v1.5.0

Co nowego:
- Podgląd logów w panelu admina (Admin > Logi) — pliki storage/logs/*.log
  bez potrzeby dostępu do kontenera, z filtrami poziomu/tekstu/liczby wpisów
  i auto-odświeżaniem.
- Filtr „Bez kategorii” w kolejce operatora — izoluje zgłoszenia bez
  przypisanej kategorii/podkategorii.
- Narzędzie importu z Heska: już nie tworzy automatycznie kont klientów dla
  nieznanych e-maili (pomija takie zgłoszenia zamiast zakładać konto),
  łączy odpowiedzi/właścicieli zgłoszeń z realnymi kontami operatorów po
  e-mailu, nowe flagi --assign-operators i --fix-closed-dates do
  donaprawiania wcześniejszych importów, dedykowany log
  storage/logs/hesk-import.log.
- Poprawka: pulpit statystyk operatora (rozkład wg kategorii/podkategorii i
  filtr kategorii) pomijał zgłoszenia przypisane do samej kategorii bez
  podkategorii (np. z poczty IMAP) — teraz liczone poprawnie.
- Poprawka: błąd JS i zawieszone w tle liczniki przy nawigacji z widoku z
  aktywnym licznikiem (najbardziej odczuwalne w liczniku czasu pracy
  operatora).
- Porządki w bazie: usunięte niewykorzystywane kolumny
  (users.remember_token, users.email_verified_at,
  email_templates.trigger_label); wartości pól dodatkowych, stan
  triage/podsumowania AI i powiązany sprzęt Snipe-IT przeniesione z tabeli
  tickets do osobnych tabel (ticket_field_values, ticket_ai_summaries,
  ticket_snipeit_assets) — bez zmiany zachowania, ale pola dodatkowe są
  teraz efektywnie przeszukiwalne; dodane brakujące indeksy na 4 tabelach
  pivot; tickets.source/ticket_messages.source walidowane względem znanego
  zestawu wartości.

Zaktualizowana dokumentacja: README, CLAUDE.md, ARCHITECTURE.md,
CHANGELOG.md, wiki/admin, wiki/operator.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitignore

@@ -1,3 +1,4 @@
 /mysql/
 .env
 compose.yaml
+scripts/hesk-import/.env

ARCHITECTURE.md

@@ -36,6 +36,9 @@ Category ─< Subcategory ─< CustomField        (per-subcategory custom fields
                           ├──< TicketMessage   (public replies + internal notes)
                           ├──< TicketAttachment
                           ├──< TicketHistory
+                          ├──< TicketFieldValue (queryable custom_fields values, kept in sync)
+                          ├── aiSummary → TicketAiSummary       (1:1, triage+summary state)
+                          ├── snipeitAsset → TicketSnipeitAsset (1:1, linked asset)
                           ├── customer/assignee → User
                           ├── status  → Status   (fixed stages: new/open/closed)
                           ├── priority → Priority → SlaRule (response/resolution minutes)
@@ -63,6 +66,38 @@ queue + unassigned + anything assigned to them, an admin sees everything), and
 work-timer tracking (`timerElapsedSeconds()`). Keep ticket-shaped logic here
 rather than spreading it across Livewire components.
 
+**Virtual `ai_*`/`snipeit_*` attributes.** The AI triage/summary fields
+(`ai_triaged_at`, `ai_summary`, `ai_suggested_action`, `ai_summary_generated_at`)
+and the Snipe-IT link (`snipeit_asset_id`, `snipeit_asset_name`) are **not**
+real columns on `tickets` — they live on the related `TicketAiSummary`/
+`TicketSnipeitAsset` rows shown in the diagram above (each table's own columns
+drop the prefix, e.g. `ticket_ai_summaries.summary`). `Ticket` overrides
+`getAttribute()`/`setAttribute()` (see `AI_SUMMARY_FIELD_MAP`/
+`SNIPEIT_FIELD_MAP`) so every existing `$ticket->ai_summary`/
+`$ticket->update(['snipeit_asset_id' => ...])` call site keeps working
+unchanged against the new tables — the same pattern `TicketMessage` already
+uses for its own virtual `role`/`author_id`. A write is queued
+(`$pendingVirtualAttributes`) and flushed into the related row's
+`updateOrCreate()` on the model's `saved` event, since a brand-new ticket has
+no id yet to key the related row on until that point. If you add a new
+`ai_*`/`snipeit_*` field, add it to the relevant `FIELD_MAP` rather than to
+`tickets` directly.
+
+**Custom field values.** `tickets.custom_fields` (a JSON blob, `field.id =>
+value`) stays the source of truth for reads/writes — `TicketFieldValue`
+(`ticket_field_values`, one row per non-blank entry) is a queryable mirror
+kept in sync automatically by `Ticket::syncFieldValues()` (called from the
+same `saved` hook whenever `custom_fields` changes), so reporting can
+filter/join on "tickets where custom field X = Y" without scanning JSON.
+Nothing else needs to write to `ticket_field_values` directly.
+
+**`source` validation.** `Ticket::SOURCES`/`TicketMessage::SOURCES` are the
+only values ever allowed in `tickets.source`/`ticket_messages.source`
+(`'web'`/`'email'`/`'hesk_import'`; `null` still means "web" for messages) —
+enforced by a `saving` listener that throws `InvalidArgumentException` on
+anything else, so a typo'd literal fails loudly instead of sticking silently.
+Add new values to the constant before writing them anywhere.
+
 ## Ticket numbering & URLs
 
 A ticket carries three distinct identifiers, each with a different job:
@@ -167,6 +202,16 @@ the account used for first login after a fresh install (see
 `SyncUserFieldsFromLdap` keeps `UserFieldValue` rows in sync with directory
 attributes.
 
+`app/Ldap/` has two directory-schema models — `LldapUser` (LLDAP/OpenLDAP,
+the default) and `AdUser` (Active Directory, `LdapRecord\Models\ActiveDirectory\User`
+under the hood). `Settings::ldapUserModelClass()` picks between them based on
+the `ldap_directory_type` setting, and `AppServiceProvider::applyLdapSettingsOverride()`
+wires the chosen class into `config('auth.providers.users.model')` on every
+request — same live-override mechanism as the connection host/base DN below.
+`LdapUserProvisioner` (used for sync + guest auto-provisioning) resolves the
+same setting at call time rather than caching the class, so switching
+directory type takes effect without a redeploy.
+
 ## Settings override ("live config")
 
 `App\Support\Settings` (`app/Support/Settings.php`) is a cached key/value reader
@@ -439,6 +484,26 @@ Requires the same external `schedule:run` cron entry as SLA/automation (see
 [CLAUDE.md](CLAUDE.md)) — without it, only the manual "Pobierz teraz" button
 does anything.
 
+## Log channels & the admin log viewer
+
+`config/logging.php` defines three dedicated channels alongside the app's
+default one, each daily/14-day-retention and always `debug` level regardless
+of `.env`'s `LOG_LEVEL` (so they stay useful even when the app itself runs at
+`error`): `imap` (`storage/logs/imap-*.log` — see "IMAP e-mail intake"
+above), `ai` (`storage/logs/ai.log` — every `ai:run-ticket-automation` run,
+used by both `TicketAiTriageService` and `TicketAiSummaryService`, plus
+`AiClient`'s own request/response/failure logging), and `hesk_import`
+(`storage/logs/hesk-import.log` — every `hesk:import` run). `Admin\Logs`
+(`app/Livewire/Admin/Logs.php`, Admin > Logi) is a read-only viewer over
+`storage/logs/*.log` (any file, not just these three) — it reads only the
+last 4 MB of a file to bound memory on large ones, splits raw log text back
+into individual entries by the `[YYYY-MM-DD HH:MM:SS]` line prefix (so a
+multi-line stack trace stays grouped with the line that started it), and
+offers level/free-text/entry-count filters plus an optional `wire:poll.5s`
+auto-refresh. `selectedFile` is validated against the real glob'd file list
+on every read, not trusted as a path — a crafted value (e.g. `../../.env`)
+is silently ignored rather than read.
+
 ## API
 
 `routes/api.php` + `app/Http/Controllers/Api/` expose a small ability-scoped REST
@@ -582,9 +647,12 @@ Blade component renders that shape everywhere an asset list shows up
 skips its own wrapping `<div class="card">` when embedded inside a
 caller-provided one (the inventory-search box + its results share one card).
 
-A linked ticket only stores `tickets.snipeit_asset_id` + a cached
-`snipeit_asset_name` label (`TicketService::setSnipeitAsset()`, which also
-writes a ticket-history line) — no other Snipe-IT fields are persisted.
+A linked ticket only stores an `asset_id` + a cached `asset_name` label on
+the related `ticket_snipeit_assets` row (`TicketService::setSnipeitAsset()`,
+which also writes a ticket-history line — see "Virtual `ai_*`/`snipeit_*`
+attributes" above for how this reads/writes as `$ticket->snipeit_asset_id`
+despite not being a `tickets` column) — no other Snipe-IT fields are
+persisted.
 Anywhere a linked asset's live detail is shown (the "Powiązany sprzęt" card),
 it's re-fetched fresh via `SnipeItClient::asset($id)` rather than trusted
 from the cache, so a status/reassignment change made directly in Snipe-IT is
@@ -607,7 +675,9 @@ live customer submitting a ticket:
   state (no category/subcategory at all → assign both; category but no
   subcategory → pick one within it; already has a subcategory → recheck and
   possibly correct), independently of the subject/priority toggles. Every
-  scanned ticket gets `tickets.ai_triaged_at` stamped exactly once — this is
+  scanned ticket gets `ai_triaged_at` stamped exactly once (on the related
+  `ticket_ai_summaries` row, not `tickets` itself — see "Virtual
+  `ai_*`/`snipeit_*` attributes" above) — this is
   a one-shot pass, not a continuous recheck, and there's deliberately no
   manual per-ticket re-trigger. Resolution is fail-closed the same way as the
   BookStack tagger: every value the model returns is matched against the
@@ -627,8 +697,8 @@ live customer submitting a ticket:
   per pass.
 - **`App\Services\TicketAiSummaryService`** — a summary + suggested next
   action for **every** ticket (gated by a single `ai_summary_enabled`
-  toggle), cached on `tickets.ai_summary`/`ai_suggested_action`/
-  `ai_summary_generated_at` and shown only in the operator ticket view (a
+  toggle), cached on the related `ticket_ai_summaries` row's `summary`/
+  `suggested_action`/`summary_generated_at` and shown only in the operator ticket view (a
   "Podsumowanie AI" sidebar card, lazy-loaded via `wire:init` like the
   BookStack suggestions card next to it). `run()` (the scheduled sweep)
   regenerates whenever a ticket's latest message postdates its last summary

CHANGELOG.md

@@ -3,6 +3,127 @@
 All notable changes to this project are documented in this file. Format loosely
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.5.0] - 2026-08-05
+
+### Added
+
+- **Admin log viewer** (Admin > Logi) — browse `storage/logs/*.log` from the
+  admin panel without shell access to the container: a file picker (size +
+  last-modified, most recent first), level/free-text/entry-count filters, and
+  an optional 5s auto-refresh. Read-only, admin-only; reads only the tail of
+  large files to keep it fast.
+- **"Bez kategorii" filter** in the operator queue's category dropdown —
+  isolates tickets with neither a category nor subcategory assigned (e.g. an
+  IMAP mailbox routed to nothing in particular), previously only reachable by
+  scanning the unfiltered list.
+
+### Changed
+
+- **Hesk import tool** (`scripts/hesk-import/`) no longer auto-creates client
+  accounts for unrecognized requester e-mails — the servicedesk user base is
+  now treated as authoritative, so a Hesk ticket whose requester has no
+  matching account is skipped instead (reported at the end, with the list of
+  skipped e-mails). Hesk staff replies/notes and ticket ownership are now
+  linked to real operator/admin accounts when the staff e-mail matches one.
+  Two new backfill flags cover tickets imported before these existed:
+  `--assign-operators` (sets `assignee_id` from Hesk's ticket owner, never
+  overwriting a manual reassignment) and `--fix-closed-dates` (corrects a
+  closed ticket's date to Hesk's own `closedat` column instead of the
+  drifting `lastchange`, and adds the missing "Zamknięte" history entry).
+  Every newly imported ticket also records its source Hesk id
+  (`tickets.hesk_ticket_id`, unique) as a second, DB-level guard against
+  duplicate imports on top of the existing state file. See
+  `scripts/hesk-import/README.md` for details.
+- Internal database cleanup: removed three columns confirmed unused against
+  live data (`users.remember_token`, `users.email_verified_at`,
+  `email_templates.trigger_label`); moved custom field values, AI
+  triage/summary state, and the linked Snipe-IT asset off the `tickets` row
+  into three dedicated one-to-one tables (`ticket_field_values`,
+  `ticket_ai_summaries`, `ticket_snipeit_assets`) — no visible behavior
+  change, but custom field values are now efficiently queryable instead of
+  living only in a JSON blob, and the `tickets` row itself is narrower; added
+  missing reverse indexes on 4 pivot tables (`team_subcategory`, `role_user`,
+  `team_user`, `custom_field_subcategory`); `tickets.source` and
+  `ticket_messages.source` now validate against a known set of values
+  instead of silently accepting any string.
+
+### Fixed
+
+- The operator statistics dashboard's category/subcategory breakdown (and
+  its category filter) only counted tickets routed through a subcategory —
+  a ticket routed to a whole category with no subcategory (e.g. via an IMAP
+  mailbox routed to "całą kategorię") was silently excluded from those
+  charts and from filtering by that category. Now counted correctly, with
+  bare-category tickets shown as their own "(bez podkategorii)" row in the
+  subcategory breakdown.
+- A JavaScript error (and stray background timers left running) could occur
+  when navigating away from a page with an active countdown/timer widget —
+  ticket/queue auto-refresh, the theme switcher, file-attachment
+  drag-and-drop. Most consequential in the operator ticket time tracker,
+  where it could throw console errors and momentarily break other UI
+  elements (e.g. dropdown menus) after leaving a ticket with the timer
+  running.
+
+## [1.4.0] - 2026-08-05
+
+### Added
+
+- **Active Directory support for LDAP auth** (Admin > Integracje > "LDAP /
+  Active Directory") — a "Typ katalogu" dropdown switches between LLDAP/
+  OpenLDAP (the original, still the default) and Active Directory. AD uses a
+  different schema (no inetOrgPerson/posixAccount, a binary `objectGUID`
+  instead of `entryUUID`) and login attribute (`sAMAccountName`, not `uid`);
+  both are now auto-detected from the directory type instead of requiring
+  LLDAP's schema everywhere.
+- **Operator client search** (Operator > Klienci) — a dedicated search page
+  (name or e-mail, any account, not just role=client) showing each match's
+  role badges and ticket count, linking straight into the queue pre-filtered
+  to that customer.
+- **Paginated ticket lists** — the operator queue (50/page) and client
+  dashboard (20/page, current/archive tracked as separate pages so switching
+  tabs doesn't lose your place) no longer render every matching ticket at
+  once; sorting still happens over the full filtered result first.
+- **Command-palette global search (Ctrl+K / Cmd+K)** — searches tickets from
+  anywhere in the app, scoped to what the searching user can actually see
+  (operators/admins search everything visible to them, clients only their
+  own). Supports Gmail-style operators — `od:` (reporter), `temat:`
+  (subject only), `treść:`/`tresc:` (message content only), `numer:`/`nr:`
+  (ticket number), combinable and AND'd together (`od:kacper
+  temat:drukarka`) — plain text with no operator still searches everything
+  as before. A "Szukaj" button in the operator/admin sidebars opens the same
+  dialog for anyone who doesn't know the shortcut.
+- **Recently viewed tickets** (operator sidebar) — the last 6 tickets an
+  operator actually opened, most-recent first, re-bumped (not duplicated) on
+  a repeat visit.
+- **Navbar redesign: panel switcher.** The old dropdown-only role switcher
+  (in the profile menu) and the plain "Panel Klienta/Operatora/Administratora"
+  text label are replaced by a single segmented control centered in the top
+  bar — Klient / Operator / Administrator — showing only the areas the
+  logged-in user actually holds, highlighting the current one, and sliding a
+  preview to whichever option is hovered before you click. Adapts to a
+  full-width row below the icons on narrow screens instead of overlapping
+  them.
+- **Richer profile dropdown** — now shows the account's name, e-mail, and
+  role badges above the existing Powiadomienia/Wyloguj się links.
+- **Per-page browser tab titles** — every page sets its own `<title>`
+  (e.g. the ticket subject, the selected queue, the active admin tab)
+  instead of every tab just showing the company name, always anchored with
+  the company name as a suffix so it's still identifiable once the browser
+  truncates a long tab title.
+- **Hesk 3.x historical import** (`scripts/hesk-import/`) — a one-time,
+  read-only migration of tickets (with full reply/note history) from an old
+  Hesk helpdesk database, filtered by e-mail domain. Dry-run by default,
+  resumable, auto-maps categories (exact name match) and teams (when
+  unambiguous). See `scripts/hesk-import/README.md`.
+
+### Fixed
+
+- Pagination controls ("« Poprzednia" / "Następna »") were showing the raw
+  translation keys `pagination.previous`/`pagination.next` instead of
+  actual text — the app's `APP_LOCALE=pl` had no matching `lang/pl/`
+  translation file and no English fallback (`APP_FALLBACK_LOCALE` is also
+  `pl`), so Laravel had nothing to resolve those strings to.
+
 ## [1.3.0] - 2026-07-27
 
 ### Added

CLAUDE.md

@@ -21,7 +21,12 @@ roles). Treat the running database as production, not a sandbox:
 ## Container operations: use `sudo`, never build the image locally
 
 All Docker commands against this stack need `sudo` (e.g.
-`sudo docker compose exec servicedesk ...`, `sudo docker exec servicedesk-servicedesk-1 ...`).
+`sudo docker compose exec app ...`, `sudo docker exec servicedesk-app-1 ...`).
+
+The stack is four services sharing the one `servicedesk` image — `app` (Apache,
+what actually serves HTTP), `reverb` (websocket server, `php artisan
+reverb:start`), `cron` (scheduler loop, `php artisan schedule:work` — see
+below), and `mariadb`. Only `app` and `reverb` are reachable from Traefik.
 
 **Never run `docker build`, `docker compose build`, or `--build`.** The
 `servicedesk` image is built by CI (`.gitea/workflows/build.yml`, triggered on
@@ -29,7 +34,7 @@ All Docker commands against this stack need `sudo` (e.g.
 `compose.yaml` only ever `pull`s a tag (`sudo docker compose pull && sudo docker
 compose up -d`, see [install.md](install.md) 1.3/1.3a) — building locally would
 just diverge from what CI produces. The app container
-(`servicedesk-servicedesk-1`) mounts `./src` from the host over NFS
+(`servicedesk-app-1`) mounts `./src` from the host over NFS
 (`/mnt/rabbit-containers` → NFS export), so plain file edits already take effect
 with no rebuild or restart:
 
@@ -56,33 +61,36 @@ with no rebuild or restart:
   surfaces in production as a 500 with `touch(): Utime failed: Operation not
   permitted`. If you ran `php artisan test`/`tinker`/any artisan command via
   `docker exec` in a session where you also edited Blade files afterward,
-  finish with `sudo docker exec servicedesk-servicedesk-1 php artisan
+  finish with `sudo docker exec servicedesk-app-1 php artisan
   view:clear` to flush any root-owned compiled views before ending the
   session — don't wait for a report of a broken page to catch it.
 
-## Scheduled commands need a host crontab entry
+## Scheduled commands run in the dedicated `cron` container
 
 The Docker image ships no cron/supervisor of its own (see [install.md](install.md)),
 so `tickets:check-sla-breaches`, `automation:run-rules`, `emails:fetch-imap`,
 and `ai:run-ticket-automation` (all registered in `routes/console.php` via
-`Schedule::command(...)`) only ever run if something outside the container
-calls `php artisan schedule:run` on a timer. **As of 2026-07-23 this is
-configured** — root's crontab on the host runs, every minute:
+`Schedule::command(...)`) only ever run if something calls `php artisan
+schedule:run` on a timer. **As of 2026-08-04 this is the `cron` service** in
+`compose.yaml` — same `servicedesk` image, running `php artisan schedule:work`
+(Laravel's own foreground scheduler loop, ticks every minute internally, no
+external trigger needed). Before this it was a root crontab entry on the host
+calling `docker compose exec -T servicedesk schedule:run`; that entry has been
+removed from `sudo crontab -l -u root` now that the container replaces it —
+don't re-add it, the two would double-run every scheduled command.
 
-```cron
-* * * * * cd /mnt/rabbit-containers/servicedesk && docker compose exec -T servicedesk php artisan schedule:run >> /dev/null 2>&1
-```
-
-(`sudo crontab -l -u root` to inspect/edit — it previously did not exist at all,
-which meant none of the four scheduled commands above had ever run
-automatically; ask before changing this again, since removing it silently
-breaks SLA checks, automation rules, IMAP fetching and AI ticket automation,
-and confusingly not the IMAP feature alone if you're only debugging that one.)
-IMAP-specific activity (connect attempts, per-message accept/reject decisions,
-created/replied ticket ids) is logged separately from the app's normal
-`LOG_LEVEL` to `storage/logs/imap-*.log` (see the `imap` channel in
-`config/logging.php`) — check there first when a mailbox isn't behaving as
-expected, before assuming the scheduler itself isn't firing.
+If the `cron` container isn't running (`sudo docker compose ps cron`), none of
+the four scheduled commands fire — same failure mode as the old missing-crontab
+case, just check the container instead of the crontab. IMAP-specific activity
+(connect attempts, per-message accept/reject decisions, created/replied ticket
+ids) is logged separately from the app's normal `LOG_LEVEL` to
+`storage/logs/imap-*.log` (see the `imap` channel in `config/logging.php`) —
+check there first when a mailbox isn't behaving as expected, before assuming
+the scheduler itself isn't firing. `ai:run-ticket-automation` and
+`hesk:import` get the same always-debug treatment via the `ai`/`hesk_import`
+channels (`storage/logs/ai.log`/`hesk-import.log`). All of `storage/logs/*.log`
+is also browsable from Admin > Logi (`app/Livewire/Admin/Logs.php`) if you'd
+rather not `docker exec` in just to tail a file.
 
 All four commands' intervals are admin-configurable (Admin > Konfiguracja —
 `schedule_sla_check_minutes`/`schedule_automation_rules_minutes`/

CONTRIBUTING.md

@@ -16,11 +16,11 @@ build through a throwaway `node:22` container as documented there.
 
 1. **Run the test suite** — see [TESTING.md](TESTING.md) for details:
    ```bash
-   docker compose exec servicedesk php artisan test
+   docker compose exec app php artisan test
    ```
 2. **Run Pint** (Laravel's code-style fixer, default preset, no project overrides):
    ```bash
-   docker compose exec servicedesk ./vendor/bin/pint
+   docker compose exec app ./vendor/bin/pint
    ```
 3. If you changed anything under `resources/`, rebuild the frontend bundle and
    commit the result if `public/build/` is tracked, or confirm the deploy step

README.md

@@ -23,9 +23,22 @@ and **[wiki/admin](wiki/admin/README.md)** for role-specific how-to guides.
 
 ## Feature overview
 
+- **Navigation** — a segmented Klient/Operator/Administrator switcher in the
+  top bar (only the areas a user actually holds, current one highlighted,
+  hover-previews the destination before you click) replaces the old dropdown
+  role switcher; the profile menu shows name/e-mail/role badges above
+  Powiadomienia/Wyloguj się; every page sets its own browser-tab title
+  (ticket subject, selected queue, active admin tab, ...) anchored with the
+  company name; and a command-palette global search (Ctrl+K/Cmd+K, or a
+  "Szukaj" sidebar button) finds tickets from anywhere, scoped to what the
+  searching user can see, with Gmail-style `od:`/`temat:`/`treść:`/`numer:`
+  operators. The operator sidebar also lists the last 6 tickets they
+  actually opened ("Ostatnio przeglądane").
 - **Tickets** — number, subject, body, category/subcategory, status, priority, team,
   assignee, custom fields (per subcategory), attachments, full message thread
-  (public replies + internal notes), history log, merge, delete.
+  (public replies + internal notes), history log, merge, delete. The operator
+  queue (50/page) and client dashboard (20/page, current/archive tracked
+  separately) paginate rather than rendering every matching ticket at once.
 - **SLA** — per-priority response/resolution time targets; a scheduled command
   (`tickets:check-sla-breaches`, every 15 min) flags overdue tickets and can notify
   the assigned operator.
@@ -53,6 +66,10 @@ and **[wiki/admin](wiki/admin/README.md)** for role-specific how-to guides.
   team's queue (plus unrouted tickets and anything assigned to them) unless they're
   an admin. Reassigning a ticket to a team, though, is unrestricted — an operator
   can route a ticket to any team, not just one they belong to.
+- **Client search** (Operator > Klienci) — find any account by name or e-mail
+  (not just role=client — a ticket's customer can be any user), see its role
+  badges and ticket count, and jump straight into the queue pre-filtered to
+  that customer.
 - **Templates** — canned response snippets for the reply box, admin-configurable
   "quick actions" (send + transition status in one click), and HTML e-mail
   templates for every ticket lifecycle event (created, status/priority/category/
@@ -69,9 +86,16 @@ and **[wiki/admin](wiki/admin/README.md)** for role-specific how-to guides.
   e-mail layout/footer, SMTP connection (Admin > E-MAIL), attachment limits,
   session lifetime, timezone (Admin > Konfiguracja), and LDAP connection + user
   sync + BookStack (Admin > Integracje).
-- **LDAP auth** — logins bind against an LDAP/LLDAP directory (`config/auth.php`,
+- **Log viewer** (Admin > Logi) — browse `storage/logs/*.log` (app, IMAP, AI
+  automation, Hesk import, ...) from the admin panel, with level/text/entry-count
+  filters and an optional auto-refresh, so diagnosing a scheduled integration
+  doesn't need shell access to the container.
+- **LDAP auth** — logins bind against a directory (`config/auth.php`,
   `config/ldap.php`); local accounts (e.g. the emergency `admin` account) fall back
-  to e-mail + local password when the LDAP bind doesn't match.
+  to e-mail + local password when the LDAP bind doesn't match. A "Typ katalogu"
+  toggle (Admin > Integracje) switches between LLDAP/OpenLDAP (default) and
+  Active Directory, which auto-selects the right schema/login attribute
+  (`sAMAccountName` + `objectGUID` for AD, vs. `uid` + `entryUUID`).
 - **Triggers** (Admin > Wyzwalacze) — event-driven business rules that fire
   immediately on a ticket lifecycle event (created, any field updated, status/
   priority/assignee/team/category changed, new public reply): AND-combined
@@ -201,11 +225,13 @@ and **[wiki/admin](wiki/admin/README.md)** for role-specific how-to guides.
   dashboard is hand-rolled inline-styled bar/column charts, so it needs no client
   build step beyond the CSS bundle.
 - **Database**: MariaDB.
-- **Deployment**: `compose.yaml` — `servicedesk` (source bind-mounted from `./src`,
+- **Deployment**: `compose.yaml` — `app` (source bind-mounted from `./src`,
   no image rebuild needed for PHP/Blade/route changes) + `mariadb` + `reverb`
-  (same image, `php artisan reverb:start`), fronted by Traefik with a private-CA
-  TLS cert (the websocket path is routed to `reverb` by a higher-priority
-  Traefik rule; everything else goes to `servicedesk`). The `servicedesk` image
+  (same image, `php artisan reverb:start`) + `cron` (same image, `php artisan
+  schedule:work` — runs the scheduled commands below without needing a host
+  crontab), fronted by Traefik with a private-CA TLS cert (the websocket path
+  is routed to `reverb` by a higher-priority Traefik rule; everything else
+  goes to `app`). The `servicedesk` image
   itself is built and pushed by Gitea Actions (`.gitea/workflows/build.yml`) to
   the Gitea container registry whenever `Dockerfile` changes — `compose.yaml`
   just pulls a tag, it never builds locally.
@@ -227,7 +253,7 @@ Compose-level and Laravel-level) and the LDAP/SMTP gotcha after a fresh seed.
   ```
 - Fresh install / reset:
   ```bash
-  sudo docker exec servicedesk-servicedesk-1 php artisan migrate:fresh --seed
+  sudo docker exec servicedesk-app-1 php artisan migrate:fresh --seed
   ```
   Seeds real reference data (categories, custom fields, statuses/priorities/SLA,
   teams, quick actions, response/e-mail templates, branding/config with example
@@ -243,12 +269,14 @@ src/                     Laravel application
   app/Models/            Eloquent models
   app/Events/            Broadcast events (TicketQueueChanged, TicketMessagePosted)
   app/Console/Commands/  Scheduled commands (SLA breach check, automation rules, IMAP fetch,
-                         AI ticket triage/summary) + bookstack:tag-content
+                         AI ticket triage/summary) + bookstack:tag-content + hesk:import
+                         (one-time historical migration, see scripts/hesk-import/)
   app/Services/          TicketService (ticket lifecycle + notifications), BookStackClient,
                          ImapMailboxFetcher (I/O) + ImapMessageClassifier (pure logic),
                          AiClient (generic LLM client), BookStackContentTagger,
                          TicketAiTriageService, TicketAiSummaryService, SnipeItClient
-  app/Ldap/              LDAP user model + sync handlers
+  app/Ldap/              LDAP user models — LldapUser (LLDAP/OpenLDAP, default) and
+                         AdUser (Active Directory) — plus sync handlers
   database/migrations/   Schema (one file per table group, final shape)
   database/seeders/      DatabaseSeeder — reference data, no ticket data
   resources/css/         Tailwind entrypoint (needs `npm run build` after edits)
@@ -261,4 +289,6 @@ wiki/
   client/                How-to guide for the Client role
   operator/               How-to guide for the Operator role
   admin/                  How-to guide for the Admin role
+scripts/
+  hesk-import/            One-time Hesk 3.x ticket history import — see its own README.md
 ```

TESTING.md

@@ -13,20 +13,20 @@ fast in-process fakes (`array`/`sync`) for the same reason.
 From inside the app container (or on a bare-metal install, from `src/`):
 
 ```bash
-docker compose exec servicedesk php artisan test
+docker compose exec app php artisan test
 ```
 
 or directly with Pest:
 
 ```bash
-docker compose exec servicedesk ./vendor/bin/pest
+docker compose exec app ./vendor/bin/pest
 ```
 
 Run a single file or filter by name:
 
 ```bash
-docker compose exec servicedesk php artisan test --filter=SlaBreachNotificationTest
-docker compose exec servicedesk ./vendor/bin/pest tests/Feature/TicketApiTest.php
+docker compose exec app php artisan test --filter=SlaBreachNotificationTest
+docker compose exec app ./vendor/bin/pest tests/Feature/TicketApiTest.php
 ```
 
 There is no CI pipeline configured for this repository — running the suite
@@ -60,5 +60,5 @@ automatically without extra boilerplate.
 on Laravel's default preset). Run it before committing:
 
 ```bash
-docker compose exec servicedesk ./vendor/bin/pint
+docker compose exec app ./vendor/bin/pint
 ```

install.md

@@ -24,7 +24,7 @@ osobne pliki, w dwóch różnych miejscach.
 - Docker + wtyczka `docker compose`.
 - Zewnętrzna sieć Docker `traefik_public`, jeśli używasz Traefika tak jak w
   `compose.yaml` (`docker network create traefik_public`, jeśli jeszcze nie
-  istnieje). Bez Traefika trzeba samodzielnie zmapować porty serwisu `servicedesk`
+  istnieje). Bez Traefika trzeba samodzielnie zmapować porty serwisu `app`
   na hosta (`ports: ["8080:80"]`) i obsłużyć TLS inaczej (patrz sekcja 2 niżej, w
   razie potrzeby reverse-proxy przed kontenerem).
 
