row before sending, so a request and the new Text Messages job (`cron/sms_queue.php`, `smsQueueRun()`, every minute) can't both send it; a 401 fails at once, a timeout, 403/429 or 5xx is tried again up to `SMS_MAX_ATTEMPTS`. The job keeps under Skyetel's 300 texts in five minutes and a second apart, and `smsTidy()` wipes codes after `SMS_CODE_KEEP_HOURS`, deletes spam and dismissed texts after `SMS_SPAM_KEEP_DAYS` and the rest after `SMS_KEEP_DAYS`. Providers are `smsProviderKinds()` - another service is an entry there with its own send function and `api/sms/.php`. +- Receiving: `api/sms/skyetel.php?key=` (the key compared with `hash_equals`, else 404) hands `{to, from, text, media}` to `smsInbound()`, in this order: a repeat within two minutes is dropped; STOP/START/HELP (`smsKeyword()`) are answered; a blocked number is Spam; a number with a text on an open ticket in `SMS_CONVERSATION_DAYS` replies on it (`smsConversationTicket()`, `smsTicketReply()`); a contact's mobile or phone (`smsContactsFor()`, matched on the digits with `REGEXP_REPLACE`) opens a ticket (`smsTicketOpen()`, source `Text`); then `smsVerificationCode()`, `smsLooksLikeSpam()`, and Unmatched with one in-app notification an hour per number. `smsSaveMedia()` fetches media over https only, from public addresses only, `SMS_MEDIA_MAX_BYTES` each, as `TICKET_ATTACHMENT_EXTENSIONS`. Texts and HTML go into queries through `smsSql()` (mysqli_real_escape_string) - `escapeSql()` strips anything that looks like a tag. +- Tickets: `public_reply_type` 3 on `add_ticket_reply` texts the reply through `smsTicketReplySend()` (`smsTextFromHtml()` keeps lines, writes links out and drops formatting) to `smsTicketRecipient()` - the contact's mobile, else the number texting on the ticket. `agent/ticket.php` reads each reply's texts with `smsRepliesForTicket()`. `ticketSourceIcon()`, the ticket summary report and the agent emails' `how` know `Text`/`text`, and `aiTicketDraft()` takes `text` for a short plain draft. +- Texts to clients: database 3.6.1 adds `contacts.contact_sms_opt_in`, `contact_sms_opt_in_at` and `contact_sms_opt_in_by` (a record of how they agreed), `sms_messages.sms_message_send_after` with a `(sms_message_purpose, sms_message_ticket_id, sms_message_created_at)` index, and `settings.config_sms_client_tickets` (0 off, 1 opened and resolved, 2 and each emailed reply), `config_sms_client_visits`, `config_sms_visit_reminder_hours` (0, 1, 2, 4, 24) and `config_sms_client_invoices`, read by `smsClientSettings()`. Everything checks `smsColumnExists()` first, so files ahead of the database do nothing. +- `triggerCustomAction()` calls `smsClientNotify()` on `ticket_create` (not for a ticket that came in by text), `ticket_resolve`, `ticket_schedule` and `ticket_unschedule`; `add_ticket_reply` calls `smsTicketReplyNotify()` after an emailed reply; and `smsInvoiceNotify($invoice, $kind, $recipients)` follows `billingEmailQueue()` in Send (`email_invoice`), the nightly payment reminders, recurring invoices sending themselves and `billingInvoiceIssue()`, texting those recipients who agreed and adding "and texted to ..." to the invoice's history. Each goes through `smsNotifyContact()`: only to `smsContactTextable()` contacts, queued with `send_after` from `smsSendAfter()` (`SMS_QUIET_FROM`/`SMS_QUIET_UNTIL`, your time - unless the morning is too late for a visit), and sent by the Text Messages job, whose `smsQueueRun()` waits for `send_after`. Texts about a ticket carry its id, so `smsConversationTicket()` puts the reply on it. +- The Text Messages job also runs `smsVisitReminders()`: tickets booked within `config_sms_visit_reminder_hours`, open, whose contact agreed, with no `reminder` or `notify_scheduled` text for the ticket in that window. +- Opting in: `smsOptInSet($contact_id, $on, $by, $by_them)` - turned on by the contact (portal, YES) it lifts their STOP; by an agent it doesn't. `smsOptInAsk()` texts an `opt_in_request`; `smsInbound()` takes YES (or OK, Sure) from a number asked in `SMS_OPT_IN_ASK_DAYS` as agreeing (`smsOptInPending()`). The contact window posts `sms_opt_in_shown` with the switch, so `smsContactOptInFromForm()` leaves a contact saved from elsewhere alone. `smsContactTextState()` is what the contact page, the contact window and the portal show. +- Texts > Codes reveals through `ajax.php?sms_reveal_code` (POST, CSRF, `module_credential`), logged as Text Message / View every time; the page asks `ajax.php?sms_latest_code` every five seconds and comes again when a code lands. Codes are masked in Maintenance > Text Messages, and their words aren't searched on either page. - `backupRestoreArchive()` no longer extracts the inner `uploads.zip` wholesale. It builds an allow-list of entries and extracts with `extractTo($dir, $entries)`, leaving out any entry whose basename is `.htaccess`, `.user.ini` or `.htpasswd` and any entry that resolves inside `backupStorageDir()`, which the restore preserves while it empties the rest of `uploads/`. Unsafe paths (`..`, absolute) still fail the restore as before. `scripts/restore_cli.php` gets the same, as it calls the same function. - `backupHardenStorageDir()` writes its `.htaccess` every time instead of only when there is none, so a guard carried in by an archive can't survive. `backupAssertUploadsGuards()` also rewrites the deny-all guards in `uploads/backups`, `canned_responses`, `expenses` and `tmp`, so a restored `uploads/` has the same guards as a fresh install. Both use the new `BACKUP_UPLOADS_DENY_GUARD` constant. - `accountLedgerSql()` reads its lines first and joins each to its account with `STRAIGHT_JOIN`. Left to choose, the optimizer started from the accounts and found their lines through an index it built on the lines' temporary table (`derived_with_keys`), which was two to three times slower. diff --git a/admin/database_updates/3.6.0.php b/admin/database_updates/3.6.0.php new file mode 100644 index 000000000..83a9e983e --- /dev/null +++ b/admin/database_updates/3.6.0.php @@ -0,0 +1,91 @@ + Tickets > Text to ticket + * + * Re-runnable: each table and column is made only where it isn't there yet. + */ + +defined('FROM_DB_UPDATER') || die("Direct file access is not allowed"); + + mysqli_query($mysqli, "CREATE TABLE IF NOT EXISTS `sms_providers` ( + `sms_provider_id` int(11) NOT NULL AUTO_INCREMENT, + `sms_provider_name` varchar(100) NOT NULL, + `sms_provider_description` varchar(255) DEFAULT NULL, + `sms_provider_username` varchar(255) NOT NULL DEFAULT '', + `sms_provider_secret` varchar(500) NOT NULL DEFAULT '', + `sms_provider_number` varchar(20) NOT NULL DEFAULT '', + `sms_provider_inbound_key` varchar(64) NOT NULL DEFAULT '', + `sms_provider_active` tinyint(1) NOT NULL DEFAULT 1, + `sms_provider_last_inbound_at` datetime DEFAULT NULL, + `sms_provider_created_at` datetime NOT NULL DEFAULT current_timestamp(), + `sms_provider_updated_at` datetime DEFAULT NULL ON UPDATE current_timestamp(), + PRIMARY KEY (`sms_provider_id`) + ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci"); + + mysqli_query($mysqli, "CREATE TABLE IF NOT EXISTS `sms_messages` ( + `sms_message_id` int(11) NOT NULL AUTO_INCREMENT, + `sms_message_direction` varchar(3) NOT NULL, + `sms_message_status` varchar(20) NOT NULL, + `sms_message_number` varchar(20) NOT NULL, + `sms_message_our_number` varchar(20) NOT NULL DEFAULT '', + `sms_message_body` text DEFAULT NULL, + `sms_message_media` text DEFAULT NULL, + `sms_message_code` varchar(20) DEFAULT NULL, + `sms_message_purpose` varchar(30) NOT NULL DEFAULT '', + `sms_message_attempts` tinyint(4) NOT NULL DEFAULT 0, + `sms_message_error` varchar(500) DEFAULT NULL, + `sms_message_provider_ref` varchar(100) DEFAULT NULL, + `sms_message_contact_id` int(11) NOT NULL DEFAULT 0, + `sms_message_client_id` int(11) NOT NULL DEFAULT 0, + `sms_message_ticket_id` int(11) NOT NULL DEFAULT 0, + `sms_message_ticket_reply_id` int(11) NOT NULL DEFAULT 0, + `sms_message_user_id` int(11) NOT NULL DEFAULT 0, + `sms_message_created_at` datetime NOT NULL DEFAULT current_timestamp(), + `sms_message_attempted_at` datetime DEFAULT NULL, + `sms_message_sent_at` datetime DEFAULT NULL, + `sms_message_handled_at` datetime DEFAULT NULL, + `sms_message_handled_by` int(11) NOT NULL DEFAULT 0, + PRIMARY KEY (`sms_message_id`), + KEY `sms_message_status` (`sms_message_status`,`sms_message_id`), + KEY `sms_message_number` (`sms_message_number`,`sms_message_created_at`), + KEY `sms_message_ticket_id` (`sms_message_ticket_id`), + KEY `sms_message_created_at` (`sms_message_created_at`) + ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci"); + + mysqli_query($mysqli, "CREATE TABLE IF NOT EXISTS `sms_numbers` ( + `sms_number_phone` varchar(20) NOT NULL, + `sms_number_label` varchar(100) DEFAULT NULL, + `sms_number_opted_out_at` datetime DEFAULT NULL, + `sms_number_blocked_at` datetime DEFAULT NULL, + `sms_number_blocked_by` int(11) NOT NULL DEFAULT 0, + `sms_number_updated_at` datetime DEFAULT NULL ON UPDATE current_timestamp(), + PRIMARY KEY (`sms_number_phone`) + ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci"); + + // Settings > Tickets > Text to ticket - after the email-to-ticket switches, in the order the page shows them + $itflow_sms_settings = [ + 'config_ticket_sms_parse' => "tinyint(1) NOT NULL DEFAULT 1 AFTER `config_ticket_email_parse_unknown_senders`", + 'config_ticket_sms_unknown_senders' => "tinyint(1) NOT NULL DEFAULT 0 AFTER `config_ticket_sms_parse`", + 'config_ticket_sms_acknowledge' => "tinyint(1) NOT NULL DEFAULT 1 AFTER `config_ticket_sms_unknown_senders`", + ]; + foreach ($itflow_sms_settings as $itflow_sms_column => $itflow_sms_definition) { + $itflow_column_exists = mysqli_query($mysqli, "SELECT 1 FROM information_schema.COLUMNS + WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'settings' AND COLUMN_NAME = '$itflow_sms_column' LIMIT 1"); + if (!$itflow_column_exists || mysqli_num_rows($itflow_column_exists) === 0) { + mysqli_query($mysqli, "ALTER TABLE `settings` ADD `$itflow_sms_column` $itflow_sms_definition"); + } + } + + unset($itflow_sms_settings, $itflow_sms_column, $itflow_sms_definition, $itflow_column_exists); diff --git a/admin/database_updates/3.6.1.php b/admin/database_updates/3.6.1.php new file mode 100644 index 000000000..da717340e --- /dev/null +++ b/admin/database_updates/3.6.1.php @@ -0,0 +1,45 @@ + Notifications > Texts to clients + * + * Re-runnable: each column is made only where it isn't there yet. + */ + +defined('FROM_DB_UPDATER') || die("Direct file access is not allowed"); + + $itflow_sms_columns = [ + ['contacts', 'contact_sms_opt_in', "tinyint(1) NOT NULL DEFAULT 0 AFTER `contact_company_ticket_emails`"], + ['contacts', 'contact_sms_opt_in_at', "datetime DEFAULT NULL AFTER `contact_sms_opt_in`"], + ['contacts', 'contact_sms_opt_in_by', "varchar(200) DEFAULT NULL AFTER `contact_sms_opt_in_at`"], + ['sms_messages', 'sms_message_send_after', "datetime DEFAULT NULL AFTER `sms_message_created_at`"], + ['settings', 'config_sms_client_tickets', "tinyint(1) NOT NULL DEFAULT 1 AFTER `config_ticket_sms_acknowledge`"], + ['settings', 'config_sms_client_visits', "tinyint(1) NOT NULL DEFAULT 1 AFTER `config_sms_client_tickets`"], + ['settings', 'config_sms_visit_reminder_hours', "int(11) NOT NULL DEFAULT 24 AFTER `config_sms_client_visits`"], + ['settings', 'config_sms_client_invoices', "tinyint(1) NOT NULL DEFAULT 1 AFTER `config_sms_visit_reminder_hours`"], + ]; + foreach ($itflow_sms_columns as [$itflow_sms_table, $itflow_sms_column, $itflow_sms_definition]) { + $itflow_column_exists = mysqli_query($mysqli, "SELECT 1 FROM information_schema.COLUMNS + WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = '$itflow_sms_table' AND COLUMN_NAME = '$itflow_sms_column' LIMIT 1"); + if (!$itflow_column_exists || mysqli_num_rows($itflow_column_exists) === 0) { + mysqli_query($mysqli, "ALTER TABLE `$itflow_sms_table` ADD `$itflow_sms_column` $itflow_sms_definition"); + } + } + + // Whether a reminder or a booking went for a ticket is looked up by what it was for and the ticket + $itflow_index_exists = mysqli_query($mysqli, "SELECT 1 FROM information_schema.STATISTICS + WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'sms_messages' AND INDEX_NAME = 'sms_message_purpose' LIMIT 1"); + if (!$itflow_index_exists || mysqli_num_rows($itflow_index_exists) === 0) { + mysqli_query($mysqli, "ALTER TABLE `sms_messages` ADD KEY `sms_message_purpose` (`sms_message_purpose`,`sms_message_ticket_id`,`sms_message_created_at`)"); + } + + unset($itflow_sms_columns, $itflow_sms_table, $itflow_sms_column, $itflow_sms_definition, $itflow_column_exists, $itflow_index_exists); diff --git a/admin/includes/side_nav.php b/admin/includes/side_nav.php index 5c7800347..844176605 100644 --- a/admin/includes/side_nav.php +++ b/admin/includes/side_nav.php @@ -121,6 +121,12 @@

AI Providers

+
  • + + +

    Text Messaging

    +     +
  • @@ -228,6 +234,20 @@

    • + +
  • + + +

    + Text Messages + + + + +

    +     +
    • +
  • diff --git a/admin/modals/sms_provider/sms_numbers.php b/admin/modals/sms_provider/sms_numbers.php new file mode 100644 index 000000000..7dff0df9a --- /dev/null +++ b/admin/modals/sms_provider/sms_numbers.php @@ -0,0 +1,89 @@ + Text Messaging - Opted out and blocked: the numbers that replied STOP (nothing is + * texted to them until they reply START) and the ones blocked as spam (their texts go + * straight to Spam). Each can be put back - opting someone back in is for when they ask, by + * any other way than texting START (admin/post/sms_provider.php). + */ + +require_once '../../includes/modal_header.php'; + +$rows = []; +try { + $sql = mysqli_query($mysqli, "SELECT sms_number_phone, sms_number_label, sms_number_opted_out_at, sms_number_blocked_at, user_name + FROM sms_numbers LEFT JOIN users ON user_id = sms_number_blocked_by + WHERE sms_number_opted_out_at IS NOT NULL OR sms_number_blocked_at IS NOT NULL + ORDER BY GREATEST(COALESCE(sms_number_opted_out_at, 0), COALESCE(sms_number_blocked_at, 0)) DESC LIMIT 500"); + $rows = mysqli_fetch_all($sql, MYSQLI_ASSOC); +} catch (Throwable $e) { + // Before the 3.6.0 database update +} +$csrf = $_SESSION['csrf_token']; + +ob_start(); + +?> +
    +
    Opted out and blocked
    + +
    +
    + +
    + + No number has replied STOP, and none is blocked as spam. +
    + +
    + + + + + + + + + + + + + + + + + +
    NumberWhat
    +
    + +
    + +     		+ +
    Replied STOP
    + + +
    Blocked as spam
    + +     		+ + Opt back in + + + Unblock + +
    +
    + +
    +
    + +
    + Text Messaging - Add. The same window as Edit (sms_provider_edit.php), with no + * provider yet. + */ + +$_GET['id'] = 0; +require __DIR__ . '/sms_provider_edit.php'; diff --git a/admin/modals/sms_provider/sms_provider_edit.php b/admin/modals/sms_provider/sms_provider_edit.php new file mode 100644 index 000000000..c098da00a --- /dev/null +++ b/admin/modals/sms_provider/sms_provider_edit.php @@ -0,0 +1,211 @@ + Text Messaging - one provider's window: Add (no id, or from sms_provider_add.php) + * or Edit. Its SID and secret - the secret never put back into the page, so left empty it + * stays - the number texts go from, and whether it is on. Save asks first (check_sms_provider, + * admin/post/sms_provider.php): what is wrong shows beside each field and the window stays + * open; once all is right, it saves. + */ + +require_once '../../includes/modal_header.php'; + +$provider_id = intval($_GET['id'] ?? 0); +$row = $provider_id ? smsProviderRow($provider_id) : null; +if ($provider_id && !$row) { + echo json_encode(['error' => 'That texting provider no longer exists.']); + exit; +} + +$kinds = smsProviderKinds(); +$taken = []; +$sql = mysqli_query($mysqli, "SELECT sms_provider_name FROM sms_providers"); +while ($taken_row = mysqli_fetch_row($sql)) { + $taken[$taken_row[0]] = true; +} +$free_kinds = array_diff_key($kinds, $taken); + +$name = $row ? (string) $row['sms_provider_name'] : (string) (array_key_first($free_kinds) ?? array_key_first($kinds)); +$kind = $kinds[$name] ?? reset($kinds); +$number = $row ? smsNumberText($row['sms_provider_number']) : ''; + +// Where what is wrong with a field shows +$error_for = function ($field) { + return '
    '; +}; + +ob_start(); + +?> +
    +
    ' . escapeHtml($name) . '' : 'Add Texting Provider' ?>
    + +
    +
    + + + +
    + + +
    is set up already - edit that one.
    + + + +
    + +
    + + +
    + +
    +
    + +
    +
    + > + +
    +
    Off, nothing is texted and texts to the number aren't taken in. Texts waiting to go wait.
    +
    + + +
    + +
    + + +
    + +
    + +
    + +
    + + +
    + +
    SMS-enabled in 's portal - and, for a US number, registered for texting there, or carriers block what it sends.
    +
    + +
    Keys
    +

    From 's portal - the gear at the top right, then API Keys.

    + +
    + +
    + + +
    + +
    + +
    + +
    + + +
    + +
    + + +
    Texts coming back
    +

    In 's portal, open the number, then SMS: send texts to this Callback URL, by POST.

    +
    + + + +
    + +
    Once it's added, Text Messaging shows the address to paste into 's portal, so texts to the number come back into ITFlow.
    + + +
    +
    + + +
    +
    + + + Text Messaging - Send a test text, to a number of your own, so the keys, the + * number and its registration are tried for real (send_sms_test, admin/post/sms_provider.php). + */ + +require_once '../../includes/modal_header.php'; + +$row = smsProviderRow($_GET['id'] ?? 0); +if (!$row) { + echo json_encode(['error' => 'That texting provider no longer exists.']); + exit; +} +$company = trim((string) (mysqli_fetch_row(mysqli_query($mysqli, "SELECT company_name FROM companies WHERE company_id = 1"))[0] ?? '')); + +ob_start(); + +?> +
    +
    Send a test text
    + +
    +
    + + + +
    +

    From through - to your own mobile. Then text it back, and the reply shows in Texts on the agent side.

