theme-support-ticketing

name	theme-support_ticketing
description	Support / ticketing application palette: variants, pages, entities, and flows for building a varied helpdesk app. Use when theme_preset is support_ticketing.

Support / ticketing theme

Domain

Apps where requesters file tickets and agents work them through a queue. The boundary between a requester (sees only their own tickets) and an agent (sees all), plus free-text fields and attachments, are where the exploits live.

Application variants — pick ONE per lab

Honor any hint in theme_free_text / custom_prompt; otherwise pick one.

• Customer helpdesk — external customers raise tickets, agents respond.
• Internal IT service desk — employees request IT help; SLAs, categories.
• Bug tracker — reporters file issues, devs triage, statuses & labels.
• Live-chat support — chat sessions converted to tickets, canned replies.
• Knowledge base + tickets — self-serve articles plus ticket fallback.
• Field-service dispatch — work orders, technicians, scheduling, on-site status.
• Community Q&A support — public questions, answers, accepted solutions, voting.

Roles — choose the set that fits the variant

• user (requester/customer) — create tickets, view/comment on own tickets.
• agent — view/assign/respond to all tickets in their queues.
• admin — manage agents, queues, categories, settings.

Most exploits run as user (requester).

Candidate pages — select a coherent subset

Size the subset to endpoint_count. Candidates: dashboard/overview, my tickets, ticket detail, new ticket, search, knowledge base, article detail, agent queue/inbox, ticket assignment, internal notes, status/priority controls, canned responses (live-chat), live-chat window / session list (live-chat), SLA / categories (IT desk), labels / components / severity (bug tracker), reports/SLA dashboard, profile/settings, notifications, admin queues/agents/categories.

Candidate entities (seed tables) — select what the variant needs

• users — id, email, password_hash, role
• tickets — id, requester_id, assignee_id?, subject, body, status, priority, queue_id, category_id?, created_at
• comments — id, ticket_id, author_id, body, is_internal, created_at
• attachments — id, ticket_id, comment_id?, filename, path, content_type
• queues — id, name, description
• notifications — id, user_id, ticket_id, kind, read_at

IT service desk (variant):

• slas (variant) — id, priority, response_minutes, resolve_minutes
• categories (variant) — id, name, parent_id?, default_queue_id?
• assets (variant) — id, name, type, owner_user_id (CMDB items a ticket references)

Bug tracker (variant):

• labels (variant) — id, name, color
• ticket_labels (variant) — ticket_id, label_id
• components (variant) — id, name, owner_team
• severity (variant) — id, ticket_id, level, is_regression

Live-chat support (variant):

• chat_sessions (variant) — id, requester_id, agent_id?, status, started_at, ended_at, ticket_id?
• chat_messages (variant) — id, session_id, author_id, body, created_at
• canned_responses (variant) — id, owner_id?, shortcut, body, is_shared

Knowledge base (variant):

• kb_articles (variant) — id, title, body_html, published, author_id, category_id?
• kb_feedback (variant) — id, article_id, user_id, helpful, comment?

Seed tickets owned by ≥2 different requesters (some assigned, some not) so cross-customer access is testable.

Candidate user flows — select the ones matching chosen pages/features

1. New ticket → submit (with attachment) → see it in my tickets.
2. Open my ticket → add a comment → read agent reply.
3. (agent) Open the queue → assign a ticket to self → reply / add internal note.
4. (agent) Change status/priority → merge or reassign tickets.
5. Search the knowledge base → open an article → mark it helpful/not (knowledge base).
6. (admin) Manage queues, agents, and categories.
7. (IT desk) File a request against a category → SLA timer starts → agent resolves within target.
8. (bug tracker) File a bug → triage with labels/component/severity → move through statuses to closed.
9. (live-chat) Start a chat session → agent answers with a canned response → escalate the chat into a ticket.
10. (admin/agent) Author or edit a canned response / KB article → it becomes available to agents.

Candidate endpoints — a feature may span several

Endpoints are a shared surface, not owned 1:1 by a feature (a single feature often spans several, and an endpoint can back multiple features). Pick a coherent subset alongside the pages above. Grouped by area:

• tickets — GET /api/tickets, GET /api/tickets/{id}, POST /api/tickets, PATCH /api/tickets/{id}
• comments / attachments — POST /api/tickets/{id}/comments, POST /api/tickets/{id}/attachments, GET /api/attachments/{id}
• triage — POST /api/tickets/{id}/assign, POST /api/tickets/{id}/status, POST /api/tickets/{id}/merge
• kb (knowledge base) — GET /api/kb, GET /api/kb/{id}, POST /api/kb/{id}/feedback
• sla / categories (IT desk) — GET /api/slas, GET/POST /api/categories
• labels / components (bug tracker) — GET/POST /api/labels, POST /api/tickets/{id}/labels, GET /api/components
• chat (live-chat) — GET/POST /api/chat/sessions, POST /api/chat/sessions/{id}/messages, GET/POST /api/canned-responses
• search — GET /api/search?q=, GET /api/tickets?queue=&status=
• admin — /api/admin/queues, /api/admin/agents, /api/admin/categories

Where vulnerabilities fit naturally

• idor → GET /api/tickets/{id} belonging to another customer; reading internal-only comments or /api/attachments/{id} as a requester.
• xss → ticket subject/body and comments rendered in the agent console (stored XSS hitting a privileged viewer); KB article HTML.
• file_upload → ticket attachment accepting an executable/script.
• privilege_escalation → requester gaining agent/admin to read all tickets or post internal notes.
• business_logic → reassign/close another agent's ticket, escalate priority to bypass SLA, view internal notes via the public ticket view, escalate a chat into a ticket you shouldn't own.
• sqli → ticket search / queue filter parameters.

Diversity guidance

Pick ONE variant and a coherent subset — a bug tracker and a live-chat desk diverge sharply. Size to endpoint_count; let theme_free_text / custom_prompt bias the variant and naming. Vary queues, statuses, and whether a knowledge base exists so two ticketing labs feel like different products.