@@ -90,8 +90,8 @@ QUEUE_CONNECTION=database
 `APP_KEY` wygenerujesz komendą artisan (krok 1.4) — zostaw puste w pliku.
 
 `LDAP_*` i `MAIL_*` w `src/.env` są tylko **wartościami startowymi/awaryjnymi**.
-Docelowo LDAP i SMTP konfiguruje się wygodniej z poziomu **Admin > Konfiguracja**
-w samej aplikacji (patrz ramka ostrzegawcza w kroku 1.6) — ale jeśli chcesz mieć
+Docelowo LDAP konfiguruje się wygodniej z poziomu **Admin > Integracje**, a SMTP
+z **Admin > Poczta** (patrz ramka ostrzegawcza w kroku 1.6) — ale jeśli chcesz mieć
 sensowny fallback zanim ktokolwiek się zaloguje do panelu admina, warto je od razu
 uzupełnić:
 
@@ -184,7 +184,7 @@ w restartach z błędem `Undefined constant "...SIGINT"`; dodaj `pcntl posix` do
 listy w `docker-php-ext-install` i poczekaj na przebudowanie obrazu przez CI.
 
 Traefik musi kierować ścieżkę websocketu (`/app*`) do `reverb`, a resztę do
-`servicedesk` — na tej samej domenie, więc bez dodatkowego wpisu DNS/certyfikatu:
+`app` — na tej samej domenie, więc bez dodatkowego wpisu DNS/certyfikatu:
 
 ```yaml
 reverb:
@@ -240,10 +240,10 @@ te wartości są wypiekane w zbudowany bundle JS, nie czytane w runtime.
 ### 1.4. Instalacja aplikacji wewnątrz kontenera
 
 ```bash
-docker compose exec servicedesk composer install --no-dev --optimize-autoloader
-docker compose exec servicedesk php artisan key:generate
-docker compose exec servicedesk php artisan migrate --seed
-docker compose exec servicedesk php artisan storage:link
+docker compose exec app composer install --no-dev --optimize-autoloader
+docker compose exec app php artisan key:generate
+docker compose exec app php artisan migrate --seed
+docker compose exec app php artisan storage:link
 ```
 
 `migrate --seed` (bez `--fresh`) na pustej bazie utworzy wszystkie tabele i
@@ -254,7 +254,7 @@ po pierwszym zalogowaniu (Admin > Użytkownicy).
 
 ### 1.5. Zbudowanie zasobów front-endowych (CSS/Tailwind)
 
-Ani host, ani kontener `servicedesk` nie mają zainstalowanego Node.js — buduj
+Ani host, ani kontener `app` nie mają zainstalowanego Node.js — buduj
 przez jednorazowy kontener `node:22` zamiast dorzucać Node do obrazu aplikacji:
 
 ```bash
@@ -273,16 +273,35 @@ patrz Admin > Poczta) i `ai:run-ticket-automation` (opcjonalna automatyczna
 kategoryzacja/podsumowania AI zgłoszeń — patrz Admin > Integracje) co 5 minut,
 ale **obraz Dockera nie ma wbudowanego cron/supervisora** — bez dodatkowego
 kroku żadne z tych zadań nigdy się nie uruchomi (poczta IMAP nadal da się
-sprawdzić ręcznie przyciskiem „Pobierz teraz”, ale bez crona nic nie dzieje się
+sprawdzić ręcznie przyciskiem „Pobierz teraz”, ale bez tego nic nie dzieje się
 samo). Wszystkie cztery interwały są też konfigurowalne z poziomu **Admin >
 Konfiguracja** (bez potrzeby edycji kodu czy restartu — nowa wartość obowiązuje
-od najbliższego tyknięcia harmonogramu). Najprościej dodać wpis crona **na
-hoście**:
+od najbliższego tyknięcia harmonogramu).
 
-```cron
-* * * * * cd /ścieżka/do/repo && docker compose exec -T servicedesk php artisan schedule:run >> /dev/null 2>&1
+`compose.yaml` rozwiązuje to czwartą usługą, `cron` — tego samego obrazu
+`servicedesk`, tylko z innym poleceniem:
+
+```yaml
+cron:
+  image: gitea.kzbikowski.pl/kzbkowski/servicedesk:${IMAGE_TAG:-latest}
+  command: php artisan schedule:work
+  volumes:
+    - ./src:/var/www/html
+  restart: unless-stopped
+  depends_on:
+    mariadb:
+      condition: service_healthy
+  networks:
+    - internal
 ```
 
+`schedule:work` to własna, pierwszoplanowa pętla harmonogramu Laravela —
+odpowiednik odpalania `schedule:run` co minutę, ale bez potrzeby zewnętrznego
+triggera. Ten kontener nie musi być widoczny w Traefiku (nie obsługuje ruchu
+HTTP), stąd tylko sieć `internal`. Sprawdź, że działa: `docker compose ps cron`
+oraz `docker compose logs -f cron` (loguje każde odpalenie zaplanowanego
+zadania).
+
 Powiadomienia e-mail wysyłają się synchronicznie (nie trafiają do kolejki), więc
 `php artisan queue:work` nie jest obowiązkowy — `QUEUE_CONNECTION=database` w
 `.env` wystarcza jako bezpieczny domyślny driver, gdyby coś w przyszłości zaczęło
@@ -291,8 +310,9 @@ kolejkować zadania.
 ### ⚠️ Ważne: LDAP/SMTP z panelu Admina nadpisują `.env` w locie
 
 `AppServiceProvider` na starcie żądania sprawdza tabelę `settings` — jeśli w
-Admin > Konfiguracja pole **host LDAP** albo **SMTP włączony + host** jest
-ustawione, **te wartości wygrywają z `.env`**, bez potrzeby restartu czy redeployu.
+Admin > Integracje pole **host LDAP** albo w Admin > Poczta **SMTP włączony +
+host** jest ustawione, **te wartości wygrywają z `.env`**, bez potrzeby
+restartu czy redeployu.
 
 Po świeżym `migrate --seed` te pola zawierają **przykładowe placeholdery**
 (`ldap.example.com`, `smtp.example.com`, `changeme-*-password`) — to znaczy, że
@@ -301,10 +321,13 @@ adresami**, nawet jeśli w `.env` wpisałeś prawdziwe dane! Zanim oddasz system
 użytku:
 
 1. Zaloguj się lokalnym kontem `admin@example.com` / `admin`.
-2. Wejdź w **Admin > Konfiguracja** i wpisz prawdziwe dane LDAP/SMTP (albo wyczyść
-   pole hosta LDAP, żeby wrócić do wartości z `.env`).
-3. Użyj przycisków **„Testuj połączenie”** przy obu sekcjach, zanim zaczniesz
-   polegać na logowaniu przez katalog.
+2. Wejdź w **Admin > Integracje** i wpisz prawdziwe dane LDAP (wybierz też
+   właściwy **Typ katalogu** — LLDAP/OpenLDAP albo Active Directory — jeśli
+   katalog to nie LLDAP; albo wyczyść pole hosta LDAP, żeby wrócić do
+   wartości z `.env`), a w **Admin > Poczta** dane SMTP.
+3. Użyj przycisku **„Testuj połączenie”** w Integracje i **„Wyślij testową
+   wiadomość”** w Poczta, zanim zaczniesz polegać na logowaniu przez katalog
+   albo na powiadomieniach e-mail.
 
 ### Integracje opcjonalne (BookStack, AI)
 
@@ -328,6 +351,14 @@ automatyczną kategoryzację/podsumowania AI zgłoszeń (Admin > Integracje >
 „Automatyzacja AI dla zgłoszeń”, wymaga też wpisu crona z kroku 1.6/2.6
 powyżej — to ten sam harmonogram co SLA/automatyzacje/IMAP).
 
+### Import historycznych zgłoszeń z Heska (opcjonalnie)
+
+Jeśli migrujesz z helpdesku Hesk 3.x, `scripts/hesk-import/` zawiera
+jednorazowe (nie ciągłe) narzędzie migracyjne — importuje zgłoszenia wraz z
+pełną historią odpowiedzi/notatek, ograniczone do jednej domeny e-mail, w
+trybie dry-run domyślnie. Nie dotyka bazy Heska poza odczytem. Zobacz
+`scripts/hesk-import/README.md` po pełną instrukcję.
+
 ---
 
 ## 2. Wdrożenie bezpośrednio na serwerze (Apache/Nginx, bez Dockera)
@@ -383,7 +414,7 @@ QUEUE_CONNECTION=database
 ```
 