    + +
    + +
    + + +
    +
    + +
    + +
    + + +
    +
    +
    +
    + + +
    +
    + Settings > Notifications (admin/settings_notification.php): - * edit_notification_settings saves the domain alert and the emails clients - * get by themselves. Reminders aren't set here (they moved to Invoices and + * edit_notification_settings saves the domain alert, and the emails and texts + * clients get by themselves. Reminders aren't set here (they moved to Invoices and * billing with their schedule), nor cron (Maintenance > Cron). A switch for a * module that is off isn't on the page, so is kept as it is. */ @@ -14,7 +14,8 @@ if (isset($_POST['edit_notification_settings'])) { validateCSRFToken(); - $before = settingsCurrent(['config_enable_alert_domain_expire', 'config_ticket_client_general_notifications', 'config_recurring_auto_send_invoice']); + $sms_columns = smsColumnExists('settings', 'config_sms_client_tickets') ? ['config_sms_client_tickets', 'config_sms_client_visits', 'config_sms_visit_reminder_hours', 'config_sms_client_invoices'] : []; + $before = settingsCurrent(array_merge(['config_enable_alert_domain_expire', 'config_ticket_client_general_notifications', 'config_recurring_auto_send_invoice'], $sms_columns)); $after = ['config_enable_alert_domain_expire' => empty($_POST['config_enable_alert_domain_expire']) ? 0 : 1]; if ($config_module_enable_ticketing) { @@ -23,6 +24,19 @@ if (isset($_POST['edit_notification_settings'])) { if ($config_module_enable_accounting) { $after['config_recurring_auto_send_invoice'] = empty($_POST['config_recurring_auto_send_invoice']) ? 0 : 1; } + // Texts to clients - once the database has them; a choice not on the list keeps what it is + if ($sms_columns) { + if ($config_module_enable_ticketing) { + $tickets = intval($_POST['config_sms_client_tickets'] ?? $before['config_sms_client_tickets']); + $after['config_sms_client_tickets'] = in_array($tickets, [0, 1, 2], true) ? $tickets : intval($before['config_sms_client_tickets']); + $after['config_sms_client_visits'] = empty($_POST['config_sms_client_visits']) ? 0 : 1; + $hours = intval($_POST['config_sms_visit_reminder_hours'] ?? $before['config_sms_visit_reminder_hours']); + $after['config_sms_visit_reminder_hours'] = isset(smsReminderChoices()[$hours]) ? $hours : intval($before['config_sms_visit_reminder_hours']); + } + if ($config_module_enable_accounting) { + $after['config_sms_client_invoices'] = empty($_POST['config_sms_client_invoices']) ? 0 : 1; + } + } settingsSave('notification', $before, $after); diff --git a/admin/post/settings_ticket.php b/admin/post/settings_ticket.php index 904340102..71f75986a 100644 --- a/admin/post/settings_ticket.php +++ b/admin/post/settings_ticket.php @@ -2,7 +2,7 @@ /* * Admin > Settings > Tickets (admin/settings_ticket.php): - * edit_ticket_settings saves the numbering, email to ticket, who hears of a + * edit_ticket_settings saves the numbering, email and text to ticket, who hears of a * new ticket and whether AI triages it, the timer and billing, closing and the * tickets page. A next * number already in use, an email address that isn't one or a closing time @@ -20,7 +20,8 @@ if (isset($_POST['edit_ticket_settings'])) { $before = settingsCurrent(array_merge(['config_ticket_prefix', 'config_ticket_next_number', 'config_ticket_email_parse', 'config_ticket_email_parse_unknown_senders', 'config_ticket_new_ticket_notification_email', 'config_ticket_timer_autostart', 'config_ticket_default_billable', 'config_ticket_autoclose_hours', - 'config_ticket_default_view', 'config_ticket_ordering', 'config_ticket_moving_columns'], aiTriageReady() ? ['config_ticket_ai_triage'] : [])); + 'config_ticket_default_view', 'config_ticket_ordering', 'config_ticket_moving_columns'], aiTriageReady() ? ['config_ticket_ai_triage'] : [], + settingsColumnExists($mysqli, 'config_ticket_sms_parse') ? ['config_ticket_sms_parse', 'config_ticket_sms_unknown_senders', 'config_ticket_sms_acknowledge'] : [])); // What was sent, and what is saved for anything that wasn't - a switch not sent is off $in = $_POST + array_map(function ($value) { return (string) $value; }, $before); @@ -37,6 +38,12 @@ if (isset($_POST['edit_ticket_settings'])) { foreach (['config_ticket_email_parse', 'config_ticket_email_parse_unknown_senders', 'config_ticket_timer_autostart', 'config_ticket_ordering', 'config_ticket_moving_columns'] as $switch) { $after[$switch] = empty($_POST[$switch]) ? 0 : 1; } + // Text to ticket - once the database has it + if (array_key_exists('config_ticket_sms_parse', $before)) { + foreach (['config_ticket_sms_parse', 'config_ticket_sms_unknown_senders', 'config_ticket_sms_acknowledge'] as $switch) { + $after[$switch] = empty($_POST[$switch]) ? 0 : 1; + } + } if ($config_module_enable_accounting) { $after['config_ticket_default_billable'] = empty($_POST['config_ticket_default_billable']) ? 0 : 1; } diff --git a/admin/post/sms_provider.php b/admin/post/sms_provider.php new file mode 100644 index 000000000..f592e12ae --- /dev/null +++ b/admin/post/sms_provider.php @@ -0,0 +1,180 @@ + Text Messaging - Add and Edit (asked first by check_sms_provider, which answers in + * JSON, so what is wrong shows beside each field), turning a provider on and off, a new + * address for texts to come back to, Delete, Send a test text, and putting back a number + * that replied STOP or was blocked as spam (functions/sms.php). What changed is in the audit + * log - the secret only as changed. + */ + +defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); + +if (isset($_POST['check_sms_provider']) || isset($_POST['add_sms_provider']) || isset($_POST['edit_sms_provider'])) { + + validateCSRFToken(); + + $checking = isset($_POST['check_sms_provider']); + $provider_id = intval($_POST['provider_id'] ?? 0); + $before = $provider_id ? smsProviderRow($provider_id) : null; + + if ($provider_id && !$before) { + if ($checking) { + header('Content-Type: application/json; charset=utf-8'); + echo json_encode(['ok' => false, 'errors' => ['provider' => 'That texting provider no longer exists - close this and look again.']]); + exit; + } + flashAlert('That texting provider no longer exists.', 'error'); + redirect('text_messaging.php'); + } + + [$after, $errors] = smsProviderCheck($_POST, $before); + + if ($checking) { + header('Content-Type: application/json; charset=utf-8'); + echo json_encode(['ok' => !$errors, 'errors' => $errors]); + exit; + } + + // Only reached without the window's script - say the first thing wrong + if ($errors) { + flashAlert('Not saved - ' . escapeHtml(reset($errors)), 'error'); + redirect(); + } + + $name = $after['sms_provider_name']; + $number = smsNumberText($after['sms_provider_number']); + + if (!$before) { + $provider_id = smsProviderWrite($after); + logAudit("Text Message", "Create", "$session_name added texting provider " . escapeSql("$name, texting from $number"), 0, $provider_id); + flashAlert('' . escapeHtml($name) . ' added, texting from ' . escapeHtml($number) . ' - paste the address texts come back to into its portal, then send a test text'); + redirect('text_messaging.php'); + } + + $lines = smsProviderChangeLines($before, $after); + if (!$lines) { + flashAlert('Nothing changed on ' . escapeHtml($name) . '', 'info'); + redirect(); + } + smsProviderWrite($after, $provider_id); + logAudit("Text Message", "Edit", "$session_name changed texting provider " . escapeSql("$name: " . implode('; ', $lines)), 0, $provider_id); + flashAlert('' . escapeHtml($name) . ' saved - ' . escapeHtml(count($lines) === 1 ? $lines[0] : count($lines) . ' changes')); + redirect(); + +} + +// Turn a provider off - nothing is texted, and texts to the number aren't taken in - or on again +if (isset($_GET['turn_sms_provider_off']) || isset($_GET['turn_sms_provider_on'])) { + + validateCSRFToken(); + + $on = isset($_GET['turn_sms_provider_on']); + $row = smsProviderRow($on ? $_GET['turn_sms_provider_on'] : $_GET['turn_sms_provider_off']); + if (!$row) { + flashAlert('That texting provider no longer exists.', 'error'); + redirect('text_messaging.php'); + } + $name = $row['sms_provider_name']; + if (intval($row['sms_provider_active']) === ($on ? 1 : 0)) { + flashAlert('' . escapeHtml($name) . ' is ' . ($on ? 'on' : 'off') . ' already', 'info'); + redirect(); + } + mysqli_query($mysqli, "UPDATE sms_providers SET sms_provider_active = " . ($on ? 1 : 0) . " WHERE sms_provider_id = " . intval($row['sms_provider_id'])); + logAudit("Text Message", "Edit", "$session_name turned texting provider " . escapeSql($name) . ($on ? ' on' : ' off'), 0, intval($row['sms_provider_id'])); + flashAlert($on + ? '' . escapeHtml($name) . ' turned on - texts go out and come in again' + : '' . escapeHtml($name) . ' turned off - nothing is texted, and texts to the number aren\'t taken in until it is on again'); + redirect(); + +} + +// A new address for texts to come back to - the old one stops working at once +if (isset($_GET['new_sms_inbound_key'])) { + + validateCSRFToken(); + + $row = smsProviderRow($_GET['new_sms_inbound_key']); + if (!$row) { + flashAlert('That texting provider no longer exists.', 'error'); + redirect('text_messaging.php'); + } + mysqli_query($mysqli, "UPDATE sms_providers SET sms_provider_inbound_key = '" . escapeSql(randomString(40)) . "' WHERE sms_provider_id = " . intval($row['sms_provider_id'])); + logAudit("Text Message", "Edit", "$session_name made a new inbound address for texting provider " . escapeSql($row['sms_provider_name']), 0, intval($row['sms_provider_id'])); + flashAlert('New address made - paste it into ' . escapeHtml($row['sms_provider_name']) . '\'s portal now, or texts to the number won\'t reach ITFlow', 'warning'); + redirect(); + +} + +// Delete a provider - the texts sent and received stay in the log and on their tickets +if (isset($_GET['delete_sms_provider'])) { + + validateCSRFToken(); + + $row = smsProviderRow($_GET['delete_sms_provider']); + if (!$row) { + flashAlert('That texting provider no longer exists.', 'error'); + redirect('text_messaging.php'); + } + $provider_id = intval($row['sms_provider_id']); + mysqli_query($mysqli, "DELETE FROM sms_providers WHERE sms_provider_id = $provider_id"); + // Texts waiting to go have nothing to go through now + mysqli_query($mysqli, "UPDATE sms_messages SET sms_message_status = 'cancelled', sms_message_error = 'Its texting provider was deleted' WHERE sms_message_status = 'queued'"); + logAudit("Text Message", "Delete", "$session_name deleted texting provider " . escapeSql($row['sms_provider_name'] . ', which texted from ' . smsNumberText($row['sms_provider_number'])), 0, $provider_id); + flashAlert('' . escapeHtml($row['sms_provider_name']) . ' deleted - nothing more is texted, and texts to the number no longer reach ITFlow', 'error'); + redirect('text_messaging.php'); + +} + +// Send a test text - to a number of your own, for real +if (isset($_POST['send_sms_test'])) { + + validateCSRFToken(); + + $row = smsProviderRow($_POST['provider_id'] ?? 0); + if (!$row || !intval($row['sms_provider_active'])) { + flashAlert('Turn the texting provider on first.', 'error'); + redirect(); + } + $number = smsNumber((string) ($_POST['number'] ?? '')); + $text = trim((string) ($_POST['text'] ?? '')); + if ($number === '') { + flashAlert('That isn\'t a number a text can go to - with its dial code, like +1 412 555 0100.', 'error'); + redirect(); + } + if ($text === '') { + $text = 'A test text from ITFlow.'; + } + $queued = smsQueue($number, $text, ['purpose' => 'test', 'user_id' => intval($session_user_id)]); + $sent = $queued['ids'] ? smsSendNow($queued['ids']) : ['sent' => 0, 'error' => $queued['error']]; + $to = escapeHtml(smsNumberText($number)); + if ($sent['sent'] && $sent['error'] === '') { + logAudit("Text Message", "Send", "$session_name sent a test text to " . escapeSql(smsNumberText($number)), 0, intval($row['sms_provider_id'])); + flashAlert("Test text sent to $to - text it back to see the reply come into Texts"); + } else { + $error = $sent['error'] !== '' ? $sent['error'] : $queued['error']; + logAudit("Text Message", "Send", "$session_name sent a test text to " . escapeSql(smsNumberText($number) . " - it didn't go: $error"), 0, intval($row['sms_provider_id'])); + flashAlert("The test text to $to didn't go - " . escapeHtml($error), 'error'); + } + redirect(); + +} + +// Put a number back - opted back in, when they asked by some other way than texting START, or unblocked +if (isset($_GET['sms_number_opt_in']) || isset($_GET['sms_number_unblock'])) { + + validateCSRFToken(); + + $opt_in = isset($_GET['sms_number_opt_in']); + $number = preg_replace('/\D/', '', (string) ($opt_in ? $_GET['sms_number_opt_in'] : $_GET['sms_number_unblock'])); + if (!smsNumberRow($number)) { + flashAlert('That number isn\'t opted out or blocked.', 'error'); + redirect(); + } + smsNumberSet($number, $opt_in ? ['opted_out_at' => null] : ['blocked_at' => null, 'blocked_by' => 0]); + $number_text = smsNumberText($number); + logAudit("Text Message", "Edit", "$session_name " . ($opt_in ? 'opted ' . escapeSql($number_text) . ' back in to texts' : 'unblocked ' . escapeSql($number_text))); + flashAlert('' . escapeHtml($number_text) . ' ' . ($opt_in ? 'can be texted again' : 'is unblocked - its texts come in as any other')); + redirect(); + +} diff --git a/admin/post/text_messages.php b/admin/post/text_messages.php new file mode 100644 index 000000000..f0598cecc --- /dev/null +++ b/admin/post/text_messages.php @@ -0,0 +1,60 @@ + Text Messages - retry a text that failed (or was cancelled), cancel one + * still waiting, delete one - one at a time or several. A retried text goes at the Text + * Messages job's next run. + */ + +defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); + +/* Do one thing to texts - how many it was done to */ +function textMessagesAct(array $ids, string $action): int +{ + global $mysqli; + $done = 0; + foreach (array_unique(array_filter(array_map('intval', $ids))) as $id) { + $row = smsMessageRow($id); + if (!$row || !smsLogCan($row, $action)) { + continue; + } + if ($action === 'retry') { + mysqli_query($mysqli, "UPDATE sms_messages SET sms_message_status = 'queued', sms_message_attempts = 0, sms_message_attempted_at = NULL, sms_message_error = NULL WHERE sms_message_id = $id"); + } elseif ($action === 'cancel') { + mysqli_query($mysqli, "UPDATE sms_messages SET sms_message_status = 'cancelled', sms_message_error = 'Cancelled' WHERE sms_message_id = $id AND sms_message_status = 'queued'"); + } else { + mysqli_query($mysqli, "DELETE FROM sms_messages WHERE sms_message_id = $id AND sms_message_status <> 'sending'"); + } + $done += mysqli_affected_rows($mysqli) > 0 ? 1 : 0; + } + return $done; +} + +foreach (['retry' => 'retry_text', 'cancel' => 'cancel_text', 'delete' => 'delete_text'] as $action => $key) { + if (isset($_GET[$key])) { + validateCSRFToken(); + $done = textMessagesAct([$_GET[$key]], $action); + if (!$done) { + flashAlert('That text can\'t be ' . ['retry' => 'retried', 'cancel' => 'cancelled', 'delete' => 'deleted'][$action] . ' - it may have gone already, or be going now.', 'error'); + redirect(); + } + logAudit("Text Message", ['retry' => 'Edit', 'cancel' => 'Edit', 'delete' => 'Delete'][$action], "$session_name " . ['retry' => 'retried', 'cancel' => 'cancelled', 'delete' => 'deleted'][$action] . " text " . intval($_GET[$key])); + flashAlert(['retry' => 'Text queued again - it goes at the next run of the Text Messages job', 'cancel' => 'Text cancelled - it won\'t be sent', 'delete' => 'Text deleted'][$action], $action === 'delete' ? 'error' : 'success'); + redirect(); + } +} + +foreach (['retry' => 'bulk_retry_texts', 'cancel' => 'bulk_cancel_texts', 'delete' => 'bulk_delete_texts'] as $action => $key) { + if (isset($_POST[$key])) { + validateCSRFToken(); + $ids = (array) ($_POST['sms_message_ids'] ?? []); + $done = textMessagesAct($ids, $action); + $verb = ['retry' => 'retried', 'cancel' => 'cancelled', 'delete' => 'deleted'][$action]; + if ($done) { + logAudit("Text Message", $action === 'delete' ? 'Delete' : 'Edit', "$session_name $verb $done text" . ($done === 1 ? '' : 's')); + } + $skipped = count(array_unique(array_filter(array_map('intval', $ids)))) - $done; + flashAlert("$done text" . ($done === 1 ? '' : 's') . " $verb" . ($skipped ? " - $skipped couldn't be" : ''), $done ? ($action === 'delete' ? 'error' : 'success') : 'warning'); + redirect(); + } +} diff --git a/admin/settings_notification.php b/admin/settings_notification.php index f9512385e..c80e2dad4 100644 --- a/admin/settings_notification.php +++ b/admin/settings_notification.php @@ -3,7 +3,8 @@ /* * Admin > Settings > Notifications - the alerts ITFlow raises for your team, * and the emails it sends clients by itself: about their tickets, and the - * invoices recurring invoices make. Payment reminders and statements are set + * invoices recurring invoices make - and the texts, to those who agreed + * (functions/sms.php). Payment reminders and statements are set * with their schedule in Invoices and billing - shown here, not set. Saved by * edit_notification_settings (admin/post/settings_notification.php). */ @@ -43,6 +44,23 @@ echo settingsPageStart('notification'); + + + +
    Texting isn't set up, so none of these go. Set up texting
    + + + 'fa-life-ring']) ?> + 'When a visit or remote work is booked on their ticket, and when it is cancelled.']) ?> + 'fa-bell']) ?> + + + 'Texted with the email, to the people it is emailed to who agreed to texts.']) ?> + + + + diff --git a/admin/settings_ticket.php b/admin/settings_ticket.php index a581bbd04..9f1576ccb 100644 --- a/admin/settings_ticket.php +++ b/admin/settings_ticket.php @@ -2,7 +2,8 @@ /* * Admin > Settings > Tickets - how tickets are numbered, made from email - * (cron/ticket_email_parser.php, reading the mailbox in Mail > Receiving), + * (cron/ticket_email_parser.php, reading the mailbox in Mail > Receiving) and + * from texts (functions/sms.php, once texting is set up in Text Messaging), * timed and billed, who hears about new ones, when resolved ones close, and * how the tickets page opens, and whether AI triages new tickets * (functions/ai_ticket.php). Saved by edit_ticket_settings @@ -35,6 +36,20 @@ echo settingsPageStart('ticket'); + + Text Messaging.') ?> + +
    Texting isn't set up yet, so no texts come in.
    + + 'Off, every text waits in Texts for an agent - STOP, START and HELP are still answered.']) ?> +
    + 'From a number that isn\'t a contact\'s, as a ticket for no client - otherwise those wait in Texts, where an agent opens a ticket from one. Codes and spam wait there either way.']) ?> + 'The first text of a new ticket is answered with its number, so they know it landed and that replying adds to it.']) ?> +
    + + + 'fa-bell', 'type' => 'email', 'maxlength' => 200, 'placeholder' => 'support@company.com', 'help' => 'A shared mailbox or list works best. Empty, nobody is emailed.']) ?> diff --git a/admin/text_messages.php b/admin/text_messages.php new file mode 100644 index 000000000..27c3d800c --- /dev/null +++ b/admin/text_messages.php @@ -0,0 +1,266 @@ + Text Messages - every text ITFlow sent and received (functions/sms.php), and + * what came of it: waiting, sent or failed going out; on a ticket, in Texts (unmatched, a + * code, spam) or a keyword coming in. Verification codes are masked here - Texts > Codes + * reveals them, logged. A text can be retried, cancelled or deleted, one at a time or several + * (admin/post/text_messages.php). + */ + +// Default Column Sortby Filter +$sort = "sms_message_created_at"; +$order = "DESC"; + +require_once "includes/inc_all_admin.php"; + +$page_title = 'Text Messages'; + +try { + mysqli_query($mysqli, "SELECT 1 FROM sms_messages LIMIT 1"); +} catch (Throwable $e) { ?> +
    Text messaging arrives with a database update - run it in Maintenance > Update first.
    + "sms_message_created_at $order", + 'sms_message_number' => "sms_message_number $order, sms_message_created_at DESC", + 'sms_message_status' => "sms_message_status $order, sms_message_created_at DESC", +]; +if (!isset($sortable_columns[$sort])) { + $sort = 'sms_message_created_at'; +} + +$search = "(sms_message_number LIKE '%$phone_query%' OR (sms_message_status <> 'code' AND sms_message_body LIKE '%$q%') OR sms_message_error LIKE '%$q%' OR contact_name LIKE '%$q%' OR client_name LIKE '%$q%' + OR CONCAT(ticket_prefix, ticket_number) LIKE '%$q%') + AND DATE(sms_message_created_at) BETWEEN '$dtf' AND '$dtt'"; +$joins = "LEFT JOIN contacts ON contact_id = sms_message_contact_id AND sms_message_contact_id > 0 + LEFT JOIN clients ON client_id = sms_message_client_id AND sms_message_client_id > 0 + LEFT JOIN tickets ON ticket_id = sms_message_ticket_id AND sms_message_ticket_id > 0 + LEFT JOIN users ON user_id = sms_message_user_id AND sms_message_user_id > 0"; + +$sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS sms_messages.*, contact_name, client_name, ticket_prefix, ticket_number, ticket_client_id, user_name + FROM sms_messages $joins + WHERE $search AND {$tabs[$show][2]} + ORDER BY {$sortable_columns[$sort]}, sms_message_id DESC + LIMIT $record_from, $record_to"); + +$num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); + +// How many in each tab, as searched +$count_sql = []; +foreach ($tabs as $key => [, , $where]) { + $count_sql[] = "COALESCE(SUM($where), 0)"; +} +$counts = array_combine(array_keys($tabs), array_map('intval', mysqli_fetch_row(mysqli_query($mysqli, "SELECT " . implode(', ', $count_sql) . " FROM sms_messages $joins WHERE $search")))); + +$sort_link = function ($column, $label) use ($url_query_strings_sort, $sort, $disp, $order_icon) { + return '' + . $label . ($sort === $column ? " $order_icon" : '') . ''; +}; +$pill_url = function ($show) { + return '?' . http_build_query(array_filter(['q' => $_GET['q'] ?? '', 'show' => $show, 'canned_date' => $_GET['canned_date'] ?? '', 'dtf' => $_GET['dtf'] ?? '', 'dtt' => $_GET['dtt'] ?? ''])); +}; +$csrf = $_SESSION['csrf_token']; +$filtered_dates = isset($_GET['dtf']) && $_GET['dtf'] !== '' && $_GET['dtf'] !== '1970-01-01'; +$ready = smsReady(); + +?> + +
    +
    +

    Text Messages

    +
    + Text Messaging +
    +
    + + +
    + +
    Texting isn't on - nothing goes out, and texts to your number aren't taken in.
    + Text Messaging +
    + + +
    +
    + +
    +
    +
    + + + +
    +
    +
    +
    + +
    +
    +
    +
    +
    +
    + +
    + + +
    + + + +
    +
    +
    +
    + +
    + +
    + +
    + + "> + + + + + + + + + + + + + + + + + + + + + +
    +
    + +
    +     		Text
    + +
    + +
    + +     		+ + +
    + +     		+
    + +
    + +
    + + +
    + + +
    +
    +     		+
    + +
    photo or file
    + + +
    By
    + +
    + +     		+ +
    # 1 ? ' · tried ' . intval($row['sms_message_attempts']) . ' times' : '' ?>
    +     		+ +
    + +
    + + Retry + + + Cancel + + +
    + Delete + +
    +
    + +
    +
    +
    + + 'texts', + 'icon' => 'fa-sms', + 'title' => $show !== '' ? 'Nothing ' . strtolower($tabs[$show][0]) : 'No texts yet', + 'text' => 'Every text ITFlow sends and receives is kept here for a year - spam and dismissed texts for ' . SMS_SPAM_KEEP_DAYS . ' days, and a verification code\'s words for a day.', + ]; + ?> + +
    + + + + Text Messaging - the texting service ITFlow texts through (functions/sms.php), one + * number for every client. Each row says whether it is on, the number, the address its texts + * come back to (pasted into the service's portal), and its texts in the last 30 days. Send a + * test text tries it; Opted out and blocked lists the numbers that replied STOP or were + * marked spam. Add and Edit are one window (modals/sms_provider/sms_provider_edit.php); the + * rest are admin/post/sms_provider.php. + */ + +// Default Column Sortby Filter +$sort = "sms_provider_name"; +$order = "ASC"; + +require_once "includes/inc_all_admin.php"; + +// The tables arrive with the 3.6.0 database update +try { + mysqli_query($mysqli, "SELECT 1 FROM sms_providers LIMIT 1"); +} catch (Throwable $e) { ?> +
    Text messaging arrives with a database update - run it in Maintenance > Update first.
    + "sms_provider_name $order", + 'sms_provider_number' => "sms_provider_number $order, sms_provider_name ASC", + 'sms_provider_last_inbound_at' => "sms_provider_last_inbound_at IS NULL, sms_provider_last_inbound_at $order, sms_provider_name ASC", +]; +if (!isset($sortable_columns[$sort])) { + $sort = 'sms_provider_name'; +} + +$sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS * FROM sms_providers + WHERE (sms_provider_name LIKE '%$q%' OR sms_provider_description LIKE '%$q%' OR sms_provider_number LIKE '%$phone_query%') + ORDER BY {$sortable_columns[$sort]}, sms_provider_id ASC + LIMIT $record_from, $record_to"); + +$num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); + +$set_up = intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(DISTINCT sms_provider_name) FROM sms_providers"))[0]); +$can_add = $set_up < count(smsProviderKinds()); +$activity = smsProviderActivity(); +$numbers = mysqli_fetch_row(mysqli_query($mysqli, "SELECT COALESCE(SUM(sms_number_opted_out_at IS NOT NULL), 0), COALESCE(SUM(sms_number_blocked_at IS NOT NULL), 0) FROM sms_numbers")); +$opted_out = intval($numbers[0]); +$blocked = intval($numbers[1]); + +$sort_link = function ($column, $label) use ($url_query_strings_sort, $sort, $disp, $order_icon) { + return '' + . $label . ($sort === $column ? " $order_icon" : '') . ''; +}; + +$add_url = 'modals/sms_provider/sms_provider_add.php'; +$csrf = $_SESSION['csrf_token']; + +?> + +
    +
    +

