feat(events): event dispatch backbone, audit log, webhooks & notifications

CLAUDE.md

@@ -9,6 +9,7 @@ bun run setup              # One-time setup (deps, Docker, migrations, seed)
 bun run dev                # Dev server at localhost:3000 (login: demo@example.com / password)
 bun run build && bun run db:generate && bun run db:migrate
 bun run test && bun run test:e2e && bun run lint && bun run typecheck
+bun apps/web/scripts/backfill-ticket-contacts.ts [--dry-run]   # One-shot: link existing portal users to contacts and backfill tickets.requesterContactId
 ```
 
 ## Rules

CONTRIBUTING.md

@@ -87,6 +87,22 @@ const post = await db.query.posts.findFirst({
 
 - Single workspace, `DATABASE_URL` singleton
 
+### Authorization
+
+Quackback has two independent authorization systems serving different product domains:
+
+| System     | Import                       | Domain                                                          |
+| ---------- | ---------------------------- | --------------------------------------------------------------- |
+| **Policy** | `@/lib/server/policy`        | Feedback portal (boards, posts, comments, chat)                 |
+| **Authz**  | `@/lib/server/domains/authz` | Ticketing & workspace admin (tickets, teams, inboxes, SLA, CRM) |
+
+**Which one should I use?**
+
+- Adding a board/post/comment/chat feature → use `policy`
+- Adding a ticket/inbox/team/contact/SLA feature → use `authz`
+
+The two systems are independent and will be unified in a future iteration.
+
 ## Development Guidelines
 
 ### Code Style

apps/web/e2e/tests/admin/tickets.spec.ts

@@ -0,0 +1,164 @@
+import { test, expect } from '@playwright/test'
+
+const uniqueId = Date.now()
+
+test.describe('Admin Tickets', () => {
+  test.describe.configure({ mode: 'serial' })
+
+  let ticketSubject: string
+
+  test('can navigate to tickets section', async ({ page }) => {
+    await page.goto('/admin')
+    await page.waitForLoadState('networkidle')
+
+    // Sidebar should have a Tickets link
+    const ticketsLink = page.getByRole('link', { name: /tickets/i })
+    await expect(ticketsLink).toBeVisible({ timeout: 10000 })
+
+    await ticketsLink.click()
+    await page.waitForURL('**/admin/tickets**')
+    await expect(page).toHaveURL(/\/admin\/tickets/)
+  })
+
+  test('can create a new ticket', async ({ page }) => {
+    await page.goto('/admin/tickets/new')
+    await page.waitForLoadState('networkidle')
+
+    ticketSubject = `E2E Ticket ${uniqueId}`
+
+    // Fill the subject field
+    const subjectInput = page.locator('#subject')
+    await expect(subjectInput).toBeVisible({ timeout: 10000 })
+    await subjectInput.fill(ticketSubject)
+
+    // Fill the description (TipTap rich text editor)
+    const editor = page.locator('.tiptap').first()
+    await editor.click()
+    await page.keyboard.type('This is an automated E2E test ticket description.')
+
+    // Submit the form
+    await page.getByRole('button', { name: /create/i }).click()
+
+    // Should navigate to the ticket detail page
+    await page.waitForURL('**/admin/tickets/ticket_**', { timeout: 15000 })
+    await expect(page).toHaveURL(/\/admin\/tickets\/ticket_/)
+  })
+
+  test('can view ticket detail', async ({ page }) => {
+    // Navigate to tickets list
+    await page.goto('/admin/tickets')
+    await page.waitForLoadState('networkidle')
+
+    // Find and click our ticket in the queue
+    const ticketRow = page.getByText(ticketSubject)
+    await expect(ticketRow).toBeVisible({ timeout: 10000 })
+    await ticketRow.click()
+
+    // Should navigate to detail page
+    await page.waitForURL('**/admin/tickets/ticket_**')
+
+    // Verify subject is visible in the properties panel
+    await expect(page.getByText(ticketSubject)).toBeVisible()
+
+    // Verify the properties panel renders key sections
+    await expect(page.getByText('Status')).toBeVisible()
+    await expect(page.getByText('Priority')).toBeVisible()
+  })
+
+  test('can add a public reply', async ({ page }) => {
+    // Navigate to tickets list then open our ticket
+    await page.goto('/admin/tickets')
+    await page.waitForLoadState('networkidle')
+    await page.getByText(ticketSubject).click()
+    await page.waitForURL('**/admin/tickets/ticket_**')
+
+    // Find the thread composer (placeholder "Reply to customer…")
+    const composer = page.locator('.tiptap').last()
+    await expect(composer).toBeVisible({ timeout: 10000 })
+    await composer.click()
+    await page.keyboard.type('This is a public reply from E2E test.')
+
+    // Click Post button
+    await page.getByRole('button', { name: /post/i }).click()
+
+    // The reply should appear in the thread timeline
+    await expect(page.getByText('This is a public reply from E2E test.')).toBeVisible({
+      timeout: 10000,
+    })
+  })
+
+  test('can change ticket status', async ({ page }) => {
+    await page.goto('/admin/tickets')
+    await page.waitForLoadState('networkidle')
+    await page.getByText(ticketSubject).click()
+    await page.waitForURL('**/admin/tickets/ticket_**')
+
+    // Find Status section and its picker button
+    const statusSection = page.locator('text=Status').locator('..')