 Uzupełnij też `LDAP_*`/`MAIL_*` jak w sekcji 1.2 (to samo ostrzeżenie o
-Admin > Konfiguracja nadpisującym te wartości w locie dotyczy tu identycznie).
+Admin > Integracje/Poczta nadpisującym te wartości w locie dotyczy tu identycznie).
 
 ```bash
 php artisan key:generate
@@ -524,9 +555,9 @@ jednej ścieżki, analogicznie do reguły Traefika w 1.3b).
 ### 2.7. Pierwsze logowanie i dalsza konfiguracja
 
 Identycznie jak w kroku 1.6 — zaloguj się `admin@example.com` / `admin`, zmień
-hasło, uzupełnij prawdziwe LDAP/SMTP w Admin > Konfiguracja (placeholdery z seeda
-inaczej realnie próbują łączyć się z fałszywymi adresami), przetestuj oba
-połączenia przyciskiem „Testuj połączenie”.
+hasło, uzupełnij prawdziwe LDAP w Admin > Integracje i SMTP w Admin > Poczta
+(placeholdery z seeda inaczej realnie próbują łączyć się z fałszywymi
+adresami), przetestuj oba połączenia.
 
 ### 2.8. Aktualizacje (bez przestoju)
 

scripts/hesk-import/.env.example

@@ -0,0 +1,5 @@
+HESK_DB_HOST=
+HESK_DB_PORT=3306
+HESK_DB_DATABASE=
+HESK_DB_USERNAME=
+HESK_DB_PASSWORD=

scripts/hesk-import/README.md

@@ -0,0 +1,127 @@
+# Hesk 3.x import
+
+One-time historical migration of tickets (with full reply/note history) from a
+Hesk 3.x helpdesk database into this app, restricted to a single e-mail
+domain. Read-only against the Hesk database — never writes there.
+
+This is **not** an ongoing sync. Run it once to backfill history from an
+old Hesk install; it doesn't pick up edits made in Hesk afterward.
+
+## What it does
+
+- Matches Hesk tickets by requester e-mail domain (`--domain=firma.pl`).
+- Imports each ticket's subject/body, status, priority, and full reply +
+  internal-note history, converting Hesk's `<br />`-laden "plain" text into
+  real line breaks.
+- Maps Hesk categories to this app's categories by exact (case/whitespace-
+  insensitive) name match. A Hesk category with no match is skipped by
+  default — pass `--include-unmapped-categories` to import those tickets
+  anyway, uncategorized.
+- Auto-assigns a team when every subcategory under the matched category
+  routes to the same single team (same rule `TicketService::autoAssignTeam()`
+  uses for normal ticket creation); ambiguous categories are left unrouted.
+- Finds the local client account per requester e-mail (matched by e-mail,
+  adding the `client` role if it doesn't have it yet). **Never creates a
+  User** — the servicedesk user base is treated as authoritative/complete, so
+  a Hesk requester e-mail with no matching account means that ticket is
+  skipped (reported at the end, with the list of skipped e-mails).
+- Hesk staff replies/notes are linked to a real operator account when the
+  Hesk staff member's e-mail matches an existing servicedesk operator/admin
+  account; otherwise they fall back to showing the correct staff name and
+  "operator" badge via `author_name` only, without a clickable user behind
+  it (this script never creates operator accounts either).
+- Every imported ticket also stores its source Hesk ticket id
+  (`tickets.hesk_ticket_id`, unique). This is a second, DB-level guard
+  against duplicate imports on top of the state file below — if the state
+  file is ever lost or out of sync, a re-run still can't create a duplicate
+  ticket for the same Hesk id.
+- A ticket's Hesk owner is matched the same way as reply/note authors and
+  set as `assignee_id`, so imported tickets show up correctly assigned in
+  the operator queue instead of everything landing in "Nieprzypisane".
+
+## Setup
+
+```bash
+cp scripts/hesk-import/.env.example scripts/hesk-import/.env
+```
+
+Fill in `scripts/hesk-import/.env` with the Hesk database's
+host/port/database/username/password. That file is gitignored — it holds
+real credentials for a database this app otherwise has no access to.
+
+## Usage
+
+Always dry-run first — it reports what *would* happen without writing
+anything:
+
+```bash
+scripts/hesk-import/hesk-import.sh --domain=firma.pl
+```
+
+Try a small batch for real before committing to the whole thing:
+
+```bash
+scripts/hesk-import/hesk-import.sh --domain=firma.pl --limit=10 --commit
+```
+
+Then the full import:
+
+```bash
+scripts/hesk-import/hesk-import.sh --domain=firma.pl --commit
+```
+
+Safe to re-run (including after an interrupted/crashed run): already-imported
+Hesk ticket ids are tracked in `storage/app/hesk-import-state.json` inside the
+app container and skipped on subsequent runs.
+
+### Backfilling team assignment
+
+If tickets were already imported before team-by-category mapping existed (or
+teams/subcategories changed since), backfill `team_id` on existing imported
+tickets without importing anything new:
+
+```bash
+scripts/hesk-import/hesk-import.sh --assign-teams --commit
+```
+
+### Fixing closed-ticket dates
+
+New imports already use Hesk's dedicated `closedat` column (not `lastchange`,
+which moves forward on any later edit — e.g. a note added after closing) for
+a closed ticket's date, and record a matching "Status zmieniony na: Zamknięte"
+history entry. To apply the same correction to tickets imported before this
+existed (including the original import, from before `hesk_ticket_id` was
+even tracked — matched back to Hesk via the unique `(email, created_at)` pair
+instead):
+
+```bash
+scripts/hesk-import/hesk-import.sh --fix-closed-dates --commit
+```
+
+Doesn't import anything new; safe to re-run (already-correct tickets are left
+alone).
+
+### Backfilling ticket ownership
+
+New imports already set `assignee_id` from Hesk's ticket owner. To apply the
+same to tickets imported before this existed:
+
+```bash
+scripts/hesk-import/hesk-import.sh --assign-operators --commit
+```
+
+Only touches tickets with no `assignee_id` yet (never overwrites a manual
+reassignment made since import) and never invents an assignment — a Hesk
+owner of 0 or one with no matching servicedesk account is left unassigned,
+unless it's one of the two ids in `ImportHeskTickets::DELETED_STAFF_REASSIGNMENT`
+(Hesk staff accounts deleted since, with historical tickets explicitly
+reassigned to a current operator per the app owner).
+
+## How it's wired up
+
+`hesk-import.sh` is a thin wrapper: it loads `.env` in this folder, then runs
+`php artisan hesk:import` inside the `app` container via `docker compose
+exec`, passing the Hesk DB credentials as one-off environment variables (they
+never touch the app's own `.env` or get persisted anywhere but the state
+file). The actual import logic lives in
+[`../../src/app/Console/Commands/ImportHeskTickets.php`](../../src/app/Console/Commands/ImportHeskTickets.php).

scripts/hesk-import/hesk-import.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+#
+# Imports tickets from a Hesk 3.x helpdesk database into this app, filtered
+# to one e-mail domain. Thin wrapper around `php artisan hesk:import` (see
+# ../../src/app/Console/Commands/ImportHeskTickets.php for the actual logic)
+# — this script only wires up the Hesk DB credentials and runs it inside the
+# app container. See README.md in this folder for full setup/usage docs.
+#
+# Setup: copy .env.example (this folder) to .env (gitignored) and fill in
+# your Hesk database's host/port/database/username/password.
+#
+# Usage:
+#   scripts/hesk-import/hesk-import.sh --domain=firma.pl                # dry run (default, writes nothing)
+#   scripts/hesk-import/hesk-import.sh --domain=firma.pl --limit=10 --commit   # real run, first 10 tickets only
+#   scripts/hesk-import/hesk-import.sh --domain=firma.pl --commit        # real run, everything
+#
+# Safe to re-run: already-imported Hesk tickets are tracked in
+# storage/app/hesk-import-state.json inside the app container and skipped.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+ENV_FILE="$SCRIPT_DIR/.env"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+    echo "Brak $ENV_FILE — skopiuj scripts/hesk-import/.env.example i uzupełnij dane dostępowe do bazy Heska." >&2
+    exit 1
+fi
+
+set -a
+# shellcheck disable=SC1090
+source "$ENV_FILE"
+set +a
+
+: "${HESK_DB_HOST:?ustaw HESK_DB_HOST w $ENV_FILE}"
+: "${HESK_DB_DATABASE:?ustaw HESK_DB_DATABASE w $ENV_FILE}"
+: "${HESK_DB_USERNAME:?ustaw HESK_DB_USERNAME w $ENV_FILE}"
+HESK_DB_PORT="${HESK_DB_PORT:-3306}"
+
+cd "$REPO_ROOT"
+
+exec sudo docker compose exec \
+    -e HESK_DB_HOST="$HESK_DB_HOST" \
+    -e HESK_DB_PORT="$HESK_DB_PORT" \
+    -e HESK_DB_DATABASE="$HESK_DB_DATABASE" \
+    -e HESK_DB_USERNAME="$HESK_DB_USERNAME" \
+    -e HESK_DB_PASSWORD="$HESK_DB_PASSWORD" \
+    app php artisan hesk:import "$@"

src/.env.example

@@ -5,7 +5,7 @@ APP_DEBUG=false
 APP_URL=http://localhost
 
 AUTHOR_CONTACT=helpdesk@kzbikowski.pl
-VERSION=1.3.0
+VERSION=1.4.0
 
 APP_LOCALE=en
 APP_FALLBACK_LOCALE=en

src/app/Console/Commands/ImportHeskTickets.php

@@ -0,0 +1,908 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Category;
+use App\Models\Role;
+use App\Models\Status;
+use App\Models\Team;
+use App\Models\Ticket;
+use App\Models\TicketHistory;
+use App\Models\User;
+use Illuminate\Console\Command;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Config;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+use PDO;
+
+/**
+ * One-off migration from a Hesk 3.x helpdesk database into this app's own
+ * tickets/users. Never writes to the Hesk database — read-only there.
+ *
+ * Runs in dry-run mode by default (reports what it would do); pass --commit
+ * to actually write. Resumable: every successfully imported Hesk ticket id
+ * is recorded in a local state file (--state, defaults to
+ * storage/app/hesk-import-state.json). Belt-and-suspenders: tickets.hesk_ticket_id
+ * is also unique at the DB level, so a state file that's lost/desynced from
+ * a crash between commit and state-save can't turn into a silent duplicate —
+ * see alreadyImported(). Not idempotent across *edits* on the Hesk side —
+ * this is a one-time historical import, not an ongoing sync.
+ *
+ * As of the 2026-08 re-import pass, this never creates new local User
+ * accounts (the servicedesk user base is considered authoritative/complete)
+ * — a Hesk requester e-mail with no matching account means the ticket is
+ * skipped rather than auto-provisioning one. See resolveCustomer().
+ */
+class ImportHeskTickets extends Command
+{
+    protected $signature = 'hesk:import
+        {--domain= : Only import tickets whose requester e-mail ends in @this-domain}
+        {--commit : Actually write to the database (default is a dry run)}
+        {--limit= : Only process this many Hesk tickets (after the domain filter), useful for a test run}
+        {--state= : Path to the resume-state JSON file (default storage/app/hesk-import-state.json)}
+        {--include-unmapped-categories : Also import tickets whose Hesk category has no matching servicedesk category (default: skip them)}
+        {--assign-teams : Backfill team_id (by category) on already-imported tickets that don\'t have one yet, then exit — does not import anything}
+        {--fix-closed-dates : Backfill accurate closedat-based updated_at + a closure history entry on already-imported closed tickets, then exit — does not import anything}
+        {--assign-operators : Backfill assignee_id (from Hesk\'s ticket owner, matched by e-mail to an existing operator account) on already-imported tickets that don\'t have one yet, then exit — does not import anything}';
+
+    protected $description = 'Import tickets (with full reply/note history) from a Hesk 3.x database, restricted to one e-mail domain';
+
+    /**
+     * Hesk ticket.status -> our status_key. Hesk's built-in codes are
+     * 0=New, 1=Waiting reply (for staff), 2=Replied (waiting on customer),
+     * 3=Resolved. Any other value (seen: a handful of "5" rows, presumably
+     * a since-deleted custom status) falls back to 'open'.
+     */
+    private const STATUS_MAP = [
+        0 => 'new',
+        1 => 'waiting_operator',
+        2 => 'waiting_customer',
+        3 => 'closed',
+    ];
+
+    /**
+     * Hesk ticket.priority -> our priority_key. Hesk's enum is 1=Critical,
+     * 2=High, 3=Medium (the near-universal default — every Hesk category
+     * here defaults new tickets to priority 3); 0 is an unused/rare edge
+     * value, treated as the closest thing Hesk has to "Low".
+     */
+    private const PRIORITY_MAP = [
+        0 => 'low',
+        1 => 'critical',
+        2 => 'high',
+        3 => 'medium',
+    ];
+
+    private array $categoryMap = [];
+
+    /** @var array<int, int> servicedesk category id => servicedesk team id, only when unambiguous */
+    private array $teamByCategory = [];
+
+    /** @var array<int, string> Hesk help_users.id => name, loaded once */
+    private array $heskStaffNames = [];
+
+    /** @var array<int, ?string> Hesk help_users.id => email, loaded once */
+    private array $heskStaffEmails = [];
+
+    /** @var array<int, ?User> Hesk help_users.id => matching local operator/admin account (or null), memoized */
+    private array $operatorCache = [];
+
+    /** @var int[] hesk ticket ids already present in tickets.hesk_ticket_id — see alreadyImported() */
+    private array $importedHeskIds = [];
+
+    /** @var Collection<int, Collection> Hesk ticket id => its help_replies rows, preloaded in bulk for the whole run — see fix for the old per-ticket N+1 query */
+    private Collection $repliesByTicket;
+
+    /** @var Collection<int, Collection> Hesk ticket id => its help_notes rows, preloaded in bulk */
+    private Collection $notesByTicket;
+
+    private array $state = ['imported' => []];
+
+    private string $statePath;
+
+    public function handle(): int
+    {
+        if ($this->option('assign-teams')) {
+            return $this->runAssignTeams((bool) $this->option('commit'));
+        }
+
+        if ($this->option('fix-closed-dates')) {
+            return $this->configureHeskConnection()
+                ? $this->runFixClosedDates((bool) $this->option('commit'))
+                : self::FAILURE;
+        }
+
+        if ($this->option('assign-operators')) {
+            return $this->configureHeskConnection()
+                ? $this->runAssignOperators((bool) $this->option('commit'))
+                : self::FAILURE;
+        }
+
+        $domain = trim((string) $this->option('domain'), " \t\n\r\0\x0B@");
+
+        if ($domain === '') {
+            $this->error('Podaj --domain=twoja-domena.pl (bez @).');
+
+            return self::FAILURE;
+        }
+
+        $commit = (bool) $this->option('commit');
+        $limit = $this->option('limit') !== null ? (int) $this->option('limit') : null;
+        $includeUnmapped = (bool) $this->option('include-unmapped-categories');
+        $this->statePath = $this->option('state') ?: storage_path('app/hesk-import-state.json');
+
+        if (! $this->configureHeskConnection()) {
+            return self::FAILURE;
+        }
+
+        $this->loadState();
+        $this->buildCategoryMap();
+        $this->buildTeamMap();
+        $this->loadHeskStaffNames();
+        $this->importedHeskIds = Ticket::query()->whereNotNull('hesk_ticket_id')->pluck('hesk_ticket_id')->all();
+
+        $tickets = DB::connection('hesk')->table('help_tickets')
+            ->where('email', 'like', '%@'.$domain)
+            ->orderBy('id')
+            ->when($limit, fn ($q) => $q->limit($limit))
+            ->get();
+
+        // Only needed once a ticket is actually about to be imported, so
+        // skip the two bulk queries entirely on a dry run.
+        if ($commit) {
+            $ticketIds = $tickets->pluck('id')->all();
+            $this->repliesByTicket = DB::connection('hesk')->table('help_replies')
+                ->whereIn('replyto', $ticketIds)->orderBy('dt')->get()->groupBy('replyto');
+            $this->notesByTicket = DB::connection('hesk')->table('help_notes')
+                ->whereIn('ticket', $ticketIds)->orderBy('dt')->get()->groupBy('ticket');
+        }
+
+        $startMessage = sprintf(
+            '%s tryb: %d zgłoszeń z Heska pasuje do domeny @%s (%d już zaimportowanych wcześniej, zostaną pominięte).',
+            $commit ? 'KOMMIT' : 'DRY-RUN',
+            $tickets->count(),
+            $domain,
+            $tickets->pluck('id')->filter(fn ($id) => $this->alreadyImported($id))->count(),
+        );
+        $this->info($startMessage);
+        Log::channel('hesk_import')->info($startMessage);
+
+        $stats = ['created' => 0, 'skipped' => 0, 'skipped_unmapped_category' => 0, 'skipped_unknown_customer' => 0, 'failed' => 0, 'messages' => 0, 'operator_messages_linked' => 0];
+        $unmappedCategories = [];
+        $unknownCustomerEmails = [];
+
+        $bar = $this->output->createProgressBar($tickets->count());
+        $bar->start();
+
+        foreach ($tickets as $heskTicket) {
+            $bar->advance();
+
+            if ($this->alreadyImported($heskTicket->id)) {
+                $stats['skipped']++;
+
+                continue;
+            }
+
+            $categoryMapped = array_key_exists($heskTicket->category, $this->categoryMap);
+
+            if (! $categoryMapped && ! in_array($heskTicket->category, $unmappedCategories, true)) {
+                $unmappedCategories[] = $heskTicket->category;
+            }
+
+            // Default: a Hesk category with no servicedesk equivalent means
+            // this ticket is skipped entirely rather than imported without
+            // a category — --include-unmapped-categories opts back in.
+            if (! $categoryMapped && ! $includeUnmapped) {
+                $stats['skipped_unmapped_category']++;
+
+                continue;
+            }
+
+            // The local user base is authoritative as of the 2026-08
+            // re-import — a requester e-mail with no matching account is
+            // skipped rather than auto-provisioning a new client (see
+            // resolveCustomer()). Checked even in dry-run so the preview
+            // accurately reflects what --commit would do.
+            $customerEmail = trim($heskTicket->email);
+            if (! User::query()->where('email', $customerEmail)->exists()) {
+                $stats['skipped_unknown_customer']++;
+
+                if (! in_array($customerEmail, $unknownCustomerEmails, true)) {
+                    $unknownCustomerEmails[] = $customerEmail;
+                }
+
+                continue;
+            }
+
+            if (! $commit) {
+                $stats['created']++;
+
+                continue;
+            }
+
+            try {
+                DB::transaction(function () use ($heskTicket, &$stats) {
+                    $this->importOneTicket($heskTicket, $stats);
+                });
+                $this->state['imported'][] = $heskTicket->id;
+                $this->saveState();
+            } catch (\Throwable $e) {
+                $stats['failed']++;
+                $this->newLine();
+                $this->error("Zgłoszenie Hesk #{$heskTicket->id} ({$heskTicket->trackid}) nie zostało zaimportowane: ".$e->getMessage());
+                Log::channel('hesk_import')->error(
+                    "Zgłoszenie Hesk #{$heskTicket->id} ({$heskTicket->trackid}) nie zostało zaimportowane: {$e->getMessage()}\n".$e->getTraceAsString()
+                );
+            }
+        }
+
+        $bar->finish();
+        $this->newLine(2);
+
+        $this->table(['Miara', 'Wartość'], [
+            ['Zgłoszenia utworzone', $stats['created']],
+            ['Wiadomości/notatki utworzone', $stats['messages']],
+            ['...w tym powiązane z realnym kontem operatora', $stats['operator_messages_linked']],
+            ['Pominięte (już zaimportowane)', $stats['skipped']],
+            ['Pominięte (kategoria bez odpowiednika)', $stats['skipped_unmapped_category']],
+            ['Pominięte (brak konta klienta w servicedesk)', $stats['skipped_unknown_customer']],
+            ['Błędy', $stats['failed']],
+        ]);
+
+        if ($unmappedCategories) {
+            $names = collect($unmappedCategories)
+                ->map(fn ($id) => DB::connection('hesk')->table('help_categories')->where('id', $id)->value('name') ?? "id={$id}")
+                ->implode(', ');
+            $action = $includeUnmapped ? 'zgłoszenia zaimportowane bez kategorii' : 'zgłoszenia POMINIĘTE — użyj --include-unmapped-categories, żeby jednak je zaimportować bez kategorii';
+            $this->warn("Kategorie Heska bez odpowiednika w servicedesk ({$action}): {$names}");
+        }
+
+        if ($unknownCustomerEmails) {
+            $this->warn(sprintf(
+                'E-maile z Heska bez konta w servicedesk (%d zgłoszeń POMINIĘTYCH): %s',
+                $stats['skipped_unknown_customer'],
+                implode(', ', $unknownCustomerEmails),
+            ));
+        }
+
+        $summaryMessage = sprintf(
+            'Zakończono (%s): utworzone=%d, wiadomości=%d, pominięte=%d, pominięte(kategoria)=%d, pominięte(brak konta)=%d, błędy=%d.',
+            $commit ? 'commit' : 'dry-run',
+            $stats['created'],
+            $stats['messages'],
+            $stats['skipped'],
+            $stats['skipped_unmapped_category'],
+            $stats['skipped_unknown_customer'],
+            $stats['failed'],
+        );
+        Log::channel('hesk_import')->info($summaryMessage);
+
+        if (! $commit) {
+            $this->newLine();
+            $this->comment('To był dry-run — nic nie zostało zapisane. Uruchom ponownie z --commit, żeby faktycznie zaimportować.');
+        }
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * State file first (cheap, in-memory), then the DB as a fallback/self-heal
+     * — a hesk_ticket_id already present on a ticket row means it was
+     * genuinely committed even if the state file never got updated (crash
+     * between the transaction commit and saveState()). Tickets imported
+     * before the hesk_ticket_id column existed have no such row to fall back
+     * on, so the state file remains authoritative for those — no regression.
+     */
+    private function alreadyImported(int $heskTicketId): bool
+    {
+        if (in_array($heskTicketId, $this->state['imported'], true)) {
+            return true;
+        }
+
+        if (in_array($heskTicketId, $this->importedHeskIds, true)) {
+            $this->state['imported'][] = $heskTicketId;
+
+            return true;
+        }
+
+        return false;
+    }
+
+    private function configureHeskConnection(): bool
+    {
+        $host = env('HESK_DB_HOST');
+        $port = env('HESK_DB_PORT', 3306);
+        $database = env('HESK_DB_DATABASE');
+        $username = env('HESK_DB_USERNAME');
+        $password = env('HESK_DB_PASSWORD');
+
+        if (! $host || ! $database || ! $username) {
+            $this->error('Brakuje HESK_DB_HOST / HESK_DB_DATABASE / HESK_DB_USERNAME w środowisku (patrz scripts/hesk-import/hesk-import.sh).');
+
+            return false;
+        }
+
+        Config::set('database.connections.hesk', [
+            'driver' => 'mysql',
+            'host' => $host,
+            'port' => $port,
+            'database' => $database,
+            'username' => $username,
+            'password' => $password,
+            'charset' => 'utf8mb4',
+            'collation' => 'utf8mb4_unicode_ci',
+            'options' => [PDO::ATTR_TIMEOUT => 10],
+        ]);
+
+        try {
+            DB::connection('hesk')->getPdo();
+        } catch (\Throwable $e) {
+            $this->error('Nie udało się połączyć z bazą Heska: '.$e->getMessage());
+
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * Hesk category name (normalized) -> servicedesk category id. Only
+     * exact (case/whitespace-insensitive) name matches are mapped; anything
+     * else is left uncategorized and reported at the end instead of guessed at.
+     */
+    private function buildCategoryMap(): void
+    {
+        $ours = Category::query()->get()->keyBy(fn (Category $c) => $this->normalizeCategoryName($c->name));
+
+        foreach (DB::connection('hesk')->table('help_categories')->get() as $heskCategory) {
+            $match = $ours->get($this->normalizeCategoryName($heskCategory->name));
+
+            if ($match) {
+                $this->categoryMap[$heskCategory->id] = $match->id;
+            }
+        }
+    }
+
+    private function normalizeCategoryName(string $name): string
+    {
+        return mb_strtolower(trim($name));
+    }
+
+    /**
+     * servicedesk category id -> servicedesk team id, only when every
+     * subcategory under that category belongs to the same single team (the
+     * existing team_subcategory routing — see TicketService::autoAssignTeam()
+     * for the same rule applied to normal in-app ticket creation, there scoped
+     * to a specific subcategory rather than a whole category). A category
+     * whose subcategories are split across more than one team is left
+     * unmapped rather than guessed at.
+     */
+    private function buildTeamMap(): void
+    {
+        foreach (Category::query()->pluck('id') as $categoryId) {
+            $teamIds = Team::query()
+                ->whereHas('subcategories', fn ($q) => $q->where('subcategories.category_id', $categoryId))
+                ->pluck('id')
+                ->unique();
+
+            if ($teamIds->count() === 1) {
+                $this->teamByCategory[$categoryId] = $teamIds->first();
+            }
+        }
+    }
+
+    /**
+     * Backfill mode (--assign-teams): sets team_id on tickets that already
+     * exist (from an earlier --commit run, before team assignment was added)
+     * and don't have one yet — doesn't import anything, doesn't touch the
+     * Hesk database at all.
+     */
+    private function runAssignTeams(bool $commit): int
+    {
+        $this->buildTeamMap();
+
+        if (! $this->teamByCategory) {
+            $this->warn('Żadna kategoria nie ma jednoznacznie przypisanego zespołu (na podstawie podkategorii) — nie ma czego przypisać.');
+
+            return self::SUCCESS;
+        }
+
+        $totalUpdated = 0;
+
+        foreach ($this->teamByCategory as $categoryId => $teamId) {
+            $query = Ticket::query()->where('category_id', $categoryId)->whereNull('team_id');
+            $count = $query->count();
+
+            if ($count === 0) {
+                continue;
+            }
+
+            $this->line(sprintf(
+                'Kategoria "%s" -> zespół "%s": %d zgłoszeń%s',
+                Category::query()->find($categoryId)?->name ?? "id={$categoryId}",
+                Team::query()->find($teamId)?->name ?? "id={$teamId}",
+                $count,
+                $commit ? '' : ' (dry-run)',
+            ));
+
+            if ($commit) {
+                $query->update(['team_id' => $teamId]);
+            }
+
+            $totalUpdated += $count;
+        }
+
+        $this->newLine();
+        $this->info(($commit ? 'Zaktualizowano' : 'Do zaktualizowania').': '.$totalUpdated.' zgłoszeń.');
+
+        if (! $commit) {
+            $this->comment('To był dry-run — uruchom ponownie z --assign-teams --commit, żeby faktycznie zapisać.');
+        }
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * Backfill mode (--fix-closed-dates): corrects already-imported closed
+     * tickets whose updated_at is Hesk's lastchange (any edit — a later note
+     * or reply — rather than the actual closure) instead of Hesk's dedicated
+     * closedat column, and adds the missing "Status zmieniony na: Zamknięte"
+     * history entry every closed ticket should have (importOneTicket() now
+     * does both automatically for new imports — see there). Idempotent: an
+     * already-correct ticket, or one that already has that exact history
+     * line, is left alone.
+     *
+     * Also covers tickets imported before tickets.hesk_ticket_id existed
+     * (no direct link back to Hesk at all — the vast majority of closed
+     * imported tickets are in this group) by matching them to their source
+     * Hesk row via (email, created_at) <-> Hesk's (email, dt): every
+     * imported ticket's created_at is Hesk's dt passed through unchanged, and
+     * that pair is unique across every hesk_import ticket today (checked —
+     * zero collisions), since dt is second-precision and two tickets from
+     * the same requester in the same second essentially never happens. Their
+     * hesk_ticket_id gets backfilled too as a side effect, closing the gap
+     * where that link never existed for them.
+     */
+    private function runFixClosedDates(bool $commit): int
+    {
+        $tickets = DB::table('tickets')
+            ->where('source', 'hesk_import')
+            ->where('status_key', 'closed')
+            ->get(['id', 'hesk_ticket_id', 'email', 'created_at', 'updated_at']);
+
+        if ($tickets->isEmpty()) {
+            $this->warn('Brak zamkniętych, zaimportowanych z Heska zgłoszeń.');
+
+            return self::SUCCESS;
+        }
+
+        [$withId, $withoutId] = $tickets->partition(fn ($t) => $t->hesk_ticket_id !== null);
+
+        $heskById = $withId->isEmpty() ? collect() : DB::connection('hesk')->table('help_tickets')
+            ->whereIn('id', $withId->pluck('hesk_ticket_id'))
+            ->get(['id', 'closedat', 'lastchange'])
+            ->keyBy('id');
+
+        $heskByEmailDt = $withoutId->isEmpty() ? collect() : DB::connection('hesk')->table('help_tickets')
+            ->whereIn('email', $withoutId->pluck('email')->unique())
+            ->get(['id', 'email', 'dt', 'closedat', 'lastchange'])
+            ->keyBy(fn ($row) => $row->email.'|'.$row->dt);
+
+        $closureLabel = 'Status zmieniony na: '.Status::labelFor('closed');
+        $alreadyRecorded = TicketHistory::query()
+            ->whereIn('ticket_id', $tickets->pluck('id'))
+            ->where('text', $closureLabel)
+            ->pluck('ticket_id')
+            ->all();
+
+        $dateFixed = 0;
+        $historyAdded = 0;
+        $idBackfilled = 0;
+        $unmatched = 0;
+
+        foreach ($tickets as $ticket) {
+            $heskRow = $ticket->hesk_ticket_id !== null
+                ? $heskById->get($ticket->hesk_ticket_id)
+                : $heskByEmailDt->get($ticket->email.'|'.$ticket->created_at);
+
+            if (! $heskRow) {
+                $unmatched++;
+
+                continue;
+            }
+
+            if ($ticket->hesk_ticket_id === null) {
+                $idBackfilled++;
+
+                if ($commit) {
+                    DB::table('tickets')->where('id', $ticket->id)->update(['hesk_ticket_id' => $heskRow->id]);
+                }
+            }
+
+            $closedAt = $heskRow->closedat ?: $heskRow->lastchange;
+
+            if (! $closedAt) {
+                continue;
+            }
+
+            if ((string) $ticket->updated_at !== (string) $closedAt) {
+                $dateFixed++;
+
+                if ($commit) {
+                    DB::table('tickets')->where('id', $ticket->id)->update(['updated_at' => $closedAt]);
+                }
+            }
+
+            if (! in_array($ticket->id, $alreadyRecorded, true)) {
+                $historyAdded++;
+
+                if ($commit) {
+                    TicketHistory::query()->create([
+                        'ticket_id' => $ticket->id,
+                        'text' => $closureLabel,
+                        'created_at' => $closedAt,
+                    ]);
+                }
+            }
+        }
+
+        $this->table(['Miara', 'Wartość'], [
+            ['Sprawdzone zamknięte zgłoszenia', $tickets->count()],
+            ['Poprawiona data zamknięcia', $dateFixed],
+            ['Dodany wpis historii zamknięcia', $historyAdded],
+            ['Uzupełniony hesk_ticket_id (stare importy)', $idBackfilled],
+            ['Bez dopasowania w bazie Heska', $unmatched],
+        ]);
+
+        if (! $commit) {
+            $this->newLine();
+            $this->comment('To był dry-run — uruchom ponownie z --fix-closed-dates --commit, żeby faktycznie zapisać.');
+        }
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * Hesk's dedicated closedat column (set once when a ticket transitions
+     * to Resolved) is a more accurate "when was this actually closed" than
+     * lastchange, which moves forward on ANY later edit — a note added
+     * after closing, for instance. Falls back to lastchange for the rare
+     * closed ticket with no closedat recorded (seen on very old rows).
+     */
+    private function heskClosedAt(object $heskTicket): ?string