    Text Messaging

    +
    + + Opted out and blocked + + Text Messages + + + +
    +
    +
    +
    +
    +
    +
    + + +
    +
    +
    + In the last 30 days: sent, failed, received +
    +
    +
    +
    +
    + + "> + + + + + + + + + + + + + + + + + + + +
    Texts come back to
    +
    + +
    + + + Off + + +
    + + +
    +
    +
    +     		+
    + + +
    +
    In 's portal: the number > SMS > Callback URL, by POST.
    +     		+ + + + None yet - text the number to try it + + +
    + +
    + + Edit + + + + Send a test text + + + + New inbound address + + + + Turn off + + + + Turn on + + +
    + + Delete + +
    +
    +
    +
    + 'texting providers', + 'icon' => 'fa-sms', + 'text' => 'Set up Skyetel and your agents can reply to tickets by text, texts from your clients open tickets, and verification codes texted to your number land in Texts.', + 'actions' => $can_add ? [['label' => 'Add Provider', 'modal' => $add_url]] : [], + ]; + ?> + +
    + + Codes - one verification code revealed, while it is fresh (functions/sms.php). + * Asked each time, by POST, so every reveal is in the audit log. + */ +if (isset($_GET['sms_reveal_code'])) { + enforceUserPermission('module_credential'); + validateCSRFToken(); + + header('Content-Type: application/json'); + + $row = smsMessageRow($_POST['id'] ?? 0); + if (!$row || $row['sms_message_status'] !== 'code' || $row['sms_message_direction'] !== 'in') { + echo json_encode(['error' => 'That code is gone.']); + exit; + } + if (!hasClientAccess($row['sms_message_client_id'])) { + echo json_encode(['error' => 'That code is gone.']); + exit; + } + if (!smsCodeFresh($row)) { + echo json_encode(['error' => 'It came more than ' . SMS_CODE_MASK_MINUTES . ' minutes ago - ask for a new one.']); + exit; + } + $sender = smsNumberLabel($row['sms_message_number']); + $sender = $sender !== '' ? "$sender (" . smsNumberText($row['sms_message_number']) . ')' : smsNumberText($row['sms_message_number']); + logAudit('Text Message', 'View', "$session_name revealed a verification code texted by " . escapeSql($sender), 0, intval($row['sms_message_id'])); + + echo json_encode(['code' => (string) $row['sms_message_code'], 'body' => (string) $row['sms_message_body']]); + exit; +} + +/* Texts > Codes - the newest code's id, so the page can come again when another lands */ +if (isset($_GET['sms_latest_code'])) { + enforceUserPermission('module_credential'); + + header('Content-Type: application/json'); + + $latest = 0; + try { + $latest = intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COALESCE(MAX(sms_message_id), 0) FROM sms_messages WHERE sms_message_direction = 'in' AND sms_message_status = 'code'"))[0]); + } catch (Throwable $e) { + // Before the 3.6.0 database update + } + echo json_encode(['latest' => $latest]); + exit; +} + if (isset($_GET['get_credential_via_id'])) { enforceUserPermission('module_credential'); diff --git a/agent/contact.php b/agent/contact.php index 981466062..41ad6596a 100644 --- a/agent/contact.php +++ b/agent/contact.php @@ -432,6 +432,33 @@ if (!$can_support) { + +
    Texts
    +
    + + Replied STOP +
    Nothing is texted to them until they text START to your number.
    + + About their tickets, visits and invoices +
    Agreed
    + + No mobile number + + Not asked yet + +
    Asked by text - a YES turns them on
    + + +
    Ask them by text
    + + +
    +
    Added
    diff --git a/agent/includes/side_nav.php b/agent/includes/side_nav.php index 6ba27e48c..3e4a9fb66 100644 --- a/agent/includes/side_nav.php +++ b/agent/includes/side_nav.php @@ -101,6 +101,20 @@

    • + +
  • + "> + +

    + Texts + + + + +

    +     +
    • +
  • "> diff --git a/agent/modals/contact/contact_form.php b/agent/modals/contact/contact_form.php index b398b842d..01732720d 100644 --- a/agent/modals/contact/contact_form.php +++ b/agent/modals/contact/contact_form.php @@ -6,8 +6,8 @@ * including this. Posts the field set agent/post/contact_model.php reads. * * Tabs like the other add / edit modals: Details (who and how to reach them), - * Roles (primary, important, billing, technical), Access (PIN and the client - * portal) and Notes (photo, notes, tags). + * Roles (primary, important, billing, technical, and texts once texting is set + * up), Access (PIN and the client portal) and Notes (photo, notes, tags). * * Should not be accessed directly. */ @@ -31,6 +31,9 @@ if ($client_id) { } } +// Texts about their work - once texting is set up (functions/sms.php) +$contact_texts = smsContactTextState($contact_form_mode === 'edit' ? intval($contact_id) : 0); + // The roles, with what each one does $contact_roles = [ 'contact_important' => ['label' => 'Important', 'icon' => 'fa-star', 'value' => $contact_important, 'help' => 'Pinned to the top of the contacts list.'], @@ -179,6 +182,24 @@ $contact_roles = [ + + + + diff --git a/agent/modals/sms/sms_label.php b/agent/modals/sms/sms_label.php new file mode 100644 index 000000000..7e794f3c7 --- /dev/null +++ b/agent/modals/sms/sms_label.php @@ -0,0 +1,41 @@ + 'That text is gone.']); + exit; +} +$number = (string) $row['sms_message_number']; + +ob_start(); + +?> +
    +
    Name
    + +
    +
    + + +
    + +
    + + +
    +
    Shown in Texts and the text log. Empty to take the name off.
    +
    +
    + + +
    +
    + diff --git a/agent/modals/sms/sms_ticket_open.php b/agent/modals/sms/sms_ticket_open.php new file mode 100644 index 000000000..e5129cb21 --- /dev/null +++ b/agent/modals/sms/sms_ticket_open.php @@ -0,0 +1,106 @@ + Unmatched - Open ticket: a ticket from a text from a number that isn't a contact's, + * for the client and contact picked (or no client). Every unmatched text from the number in + * the last SMS_CONVERSATION_DAYS days goes on it, and what the number texts next goes on it + * too. The number can be saved as the contact's mobile, so their next text finds them + * (sms_open_ticket, agent/post/texts.php). + */ + +require_once '../../../includes/modal_header.php'; + +enforceUserPermission('module_support', 2); + +$row = smsMessageRow($_GET['id'] ?? 0); +if (!$row || $row['sms_message_direction'] !== 'in' || $row['sms_message_status'] !== 'unmatched' || !hasClientAccess($row['sms_message_client_id'])) { + echo json_encode(['error' => 'That text isn\'t waiting in Unmatched any more - someone may have opened a ticket from it.']); + exit; +} +$number = (string) $row['sms_message_number']; +$texts = mysqli_fetch_all(mysqli_query($mysqli, "SELECT sms_message_id, sms_message_body, sms_message_media, sms_message_created_at FROM sms_messages + WHERE sms_message_direction = 'in' AND sms_message_status = 'unmatched' AND sms_message_number = '" . escapeSql($number) . "' + AND sms_message_created_at > NOW() - INTERVAL " . SMS_CONVERSATION_DAYS . " DAY ORDER BY sms_message_id ASC LIMIT 20"), MYSQLI_ASSOC); +$first_line = trim(strtok((string) ($texts[0]['sms_message_body'] ?? $row['sms_message_body']), "\n") ?: ''); +$subject = $first_line !== '' ? mb_strimwidth($first_line, 0, 80, '...') : 'Text from ' . smsNumberText($number); +$client_id = intval($row['sms_message_client_id']); + +ob_start(); + +?> +
    +
    Open a ticket from
    + +
    +
    + + + +
    + +
    + +
    +
    ' . count($media) : '' ?>
    +
    +
    + +
    + 1) { ?> +

    All go on the ticket, and what this number texts next goes on it too.

    + + +
    + +
    + + +
    +
    + +
    + +
    + + +
    +
    + + +
    +
    + +
    + +
    + + +
    +
    + +
    + + +
    +
    + +
    + + +
    +
    + + + + diff --git a/agent/post/contact.php b/agent/post/contact.php index d87dbc735..e6c43528c 100644 --- a/agent/post/contact.php +++ b/agent/post/contact.php @@ -46,6 +46,9 @@ if (isset($_POST['add_contact'])) { $contact_id = mysqli_insert_id($mysqli); + // Texts - whether they agreed to texts about their work (functions/sms.php) + smsContactOptInFromForm($contact_id, $_POST, $client_id); + // Tags - contact tags only, and an admin can type a new one in (functions/tags.php) tagSetForRecord('contact', $contact_id, (array) ($_POST['tags'] ?? [])); @@ -152,6 +155,9 @@ if (isset($_POST['edit_contact'])) { mysqli_query($mysqli,"UPDATE contacts SET contact_name = '$name', contact_title = '$title', contact_phone_country_code = '$phone_country_code', contact_phone = '$phone', contact_extension = '$extension', contact_mobile_country_code = '$mobile_country_code', contact_mobile = '$mobile', contact_email = '$email', contact_pin = '$pin', contact_notes = '$notes', contact_important = $contact_important, contact_billing = $contact_billing, contact_technical = $contact_technical, contact_department = '$department', contact_location_id = $location_id, contact_user_id = $contact_user_id WHERE contact_id = $contact_id"); + // Texts - whether they agreed to texts about their work (functions/sms.php) + smsContactOptInFromForm($contact_id, $_POST, $client_id); + // Upload Photo - replacing the old one, if there was one $old_photo_path = $existing_file_name !== '' ? "../uploads/clients/$client_id/$existing_file_name" : ''; if (!empty($_FILES['file']['tmp_name'])) { diff --git a/agent/post/invoice.php b/agent/post/invoice.php index 86d41b57c..c6fae4593 100644 --- a/agent/post/invoice.php +++ b/agent/post/invoice.php @@ -411,10 +411,12 @@ if (isset($_POST['email_invoice'])) { } $sent = billingEmailQueue($recipients, $subject, $email, ['attach' => $attach]); $reminder = $kind === 'reminder' && $email['kind'] === 'Payment reminder'; + // Texted with its link too, to those of them who agreed to texts (functions/sms.php) + $texted = smsInvoiceNotify($invoice, $reminder ? 'reminder' : 'invoice', $recipients); $by = stripslashes($session_name); billingLog('invoice', $invoice_id, $invoice['invoice_status'] === 'Draft' ? 'Sent' : $invoice['invoice_status'], - ($reminder ? 'Reminder emailed' : 'Invoice emailed') . " by $by to " . implode(', ', $sent) . ($attach ? ' with the PDF' : '')); + ($reminder ? 'Reminder emailed' : 'Invoice emailed') . " by $by to " . implode(', ', $sent) . ($attach ? ' with the PDF' : '') . ($texted ? ' - and texted to ' . implode(', ', $texted) : '')); foreach ($recipients as $recipient) { logAudit("Invoice", "Email", "$session_name emailed " . escapeSql($recipient['email']) . ($reminder ? " a reminder for" : "") . " invoice " . escapeSql($number), $client_id, $invoice_id); } @@ -424,7 +426,7 @@ if (isset($_POST['email_invoice'])) { mysqli_query($mysqli, "UPDATE invoices SET invoice_status = 'Sent' WHERE invoice_id = $invoice_id"); } - flashAlert(($reminder ? 'Reminder' : 'Invoice') . " queued to " . count($sent) . " " . (count($sent) === 1 ? "recipient" : "recipients")); + flashAlert(($reminder ? 'Reminder' : 'Invoice') . " queued to " . count($sent) . " " . (count($sent) === 1 ? "recipient" : "recipients") . ($texted ? ' - and texted to ' . count($texted) : '')); redirect(); diff --git a/agent/post/texts.php b/agent/post/texts.php new file mode 100644 index 000000000..df10cd53b --- /dev/null +++ b/agent/post/texts.php @@ -0,0 +1,200 @@ + NOW() - INTERVAL " . SMS_CONVERSATION_DAYS . " DAY ORDER BY sms_message_id ASC LIMIT 20"), MYSQLI_ASSOC); + $ids = array_map('intval', array_column($texts, 'sms_message_id')); + if (!in_array(intval($row['sms_message_id']), $ids, true)) { + $ids[] = intval($row['sms_message_id']); + $texts[] = $row; + } + $words = []; + $media = []; + foreach ($texts as $text) { + if (trim((string) $text['sms_message_body']) !== '') { + $words[] = count($texts) > 1 ? date('M j, g:i A', strtotime($text['sms_message_created_at'])) . ":\n" . $text['sms_message_body'] : (string) $text['sms_message_body']; + } + $media = array_merge($media, $text['sms_message_media'] ? (json_decode($text['sms_message_media'], true) ?: []) : []); + } + + $ticket_id = smsTicketOpen(intval($row['sms_message_id']), $number, implode("\n\n", $words), array_slice($media, 0, SMS_MEDIA_MAX_FILES), $contact_id, $client_id, $subject, intval($session_user_id), $ids); + mysqli_query($mysqli, "UPDATE sms_messages SET sms_message_status = 'ticket', sms_message_handled_at = NOW(), sms_message_handled_by = " . intval($session_user_id) . " WHERE sms_message_id IN (" . implode(',', $ids) . ")"); + + if (!empty($_POST['assign_me'])) { + mysqli_query($mysqli, "UPDATE tickets SET ticket_assigned_to = " . intval($session_user_id) . ", ticket_status = 2 WHERE ticket_id = $ticket_id"); + } + + // Their next text finds them - when they have no mobile yet + $saved = ''; + if ($contact && !empty($_POST['save_number']) && trim((string) $contact['contact_mobile']) === '' && smsNumberIsPhone($number)) { + [$cc, $national] = smsNumberParts($number); + mysqli_query($mysqli, "UPDATE contacts SET contact_mobile = '" . escapeSql($national) . "', contact_mobile_country_code = '" . escapeSql($cc) . "' WHERE contact_id = $contact_id"); + $saved = ' - ' . smsNumberText($number) . ' saved as ' . $contact['contact_name'] . '\'s mobile'; + } + + $reference = ticketReference(ticketRow($ticket_id)); + logAudit("Text Message", "Edit", "$session_name opened ticket " . escapeSql($reference) . " from " . count($ids) . " text" . (count($ids) === 1 ? '' : 's') . " from " . escapeSql(smsNumberText($number) . $saved), $client_id, $ticket_id); + flashAlert("Ticket " . escapeHtml($reference) . " opened from the text" . (count($ids) === 1 ? '' : 's') . escapeHtml($saved) . " - Text reply on it texts them back"); + redirect('/agent/' . ticketUrl($ticket_id, $client_id)); + +} + +// Ask a contact by text whether texts about their work are all right - a YES turns them on +if (isset($_GET['sms_ask_opt_in'])) { + + validateCSRFToken(); + enforceUserPermission('module_client', 2); + + $contact_id = intval($_GET['sms_ask_opt_in']); + $contact = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id")); + if (!$contact || !hasClientAccess($contact['contact_client_id'])) { + flashAlert('That contact no longer exists.', 'error'); + redirect(); + } + $asked = smsOptInAsk($contact_id, intval($session_user_id)); + if (!$asked['ok']) { + flashAlert('Not asked - ' . escapeHtml($asked['error']), 'error'); + redirect(); + } + logAudit("Contact", "Edit", "$session_name asked " . escapeSql($contact['contact_name']) . " by text whether texts are all right", intval($contact['contact_client_id']), $contact_id); + flashAlert('' . escapeHtml($contact['contact_name']) . ' asked by text - a YES turns texts on for them'); + redirect(); + +} + +if (isset($_GET['sms_dismiss'])) { + + validateCSRFToken(); + enforceUserPermission('module_support', 2); + + $row = textsForRequest($_GET['sms_dismiss'], ['unmatched']); + mysqli_query($mysqli, "UPDATE sms_messages SET sms_message_status = 'dismissed', sms_message_handled_at = NOW(), sms_message_handled_by = " . intval($session_user_id) . " WHERE sms_message_id = " . intval($row['sms_message_id'])); + logAudit("Text Message", "Edit", "$session_name dismissed a text from " . escapeSql(smsNumberText($row['sms_message_number'])), intval($row['sms_message_client_id'])); + flashAlert('Text dismissed - it stays in the text log for ' . SMS_SPAM_KEEP_DAYS . ' days'); + redirect(); + +} + +if (isset($_GET['sms_mark_spam'])) { + + validateCSRFToken(); + enforceUserPermission('module_support', 2); + + $row = textsForRequest($_GET['sms_mark_spam'], ['unmatched']); + $number = (string) $row['sms_message_number']; + smsNumberSet($number, ['blocked_at' => 'NOW()', 'blocked_by' => intval($session_user_id)]); + mysqli_query($mysqli, "UPDATE sms_messages SET sms_message_status = 'spam', sms_message_handled_at = NOW(), sms_message_handled_by = " . intval($session_user_id) . " + WHERE sms_message_direction = 'in' AND sms_message_number = '" . escapeSql($number) . "' AND sms_message_status IN ('unmatched', 'dismissed')"); + logAudit("Text Message", "Edit", "$session_name marked texts from " . escapeSql(smsNumberText($number)) . " as spam and blocked the number"); + flashAlert('' . escapeHtml(smsNumberText($number)) . ' blocked - what it sends goes straight to Spam'); + redirect(); + +} + +if (isset($_GET['sms_not_spam'])) { + + validateCSRFToken(); + enforceUserPermission('module_support', 2); + + $row = textsForRequest($_GET['sms_not_spam'], ['spam']); + $number = (string) $row['sms_message_number']; + smsNumberSet($number, ['blocked_at' => null, 'blocked_by' => 0]); + mysqli_query($mysqli, "UPDATE sms_messages SET sms_message_status = 'unmatched', sms_message_handled_at = NULL, sms_message_handled_by = 0 + WHERE sms_message_direction = 'in' AND sms_message_number = '" . escapeSql($number) . "' AND sms_message_status = 'spam'"); + logAudit("Text Message", "Edit", "$session_name said texts from " . escapeSql(smsNumberText($number) . " aren't spam") . " and unblocked the number"); + flashAlert('' . escapeHtml(smsNumberText($number)) . ' isn\'t spam - its texts are in Unmatched'); + redirect('texts.php?show=unmatched'); + +} + +if (isset($_GET['sms_delete'])) { + + validateCSRFToken(); + enforceUserPermission('module_support', 2); + + $row = textsForRequest($_GET['sms_delete'], ['spam']); + mysqli_query($mysqli, "DELETE FROM sms_messages WHERE sms_message_id = " . intval($row['sms_message_id'])); + flashAlert('Text deleted', 'error'); + redirect(); + +} + +if (isset($_GET['sms_not_code'])) { + + validateCSRFToken(); + enforceUserPermission('module_credential', 2); + + $row = textsForRequest($_GET['sms_not_code'], ['code']); + if ($row['sms_message_body'] === null) { + flashAlert('Its words were wiped a day after it came.', 'error'); + redirect(); + } + mysqli_query($mysqli, "UPDATE sms_messages SET sms_message_status = 'unmatched', sms_message_code = NULL WHERE sms_message_id = " . intval($row['sms_message_id'])); + logAudit("Text Message", "Edit", "$session_name said a text from " . escapeSql(smsNumberText($row['sms_message_number']) . " isn't a code") . ", and moved it to Unmatched"); + flashAlert('Moved to Unmatched'); + redirect(); + +} + +if (isset($_POST['sms_label_number'])) { + + validateCSRFToken(); + + $row = smsMessageRow($_POST['id'] ?? 0); + $code = $row && $row['sms_message_status'] === 'code'; + if (!$row || $row['sms_message_direction'] !== 'in') { + flashAlert('That text is gone.', 'error'); + redirect('texts.php'); + } + enforceUserPermission($code ? 'module_credential' : 'module_support', $code ? 1 : 2); + + $number = (string) $row['sms_message_number']; + $label = mb_substr(trim((string) ($_POST['label'] ?? '')), 0, 100); + smsNumberSet($number, ['label' => $label !== '' ? $label : null]); + logAudit("Text Message", "Edit", "$session_name " . ($label !== '' ? "named " . escapeSql(smsNumberText($number)) . " " . escapeSql($label) : "took the name off " . escapeSql(smsNumberText($number)))); + flashAlert($label !== '' ? '' . escapeHtml(smsNumberText($number)) . ' is ' . escapeHtml($label) . ' now' : 'Name taken off'); + redirect(); + +} diff --git a/agent/post/ticket.php b/agent/post/ticket.php index 90747482b..31ed25972 100644 --- a/agent/post/ticket.php +++ b/agent/post/ticket.php @@ -1078,13 +1078,16 @@ if (isset($_POST['add_ticket_reply'])) { // Time tracking, inputs & combine into string $ticket_reply_time_worked = escapeSql(sprintf("%02d:%02d:%02d", max(0, intval($_POST['hours'] ?? 0)), max(0, min(59, intval($_POST['minutes'] ?? 0))), max(0, min(59, intval($_POST['seconds'] ?? 0))))); - // Who sees it: internal note, public note, or public and emailed + // Who sees it: internal note, public note, or public and emailed - or texted (functions/sms.php) $send_email = 0; + $send_text = 0; $ticket_reply_id = 0; $public_reply_type = intval($_POST['public_reply_type'] ?? 0); $ticket_reply_type = $public_reply_type ? 'Public' : 'Internal'; if ($public_reply_type === 2) { $send_email = 1; + } elseif ($public_reply_type === 3) { + $send_text = 1; } // Its @mentions put right - each one an agent who can open the ticket, in an internal note only (functions/ticket_mention.php) [$ticket_reply, $mentioned] = ticketMentionsFromHtml($ticket_reply, $row['ticket_client_id'], $ticket_reply_type === 'Internal'); @@ -1141,10 +1144,17 @@ if (isset($_POST['add_ticket_reply'])) { // The reply as saved - with the signature - read back $emailed_to = ticketMailReply($ticket_id, (string) getFieldById('ticket_replies', $ticket_reply_id, 'ticket_reply'), stripslashes($session_name), $ticket_status === TICKET_STATUS_RESOLVED, $emailable_attachments['send'], $ticket_reply_id); + // And a text saying so, to a contact who agreed to texts - when Texts to clients says each reply (functions/sms.php) + if ($emailed_to) { + smsTicketReplyNotify($row); + } } else { ticketReplyEmailed($ticket_reply_id, false); } + // Text it to the contact's mobile, or the number texting on the ticket - as it reads, without the formatting + $texted = $send_text ? smsTicketReplySend($row, $ticket_reply_id, $ticket_reply_html, intval($session_user_id)) : null; + // Tell the agent it is assigned to, and whoever opened it - unless it mentions them, which told them already if (!isset($told[intval($row['ticket_assigned_to'])])) { ticketNotifyAgent($row['ticket_assigned_to'], $row, "$session_name updated Ticket " . ticketReference($row) . " - Subject: " . $row['ticket_subject'] . " that is assigned to you"); @@ -1163,6 +1173,14 @@ if (isset($_POST['add_ticket_reply'])) { $reference_html = "" . escapeHtml(ticketReference($row)) . ""; if ($ticket_reply_type === 'Internal') { flashAlert("Internal note added to ticket $reference_html" . ($told ? " - " . escapeHtml(ticketMentionNames($told)) . " " . (count($told) === 1 ? 'was' : 'were') . " told" : '')); + } elseif ($texted) { + if ($texted['ok']) { + flashAlert("Reply added to ticket $reference_html and texted to " . escapeHtml($texted['to']) . ""); + } elseif ($texted['queued']) { + flashAlert("Reply added to ticket $reference_html - the text to " . escapeHtml($texted['to']) . " is waiting to go: " . escapeHtml($texted['error']), 'warning'); + } else { + flashAlert("Reply added to ticket $reference_html but not texted - " . escapeHtml($texted['error']), 'error'); + } } elseif (!$send_email) { flashAlert("Public note added to ticket $reference_html - not emailed"); } elseif ($emailed_to) { @@ -1199,7 +1217,7 @@ if (isset($_POST['add_ticket_reply'])) { logTicketHistory($ticket_id, "$session_name set the status to " . escapeSql(getTicketStatusName($ticket_status))); } - logAudit("Ticket", "Reply", "$session_name replied to ticket $reference - $subject and was a $ticket_reply_type reply", $client_id, $ticket_id); + logAudit("Ticket", "Reply", "$session_name replied to ticket $reference - $subject and was a $ticket_reply_type reply" . (!empty($texted['ok']) ? ', texted' : ''), $client_id, $ticket_id); redirect(); diff --git a/agent/reports/ticket_summary.php b/agent/reports/ticket_summary.php index d5e826f3f..498103f1c 100644 --- a/agent/reports/ticket_summary.php +++ b/agent/reports/ticket_summary.php @@ -51,7 +51,7 @@ $breakdown = function ($column) use ($filter, $opened_in) { } return $rows; }; -$sources = $breakdown("CASE WHEN ticket_source IN ('Email', 'Portal', 'Agent', 'API', 'Recurring', 'Project') THEN ticket_source WHEN ticket_source LIKE '%Recurring%' THEN 'Recurring' ELSE COALESCE(NULLIF(ticket_source, ''), 'Agent') END"); +$sources = $breakdown("CASE WHEN ticket_source IN ('Email', 'Portal', 'Text', 'Agent', 'API', 'Recurring', 'Project') THEN ticket_source WHEN ticket_source LIKE '%Recurring%' THEN 'Recurring' ELSE COALESCE(NULLIF(ticket_source, ''), 'Agent') END"); $priorities = $breakdown('ticket_priority'); // By category: opened, resolved, how long, how much time @@ -157,7 +157,7 @@ if (reportExporting()) { require_once "includes/inc_report_layout.php"; $ticket_list = '/agent/tickets.php?' . http_build_query(array_filter(['client_id' => $client_id ?: null, 'assigned' => $agent_id ?: null])); -$source_icons = ['Email' => 'envelope', 'Portal' => 'globe', 'Agent' => 'headset', 'API' => 'plug', 'Recurring' => 'redo-alt', 'Project' => 'project-diagram']; +$source_icons = ['Email' => 'envelope', 'Portal' => 'globe', 'Text' => 'sms', 'Agent' => 'headset', 'API' => 'plug', 'Recurring' => 'redo-alt', 'Project' => 'project-diagram']; $priority_tones = ['Urgent' => 'dark', 'High' => 'danger', 'Medium' => 'warning', 'Low' => 'info']; $source_rows = reportTopN(array_map(function ($k, $v) { return ['label' => $k, 'value' => $v]; }, array_keys($sources), array_values($sources)), 6); $source_colors = array_map(function ($i) { return reportPalette($i); }, array_keys($source_rows)); diff --git a/agent/texts.php b/agent/texts.php new file mode 100644 index 000000000..00d54b220 --- /dev/null +++ b/agent/texts.php @@ -0,0 +1,290 @@ + +
    +
    + + Texting isn't set up - an admin sets it up in Admin > Integrations > Text Messaging. +
    +
    + = 2; +$can_codes = lookupUserPermission('module_credential') >= 1; + +// Only these sort - an unknown column would take the page down +$sortable_columns = [ + 'sms_message_created_at' => "sms_message_created_at $order", + 'sms_message_number' => "sms_message_number $order, sms_message_created_at DESC", +]; +if (!isset($sortable_columns[$sort])) { + $sort = 'sms_message_created_at'; +} + +// A code's words aren't searched - a search that narrows to it would tell what it is +$search = "(sms_message_number LIKE '%$phone_query%' OR sms_number_label LIKE '%$q%' OR contact_name LIKE '%$q%' OR client_name LIKE '%$q%'" + . ($codes ? '' : " OR sms_message_body LIKE '%$q%'") . ")"; +$joins = "LEFT JOIN sms_numbers ON sms_number_phone = sms_message_number + LEFT JOIN contacts ON contact_id = sms_message_contact_id AND sms_message_contact_id > 0 + LEFT JOIN clients ON client_id = sms_message_client_id AND sms_message_client_id > 0"; +$scope = "sms_message_direction = 'in' " . clientScopeSql('sms_message_client_id'); + +$sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS sms_message_id, sms_message_number, sms_message_body, sms_message_media, sms_message_code, sms_message_status, + sms_message_created_at, sms_message_error, sms_number_label, contact_name, client_name + FROM sms_messages $joins + WHERE $scope AND $search AND {$tabs[$show][2]} + ORDER BY {$sortable_columns[$sort]}, sms_message_id DESC + LIMIT $record_from, $record_to"); + +$num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); + +// How many in each tab +$count_sql = []; +foreach ($tabs as $key => $tab) { + $count_sql[] = "COALESCE(SUM({$tab[2]}), 0)"; +} +$counts = array_combine(array_keys($tabs), array_map('intval', mysqli_fetch_row(mysqli_query($mysqli, "SELECT " . implode(', ', $count_sql) . " FROM sms_messages $joins WHERE $scope")))); +$latest_code = $can_codes ? intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COALESCE(MAX(sms_message_id), 0) FROM sms_messages WHERE sms_message_direction = 'in' AND sms_message_status = 'code'"))[0]) : 0; + +$sort_link = function ($column, $label) use ($url_query_strings_sort, $sort, $disp, $order_icon) { + return '    ' + . $label . ($sort === $column ? " $order_icon" : '') . ''; +}; +$csrf = $_SESSION['csrf_token']; +$provider = smsProvider(); + +?> + +
    +
    +

