feat(admin): streamline ticket management with dialogs

Move on-behalf ticket creation into a header dialog and load ticket handling on demand. Reuse the admin REST write path, preserve drafts and filters, and cover dialog and server boundaries with regression tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/admin/ticket-native-render.test.cjs

@@ -0,0 +1,86 @@
+'use strict';
+const assert = require('node:assert/strict');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const test = require('node:test');
+let fixture;
+function rendered() {
+  if (!fixture) {
+    const run = spawnSync(process.env.PHP_BINARY || 'php', [path.join(__dirname, 'ticket-native-render-harness.php')], { encoding: 'utf8' });
+    assert.equal(run.status, 0, run.stderr || run.stdout);
+    fixture = JSON.parse(run.stdout);
+  }
+  return fixture;
+}
+
+test('page renders header creation action and one of each dialog, without eagerly reading conversations', () => {
+  const { html, initial } = rendered();
+  assert.equal((html.match(/<dialog /g) || []).length, 2);
+  assert.match(html, /aksrt-native-header__actions[^]*data-aksrt-dialog-open="aksrt-ticket-create-dialog"/);
+  assert.match(html, /aria-controls="aksrt-ticket-detail-dialog"/);
+  assert.doesNotMatch(html, /<details|detail-row|data-aksrt-ticket-detail="/);
+  assert.equal(initial.detail_reads, 0);
+  assert.equal(initial.reply_reads, 0);
+  assert.equal(initial.queries.at(-1).offset, 20);
+  assert.equal(initial.queries.at(-1).limit, 20);
+  assert.deepEqual(initial.counts[0], { status: ['pending', 'handling', 'closed', 'archived'], ticket_type_id: 1, keywords: 'needle' });
+  assert.match(html, /status=closed&amp;ticket_type_id=1&amp;s=needle/);
+});
+
+test('detail is independently loaded even for a closed ticket outside current filters', () => {
+  const { closed, open } = rendered();
+  assert.equal(closed.status, 200);
+  assert.equal(closed.data.page, 2);
+  assert.match(closed.data.panel, /data-aksrt-ticket-detail="99"/);
+  assert.match(closed.data.panel, /aksrt-ticket-detail__closed/);
+  assert.match(closed.data.panel, /data-aksrt-ticket-form="note"/);
+  assert.doesNotMatch(closed.data.panel, /data-aksrt-ticket-form="(?:reply|status)"/);
+  assert.match(closed.data.list, /data-aksrt-ticket-view="21"/);
+  for (const action of ['reply', 'status', 'note']) assert.ok(open.data.panel.includes(`data-aksrt-ticket-form="${action}"`));
+  assert.match(open.data.panel, /action="https:\/\/example.test\/wp-json\/aksrt\/v1\/admin\/tickets\/21\/notes"/);
+  assert.match(open.data.panel, /data-aksrt-ticket-close-confirm/);
+  assert.match(open.data.panel, /value="closed" data-closed="1"/);
+});
+
+test('read handler enforces capability, nonce and record existence', () => {
+  const { missing, denied, nonce } = rendered();
+  assert.equal(missing.status, 404);
+  assert.equal(denied.status, 403);
+  assert.equal(nonce.status, 403);
+  for (const result of [missing, denied, nonce]) {
+    assert.equal(result.success, false);
+    assert.equal(result.data.panel, undefined);
+    assert.equal(result.data.list, undefined);
+  }
+});
+
+test('real rendering escapes user content, quotes and metadata', () => {
+  const { html, open } = rendered();
+  const all = html + open.data.panel;
+  assert.match(all, /Question &lt;svg onload=alert\(1\)&gt;/);
+  assert.match(all, /Description &lt;script&gt;alert\(1\)&lt;\/script&gt;/);
+  assert.match(all, /Secret &lt;script&gt;alert\(1\)&lt;\/script&gt;/);
+  assert.match(all, /原回复已删除/);
+  assert.match(all, /target="_blank" rel="noopener noreferrer"/);
+  assert.doesNotMatch(all, /<script>|<svg onload|<img>/);
+  assert.doesNotMatch(all, /admin-post.php|name="ticket_action"|name="_wpnonce"/);
+});
+
+test('missing departments and disabled order links have explicit creation states', () => {
+  const { no_types: noTypes, no_orders: noOrders } = rendered();
+  assert.match(noTypes, /尚未配置工单部门/);
+  assert.doesNotMatch(noTypes, /data-aksrt-ticket-form="create"/);
+  assert.match(noTypes, /前往工单配置/);
+  assert.doesNotMatch(noOrders, /name="order_number"/);
+});
+
+test('query builder excludes every terminal state and filtered counts use the same conditions', () => {
+  const { where, count_sql: sql, count_params: params, statistic } = rendered();
+  assert.match(where[0], /status NOT IN \(%s, %s\)/);
+  assert.deepEqual(where[1], ['closed', 'archived']);
+  assert.match(sql, /status IN \(%s, %s, %s, %s\)/);
+  assert.match(sql, /ticket_type_id = %d/);
+  assert.match(sql, /ticket_num LIKE %s OR title LIKE %s/);
+  assert.deepEqual(params, ['pending', 'handling', 'closed', 'archived', 1, '%needle%', '%needle%']);
+  assert.equal(statistic.closed, 2);
+});