+    {
+        return $heskTicket->closedat ?: $heskTicket->lastchange;
+    }
+
+    /**
+     * Backfill mode (--assign-operators): sets assignee_id (from Hesk's
+     * ticket owner, resolved to a local operator by e-mail — same
+     * resolveOperator() used for reply/note authorship) on already-imported
+     * tickets that don't have one yet. importOneTicket() does this
+     * automatically for new imports — see there. Never overwrites an
+     * assignee_id an operator may have since set manually in servicedesk
+     * (only touches tickets where it's still null), and never invents an
+     * assignment: a Hesk owner of 0 (unassigned) or one whose e-mail
+     * doesn't match any local operator (e.g. Hesk staff since deleted —
+     * seen in practice on this data) is left unassigned rather than guessed.
+     */
+    private function runAssignOperators(bool $commit): int
+    {
+        $tickets = DB::table('tickets')
+            ->where('source', 'hesk_import')
+            ->whereNotNull('hesk_ticket_id')
+            ->whereNull('assignee_id')
+            ->get(['id', 'hesk_ticket_id']);
+
+        if ($tickets->isEmpty()) {
+            $this->warn('Brak zaimportowanych zgłoszeń bez przypisanego operatora do sprawdzenia.');
+
+            return self::SUCCESS;
+        }
+
+        $this->loadHeskStaffNames();
+
+        $heskOwners = DB::connection('hesk')->table('help_tickets')
+            ->whereIn('id', $tickets->pluck('hesk_ticket_id'))
+            ->pluck('owner', 'id');
+
+        $assigned = 0;
+        $noHeskOwner = 0;
+        $ownerUnmatched = 0;
+
+        foreach ($tickets as $ticket) {
+            $ownerId = (int) ($heskOwners[$ticket->hesk_ticket_id] ?? 0);
+
+            if ($ownerId <= 0) {
+                $noHeskOwner++;
+
+                continue;
+            }
+
+            $operator = $this->resolveAssignee($ownerId);
+
+            if (! $operator) {
+                $ownerUnmatched++;
+
+                continue;
+            }
+
+            $assigned++;
+
+            if ($commit) {
+                DB::table('tickets')->where('id', $ticket->id)->update(['assignee_id' => $operator->id]);
+            }
+        }
+
+        $this->table(['Miara', 'Wartość'], [
+            ['Sprawdzone zgłoszenia bez operatora', $tickets->count()],
+            ['Przypisano operatora', $assigned],
+            ['Brak właściciela w Hesku (nieprzypisane)', $noHeskOwner],
+            ['Właściciel w Hesku bez konta w servicedesk', $ownerUnmatched],
+        ]);
+
+        if (! $commit) {
+            $this->newLine();
+            $this->comment('To był dry-run — uruchom ponownie z --assign-operators --commit, żeby faktycznie zapisać.');
+        }
+
+        return self::SUCCESS;
+    }
+
+    private function loadHeskStaffNames(): void
+    {
+        $rows = DB::connection('hesk')->table('help_users')->select('id', 'name', 'email')->get();
+        $this->heskStaffNames = $rows->pluck('name', 'id')->all();
+        $this->heskStaffEmails = $rows->pluck('email', 'id')->all();
+    }
+
+    /**
+     * Matches a Hesk staff member to a real local User by e-mail, so
+     * imported replies/notes are linked to an actual clickable operator
+     * account rather than only carrying the right name via author_name.
+     * Falls back to null (unchanged prior behavior) when no local account
+     * has that e-mail — this never creates operator accounts.
+     */
+    private function resolveOperator(int $heskStaffId): ?User
+    {
+        if (! array_key_exists($heskStaffId, $this->operatorCache)) {
+            $email = $this->heskStaffEmails[$heskStaffId] ?? null;
+            $this->operatorCache[$heskStaffId] = $email ? User::query()->where('email', $email)->first() : null;
+        }
+
+        return $this->operatorCache[$heskStaffId];
+    }
+
+    /**
+     * Hesk staff ids whose account has since been fully deleted from Hesk
+     * (no help_users row left at all — resolveOperator() has no e-mail to
+     * even look up for these) mapped to the servicedesk operator who should
+     * own their historical tickets now, per explicit instruction from the
+     * app owner. staffid 6 was Katarzyna Piewiszkis, 7 was Agnieszka
+     * Konopka — identified from ticket-history text remnants, not from any
+     * structured Hesk data (there wasn't any left).
+     */
+    private const DELETED_STAFF_REASSIGNMENT = [
+        6 => 'agolebiowska@polagent.com',
+        7 => 'agolebiowska@polagent.com',
+    ];
+
+    /**
+     * Ticket-*ownership*-specific resolution: falls back to
+     * DELETED_STAFF_REASSIGNMENT when resolveOperator() can't do anything
+     * (no e-mail left in Hesk to look up). Deliberately not folded into
+     * resolveOperator() itself — reassigning who now owns a ticket is
+     * reasonable, but reply/note *authorship* should keep reflecting who
+     * actually wrote it rather than being silently rewritten to whoever
+     * ticket ownership was reassigned to.
+     */
+    private function resolveAssignee(int $heskOwnerId): ?User
+    {
+        return $this->resolveOperator($heskOwnerId)
+            ?? (isset(self::DELETED_STAFF_REASSIGNMENT[$heskOwnerId])
+                ? User::query()->where('email', self::DELETED_STAFF_REASSIGNMENT[$heskOwnerId])->first()
+                : null);
+    }
+
+    private function importOneTicket(object $heskTicket, array &$stats): void
+    {
+        $customer = $this->resolveCustomer($heskTicket->email);
+
+        if (! $customer) {
+            // Guarded against in handle() before this is ever called — kept
+            // here as a hard stop rather than silently creating an
+            // orphaned/incorrect ticket if that guard is ever bypassed.
+            throw new \RuntimeException("Brak konta klienta dla {$heskTicket->email} — nie powinno się zdarzyć, sprawdzono wcześniej w handle().");
+        }
+
+        $categoryId = $this->categoryMap[$heskTicket->category] ?? null;
+        $statusKey = self::STATUS_MAP[(int) $heskTicket->status] ?? 'open';
+        $closedAt = $statusKey === 'closed' ? $this->heskClosedAt($heskTicket) : null;
+        $assignee = ((int) $heskTicket->owner) > 0 ? $this->resolveAssignee((int) $heskTicket->owner) : null;
+
+        $ticket = Ticket::query()->create([
+            'number' => Ticket::nextNumber(),
+            'customer_id' => $customer->id,
+            'email' => $heskTicket->email,
+            'name' => $heskTicket->name ?: $heskTicket->email,
+            'category_id' => $categoryId,
+            'team_id' => $categoryId ? ($this->teamByCategory[$categoryId] ?? null) : null,
+            'assignee_id' => $assignee?->id,
+            'subject' => $this->cleanText($heskTicket->subject) ?: '(bez tematu)',
+            'body' => $this->cleanText($heskTicket->message),
+            'status_key' => $statusKey,
+            'priority_key' => self::PRIORITY_MAP[(int) $heskTicket->priority] ?? 'medium',
+            'source' => 'hesk_import',
+            'hesk_ticket_id' => $heskTicket->id,
+            'last_customer_activity_at' => $heskTicket->lastchange,
+            'created_at' => $heskTicket->dt,
+            'updated_at' => $closedAt ?? $heskTicket->lastchange,
+        ]);
+
+        // Ticket::booted() re-saves the row right after create() to stamp a
+        // checksum, which — being a normal Eloquent save() — stomps
+        // updated_at back to "now". Restore the historical value via the
+        // query builder so it bypasses Eloquent's timestamp handling.
+        DB::table('tickets')->where('id', $ticket->id)->update(['updated_at' => $closedAt ?? $heskTicket->lastchange]);
+
+        $opening = $ticket->messages()->create([
+            'author_name' => $heskTicket->name ?: $heskTicket->email,
+            'body' => $this->cleanText($heskTicket->message),
+            'created_at' => $heskTicket->dt,
+            'updated_at' => $heskTicket->dt,
+        ]);
+        $opening->attachAuthor($customer->id, 'client');
+        $stats['messages']++;
+
+        foreach ($this->heskReplies($heskTicket->id) as $reply) {
+            $this->importReply($ticket, $reply, $customer, $stats);
+        }
+
+        foreach ($this->heskNotes($heskTicket->id) as $note) {
+            $this->importNote($ticket, $note, $stats);
+        }
+
+        // Mirrors what a real in-app closure leaves behind (see
+        // TicketService::setStatus()) so an imported closed ticket's
+        // "Historia zmian" tab isn't empty and shows an accurate closure
+        // date — without this, nothing else records when/that it closed.
+        if ($closedAt) {
+            $ticket->histories()->create([
+                'text' => 'Status zmieniony na: '.Status::labelFor('closed'),
+                'created_at' => $closedAt,
+            ]);
+        }
+
+        $stats['created']++;
+    }
+
+    /**
+     * Both pulled from repliesByTicket/notesByTicket, bulk-preloaded once
+     * for the whole run in handle() rather than queried per ticket here —
+     * on a multi-thousand-ticket import that was 2 extra DB round-trips per
+     * ticket for no reason, since the domain filter already bounds the
+     * result set to something worth loading in one shot.
+     */
+    private function heskReplies(int $heskTicketId): Collection
+    {
+        return $this->repliesByTicket->get($heskTicketId, collect());
+    }
+
+    private function heskNotes(int $heskTicketId): Collection
+    {
+        return $this->notesByTicket->get($heskTicketId, collect());
+    }
+
+    private function importReply(Ticket $ticket, object $reply, User $customer, array &$stats): void
+    {
+        $isStaff = (int) $reply->staffid > 0;
+        $operator = $isStaff ? $this->resolveOperator((int) $reply->staffid) : null;
+        $authorName = $isStaff
+            ? ($operator->name ?? $this->heskStaffNames[$reply->staffid] ?? 'Personel')
+            : ($reply->name ?: $customer->name);
+
+        $message = $ticket->messages()->create([
+            'author_name' => $authorName,
+            'body' => $this->cleanText($reply->message),
+            'created_at' => $reply->dt,
+            'updated_at' => $reply->dt,
+        ]);
+
+        // Linked to a real operator User when the Hesk staff e-mail matches
+        // one (resolveOperator()); otherwise falls back to the previous
+        // behavior — attachAuthor(null, 'operator') still tags the
+        // role/badge correctly via author_name, just without a clickable
+        // user behind it.
+        $message->attachAuthor($isStaff ? $operator?->id : $customer->id, $isStaff ? 'operator' : 'client');
+        $stats['messages']++;
+
+        if ($isStaff && $operator) {
+            $stats['operator_messages_linked']++;
+        }
+    }
+
+    private function importNote(Ticket $ticket, object $note, array &$stats): void
+    {
+        $operator = $this->resolveOperator((int) $note->who);
+
+        $message = $ticket->messages()->create([
+            'author_name' => $operator->name ?? $this->heskStaffNames[$note->who] ?? 'Personel',
+            'internal' => true,
+            'body' => $this->cleanText($note->message),
+            'created_at' => $note->dt,
+            'updated_at' => $note->dt,
+        ]);
+        $message->attachAuthor($operator?->id, 'operator');
+        $stats['messages']++;
+
+        if ($operator) {
+            $stats['operator_messages_linked']++;
+        }
+    }
+
+    /**
+     * Finds the local client account for a Hesk requester e-mail. As of the
+     * 2026-08 re-import the servicedesk user base is considered
+     * authoritative/complete — this deliberately never creates a User
+     * anymore (unlike the original 2026-08-04 run); handle() checks
+     * existence before a ticket ever reaches here, so returning null is not
+     * expected in normal operation (see importOneTicket()'s hard-stop guard).
+     * Only ever adds the 'client' role to a match — never removes whatever
+     * roles the account already had.
+     */
+    private function resolveCustomer(string $email): ?User
+    {
+        $user = User::query()->where('email', trim($email))->first();
+
+        if (! $user) {
+            return null;
+        }
+
+        if (! in_array('client', $user->roles, true)) {
+            $user->roles = [...$user->roles, 'client'];
+            $user->save();
+        }
+
+        return $user;
+    }
+
+    /**
+     * Hesk's "plain" message/subject columns still carry <br /> tags (and
+     * occasionally other inline HTML) from HTML-formatted source e-mails —
+     * this app renders ticket/message bodies as escaped plain text
+     * (white-space:pre-wrap), so raw tags would show up literally instead
+     * of as line breaks.
+     */
+    private function cleanText(?string $value): string
+    {
+        if ($value === null || $value === '') {
+            return '';
+        }
+
+        $text = preg_replace('/<br\s*\/?>/i', "\n", $value);
+        $text = strip_tags($text);
+        $text = html_entity_decode($text, ENT_QUOTES | ENT_HTML5, 'UTF-8');
+
+        return trim($text);
+    }
+
+    private function loadState(): void
+    {
+        if (is_file($this->statePath)) {
+            $decoded = json_decode(file_get_contents($this->statePath), true);
+            $this->state = is_array($decoded) ? $decoded : $this->state;
+            $this->state['imported'] ??= [];
+        }
+    }
+
+    private function saveState(): void
+    {
+        $dir = dirname($this->statePath);
+        if (! is_dir($dir)) {
+            mkdir($dir, 0755, true);
+        }
+
+        file_put_contents($this->statePath, json_encode($this->state));
+    }
+}

src/app/Ldap/AdUser.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Ldap;
+
+use LdapRecord\Models\ActiveDirectory\User as ActiveDirectoryUser;
+
+/**
+ * Active Directory counterpart to LldapUser — same role (the LdapRecord
+ * model backing the 'users' auth provider), but for AD's schema instead of
+ * LLDAP/OpenLDAP's. AD user objects carry objectClass top/person/
+ * organizationalPerson/user (no inetOrgPerson/posixAccount/mailAccount, so
+ * LldapUser's object-class scope matches zero AD entries) and expose a
+ * binary objectGUID rather than entryUUID — both already handled correctly
+ * by LdapRecord's stock ActiveDirectory\User, so no overrides are needed
+ * here, only the swap in AppServiceProvider::applyLdapSettingsOverride()
+ * (driven by the ldap_directory_type setting).
+ */
+class AdUser extends ActiveDirectoryUser {}

src/app/Livewire/Admin/Logs.php

@@ -0,0 +1,171 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Collection;
+use Livewire\Attributes\Computed;
+use Livewire\Component;
+
+/**
+ * Read-only viewer over storage/logs/*.log — the only way to see what the
+ * scheduled integrations (IMAP fetch, automation rules, AI automation) are
+ * doing without shell access to the container. Deliberately whitelists
+ * files via files()/glob() rather than trusting $selectedFile directly,
+ * since it's a public Livewire property a client could otherwise tamper
+ * with into a path-traversal read of arbitrary files.
+ */
+class Logs extends Component
+{
+    /**
+     * How much of a (possibly multi-MB, e.g. browser.log) file to read from
+     * the tail per request — bounds memory/response size regardless of how
+     * large the underlying file grows.
+     */
+    private const MAX_BYTES = 4 * 1024 * 1024;
+
+    private const LEVELS = ['EMERGENCY', 'ALERT', 'CRITICAL', 'ERROR', 'WARNING', 'NOTICE', 'INFO', 'DEBUG'];
+
+    public string $selectedFile = '';
+
+    public string $levelFilter = '';
+
+    public string $search = '';
+
+    public int $limit = 300;
+
+    public bool $autoRefresh = false;
+
+    public function mount(): void
+    {
+        $names = $this->files()->pluck('name');
+        $this->selectedFile = $names->first(fn (string $n) => $n === 'laravel.log') ?? $names->first() ?? '';
+    }
+
+    public static function availableLevels(): array
+    {
+        return self::LEVELS;
+    }
+
+    /**
+     * @return array{class: string, style: string} CSS for the level badge —
+     *                                             reuses the existing .tag-* palette (accent/accent-2/neutral) where
+     *                                             it fits, and falls back to inline color-mix() (matching the
+     *                                             danger/warning treatment already used elsewhere, e.g.
+     *                                             admin/api-keys.blade.php's status tags) for severities with no
+     *                                             existing tag class.
+     */
+    public static function levelBadge(?string $level): array
+    {
+        return match ($level) {
+            'DEBUG' => ['class' => 'tag tag-neutral', 'style' => ''],
+            'INFO' => ['class' => 'tag tag-accent-2', 'style' => ''],
+            'NOTICE' => ['class' => 'tag tag-accent', 'style' => ''],
+            'WARNING' => ['class' => 'tag', 'style' => 'background:color-mix(in srgb, var(--color-warning) 20%, transparent);color:var(--color-warning)'],
+            'ERROR' => ['class' => 'tag', 'style' => 'background:color-mix(in srgb, var(--color-danger) 18%, transparent);color:var(--color-danger)'],
+            'CRITICAL', 'ALERT', 'EMERGENCY' => ['class' => 'tag', 'style' => 'background:var(--color-danger);color:#fff'],
+            default => ['class' => 'tag tag-outline', 'style' => ''],
+        };
+    }
+
+    #[Computed]
+    public function files(): Collection
+    {
+        $paths = glob(storage_path('logs/*.log')) ?: [];
+
+        return collect($paths)
+            ->map(fn (string $path) => [
+                'name' => basename($path),
+                'size' => filesize($path) ?: 0,
+                'modified' => Carbon::createFromTimestamp(filemtime($path) ?: time()),
+            ])
+            ->sortByDesc('modified')
+            ->values();
+    }
+
+    #[Computed]
+    public function entries(): Collection
+    {
+        if ($this->selectedFile === '' || ! $this->files()->pluck('name')->contains($this->selectedFile)) {
+            return collect();
+        }
+
+        $path = storage_path('logs/'.$this->selectedFile);
+
+        if (! is_file($path)) {
+            return collect();
+        }
+
+        $size = filesize($path);
+        $handle = fopen($path, 'r');
+        $truncated = $size > self::MAX_BYTES;
+
+        if ($truncated) {
+            fseek($handle, -self::MAX_BYTES, SEEK_END);
+        }
+
+        $content = stream_get_contents($handle);
+        fclose($handle);
+
+        // A new log entry starts at a "[YYYY-MM-DD HH:MM:SS]" line; anything
+        // after it (stack traces, multi-line messages) belongs to that entry.
+        $chunks = preg_split('/(?=^\[\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}:\d{2})/m', (string) $content);
+        $chunks = array_values(array_filter($chunks, fn (string $c) => trim($c) !== ''));
+
+        if ($truncated && count($chunks) > 1) {
+            // First chunk was very likely cut mid-entry by the seek above.
+            array_shift($chunks);
+        }
+
+        $entries = collect($chunks)->map(function (string $chunk) {
+            preg_match('/^\[[^\]]+\]\s+\S+\.(\w+):/', $chunk, $m);
+
+            return [
+                'level' => isset($m[1]) ? strtoupper($m[1]) : null,
+                'text' => rtrim($chunk),
+            ];
+        });
+
+        if ($this->levelFilter !== '') {
+            $entries = $entries->filter(fn (array $e) => $e['level'] === $this->levelFilter);
+        }
+
+        if (trim($this->search) !== '') {
+            $needle = mb_strtolower($this->search);
+            $entries = $entries->filter(fn (array $e) => str_contains(mb_strtolower($e['text']), $needle));
+        }
+
+        return $entries->values()->slice(-$this->limit)->values();
+    }
+
+    public function selectFile(string $name): void
+    {
+        if ($this->files()->pluck('name')->contains($name)) {
+            $this->selectedFile = $name;
+        }
+    }
+
+    public function formatBytes(int $bytes): string
+    {
+        if ($bytes < 1024) {
+            return "{$bytes} B";
+        }
+
+        $units = ['KB', 'MB', 'GB'];
+        $value = $bytes / 1024;
+
+        foreach ($units as $unit) {
+            if ($value < 1024 || $unit === end($units)) {
+                return number_format($value, 1).' '.$unit;
+            }
+            $value /= 1024;
+        }
+
+        return "{$bytes} B";
+    }
+
+    public function render()
+    {
+        return view('livewire.admin.logs');
+    }
+}

src/app/Livewire/Admin/Panel.php

@@ -219,6 +219,7 @@ class Panel extends Component
 
         $this->ldapConfig = [
             'enabled' => Settings::bool('ldap_enabled'),
+            'directoryType' => Settings::get('ldap_directory_type', 'lldap'),
             'host' => Settings::get('ldap_host'),
             'port' => Settings::get('ldap_port'),
             'baseDn' => Settings::get('ldap_base_dn'),
@@ -1498,6 +1499,7 @@ class Panel extends Component
     public function saveLdapConfig(): void
     {
         Settings::set('ldap_enabled', $this->ldapConfig['enabled'] ? '1' : '0');
+        Settings::set('ldap_directory_type', $this->ldapConfig['directoryType'] === 'ad' ? 'ad' : 'lldap');
         Settings::set('ldap_host', $this->ldapConfig['host']);
         Settings::set('ldap_port', (string) $this->ldapConfig['port']);
         Settings::set('ldap_base_dn', $this->ldapConfig['baseDn']);
@@ -1814,8 +1816,38 @@ class Panel extends Component
         $this->cancelPendingDelete();
     }
 
+    /**
+     * Mirrors the labels in the $tabGroups array built inline in
+     * admin/panel.blade.php (icons/grouping live only there — this is just
+     * the page-title-sized subset, not worth threading the whole structure
+     * through the PHP side for).
+     */
+    private const TAB_LABELS = [
+        'categories' => 'Kategorie',
+        'fields' => 'Pola dodatkowe',
+        'statuses' => 'Statusy',
+        'priorities' => 'Priorytety i SLA',
+        'reply-quick-actions' => 'Szybkie akcje odpowiedzi',
+        'response-templates' => 'Szablony odpowiedzi',
+        'automation-rules' => 'Automatyzacja SLA',
+        'triggers' => 'Wyzwalacze',
+        'users' => 'Użytkownicy',
+        'teams' => 'Zespoły',
+        'user-fields' => 'Pola dodatkowe',
+        'templates' => 'Szablony e-mail',
+        'email' => 'Poczta',
+        'branding' => 'Wygląd i branding',
+        'config' => 'Konfiguracja',
+        'integrations' => 'Integracje',
+        'api-keys' => 'Klucze API',
+        'logs' => 'Logi',
+        'about' => 'O aplikacji',
+    ];
+
     public function render()
     {
-        return view('livewire.admin.panel');
+        $tabLabel = self::TAB_LABELS[$this->tab] ?? 'Panel administratora';
+
+        return view('livewire.admin.panel')->title(Settings::pageTitle($tabLabel));
     }
 }

src/app/Livewire/Auth/Login.php

@@ -75,6 +75,6 @@ class Login extends Component
 
     public function render()
     {
-        return view('livewire.auth.login');
+        return view('livewire.auth.login')->title(Settings::pageTitle('Logowanie'));
     }
 }

src/app/Livewire/Client/Dashboard.php

@@ -3,36 +3,52 @@
 namespace App\Livewire\Client;
 
 use App\Models\Status;
+use App\Support\Settings;
 use Illuminate\Support\Facades\Auth;
 use Livewire\Attributes\Computed;
 use Livewire\Component;
+use Livewire\WithPagination;
 
 class Dashboard extends Component
 {
+    use WithPagination;
+
+    private const PER_PAGE = 20;
+
     public string $tab = 'current';
 
     public string $search = '';
 
-    #[Computed]
-    public function tickets()
+    protected function baseQuery()
     {
         return Auth::user()->ticketsAsCustomer()
             ->search($this->search)
             ->with('subcategory.category')
-            ->orderByDesc('updated_at')
-            ->get();
+            ->orderByDesc('updated_at');
     }
 
+    /**
+     * Separate named paginators (see pageName below) so switching tabs
+     * doesn't reset whichever page the other tab was on.
+     */
     #[Computed]
     public function currentTickets()
     {
-        return $this->tickets->whereNotIn('status_key', Status::closedKeys());
+        return $this->baseQuery()->whereNotIn('status_key', Status::closedKeys())
+            ->paginate(self::PER_PAGE, pageName: 'currentPage');
     }
 
     #[Computed]
     public function archiveTickets()
     {
-        return $this->tickets->whereIn('status_key', Status::closedKeys());
+        return $this->baseQuery()->whereIn('status_key', Status::closedKeys())
+            ->paginate(self::PER_PAGE, pageName: 'archivePage');
+    }
+
+    public function updatedSearch(): void
+    {
+        $this->resetPage('currentPage');
+        $this->resetPage('archivePage');
     }
 
     public function setTab(string $tab): void
@@ -42,6 +58,6 @@ class Dashboard extends Component
 
     public function render()
     {
-        return view('livewire.client.dashboard');
+        return view('livewire.client.dashboard')->title(Settings::pageTitle('Moje zgłoszenia'));
     }
 }

src/app/Livewire/Client/NewTicket.php

@@ -209,6 +209,6 @@ class NewTicket extends Component
 
     public function render()
     {
-        return view('livewire.client.new-ticket');
+        return view('livewire.client.new-ticket')->title(Settings::pageTitle('Nowe zgłoszenie'));
     }
 }

src/app/Livewire/Client/TicketShow.php

@@ -33,6 +33,10 @@ class TicketShow extends Component
 
     public string $csatComment = '';
 
+    public bool $showAllOtherTickets = false;
+
+    private const OTHER_TICKETS_PREVIEW_COUNT = 5;
+
     // Set via wire:init (see the blade view) rather than on the initial
     // render, so the BookStack HTTP call in suggestedArticles() never
     // delays the ticket page's first paint — it loads in a beat later instead.
@@ -103,7 +107,21 @@ class TicketShow extends Component
     #[Computed]
     public function otherTickets()
     {
-        return Auth::user()->ticketsAsCustomer()->where('id', '!=', $this->ticket->id)->get();
+        $query = Auth::user()->ticketsAsCustomer()->where('id', '!=', $this->ticket->id)->latest();
+
+        return $this->showAllOtherTickets ? $query->get() : $query->take(self::OTHER_TICKETS_PREVIEW_COUNT)->get();
+    }
+
+    #[Computed]
+    public function otherTicketsCount(): int
+    {
+        return Auth::user()->ticketsAsCustomer()->where('id', '!=', $this->ticket->id)->count();
+    }
+
+    public function revealAllOtherTickets(): void
+    {
+        $this->showAllOtherTickets = true;
+        unset($this->otherTickets);
     }
 
     /**
@@ -222,6 +240,6 @@ class TicketShow extends Component
 
     public function render()
     {
-        return view('livewire.client.ticket-show');
+        return view('livewire.client.ticket-show')->title(Settings::pageTitle($this->ticket->displayNumber().' — '.$this->ticket->subject));
     }
 }

src/app/Livewire/GlobalSearch.php

@@ -0,0 +1,141 @@
+<?php
+
+namespace App\Livewire;
+
+use App\Models\Ticket;
+use App\Models\User;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\DB;
+use Livewire\Attributes\Computed;
+use Livewire\Component;
+
+class GlobalSearch extends Component
+{
+    public string $search = '';
+
+    /**
+     * Gmail-style "field:value" operators — recognized keys (accent-
+     * insensitive, a couple of Polish synonyms each) narrow the match to
+     * that one field; anything left over after stripping them still runs
+     * through the broad Ticket::scopeSearch() default. Multiple operators
+     * combine with AND, same as Gmail's "from:x subject:y".
+     */
+    private const FIELD_PREFIXES = [
+        'od' => 'from',
+        'nadawca' => 'from',
+        'temat' => 'subject',
+        'tytul' => 'subject',
+        'tytuł' => 'subject',
+        'tresc' => 'body',
+        'treść' => 'body',
+        'numer' => 'number',
+        'nr' => 'number',
+    ];
+
+    #[Computed]
+    public function results()
+    {
+        $term = trim($this->search);
+
+        if ($term === '' || ! ($user = Auth::user())) {
+            return collect();
+        }
+
+        $query = $this->baseQuery($user);
+
+        if (! $query) {
+            return collect();
+        }
+
+        [$fields, $free] = $this->parseQuery($term);
+
+        foreach ($fields as $field => $values) {
+            foreach ($values as $value) {
+                $this->applyFieldFilter($query, $field, $value);
+            }
+        }
+
+        // search() itself no-ops on an empty term, so this is safe to call
+        // unconditionally — it only matters when there was no operator at
+        // all, or an operator left some free text behind.
+        $query->search($free);
+
+        return $query->orderByDesc('updated_at')->limit(8)->get();
+    }
+
+    /**
+     * Splits "od:kacper temat:drukarka reszta" into recognized field
+     * operators plus whatever free text is left over. An unrecognized
+     * "key:value" (e.g. a pasted URL) is left untouched in the free text
+     * rather than silently dropped.
+     */
+    private function parseQuery(string $term): array
+    {
+        $fields = [];
+
+        $free = preg_replace_callback(
+            '/(\pL+):(\S+)/u',
+            function ($m) use (&$fields) {
+                $key = mb_strtolower($m[1]);
+
+                if (! isset(self::FIELD_PREFIXES[$key])) {
+                    return $m[0];
+                }
+
+                $fields[self::FIELD_PREFIXES[$key]][] = $m[2];
+
+                return '';
+            },
+            $term
+        );
+
+        return [$fields, trim(preg_replace('/\s+/', ' ', $free))];
+    }
+
+    private function applyFieldFilter($query, string $field, string $value): void
+    {
+        $like = '%'.$value.'%';
+
+        match ($field) {
+            'from' => $query->where(fn ($q) => $q->where('name', 'like', $like)->orWhere('email', 'like', $like)),
+            'subject' => $query->where('subject', 'like', $like),
+            'number' => $query->where('number', 'like', $like),
+            'body' => $query->where(fn ($q) => $q->where('body', 'like', $like)
+                ->orWhereIn('id', DB::table('ticket_messages')->where('body', 'like', $like)->pluck('ticket_id'))),
+            default => null,
+        };
+    }
+
+    public function urlFor(Ticket $ticket): string
+    {
+        $user = Auth::user();
+
+        return $user->isOperator()
+            ? route('operator.ticket', $ticket)
+            : route('client.ticket', $ticket);
+    }
+
+    /**
+     * Scoped (and routed, see urlFor()) by the operator role specifically
+     * rather than isAdmin() — admin alone doesn't grant the operator.*
+     * routes (see routes/web.php's role:operator middleware), so a result
+     * pointing there would 404 for an admin-only account.
+     */
+    protected function baseQuery(User $user)
+    {
+        if ($user->isOperator()) {
+            return Ticket::query()->visibleToOperator($user);
+        }
+
+        if ($user->isClient()) {
+            return $user->ticketsAsCustomer();
+        }
+
+        return null;
+    }
+
+    public function render()
+    {
+        return view('livewire.global-search');
+    }
+}

src/app/Livewire/Landing.php

@@ -10,6 +10,7 @@ use App\Services\BookStackClient;
 use App\Services\LdapUserProvisioner;
 use App\Services\TicketService;
 use App\Support\Settings;
+use Illuminate\Support\Facades\Auth;
 use Livewire\Attributes\Computed;
 use Livewire\Component;
 use Livewire\WithFileUploads;
@@ -41,6 +42,13 @@ class Landing extends Component
     // delays the page's first paint — it loads in a beat later instead.
     public bool $suggestedArticlesLoaded = false;
 
+    public function mount(): void
+    {
+        if (Auth::check()) {
+            $this->redirect(route('client.dashboard'), navigate: true);
+        }
+    }
+
     public function loadSuggestedArticles(): void
     {
         $this->suggestedArticlesLoaded = true;
@@ -187,6 +195,8 @@ class Landing extends Component
 
     public function render()
     {
-        return view('livewire.landing');
+        $context = $this->submittedTicketId ? 'Zgłoszenie utworzone' : 'Zgłoś problem';
+