    Texts to

    +
    +
    +
    + +
    +
    +
    + + +
    +
    +
    + + A code can be revealed for minutes after it came - each reveal is in the audit log - and its words are wiped after a day. + + Texts from numbers that aren't a contact's. Texts from your contacts go on their tickets. + + From blocked numbers, or what looks like bait. Deleted after days. + +
    +
    +
    + +
    + +
    + + "> + + + + + + + + + + + + + + + + + + + + + +
    CodeText
    +
    + +
    + +
    + + +
    +     		+ + Wiped + + + + + + + Expired + + +
    + +
    photo or file - fetched onto the ticket if one is opened from it
    + +     		+ +
    +     		+ + + + +
    + +
    + + Dismiss + Name this number +
    + Mark as spam + + Name this sender + = 2 && $row['sms_message_body'] !== null) { ?> + Not a code + + + Not spam +
    + Delete + +
    +
    + +
    +
    + 'texts', + 'icon' => $tabs[$show][1], + 'title' => ['unmatched' => 'Nothing unmatched', 'codes' => 'No codes', 'spam' => 'No spam'][$show] ?? 'No texts', + 'text' => ['unmatched' => 'Texts from numbers that aren\'t a contact\'s wait here - texts from your contacts go on their tickets.', + 'codes' => 'Verification codes texted to ' . smsNumberText($provider['sms_provider_number']) . ' show here as they come.', + 'spam' => 'Texts from blocked numbers, and ones that look like bait, wait here for ' . SMS_SPAM_KEEP_DAYS . ' days.'][$show] ?? '', + ]; + ?> + +
    + + + + + + + + > + + + +
    replied STOP to your texts - they can't be texted until they reply START.
    +
    @@ -810,6 +823,13 @@ if (isset($_GET['ticket_id'])) { Emails <> and watcher, and shows in the portal.
    + + +
    " . escapeHtml($sms_words) . ''; + if ($ticket_reply_type == 'Public') { + $reply_badge = "Text reply"; + } + } elseif ($reply_sms && $ticket_reply_type == 'Client') { + $reply_badge .= " By text"; + if (trim((string) $reply_row['contact_name']) === '' || !intval($reply_row['ticket_reply_by'])) { + $ticket_reply_by_display = escapeHtml(smsNumberText($reply_sms['number'])); + $reply_contact_avatar = ''; + } + } + ?> @@ -1001,6 +1038,9 @@ if (isset($_GET['ticket_id'])) { · + + · + @@ -1903,7 +1943,35 @@ if (!empty($can_edit_ticket) && !empty($ticket_is_open)) { ?> // Who will see it and what the button does, for whichever type is picked const replyAudience = document.getElementById('replyAudience'); const replySubmitLabel = document.getElementById('replySubmitLabel'); - const replySubmitLabels = { '0': 'Add note', '1': 'Post note', '2': 'Send email' }; + const replySubmitLabels = { '0': 'Add note', '1': 'Post note', '2': 'Send email', '3': 'Send text' }; + + // A text reply's length, and how many texts it goes as (SMS_TEXT_LIMIT in functions/sms.php) + const smsCount = document.querySelector('[data-sms-count]'); + function countSms() { + if (!smsCount) { + return; + } + const editor = window.tinymce ? tinymce.get('ticket_reply') : null; + const text = (editor ? editor.getContent({ format: 'text' }) : (document.getElementById('ticket_reply') || {}).value || '').trim(); + const parts = text.length ? Math.ceil(text.length / ) : 0; + smsCount.textContent = text.length ? text.length + ' characters' + (parts > 1 ? ', as ' + parts + ' texts' : '') : ''; + } + if (smsCount) { + const hookSmsCount = function () { + const editor = window.tinymce ? tinymce.get('ticket_reply') : null; + if (editor) { + editor.on('input change keyup SetContent', countSms); + } else { + const textarea = document.getElementById('ticket_reply'); + if (textarea) textarea.addEventListener('input', countSms); + } + }; + if (window.tinymce && tinymce.get('ticket_reply')) { + hookSmsCount(); + } else { + window.addEventListener('load', hookSmsCount); + } + } function showReplyType(type) { if (replyAudience) { diff --git a/api/sms/skyetel.php b/api/sms/skyetel.php new file mode 100644 index 000000000..b858ad5ab --- /dev/null +++ b/api/sms/skyetel.php @@ -0,0 +1,67 @@ + Integrations > Text Messaging shows it. + * Skyetel sends JSON - {"to", "from", "text", "media": [urls]} - by POST, or by GET; both are + * taken. Without the key there is nothing here (404). What becomes of a text is smsInbound()'s + * (functions/sms.php): a reply on a ticket, a new ticket, or the Texts inbox. + */ + +require_once __DIR__ . '/../../config.php'; +require_once __DIR__ . '/../../functions.php'; +require_once __DIR__ . '/../../includes/inc_set_timezone.php'; +require_once __DIR__ . '/../../includes/load_global_settings.php'; + +header('Content-Type: application/json'); +header('Cache-Control: no-store'); + +$sms_api_reply = function (int $status, array $answer) { + http_response_code($status); + echo json_encode($answer); + exit; +}; + +// logAudit() reads these +$session_ip = escapeSql(getIP()); +$session_user_agent = escapeSql($_SERVER['HTTP_USER_AGENT'] ?? ''); +$session_user_id = 0; +$session_name = 'Skyetel'; + +// The key says which provider it is - one that is set up in ITFlow, with this key +$key = (string) ($_GET['key'] ?? ''); +$provider = null; +if (strlen($key) >= 32) { + try { + $sql = mysqli_query($mysqli, "SELECT * FROM sms_providers WHERE sms_provider_name = 'Skyetel'"); + while ($row = mysqli_fetch_assoc($sql)) { + if ((string) $row['sms_provider_inbound_key'] !== '' && hash_equals((string) $row['sms_provider_inbound_key'], $key)) { + $provider = $row; + break; + } + } + } catch (Throwable $e) { + // Before the 3.6.0 database update there is nothing here + } +} +if (!$provider) { + $sms_api_reply(404, ['error' => 'Not found']); +} +if (!intval($provider['sms_provider_active'])) { + $sms_api_reply(503, ['error' => 'Texting is turned off in ITFlow']); +} + +// The text - a JSON body, or the same as form or query fields +$body = json_decode((string) file_get_contents('php://input'), true); +if (!is_array($body)) { + $body = array_merge($_GET, $_POST); +} +$media = $body['media'] ?? []; +if (is_string($media)) { + $media = $media !== '' ? (json_decode($media, true) ?: [$media]) : []; +} +$text = (string) ($body['text'] ?? $body['message'] ?? $body['body'] ?? ''); + +$result = smsInbound($provider, (string) ($body['from'] ?? ''), (string) ($body['to'] ?? ''), $text, is_array($media) ? $media : []); + +$sms_api_reply(200, ['ok' => true, 'status' => $result['status']]); diff --git a/client/post.php b/client/post.php index 93e950e5c..f1ee0ae7b 100644 --- a/client/post.php +++ b/client/post.php @@ -670,6 +670,26 @@ if (isset($_POST['portal_email_prefs'])) { } +// Your account > Texts from us - their own say-so, so a STOP they sent before is lifted when they turn it on (functions/sms.php) +if (isset($_POST['portal_sms_prefs'])) { + + validateCSRFToken(); + + $state = smsContactTextState(intval($session_contact_id)); + if (!$state['ready'] || $state['number'] === '') { + flashAlert('Add your mobile first.', 'error'); + redirect('profile.php#texts'); + } + $want = !empty($_POST['sms_opt_in']); + if ($want !== ($state['on'] && !$state['stopped'])) { + smsOptInSet(intval($session_contact_id), $want, 'them, in the client portal'); + logAudit("Contact", "Edit", "Client contact $session_contact_name turned " . ($want ? 'on' : 'off') . " texts about their tickets, visits and invoices in the client portal", $session_client_id, $session_contact_id); + } + flashAlert($want ? 'Saved - we\'ll text you about your tickets, visits and invoices' : 'Saved - we won\'t text you'); + redirect('profile.php#texts'); + +} + if (isset($_POST['portal_contact_save'])) { validateCSRFToken(); diff --git a/client/profile.php b/client/profile.php index 89d4981ce..fd714f53c 100644 --- a/client/profile.php +++ b/client/profile.php @@ -190,6 +190,34 @@ $csrf = escapeHtml($_SESSION['csrf_token']); + +
    + +
    +

    Texts from us

    +
    +
    + +

    Add your mobile above and you can choose to get texts about your tickets, visits and invoices.

    + +
    + > + +
    +

    To , from . Reply to a text about a ticket to add to it. Reply STOP to any text and they stop. Message and data rates may apply.

    + +

    You replied STOP to our texts, so we send none. Turn this on to get them again.