+    const statusButton = statusSection.locator('button').first()
+    await expect(statusButton).toBeVisible({ timeout: 10000 })
+    await statusButton.click()
+
+    // Select "Solved" from the dropdown
+    const solvedOption = page.getByRole('option', { name: /solved/i }).or(page.getByText('Solved'))
+    await solvedOption.first().click()
+
+    // Wait for the mutation to complete
+    await page.waitForLoadState('networkidle')
+
+    // Verify the status changed (status badge should show "Solved")
+    await expect(page.getByText('Solved').first()).toBeVisible({ timeout: 10000 })
+  })
+
+  test('can change ticket priority', async ({ page }) => {
+    await page.goto('/admin/tickets')
+    await page.waitForLoadState('networkidle')
+    await page.getByText(ticketSubject).click()
+    await page.waitForURL('**/admin/tickets/ticket_**')
+
+    // Find Priority section and its picker
+    const prioritySection = page.locator('text=Priority').locator('..')
+    const priorityButton = prioritySection.locator('button').first()
+    await expect(priorityButton).toBeVisible({ timeout: 10000 })
+    await priorityButton.click()
+
+    // Select "High" from the dropdown
+    const highOption = page.getByRole('option', { name: /high/i }).or(page.getByText('high'))
+    await highOption.first().click()
+
+    await page.waitForLoadState('networkidle')
+
+    // Verify priority changed
+    await expect(page.getByText(/high/i).first()).toBeVisible({ timeout: 10000 })
+  })
+
+  test('can edit ticket subject', async ({ page }) => {
+    await page.goto('/admin/tickets')
+    await page.waitForLoadState('networkidle')
+    await page.getByText(ticketSubject).click()
+    await page.waitForURL('**/admin/tickets/ticket_**')
+
+    // Find the Subject section in properties panel and click it to start editing
+    const subjectSection = page.locator('text=Subject').locator('..')
+    await subjectSection.click()
+
+    // The input should appear
+    const subjectInput = subjectSection.locator('input')
+    await expect(subjectInput).toBeVisible({ timeout: 5000 })
+
+    // Clear and type new subject
+    const newSubject = `Updated E2E Ticket ${uniqueId}`
+    await subjectInput.clear()
+    await subjectInput.fill(newSubject)
+    await subjectInput.press('Enter')
+
+    // Wait for save
+    await page.waitForLoadState('networkidle')
+
+    // Verify subject updated (it should appear in the header)
+    await expect(page.getByText(newSubject).first()).toBeVisible({ timeout: 10000 })
+
+    // Update for subsequent tests
+    ticketSubject = newSubject
+  })
+})

apps/web/e2e/utils/access-helpers.ts

@@ -84,7 +84,10 @@ export function flushMagicLinkRateLimit(): void {
     ['exec', 'quackback-dragonfly', 'redis-cli', '--scan', '--pattern', 'signin:magiclink:*'],
     { encoding: 'utf-8' }
   )
-  const keys = scan.split('\n').map((k) => k.trim()).filter(Boolean)
+  const keys = scan
+    .split('\n')
+    .map((k) => k.trim())
+    .filter(Boolean)
   for (const key of keys) {
     execFileSync('docker', ['exec', 'quackback-dragonfly', 'redis-cli', 'del', key], {
       stdio: 'pipe',

apps/web/e2e/utils/db-helpers.ts

@@ -35,6 +35,43 @@ export function getMagicLinkToken(email: string): string {
   }
 }
 
+/**
+ * Get the most recent live email OTP code for an email. Better-auth stores
+ * email OTP rows as `sign-in-otp-<email>` with value `<code>:<attempts>`.
+ */
+export function getOtpCode(email: string, _host?: string): string {
+  const query = `
+    SELECT value
+    FROM verification
+    WHERE identifier = 'sign-in-otp-${email.replace(/'/g, "''")}'
+      AND expires_at > NOW()
+    ORDER BY created_at DESC
+    LIMIT 1
+  `
+
+  try {
+    const result = execSync(
+      `dotenv -e ../../.env -- bun -e ${JSON.stringify(`
+        import postgres from 'postgres'
+        const sql = postgres(process.env.DATABASE_URL)
+        const rows = await sql.unsafe(${JSON.stringify(query)})
+        if (rows.length === 0) throw new Error('No live OTP verification row found')
+        console.log(String(rows[0].value).split(':')[0])
+        await sql.end()
+      `)}`,
+      {
+        encoding: 'utf-8',
+        cwd: resolve(__dirname, '../..'), // apps/web directory
+      }
+    )
+
+    return result.trim()
+  } catch (error) {
+    const err = error as { stderr?: string; message: string }
+    throw new Error(`Failed to get OTP code: ${err.stderr || err.message}`, { cause: error })
+  }
+}
+
 /**
  * Ensure a test user has the required role for E2E testing
  *