+        return view('livewire.landing')->title(Settings::pageTitle($context));
     }
 }

src/app/Livewire/Operator/ClientSearch.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Livewire\Operator;
+
+use App\Models\User;
+use App\Support\Settings;
+use Livewire\Attributes\Computed;
+use Livewire\Attributes\Url;
+use Livewire\Component;
+
+class ClientSearch extends Component
+{
+    #[Url]
+    public string $search = '';
+
+    /**
+     * A search box, not a browse-everything list — capped rather than
+     * paginated, same reasoning as the debounced search inputs elsewhere
+     * (queue/dashboard): once there's a match count this large, the fix is a
+     * narrower search term, not another page to click through.
+     */
+    private const MAX_RESULTS = 20;
+
+    /**
+     * Matches by name or e-mail across every account, not just role=client —
+     * a ticket's customer_id can point at any user (e.g. an operator who
+     * also filed a ticket), so narrowing to clients only would hide valid
+     * results. Role badges in the view make it clear who's who.
+     */
+    #[Computed]
+    public function results()
+    {
+        $term = trim($this->search);
+
+        if ($term === '') {
+            return collect();
+        }
+
+        return User::query()
+            ->where(fn ($q) => $q->where('name', 'like', "%{$term}%")->orWhere('email', 'like', "%{$term}%"))
+            ->withCount('ticketsAsCustomer')
+            ->orderBy('name')
+            ->limit(self::MAX_RESULTS)
+            ->get();
+    }
+
+    public function render()
+    {
+        return view('livewire.operator.client-search')->title(Settings::pageTitle('Klienci'));
+    }
+}

src/app/Livewire/Operator/NewTicket.php

@@ -160,6 +160,6 @@ class NewTicket extends Component
 
     public function render()
     {
-        return view('livewire.operator.new-ticket');
+        return view('livewire.operator.new-ticket')->title(Settings::pageTitle('Nowe zgłoszenie'));
     }
 }

src/app/Livewire/Operator/Queue.php

@@ -10,14 +10,30 @@ use App\Models\Team;
 use App\Models\Ticket;
 use App\Models\User;
 use App\Services\TicketService;
+use App\Support\Settings;
+use Illuminate\Pagination\LengthAwarePaginator;
 use Illuminate\Support\Facades\Auth;
 use Livewire\Attributes\Computed;
 use Livewire\Attributes\On;
 use Livewire\Attributes\Url;
 use Livewire\Component;
+use Livewire\WithPagination;
 
 class Queue extends Component
 {
+    use WithPagination;
+
+    /**
+     * Rows per page for the ticket table below. Sorting (see sortTickets())
+     * still happens in PHP over the full filtered result — several sortable
+     * columns (kategoria, przypisany, zespół...) are derived labels with no
+     * single backing SQL column — so this slices the already-sorted
+     * collection rather than using a query-level ->paginate(). That still
+     * bounds how many rows ever hit the DOM at once, which is what actually
+     * mattered once the ticket count grew into the thousands.
+     */
+    private const PER_PAGE = 50;
+
     #[Url]
     public string $queue = 'all';
 
@@ -129,6 +145,32 @@ class Queue extends Component
         $this->sortDir = $filters['sortDir'] ?? $this->sortDir;
         $this->visibleColumns = $filters['visibleColumns'] ?? $this->visibleColumns;
         $this->selectedIds = [];
+        $this->resetPage();
+    }
+
+    /**
+     * Any change to a filter/search/queue-tab input can shrink the result
+     * set out from under whatever page the operator was on — snap back to
+     * page 1 rather than showing an empty table.
+     */
+    public function updatedSearch(): void
+    {
+        $this->resetPage();
+    }
+
+    public function updatedFilterStatus(): void
+    {
+        $this->resetPage();
+    }
+
+    public function updatedFilterPriority(): void
+    {
+        $this->resetPage();
+    }
+
+    public function updatedFilterCategory(): void
+    {
+        $this->resetPage();
     }
 
     public function saveCurrentView(): void
@@ -285,6 +327,21 @@ class Queue extends Component
         return $groups;
     }
 
+    /**
+     * Last few tickets this operator actually opened (see
+     * Ticket::recordViewBy(), called from TicketShow::mount()) — re-scoped
+     * through visibleToOperator() in case a team reassignment since the
+     * view happened would now hide it from them.
+     */
+    #[Computed]
+    public function recentlyViewed()
+    {
+        return Auth::user()->recentlyViewedTickets()
+            ->visibleToOperator(Auth::user())
+            ->take(6)
+            ->get();
+    }
+
     #[Computed]
     public function filteredTickets()
     {
@@ -297,7 +354,9 @@ class Queue extends Component
         if ($this->filterPriority !== 'all') {
             $query->where('priority_key', $this->filterPriority);
         }
-        if ($this->filterCategory !== 'all') {
+        if ($this->filterCategory === 'none') {
+            $query->whereNull('subcategory_id')->whereNull('category_id');
+        } elseif ($this->filterCategory !== 'all') {
             // A ticket carries a category either via its subcategory or,
             // when routed to a whole category with no subcategory (e.g. an
             // IMAP mailbox), directly on tickets.category_id.
@@ -314,8 +373,15 @@ class Queue extends Component
         }
 
         $tickets = $query->with(['subcategory.category', 'category', 'assignee', 'priority', 'status', 'team'])->get();
+        $sorted = $this->sortTickets($tickets);
 
-        return $this->sortTickets($tickets);
+        return new LengthAwarePaginator(
+            $sorted->forPage($this->getPage(), self::PER_PAGE)->values(),
+            $sorted->count(),
+            self::PER_PAGE,
+            $this->getPage(),
+            ['path' => request()->url()],
+        );
     }
 
     /**
@@ -415,11 +481,14 @@ class Queue extends Component
         if ($key !== 'closed' && $this->filterStatus !== 'all' && Status::stageFor($this->filterStatus) === 'closed') {
             $this->filterStatus = 'all';
         }
+
+        $this->resetPage();
     }
 
     public function clearCustomerFilter(): void
     {
         $this->filterCustomerId = null;
+        $this->resetPage();
     }
 
     public function toggleSelect(int $id): void
@@ -496,6 +565,8 @@ class Queue extends Component
 
     public function render()
     {
-        return view('livewire.operator.queue');
+        $queueLabel = $this->queueDefs()[$this->queue]['label'] ?? 'Kolejka';
+
+        return view('livewire.operator.queue')->title(Settings::pageTitle($queueLabel));
     }
 }

src/app/Livewire/Operator/Stats.php

@@ -9,6 +9,7 @@ use App\Models\Status;
 use App\Models\Team;
 use App\Models\Ticket;
 use App\Models\User;
+use App\Support\Settings;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\DB;
@@ -127,7 +128,17 @@ class Stats extends Component
             $query->where('tickets.priority_key', $this->filterPriority);
         }
         if ($this->filterCategory !== 'all') {
-            $query->whereHas('subcategory', fn ($q) => $q->where('category_id', $this->filterCategory));
+            // A ticket can carry its category two ways — via a subcategory
+            // (whose own category_id we check through) or, when routed to a
+            // bare category with no subcategory, via tickets.category_id
+            // directly (see Ticket::category()). Only checking the
+            // subcategory relation silently dropped every bare-category
+            // ticket from the filter.
+            $categoryId = $this->filterCategory;
+            $query->where(function ($q) use ($categoryId) {
+                $q->where('tickets.category_id', $categoryId)
+                    ->orWhereHas('subcategory', fn ($sq) => $sq->where('category_id', $categoryId));
+            });
         }
         if ($this->filterAssignee === 'unassigned') {
             $query->whereNull('tickets.assignee_id');
@@ -298,37 +309,70 @@ class Stats extends Component
         ])->values();
     }
 
+    /**
+     * A ticket carries its category two ways: via a subcategory (whose
+     * category_id we join through), or — when routed to a bare category with
+     * no subcategory — via tickets.category_id directly (see
+     * Ticket::category()). Counting only the subcategory join silently
+     * dropped every bare-category ticket, so this sums both paths per
+     * category id before joining to categories for the label.
+     */
     #[Computed]
     public function byCategory()
     {
-        return (clone $this->baseQuery)
+        $viaSubcategory = (clone $this->baseQuery)
             ->whereNotNull('tickets.subcategory_id')
             ->join('subcategories', 'subcategories.id', '=', 'tickets.subcategory_id')
-            ->join('categories', 'categories.id', '=', 'subcategories.category_id')
-            ->select('categories.name as label', DB::raw('count(*) as count'))
-            ->groupBy('categories.id', 'categories.name')
-            ->orderByDesc('count')
-            ->get()
-            ->map(fn ($row) => ['label' => $row->label, 'count' => (int) $row->count]);
+            ->select('subcategories.category_id', DB::raw('count(*) as count'))
+            ->groupBy('subcategories.category_id')
+            ->pluck('count', 'category_id');
+
+        $viaCategory = (clone $this->baseQuery)
+            ->whereNull('tickets.subcategory_id')
+            ->whereNotNull('tickets.category_id')
+            ->select('tickets.category_id', DB::raw('count(*) as count'))
+            ->groupBy('tickets.category_id')
+            ->pluck('count', 'category_id');
+
+        $counts = $viaSubcategory->keys()->merge($viaCategory->keys())->unique()
+            ->mapWithKeys(fn ($id) => [$id => ($viaSubcategory[$id] ?? 0) + ($viaCategory[$id] ?? 0)]);
+
+        return Category::query()->whereIn('id', $counts->keys())->get()
+            ->map(fn (Category $c) => ['label' => $c->name, 'count' => (int) $counts[$c->id]])
+            ->sortByDesc('count')
+            ->values();
     }
 
     /**
-     * One level deeper than byCategory() — same shape, but grouped by the
-     * actual subcategory, labeled "Category / Subcategory" to disambiguate
-     * subcategories that share a name across different parent categories.
+     * One level deeper than byCategory() — grouped by the actual subcategory,
+     * labeled "Category / Subcategory" to disambiguate subcategories that
+     * share a name across different parent categories. Tickets routed to a
+     * bare category (no subcategory — see byCategory()'s docblock) have no
+     * subcategory to group by, so they get their own "Category (bez
+     * podkategorii)" row instead of being silently dropped.
      */
     #[Computed]
     public function bySubcategory()
     {
-        return (clone $this->baseQuery)
+        $withSubcategory = (clone $this->baseQuery)
             ->whereNotNull('tickets.subcategory_id')
             ->join('subcategories', 'subcategories.id', '=', 'tickets.subcategory_id')
             ->join('categories', 'categories.id', '=', 'subcategories.category_id')
             ->select('subcategories.id', 'categories.name as category_name', 'subcategories.name as sub_name', DB::raw('count(*) as count'))
             ->groupBy('subcategories.id', 'categories.name', 'subcategories.name')
-            ->orderByDesc('count')
             ->get()
             ->map(fn ($row) => ['label' => $row->category_name.' / '.$row->sub_name, 'count' => (int) $row->count]);
+
+        $bareCategory = (clone $this->baseQuery)
+            ->whereNull('tickets.subcategory_id')
+            ->whereNotNull('tickets.category_id')
+            ->join('categories', 'categories.id', '=', 'tickets.category_id')
+            ->select('categories.name as category_name', DB::raw('count(*) as count'))
+            ->groupBy('categories.id', 'categories.name')
+            ->get()
+            ->map(fn ($row) => ['label' => $row->category_name.' (bez podkategorii)', 'count' => (int) $row->count]);
+
+        return $withSubcategory->concat($bareCategory)->sortByDesc('count')->values();
     }
 
     #[Computed]
@@ -624,6 +668,6 @@ class Stats extends Component
 
     public function render()
     {
-        return view('livewire.operator.stats');
+        return view('livewire.operator.stats')->title(Settings::pageTitle('Statystyki'));
     }
 }

src/app/Livewire/Operator/TicketShow.php

@@ -124,6 +124,8 @@ class TicketShow extends Component
         // ticket-show.blade.php) — so every open resumes it, not just the
         // very first one.
         $this->ticket->resumeTimer();
+
+        $this->ticket->recordViewBy(Auth::user());
     }
 
     /**
@@ -773,6 +775,6 @@ class TicketShow extends Component
         // progress is saved incrementally rather than only on explicit stop.
         $this->ticket->flushTimer();
 
-        return view('livewire.operator.ticket-show');
+        return view('livewire.operator.ticket-show')->title(Settings::pageTitle($this->ticket->displayNumber().' — '.$this->ticket->subject));
     }
 }

src/app/Livewire/Settings/NotificationPreferences.php

@@ -3,6 +3,7 @@
 namespace App\Livewire\Settings;
 
 use App\Models\NotificationPreference;
+use App\Support\Settings;
 use Illuminate\Support\Facades\Auth;
 use Livewire\Component;
 
@@ -39,6 +40,7 @@ class NotificationPreferences extends Component
 
     public function render()
     {
-        return view('livewire.settings.notification-preferences', ['rows' => $this->rows()]);
+        return view('livewire.settings.notification-preferences', ['rows' => $this->rows()])
+            ->title(Settings::pageTitle('Powiadomienia'));
     }
 }

src/app/Models/EmailTemplate.php

@@ -5,7 +5,7 @@ namespace App\Models;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Model;
 
-#[Fillable(['key', 'name', 'trigger_label', 'subject', 'body'])]
+#[Fillable(['key', 'name', 'subject', 'body'])]
 class EmailTemplate extends Model
 {
     public function render(array $placeholders): array

src/app/Models/Ticket.php

@@ -9,12 +9,13 @@ use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\Relations\HasOne;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\DB;
 
 #[Fillable([
     'number', 'checksum', 'customer_id', 'email', 'name', 'subcategory_id', 'category_id', 'subject', 'body',
-    'status_key', 'priority_key', 'team_id', 'assignee_id', 'custom_fields', 'api_client_id', 'source',
+    'status_key', 'priority_key', 'team_id', 'assignee_id', 'custom_fields', 'api_client_id', 'source', 'hesk_ticket_id',
     'sla_notified_at', 'last_customer_activity_at', 'time_spent_seconds', 'timer_started_at',
     'created_at', 'updated_at', 'csat_rating', 'csat_comment', 'csat_rated_at',
     'ai_triaged_at', 'ai_summary', 'ai_suggested_action', 'ai_summary_generated_at',
@@ -22,6 +23,43 @@ use Illuminate\Support\Facades\DB;
 ])]
 class Ticket extends Model
 {
+    /**
+     * Every value ever written to tickets.source across the app — web
+     * submission (the default), IMAP-fetched e-mail, and the Hesk import
+     * command. Enforced on save (see booted() below) so a typo'd literal
+     * fails loudly instead of silently sticking in the column.
+     */
+    public const SOURCES = ['web', 'email', 'hesk_import'];
+
+    /**
+     * ai_* and snipeit_* fields are no longer real columns on `tickets` —
+     * they live in aiSummary()/snipeitAsset(), one-to-one extension tables (see the
+     * 2026_08_05_000164/000165 migrations for why: both blocks are wide and
+     * null on most tickets). These maps back the getAttribute()/
+     * setAttribute() overrides below, which keep every existing
+     * `$ticket->ai_summary`/`$ticket->snipeit_asset_id` read/write working
+     * unchanged against the new tables, so callers never had to change.
+     */
+    private const AI_SUMMARY_FIELD_MAP = [
+        'ai_triaged_at' => 'triaged_at',
+        'ai_summary' => 'summary',
+        'ai_suggested_action' => 'suggested_action',
+        'ai_summary_generated_at' => 'summary_generated_at',
+    ];
+
+    private const SNIPEIT_FIELD_MAP = [
+        'snipeit_asset_id' => 'asset_id',
+        'snipeit_asset_name' => 'asset_name',
+    ];
+
+    /**
+     * Queued writes to the virtual ai_* and snipeit_* fields above, flushed into
+     * the related row once the ticket itself is saved (see booted()) rather
+     * than applied immediately — a brand-new ticket has no id yet to key the
+     * related row on.
+     */
+    protected array $pendingVirtualAttributes = [];
+
     /**
      * Every ticket gets a stable, unique checksum the moment its id is known
      * — it never needs to change afterward, and having it always populated
@@ -34,6 +72,87 @@ class Ticket extends Model
             $ticket->checksum = static::generateUniqueChecksum($ticket->id);
             $ticket->saveQuietly();
         });
+
+        static::saving(function (Ticket $ticket) {
+            if ($ticket->source !== null && ! in_array($ticket->source, self::SOURCES, true)) {
+                throw new \InvalidArgumentException("Invalid ticket source: {$ticket->source}");
+            }
+        });
+
+        static::saved(function (Ticket $ticket) {
+            $ticket->flushPendingVirtualAttributes();
+
+            // Keeps ticket_field_values (queryable EAV rows) in sync with the
+            // freeform custom_fields JSON blob — see syncFieldValues().
+            if ($ticket->wasChanged('custom_fields') || $ticket->wasRecentlyCreated) {
+                $ticket->syncFieldValues();
+            }
+        });
+    }
+
+    /**
+     * @see AI_SUMMARY_FIELD_MAP, SNIPEIT_FIELD_MAP
+     */
+    public function getAttribute($key)
+    {
+        if (isset(self::AI_SUMMARY_FIELD_MAP[$key])) {
+            return array_key_exists($key, $this->pendingVirtualAttributes)
+                ? $this->pendingVirtualAttributes[$key]
+                : $this->aiSummary?->{self::AI_SUMMARY_FIELD_MAP[$key]};
+        }
+
+        if (isset(self::SNIPEIT_FIELD_MAP[$key])) {
+            return array_key_exists($key, $this->pendingVirtualAttributes)
+                ? $this->pendingVirtualAttributes[$key]
+                : $this->snipeitAsset?->{self::SNIPEIT_FIELD_MAP[$key]};
+        }
+
+        return parent::getAttribute($key);
+    }
+
+    /**
+     * @see AI_SUMMARY_FIELD_MAP, SNIPEIT_FIELD_MAP
+     */
+    public function setAttribute($key, $value)
+    {
+        if (isset(self::AI_SUMMARY_FIELD_MAP[$key]) || isset(self::SNIPEIT_FIELD_MAP[$key])) {
+            $this->pendingVirtualAttributes[$key] = $value;
+
+            return $this;
+        }
+
+        return parent::setAttribute($key, $value);
+    }
+
+    protected function flushPendingVirtualAttributes(): void
+    {
+        if (! $this->pendingVirtualAttributes) {
+            return;
+        }
+
+        $ai = array_intersect_key($this->pendingVirtualAttributes, self::AI_SUMMARY_FIELD_MAP);
+        $snipeit = array_intersect_key($this->pendingVirtualAttributes, self::SNIPEIT_FIELD_MAP);
+        $this->pendingVirtualAttributes = [];
+
+        if ($ai) {
+            $this->aiSummary()->updateOrCreate([], collect($ai)
+                ->mapWithKeys(fn ($value, $key) => [self::AI_SUMMARY_FIELD_MAP[$key] => $value])->all());
+        }
+
+        if ($snipeit) {
+            $this->snipeitAsset()->updateOrCreate([], collect($snipeit)
+                ->mapWithKeys(fn ($value, $key) => [self::SNIPEIT_FIELD_MAP[$key] => $value])->all());
+        }
+    }
+
+    public function aiSummary(): HasOne
+    {
+        return $this->hasOne(TicketAiSummary::class);
+    }
+
+    public function snipeitAsset(): HasOne
+    {
+        return $this->hasOne(TicketSnipeitAsset::class);
     }
 
     protected function casts(): array
@@ -46,9 +165,6 @@ class Ticket extends Model
             'timer_started_at' => 'datetime',
             'csat_rating' => 'integer',
             'csat_rated_at' => 'datetime',
-            'ai_triaged_at' => 'datetime',
-            'ai_summary_generated_at' => 'datetime',
-            'snipeit_asset_id' => 'integer',
         ];
     }
 
@@ -87,6 +203,16 @@ class Ticket extends Model
         return $this->belongsTo(Category::class);
     }
 
+    /**
+     * Queryable counterpart to the custom_fields JSON blob — see
+     * syncFieldValues(). Read-only from the app's perspective; write custom
+     * field values via the custom_fields attribute as before.
+     */
+    public function fieldValues(): HasMany
+    {
+        return $this->hasMany(TicketFieldValue::class);
+    }
+
     public function watchers(): BelongsToMany
     {
         return $this->belongsToMany(User::class, 'ticket_watchers');
@@ -97,6 +223,26 @@ class Ticket extends Model
         return $this->watchers()->where('users.id', $user->id)->exists();
     }
 
+    public function viewers(): BelongsToMany
+    {
+        return $this->belongsToMany(User::class, 'ticket_views')->withPivot('viewed_at');
+    }
+
+    /**
+     * Bumps viewed_at for an existing view rather than duplicating it — sync()
+     * updates pivot columns on already-attached rows, not just new ones.
+     *
+     * Formatted explicitly with microseconds: a plain Carbon instance gets
+     * bound through the connection's default date format (whole seconds,
+     * regardless of the column's own declared precision), so two views in
+     * the same second would otherwise tie and silently fall back to sorting
+     * by row id instead of actual recency.
+     */
+    public function recordViewBy(User $user): void
+    {
+        $this->viewers()->syncWithoutDetaching([$user->id => ['viewed_at' => now()->format('Y-m-d H:i:s.u')]]);
+    }
+
     public function status(): BelongsTo
     {
         return $this->belongsTo(Status::class, 'status_key');
@@ -137,9 +283,18 @@ class Ticket extends Model
         return $this->hasMany(AutomationRuleTicketLog::class);
     }
 
+    /**
+     * Numeric-safe "max + 1" without pulling every ticket's number into PHP
+     * memory (`number` is a plain string column, so a DB-level MAX() would
+     * sort lexicographically — "999" > "1000" — hence ordering by length
+     * first). LENGTH()/ORDER BY/LIMIT are portable across MySQL and the
+     * sqlite connection tests run against, unlike a driver-specific CAST.
+     */
     public static function nextNumber(): string
     {
-        $max = static::query()->pluck('number')->map(fn ($n) => (int) $n)->max();
+        $max = (int) static::query()
+            ->orderByRaw('LENGTH(number) DESC, number DESC')
+            ->value('number');
 
         return (string) (($max ?: 1000) + 1);
     }
@@ -533,4 +688,33 @@ class Ticket extends Model
             ->values()
             ->all();
     }
+
+    /**
+     * Mirrors the custom_fields JSON blob into ticket_field_values, one row
+     * per non-blank entry — called automatically on save (see booted()).
+     * Deleted/blanked entries are removed rather than left stale, and
+     * unrecognized field ids (e.g. a value left over after its custom_fields
+     * definition was deleted) are skipped, matching the migration's
+     * backfill.
+     */
+    public function syncFieldValues(): void
+    {
+        $values = $this->custom_fields ?? [];
+        $validFieldIds = CustomField::query()->pluck('id')->all();
+
+        $this->fieldValues()->whereNotIn('custom_field_id', array_keys($values))->delete();
+
+        foreach ($values as $fieldId => $value) {
+            if ($value === '' || $value === null || ! in_array((int) $fieldId, $validFieldIds, true)) {
+                $this->fieldValues()->where('custom_field_id', $fieldId)->delete();
+
+                continue;
+            }
+
+            $this->fieldValues()->updateOrCreate(
+                ['custom_field_id' => $fieldId],
+                ['value' => is_bool($value) ? ($value ? '1' : '0') : (string) $value],
+            );
+        }
+    }
 }

src/app/Models/TicketAiSummary.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Attributes\Fillable;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+#[Fillable(['ticket_id', 'triaged_at', 'summary', 'suggested_action', 'summary_generated_at'])]
+class TicketAiSummary extends Model
+{
+    protected function casts(): array
+    {
+        return [
+            'triaged_at' => 'datetime',
+            'summary_generated_at' => 'datetime',
+        ];
+    }
+
+    public function ticket(): BelongsTo
+    {
+        return $this->belongsTo(Ticket::class);
+    }
+}

src/app/Models/TicketFieldValue.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Attributes\Fillable;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+#[Fillable(['ticket_id', 'custom_field_id', 'value'])]
+class TicketFieldValue extends Model
+{
+    public function ticket(): BelongsTo
+    {
+        return $this->belongsTo(Ticket::class);
+    }
+
+    public function field(): BelongsTo
+    {
+        return $this->belongsTo(CustomField::class, 'custom_field_id');
+    }
+}

src/app/Models/TicketMessage.php

@@ -12,6 +12,23 @@ use Illuminate\Database\Eloquent\Relations\HasOneThrough;
 #[Fillable(['ticket_id', 'author_name', 'internal', 'body', 'edited', 'api_client_id', 'source', 'created_at', 'updated_at'])]
 class TicketMessage extends Model
 {
+    /**
+     * Non-null values ever written to ticket_messages.source — null means
+     * "web" (see the migration that added this column); only IMAP-fetched
+     * replies set it to 'email'. Enforced on save (see booted() below) so a
+     * typo'd literal fails loudly instead of silently sticking.
+     */
+    public const SOURCES = ['email'];
+
+    protected static function booted(): void
+    {
+        static::saving(function (TicketMessage $message) {
+            if ($message->source !== null && ! in_array($message->source, self::SOURCES, true)) {
+                throw new \InvalidArgumentException("Invalid ticket message source: {$message->source}");
+            }
+        });
+    }
+
     protected function casts(): array
     {
         return [

src/app/Models/TicketSnipeitAsset.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Attributes\Fillable;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+#[Fillable(['ticket_id', 'asset_id', 'asset_name'])]
+class TicketSnipeitAsset extends Model
+{
+    protected function casts(): array
+    {
+        return [
+            'asset_id' => 'integer',
+        ];
+    }
+
+    public function ticket(): BelongsTo
+    {
+        return $this->belongsTo(Ticket::class);
+    }
+}

src/app/Models/User.php

@@ -2,7 +2,6 @@
 
 namespace App\Models;
 
-// use Illuminate\Contracts\Auth\MustVerifyEmail;
 use Database\Factories\UserFactory;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Attributes\Hidden;
@@ -16,7 +15,7 @@ use LdapRecord\Laravel\Auth\AuthenticatesWithLdap;
 use LdapRecord\Laravel\Auth\LdapAuthenticatable;
 
 #[Fillable(['name', 'email', 'password', 'roles', 'custom_field_values'])]
-#[Hidden(['password', 'remember_token'])]
+#[Hidden(['password'])]
 class User extends Authenticatable implements LdapAuthenticatable
 {
     /** @use HasFactory<UserFactory> */
@@ -109,7 +108,6 @@ class User extends Authenticatable implements LdapAuthenticatable
     protected function casts(): array
     {
         return [
-            'email_verified_at' => 'datetime',
             'password' => 'hashed',
         ];
     }
@@ -189,6 +187,13 @@ class User extends Authenticatable implements LdapAuthenticatable
         return $this->belongsToMany(Ticket::class, 'ticket_watchers');
     }
 
+    public function recentlyViewedTickets(): BelongsToMany
+    {
+        return $this->belongsToMany(Ticket::class, 'ticket_views')
+            ->withPivot('viewed_at')
+            ->orderByPivot('viewed_at', 'desc');
+    }
+
     public function ticketsAssigned(): HasMany
     {
         return $this->hasMany(Ticket::class, 'assignee_id');

src/app/Providers/AppServiceProvider.php

@@ -158,6 +158,12 @@ class AppServiceProvider extends ServiceProvider
 
         Config::set('ldap.connections.default', $config);
         Container::addConnection(new Connection($config), 'default');
+
+        // Active Directory's objectClass chain (top/person/organizationalPerson/
+        // user) and login attribute (sAMAccountName) differ from the
+        // LLDAP/OpenLDAP schema LldapUser is scoped to — swap in AdUser so a
+        // directory switch doesn't leave every login matching zero entries.
+        Config::set('auth.providers.users.model', Settings::ldapUserModelClass());
     }
 
     /**

src/app/Services/AiClient.php

@@ -4,6 +4,8 @@ namespace App\Services;
 
 use App\Support\Settings;
 use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Str;
 
 /**
  * Generic OpenAI-compatible chat-completions client — works against Groq,
@@ -32,19 +34,38 @@ class AiClient
             return null;
         }
 
+        $model = Settings::get('ai_model');
+
         try {
             $response = $this->client()->post('/chat/completions', [
-                'model' => Settings::get('ai_model'),
+                'model' => $model,
                 'messages' => $messages,
                 ...$options,
             ]);
 
             if (! $response->successful()) {
+                Log::channel('ai')->warning(sprintf(
+                    'Zapytanie do modelu %s zakończone błędem HTTP %d: %s',
+                    $model,
+                    $response->status(),
+                    $response->json('error.message') ?? Str::limit($response->body(), 300),
+                ));
+
                 return null;
             }
 
-            return $response->json('choices.0.message.content');
-        } catch (\Throwable) {
+            $content = $response->json('choices.0.message.content');
+            Log::channel('ai')->debug(sprintf(
+                'Zapytanie do modelu %s: %d wiadomości wejściowych, odpowiedź %d znaków.',
+                $model,
+                count($messages),
+                mb_strlen((string) $content),
+            ));
+
+            return $content;
+        } catch (\Throwable $e) {
+            Log::channel('ai')->error("Zapytanie do modelu {$model} nie powiodło się: {$e->getMessage()}");
+
             return null;
         }
     }

src/app/Services/LdapUserProvisioner.php

@@ -2,10 +2,11 @@
 
 namespace App\Services;
 
-use App\Ldap\LldapUser;
 use App\Models\User;
 use App\Models\UserField;
+use App\Support\Settings;
 use Illuminate\Support\Facades\Log;
+use LdapRecord\Models\Model as LdapModel;
 use Throwable;
 
 /**
@@ -80,11 +81,26 @@ class LdapUserProvisioner
         return $matched;
     }
 
-    protected function findLdapEntryForUser(User $user): ?LldapUser
+    /**
+     * The LdapRecord model class for whichever directory is currently
+     * configured (LLDAP vs Active Directory — see
+     * Settings::ldapUserModelClass()) — resolved fresh on every call rather
+     * than cached, since an admin can flip the directory type mid-session.
+     */
+    protected function ldapUserModel(): string
+    {
+        return Settings::ldapUserModelClass();
+    }
+
+    protected function findLdapEntryForUser(User $user): ?LdapModel
     {
         if ($user->guid) {
             try {
-                $byGuid = LldapUser::query()->where('entryuuid', '=', $user->guid)->first();
+                // findByGuid() builds the right raw filter for either a
+                // binary objectGUID (AD) or a plain entryUUID string
+                // (LLDAP/OpenLDAP) — unlike a plain ->where(), it doesn't
+                // need to know which attribute that is.
+                $byGuid = $this->ldapUserModel()::query()->findByGuid($user->guid);
             } catch (Throwable $e) {
                 Log::warning('LDAP lookup by guid failed: '.$e->getMessage());
                 $byGuid = null;
@@ -98,10 +114,10 @@ class LdapUserProvisioner
         return $this->findLdapEntryByEmail($user->email);
     }
 
-    protected function findLdapEntryByEmail(string $email): ?LldapUser
+    protected function findLdapEntryByEmail(string $email): ?LdapModel
     {
         try {
-            return LldapUser::query()->where('mail', '=', $email)->first();
+            return $this->ldapUserModel()::query()->where('mail', '=', $email)->first();
         } catch (Throwable $e) {
             Log::warning('LDAP lookup by email failed: '.$e->getMessage());
 