    + + + +
    +
    + +
    diff --git a/cron/nightly_tasks.php b/cron/nightly_tasks.php index 07ecc4af4..0108d45ad 100644 --- a/cron/nightly_tasks.php +++ b/cron/nightly_tasks.php @@ -534,7 +534,9 @@ if ($reminder_rules['enabled']) { $attach[] = $file; } $sent = billingEmailQueue($recipients, $subject, $email, ['attach' => $attach]); - billingLog('invoice', $invoice_id, $invoice['invoice_status'], 'Reminder emailed to ' . implode(', ', $sent) . ' - ' . billingReminderWhen($days)); + // Texted too, in the morning, to those of them who agreed to texts (functions/sms.php) + $texted = smsInvoiceNotify($invoice, 'reminder', $recipients); + billingLog('invoice', $invoice_id, $invoice['invoice_status'], 'Reminder emailed to ' . implode(', ', $sent) . ' - ' . billingReminderWhen($days) . ($texted ? ' - and texted to ' . implode(', ', $texted) : '')); } // Statements each month, on the day in the invoice settings, to every client with a balance diff --git a/cron/sms_queue.php b/cron/sms_queue.php new file mode 100644 index 000000000..285a8da87 --- /dev/null +++ b/cron/sms_queue.php @@ -0,0 +1,53 @@ + false, * 'error']. $notes is what the agent has typed in the editor so far: the reply - * says what it says, in full. $type is who reads it: 'internal', 'public' or - * 'email' - a reply the client reads is drafted without the internal notes, so - * nothing in them can find its way to the client, and an email has no sign-off - * (the agent's signature is added when it is sent). + * says what it says, in full. $type is who reads it: 'internal', 'public', + * 'email' or 'text' - a reply the client reads is drafted without the internal + * notes, so nothing in them can find its way to the client, an email has no + * sign-off (the agent's signature is added when it is sent), and a text is a + * few short plain sentences. */ function aiTicketDraft($ticket_id, $notes = '', $type = 'email') { $model = getAiModel('Tickets'); if (!$model) { return ['ok' => false, 'error' => aiModelMissingError('Tickets')]; } - $type = in_array($type, ['internal', 'public', 'email'], true) ? $type : 'email'; + $type = in_array($type, ['internal', 'public', 'email', 'text'], true) ? $type : 'email'; $ticket = aiTicketContext($ticket_id, $type === 'internal'); if (!$ticket) { return ['ok' => false, 'error' => 'That ticket no longer exists.']; } $notes = aiHtmlToText($notes, 6000); - if ($type === 'internal') { + if ($type === 'text') { + $instructions = 'You draft the text messages the agents of a managed service provider send to their clients about support tickets.' + . ' One to three short, plain, friendly sentences - it is read on a phone - with no jargon, no formatting, no greeting beyond' + . ($ticket['first_name'] !== '' ? " \"Hi {$ticket['first_name']},\"" : ' a short "Hi,"') . ' and no sign-off.'; + } elseif ($type === 'internal') { $instructions = 'You write internal notes on IT support tickets for the agents of a managed service provider - for colleagues, not the client: concise and technical, no greeting and no sign-off.'; } else { $instructions = 'You draft the replies the agents of a managed service provider send to their clients on support tickets.' diff --git a/functions/audit_log.php b/functions/audit_log.php index 4e6a4f1fd..c7df2cfc2 100644 --- a/functions/audit_log.php +++ b/functions/audit_log.php @@ -100,6 +100,7 @@ function auditLogKinds() { 'Payment Method' => ['icon' => 'fa-credit-card', 'module' => 'module_financial'], 'Email' => ['icon' => 'fa-envelope'], 'Bulk Mail' => ['icon' => 'fa-mail-bulk'], + 'Text Message' => ['icon' => 'fa-sms'], 'Notification' => ['icon' => 'fa-bell'], 'Announcement' => ['icon' => 'fa-bullhorn'], 'Tag' => ['icon' => 'fa-tag'], diff --git a/functions/billing.php b/functions/billing.php index d58c60f7d..3b5cac9fe 100644 --- a/functions/billing.php +++ b/functions/billing.php @@ -2269,7 +2269,9 @@ function recurringInvoiceGenerate($recurring_invoice_id, $by = 'Cron', $early = } if ($sent_to) { mysqli_query($mysqli, "UPDATE invoices SET invoice_status = 'Sent' WHERE invoice_id = $invoice_id"); - billingLog('invoice', $invoice_id, 'Sent', 'Emailed to ' . implode(', ', $sent_to) . ($attach ? ' with the PDF' : '')); + // Texted with its link too, to those of them who agreed to texts (functions/sms.php) + $texted = smsInvoiceNotify(billingRow('invoice', $invoice_id, false), 'invoice', $recipients); + billingLog('invoice', $invoice_id, 'Sent', 'Emailed to ' . implode(', ', $sent_to) . ($attach ? ' with the PDF' : '') . ($texted ? ' - and texted to ' . implode(', ', $texted) : '')); } else { billingLog('invoice', $invoice_id, 'Draft', 'Nobody to email it to - no primary or billing contact with an email address'); } @@ -2466,7 +2468,9 @@ function billingInvoiceIssue($invoice_id, $by) { $sent_to = billingEmailQueue($recipients, $subject, $email, ['attach' => $attach]); } mysqli_query($mysqli, "UPDATE invoices SET invoice_status = 'Sent' WHERE invoice_id = $invoice_id AND invoice_status = 'Draft'"); - billingLog('invoice', $invoice_id, 'Sent', $sent_to ? 'Emailed to ' . implode(', ', $sent_to) . " by $by" : "Marked sent by $by - its link was handed on, nobody was emailed"); + // Texted with its link too, to those emailed who agreed to texts (functions/sms.php) + $texted = $sent_to ? smsInvoiceNotify(billingRow('invoice', $invoice_id, false), 'invoice', $recipients) : []; + billingLog('invoice', $invoice_id, 'Sent', ($sent_to ? 'Emailed to ' . implode(', ', $sent_to) . " by $by" : "Marked sent by $by - its link was handed on, nobody was emailed") . ($texted ? ' - and texted to ' . implode(', ', $texted) : '')); return $sent_to; } diff --git a/functions/logging.php b/functions/logging.php index 2ebde17b8..27f66508c 100644 --- a/functions/logging.php +++ b/functions/logging.php @@ -13,6 +13,10 @@ function triggerCustomAction($trigger, $entity) { if ($trigger === 'invoice_pay' && function_exists('invoicePaidFollowUp')) { invoicePaidFollowUp($entity); } + // ...and a text to the ticket's contact, when they agreed to texts (smsClientNotify(), functions/sms.php) + if (in_array($trigger, ['ticket_create', 'ticket_resolve', 'ticket_schedule', 'ticket_unschedule'], true) && function_exists('smsClientNotify')) { + smsClientNotify($trigger, $entity); + } $original_dir = getcwd(); // Save chdir(dirname(__FILE__)); diff --git a/functions/settings.php b/functions/settings.php index a26055d11..a963355a3 100644 --- a/functions/settings.php +++ b/functions/settings.php @@ -54,7 +54,7 @@ function settingsPages() { 'mail' => ['group' => 'email', 'title' => 'Mail', 'icon' => 'fa-envelope', 'url' => 'settings_mail.php', 'about' => 'The mailboxes ITFlow sends from and reads tickets from, the names emails come from, and tests.'], 'notification' => ['group' => 'email', 'title' => 'Notifications', 'icon' => 'fa-bell', 'url' => 'settings_notification.php', - 'about' => 'Which alerts ITFlow raises, and which emails clients get.'], + 'about' => 'Which alerts ITFlow raises, and which emails and texts clients get.'], 'security' => ['group' => 'access', 'title' => 'Security', 'icon' => 'fa-shield-alt', 'url' => 'settings_security.php', 'about' => 'The sign-in page, two-step sign-in, failed sign-ins and shared links.'], 'client_portal' => ['group' => 'access', 'title' => 'Client portal', 'icon' => 'fa-user-shield', 'url' => 'settings_client_portal.php', 'module' => 'portal', @@ -153,6 +153,9 @@ function settingsFields() { 'config_ticket_next_number' => ['page' => 'ticket', 'section' => 'Numbering', 'label' => 'Next ticket number', 'words' => 'ticket number counter'], 'config_ticket_email_parse' => ['page' => 'ticket', 'section' => 'Email to ticket', 'label' => 'Turn emails into tickets', 'words' => 'email to ticket parser parse inbound imap mailbox'] + $on_off, 'config_ticket_email_parse_unknown_senders' => ['page' => 'ticket', 'section' => 'Email to ticket', 'label' => 'From unknown senders too', 'words' => 'unknown senders domains anyone email'] + $on_off, + 'config_ticket_sms_parse' => ['page' => 'ticket', 'section' => 'Text to ticket', 'label' => 'Turn texts into tickets', 'words' => 'text sms message mobile phone skyetel to ticket'] + $on_off, + 'config_ticket_sms_unknown_senders' => ['page' => 'ticket', 'section' => 'Text to ticket', 'label' => 'From unknown numbers too', 'words' => 'text sms unknown numbers anyone'] + $on_off, + 'config_ticket_sms_acknowledge' => ['page' => 'ticket', 'section' => 'Text to ticket', 'label' => 'Text back the ticket number', 'words' => 'text sms acknowledge reply confirm number'] + $on_off, 'config_ticket_default_billable' => ['page' => 'ticket', 'section' => 'Time and billing', 'label' => 'New tickets are billable', 'words' => 'billable default bill'] + $on_off, 'config_ticket_timer_autostart' => ['page' => 'ticket', 'section' => 'Time and billing', 'label' => 'Start the timer on opening a ticket', 'words' => 'timer autostart time tracking'] + $on_off, 'config_ticket_autoclose_hours' => ['page' => 'ticket', 'section' => 'Closing', 'label' => 'Close resolved tickets after', 'words' => 'auto close autoclose resolved hours'], @@ -246,6 +249,12 @@ function settingsFields() { 'config_enable_alert_domain_expire' => ['page' => 'notification', 'section' => 'Alerts for your team', 'label' => 'Domains about to expire', 'words' => 'domain expiry expiration alert'] + $on_off, 'config_recurring_auto_send_invoice' => ['page' => 'notification', 'section' => 'Emails to clients', 'label' => 'Email the invoices recurring invoices make', 'words' => 'recurring invoice auto send email'] + $on_off, 'config_ticket_client_general_notifications' => ['page' => 'notification', 'section' => 'Emails to clients', 'label' => 'Email clients about their tickets', 'words' => 'ticket notification client email opened closed'] + $on_off, + 'config_sms_client_tickets' => ['page' => 'notification', 'section' => 'Texts to clients', 'label' => 'Text them about their tickets', 'kind' => 'select', + 'options' => [0 => 'No', 1 => 'When one is opened and resolved', 2 => 'When one is opened and resolved, and each emailed reply'], 'words' => 'text sms ticket opened resolved reply notification'], + 'config_sms_client_visits' => ['page' => 'notification', 'section' => 'Texts to clients', 'label' => 'Text them when a visit or call is booked', 'words' => 'text sms schedule scheduled visit onsite remote booked appointment'] + $on_off, + 'config_sms_visit_reminder_hours' => ['page' => 'notification', 'section' => 'Texts to clients', 'label' => 'Remind them of a visit or call', 'kind' => 'select', + 'options' => smsReminderChoices(), 'words' => 'text sms reminder appointment visit hours before'], + 'config_sms_client_invoices' => ['page' => 'notification', 'section' => 'Texts to clients', 'label' => 'Text invoices and payment reminders, with a link to pay', 'words' => 'text sms invoice pay link reminder overdue'] + $on_off, // Security 'config_login_message' => ['page' => 'security', 'section' => 'The sign-in page', 'label' => 'Sign-in page message', 'kind' => 'long', 'words' => 'login message banner notice'], diff --git a/functions/sms.php b/functions/sms.php new file mode 100644 index 000000000..26d780b7f --- /dev/null +++ b/functions/sms.php @@ -0,0 +1,1713 @@ + Integrations > Text Messaging). + * + * Going out: smsQueue() puts a text in sms_messages, smsSendQueued() sends one and the + * Text Messages job (cron/sms_queue.php, smsQueueRun()) sends the rest, a second apart, as + * the service allows. A number that replied STOP gets nothing more until it replies START. + * + * Coming in: the service posts each text to api/sms/.php, which hands it to + * smsInbound(). What happens to it, in order: + * STOP, START, HELP - the number is opted out or back in, or told who you are, and answered + * a blocked number - Spam, quietly + * a number texting on a ticket in the last SMS_CONVERSATION_DAYS days - a reply on it + * a contact's mobile (or phone) - a new ticket for them (Settings > Tickets > Text to ticket) + * a verification code - Texts > Codes, for those who can view credentials, masked, and + * wiped after SMS_CODE_KEEP_HOURS + * what looks like spam - Texts > Spam + * anyone else - Texts > Unmatched, for an agent to open a ticket from, or dismiss + * + * Texts to clients - about their tickets, visits and invoices - go only to contacts who agreed + * (contact_sms_opt_in: an agent with their say-so, the client portal, or replying YES when asked + * by text), and wait for the morning when they'd land at night (smsSendAfter()). Each is sent by + * the Text Messages job, and a reply to one about a ticket goes on that ticket. + * + * Numbers are kept as E.164 digits without the + ("14125550100"), short codes as their digits. + */ + +const SMS_CONVERSATION_DAYS = 14; // a text within this long of the last one on a ticket goes on it +const SMS_CODE_MASK_MINUTES = 15; // a code can be revealed for this long after it arrives +const SMS_CODE_KEEP_HOURS = 24; // then the code text is wiped, this long after it arrived +const SMS_SPAM_KEEP_DAYS = 30; // spam and dismissed texts are deleted after this long +const SMS_KEEP_DAYS = 365; // the rest of the log +const SMS_MAX_ATTEMPTS = 3; // a text that won't go is tried this many times +const SMS_TEXT_LIMIT = 1000; // a longer text goes as several - Skyetel takes 1024 characters +const SMS_MEDIA_MAX_BYTES = 5242880; // a photo or file texted in, at most +const SMS_MEDIA_MAX_FILES = 10; +const SMS_QUIET_FROM = 21; // texts to clients that ITFlow sends by itself wait from 9pm... +const SMS_QUIET_UNTIL = 8; // ...until 8am, your time +const SMS_OPT_IN_ASK_DAYS = 7; // a YES counts as agreeing this long after they were asked + +/* A text's words or a reply's HTML for a query - as they are; escapeSql() would take out anything that looks like a tag */ +function smsSql($value): string +{ + global $mysqli; + return mysqli_real_escape_string($mysqli, (string) $value); +} + +/* ------------------------------------------------------------------ Providers */ + +/* The texting services ITFlow works with - what each needs to be set up */ +function smsProviderKinds(): array +{ + return [ + 'Skyetel' => [ + 'icon' => 'fas fa-sms', + 'portal_url' => 'https://portal.skyetel.com', + 'about' => 'Your Skyetel number texts clients, and texts to it come back into ITFlow.', + 'username_label' => 'SID', + 'secret_label' => 'Secret', + 'endpoint' => 'skyetel', + 'send' => 'smsSkyetelSend', + 'per_second' => 1, + 'per_five_minutes' => 300, + ], + ]; +} + +/* One provider by id - raw, or null */ +function smsProviderRow($provider_id): ?array +{ + global $mysqli; + $provider_id = intval($provider_id); + if (!$provider_id) { + return null; + } + try { + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM sms_providers WHERE sms_provider_id = $provider_id LIMIT 1")); + } catch (Throwable $e) { + return null; + } + return $row ?: null; +} + +/* The provider texts go through - the one that is on (the first, if there are more) - or null. Read once a request */ +function smsProvider(bool $fresh = false): ?array +{ + global $mysqli; + static $provider = false; + if ($provider === false || $fresh) { + $provider = null; + try { + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM sms_providers WHERE sms_provider_active = 1 ORDER BY sms_provider_id ASC LIMIT 1")); + $provider = $row ?: null; + } catch (Throwable $e) { + // Before the 3.6.0 database update there is no texting + } + } + return $provider; +} + +/* Whether texts can go out - a provider that is on, with its keys and number */ +function smsReady(): bool +{ + $provider = smsProvider(); + return $provider && isset(smsProviderKinds()[$provider['sms_provider_name']]) + && trim((string) $provider['sms_provider_username']) !== '' && trim((string) $provider['sms_provider_secret']) !== '' + && smsNumberIsPhone((string) $provider['sms_provider_number']); +} + +/* The address the provider posts texts to - what to paste into its portal */ +function smsInboundUrl(array $provider): string +{ + global $config_base_url; + $kind = smsProviderKinds()[$provider['sms_provider_name']] ?? null; + $endpoint = $kind['endpoint'] ?? 'skyetel'; + return 'https://' . rtrim((string) $config_base_url, '/') . "/api/sms/$endpoint.php?key=" . rawurlencode((string) $provider['sms_provider_inbound_key']); +} + +/* + * What the Text Messaging window sent, checked - [$after, $errors]: the row to save, and what + * is wrong by field. A secret left empty keeps the saved one; a new provider gets its key for + * the inbound address. + */ +function smsProviderCheck(array $in, ?array $before): array +{ + global $mysqli; + + $kinds = smsProviderKinds(); + $errors = []; + $name = $before ? (string) $before['sms_provider_name'] : (string) ($in['provider'] ?? ''); + if (!isset($kinds[$name])) { + $errors['provider'] = 'Pick a texting service ITFlow works with.'; + $name = (string) array_key_first($kinds); + } elseif (!$before && mysqli_num_rows(mysqli_query($mysqli, "SELECT 1 FROM sms_providers WHERE sms_provider_name = '" . escapeSql($name) . "'"))) { + $errors['provider'] = "$name is set up already - edit that one."; + } + $kind = $kinds[$name]; + + $after = [ + 'sms_provider_name' => $name, + 'sms_provider_description' => mb_substr(trim((string) ($in['description'] ?? '')), 0, 250), + 'sms_provider_username' => trim((string) ($in['username'] ?? '')), + 'sms_provider_secret' => trim((string) ($in['secret'] ?? '')), + 'sms_provider_number' => smsNumber((string) ($in['number'] ?? '')), + 'sms_provider_active' => $before ? (empty($in['active']) ? 0 : 1) : 1, + 'sms_provider_inbound_key' => $before ? (string) $before['sms_provider_inbound_key'] : randomString(40), + ]; + if ($after['sms_provider_secret'] === '' && $before) { + $after['sms_provider_secret'] = (string) $before['sms_provider_secret']; + } + + if ($after['sms_provider_username'] === '') { + $errors['username'] = "Its {$kind['username_label']}, from $name's portal."; + } elseif (mb_strlen($after['sms_provider_username']) > 250 || preg_match('/\s/', $after['sms_provider_username'])) { + $errors['username'] = "That isn't a {$kind['username_label']} - it has no spaces."; + } + if ($after['sms_provider_secret'] === '') { + $errors['secret'] = "Its {$kind['secret_label']}, shown when the {$kind['username_label']} is made."; + } elseif (mb_strlen($after['sms_provider_secret']) > 500) { + $errors['secret'] = "That is too long to be a {$kind['secret_label']}."; + } + if (trim((string) ($in['number'] ?? '')) === '') { + $errors['number'] = "The $name number texts go from - SMS-enabled in $name's portal."; + } elseif ($after['sms_provider_number'] === '') { + $errors['number'] = "That isn't a phone number - with its dial code, like +1 412 555 0100."; + } + return [$after, $errors]; +} + +/* Save a provider - its id */ +function smsProviderWrite(array $after, int $provider_id = 0): int +{ + global $mysqli; + $set = []; + foreach ($after as $column => $value) { + $set[] = "`$column` = " . (is_int($value) ? $value : "'" . escapeSql((string) $value) . "'"); + } + $set = implode(', ', $set); + if ($provider_id) { + mysqli_query($mysqli, "UPDATE sms_providers SET $set WHERE sms_provider_id = $provider_id"); + return $provider_id; + } + mysqli_query($mysqli, "INSERT INTO sms_providers SET $set"); + return mysqli_insert_id($mysqli); +} + +/* What changed on a provider, for the audit log and the message - the secret only as changed */ +function smsProviderChangeLines(array $before, array $after): array +{ + $lines = []; + $labels = ['sms_provider_description' => 'description', 'sms_provider_username' => 'SID', 'sms_provider_number' => 'number']; + foreach ($labels as $column => $label) { + if ((string) $before[$column] !== (string) $after[$column]) { + $from = $column === 'sms_provider_number' ? smsNumberText($before[$column]) : (string) $before[$column]; + $to = $column === 'sms_provider_number' ? smsNumberText($after[$column]) : (string) $after[$column]; + $lines[] = "$label " . ($from !== '' ? $from : '(none)') . " -> " . ($to !== '' ? $to : '(none)'); + } + } + if ((string) $before['sms_provider_secret'] !== (string) $after['sms_provider_secret']) { + $lines[] = 'secret changed'; + } + if (intval($before['sms_provider_active']) !== intval($after['sms_provider_active'])) { + $lines[] = intval($after['sms_provider_active']) ? 'turned on' : 'turned off'; + } + return $lines; +} + +/* A provider's texts in the last 30 days - ['sent', 'failed', 'received', 'last_in'] */ +function smsProviderActivity(): array +{ + global $mysqli; + try { + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT + COALESCE(SUM(sms_message_direction = 'out' AND sms_message_status = 'sent'), 0) AS sent, + COALESCE(SUM(sms_message_direction = 'out' AND sms_message_status = 'failed'), 0) AS failed, + COALESCE(SUM(sms_message_direction = 'in'), 0) AS received + FROM sms_messages WHERE sms_message_created_at > NOW() - INTERVAL 30 DAY")); + } catch (Throwable $e) { + $row = null; + } + return ['sent' => intval($row['sent'] ?? 0), 'failed' => intval($row['failed'] ?? 0), 'received' => intval($row['received'] ?? 0)]; +} + +/* ------------------------------------------------------------------ Numbers */ + +/* The dial code a number written without one is taken to have - your company's, else North America's */ +function smsDefaultCountryCode(): string +{ + global $mysqli; + static $cc = null; + if ($cc === null) { + $row = mysqli_fetch_row(mysqli_query($mysqli, "SELECT company_phone_country_code FROM companies WHERE company_id = 1")); + $cc = preg_replace('/\D/', '', (string) ($row[0] ?? '')); + if ($cc === '') { + $cc = '1'; + } + } + return $cc; +} + +/* + * A number as a text goes to it - E.164 digits without the + - from a number as ITFlow keeps + * it (a contact's digits and dial code), or as typed ("+1 412-555-0100", "(412) 555-0100"). + * '' when it can't be a number a text goes to. + */ +function smsNumber($number, $country_code = ''): string +{ + $raw = trim((string) $number); + $digits = preg_replace('/\D/', '', $raw); + if ($digits === '') { + return ''; + } + if (strpos($raw, '+') === 0) { + $e164 = $digits; + } elseif (strpos($digits, '00') === 0 && strlen($digits) > 10) { + $e164 = substr($digits, 2); + } else { + $cc = preg_replace('/\D/', '', (string) $country_code); + if ($cc === '') { + $cc = smsDefaultCountryCode(); + } + $e164 = $cc . phoneParts($digits, $cc)['national']; + } + return smsNumberIsPhone($e164) ? $e164 : ''; +} + +/* A number as a service sends it - its digits, a 10-digit North American number given its 1, a short code as it is */ +function smsInboundNumber($number): string +{ + $digits = preg_replace('/\D/', '', (string) $number); + if (strlen($digits) === 10 && smsDefaultCountryCode() === '1') { + $digits = '1' . $digits; + } + return strlen($digits) >= 3 && strlen($digits) <= 15 ? $digits : ''; +} + +/* Whether E.164 digits are a phone number (8 to 15 digits) rather than a short code */ +function smsNumberIsPhone(string $digits): bool +{ + return preg_match('/^[1-9]\d{7,14}$/', $digits) === 1; +} + +/* A number for reading - "+1 (412) 555-0100", "Short code 32665" */ +function smsNumberText($digits): string +{ + $digits = preg_replace('/\D/', '', (string) $digits); + if ($digits === '') { + return ''; + } + if (!smsNumberIsPhone($digits)) { + return "Short code $digits"; + } + if (strlen($digits) === 11 && $digits[0] === '1') { + return formatPhoneNumber(substr($digits, 1), '1'); + } + for ($length = 1; $length <= 3; $length++) { + $cc = substr($digits, 0, $length); + if (phoneFormatRules($cc)) { + return formatPhoneNumber(substr($digits, $length), $cc); + } + } + return "+$digits"; +} + +/* What ITFlow knows about a number (sms_numbers) - or null */ +function smsNumberRow(string $number): ?array +{ + global $mysqli; + if ($number === '') { + return null; + } + try { + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM sms_numbers WHERE sms_number_phone = '" . escapeSql($number) . "' LIMIT 1")); + } catch (Throwable $e) { + return null; + } + return $row ?: null; +} + +/* Set what is known about a number - columns of sms_numbers without the prefix: label, opted_out_at, blocked_at, blocked_by */ +function smsNumberSet(string $number, array $set): void +{ + global $mysqli; + if ($number === '' || !$set) { + return; + } + $pairs = []; + foreach ($set as $column => $value) { + $column = 'sms_number_' . preg_replace('/[^a-z_]/', '', (string) $column); + $pairs[] = "`$column` = " . ($value === null ? 'NULL' : ($value === 'NOW()' ? 