Cannot use API to create comment on a ticket

[rimi-itk]

What is your set up?

Self Hosted Server

Version

3.5.9

Describe the issue

Errors are reported when using leantime.rpc.Comments.Comments.addComment to (try to) create a comment on a ticket.

Two issues are a play here (see “Reproduction steps” for more details):

1. The payload in a JSON RPC request is always decoded as arrays, but some API code assumes that some data are objects
2. The API code uses the session to get data that does not make sense when making API requests

Reproduction steps

Sending a request like

POST /api/jsonrpc HTTP/1.1

{
  "jsonrpc": "2.0",
  "id": 0,
  "method": "leantime.rpc.Comments.Comments.addComment",
  "params": {
    "entity": {
      "id": 4897,
      "type": "task",
      "headline": "…"
    },
    "entityId": 4897,
    "module": "ticket",
    "values": {
      "father": 0,
      "projectId": 1,
      "text": "Test comment",
      "ticketId": 4897,
      "userId": 16
    }
  }
}

results in

HTTP/2.0 200 OK
…

{
  "jsonrpc": "2.0",
  "id": 0,
  "error": {
    "code": -32000,
    "message": "Server error",
    "data": "Attempt to read property \"type\" on array"
  }
}

$entity is expected to be an object in
https://github.com/Leantime/leantime/blob/master/app/Domain/Comments/Services/Comments.php#L69.

Quick n' dirty fix:

diff --git a/app/Domain/Comments/Services/Comments.php b/app/Domain/Comments/Services/Comments.php
index 623ab6c6b..29045f265 100644
--- a/app/Domain/Comments/Services/Comments.php
+++ b/app/Domain/Comments/Services/Comments.php
@@ -66,6 +66,7 @@ class Comments

                 switch ($module) {
                     case 'ticket':
+                        $entity = (object)$entity;
                         $subject = sprintf($this->language->__('email_notifications.new_comment_todo_with_type_subject'), $this->language->__('label.'.strtolower($entity->type)), $entity->id, strip_tags($entity->headline));
                         $message = sprintf($this->language->__('email_notifications.new_comment_todo_with_type_message'), session('userdata.name'), $this->language->__('label.'.strtolower($entity->type)), strip_tags($entity->headline), strip_tags($values['text']));
                         $linkLabel = $this->language->__('email_notifications.new_comment_todo_cta');

Applying fix and sending same request results in

HTTP/2.0 500 Internal Server Error
Connection: close
0: Referrer-Policy
1: same-origin
Access-Control-Allow-Origin: https://leantime.local.itkdev.dk
Cache-Control: no-cache, private
Content-Security-Policy: default-src 'self' 'unsafe-inline';base-uri 'self';;script-src 'self' 'unsafe-inline' 'unsafe-eval' unpkg.com;font-src 'self'  data: unpkg.com;img-src * 'self' *.leantime.io *.amazonaws.com data: blob: marketplace.localhost;frame-src 'self' *.google.com *.microsoft.com *.live.com;frame-ancestors 'self' *.google.com *.microsoft.com *.live.com
Content-Type: application/json
Date: Wed, 09 Jul 2025 12:09:04 GMT
Pragma: no-cache
Server: nginx/1.29.0
Set-Cookie: esl=true; expires=Wed, 09 Jul 2025 13:09:04 GMT; Max-Age=3600; path=/; httponly; samesite=lax
Set-Cookie: leantime_session=K6YRQxkHIFBh65nY4hcJlful31sI7hnlL0iwwvvY; expires=Wed, 09 Jul 2025 13:09:04 GMT; Max-Age=3600; path=/; httponly; samesite=lax
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block

{
    "message": "Cannot assign null to property Leantime\\Domain\\Notifications\\Models\\Notification::$projectId of type int",
    "exception": "TypeError",
    "file": "/app/app/Domain/Comments/Services/Comments.php",
    "line": 97,
    "trace": [
        {
            "file": "/app/app/Domain/Api/Controllers/Jsonrpc.php",
            "line": 234,
…

The API is using the session to get the current project ID in https://github.com/Leantime/leantime/blob/master/app/Domain/Comments/Services/Comments.php#L96.

Error Logs (LEANTIMEFOLDER/storage/logs)

No response

[rimi-itk]

I've been playing around with a possible solution in a draft pull request: #3068. The pull request targets leantime.rpc.Comments.Comments.addComment specifically (which happens to contain all use of session values in the Comments repository).

Many other API endpoints, e.g. https://github.com/Leantime/leantime/blob/master/app/Domain/Tickets/Repositories/Tickets.php#L261, already makes it possible to provide overrides for values in the session, but it may be worth going through all the code used in API requests to make overriding values possible.

[marcelfolaron]

Thanks. You are right, we need to make it possible to set user id and project id. I will review the PR and take a look on how to make it a more consistent pattern across the system

[zhzy0077]

Echo this. Running into a similar case when I'm trying to synchronize my calendars. When calling "leantime.rpc.Calendar.Calendar.addEvent", I would like to override the userId there and it's hard-coded to the session user - aka API user today.

https://github.com/Leantime/leantime/blob/b771400e49099219cf8fcbb51b12a050982dd192/app/Domain/Calendar/Repositories/Calendar.php#L365C1-L365C77