@@ -109,7 +125,7 @@ class LdapUserProvisioner
         }
     }
 
-    public function applyFieldsFromLdap(User $user, LldapUser $ldapEntry): void
+    public function applyFieldsFromLdap(User $user, LdapModel $ldapEntry): void
     {
         $values = $user->custom_field_values ?? [];
 

src/app/Services/TicketAiSummaryService.php

@@ -6,6 +6,7 @@ use App\Models\Ticket;
 use App\Support\Settings;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Str;
 
 /**
@@ -48,6 +49,13 @@ class TicketAiSummaryService
                 $this->summarizeOne($ticket) ? $totals['updated']++ : $totals['failed']++;
             });
 
+        Log::channel('ai')->info(sprintf(
+            'Podsumowania: przeskanowano %d, zaktualizowano %d, błędów %d.',
+            $totals['scanned'],
+            $totals['updated'],
+            $totals['failed'],
+        ));
+
         return $totals;
     }
 
@@ -58,18 +66,28 @@ class TicketAiSummaryService
      * latter also changes on unrelated actions (status/priority/timer
      * edits), which would otherwise trigger spurious re-summarization on
      * every scheduler tick for an active ticket.
+     *
+     * ai_summary_generated_at now lives on the related ticket_ai_summaries
+     * row (see Ticket::aiSummary()), so this joins to it directly rather
+     * than going through the model relation — a plain whereNull() on the
+     * left-joined column covers "no row yet" the same way it used to cover
+     * "column is null" when it lived on tickets itself.
      */
     protected function staleQuery(): Builder
     {
-        return Ticket::query()->where(function (Builder $q) {
-            $q->whereNull('ai_summary_generated_at')
-                ->orWhere(function (Builder $q2) {
-                    $q2->whereNotNull('ai_summary_generated_at')
-                        ->whereColumn('ai_summary_generated_at', '<', DB::raw(
-                            '(select max(ticket_messages.created_at) from ticket_messages where ticket_messages.ticket_id = tickets.id)'
-                        ));
-                });
-        })->orderBy('id');
+        return Ticket::query()
+            ->leftJoin('ticket_ai_summaries', 'ticket_ai_summaries.ticket_id', '=', 'tickets.id')
+            ->where(function (Builder $q) {
+                $q->whereNull('ticket_ai_summaries.summary_generated_at')
+                    ->orWhere(function (Builder $q2) {
+                        $q2->whereNotNull('ticket_ai_summaries.summary_generated_at')
+                            ->whereColumn('ticket_ai_summaries.summary_generated_at', '<', DB::raw(
+                                '(select max(ticket_messages.created_at) from ticket_messages where ticket_messages.ticket_id = tickets.id)'
+                            ));
+                    });
+            })
+            ->select('tickets.*')
+            ->orderBy('tickets.id');
     }
 
     /**
@@ -99,6 +117,8 @@ class TicketAiSummaryService
             // Leaves any prior summary untouched and generated_at unchanged,
             // so the ticket stays in the stale set and gets retried next run
             // rather than silently losing a working summary.
+            Log::channel('ai')->warning("Podsumowanie zgłoszenia #{$ticket->number}: nie udało się wygenerować (brak lub niepoprawna odpowiedź modelu).");
+
             return false;
         }
 
@@ -108,6 +128,8 @@ class TicketAiSummaryService
             'ai_summary_generated_at' => now(),
         ]);
 
+        Log::channel('ai')->debug("Podsumowanie zgłoszenia #{$ticket->number}: zaktualizowane.");
+
         return true;
     }
 

src/app/Services/TicketAiTriageService.php

@@ -6,6 +6,7 @@ use App\Models\Category;
 use App\Models\Priority;
 use App\Models\Ticket;
 use App\Support\Settings;
+use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Str;
 
 /**
@@ -43,7 +44,12 @@ class TicketAiTriageService
         $vocabulary = $this->buildVocabulary();
         $priorities = Priority::query()->orderBy('sort_order')->pluck('label', 'key')->all();
 
-        Ticket::query()->whereNull('ai_triaged_at')
+        // ai_triaged_at now lives on the related ticket_ai_summaries row (see
+        // Ticket::aiSummary()) — whereDoesntHave() matches both "no row yet"
+        // and "row exists but triaged_at is still null", same as the plain
+        // whereNull() this replaces did when the column lived on tickets.
+        Ticket::query()
+            ->whereDoesntHave('aiSummary', fn ($q) => $q->whereNotNull('triaged_at'))
             ->orderBy('id')
             ->limit($limit ?? self::BATCH_LIMIT)
             ->get()
@@ -52,6 +58,13 @@ class TicketAiTriageService
                 $this->triageOne($ticket, $vocabulary, $priorities, $totals);
             });
 
+        Log::channel('ai')->info(sprintf(
+            'Triage: przeskanowano %d, zmieniono %d, błędów %d.',
+            $totals['scanned'],
+            $totals['changed'],
+            $totals['failed'],
+        ));
+
         return $totals;
     }
 
@@ -92,6 +105,7 @@ class TicketAiTriageService
         // response doesn't get retried forever.
         if ($raw !== null && $parsed === null) {
             $totals['failed']++;
+            Log::channel('ai')->warning("Triage zgłoszenia #{$ticket->number}: odpowiedź modelu nie dała się zinterpretować jako JSON.");
         }
 
         [$changes, $historyLines] = $parsed
@@ -101,6 +115,9 @@ class TicketAiTriageService
         if ($changes) {
             $this->tickets->applyAiTriage($ticket, $changes, $historyLines);
             $totals['changed']++;
+            Log::channel('ai')->info("Triage zgłoszenia #{$ticket->number}: ".implode('; ', $historyLines));
+        } else {
+            Log::channel('ai')->debug("Triage zgłoszenia #{$ticket->number}: bez zmian.");
         }
 
         $ticket->update(['ai_triaged_at' => now()]);

src/app/Support/Settings.php

@@ -2,6 +2,8 @@
 
 namespace App\Support;
 
+use App\Ldap\AdUser;
+use App\Ldap\LldapUser;
 use App\Models\Setting;
 use Illuminate\Http\UploadedFile;
 use Illuminate\Support\Facades\Crypt;
@@ -229,6 +231,20 @@ class Settings
         return $path ? Storage::disk('public')->url($path) : asset('branding/default-mark.svg');
     }
 
+    /**
+     * Per-page <title>: the context first (so it's still visible once the
+     * browser truncates a long tab title, and so tabs are distinguishable
+     * at a glance) with the company name as a trailing, always-present
+     * anchor. Falls back to just the company name for pages with no more
+     * specific context (landing, login).
+     */
+    public static function pageTitle(?string $context = null): string
+    {
+        $company = static::get('company_name');
+
+        return $context ? "{$context} — {$company}" : $company;
+    }
+
     /**
      * The admin-configured timezone (IANA identifier, e.g. "Europe/Warsaw"),
      * applied at runtime by AppServiceProvider so every date/time displayed
@@ -286,19 +302,46 @@ class Settings
         ]);
     }
 
+    /**
+     * Whether the admin has pointed LDAP auth at Active Directory rather
+     * than an LLDAP/OpenLDAP-schema directory — changes which LdapRecord
+     * model class backs logins (see ldapUserModelClass()) and which
+     * attribute a bare username search defaults to (see
+     * ldapUsernameAttribute()), since AD's objectClass chain and login
+     * attribute (sAMAccountName, not uid) differ from LLDAP's.
+     */
+    public static function isActiveDirectory(): bool
+    {
+        return static::get('ldap_directory_type') === 'ad';
+    }
+
+    /**
+     * The LdapRecord model class the 'users' auth provider should use —
+     * wired into config('auth.providers.users.model') at runtime by
+     * AppServiceProvider::applyLdapSettingsOverride(), same as the
+     * connection host/base DN below.
+     */
+    public static function ldapUserModelClass(): string
+    {
+        return static::isActiveDirectory() ? AdUser::class : LldapUser::class;
+    }
+
     /**
      * Parses the admin-configurable LDAP user filter (e.g. "(uid={0})") to
-     * find which LDAP attribute logins are matched against.
+     * find which LDAP attribute logins are matched against. Defaults to
+     * Active Directory's sAMAccountName when no filter is set and the
+     * directory type is AD — uid is never populated on a stock AD user.
      */
     public static function ldapUsernameAttribute(): string
     {
-        $filter = static::get('ldap_user_filter', '(uid={0})');
+        $default = static::isActiveDirectory() ? '(sAMAccountName={0})' : '(uid={0})';
+        $filter = static::get('ldap_user_filter') ?: $default;
 
         if (preg_match('/\(([a-zA-Z0-9-]+)=\{0\}\)/', (string) $filter, $matches)) {
             return $matches[1];
         }
 
-        return 'uid';
+        return static::isActiveDirectory() ? 'sAMAccountName' : 'uid';
     }
 
     /**

src/config/logging.php

@@ -86,6 +86,29 @@ return [
             'replace_placeholders' => true,
         ],
 
+        // Dedicated, always-verbose channel for the scheduled AI ticket
+        // automation (ai:run-ticket-automation — triage + summaries) — same
+        // rationale as 'imap' below: full visibility into what the AI
+        // integration did on every run without depending on LOG_LEVEL.
+        'ai' => [
+            'driver' => 'daily',
+            'path' => storage_path('logs/ai.log'),
+            'level' => 'debug',
+            'days' => 14,
+            'replace_placeholders' => true,
+        ],
+
+        // Dedicated channel for the one-off Hesk import command (hesk:import)
+        // — console output alone is lost once the terminal is closed, so
+        // failures/summary go here too.
+        'hesk_import' => [
+            'driver' => 'daily',
+            'path' => storage_path('logs/hesk-import.log'),
+            'level' => 'debug',
+            'days' => 14,
+            'replace_placeholders' => true,
+        ],
+
         'slack' => [
             'driver' => 'slack',
             'url' => env('LOG_SLACK_WEBHOOK_URL'),

src/database/factories/UserFactory.php

@@ -5,7 +5,6 @@ namespace Database\Factories;
 use App\Models\User;
 use Illuminate\Database\Eloquent\Factories\Factory;
 use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Str;
 
 /**
  * @extends Factory<User>
@@ -27,20 +26,8 @@ class UserFactory extends Factory
         return [
             'name' => fake()->name(),
             'email' => fake()->unique()->safeEmail(),
-            'email_verified_at' => now(),
             'password' => static::$password ??= Hash::make('password'),
             'roles' => ['client'],
-            'remember_token' => Str::random(10),
         ];
     }
-
-    /**
-     * Indicate that the model's email address should be unverified.
-     */
-    public function unverified(): static
-    {
-        return $this->state(fn (array $attributes) => [
-            'email_verified_at' => null,
-        ]);
-    }
 }

src/database/migrations/2026_08_04_000159_create_ticket_views_table.php

@@ -0,0 +1,29 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('ticket_views', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('ticket_id')->constrained()->cascadeOnDelete();
+            $table->foreignId('user_id')->constrained()->cascadeOnDelete();
+            // Microsecond precision (not the plain-timestamp default) so two
+            // views landing in the same second — plausible with fast repeat
+            // clicks, not just test speed — still order correctly instead of
+            // tying and falling back to row id.
+            $table->timestamp('viewed_at', 6);
+
+            $table->unique(['ticket_id', 'user_id']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('ticket_views');
+    }
+};

src/database/migrations/2026_08_05_000160_add_hesk_ticket_id_to_tickets.php

@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Ties an imported ticket back to its source Hesk ticket id (source is
+     * otherwise just the generic string 'hesk_import', shared by every
+     * imported row). Nullable — only ever set by hesk:import — and unique so
+     * a repeat INSERT for the same Hesk ticket (e.g. the resume-state JSON
+     * file was lost or desynced from a crash between commit and state save)
+     * fails loudly at the DB level instead of silently duplicating the ticket.
+     */
+    public function up(): void
+    {
+        Schema::table('tickets', function (Blueprint $table) {
+            $table->unsignedInteger('hesk_ticket_id')->nullable()->unique()->after('source');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('tickets', function (Blueprint $table) {
+            $table->dropColumn('hesk_ticket_id');
+        });
+    }
+};

src/database/migrations/2026_08_05_000161_drop_unused_columns.php

@@ -0,0 +1,51 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Three columns confirmed dead against live production data (not just
+     * code — checked actual row counts before writing this):
+     *
+     * - users.remember_token: 0 non-null rows. No "remember me" checkbox in
+     *   the login form, Auth::attempt() never passes $remember.
+     * - users.email_verified_at: 0 non-null rows. MustVerifyEmail was never
+     *   implemented on the User model (this app authenticates via LDAP +
+     *   local password fallback, not e-mail verification).
+     * - email_templates.trigger_label: fully populated (10/10 rows) but
+     *   write-only — the "Szablony e-mail" admin tab actually renders
+     *   notification_settings.trigger_label, a different table that
+     *   happens to share the column name.
+     *
+     * users.domain was also on this list initially — grep found no app-level
+     * read/write, but the test suite caught what grep couldn't: LdapRecord's
+     * own Import\Synchronizer (vendor/directorytree/ldaprecord-laravel)
+     * force-fills it on every LDAP sync, bypassing $fillable entirely. Left
+     * alone; dropping it would break LDAP login.
+     */
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->dropColumn(['remember_token', 'email_verified_at']);
+        });
+
+        Schema::table('email_templates', function (Blueprint $table) {
+            $table->dropColumn('trigger_label');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->rememberToken();
+            $table->timestamp('email_verified_at')->nullable();
+        });
+
+        Schema::table('email_templates', function (Blueprint $table) {
+            $table->string('trigger_label')->default('');
+        });
+    }
+};

src/database/migrations/2026_08_05_000162_create_ticket_field_values_table.php

@@ -0,0 +1,77 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Queryable counterpart to tickets.custom_fields (a freeform JSON blob) —
+     * mirrors the user_fields/user_field_values pattern, so reporting can
+     * filter/join on "tickets where custom field X = Y" without scanning
+     * JSON. The JSON column stays the source of truth for reads/writes (see
+     * Ticket::syncFieldValues(), called on every save); this table is kept
+     * in sync automatically and exists purely for querying.
+     */
+    public function up(): void
+    {
+        Schema::create('ticket_field_values', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('ticket_id')->constrained()->cascadeOnDelete();
+            $table->foreignId('custom_field_id')->constrained()->cascadeOnDelete();
+            $table->text('value')->nullable();
+            $table->timestamps();
+            $table->unique(['ticket_id', 'custom_field_id']);
+        });
+
+        $this->backfill();
+    }
+
+    /**
+     * One-time backfill from the existing custom_fields JSON blob, so
+     * reporting against ticket_field_values also covers tickets created
+     * before this table existed. Skips any field id no longer present in
+     * custom_fields (a deleted field definition would otherwise violate the
+     * FK constraint) and any blank/null value, matching
+     * Ticket::syncFieldValues()'s own filtering.
+     */
+    private function backfill(): void
+    {
+        $validFieldIds = DB::table('custom_fields')->pluck('id')->all();
+        $now = now();
+
+        DB::table('tickets')->whereNotNull('custom_fields')->orderBy('id')
+            ->chunkById(500, function ($tickets) use ($validFieldIds, $now) {
+                $rows = [];
+
+                foreach ($tickets as $ticket) {
+                    $values = json_decode($ticket->custom_fields, true) ?? [];
+
+                    foreach ($values as $fieldId => $value) {
+                        if ($value === '' || $value === null || ! in_array((int) $fieldId, $validFieldIds, true)) {
+                            continue;
+                        }
+
+                        $rows[] = [
+                            'ticket_id' => $ticket->id,
+                            'custom_field_id' => (int) $fieldId,
+                            'value' => is_bool($value) ? ($value ? '1' : '0') : (string) $value,
+                            'created_at' => $now,
+                            'updated_at' => $now,
+                        ];
+                    }
+                }
+
+                if ($rows) {
+                    DB::table('ticket_field_values')->insert($rows);
+                }
+            });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('ticket_field_values');
+    }
+};

src/database/migrations/2026_08_05_000163_add_reverse_indexes_to_pivot_tables.php

@@ -0,0 +1,54 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Each of these pivot tables has a composite primary key covering both
+     * FK columns, in a fixed order — e.g. team_subcategory's PK is
+     * (team_id, subcategory_id). Under the leftmost-prefix rule that index
+     * only serves lookups by the first column; a query keyed on the second
+     * column alone (e.g. "which teams can see subcategory X") has no index
+     * to use. Adds the missing reverse index to each.
+     */
+    public function up(): void
+    {
+        Schema::table('team_subcategory', function (Blueprint $table) {
+            $table->index('subcategory_id');
+        });
+
+        Schema::table('role_user', function (Blueprint $table) {
+            $table->index('user_id');
+        });
+
+        Schema::table('team_user', function (Blueprint $table) {
+            $table->index('user_id');
+        });
+
+        Schema::table('custom_field_subcategory', function (Blueprint $table) {
+            $table->index('subcategory_id');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('team_subcategory', function (Blueprint $table) {
+            $table->dropIndex(['subcategory_id']);
+        });
+
+        Schema::table('role_user', function (Blueprint $table) {
+            $table->dropIndex(['user_id']);
+        });
+
+        Schema::table('team_user', function (Blueprint $table) {
+            $table->dropIndex(['user_id']);
+        });
+
+        Schema::table('custom_field_subcategory', function (Blueprint $table) {
+            $table->dropIndex(['subcategory_id']);
+        });
+    }
+};

src/database/migrations/2026_08_05_000164_create_ticket_ai_summaries_table.php

@@ -0,0 +1,74 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Moves the four AI columns off `tickets` (added by
+     * 2026_07_24_000156_add_ai_triage_and_summary_to_tickets.php) into their
+     * own one-to-one table — most tickets never get an AI pass at all, so
+     * this keeps the wide, mostly-null block off the main row. Ticket's
+     * getAttribute()/setAttribute() overrides keep every existing
+     * `$ticket->ai_summary` etc. read/write working unchanged against this
+     * table (see Ticket::AI_SUMMARY_FIELD_MAP).
+     */
+    public function up(): void
+    {
+        Schema::create('ticket_ai_summaries', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('ticket_id')->unique()->constrained()->cascadeOnDelete();
+            $table->timestamp('triaged_at')->nullable();
+            $table->text('summary')->nullable();
+            $table->text('suggested_action')->nullable();
+            $table->timestamp('summary_generated_at')->nullable();
+            $table->timestamps();
+        });
+
+        $this->backfill();
+
+        Schema::table('tickets', function (Blueprint $table) {
+            $table->dropColumn(['ai_triaged_at', 'ai_summary', 'ai_suggested_action', 'ai_summary_generated_at']);
+        });
+    }
+
+    private function backfill(): void
+    {
+        $now = now();
+
+        DB::table('tickets')
+            ->where(function ($q) {
+                $q->whereNotNull('ai_triaged_at')
+                    ->orWhereNotNull('ai_summary')
+                    ->orWhereNotNull('ai_suggested_action')
+                    ->orWhereNotNull('ai_summary_generated_at');
+            })
+            ->orderBy('id')
+            ->chunkById(500, function ($tickets) use ($now) {
+                DB::table('ticket_ai_summaries')->insert($tickets->map(fn ($t) => [
+                    'ticket_id' => $t->id,
+                    'triaged_at' => $t->ai_triaged_at,
+                    'summary' => $t->ai_summary,
+                    'suggested_action' => $t->ai_suggested_action,
+                    'summary_generated_at' => $t->ai_summary_generated_at,
+                    'created_at' => $now,
+                    'updated_at' => $now,
+                ])->all());
+            });
+    }
+
+    public function down(): void
+    {
+        Schema::table('tickets', function (Blueprint $table) {
+            $table->timestamp('ai_triaged_at')->nullable()->after('source');
+            $table->text('ai_summary')->nullable()->after('ai_triaged_at');
+            $table->text('ai_suggested_action')->nullable()->after('ai_summary');
+            $table->timestamp('ai_summary_generated_at')->nullable()->after('ai_suggested_action');
+        });
+
+        Schema::dropIfExists('ticket_ai_summaries');
+    }
+};

src/database/migrations/2026_08_05_000165_create_ticket_snipeit_assets_table.php

@@ -0,0 +1,64 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Moves the two Snipe-IT columns off `tickets` (added by
+     * 2026_07_27_000158_add_snipeit_asset_to_tickets_table.php) into their
+     * own one-to-one table — only a small subset of tickets ever link an
+     * asset. Ticket's getAttribute()/setAttribute() overrides keep every
+     * existing `$ticket->snipeit_asset_id`/`snipeit_asset_name` read/write
+     * working unchanged against this table (see Ticket::SNIPEIT_FIELD_MAP).
+     */
+    public function up(): void
+    {
+        Schema::create('ticket_snipeit_assets', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('ticket_id')->unique()->constrained()->cascadeOnDelete();
+            $table->unsignedInteger('asset_id')->nullable();
+            $table->string('asset_name')->nullable();
+            $table->timestamps();
+        });
+
+        $this->backfill();
+
+        Schema::table('tickets', function (Blueprint $table) {
+            $table->dropColumn(['snipeit_asset_id', 'snipeit_asset_name']);
+        });
+    }
+
+    private function backfill(): void
+    {
+        $now = now();
+
+        DB::table('tickets')
+            ->where(function ($q) {
+                $q->whereNotNull('snipeit_asset_id')->orWhereNotNull('snipeit_asset_name');
+            })
+            ->orderBy('id')
+            ->chunkById(500, function ($tickets) use ($now) {
+                DB::table('ticket_snipeit_assets')->insert($tickets->map(fn ($t) => [
+                    'ticket_id' => $t->id,
+                    'asset_id' => $t->snipeit_asset_id,
+                    'asset_name' => $t->snipeit_asset_name,
+                    'created_at' => $now,
+                    'updated_at' => $now,
+                ])->all());
+            });
+    }
+
+    public function down(): void
+    {
+        Schema::table('tickets', function (Blueprint $table) {
+            $table->unsignedInteger('snipeit_asset_id')->nullable()->after('source');
+            $table->string('snipeit_asset_name')->nullable()->after('snipeit_asset_id');
+        });
+
+        Schema::dropIfExists('ticket_snipeit_assets');
+    }
+};

src/database/seeders/DatabaseSeeder.php

@@ -296,52 +296,52 @@ class DatabaseSeeder extends Seeder
 
         $templates = [
             'tpl-new' => [
-                'name' => 'Nowe zgłoszenie przyjęte', 'trigger_label' => 'Zgłoszenie utworzone',
+                'name' => 'Nowe zgłoszenie przyjęte',
                 'subject' => 'Otrzymaliśmy Twoje zgłoszenie #{numer}',
                 'body' => '<p>Cześć {imie},</p><p>Otrzymaliśmy Twoje zgłoszenie „{temat}”. Nasz zespół zajmie się nim najszybciej jak to możliwe.</p>'.$link.$footer,
             ],
             'tpl-status' => [
-                'name' => 'Zmiana statusu', 'trigger_label' => 'Status zgłoszenia zmieniony',
+                'name' => 'Zmiana statusu',
                 'subject' => 'Aktualizacja zgłoszenia #{numer}',
                 'body' => '<p>Cześć {imie},</p><p>Status Twojego zgłoszenia „{temat}” zmienił się na: {status}.</p>'.$link.$footer,
             ],
             'tpl-category' => [
-                'name' => 'Zmiana kategorii', 'trigger_label' => 'Kategoria zgłoszenia zmieniona',
+                'name' => 'Zmiana kategorii',
                 'subject' => 'Zmieniono kategorię zgłoszenia #{numer}',
                 'body' => '<p>Cześć {imie},</p><p>Kategoria Twojego zgłoszenia „{temat}” została zmieniona na: {kategoria}.</p>'.$link.$footer,
             ],
             'tpl-assignee' => [
-                'name' => 'Zmiana przypisanego operatora', 'trigger_label' => 'Przypisany operator zmieniony',
+                'name' => 'Zmiana przypisanego operatora',
                 'subject' => 'Zmieniono osobę obsługującą zgłoszenie #{numer}',
                 'body' => '<p>Cześć {imie},</p><p>Twoim zgłoszeniem „{temat}” zajmie się teraz: {operator}.</p>'.$link.$footer,
             ],
             'tpl-priority' => [
-                'name' => 'Zmiana priorytetu', 'trigger_label' => 'Priorytet zgłoszenia zmieniony',
+                'name' => 'Zmiana priorytetu',
                 'subject' => 'Zmieniono priorytet zgłoszenia #{numer}',
                 'body' => '<p>Cześć {imie},</p><p>Priorytet Twojego zgłoszenia „{temat}” zmienił się na: {priorytet}.</p>'.$link.$footer,
             ],
             'tpl-team' => [
-                'name' => 'Zmiana zespołu', 'trigger_label' => 'Zespół obsługujący zmieniony',
+                'name' => 'Zmiana zespołu',
                 'subject' => 'Zmieniono zespół obsługujący zgłoszenie #{numer}',
                 'body' => '<p>Cześć {imie},</p><p>Twoim zgłoszeniem „{temat}” zajmuje się teraz zespół: {zespol}.</p>'.$link.$footer,
             ],
             'tpl-closed' => [
-                'name' => 'Zgłoszenie zamknięte', 'trigger_label' => 'Status = Zamknięte',
+                'name' => 'Zgłoszenie zamknięte',
                 'subject' => 'Zgłoszenie #{numer} zostało zamknięte',
                 'body' => '<p>Cześć {imie},</p><p>Twoje zgłoszenie „{temat}” zostało zamknięte. Jeśli temat nie został rozwiązany, odpowiedz na tego maila lub zgłoś sprawę ponownie.</p>'.$link.$csatLink.$footer,
             ],
             'tpl-reply' => [
-                'name' => 'Nowa odpowiedź operatora', 'trigger_label' => 'Operator odpowiedział',
+                'name' => 'Nowa odpowiedź operatora',
                 'subject' => 'Nowa odpowiedź w zgłoszeniu #{numer}',
                 'body' => '<p>Cześć {imie},</p><p>Otrzymałeś/aś nową odpowiedź w zgłoszeniu „{temat}”.</p>'.$link.$footer,
             ],
             'tpl-sla-breach' => [
-                'name' => 'Przekroczenie SLA', 'trigger_label' => 'SLA przekroczone — operator',
+                'name' => 'Przekroczenie SLA',
                 'subject' => 'Przekroczono SLA zgłoszenia #{numer}',
                 'body' => '<p>Cześć {operator},</p><p>Zgłoszenie „{temat}” (#{numer}) przekroczyło ustalony czas rozwiązania SLA.</p>'.$link.$footer,
             ],
             'tpl-team-new-ticket' => [
-                'name' => 'Nowe zgłoszenie w zespole', 'trigger_label' => 'Nowe zgłoszenie w zespole — operator',
+                'name' => 'Nowe zgłoszenie w zespole',
                 'subject' => 'Nowe zgłoszenie w Twoim zespole (#{numer})',
                 'body' => '<p>Cześć,</p><p>Nowe zgłoszenie „{temat}” (#{numer}, kategoria: {kategoria}) trafiło do zespołu {zespol}.</p>'.$link.$footer,
             ],
@@ -352,7 +352,6 @@ class DatabaseSeeder extends Seeder
         foreach ($templates as $key => $tpl) {
             $ids[$key] = EmailTemplate::query()->firstOrCreate(['key' => $key], [
                 'name' => $tpl['name'],
-                'trigger_label' => $tpl['trigger_label'],
                 'subject' => $tpl['subject'],
                 'body' => $tpl['body'],
             ])->id;

src/lang/pl/pagination.php

@@ -0,0 +1,8 @@
+<?php
+
+return [
+
+    'previous' => '&laquo; Poprzednia',
+    'next' => 'Następna &raquo;',
+
+];

src/resources/css/app.css

@@ -211,6 +211,63 @@ body {
     .seg-opt:has(input:checked) { background: color-mix(in srgb, var(--color-accent) 16%, transparent); color: var(--color-accent); }
     .seg-opt input { position: absolute; opacity: 0; width: 0; height: 0; }
 
+    .panel-switch {
+        display: inline-flex;
+        padding: 3px;
+        border: 1px solid var(--color-divider);
+        border-radius: 999px;
+        background: color-mix(in srgb, var(--color-text) 4%, transparent);
+        max-width: 100%;
+        overflow-x: auto;
+        scrollbar-width: none;
+    }
+    .panel-switch::-webkit-scrollbar { display: none; }
+    .panel-switch-indicator {
+        position: absolute;
+        top: 0;
+        bottom: 0;
+        left: 0;
+        border-radius: 999px;
+        background: var(--color-accent);
+        transition: transform 0.2s ease;
+        z-index: 0;
+    }
+    .nav .panel-switch-option {
+        position: relative;
+        z-index: 1;
+        flex: 1 1 0;
+        min-width: 128px;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        padding: 6px 16px;
+        font-size: 12.5px;
+        font-weight: 500;
+        color: var(--color-text);
+        text-decoration: none;
+        white-space: nowrap;
+        border-radius: 999px;
+    }
+    .nav .panel-switch-option:hover { color: #fff; text-decoration: none; }
+    .nav .panel-switch-option-active, .nav .panel-switch-option-active:hover { color: #fff; }
+
+    /* Preview the destination before the click actually navigates there:
+       the indicator follows whichever option is under the cursor (falling
+       back to the real active position, set inline per-request by
+       panel-switcher.blade.php, the moment the pointer leaves). Position is
+       purely by hovered index — independent of how many roles/options
+       exist — so these three rules cover the max of three areas regardless
+       of which subset a given user has. */
+    .panel-switch:has(> .panel-switch-option:nth-of-type(1):hover) .panel-switch-indicator { transform: translateX(0%) !important; }
+    .panel-switch:has(> .panel-switch-option:nth-of-type(2):hover) .panel-switch-indicator { transform: translateX(100%) !important; }
+    .panel-switch:has(> .panel-switch-option:nth-of-type(3):hover) .panel-switch-indicator { transform: translateX(200%) !important; }
+
+    /* The real active option's white text is only correct while the
+       indicator sits under it — once hover has pulled the indicator away to
+       a neighboring option, drop it back to normal text color so it doesn't
+       read as near-invisible white-on-track. */
+    .panel-switch:hover .panel-switch-option-active:not(:hover) { color: var(--color-text); }
+
     .theme-toggle-option {
         display: flex;
         align-items: center;
@@ -341,8 +398,26 @@ body {
 
 @media (max-width: 640px) {
     .page-pad { padding: 16px !important; }
-    .nav { padding-left: 14px !important; padding-right: 14px !important; gap: 10px; }
-    .nav-panel-label { display: none; }
+    .nav { padding-left: 14px !important; padding-right: 14px !important; gap: 10px; flex-wrap: wrap; }
+
+    /* At this width the switcher's own centered slot collides with the
+       brand text and the icon buttons sharing the row (nothing left to