'NOW()' : "'" . escapeSql((string) $value) . "'")); + } + $pairs = implode(', ', $pairs); + mysqli_query($mysqli, "INSERT INTO sms_numbers SET sms_number_phone = '" . escapeSql($number) . "', $pairs ON DUPLICATE KEY UPDATE $pairs"); +} + +function smsOptedOut(string $number): bool +{ + return !empty(smsNumberRow($number)['sms_number_opted_out_at']); +} + +function smsBlocked(string $number): bool +{ + return !empty(smsNumberRow($number)['sms_number_blocked_at']); +} + +/* A name for a number - what an agent called it (a code sender, say), or '' */ +function smsNumberLabel(string $number): string +{ + return trim((string) (smsNumberRow($number)['sms_number_label'] ?? '')); +} + +/* + * The contacts a number belongs to - their mobile first, then their phone, the most recently + * changed first. Each: contact_id, contact_name, contact_client_id, client_name. + */ +function smsContactsFor(string $number): array +{ + global $mysqli; + if (!smsNumberIsPhone($number)) { + return []; + } + $tail = escapeSql(substr($number, -7)); + $sql = mysqli_query($mysqli, "SELECT contact_id, contact_name, contact_client_id, contact_mobile, contact_mobile_country_code, contact_phone, contact_phone_country_code, client_name + FROM contacts + LEFT JOIN clients ON client_id = contact_client_id + WHERE contact_archived_at IS NULL AND (contact_client_id = 0 OR client_archived_at IS NULL) + AND (REGEXP_REPLACE(contact_mobile, '[^0-9]', '') LIKE '%$tail' OR REGEXP_REPLACE(contact_phone, '[^0-9]', '') LIKE '%$tail') + ORDER BY contact_updated_at DESC, contact_id DESC + LIMIT 50"); + $mobiles = []; + $phones = []; + while ($row = mysqli_fetch_assoc($sql)) { + if (smsNumber($row['contact_mobile'], $row['contact_mobile_country_code']) === $number) { + $mobiles[] = $row; + } elseif (smsNumber($row['contact_phone'], $row['contact_phone_country_code']) === $number) { + $phones[] = $row; + } + } + return array_merge($mobiles, $phones); +} + +/* E.164 digits in their parts - [dial code, the number after it] - as a contact's mobile is kept. ['', digits] when the dial code isn't known */ +function smsNumberParts(string $digits): array +{ + if (strlen($digits) === 11 && $digits[0] === '1') { + return ['1', substr($digits, 1)]; + } + for ($length = 1; $length <= 3; $length++) { + if (phoneFormatRules(substr($digits, 0, $length))) { + return [substr($digits, 0, $length), substr($digits, $length)]; + } + } + return ['', $digits]; +} + +/* A contact's number for texts - their mobile, as a text goes to it - or '' */ +function smsContactNumber(array $contact): string +{ + return smsNumber($contact['contact_mobile'] ?? '', $contact['contact_mobile_country_code'] ?? ''); +} + +/* ------------------------------------------------------------------ Text */ + +/* Plain text from a reply's HTML - lines kept, links written out, formatting dropped */ +function smsTextFromHtml(string $html): string +{ + $html = preg_replace('#<(script|style)\b[^>]*>.*?#is', '', $html); + // A link keeps where it goes, unless its words are its address + $html = preg_replace_callback('#]*href=["\']([^"\']+)["\'][^>]*>(.*?)#is', function ($m) { + $words = trim(html_entity_decode(strip_tags($m[2]), ENT_QUOTES | ENT_HTML5, 'UTF-8')); + $href = html_entity_decode($m[1], ENT_QUOTES | ENT_HTML5, 'UTF-8'); + if (stripos($href, 'mailto:') === 0) { + $href = substr($href, 7); + } + return $words === '' || $words === $href ? $href : "$words ($href)"; + }, $html); + $html = preg_replace('#]*>#i', "\n- ", $html); + $html = preg_replace('##i', "\n", $html); + $html = preg_replace('##i', "\n", $html); + $text = html_entity_decode(strip_tags($html), ENT_QUOTES | ENT_HTML5, 'UTF-8'); + $text = str_replace("\u{00A0}", ' ', $text); + $text = preg_replace("/[ \t]+/", ' ', $text); + $text = preg_replace("/ *\n */", "\n", $text); + $text = preg_replace("/\n{3,}/", "\n\n", $text); + return trim($text); +} + +/* A text in parts no longer than the service takes - split at a paragraph, a line, then a word */ +function smsSplit(string $text, int $limit = SMS_TEXT_LIMIT): array +{ + $text = trim($text); + $parts = []; + while (mb_strlen($text) > $limit) { + $head = mb_substr($text, 0, $limit); + $cut = 0; + foreach (["\n\n", "\n", '. ', ' '] as $break) { + $at = mb_strrpos($head, $break); + if ($at !== false && $at > $limit / 2) { + $cut = $at + mb_strlen($break); + break; + } + } + if (!$cut) { + $cut = $limit; + } + $parts[] = trim(mb_substr($text, 0, $cut)); + $text = trim(mb_substr($text, $cut)); + } + if ($text !== '') { + $parts[] = $text; + } + return $parts; +} + +/* + * A keyword the whole text is - 'stop', 'start' or 'help' - or ''. Carriers expect these + * answered; CANCEL and END stop texts too, as the industry's rules say they must. + */ +function smsKeyword(string $text): string +{ + $word = strtoupper(preg_replace('/[^A-Za-z]/', '', trim($text))); + if (mb_strlen(trim($text)) > 20) { + return ''; + } + if (in_array($word, ['STOP', 'STOPALL', 'UNSUBSCRIBE', 'CANCEL', 'END', 'QUIT', 'OPTOUT', 'REVOKE'], true)) { + return 'stop'; + } + if (in_array($word, ['START', 'UNSTOP', 'SUBSCRIBE', 'OPTIN'], true)) { + return 'start'; + } + if (in_array($word, ['HELP', 'INFO'], true)) { + return 'help'; + } + return ''; +} + +/* + * The verification code in a text - "Your Microsoft code is 482 913", "G-582014 is your Google + * verification code" - or ''. It takes the words such texts use and a run of 4 to 8 digits. + */ +function smsVerificationCode(string $text): string +{ + $words = '/\b(codes?|passcodes?|pass code|otp|one[- ]time|verification|verify|security|authenticat\w*|2fa|mfa|two[- ](?:factor|step)|sign[- ]?in|log[- ]?in|pin)\b/i'; + if (!preg_match($words, $text)) { + return ''; + } + $patterns = [ + // Right after the word code, passcode, OTP or PIN, with a few words between + '/\b(?:code|passcode|otp|pin)\b[^0-9\n]{0,24}?\b((?:[A-Z]{1,3}-)?\d{3,4}(?:[ -]?\d{2,4})?)\b(?![\d,:\/%]|\.\d)/i', + // Before "is your ... code" + '/\b((?:[A-Z]{1,3}-)?\d{4,8})\b(?=\s+is\s+your\b)/i', + // Any run of 4 to 8 digits on its own, or 3 and 3 ("123 456") + '/(?= 4 && strlen(preg_replace('/\D/', '', $code)) <= 8) { + return $code; + } + } + } + return ''; +} + +/* Whether a text from someone you don't know looks like spam - shortened links and the usual bait */ +function smsLooksLikeSpam(string $text): bool +{ + $lower = mb_strtolower($text); + if (preg_match('#\b(bit\.ly|tinyurl\.com|t\.co|is\.gd|cutt\.ly|rb\.gy|shorturl\.at|tiny\.cc|ow\.ly|rebrand\.ly|t\.ly)/#', $lower)) { + return true; + } + $bait = ['you have won', "you've won", 'you won a', 'claim your', 'free gift', 'gift card', 'act now', 'limited time offer', 'pre-approved', 'preapproved', + 'loan', 'crypto', 'bitcoin', 'unpaid toll', 'toll balance', 'toll violation', 'could not be delivered', 'delivery attempt', 'redelivery', 'usps', 'parcel', + 'reply yes to', 'click the link', 'click here', 'verify your account', 'account has been suspended', 'final notice', 'debt relief', 'lower your rate', 'casino', 'promo code']; + $hits = 0; + foreach ($bait as $phrase) { + if (strpos($lower, $phrase) !== false) { + $hits++; + } + } + $has_link = preg_match('#https?://|www\.|\b[a-z0-9-]+\.(com|net|info|top|xyz|club|site|online|icu|live|vip|shop)/#', $lower) === 1; + return $hits >= 2 || ($hits >= 1 && $has_link); +} + +/* ------------------------------------------------------------------ Sending */ + +/* + * Queue a text - ['ids' => [the text's rows], 'error' => why it can't go, or '']. $to in E.164 + * digits - smsNumber() of one typed or kept on a contact; $text plain, split when long. $meta: purpose, contact_id, + * client_id, ticket_id, ticket_reply_id, user_id, send_after (not before then - smsSendAfter()), + * and force - to a number that replied STOP, for the reply that says so and nothing else. + */ +function smsQueue($to, string $text, array $meta = []): array +{ + global $mysqli; + + $provider = smsProvider(); + if (!smsReady()) { + return ['ids' => [], 'error' => "Texting isn't set up - Admin > Text Messaging"]; + } + $number = preg_replace('/\D/', '', (string) $to); + if (!smsNumberIsPhone($number)) { + return ['ids' => [], 'error' => "That isn't a number a text can go to"]; + } + $parts = smsSplit($text); + if (!$parts) { + return ['ids' => [], 'error' => 'There is nothing to text']; + } + + $blocked = empty($meta['force']) && smsOptedOut($number); + $columns = "sms_message_direction = 'out', sms_message_number = '" . escapeSql($number) . "', sms_message_our_number = '" . escapeSql($provider['sms_provider_number']) . "', + sms_message_purpose = '" . escapeSql(substr((string) ($meta['purpose'] ?? ''), 0, 30)) . "', + sms_message_contact_id = " . intval($meta['contact_id'] ?? 0) . ", sms_message_client_id = " . intval($meta['client_id'] ?? 0) . ", + sms_message_ticket_id = " . intval($meta['ticket_id'] ?? 0) . ", sms_message_ticket_reply_id = " . intval($meta['ticket_reply_id'] ?? 0) . ", + sms_message_user_id = " . intval($meta['user_id'] ?? 0) + . (!empty($meta['send_after']) && smsColumnExists('sms_messages', 'sms_message_send_after') ? ", sms_message_send_after = '" . escapeSql($meta['send_after']) . "'" : ''); + + $ids = []; + foreach ($parts as $part) { + mysqli_query($mysqli, "INSERT INTO sms_messages SET $columns, sms_message_body = '" . smsSql($part) . "', + sms_message_status = '" . ($blocked ? 'blocked' : 'queued') . "'" . ($blocked ? ", sms_message_error = 'They replied STOP - they get no texts until they reply START'" : '')); + $ids[] = mysqli_insert_id($mysqli); + if ($blocked) { + break; + } + } + return ['ids' => $ids, 'error' => $blocked ? 'They replied STOP to your texts, so they get none until they reply START' : '']; +} + +/* Send queued texts now - the first, and the rest a second apart, as the service allows. ['sent' => n, 'error' => the first reason one didn't go] */ +function smsSendNow(array $ids): array +{ + $sent = 0; + $error = ''; + foreach (array_values($ids) as $i => $id) { + if ($i) { + usleep(1100000); + } + $result = smsSendQueued(intval($id)); + if ($result['ok']) { + $sent++; + } elseif ($error === '') { + $error = $result['error']; + } + } + return ['sent' => $sent, 'error' => $error]; +} + +/* Send one queued text - ['ok', 'error']. One that can be tried again goes back in the queue for the job */ +function smsSendQueued(int $id): array +{ + global $mysqli; + + $provider = smsProvider(); + $kind = $provider ? (smsProviderKinds()[$provider['sms_provider_name']] ?? null) : null; + if (!$kind || !smsReady()) { + return ['ok' => false, 'error' => "Texting isn't set up"]; + } + + // Claimed, so the job and a request can't both send it + mysqli_query($mysqli, "UPDATE sms_messages SET sms_message_status = 'sending', sms_message_attempts = sms_message_attempts + 1, sms_message_attempted_at = NOW() + WHERE sms_message_id = $id AND sms_message_direction = 'out' AND sms_message_status = 'queued'"); + if (mysqli_affected_rows($mysqli) !== 1) { + return ['ok' => false, 'error' => 'It was sent already, or is being sent']; + } + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT sms_message_number, sms_message_body, sms_message_attempts FROM sms_messages WHERE sms_message_id = $id")); + + $result = call_user_func($kind['send'], $provider, (string) $row['sms_message_number'], (string) $row['sms_message_body'], []); + + if ($result['ok']) { + mysqli_query($mysqli, "UPDATE sms_messages SET sms_message_status = 'sent', sms_message_sent_at = NOW(), sms_message_error = NULL, + sms_message_provider_ref = " . ($result['ref'] !== '' ? "'" . escapeSql(substr($result['ref'], 0, 100)) . "'" : 'NULL') . " WHERE sms_message_id = $id"); + return ['ok' => true, 'error' => '']; + } + + $again = $result['retry'] && intval($row['sms_message_attempts']) < SMS_MAX_ATTEMPTS; + mysqli_query($mysqli, "UPDATE sms_messages SET sms_message_status = '" . ($again ? 'queued' : 'failed') . "', sms_message_error = '" . escapeSql(mb_substr($result['error'], 0, 500)) . "' WHERE sms_message_id = $id"); + if (!$again) { + logApp('Text Message', 'warning', "A text to " . smsNumberText($row['sms_message_number']) . " didn't go: " . $result['error']); + } + return ['ok' => false, 'error' => $result['error'] . ($again ? ' - it will be tried again in a minute or two' : '')]; +} + +/* + * The Text Messages job - texts waiting to go, oldest first, a second apart, until the + * service's five-minute allowance or $max_seconds runs out. One tried before waits a couple + * of minutes for each try. ['sent', 'failed', 'waiting']. + */ +function smsQueueRun(int $max_seconds = 45): array +{ + global $mysqli; + + $counts = ['sent' => 0, 'failed' => 0, 'waiting' => 0]; + $provider = smsProvider(); + $kind = $provider ? (smsProviderKinds()[$provider['sms_provider_name']] ?? null) : null; + if (!$kind || !smsReady()) { + return $counts; + } + + // Left sending by a run that stopped part way - back in the queue + mysqli_query($mysqli, "UPDATE sms_messages SET sms_message_status = 'queued' WHERE sms_message_status = 'sending' AND sms_message_attempted_at < NOW() - INTERVAL 10 MINUTE"); + + $wait_column = smsColumnExists('sms_messages', 'sms_message_send_after'); + $started = time(); + while (time() - $started < $max_seconds) { + $recent = intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM sms_messages WHERE sms_message_direction = 'out' AND sms_message_attempted_at > NOW() - INTERVAL 5 MINUTE"))[0]); + if ($recent >= $kind['per_five_minutes'] - 10) { + break; + } + $next = mysqli_fetch_row(mysqli_query($mysqli, "SELECT sms_message_id FROM sms_messages + WHERE sms_message_direction = 'out' AND sms_message_status = 'queued' + AND (sms_message_attempted_at IS NULL OR sms_message_attempted_at < NOW() - INTERVAL (2 * sms_message_attempts) MINUTE) + " . ($wait_column ? 'AND (sms_message_send_after IS NULL OR sms_message_send_after <= NOW())' : '') . " + ORDER BY sms_message_id ASC LIMIT 1")); + if (!$next) { + break; + } + $result = smsSendQueued(intval($next[0])); + $counts[$result['ok'] ? 'sent' : 'failed']++; + usleep(1100000); + } + $counts['waiting'] = intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM sms_messages WHERE sms_message_direction = 'out' AND sms_message_status = 'queued'"))[0]); + return $counts; +} + +/* + * Skyetel - POST https://sms.skyetel.com/v1/out?from=, its SID and secret as the + * user and password, {"to", "text", "media"}. ['ok', 'ref', 'error', 'retry']. + */ +function smsSkyetelSend(array $provider, string $to, string $text, array $media = []): array +{ + $body = ['to' => $to, 'text' => $text]; + if ($media) { + $body['media'] = array_values($media); + } + $ch = curl_init('https://sms.skyetel.com/v1/out?from=' . rawurlencode(preg_replace('/\D/', '', (string) $provider['sms_provider_number']))); + curl_setopt_array($ch, [ + CURLOPT_RETURNTRANSFER => true, + CURLOPT_POST => true, + CURLOPT_POSTFIELDS => json_encode($body), + CURLOPT_HTTPHEADER => ['Content-Type: application/json', 'Accept: application/json'], + CURLOPT_HTTPAUTH => CURLAUTH_BASIC, + CURLOPT_USERPWD => $provider['sms_provider_username'] . ':' . $provider['sms_provider_secret'], + CURLOPT_TIMEOUT => 20, + CURLOPT_CONNECTTIMEOUT => 10, + CURLOPT_USERAGENT => 'ITFlow', + CURLOPT_PROTOCOLS => CURLPROTO_HTTPS, + ]); + $raw = curl_exec($ch); + $curl_error = curl_error($ch); + $code = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE); + curl_close($ch); + + if ($raw === false) { + return ['ok' => false, 'ref' => '', 'error' => "Couldn't reach Skyetel" . ($curl_error !== '' ? " ($curl_error)" : ''), 'retry' => true]; + } + $json = json_decode((string) $raw, true); + $said = is_array($json) ? trim((string) ($json['message'] ?? $json['error'] ?? $json['detail'] ?? '')) : trim(strip_tags((string) $raw)); + if ($code >= 200 && $code < 300 && !(is_array($json) && isset($json['success']) && $json['success'] === false)) { + $ref = is_array($json) ? (string) ($json['id'] ?? $json['message_id'] ?? $json['mid'] ?? '') : ''; + return ['ok' => true, 'ref' => $ref, 'error' => '', 'retry' => false]; + } + if ($code === 401) { + return ['ok' => false, 'ref' => '', 'error' => "Skyetel turned it down (401) - check the SID and secret, that the number is SMS-enabled and registered for texting, and that the account has a balance", 'retry' => false]; + } + if ($code === 403 || $code === 429) { + return ['ok' => false, 'ref' => '', 'error' => "Skyetel says too many texts went at once ($code)", 'retry' => true]; + } + $said = $said !== '' ? ' - ' . mb_strimwidth($said, 0, 200, '...') : ''; + return ['ok' => false, 'ref' => '', 'error' => "Skyetel answered $code$said", 'retry' => $code >= 500]; +} + +/* ------------------------------------------------------------------ Coming in */ + +/* Settings > Tickets > Text to ticket, and the ticket numbering and billing a ticket opened from a text takes - read where they're used */ +function smsTicketSettings(): array +{ + global $mysqli; + $settings = ['config_ticket_sms_parse' => 1, 'config_ticket_sms_unknown_senders' => 0, 'config_ticket_sms_acknowledge' => 1, 'config_ticket_prefix' => '', 'config_ticket_default_billable' => 0]; + try { + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT config_ticket_sms_parse, config_ticket_sms_unknown_senders, config_ticket_sms_acknowledge, config_ticket_prefix, config_ticket_default_billable FROM settings WHERE company_id = 1")); + if ($row) { + $settings = array_merge($settings, $row); + } + } catch (Throwable $e) { + // Before the 3.6.0 database update - the defaults + } + return $settings; +} + +/* + * A text that came in, from the provider's endpoint - what became of it: + * ['status' => ticket, unmatched, code, spam, keyword, duplicate or ignored, 'id' => its row, 'ticket_id']. + */ +function smsInbound(array $provider, $from_raw, $to_raw, string $text, array $media): array +{ + global $mysqli; + + $settings = smsTicketSettings(); + $from = smsInboundNumber($from_raw); + $to = smsInboundNumber($to_raw); + $text = trim(mb_substr(str_replace("\r\n", "\n", $text), 0, 5000)); + $media = array_slice(array_values(array_filter(array_map('strval', $media), function ($url) { + return preg_match('#^https://#i', $url) === 1; + })), 0, SMS_MEDIA_MAX_FILES); + if ($from === '' || ($text === '' && !$media)) { + return ['status' => 'ignored', 'id' => 0, 'ticket_id' => 0]; + } + $number_esc = escapeSql($from); + $media_json = $media ? smsSql(json_encode($media)) : ''; + + // The same text again within two minutes - a service trying again - is the one already here + $same = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT sms_message_id, sms_message_status, sms_message_ticket_id FROM sms_messages + WHERE sms_message_direction = 'in' AND sms_message_number = '$number_esc' AND sms_message_created_at > NOW() - INTERVAL 2 MINUTE + AND sms_message_body = '" . smsSql($text) . "' AND COALESCE(sms_message_media, '') = '$media_json' LIMIT 1")); + if ($same) { + return ['status' => 'duplicate', 'id' => intval($same['sms_message_id']), 'ticket_id' => intval($same['sms_message_ticket_id'])]; + } + + mysqli_query($mysqli, "INSERT INTO sms_messages SET sms_message_direction = 'in', sms_message_status = 'received', sms_message_number = '$number_esc', + sms_message_our_number = '" . escapeSql($to) . "', sms_message_body = '" . smsSql($text) . "', sms_message_media = " . ($media ? "'$media_json'" : 'NULL')); + $id = mysqli_insert_id($mysqli); + mysqli_query($mysqli, "UPDATE sms_providers SET sms_provider_last_inbound_at = NOW() WHERE sms_provider_id = " . intval($provider['sms_provider_id'])); + + $done = function ($status, $set = '', $ticket_id = 0) use ($mysqli, $id) { + mysqli_query($mysqli, "UPDATE sms_messages SET sms_message_status = '$status'" . ($set !== '' ? ", $set" : '') . " WHERE sms_message_id = $id"); + return ['status' => $status, 'id' => $id, 'ticket_id' => intval($ticket_id)]; + }; + + $conversation = smsConversationTicket($from); + + // STOP, START, HELP - answered, and nothing else + $keyword = smsKeyword($text); + if ($keyword === '' && strtoupper(trim($text, " .!\n")) === 'YES' && smsOptedOut($from)) { + $keyword = 'start'; + } + // YES to being asked whether texts are all right - they agreed + if ($keyword === '' && preg_match('/^\s*(yes|y|yes please|ok|okay|sure)\s*[.!]*\s*$/i', $text) && ($asked = smsOptInPending($from))) { + smsOptInSet(intval($asked['contact_id']), true, 'them, by replying YES when asked by text'); + $queued = smsQueue($from, smsCompanyName() . ": thanks - you'll get texts about your tickets, visits and invoices. Reply STOP any time to stop them, HELP for help.", + ['purpose' => 'opt_in', 'contact_id' => intval($asked['contact_id']), 'client_id' => intval($asked['contact_client_id'])]); + if ($queued['ids']) { + smsSendNow($queued['ids']); + } + logAudit('Text Message', 'Edit', escapeSql($asked['contact_name'] . ' (' . smsNumberText($from) . ') replied YES and agreed to texts'), intval($asked['contact_client_id'])); + return $done('keyword', 'sms_message_contact_id = ' . intval($asked['contact_id']) . ', sms_message_client_id = ' . intval($asked['contact_client_id'])); + } + if ($keyword !== '') { + smsKeywordAnswer($keyword, $from, $conversation); + return $done('keyword', $conversation ? 'sms_message_ticket_id = ' . intval($conversation['ticket_id']) : '', $conversation['ticket_id'] ?? 0); + } + + if (smsBlocked($from)) { + return $done('spam'); + } + + $to_tickets = intval($settings['config_ticket_sms_parse']) === 1; + + // Texting on a ticket - a reply on it + if ($to_tickets && $conversation) { + $reply_id = smsTicketReply($id, $conversation, $from, $text, $media); + return $done('ticket', "sms_message_ticket_id = " . intval($conversation['ticket_id']) . ", sms_message_ticket_reply_id = " . intval($reply_id) + . ", sms_message_client_id = " . intval($conversation['ticket_client_id']), $conversation['ticket_id']); + } + + // A contact - a new ticket for them + $contacts = smsContactsFor($from); + if ($to_tickets && $contacts) { + $contact = $contacts[0]; + $ticket_id = smsTicketOpen($id, $from, $text, $media, intval($contact['contact_id']), intval($contact['contact_client_id'])); + return $done('ticket', "sms_message_ticket_id = $ticket_id, sms_message_contact_id = " . intval($contact['contact_id']) . ", sms_message_client_id = " . intval($contact['contact_client_id']), $ticket_id); + } + + // A verification code - kept out of tickets, for those who can see credentials + $code = smsVerificationCode($text); + if ($code !== '' && !$contacts) { + return $done('code', "sms_message_code = '" . escapeSql($code) . "'"); + } + + if (!$contacts && smsLooksLikeSpam($text)) { + return $done('spam'); + } + + if ($to_tickets && intval($settings['config_ticket_sms_unknown_senders']) === 1 && !$contacts) { + $ticket_id = smsTicketOpen($id, $from, $text, $media, 0, 0); + return $done('ticket', "sms_message_ticket_id = $ticket_id", $ticket_id); + } + + // For an agent to look at - told once an hour a number, not for every text + $earlier = intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM sms_messages WHERE sms_message_direction = 'in' AND sms_message_number = '$number_esc' + AND sms_message_status = 'unmatched' AND sms_message_created_at > NOW() - INTERVAL 1 HOUR AND sms_message_id <> $id"))[0]); + $result = $done('unmatched', $contacts ? 'sms_message_contact_id = ' . intval($contacts[0]['contact_id']) . ', sms_message_client_id = ' . intval($contacts[0]['contact_client_id']) : ''); + if (!$earlier) { + $who = $contacts ? $contacts[0]['contact_name'] : smsNumberText($from); + appNotify('Text Message', escapeSql("A text from $who is waiting in Texts"), '/agent/texts.php', $contacts ? intval($contacts[0]['contact_client_id']) : 0); + } + return $result; +} + +/* The ticket a number is texting on - the last one a text to or from it went on, in SMS_CONVERSATION_DAYS, still open - or null */ +function smsConversationTicket(string $number): ?array +{ + global $mysqli; + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT ticket_id, ticket_client_id, ticket_contact_id, ticket_status, ticket_closed_at + FROM sms_messages + JOIN tickets ON ticket_id = sms_message_ticket_id + WHERE sms_message_number = '" . escapeSql($number) . "' AND sms_message_ticket_id > 0 + AND sms_message_created_at > NOW() - INTERVAL " . SMS_CONVERSATION_DAYS . " DAY + AND ticket_archived_at IS NULL + ORDER BY sms_message_id DESC LIMIT 1")); + return $row && empty($row['ticket_closed_at']) ? $row : null; +} + +/* Answer STOP, START or HELP - and say so on the ticket they text on */ +function smsKeywordAnswer(string $keyword, string $number, ?array $conversation): void +{ + global $mysqli; + + $company = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT company_name, company_phone, company_phone_country_code, company_email FROM companies WHERE company_id = 1")) ?: []; + $name = trim((string) ($company['company_name'] ?? '')) ?: 'Support'; + $ticket_id = intval($conversation['ticket_id'] ?? 0); + $meta = ['purpose' => 'keyword', 'ticket_id' => $ticket_id, 'client_id' => intval($conversation['ticket_client_id'] ?? 0), 'force' => true]; + $contacts = smsContactsFor($number); + $who = ($contacts ? $contacts[0]['contact_name'] . ' (' . smsNumberText($number) . ')' : smsNumberText($number)); + + if ($keyword === 'stop') { + smsNumberSet($number, ['opted_out_at' => 'NOW()']); + $answer = "$name: you won't get any more texts from us. Reply START to get them again."; + $note = "$who replied STOP - they get no more texts until they reply START."; + logAudit('Text Message', 'Edit', escapeSql("$who replied STOP and was opted out of texts"), intval($conversation['ticket_client_id'] ?? 0), $ticket_id); + } elseif ($keyword === 'start') { + smsNumberSet($number, ['opted_out_at' => null]); + $answer = "$name: texts from us are back on. Reply STOP to stop them, HELP for help."; + $note = "$who replied START - texts to them are back on."; + logAudit('Text Message', 'Edit', escapeSql("$who replied START and was opted back in to texts"), intval($conversation['ticket_client_id'] ?? 0), $ticket_id); + } else { + $ways = []; + if (trim((string) ($company['company_phone'] ?? '')) !== '') { + $ways[] = 'call ' . formatPhoneNumber($company['company_phone'], $company['company_phone_country_code'] ?? ''); + } + if (filter_var($company['company_email'] ?? '', FILTER_VALIDATE_EMAIL)) { + $ways[] = 'email ' . $company['company_email']; + } + $answer = "$name support" . ($ways ? ': ' . implode(' or ', $ways) : '') . '. Reply STOP to stop texts.'; + $note = ''; + } + + $queued = smsQueue($number, $answer, $meta); + if ($queued['ids']) { + smsSendNow($queued['ids']); + } + if ($note !== '' && $ticket_id) { + mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = '" . smsSql('

    ' . escapeHtml($note) . '

    ') . "', ticket_reply_type = 'Internal', ticket_reply_time_worked = '00:00:00', ticket_reply_by = 0, ticket_reply_ticket_id = $ticket_id"); + } +} + +/* A text's words as a reply or a ticket's details - its lines kept, nothing in it taken as HTML */ +function smsTextHtml(string $text): string +{ + return $text === '' ? '' : '

    ' . nl2br(escapeHtml($text)) . '

    '; +} + +/* + * Open a ticket from a text - for a contact, a client, or no client (from someone you don't + * know). $by is the agent opening it from Texts (0: it came in), who isn't texted the number; + * $more_ids, other texts from the number that go on it with this one. Its id. + */ +function smsTicketOpen(int $message_id, string $from, string $text, array $media, int $contact_id, int $client_id, string $subject = '', int $by = 0, array $more_ids = []): int +{ + global $mysqli; + + $settings = smsTicketSettings(); + $config_ticket_prefix = (string) $settings['config_ticket_prefix']; + + mysqli_query($mysqli, "UPDATE settings SET config_ticket_next_number = LAST_INSERT_ID(config_ticket_next_number), config_ticket_next_number = config_ticket_next_number + 1 WHERE company_id = 1"); + $ticket_number = mysqli_insert_id($mysqli); + + $contact_name = $contact_id ? trim((string) getFieldById('contacts', $contact_id, 'contact_name')) : ''; + $who = $contact_name !== '' ? $contact_name : smsNumberText($from); + if (trim($subject) === '') { + $first_line = trim(strtok($text, "\n") ?: ''); + $subject = $first_line !== '' ? mb_strimwidth($first_line, 0, 80, '...') : "Text from $who"; + } + $prefix = escapeSql($config_ticket_prefix); + $details = smsSql(smsTextHtml($text !== '' ? $text : '(A photo or file, attached)')); + $url_key = randomString(32); + $billable = intval($settings['config_ticket_default_billable']) ? 1 : 0; + + mysqli_query($mysqli, "INSERT INTO tickets SET ticket_prefix = '$prefix', ticket_number = $ticket_number, ticket_source = 'Text', ticket_subject = '" . escapeSql(mb_substr($subject, 0, 500)) . "', + ticket_details = '$details', ticket_priority = 'Medium', ticket_status = 1, ticket_billable = $billable, ticket_created_by = " . intval($by) . ", + ticket_contact_id = $contact_id, ticket_url_key = '$url_key', ticket_client_id = $client_id"); + $ticket_id = mysqli_insert_id($mysqli); + applyTicketSla($ticket_id); + $ids = implode(',', array_unique(array_merge([intval($message_id)], array_map('intval', $more_ids)))); + mysqli_query($mysqli, "UPDATE sms_messages SET sms_message_ticket_id = $ticket_id, sms_message_contact_id = $contact_id, sms_message_client_id = $client_id WHERE sms_message_id IN ($ids)"); + + if ($media) { + smsSaveMedia($media, $ticket_id, null, $message_id); + } + + $reference = $config_ticket_prefix . $ticket_number; + logAudit('Ticket', 'Create', escapeSql($by ? "Text: ticket $reference was opened from a text from $who ($subject)" : "Text: $who texted in and ticket $reference was opened ($subject)"), $client_id, $ticket_id); + logTicketHistory($ticket_id, escapeSql("Opened from a text from $who" . ($contact_name !== '' ? ' (' . smsNumberText($from) . ')' : ''))); + + // The new-ticket address and the client's contacts who hear about new tickets - by email, as for any other + ticketMailNewTicketAddress($ticket_id, 'text'); + ticketMailColleaguesNew($ticket_id); + triggerCustomAction('ticket_create', $ticket_id); + + // They're texted back the number - so they know it landed, and that replying adds to it + if (!$by && intval($settings['config_ticket_sms_acknowledge']) === 1 && smsNumberIsPhone($from)) { + $company = trim((string) (mysqli_fetch_row(mysqli_query($mysqli, "SELECT company_name FROM companies WHERE company_id = 1"))[0] ?? '')); + $queued = smsQueue($from, ($company !== '' ? "$company: " : '') . "thanks, we got your text and opened ticket $reference. Reply here to add to it.", + ['purpose' => 'acknowledge', 'ticket_id' => $ticket_id, 'contact_id' => $contact_id, 'client_id' => $client_id]); + if ($queued['ids']) { + smsSendNow($queued['ids']); + } + } + return $ticket_id; +} + +/* A text on the ticket it is texting on - a client reply, its photos with it, the ticket opened again. The reply's id */ +function smsTicketReply(int $message_id, array $conversation, string $from, string $text, array $media): int +{ + global $mysqli; + + $ticket_id = intval($conversation['ticket_id']); + $row = ticketRow($ticket_id); + $client_id = intval($row['ticket_client_id']); + + // Who it is - the ticket's contact, or another of the client's contacts with the number + $contact_id = 0; + foreach (smsContactsFor($from) as $contact) { + if (intval($contact['contact_id']) === intval($row['ticket_contact_id'])) { + $contact_id = intval($contact['contact_id']); + break; + } + if (!$contact_id && intval($contact['contact_client_id']) === $client_id) { + $contact_id = intval($contact['contact_id']); + } + } + $who = $contact_id ? (string) getFieldById('contacts', $contact_id, 'contact_name') : smsNumberText($from); + + $html = smsTextHtml($text !== '' ? $text : '(A photo or file, attached)'); + mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = '" . smsSql($html) . "', ticket_reply_type = 'Client', ticket_reply_time_worked = '00:00:00', ticket_reply_by = $contact_id, ticket_reply_ticket_id = $ticket_id"); + $reply_id = mysqli_insert_id($mysqli); + mysqli_query($mysqli, "UPDATE sms_messages SET sms_message_contact_id = $contact_id WHERE sms_message_id = " . intval($message_id)); + if ($media) { + smsSaveMedia($media, $ticket_id, $reply_id, $message_id); + } + + // Back to Open - unless it is in a status of your own set to stay put when the client replies + $status = intval($row['ticket_status']); + $new_status = ticketStatusAfterClientReply($status); + mysqli_query($mysqli, "UPDATE tickets SET ticket_status = $new_status, ticket_resolved_at = NULL, ticket_updated_at = NOW() WHERE ticket_id = $ticket_id"); + resetTicketResolutionSla($ticket_id); + logTicketHistory($ticket_id, escapeSql("$who replied by text" . ($new_status !== $status ? ', reopening the ticket' : ''))); + logAudit('Ticket', 'Edit', escapeSql("Text: $who replied by text on ticket " . ticketReference($row)), $client_id, $ticket_id); + + // The agent it is assigned to - in ITFlow and by email, with what they wrote + $assigned = intval($row['ticket_assigned_to']); + if ($assigned) { + mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = 'Ticket', notification = '" . escapeSql("$who replied by text on Ticket " . ticketReference($row) . " - " . $row['ticket_subject']) . "', + notification_action = '" . escapeSql('/agent/' . ticketUrl($ticket_id, $client_id)) . "', notification_client_id = $client_id, notification_user_id = $assigned"); + } + ticketMailAssigneeReplied($ticket_id, 'text', $html, $who); + triggerCustomAction('ticket_reply_client', $ticket_id); + return $reply_id; +} + +/* + * Fetch the photos and files a text brought and keep them on the ticket - on a reply, or on + * the ticket itself. Only https, only to a public address, each at most SMS_MEDIA_MAX_BYTES, + * only the kinds a ticket takes. What couldn't be fetched is noted on the text. How many were kept. + */ +function smsSaveMedia(array $urls, int $ticket_id, ?int $reply_id, int $message_id): int +{ + global $mysqli; + + $types = ['image/jpeg' => 'jpg', 'image/jpg' => 'jpg', 'image/png' => 'png', 'image/gif' => 'gif', 'image/webp' => 'webp', 'application/pdf' => 'pdf', + 'text/plain' => 'txt', 'text/csv' => 'csv', 'video/mp4' => 'mp4', 'video/quicktime' => 'mov', 'audio/mpeg' => 'mp3', 'audio/mp3' => 'mp3', + 'audio/wav' => 'wav', 'audio/x-wav' => 'wav', 'audio/ogg' => 'ogg', 'application/zip' => 'zip', 'application/json' => 'json']; + $dir = dirname(__DIR__) . "/uploads/tickets/$ticket_id/"; + mkdirMissing(dirname(__DIR__) . '/uploads/tickets/'); + mkdirMissing($dir); + + $kept = 0; + $missed = []; + foreach (array_slice($urls, 0, SMS_MEDIA_MAX_FILES) as $i => $url) { + $host = parse_url($url, PHP_URL_HOST); + $ip = $host ? gethostbyname($host) : ''; + if (!preg_match('#^https://#i', $url) || !filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) { + $missed[] = 'one at an address ITFlow won\'t fetch from'; + continue; + } + $data = ''; + $ch = curl_init($url); + curl_setopt_array($ch, [ + CURLOPT_RETURNTRANSFER => false, + CURLOPT_TIMEOUT => 20, + CURLOPT_CONNECTTIMEOUT => 10, + CURLOPT_USERAGENT => 'ITFlow', + CURLOPT_PROTOCOLS => CURLPROTO_HTTPS, + CURLOPT_FOLLOWLOCATION => false, + CURLOPT_WRITEFUNCTION => function ($ch, $chunk) use (&$data) { + $data .= $chunk; + return strlen($data) > SMS_MEDIA_MAX_BYTES ? 0 : strlen($chunk); + }, + ]); + $ok = curl_exec($ch); + $code = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE); + $type = strtolower(trim(explode(';', (string) curl_getinfo($ch, CURLINFO_CONTENT_TYPE))[0])); + curl_close($ch); + if (strlen($data) > SMS_MEDIA_MAX_BYTES) { + $missed[] = 'one over ' . round(SMS_MEDIA_MAX_BYTES / 1048576) . ' MB'; + continue; + } + if (!$ok || $code !== 200 || $data === '') { + $missed[] = "one that couldn't be fetched" . ($code ? " ($code)" : ''); + continue; + } + $extension = $types[$type] ?? strtolower(pathinfo((string) parse_url($url, PHP_URL_PATH), PATHINFO_EXTENSION)); + if ($extension === 'jpeg') { + $extension = 'jpg'; + } + if (!in_array($extension, TICKET_ATTACHMENT_EXTENSIONS, true)) { + $missed[] = 'a kind of file a ticket doesn\'t take' . ($type !== '' ? " ($type)" : ''); + continue; + } + $stored = bin2hex(random_bytes(16)) . ".$extension"; + if (file_put_contents($dir . $stored, $data) === false) { + $missed[] = "one that couldn't be saved"; + continue; + } + $name = escapeSql('Texted ' . (str_starts_with($type, 'image/') ? 'photo' : 'file') . ' ' . ($i + 1) . ".$extension"); + mysqli_query($mysqli, "INSERT INTO ticket_attachments SET ticket_attachment_name = '$name', ticket_attachment_reference_name = '$stored', + ticket_attachment_reply_id = " . ($reply_id === null ? 'NULL' : intval($reply_id)) . ", ticket_attachment_ticket_id = $ticket_id"); + $kept++; + } + if ($missed) { + mysqli_query($mysqli, "UPDATE sms_messages SET sms_message_error = '" . escapeSql(mb_substr('Not kept on the ticket: ' . implode(', ', $missed), 0, 500)) . "' WHERE sms_message_id = " . intval($message_id)); + } + return $kept; +} + +/* ------------------------------------------------------------------ The Texts inbox */ + +/* Its tabs - label, icon, which texts - and whether the person looking may see each */ +function smsInboxTabs(): array +{ + return [ + 'unmatched' => ['Unmatched', 'fa-question-circle', "sms_message_status = 'unmatched'", lookupUserPermission('module_support') >= 1], + 'codes' => ['Codes', 'fa-key', "sms_message_status = 'code'", lookupUserPermission('module_credential') >= 1], + 'spam' => ['Spam', 'fa-ban', "sms_message_status = 'spam'", lookupUserPermission('module_support') >= 1], + ]; +} + +/* How many texts wait in Unmatched - and codes still fresh, for those who may see them - for the side nav. 0 before texting is set up */ +function smsInboxWaiting(): int +{ + global $mysqli; + if (!smsProvider()) { + return 0; + } + $where = ["sms_message_status = 'unmatched'"]; + if (lookupUserPermission('module_credential') >= 1) { + $where[] = "(sms_message_status = 'code' AND sms_message_created_at > NOW() - INTERVAL " . SMS_CODE_MASK_MINUTES . " MINUTE)"; + } + try { + return intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM sms_messages WHERE sms_message_direction = 'in' AND (" . implode(' OR ', $where) . ")"))[0]); + } catch (Throwable $e) { + return 0; + } +} + +/* Whether a code can still be revealed - SMS_CODE_MASK_MINUTES after it came, and while it's kept */ +function smsCodeFresh(array $row): bool +{ + return ($row['sms_message_status'] ?? '') === 'code' && (string) ($row['sms_message_code'] ?? '') !== '' + && strtotime($row['sms_message_created_at']) > time() - SMS_CODE_MASK_MINUTES * 60; +} + +/* A code masked - its length kept, so it can be told apart from the next */ +function smsCodeMasked(string $code): string +{ + return preg_replace('/[0-9A-Za-z]/', '•', $code); +} + +/* One inbound text by id - raw, or null */ +function smsMessageRow($message_id): ?array +{ + global $mysqli; + $message_id = intval($message_id); + try { + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM sms_messages WHERE sms_message_id = $message_id LIMIT 1")); + } catch (Throwable $e) { + return null; + } + return $row ?: null; +} + +/* + * Tidy the log - from the Text Messages job. A code's text is wiped SMS_CODE_KEEP_HOURS after + * it came (that one came from that sender is kept); spam and dismissed texts go after + * SMS_SPAM_KEEP_DAYS, everything after SMS_KEEP_DAYS. + */ +function smsTidy(): void +{ + global $mysqli; + mysqli_query($mysqli, "UPDATE sms_messages SET sms_message_body = NULL, sms_message_code = NULL, sms_message_media = NULL, sms_message_error = 'The code was wiped a day after it came' + WHERE sms_message_status = 'code' AND sms_message_body IS NOT NULL AND sms_message_created_at < NOW() - INTERVAL " . SMS_CODE_KEEP_HOURS . " HOUR"); + mysqli_query($mysqli, "DELETE FROM sms_messages WHERE sms_message_status IN ('spam', 'dismissed') AND sms_message_created_at < NOW() - INTERVAL " . SMS_SPAM_KEEP_DAYS . " DAY"); + mysqli_query($mysqli, "DELETE FROM sms_messages WHERE sms_message_created_at < NOW() - INTERVAL " . SMS_KEEP_DAYS . " DAY"); +} + +/* ------------------------------------------------------------------ The log */ + +/* Texts that didn't go in the last week - for the side nav. 0 before the tables exist */ +function smsFailedRecently(): int +{ + global $mysqli; + try { + return intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM sms_messages WHERE sms_message_direction = 'out' AND sms_message_status = 'failed' AND sms_message_created_at > NOW() - INTERVAL 7 DAY"))[0]); + } catch (Throwable $e) { + return 0; + } +} + +/* Maintenance > Text Messages' tabs - label, icon, which texts */ +function smsLogTabs(): array +{ + return [ + '' => ['All', 'fa-list', '1'], + 'waiting' => ['Waiting', 'fa-hourglass-half', "sms_message_direction = 'out' AND sms_message_status IN ('queued', 'sending')"], + 'failed' => ['Failed', 'fa-exclamation-triangle', "sms_message_direction = 'out' AND sms_message_status IN ('failed', 'blocked')"], + 'sent' => ['Sent', 'fa-paper-plane', "sms_message_direction = 'out' AND sms_message_status = 'sent'"], + 'received' => ['Received', 'fa-inbox', "sms_message_direction = 'in'"], + ]; +} + +/* How a text stands, for the log - key, label, badge, icon, and why when it didn't go */ +function smsLogState(array $row): array +{ + $states = [ + 'queued' => ['Waiting', 'text-bg-light border', 'fa-hourglass-half'], + 'sending' => ['Sending', 'text-bg-info', 'fa-spinner'], + 'sent' => ['Sent', 'text-bg-success', 'fa-check'], + 'failed' => ['Failed', 'text-bg-danger', 'fa-exclamation-triangle'], + 'blocked' => ['Not sent', 'text-bg-warning', 'fa-hand-paper'], + 'cancelled' => ['Cancelled', 'text-bg-secondary', 'fa-ban'], + 'ticket' => ['On a ticket', 'text-bg-primary', 'fa-life-ring'], + 'unmatched' => ['In Texts', 'text-bg-warning', 'fa-question-circle'], + 'code' => ['Code', 'text-bg-dark', 'fa-key'], + 'spam' => ['Spam', 'text-bg-secondary', 'fa-ban'], + 'keyword' => ['Keyword', 'text-bg-light border', 'fa-hand-paper'], + 'dismissed' => ['Dismissed', 'text-bg-light border', 'fa-check'], + 'received' => ['Received', 'text-bg-light border', 'fa-inbox'], + ]; + $status = (string) $row['sms_message_status']; + [$label, $badge, $icon] = $states[$status] ?? [ucfirst($status), 'text-bg-light border', 'fa-circle']; + $error = trim((string) $row['sms_message_error']); + // Waiting for the morning - says when + if ($status === 'queued' && !empty($row['sms_message_send_after']) && strtotime($row['sms_message_send_after']) > time() && $error === '') { + $error = 'Waiting until ' . date('g:ia', strtotime($row['sms_message_send_after'])) . ' - it would land at night'; + } + return ['key' => $status, 'label' => $label, 'badge' => $badge, 'icon' => $icon, 'error' => $error]; +} + +/* A text's words as the log shows them - a code masked, a wiped one said so */ +function smsLogBody(array $row): string +{ + $body = (string) $row['sms_message_body']; + if ($row['sms_message_status'] === 'code') { + if ($row['sms_message_body'] === null) { + return '(A verification code - wiped a day after it came)'; + } + $code = (string) $row['sms_message_code']; + return $code !== '' ? str_replace($code, smsCodeMasked($code), $body) : $body; + } + return $body; +} + +/* What a text ITFlow sent by itself was for, in words - '' for a reply an agent wrote */ +function smsPurposeText(string $purpose): string +{ + return [ + 'acknowledge' => 'The ticket number, for a new ticket', 'keyword' => 'The answer to STOP, START or HELP', 'test' => 'A test', + 'notify_opened' => 'Their ticket was opened', 'notify_resolved' => 'Their ticket was resolved', 'notify_replied' => 'A reply was emailed to them', + 'notify_scheduled' => 'A visit or call was booked', 'notify_unscheduled' => 'A visit or call was cancelled', 'reminder' => 'A reminder of a visit or call', + 'invoice' => 'An invoice, with its link', 'invoice_reminder' => 'A payment reminder, with its link', + 'opt_in_request' => 'Asking whether texts are all right', 'opt_in' => 'Thanks for agreeing to texts', + ][$purpose] ?? ''; +} + +/* What can be done with a text in the log - retry a failed one, cancel a waiting one, delete one that isn't being sent */ +function smsLogCan(array $row, string $action): bool +{ + $status = (string) $row['sms_message_status']; + $out = $row['sms_message_direction'] === 'out'; + if ($action === 'retry') { + return $out && in_array($status, ['failed', 'cancelled'], true); + } + if ($action === 'cancel') { + return $out && $status === 'queued'; + } + return $status !== 'sending'; +} + +/* ------------------------------------------------------------------ On tickets */ + +/* + * Each reply's texts on a ticket - [reply id => ['direction', 'status', 'number', 'error', 'parts']] - + * for the conversation: "Texted to ..." and whether it went, or "By text" on one that came in. + */ +function smsRepliesForTicket(int $ticket_id): array +{ + global $mysqli; + $states = []; + try { + $sql = mysqli_query($mysqli, "SELECT sms_message_ticket_reply_id, sms_message_direction, sms_message_status, sms_message_number, sms_message_error + FROM sms_messages WHERE sms_message_ticket_id = " . intval($ticket_id) . " AND sms_message_ticket_reply_id > 0 ORDER BY sms_message_id ASC"); + } catch (Throwable $e) { + return []; + } + $rank = ['failed' => 5, 'blocked' => 4, 'queued' => 3, 'sending' => 2, 'sent' => 1]; + while ($row = mysqli_fetch_assoc($sql)) { + $reply_id = intval($row['sms_message_ticket_reply_id']); + $state = $states[$reply_id] ?? ['direction' => $row['sms_message_direction'], 'status' => $row['sms_message_status'], 'number' => $row['sms_message_number'], 'error' => '', 'parts' => 0]; + $state['parts']++; + // The worst of its parts is how it stands + if (($rank[$row['sms_message_status']] ?? 0) > ($rank[$state['status']] ?? 0)) { + $state['status'] = $row['sms_message_status']; + } + if ((string) $row['sms_message_error'] !== '' && $state['error'] === '') { + $state['error'] = (string) $row['sms_message_error']; + } + $states[$reply_id] = $state; + } + return $states; +} + +/* How a text reply stands, for the line under it - [icon, words, tone] */ +function smsReplyStateText(array $state): array +{ + $to = smsNumberText($state['number']); + $parts = $state['parts'] > 1 ? ' (' . $state['parts'] . ' texts)' : ''; + switch ($state['status']) { + case 'sent': + return ['fa-check', "Texted to $to$parts", 'text-body-secondary']; + case 'queued': + case 'sending': + return ['fa-hourglass-half', "Texting $to$parts - waiting to go", 'text-body-secondary']; + case 'blocked': + return ['fa-ban', "Not texted to $to - they replied STOP", 'text-danger-emphasis']; + default: + return ['fa-exclamation-triangle', "Not texted to $to" . ($state['error'] !== '' ? ' - ' . $state['error'] : ''), 'text-danger-emphasis']; + } +} + +/* + * Who a text reply on a ticket goes to - ['number', 'name', 'opted_out'] - or null: its + * contact's mobile, else the number it is texting on (someone you don't know). + */ +function smsTicketRecipient(array $ticket): ?array +{ + global $mysqli; + if (!smsReady()) { + return null; + } + $number = ''; + $name = ''; + $contact_id = intval($ticket['ticket_contact_id'] ?? 0); + if ($contact_id) { + $contact = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT contact_name, contact_mobile, contact_mobile_country_code FROM contacts WHERE contact_id = $contact_id AND contact_archived_at IS NULL")); + if ($contact) { + $number = smsContactNumber($contact); + $name = (string) $contact['contact_name']; + } + } + if ($number === '') { + $last = mysqli_fetch_row(mysqli_query($mysqli, "SELECT sms_message_number FROM sms_messages WHERE sms_message_ticket_id = " . intval($ticket['ticket_id']) . " AND sms_message_direction = 'in' ORDER BY sms_message_id DESC LIMIT 1")); + $number = smsNumberIsPhone((string) ($last[0] ?? '')) ? (string) $last[0] : ''; + } + if ($number === '') { + return null; + } + return ['number' => $number, 'name' => $name, 'opted_out' => smsOptedOut($number)]; +} + +/* + * Text a reply on a ticket to who it goes to (smsTicketRecipient()) - now, the rest by the job + * when it is long. ['ok' => went, 'queued' => waiting to go, 'to' => who, for reading, 'error']. + */ +function smsTicketReplySend(array $ticket, int $reply_id, string $html, int $user_id): array +{ + $recipient = smsTicketRecipient($ticket); + if (!