+       shrink once labels are already at their minimum width) — same
+       "restructure instead of cram" fix as the mobile table pattern above:
+       drop it to its own full-width row below instead of fighting for
+       space with everything else in the bar. */
+    .panel-switch {
+        position: relative !important;
+        left: auto !important;
+        top: auto !important;
+        transform: none !important;
+        order: 10;
+        width: 100%;
+        max-width: 100%;
+        justify-content: center;
+        margin-top: 10px;
+    }
+    .nav .panel-switch-option { padding: 10px; font-size: 11.5px; min-width: 92px; }
 
     /* Theme/notifications/profile dropdowns are anchored (position:absolute)
        to their own small trigger button by default, which overflows off the

src/resources/views/components/panel-switcher.blade.php

@@ -0,0 +1,50 @@
+@props(['area' => null])
+
+@php
+    // $area is passed explicitly by each page (e.g. <x-topbar area="operator" />)
+    // rather than inferred from request()->routeIs() here: this component is
+    // rendered as part of each top-level Livewire page's own template, so it
+    // re-renders on every wire:click/wire:model round-trip on that page (tab
+    // switches, pagination, search, ...) — and during that AJAX request,
+    // request()->route() is Livewire's own update route, not client./operator./
+    // admin.*, which silently broke the highlight on every in-page interaction
+    // when this used to key off the ambient request instead of an explicit prop.
+    $user = auth()->user();
+    $areas = [];
+
+    if ($user) {
+        if ($user->isClient()) {
+            $areas[] = ['label' => 'Klient', 'url' => route('client.dashboard'), 'active' => $area === 'client'];
+        }
+        if ($user->isOperator()) {
+            $areas[] = ['label' => 'Operator', 'url' => route('operator.queue'), 'active' => $area === 'operator'];
+        }
+        if ($user->isAdmin()) {
+            $areas[] = ['label' => 'Administrator', 'url' => route('admin.panel'), 'active' => $area === 'admin'];
+        }
+    }
+
+    $activeIndex = collect($areas)->search(fn ($area) => $area['active']);
+@endphp
+
+@if (count($areas))
+    <div
+        class="panel-switch"
+        style="position:absolute;left:50%;top:50%;transform:translate(-50%, -50%)"
+    >
+        @if ($activeIndex !== false)
+            <span
+                class="panel-switch-indicator"
+                style="width:calc(100% / {{ count($areas) }});transform:translateX({{ $activeIndex * 100 }}%)"
+            ></span>
+        @endif
+
+        @foreach ($areas as $item)
+            <a
+                href="{{ $item['url'] }}"
+                wire:navigate
+                class="panel-switch-option {{ $item['active'] ? 'panel-switch-option-active' : '' }}"
+            >{{ $item['label'] }}</a>
+        @endforeach
+    </div>
+@endif

src/resources/views/components/profile-menu.blade.php

@@ -1,18 +1,5 @@
 @php
     $user = auth()->user();
-    $areas = [];
-
-    if ($user) {
-        if ($user->isClient()) {
-            $areas[] = ['label' => 'Panel Klienta', 'url' => route('client.dashboard'), 'active' => request()->routeIs('client.*')];
-        }
-        if ($user->isOperator()) {
-            $areas[] = ['label' => 'Panel Operatora', 'url' => route('operator.queue'), 'active' => request()->routeIs('operator.*')];
-        }
-        if ($user->isAdmin()) {
-            $areas[] = ['label' => 'Panel Administratora', 'url' => route('admin.panel'), 'active' => request()->routeIs('admin.*')];
-        }
-    }
 @endphp
 
 @if ($user)
@@ -26,23 +13,27 @@
             x-show="open"
             x-cloak
             class="nav-dropdown"
-            style="position:absolute;top:100%;right:0;margin-top:6px;background:var(--color-surface);border:1px solid var(--color-divider);border-radius:8px;box-shadow:var(--shadow-md);min-width:200px;overflow:hidden;z-index:30"
+            style="position:absolute;top:100%;right:0;margin-top:6px;background:var(--color-surface);border:1px solid var(--color-divider);border-radius:8px;box-shadow:var(--shadow-md);min-width:220px;overflow:hidden;z-index:30"
         >
-            @foreach ($areas as $area)
-                <a
-                    href="{{ $area['url'] }}"
-                    wire:navigate
-                    @click="open = false"
-                    class="theme-toggle-option"
-                    style="text-decoration:none;color:{{ $area['active'] ? 'var(--color-accent)' : 'var(--color-text)' }};font-size:12.5px"
-                >{{ $area['label'] }}</a>
-            @endforeach
+            <div style="display:flex;flex-direction:column;gap:6px;padding:12px">
+                <span style="font-weight:600;font-size:13px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap">{{ $user->name }}</span>
+                <span style="font-size:11.5px;color:color-mix(in srgb, var(--color-text) 60%, transparent);overflow:hidden;text-overflow:ellipsis;white-space:nowrap">{{ $user->email }}</span>
+                <div style="display:flex;flex-wrap:wrap;gap:4px;margin-top:2px">
+                    @if ($user->isClient())
+                        <span class="tag tag-neutral">Klient</span>
+                    @endif
+                    @if ($user->isOperator())
+                        <span class="tag tag-accent-2">Operator</span>
+                    @endif
+                    @if ($user->isAdmin())
+                        <span class="tag tag-accent">Administrator</span>
+                    @endif
+                </div>
+            </div>
 
-            @if (count($areas))
-                <div style="border-top:1px solid var(--color-divider)"></div>
-            @endif
+            <div style="border-top:1px solid var(--color-divider)"></div>
 
-            @if ($user && ($user->isOperator() || $user->isAdmin()))
+            @if ($user->isOperator() || $user->isAdmin())
                 <a
                     href="{{ route('settings.notifications') }}"
                     wire:navigate

src/resources/views/components/theme-toggle.blade.php

@@ -16,10 +16,10 @@
     style="position:relative;display:inline-block"
 >
     <button type="button" class="btn btn-secondary btn-icon" @click="open = !open">
-        <span class="material-symbols-outlined" x-text="icon()"></span>
+        <span class="material-symbols-outlined" x-text="typeof icon === 'function' ? icon() : ''"></span>
     </button>
     <div
-        x-show="open"
+        x-show="typeof open !== 'undefined' && open"
         x-cloak
         class="nav-dropdown"
         style="position:absolute;top:100%;right:0;margin-top:6px;background:var(--color-surface);border:1px solid var(--color-divider);border-radius:8px;box-shadow:var(--shadow-md);min-width:150px;overflow:hidden;z-index:20"

src/resources/views/components/topbar.blade.php

@@ -1,18 +1,9 @@
-@php
-    $panelLabel = match (true) {
-        request()->routeIs('client.*') => 'Panel Klienta',
-        request()->routeIs('operator.*') => 'Panel Operatora',
-        request()->routeIs('admin.*') => 'Panel Administratora',
-        default => null,
-    };
-@endphp
+@props(['area' => null])
 
 <div class="nav" style="position:relative;padding:16px 28px;border-bottom:1px solid var(--color-divider)">
     <span class="nav-brand">{{ \App\Support\Settings::get('company_name') }}</span>
 
-    @if ($panelLabel)
-        <span class="nav-panel-label" style="position:absolute;left:50%;top:50%;transform:translate(-50%, -50%);font-weight:500;font-size:13.5px;white-space:nowrap">{{ $panelLabel }}</span>
-    @endif
+    <x-panel-switcher :area="$area" />
 
     <x-theme-toggle />
 
@@ -20,6 +11,7 @@
 
     @auth
         <livewire:notification-bell />
+        <livewire:global-search />
     @endauth
 
     <x-profile-menu />

src/resources/views/livewire/admin/logs.blade.php

@@ -0,0 +1,69 @@
+<div>
+    <div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:6px">
+        <h3 style="margin:0">Logi</h3>
+        <label style="display:flex;align-items:center;gap:6px;font-size:12.5px;font-weight:400;color:var(--color-text)">
+            <input type="checkbox" wire:model.live="autoRefresh" style="position:static;opacity:1;width:auto;height:auto">
+            Odświeżaj automatycznie (5 s)
+        </label>
+    </div>
+    <p class="text-muted" style="font-size:12.5px;margin:0 0 14px">
+        Podgląd plików z <code>storage/logs/</code> — co robi aplikacja i zaplanowane integracje (IMAP, automatyzacje, SLA). Widok tylko do odczytu, pokazuje ostatni fragment pliku.
+    </p>
+
+    @if ($autoRefresh)
+        <div wire:poll.5s="$refresh" style="display:none"></div>
+    @endif
+
+    @if ($this->files->isEmpty())
+        <p class="text-muted" style="font-size:13px">Brak plików logów w <code>storage/logs/</code>.</p>
+    @else
+        <div style="display:flex;flex-wrap:wrap;gap:6px;margin-bottom:14px">
+            @foreach ($this->files as $file)
+                <button type="button" wire:click="selectFile('{{ $file['name'] }}')"
+                        style="display:flex;flex-direction:column;align-items:flex-start;gap:2px;padding:6px 12px;border-radius:8px;cursor:pointer;font-size:12.5px;text-align:left;border:1px solid {{ $selectedFile === $file['name'] ? 'var(--color-accent)' : 'var(--color-divider)' }};background:{{ $selectedFile === $file['name'] ? 'color-mix(in srgb, var(--color-accent) 14%, transparent)' : 'transparent' }};color:{{ $selectedFile === $file['name'] ? 'var(--color-accent)' : 'var(--color-text)' }}">
+                    <span style="font-weight:500">{{ $file['name'] }}</span>
+                    <span class="text-muted" style="font-size:11px">{{ $this->formatBytes($file['size']) }} &middot; {{ $file['modified']->diffForHumans() }}</span>
+                </button>
+            @endforeach
+        </div>
+
+        <div style="display:flex;flex-wrap:wrap;gap:10px;align-items:center;margin-bottom:12px">
+            <select class="input" wire:model.live="levelFilter" style="width:auto">
+                <option value="">Wszystkie poziomy</option>
+                @foreach (\App\Livewire\Admin\Logs::availableLevels() as $level)
+                    <option value="{{ $level }}">{{ $level }}</option>
+                @endforeach
+            </select>
+
+            <input class="input" type="search" wire:model.live.debounce.400ms="search" placeholder="Szukaj w treści..." style="width:220px">
+
+            <select class="input" wire:model.live="limit" style="width:auto">
+                <option value="100">ostatnie 100</option>
+                <option value="300">ostatnie 300</option>
+                <option value="1000">ostatnie 1000</option>
+                <option value="3000">ostatnie 3000</option>
+            </select>
+
+            <button type="button" class="btn btn-ghost" wire:click="$refresh">
+                <span class="material-symbols-outlined" style="font-size:16px;vertical-align:-3px">refresh</span>
+                Odśwież
+            </button>
+
+            <span class="text-muted" style="font-size:12px;margin-left:auto">{{ $this->entries->count() }} wpisów</span>
+        </div>
+
+        <div wire:key="log-box-{{ $selectedFile }}-{{ $levelFilter }}-{{ $search }}-{{ $limit }}"
+             x-data x-init="$el.scrollTop = $el.scrollHeight"
+             style="height:65vh;overflow:auto;border:1px solid var(--color-divider);border-radius:8px;background:color-mix(in srgb, var(--color-text) 4%, var(--color-bg));padding:10px 12px;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:12px;line-height:1.5">
+            @forelse ($this->entries as $entry)
+                @php $badge = \App\Livewire\Admin\Logs::levelBadge($entry['level']); @endphp
+                <div style="display:flex;gap:8px;align-items:flex-start;padding:3px 0;border-bottom:1px solid color-mix(in srgb, var(--color-text) 6%, transparent)">
+                    <span class="{{ $badge['class'] }}" style="flex:none;font-size:10px;padding:1px 6px;margin-top:2px;{{ $badge['style'] }}">{{ $entry['level'] ?? '?' }}</span>
+                    <span style="white-space:pre-wrap;word-break:break-word;flex:1">{{ $entry['text'] }}</span>
+                </div>
+            @empty
+                <p class="text-muted" style="margin:0">Brak wpisów spełniających kryteria.</p>
+            @endforelse
+        </div>
+    @endif
+</div>

src/resources/views/livewire/admin/panel.blade.php

@@ -22,15 +22,21 @@ $tabGroups = [
         ['key' => 'config', 'label' => 'Konfiguracja', 'icon' => 'settings'],
         ['key' => 'integrations', 'label' => 'Integracje', 'icon' => 'hub'],
         ['key' => 'api-keys', 'label' => 'Klucze API', 'icon' => 'vpn_key'],
+        ['key' => 'logs', 'label' => 'Logi', 'icon' => 'terminal'],
         ['key' => 'about', 'label' => 'O aplikacji', 'icon' => 'info'],
     ],
 ];
 @endphp
 <div style="flex:1;display:flex;flex-direction:column">
-    <x-topbar />
+    <x-topbar area="admin" />
 
     <div class="app-split" style="flex:1;display:flex;min-height:0">
         <div class="side-rail" style="padding:16px 10px;gap:16px;overflow:auto;background:color-mix(in srgb, var(--color-text) 5%, var(--color-bg))">
+            <button type="button" @click="window.dispatchEvent(new CustomEvent('open-global-search'))" style="display:flex;align-items:center;gap:10px;width:100%;padding:8px 12px;border-radius:6px;border:none;cursor:pointer;font-size:13.5px;text-align:left;white-space:nowrap;background:transparent;color:var(--color-text)">
+                <span class="material-symbols-outlined" style="font-size:18px">search</span>
+                <span>Szukaj</span>
+            </button>
+
             @foreach ($tabGroups as $groupLabel => $items)
                 <div style="display:flex;flex-direction:column;gap:1px">
                     <div style="font-size:10px;letter-spacing:0.09em;text-transform:uppercase;color:color-mix(in srgb, var(--color-text) 45%, transparent);padding:4px 12px 6px;white-space:nowrap">{{ $groupLabel }}</div>
@@ -615,9 +621,12 @@ $tabGroups = [
                             <h4 style="margin:0">Sesja i strefa czasowa</h4>
                             <div class="field"><label>Czas wygaśnięcia sesji (minuty)</label><input class="input" type="number" wire:model="systemConfig.sessionLifetimeMinutes"></div>
                             <div class="field"
+                                 wire:key="admin-timezone-clock"
                                  x-data="{
                                      tz: @js($systemConfig['timezone']),
                                      now: '',
+                                     tickHandle: null,
+                                     navigatingHandler: null,
                                      tick() {
                                          try {
                                              this.now = new Intl.DateTimeFormat('pl-PL', { timeZone: this.tz, dateStyle: 'medium', timeStyle: 'medium' }).format(new Date());
@@ -625,8 +634,13 @@ $tabGroups = [
                                              this.now = '—';
                                          }
                                      },
-                                 }"
-                                 x-init="tick(); setInterval(() => tick(), 1000)">
+                                     init() {
+                                         this.tick();
+                                         this.tickHandle = setInterval(() => this.tick(), 1000);
+                                         this.navigatingHandler = () => clearInterval(this.tickHandle);
+                                         document.addEventListener('livewire:navigating', this.navigatingHandler);
+                                     },
+                                 }">
                                 <label>Strefa czasowa</label>
                                 <select class="input" wire:model="systemConfig.timezone" x-on:change="tz = $event.target.value; tick()">
                                     @foreach (\DateTimeZone::listIdentifiers() as $tzId)
@@ -635,7 +649,7 @@ $tabGroups = [
                                 </select>
                                 <div style="display:flex;gap:4px;font-size:12px">
                                     <span class="text-muted">Aktualny czas:</span>
-                                    <strong x-text="now"></strong>
+                                    <strong x-text="typeof now !== 'undefined' ? now : ''"></strong>
                                 </div>
                             </div>
                         </div>
@@ -684,6 +698,13 @@ $tabGroups = [
                         <label class="radio"><input type="checkbox" wire:model="ldapConfig.enabled" style="position:static;opacity:1;width:auto;height:auto"><strong>Włącz autentykację LDAP/AD</strong></label>
 
                         @if ($ldapConfig['enabled'])
+                            <div class="field">
+                                <label>Typ katalogu</label>
+                                <select class="input" wire:model="ldapConfig.directoryType">
+                                    <option value="lldap">LLDAP / OpenLDAP</option>
+                                    <option value="ad">Active Directory</option>
+                                </select>
+                            </div>
                             <div class="field"><label>Host serwera LDAP</label><input class="input" placeholder="ldap.example.com" wire:model="ldapConfig.host"></div>
                             <div style="display:flex;gap:10px">
                                 <div class="field" style="flex:1"><label>Port</label><input class="input" type="number" placeholder="389" wire:model="ldapConfig.port"></div>
@@ -692,7 +713,13 @@ $tabGroups = [
                             <div class="field"><label>Base DN</label><input class="input" placeholder="dc=example,dc=com" wire:model="ldapConfig.baseDn"></div>
                             <div class="field"><label>Bind DN</label><input class="input" placeholder="cn=admin,dc=example,dc=com" wire:model="ldapConfig.bindDn"></div>
                             <div class="field"><label>Hasło Bind</label><input class="input" type="password" placeholder="(bez zmian jeśli puste)" wire:model="ldapConfig.bindPassword"></div>
-                            <div class="field"><label>User Filter</label><input class="input" placeholder="(uid={0})" wire:model="ldapConfig.userFilter"></div>
+                            <div class="field">
+                                <label>User Filter</label>
+                                <input class="input" placeholder="{{ $ldapConfig['directoryType'] === 'ad' ? '(sAMAccountName={0})' : '(uid={0})' }}" wire:model="ldapConfig.userFilter">
+                                @if ($ldapConfig['directoryType'] === 'ad')
+                                    <p class="text-muted" style="font-size:11.5px;margin:2px 0 0">Active Directory nie ma atrybutu "uid" — puste pole domyślnie użyje sAMAccountName.</p>
+                                @endif
+                            </div>
                             <label class="radio"><input type="checkbox" wire:model="ldapConfig.autoProvisionGuests" style="position:static;opacity:1;width:auto;height:auto">Automatycznie zakładaj konto dla gościa zgłaszającego, jeśli jego e-mail istnieje w LDAP</label>
                             <label class="radio"><input type="checkbox" wire:model="ldapConfig.restrictUserCreationToLdap" style="position:static;opacity:1;width:auto;height:auto">Zezwalaj na ręczne zapraszanie użytkowników tylko, jeśli ich e-mail istnieje w LDAP</label>
                             <label class="radio"><input type="checkbox" wire:model="ldapConfig.restrictTicketsToLdap" style="position:static;opacity:1;width:auto;height:auto">Zezwalaj na tworzenie zgłoszeń bez logowania tylko dla adresów e-mail istniejących w LDAP</label>
@@ -965,6 +992,11 @@ $tabGroups = [
                 <livewire:admin.api-keys />
             @endif
 
+            {{-- ================= LOGS ================= --}}
+            @if ($tab === 'logs')
+                <livewire:admin.logs />
+            @endif
+
             @if ($tab === 'about')
                 <h3 style="margin:0 0 14px">O aplikacji</h3>
                 <div class="card" style="padding:18px;gap:10px;max-width:420px">

src/resources/views/livewire/client/dashboard.blade.php

@@ -1,5 +1,5 @@
 <div style="flex:1;display:flex;flex-direction:column">
-    <x-topbar />
+    <x-topbar area="client" />
 
     <div class="page-pad" style="flex:1;padding:28px;display:flex;flex-direction:column;gap:20px;max-width:920px;width:100%;margin:0 auto;box-sizing:border-box">
         <div style="display:flex;justify-content:space-between;align-items:center;gap:12px;flex-wrap:wrap">
@@ -9,8 +9,8 @@
 
         <div style="display:flex;justify-content:space-between;align-items:center;gap:12px;flex-wrap:wrap">
             <div class="seg">
-                <label class="seg-opt"><input type="radio" name="ctab" @checked($tab === 'current') wire:click="setTab('current')">Aktualne ({{ $this->currentTickets->count() }})</label>
-                <label class="seg-opt"><input type="radio" name="ctab" @checked($tab === 'archive') wire:click="setTab('archive')">Archiwalne ({{ $this->archiveTickets->count() }})</label>
+                <label class="seg-opt"><input type="radio" name="ctab" @checked($tab === 'current') wire:click="setTab('current')">Aktualne ({{ $this->currentTickets->total() }})</label>
+                <label class="seg-opt"><input type="radio" name="ctab" @checked($tab === 'archive') wire:click="setTab('archive')">Archiwalne ({{ $this->archiveTickets->total() }})</label>
             </div>
             <input class="input" type="search" placeholder="Szukaj po numerze, temacie, treści…" wire:model.live.debounce.400ms="search" style="max-width:280px">
         </div>
@@ -32,6 +32,10 @@
             @if (($tab === 'current' ? $this->currentTickets : $this->archiveTickets)->isEmpty())
                 <p class="text-muted" style="font-size:13px">Brak zgłoszeń w tej zakładce.</p>
             @endif
+
+            <div style="margin-top:4px">
+                {{ ($tab === 'current' ? $this->currentTickets : $this->archiveTickets)->links() }}
+            </div>
         </div>
     </div>
 </div>

src/resources/views/livewire/client/new-ticket.blade.php

@@ -1,5 +1,5 @@
 <div style="flex:1;display:flex;flex-direction:column">
-    <x-topbar />
+    <x-topbar area="client" />
 
     <div class="page-pad" style="flex:1;padding:28px;display:flex;flex-direction:column;gap:20px;max-width:920px;width:100%;margin:0 auto;box-sizing:border-box">
         <div style="display:flex;justify-content:space-between;align-items:center;gap:12px;flex-wrap:wrap">
@@ -95,7 +95,7 @@
                         @dragover.prevent="dragging = true"
                         @dragleave.prevent="dragging = false"
                         @drop.prevent="dragging = false; const input = $el.querySelector('input[type=file]'); input.files = $event.dataTransfer.files; input.dispatchEvent(new Event('change'))"
-                        :style="{ borderColor: dragging ? 'var(--color-accent)' : undefined, background: dragging ? 'color-mix(in srgb, var(--color-accent) 8%, transparent)' : undefined }"
+                        :style="{ borderColor: (typeof dragging !== 'undefined' && dragging) ? 'var(--color-accent)' : undefined, background: (typeof dragging !== 'undefined' && dragging) ? 'color-mix(in srgb, var(--color-accent) 8%, transparent)' : undefined }"
                         style="border:1px dashed var(--color-divider);border-radius:8px;padding:14px;display:flex;flex-wrap:wrap;align-items:center;gap:10px"
                     >
                         <label class="btn btn-secondary" style="cursor:pointer">Wybierz pliki<input type="file" multiple style="display:none" wire:model="attachments"></label>

src/resources/views/livewire/client/ticket-show.blade.php

@@ -1,5 +1,5 @@
 <div style="flex:1;display:flex;flex-direction:column">
-    <x-topbar />
+    <x-topbar area="client" />
 
     <div class="page-pad" style="flex:1;padding:28px;display:flex;flex-direction:column;gap:20px;max-width:1180px;width:100%;margin:0 auto;box-sizing:border-box">
         <div style="display:flex;justify-content:space-between;align-items:center;gap:12px;flex-wrap:wrap">
@@ -13,15 +13,27 @@
                 $refreshTicketSeconds = max(1, (int) \App\Support\Settings::get('refresh_ticket_view_seconds'));
             @endphp
             <div
+                wire:key="ticket-autorefresh-{{ $ticket->id }}"
                 class="btn btn-secondary"
                 style="cursor:pointer;gap:6px"
-                x-data="{ remaining: {{ $refreshTicketSeconds }}, total: {{ $refreshTicketSeconds }} }"
-                x-init="setInterval(() => { remaining = remaining <= 1 ? total : remaining - 1; if (remaining === total) $wire.refreshTicketData(); }, 1000)"
+                x-data="{
+                    remaining: {{ $refreshTicketSeconds }}, total: {{ $refreshTicketSeconds }},
+                    tick: null,
+                    navigatingHandler: null,
+                    init() {
+                        this.tick = setInterval(() => {
+                            this.remaining = this.remaining <= 1 ? this.total : this.remaining - 1;
+                            if (this.remaining === this.total) $wire.refreshTicketData();
+                        }, 1000);
+                        this.navigatingHandler = () => clearInterval(this.tick);
+                        document.addEventListener('livewire:navigating', this.navigatingHandler);
+                    },
+                }"
                 x-on:click="remaining = total; $wire.refreshTicketData()"
                 title="Zgłoszenie odświeża się automatycznie — kliknij, aby odświeżyć teraz"
             >
                 <span class="material-symbols-outlined" style="font-size:18px">schedule</span>
-                <span x-text="remaining + 's'"></span>
+                <span x-text="typeof remaining !== 'undefined' ? (remaining + 's') : ''"></span>
             </div>
         </div>
 
@@ -89,7 +101,7 @@
                             @dragover.prevent="dragging = true"
                             @dragleave.prevent="dragging = false"
                             @drop.prevent="dragging = false; const input = $el.querySelector('input[type=file]'); input.files = $event.dataTransfer.files; input.dispatchEvent(new Event('change'))"
-                            :style="{ borderColor: dragging ? 'var(--color-accent)' : undefined, background: dragging ? 'color-mix(in srgb, var(--color-accent) 8%, transparent)' : undefined }"
+                            :style="{ borderColor: (typeof dragging !== 'undefined' && dragging) ? 'var(--color-accent)' : undefined, background: (typeof dragging !== 'undefined' && dragging) ? 'color-mix(in srgb, var(--color-accent) 8%, transparent)' : undefined }"
                             style="flex:1;min-width:0;border:1px dashed var(--color-divider);border-radius:8px;padding:10px 14px;display:flex;flex-wrap:wrap;align-items:center;gap:10px"
                         >
                             <label class="btn btn-secondary" style="cursor:pointer;flex:none">Załącz pliki<input type="file" multiple style="display:none" wire:model="attachments"></label>
@@ -182,13 +194,18 @@
                 <div class="card" style="padding:16px;gap:8px">
                     <div class="card-kicker">Inne Twoje zgłoszenia</div>
                     @forelse ($this->otherTickets as $ot)
-                        <a href="{{ route('client.ticket', $ot) }}" wire:navigate style="display:flex;justify-content:space-between;align-items:center;gap:8px;cursor:pointer;text-decoration:none;color:inherit">
+                        <a wire:key="other-ticket-{{ $ot->id }}" href="{{ route('client.ticket', $ot) }}" wire:navigate style="display:flex;justify-content:space-between;align-items:center;gap:8px;cursor:pointer;text-decoration:none;color:inherit">
                             <span style="font-size:13px">{{ $ot->displayNumber() }} — {{ $ot->subject }}</span>
                             <span style="{{ $ot->statusStyle() }};flex:none">{{ $ot->statusLabel() }}</span>
                         </a>
                     @empty
-                        <p class="text-muted" style="font-size:12px;margin:0">Brak innych zgłoszeń.</p>
+                        <p wire:key="other-tickets-empty" class="text-muted" style="font-size:12px;margin:0">Brak innych zgłoszeń.</p>
                     @endforelse
+                    @if (! $showAllOtherTickets && $this->otherTicketsCount > count($this->otherTickets))
+                        <button wire:key="show-all-other-tickets" type="button" wire:click="revealAllOtherTickets" class="btn btn-secondary" style="font-size:12px;padding:6px 10px;align-self:flex-start">
+                            Pokaż wszystkie ({{ $this->otherTicketsCount }})
+                        </button>
+                    @endif
                 </div>
             </div>
         </div>

src/resources/views/livewire/global-search.blade.php

@@ -0,0 +1,51 @@
+<div
+    x-data="{ open: false }"
+    x-on:open-global-search.window="open = true; $nextTick(() => $refs.searchInput.focus())"
+    x-on:keydown.cmd.k.window.prevent="open = true; $nextTick(() => $refs.searchInput.focus())"
+    x-on:keydown.ctrl.k.window.prevent="open = true; $nextTick(() => $refs.searchInput.focus())"
+    x-on:keydown.escape.window="open = false"
+>
+    <div class="dialog-backdrop" x-show="open" x-cloak style="align-items:flex-start;padding-top:10vh">
+        <div class="dialog" style="max-width:720px;padding:0;gap:0;overflow:hidden" @click.outside="open = false">
+            <div style="display:flex;align-items:center;gap:14px;padding:18px 22px;border-bottom:1px solid var(--color-divider)">
+                <span class="material-symbols-outlined" style="font-size:26px;color:color-mix(in srgb, var(--color-text) 55%, transparent)">search</span>
+                <input
+                    x-ref="searchInput"
+                    type="text"
+                    wire:model.live.debounce.200ms="search"
+                    placeholder="Szukaj zgłoszenia… (np. od:kacper temat:drukarka)"
+                    class="input"
+                    style="border:none;padding:10px 12px;box-shadow:none;font-size:18px"
+                    x-on:keydown.enter="$refs.resultsList?.querySelector('a')?.click()"
+                >
+                <kbd style="font-size:11px;color:color-mix(in srgb, var(--color-text) 45%, transparent);border:1px solid var(--color-divider);border-radius:4px;padding:2px 7px;flex:none">Esc</kbd>
+            </div>
+
+            <div x-ref="resultsList" style="max-height:460px;overflow-y:auto">
+                @forelse ($this->results as $ticket)
+                    <a
+                        href="{{ $this->urlFor($ticket) }}"
+                        wire:navigate
+                        @click="open = false"
+                        style="display:flex;align-items:center;justify-content:space-between;gap:16px;padding:14px 22px;text-decoration:none;color:inherit;border-bottom:1px solid var(--color-divider)"
+                    >
+                        <div style="min-width:0">
+                            <div style="font-weight:500;font-size:14.5px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap">{{ $ticket->displayNumber() }} — {{ $ticket->subject }}</div>
+                            <div class="card-meta" style="overflow:hidden;text-overflow:ellipsis;white-space:nowrap">
+                                {{ $ticket->categoryLabel() }} &middot; {{ $ticket->name }} &middot; {{ \App\Support\Rel::format($ticket->updated_at) }}
+                            </div>
+                        </div>
+                        <div style="display:flex;gap:6px;flex:none">
+                            <span style="{{ $ticket->priorityStyle() }}">{{ $ticket->priorityLabel() }}</span>
+                            <span style="{{ $ticket->statusStyle() }}">{{ $ticket->statusLabel() }}</span>
+                        </div>
+                    </a>
+                @empty