$recipient) { + return ['ok' => false, 'queued' => false, 'to' => '', 'error' => smsReady() ? "there's no mobile number on its contact to text" : "texting isn't set up"]; + } + $to = ($recipient['name'] !== '' ? $recipient['name'] . ' at ' : '') . smsNumberText($recipient['number']); + $text = smsTextFromHtml($html); + if ($text === '') { + return ['ok' => false, 'queued' => false, 'to' => $to, 'error' => 'there are no words in it to text']; + } + $queued = smsQueue($recipient['number'], $text, ['purpose' => 'reply', 'ticket_id' => intval($ticket['ticket_id']), 'ticket_reply_id' => $reply_id, + 'contact_id' => intval($ticket['ticket_contact_id']), 'client_id' => intval($ticket['ticket_client_id']), 'user_id' => $user_id]); + if ($queued['error'] !== '') { + return ['ok' => false, 'queued' => false, 'to' => $to, 'error' => $queued['error']]; + } + $sent = smsSendNow($queued['ids']); + $waiting = count($queued['ids']) - $sent['sent']; + return ['ok' => $waiting === 0, 'queued' => $waiting > 0 && smsQueuedStill($queued['ids']), 'to' => $to, 'error' => $sent['error']]; +} + +/* Whether any of these texts is still waiting to go - tried, and to be tried again */ +function smsQueuedStill(array $ids): bool +{ + global $mysqli; + $ids = array_filter(array_map('intval', $ids)); + if (!$ids) { + return false; + } + return intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM sms_messages WHERE sms_message_id IN (" . implode(',', $ids) . ") AND sms_message_status = 'queued'"))[0]) > 0; +} + +/* ------------------------------------------------------------------ Texts to clients */ + +/* Whether a table has a column yet - the texts to clients arrive with the 3.6.1 database update. Asked once a request */ +function smsColumnExists(string $table, string $column): bool +{ + global $mysqli; + static $known = []; + $key = "$table.$column"; + if (!isset($known[$key])) { + $result = mysqli_query($mysqli, "SELECT 1 FROM information_schema.COLUMNS WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = '" . escapeSql($table) . "' AND COLUMN_NAME = '" . escapeSql($column) . "' LIMIT 1"); + $known[$key] = $result && mysqli_num_rows($result) > 0; + } + return $known[$key]; +} + +/* Your company's name, as texts start with it */ +function smsCompanyName(): string +{ + global $mysqli; + static $name = null; + if ($name === null) { + $name = trim((string) (mysqli_fetch_row(mysqli_query($mysqli, "SELECT company_name FROM companies WHERE company_id = 1"))[0] ?? '')); + if ($name === '') { + $name = 'Support'; + } + } + return $name; +} + +/* Settings > Notifications > Texts to clients - read where they're used */ +function smsClientSettings(): array +{ + global $mysqli; + $settings = ['config_sms_client_tickets' => 1, 'config_sms_client_visits' => 1, 'config_sms_visit_reminder_hours' => 24, 'config_sms_client_invoices' => 1]; + if (!smsColumnExists('settings', 'config_sms_client_tickets')) { + return array_map(function () { return 0; }, $settings); + } + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT config_sms_client_tickets, config_sms_client_visits, config_sms_visit_reminder_hours, config_sms_client_invoices FROM settings WHERE company_id = 1")); + return array_map('intval', array_merge($settings, $row ?: [])); +} + +/* The reminder choices on Settings > Notifications - hours before a visit or call */ +function smsReminderChoices(): array +{ + return [0 => 'No reminder', 1 => 'An hour before', 2 => 'Two hours before', 4 => 'Four hours before', 24 => 'The day before']; +} + +/* + * When a text ITFlow sends a client by itself may go - null for now, or the next morning when it + * is night (SMS_QUIET_FROM to SMS_QUIET_UNTIL, your time). $before: what it's about starts then + * (a visit) - when the morning is too late for it, now. + */ +function smsSendAfter(?int $before = null): ?string +{ + $hour = intval(date('G')); + if ($hour >= SMS_QUIET_UNTIL && $hour < SMS_QUIET_FROM) { + return null; + } + $morning = strtotime(($hour >= SMS_QUIET_FROM ? 'tomorrow' : 'today') . ' ' . sprintf('%02d:00', SMS_QUIET_UNTIL)); + if ($before !== null && $morning >= $before - 15 * 60) { + return null; + } + return date('Y-m-d H:i:s', $morning); +} + +/* + * A contact who can be texted about their work - agreed to texts, has a mobile, didn't reply + * STOP, isn't archived - with 'number' added. Null otherwise. + */ +function smsContactTextable(int $contact_id): ?array +{ + global $mysqli; + if (!$contact_id || !smsReady() || !smsColumnExists('contacts', 'contact_sms_opt_in')) { + return null; + } + $contact = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT contact_id, contact_name, contact_client_id, contact_mobile, contact_mobile_country_code, contact_sms_opt_in + FROM contacts WHERE contact_id = $contact_id AND contact_archived_at IS NULL")); + if (!$contact || !intval($contact['contact_sms_opt_in'])) { + return null; + } + $contact['number'] = smsContactNumber($contact); + return $contact['number'] !== '' && !smsOptedOut($contact['number']) ? $contact : null; +} + +/* Queue a text to a contact who agreed to texts - at night, for the morning. Whether it was queued */ +function smsNotifyContact(int $contact_id, string $text, array $meta, ?int $before = null): bool +{ + $contact = smsContactTextable($contact_id); + if (!$contact) { + return false; + } + $queued = smsQueue($contact['number'], $text, $meta + ['contact_id' => $contact_id, 'client_id' => intval($contact['contact_client_id']), 'send_after' => smsSendAfter($before)]); + return (bool) $queued['ids'] && $queued['error'] === ''; +} + +/* A ticket's subject, short enough for a text */ +function smsTicketSubject(array $row): string +{ + return mb_strimwidth(trim((string) $row['ticket_subject']), 0, 60, '...'); +} + +/* When a visit is, as a text says it - "today at 2:00pm", "tomorrow at 9:30am", "on Tue, Nov 10 at 2:00pm" */ +function smsWhenText(string $datetime): string +{ + $at = strtotime($datetime); + $time = date('g:ia', $at); + if (date('Y-m-d', $at) === date('Y-m-d')) { + return "today at $time"; + } + if (date('Y-m-d', $at) === date('Y-m-d', strtotime('tomorrow'))) { + return "tomorrow at $time"; + } + return 'on ' . date('D, M j', $at) . " at $time"; +} + +/* + * A ticket's contact told by text, from triggerCustomAction(): ticket_create (opened for them - + * not one that came in by text, which was answered already), ticket_resolve, ticket_schedule and + * ticket_unschedule. Each as Settings > Notifications > Texts to clients has it, and only to a + * contact who agreed. Their reply goes on the ticket. + */ +function smsClientNotify(string $trigger, $ticket_id): void +{ + if (!smsReady()) { + return; + } + $row = ticketRow($ticket_id); + if (!$row || !intval($row['ticket_contact_id'])) { + return; + } + $settings = smsClientSettings(); + $reference = ticketReference($row); + $company = smsCompanyName(); + $meta = ['ticket_id' => intval($row['ticket_id'])]; + $text = ''; + $before = null; + + if ($trigger === 'ticket_create' && $settings['config_sms_client_tickets'] && $row['ticket_source'] !== 'Text') { + $text = "$company: we opened ticket $reference for you - " . smsTicketSubject($row) . ". Reply to this text to add to it."; + $meta['purpose'] = 'notify_opened'; + } elseif ($trigger === 'ticket_resolve' && $settings['config_sms_client_tickets']) { + $text = "$company: ticket $reference (" . smsTicketSubject($row) . ") is resolved. If it isn't fixed, reply here and we'll pick it up again."; + $meta['purpose'] = 'notify_resolved'; + } elseif ($trigger === 'ticket_schedule' && $settings['config_sms_client_visits'] && !empty($row['ticket_schedule'])) { + $what = intval($row['ticket_onsite']) ? 'A visit' : 'Remote work'; + $who = trim((string) $row['user_name']) !== '' ? ' with ' . strtok(trim((string) $row['user_name']), ' ') : ''; + $text = "$company: $what$who for ticket $reference is booked " . smsWhenText($row['ticket_schedule']) . ". Reply here if that doesn't suit."; + $meta['purpose'] = 'notify_scheduled'; + $before = strtotime($row['ticket_schedule']); + } elseif ($trigger === 'ticket_unschedule' && $settings['config_sms_client_visits']) { + $text = "$company: the time booked for ticket $reference is cancelled - we'll be in touch to book another."; + $meta['purpose'] = 'notify_unscheduled'; + } + if ($text !== '') { + smsNotifyContact(intval($row['ticket_contact_id']), $text, $meta, $before); + } +} + +/* An agent's emailed reply, told by text too - when Texts to clients says each reply. Whether it was */ +function smsTicketReplyNotify(array $row): bool +{ + if (!smsReady() || smsClientSettings()['config_sms_client_tickets'] !== 2) { + return false; + } + return smsNotifyContact(intval($row['ticket_contact_id']), smsCompanyName() . " replied on ticket " . ticketReference($row) . " - see your email. Or reply here to answer by text.", + ['ticket_id' => intval($row['ticket_id']), 'purpose' => 'notify_replied']); +} + +/* + * Reminders of visits and calls booked on tickets - from the Text Messages job, the set hours + * before, to contacts who agreed. Once a booking: not when one went in the reminder's window + * already, nor when the booking itself was texted in it. How many were queued. + */ +function smsVisitReminders(): int +{ + global $mysqli; + $settings = smsClientSettings(); + $hours = $settings['config_sms_visit_reminder_hours']; + if (!smsReady() || !$settings['config_sms_client_visits'] || $hours <= 0) { + return 0; + } + $sql = mysqli_query($mysqli, "SELECT ticket_id FROM tickets + JOIN contacts ON contact_id = ticket_contact_id AND contact_sms_opt_in = 1 AND contact_archived_at IS NULL + WHERE ticket_schedule > NOW() AND ticket_schedule <= NOW() + INTERVAL $hours HOUR + AND ticket_resolved_at IS NULL AND ticket_closed_at IS NULL AND ticket_archived_at IS NULL + AND NOT EXISTS (SELECT 1 FROM sms_messages WHERE sms_message_purpose IN ('reminder', 'notify_scheduled') AND sms_message_ticket_id = ticket_id + AND sms_message_created_at > NOW() - INTERVAL $hours HOUR) + LIMIT 50"); + $queued = 0; + while ($found = mysqli_fetch_row($sql)) { + $row = ticketRow($found[0]); + $who = trim((string) $row['user_name']) !== '' ? strtok(trim((string) $row['user_name']), ' ') : 'we'; + $what = intval($row['ticket_onsite']) ? ($who === 'we' ? 'we are visiting' : "$who is visiting") : ($who === 'we' ? 'we are connecting remotely' : "$who is connecting remotely"); + $text = smsCompanyName() . ": a reminder - $what for ticket " . ticketReference($row) . ' ' . smsWhenText($row['ticket_schedule']) . ". Reply here if that doesn't suit."; + if (smsNotifyContact(intval($row['ticket_contact_id']), $text, ['ticket_id' => intval($row['ticket_id']), 'purpose' => 'reminder'], strtotime($row['ticket_schedule']))) { + $queued++; + } + } + return $queued; +} + +/* + * An invoice, or a reminder of what's owed, texted with its link to the ones of the people it + * was emailed to who agreed to texts - when Texts to clients has invoices on. $kind 'invoice' or + * 'reminder'; $recipients as billingEmailRecipients() gives them. Who it went to, for the + * invoice's history ("Name (+1 ...)"). + */ +function smsInvoiceNotify(array $invoice, string $kind, array $recipients): array +{ + if (!smsReady() || !smsClientSettings()['config_sms_client_invoices']) { + return []; + } + $state = invoiceState($invoice, invoicePaid($invoice['invoice_id'])); + // A draft is being sent as this is asked + if (!in_array($state['state'], ['open', 'overdue', 'draft'], true) || $state['balance'] <= 0) { + return []; + } + $number = billingNumber('invoice', $invoice); + $currency = (string) $invoice['invoice_currency_code']; + $link = billingGuestUrl('invoice', $invoice); + $pay = billingOnlinePayments() ? 'Pay' : 'View it'; + if ($kind === 'reminder') { + $when = $state['days'] < 0 ? abs($state['days']) . ' day' . (abs($state['days']) === 1 ? '' : 's') . ' overdue' : 'due ' . date('M j', strtotime($invoice['invoice_due'])); + $text = smsCompanyName() . ": a reminder - invoice $number has " . billingMoney($state['balance'], $currency) . " still to pay, $when. $pay: $link"; + } else { + $text = smsCompanyName() . ": invoice $number for " . billingMoney($state['balance'], $currency) . ' is due ' . date('M j', strtotime($invoice['invoice_due'])) . ". $pay: $link"; + } + $texted = []; + foreach ($recipients as $recipient) { + $contact = smsContactTextable(intval($recipient['id'] ?? 0)); + if ($contact && smsNotifyContact(intval($contact['contact_id']), $text, ['purpose' => $kind === 'reminder' ? 'invoice_reminder' : 'invoice'])) { + $texted[] = $contact['contact_name'] . ' (' . smsNumberText($contact['number']) . ')'; + } + } + return $texted; +} + +/* + * Turn a contact's texts on or off - $by says how they agreed, for the record ("Alex Rivera, + * with their say-so", "them, in the client portal"). Turned on by the contact themselves, a STOP + * they sent before is lifted: this is them asking again. An agent turning it on doesn't lift one. + */ +function smsOptInSet(int $contact_id, bool $on, string $by, bool $by_them = true): void +{ + global $mysqli; + if (!$contact_id || !smsColumnExists('contacts', 'contact_sms_opt_in')) { + return; + } + if ($on) { + mysqli_query($mysqli, "UPDATE contacts SET contact_sms_opt_in = 1, contact_sms_opt_in_at = NOW(), contact_sms_opt_in_by = '" . escapeSql(mb_substr($by, 0, 200)) . "' WHERE contact_id = $contact_id"); + if ($by_them) { + $contact = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT contact_mobile, contact_mobile_country_code FROM contacts WHERE contact_id = $contact_id")); + $number = $contact ? smsContactNumber($contact) : ''; + if ($number !== '' && smsOptedOut($number)) { + smsNumberSet($number, ['opted_out_at' => null]); + } + } + } else { + mysqli_query($mysqli, "UPDATE contacts SET contact_sms_opt_in = 0, contact_sms_opt_in_at = NULL, contact_sms_opt_in_by = NULL WHERE contact_id = $contact_id"); + } +} + +/* Ask a contact by text whether texts are all right - YES agrees (smsInbound()). ['ok', 'error'] */ +function smsOptInAsk(int $contact_id, int $user_id): array +{ + global $mysqli; + if (!smsReady()) { + return ['ok' => false, 'error' => "texting isn't set up"]; + } + $contact = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT contact_id, contact_name, contact_client_id, contact_mobile, contact_mobile_country_code FROM contacts WHERE contact_id = $contact_id AND contact_archived_at IS NULL")); + $number = $contact ? smsContactNumber($contact) : ''; + if ($number === '') { + return ['ok' => false, 'error' => 'they have no mobile number']; + } + if (smsOptedOut($number)) { + return ['ok' => false, 'error' => 'they replied STOP to your texts - only they can turn texts back on, by texting START']; + } + $queued = smsQueue($number, smsCompanyName() . ': can we text you about your tickets, visits and invoices? Reply YES to agree. Reply STOP and you won\'t get texts from us.', + ['purpose' => 'opt_in_request', 'contact_id' => $contact_id, 'client_id' => intval($contact['contact_client_id']), 'user_id' => $user_id]); + if ($queued['error'] !== '') { + return ['ok' => false, 'error' => $queued['error']]; + } + $sent = smsSendNow($queued['ids']); + return ['ok' => $sent['sent'] > 0, 'error' => $sent['error']]; +} + +/* The contact a number was asked about texts for, in the last SMS_OPT_IN_ASK_DAYS days, who hasn't agreed yet - or null */ +function smsOptInPending(string $number): ?array +{ + global $mysqli; + if (!smsColumnExists('contacts', 'contact_sms_opt_in')) { + return null; + } + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT contact_id, contact_name, contact_client_id FROM sms_messages + JOIN contacts ON contact_id = sms_message_contact_id AND contact_archived_at IS NULL AND contact_sms_opt_in = 0 + WHERE sms_message_direction = 'out' AND sms_message_purpose = 'opt_in_request' AND sms_message_number = '" . escapeSql($number) . "' + AND sms_message_created_at > NOW() - INTERVAL " . SMS_OPT_IN_ASK_DAYS . " DAY + ORDER BY sms_message_id DESC LIMIT 1")); + return $row ?: null; +} + +/* + * Where a contact stands with texts, for their page - ['ready' => texting is set up, 'number', + * 'on', 'at', 'by', 'stopped' => replied STOP, 'asked_at' => asked by text and not answered yet]. + */ +function smsContactTextState(int $contact_id): array +{ + global $mysqli; + $state = ['ready' => smsReady() && smsColumnExists('contacts', 'contact_sms_opt_in'), 'number' => '', 'on' => false, 'at' => null, 'by' => '', 'stopped' => false, 'asked_at' => null]; + if (!$state['ready']) { + return $state; + } + $contact = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT contact_mobile, contact_mobile_country_code, contact_sms_opt_in, contact_sms_opt_in_at, contact_sms_opt_in_by FROM contacts WHERE contact_id = $contact_id")); + if (!$contact) { + return $state; + } + $state['number'] = smsContactNumber($contact); + $state['on'] = intval($contact['contact_sms_opt_in']) === 1; + $state['at'] = $contact['contact_sms_opt_in_at']; + $state['by'] = (string) $contact['contact_sms_opt_in_by']; + $state['stopped'] = $state['number'] !== '' && smsOptedOut($state['number']); + if (!$state['on'] && $state['number'] !== '') { + $asked = mysqli_fetch_row(mysqli_query($mysqli, "SELECT MAX(sms_message_created_at) FROM sms_messages WHERE sms_message_purpose = 'opt_in_request' AND sms_message_contact_id = $contact_id + AND sms_message_created_at > NOW() - INTERVAL " . SMS_OPT_IN_ASK_DAYS . " DAY")); + $state['asked_at'] = $asked[0] ?? null; + } + return $state; +} + +/* The contact window's Texts switch, saved - when it was on the window, and changed. With their say-so, an agent's word for it */ +function smsContactOptInFromForm(int $contact_id, array $post, int $client_id): void +{ + global $session_name; + if (empty($post['sms_opt_in_shown']) || !$contact_id) { + return; + } + $state = smsContactTextState($contact_id); + $want = !empty($post['contact_sms_opt_in']); + if (!$state['ready'] || $want === $state['on']) { + return; + } + smsOptInSet($contact_id, $want, stripslashes((string) $session_name) . ', with their say-so', false); + $name = (string) getFieldById('contacts', $contact_id, 'contact_name'); + logAudit('Contact', 'Edit', "$session_name " . ($want ? 'turned on texts for ' : 'turned off texts for ') . escapeSql($name), $client_id, $contact_id); +} diff --git a/functions/ticket.php b/functions/ticket.php index 416bd08d2..a6151bb6d 100644 --- a/functions/ticket.php +++ b/functions/ticket.php @@ -867,7 +867,7 @@ function ticketAgentEmailContent(array $row, $kind, array $opts = []) { 'button' => ['label' => 'Open in ITFlow', 'url' => ticketAgentUrl($row)], ]; if ($kind === 'new') { - $how = ['portal' => ' in the client portal', 'email' => ' by email', 'api' => ' through the API', 'scheduled' => ', as scheduled'][$opts['how'] ?? ''] ?? ''; + $how = ['portal' => ' in the client portal', 'email' => ' by email', 'text' => ' by text', 'api' => ' through the API', 'scheduled' => ', as scheduled'][$opts['how'] ?? ''] ?? ''; $who = ($opts['how'] ?? '') === 'scheduled' ? 'A recurring ticket was raised' : (trim((string) ($row['contact_name'] ?? '')) !== '' ? $row['contact_name'] . ' raised a ticket' : 'A ticket was raised'); $email['kind'] = 'New ticket'; $email['intro'] = [($opts['how'] ?? '') === 'scheduled' ? "$who for $client, as scheduled." : "$who$how for $client."]; @@ -881,7 +881,7 @@ function ticketAgentEmailContent(array $row, $kind, array $opts = []) { "$reference is ready to work on" . (!empty($opts['reopened']) ? ' - it is Open again, from On Hold.' : '.')]; $email['history'] = ticketEmailHistory($row, ['limit' => 2, 'label' => 'The conversation']); } elseif ($kind === 'replied') { - $how = ['portal' => ' in the client portal', 'email' => ' by email'][$opts['how'] ?? ''] ?? ''; + $how = ['portal' => ' in the client portal', 'email' => ' by email', 'text' => ' by text'][$opts['how'] ?? ''] ?? ''; $email['kind'] = 'Client replied'; $email['intro'] = [($by !== '' ? $by : 'The client') . " replied to $reference$how."]; $email['message'] = ['html' => (string) ($opts['message'] ?? ''), 'label' => ($by !== '' ? $by : 'They') . ' wrote']; @@ -1572,7 +1572,7 @@ function ticketActivityHtml($reply, $row) { function ticketSourceIcon($source) { $icons = ['Email' => ['fa-envelope', 'Came in by email'], 'Portal' => ['fa-globe', 'Raised in the client portal'], 'Recurring' => ['fa-redo-alt', 'Raised by a recurring ticket'], 'API' => ['fa-plug', 'Raised through the API'], - 'Project' => ['fa-project-diagram', 'From a project template']]; + 'Project' => ['fa-project-diagram', 'From a project template'], 'Text' => ['fa-sms', 'Came in by text']]; foreach ($icons as $match => [$icon, $title]) { if (stripos((string) $source, $match) !== false) { return ''; diff --git a/includes/cron_jobs.php b/includes/cron_jobs.php index 1973011c7..f2b3109c4 100644 --- a/includes/cron_jobs.php +++ b/includes/cron_jobs.php @@ -65,6 +65,14 @@ function cronJobRegistry(): array 'schedule' => 'Interval', 'interval_minutes' => 1, ], + [ + 'name' => 'sms_queue', + 'label' => 'Text Messages', + 'script' => 'sms_queue.php', + 'description' => 'Sends the texts waiting to go, a second apart, texts reminders of visits and calls coming up, and tidies the text log - once texting is set up in Admin > Text Messaging.', + 'schedule' => 'Interval', + 'interval_minutes' => 1, + ], [ 'name' => 'ticket_email_parser', 'label' => 'Ticket Email Parser', diff --git a/js/app.js b/js/app.js index 49b632f41..484d1036e 100644 --- a/js/app.js +++ b/js/app.js @@ -337,7 +337,7 @@ function itflowAiReword(editor, ticket) { */ function itflowAiDraft(editor, ticketId, say) { var buttonApi = null; - var types = { '0': 'internal', '1': 'public', '2': 'email' }; + var types = { '0': 'internal', '1': 'public', '2': 'email', '3': 'text' }; editor.ui.registry.addButton('aidraft', { icon: 'ai-prompt', text: 'Draft',