+                    <div style="padding:28px 22px;text-align:center;font-size:13.5px;color:color-mix(in srgb, var(--color-text) 55%, transparent)">
+                        {{ trim($search) === '' ? 'Zacznij pisać, aby wyszukać zgłoszenie… (obsługuje też od:, temat:, treść:, numer:)' : 'Brak wyników.' }}
+                    </div>
+                @endforelse
+            </div>
+        </div>
+    </div>
+</div>

src/resources/views/livewire/operator/client-search.blade.php

@@ -0,0 +1,53 @@
+<div style="flex:1;display:flex;flex-direction:column">
+    <x-topbar area="operator" />
+
+    <div class="page-pad" style="flex:1;padding:20px 24px;overflow:auto;display:flex;flex-direction:column;gap:20px;max-width:820px;width:100%;margin:0 auto;box-sizing:border-box">
+        <div style="display:flex;justify-content:space-between;align-items:center;gap:12px;flex-wrap:wrap">
+            <h2 style="margin:0">Klienci</h2>
+            <a href="{{ route('operator.queue') }}" wire:navigate class="btn btn-ghost">&larr; Wróć do listy</a>
+        </div>
+
+        <input
+            class="input"
+            type="search"
+            placeholder="Szukaj po imieniu, nazwisku lub adresie e-mail…"
+            wire:model.live.debounce.400ms="search"
+            autofocus
+        >
+
+        <div style="display:flex;flex-direction:column;gap:10px">
+            @if (trim($search) === '')
+                <p class="text-muted" style="font-size:13px">Zacznij pisać, aby wyszukać klienta.</p>
+            @else
+                @forelse ($this->results as $u)
+                    <a
+                        wire:key="client-{{ $u->id }}"
+                        href="{{ route('operator.queue', ['filterCustomerId' => $u->id]) }}"
+                        wire:navigate
+                        class="card elev-sm"
+                        style="padding:14px 16px;cursor:pointer;flex-direction:row;align-items:center;justify-content:space-between;gap:12px;flex-wrap:wrap;text-decoration:none;color:inherit"
+                    >
+                        <div>
+                            <div style="font-weight:500">{{ $u->name }}</div>
+                            <div class="card-meta">{{ $u->email }}</div>
+                        </div>
+                        <div style="display:flex;align-items:center;gap:8px;flex-wrap:wrap;justify-content:flex-end">
+                            @if ($u->hasRole('client'))
+                                <span class="tag tag-outline">Klient</span>
+                            @endif
+                            @if ($u->hasRole('operator'))
+                                <span class="tag tag-outline">Operator</span>
+                            @endif
+                            @if ($u->hasRole('admin'))
+                                <span class="tag tag-outline">Administrator</span>
+                            @endif
+                            <span class="tag tag-neutral">{{ $u->tickets_as_customer_count }} {{ $u->tickets_as_customer_count === 1 ? 'zgłoszenie' : 'zgłoszeń' }}</span>
+                        </div>
+                    </a>
+                @empty
+                    <p class="text-muted" style="font-size:13px">Brak wyników dla „{{ $search }}”.</p>
+                @endforelse
+            @endif
+        </div>
+    </div>
+</div>

src/resources/views/livewire/operator/new-ticket.blade.php

@@ -1,5 +1,5 @@
 <div style="flex:1;display:flex;flex-direction:column">
-    <x-topbar />
+    <x-topbar area="operator" />
 
     <div class="page-pad" style="flex:1;padding:28px;display:flex;flex-direction:column;gap:20px;max-width:920px;width:100%;margin:0 auto;box-sizing:border-box">
         <div style="display:flex;justify-content:space-between;align-items:center;gap:12px;flex-wrap:wrap">
@@ -92,7 +92,7 @@
                         @dragover.prevent="dragging = true"
                         @dragleave.prevent="dragging = false"
                         @drop.prevent="dragging = false; const input = $el.querySelector('input[type=file]'); input.files = $event.dataTransfer.files; input.dispatchEvent(new Event('change'))"
-                        :style="{ borderColor: dragging ? 'var(--color-accent)' : undefined, background: dragging ? 'color-mix(in srgb, var(--color-accent) 8%, transparent)' : undefined }"
+                        :style="{ borderColor: (typeof dragging !== 'undefined' && dragging) ? 'var(--color-accent)' : undefined, background: (typeof dragging !== 'undefined' && dragging) ? 'color-mix(in srgb, var(--color-accent) 8%, transparent)' : undefined }"
                         style="border:1px dashed var(--color-divider);border-radius:8px;padding:14px;display:flex;flex-wrap:wrap;align-items:center;gap:10px"
                     >
                         <label class="btn btn-secondary" style="cursor:pointer">Wybierz pliki<input type="file" multiple style="display:none" wire:model="attachments"></label>

src/resources/views/livewire/operator/queue.blade.php

@@ -1,17 +1,22 @@
 <div style="flex:1;display:flex;flex-direction:column">
-    <x-topbar />
+    <x-topbar area="operator" />
 
     <div class="app-split" style="flex:1;display:flex;min-height:0">
         <div
             class="side-rail"
             style="padding:10px;gap:6px;background:color-mix(in srgb, var(--color-text) 5%, var(--color-bg))"
             x-data="{ collapsed: localStorage.getItem('operatorSidebarCollapsed') === '1' }"
-            x-effect="localStorage.setItem('operatorSidebarCollapsed', collapsed ? '1' : '0')"
-            :class="collapsed ? 'side-rail-collapsed' : ''"
+            x-effect="typeof collapsed !== 'undefined' && localStorage.setItem('operatorSidebarCollapsed', collapsed ? '1' : '0')"
+            :class="(typeof collapsed !== 'undefined' && collapsed) ? 'side-rail-collapsed' : ''"
         >
-            <button type="button" class="side-rail-toggle" @click="collapsed = ! collapsed" :title="collapsed ? 'Rozwiń panel' : 'Zwiń panel'">
-                <span class="material-symbols-outlined" style="font-size:18px" x-text="collapsed ? 'left_panel_open' : 'left_panel_close'"></span>
-                <span class="side-rail-toggle-label" x-text="collapsed ? 'Przegląd' : 'Zwiń panel'"></span>
+            <button type="button" class="side-rail-toggle" @click="collapsed = ! collapsed" :title="(typeof collapsed !== 'undefined' && collapsed) ? 'Rozwiń panel' : 'Zwiń panel'">
+                <span class="material-symbols-outlined" style="font-size:18px" x-text="(typeof collapsed !== 'undefined' && collapsed) ? 'left_panel_open' : 'left_panel_close'"></span>
+                <span class="side-rail-toggle-label" x-text="(typeof collapsed !== 'undefined' && collapsed) ? 'Przegląd' : 'Zwiń panel'"></span>
+            </button>
+
+            <button type="button" class="side-rail-toggle" title="Szukaj" @click="window.dispatchEvent(new CustomEvent('open-global-search'))">
+                <span class="material-symbols-outlined" style="font-size:18px">search</span>
+                <span class="side-rail-toggle-label">Szukaj</span>
             </button>
 
             <div class="side-rail-scroll">
@@ -27,6 +32,18 @@
                         @endforeach
                     </div>
                 @endforeach
+
+                @if ($this->recentlyViewed->isNotEmpty())
+                    <div style="display:flex;flex-direction:column;gap:1px">
+                        <div class="side-rail-group-label" style="font-size:10px;letter-spacing:0.09em;text-transform:uppercase;color:color-mix(in srgb, var(--color-text) 45%, transparent);padding:4px 12px 6px;white-space:nowrap">Ostatnio przeglądane</div>
+                        @foreach ($this->recentlyViewed as $ticket)
+                            <a href="{{ route('operator.ticket', $ticket) }}" wire:navigate class="side-rail-item" title="{{ $ticket->displayNumber() }} — {{ $ticket->subject }}" style="display:flex;align-items:center;gap:10px;width:100%;padding:8px 12px;border-radius:6px;font-size:13.5px;text-align:left;white-space:nowrap;text-decoration:none;color:var(--color-text);overflow:hidden">
+                                <span class="material-symbols-outlined" style="font-size:18px;flex:none">history</span>
+                                <span class="side-rail-label" style="overflow:hidden;text-overflow:ellipsis">{{ $ticket->displayNumber() }} — {{ $ticket->subject }}</span>
+                            </a>
+                        @endforeach
+                    </div>
+                @endif
             </div>
         </div>
 
@@ -40,6 +57,10 @@
                         <button type="button" class="btn btn-secondary" @disabled(count($selectedIds) < 2) wire:click="mergeSelected">Scal zgłoszenia ({{ count($selectedIds) }})</button>
                         <button type="button" class="btn btn-secondary" @disabled(count($selectedIds) < 1) wire:click="requestDeleteSelected" style="color:var(--color-danger)">Usuń zgłoszenia ({{ count($selectedIds) }})</button>
                     </div>
+                    <a href="{{ route('operator.clients') }}" wire:navigate class="btn btn-secondary" style="display:flex;align-items:center;gap:6px">
+                        <span class="material-symbols-outlined" style="font-size:18px">person_search</span>
+                        Klienci
+                    </a>
                     <a href="{{ route('operator.stats') }}" wire:navigate class="btn btn-secondary" style="display:flex;align-items:center;gap:6px">
                         <span class="material-symbols-outlined" style="font-size:18px">bar_chart</span>
                         Statystyki
@@ -69,6 +90,7 @@
                 </select>
                 <select class="input" style="width:auto" wire:model.live="filterCategory">
                     <option value="all">Wszystkie kategorie</option>
+                    <option value="none">Bez kategorii</option>
                     @foreach ($this->categories as $c)
                         <option value="{{ $c->id }}">{{ $c->name }}</option>
                     @endforeach
@@ -79,7 +101,7 @@
                         <span class="material-symbols-outlined" style="font-size:18px">bookmark</span>
                         Zapisane widoki
                     </button>
-                    <div x-show="open" x-cloak @click.outside="open = false; adding = false" style="position:absolute;top:100%;left:0;margin-top:4px;background:var(--color-surface);border:1px solid var(--color-divider);border-radius:8px;box-shadow:var(--shadow-md);z-index:30;padding:6px;min-width:220px">
+                    <div x-show="typeof open !== 'undefined' && open" x-cloak @click.outside="open = false; adding = false" style="position:absolute;top:100%;left:0;margin-top:4px;background:var(--color-surface);border:1px solid var(--color-divider);border-radius:8px;box-shadow:var(--shadow-md);z-index:30;padding:6px;min-width:220px">
                         @forelse ($this->savedViews as $view)
                             <div style="display:flex;align-items:center;gap:4px;padding:2px 2px 2px 8px;border-radius:5px;{{ $savedViewId === $view->id ? 'background:color-mix(in srgb, var(--color-accent) 12%, transparent)' : '' }}">
                                 <button type="button" wire:click="applySavedView({{ $view->id }})" style="flex:1;min-width:0;text-align:left;background:none;border:none;cursor:pointer;padding:6px 0;font-size:13px;color:{{ $savedViewId === $view->id ? 'var(--color-accent)' : 'inherit' }};overflow:hidden;text-overflow:ellipsis;white-space:nowrap">{{ $view->name }}</button>
@@ -95,7 +117,7 @@
                         <template x-if="! adding">
                             <button type="button" class="btn btn-secondary btn-block" @click="adding = true" style="font-size:12.5px">+ Zapisz bieżące filtry…</button>
                         </template>
-                        <div x-show="adding" style="display:flex;gap:6px;padding:4px 2px">
+                        <div x-show="typeof adding !== 'undefined' && adding" style="display:flex;gap:6px;padding:4px 2px">
                             <input class="input" style="flex:1;font-size:12.5px" placeholder="Nazwa widoku" wire:model="newViewName" @keydown.enter="$wire.saveCurrentView(); adding = false">
                             <button type="button" class="btn btn-primary" style="flex:none;padding:6px 10px" @click="$wire.saveCurrentView(); adding = false">Zapisz</button>
                         </div>
@@ -107,7 +129,7 @@
                         <span class="material-symbols-outlined" style="font-size:18px">view_column</span>
                         Kolumny
                     </button>
-                    <div x-show="open" x-cloak @click.outside="open = false" style="position:absolute;top:100%;right:0;margin-top:4px;background:var(--color-surface);border:1px solid var(--color-divider);border-radius:8px;box-shadow:var(--shadow-md);z-index:30;padding:6px;min-width:180px">
+                    <div x-show="typeof open !== 'undefined' && open" x-cloak @click.outside="open = false" style="position:absolute;top:100%;right:0;margin-top:4px;background:var(--color-surface);border:1px solid var(--color-divider);border-radius:8px;box-shadow:var(--shadow-md);z-index:30;padding:6px;min-width:180px">
                         @foreach ($columnDefs as $key => $label)
                             <label style="display:flex;align-items:center;gap:8px;font-size:13px;font-weight:400;padding:6px 8px;border-radius:5px;cursor:pointer">
                                 <input type="checkbox" @checked(in_array($key, $visibleColumns)) wire:click="toggleColumn('{{ $key }}')">
@@ -126,15 +148,27 @@
                     $refreshQueueSeconds = max(1, (int) \App\Support\Settings::get('refresh_queue_seconds'));
                 @endphp
                 <div
+                    wire:key="queue-autorefresh"
                     class="btn btn-secondary"
                     style="cursor:pointer;gap:6px"
-                    x-data="{ remaining: {{ $refreshQueueSeconds }}, total: {{ $refreshQueueSeconds }} }"
-                    x-init="setInterval(() => { remaining = remaining <= 1 ? total : remaining - 1; if (remaining === total) $wire.refreshQueue(); }, 1000)"
+                    x-data="{
+                        remaining: {{ $refreshQueueSeconds }}, total: {{ $refreshQueueSeconds }},
+                        tick: null,
+                        navigatingHandler: null,
+                        init() {
+                            this.tick = setInterval(() => {
+                                this.remaining = this.remaining <= 1 ? this.total : this.remaining - 1;
+                                if (this.remaining === this.total) $wire.refreshQueue();
+                            }, 1000);
+                            this.navigatingHandler = () => clearInterval(this.tick);
+                            document.addEventListener('livewire:navigating', this.navigatingHandler);
+                        },
+                    }"
                     x-on:click="remaining = total; $wire.refreshQueue()"
                     title="Kolejka odświeża się automatycznie — kliknij, aby odświeżyć teraz"
                 >
                     <span class="material-symbols-outlined" style="font-size:18px">schedule</span>
-                    <span x-text="remaining + 's'"></span>
+                    <span x-text="typeof remaining !== 'undefined' ? (remaining + 's') : ''"></span>
                 </div>
             </div>
 
@@ -208,6 +242,9 @@
                     </tbody>
                 </table>
             </div>
+            <div style="margin-top:12px">
+                {{ $this->filteredTickets->links() }}
+            </div>
         </div>
     </div>
 

src/resources/views/livewire/operator/stats.blade.php

@@ -1,5 +1,5 @@
 <div style="flex:1;display:flex;flex-direction:column">
-    <x-topbar />
+    <x-topbar area="operator" />
 
     <div class="page-pad" style="flex:1;padding:20px 24px;overflow:auto;display:flex;flex-direction:column;gap:20px">
         <div style="display:flex;justify-content:space-between;align-items:center;gap:12px;flex-wrap:wrap">

src/resources/views/livewire/operator/ticket-show.blade.php

@@ -1,5 +1,5 @@
 <div style="flex:1;display:flex;flex-direction:column">
-    <x-topbar />
+    <x-topbar area="operator" />
 
     <div class="page-pad" style="flex:1;padding:20px 24px;overflow:auto">
         <div style="display:flex;flex-direction:column;gap:16px;max-width:1180px;margin:0 auto">
@@ -25,15 +25,27 @@
                     $refreshTicketSeconds = max(1, (int) \App\Support\Settings::get('refresh_ticket_view_seconds'));
                 @endphp
                 <div
+                    wire:key="ticket-autorefresh-{{ $ticket->id }}"
                     class="btn btn-secondary"
                     style="cursor:pointer;gap:6px"
-                    x-data="{ remaining: {{ $refreshTicketSeconds }}, total: {{ $refreshTicketSeconds }} }"
-                    x-init="setInterval(() => { remaining = remaining <= 1 ? total : remaining - 1; if (remaining === total) $wire.refreshTicketData(); }, 1000)"
+                    x-data="{
+                        remaining: {{ $refreshTicketSeconds }}, total: {{ $refreshTicketSeconds }},
+                        tick: null,
+                        navigatingHandler: null,
+                        init() {
+                            this.tick = setInterval(() => {
+                                this.remaining = this.remaining <= 1 ? this.total : this.remaining - 1;
+                                if (this.remaining === this.total) $wire.refreshTicketData();
+                            }, 1000);
+                            this.navigatingHandler = () => clearInterval(this.tick);
+                            document.addEventListener('livewire:navigating', this.navigatingHandler);
+                        },
+                    }"
                     x-on:click="remaining = total; $wire.refreshTicketData()"
                     title="Zgłoszenie odświeża się automatycznie — kliknij, aby odświeżyć teraz"
                 >
                     <span class="material-symbols-outlined" style="font-size:18px">schedule</span>
-                    <span x-text="remaining + 's'"></span>
+                    <span x-text="typeof remaining !== 'undefined' ? (remaining + 's') : ''"></span>
                 </div>
             </div>
 
@@ -140,7 +152,7 @@
                                     @dragover.prevent="dragging = true"
                                     @dragleave.prevent="dragging = false"
                                     @drop.prevent="dragging = false; const input = $el.querySelector('input[type=file]'); input.files = $event.dataTransfer.files; input.dispatchEvent(new Event('change'))"
-                                    :style="{ borderColor: dragging ? 'var(--color-accent)' : undefined, background: dragging ? 'color-mix(in srgb, var(--color-accent) 8%, transparent)' : undefined }"
+                                    :style="{ borderColor: (typeof dragging !== 'undefined' && dragging) ? 'var(--color-accent)' : undefined, background: (typeof dragging !== 'undefined' && dragging) ? 'color-mix(in srgb, var(--color-accent) 8%, transparent)' : undefined }"
                                     style="flex:1;min-width:0;border:1px dashed var(--color-divider);border-radius:8px;padding:10px 14px;display:flex;flex-wrap:wrap;align-items:center;gap:10px"
                                 >
                                     <label class="btn btn-secondary" style="cursor:pointer;flex:none">Załącz pliki<input type="file" multiple style="display:none" wire:model="noteAttachments"></label>
@@ -216,7 +228,7 @@
                                 @dragover.prevent="dragging = true"
                                 @dragleave.prevent="dragging = false"
                                 @drop.prevent="dragging = false; const input = $el.querySelector('input[type=file]'); input.files = $event.dataTransfer.files; input.dispatchEvent(new Event('change'))"
-                                :style="{ borderColor: dragging ? 'var(--color-accent)' : undefined, background: dragging ? 'color-mix(in srgb, var(--color-accent) 8%, transparent)' : undefined }"
+                                :style="{ borderColor: (typeof dragging !== 'undefined' && dragging) ? 'var(--color-accent)' : undefined, background: (typeof dragging !== 'undefined' && dragging) ? 'color-mix(in srgb, var(--color-accent) 8%, transparent)' : undefined }"
                                 style="flex:1;min-width:0;border:1px dashed var(--color-divider);border-radius:8px;padding:10px 14px;display:flex;flex-wrap:wrap;align-items:center;gap:10px"
                             >
                                 <label class="btn btn-secondary" style="cursor:pointer;flex:none">Załącz pliki<input type="file" multiple style="display:none" wire:model="replyAttachments"></label>
@@ -235,7 +247,7 @@
                                 <button class="btn btn-primary" type="button" style="border-top-left-radius:0;border-bottom-left-radius:0;border-left:1px solid var(--color-bg);padding:0 6px" @click="open = !open">
                                     <span class="material-symbols-outlined" style="font-size:16px">expand_more</span>
                                 </button>
-                                <div x-show="open" x-cloak style="position:absolute;bottom:100%;right:0;margin-bottom:6px;background:var(--color-surface);border:1px solid var(--color-divider);border-radius:8px;box-shadow:var(--shadow-md);min-width:220px;overflow:hidden;z-index:10">
+                                <div x-show="typeof open !== 'undefined' && open" x-cloak style="position:absolute;bottom:100%;right:0;margin-bottom:6px;background:var(--color-surface);border:1px solid var(--color-divider);border-radius:8px;box-shadow:var(--shadow-md);min-width:220px;overflow:hidden;z-index:10">
                                     @forelse ($this->replyQuickActions as $qa)
                                         <button type="button" class="theme-toggle-option" @click="open = false" wire:click="sendAndTransition({{ $qa->id }})">{{ $qa->label }}</button>
                                     @empty
@@ -439,6 +451,7 @@
                     <div class="card" style="padding:16px;gap:8px">
                         <div class="card-kicker">MONITOR CZASU PRACY</div>
                         <div
+                            wire:key="ticket-timer-{{ $ticket->id }}"
                             style="display:flex;flex-direction:column;gap:6px"
                             x-data="{
                                 seconds: {{ $ticket->timerElapsedSeconds() }},
@@ -464,16 +477,43 @@
                                     // The timer only tracks time this ticket is actually open in
                                     // the browser: stop it server-side the moment the operator
                                     // navigates elsewhere in the app (wire:navigate — a normal
-                                    // Livewire call, since the document itself isn't unloading)…
+                                    // SPA transition, since the document itself isn't unloading)…
+                                    //
+                                    // Alpine has no automatic on-element-removed hook (a
+                                    // `destroy(){}` method here — as this used to have — is never
+                                    // called by anything), so wire:navigate leaving this ticket
+                                    // page previously left `tick`'s setInterval running forever in
+                                    // the background against a stale scope, eventually throwing
+                                    // 'format is not defined' or similar once Alpine's reactivity
+                                    // for it was in a half-torn-down state. Explicitly tearing
+                                    // everything down here (the one hook that's actually invoked,
+                                    // on navigation away) fixes that at the source.
+                                    //
+                                    // This deliberately does NOT use $wire.call('stopTimer') —
+                                    // that used to be here, but firing a Livewire action from
+                                    // inside the livewire:navigating handler makes Livewire process
+                                    // that action's response (and morph the DOM for it) while the
+                                    // SPA navigation to the next page is already underway, which
+                                    // corrupts unrelated Alpine components elsewhere on the page
+                                    // (confirmed via a browser console capture: 'Illegal invocation'
+                                    // errors on the shared topbar's dropdowns, traced back to this
+                                    // exact handler in the stack). sendBeacon — the same mechanism
+                                    // pagehideHandler already uses below, for the same underlying
+                                    // reason — is a plain HTTP POST that never touches Livewire's
+                                    // component/morph pipeline, so it can't race with navigation.
                                     this.navigatingHandler = () => {
-                                        if (this.running) $wire.call('stopTimer');
+                                        if (this.running) {
+                                            navigator.sendBeacon(@js(route('operator.ticket.stop-timer', $ticket)));
+                                        }
+                                        this.teardown();
                                     };
                                     document.addEventListener('livewire:navigating', this.navigatingHandler);
 
                                     // …or closes/reloads the tab. Regular fetch/Livewire calls
                                     // can get cut off mid-flight during an actual page unload, so
                                     // this uses sendBeacon against a plain endpoint instead, which
-                                    // browsers guarantee to deliver.
+                                    // browsers guarantee to deliver. No teardown() needed here —
+                                    // the whole JS realm is going away with the page.
                                     this.pagehideHandler = () => {
                                         if (this.running) {
                                             navigator.sendBeacon(@js(route('operator.ticket.stop-timer', $ticket)));
@@ -481,7 +521,7 @@
                                     };
                                     window.addEventListener('pagehide', this.pagehideHandler);
                                 },
-                                destroy() {
+                                teardown() {
                                     clearInterval(this.tick);
                                     document.removeEventListener('livewire:navigating', this.navigatingHandler);
                                     window.removeEventListener('pagehide', this.pagehideHandler);
@@ -500,7 +540,12 @@
                                 </div>
                             @else
                                 <div style="font-size:12px;display:flex;align-items:center;gap:6px">
-                                    <span>Czas w zgłoszeniu: <strong x-text="format()"></strong></span>
+                                    {{-- Guarded call: even with the interval/listener cleanup above, a
+                                         refreshTicketData() response already in flight when the operator
+                                         navigates away can still land afterward and get morphed against
+                                         a scope that's mid-teardown — typeof-guarding here means that
+                                         race can no longer throw, whatever exactly triggers it. --}}
+                                    <span>Czas w zgłoszeniu: <strong x-text="typeof format === 'function' ? format() : ''"></strong></span>
                                     <span class="material-symbols-outlined" style="font-size:16px;cursor:pointer;opacity:0.7" wire:click="startEditTimer">edit</span>
                                 </div>
                                 @if ($ticket->isClosed())

src/routes/web.php

@@ -6,6 +6,7 @@ use App\Livewire\Client\Dashboard as ClientDashboard;
 use App\Livewire\Client\NewTicket as ClientNewTicket;
 use App\Livewire\Client\TicketShow as ClientTicketShow;
 use App\Livewire\Landing;
+use App\Livewire\Operator\ClientSearch as OperatorClientSearch;
 use App\Livewire\Operator\NewTicket as OperatorNewTicket;
 use App\Livewire\Operator\Queue as OperatorQueue;
 use App\Livewire\Operator\Stats as OperatorStats;
@@ -56,6 +57,7 @@ Route::middleware(['auth', 'role:operator'])->prefix('operator')->name('operator
     Route::get('/', OperatorQueue::class)->name('queue');
     Route::get('/new', OperatorNewTicket::class)->name('new');
     Route::get('/stats', OperatorStats::class)->name('stats');
+    Route::get('/clients', OperatorClientSearch::class)->name('clients');
     Route::get('/tickets/{ticket}', OperatorTicketShow::class)->name('ticket');
 
     // Fired via navigator.sendBeacon on tab/browser close (see the

src/tests/Feature/AdminLogsViewerTest.php

@@ -0,0 +1,78 @@
+<?php
+
+use App\Livewire\Admin\Logs;
+use App\Models\User;
+use Livewire\Livewire;
+
+function adminUserForLogsTest(): User
+{
+    return User::query()->create(['name' => 'Admin', 'email' => 'admin-logs@example.com', 'roles' => ['admin']]);
+}
+
+beforeEach(function () {
+    $this->logPath = storage_path('logs/pest-admin-logs-test.log');
+    file_put_contents($this->logPath, implode("\n", [
+        '[2026-08-05 08:00:00] production.INFO: normalny wpis o połączeniu',
+        '[2026-08-05 08:01:00] production.ERROR: coś się nie udało',
+        '#0 stack trace line belonging to the ERROR entry above',
+        '[2026-08-05 08:02:00] production.WARNING: uwaga na przyszłość',
+    ])."\n");
+});
+
+afterEach(function () {
+    @unlink($this->logPath);
+});
+
+test('admin sees the log file list and its tail content', function () {
+    $admin = adminUserForLogsTest();
+
+    Livewire::actingAs($admin)->test(Logs::class)
+        ->set('selectedFile', 'pest-admin-logs-test.log')
+        ->assertSee('pest-admin-logs-test.log')
+        ->assertSee('normalny wpis o połączeniu')
+        ->assertSee('coś się nie udało')
+        ->assertSee('stack trace line belonging to the ERROR entry above');
+});
+
+test('multi-line entries stay grouped and level filter narrows to matching entries', function () {
+    $admin = adminUserForLogsTest();
+
+    $component = Livewire::actingAs($admin)->test(Logs::class)
+        ->set('selectedFile', 'pest-admin-logs-test.log');
+
+    expect($component->get('entries'))->toHaveCount(3);
+
+    $component->set('levelFilter', 'ERROR');
+    $entries = $component->get('entries');
+
+    expect($entries)->toHaveCount(1)
+        ->and($entries[0]['text'])->toContain('coś się nie udało')
+        ->and($entries[0]['text'])->toContain('stack trace line belonging to the ERROR entry above');
+});
+
+test('search filters entries by substring', function () {
+    $admin = adminUserForLogsTest();
+
+    $component = Livewire::actingAs($admin)->test(Logs::class)
+        ->set('selectedFile', 'pest-admin-logs-test.log')
+        ->set('search', 'uwaga');
+
+    expect($component->get('entries'))->toHaveCount(1)
+        ->and($component->get('entries')[0]['text'])->toContain('uwaga na przyszłość');
+});
+
+test('selecting an unknown file name is ignored, preventing path traversal via the public property', function () {
+    $admin = adminUserForLogsTest();
+
+    $component = Livewire::actingAs($admin)->test(Logs::class)
+        ->set('selectedFile', 'pest-admin-logs-test.log')
+        ->call('selectFile', '../../.env');
+
+    expect($component->get('selectedFile'))->toBe('pest-admin-logs-test.log');
+});
+
+test('non-admin cannot open the admin panel logs tab', function () {
+    $operator = User::query()->create(['name' => 'Op', 'email' => 'op-logs@example.com', 'roles' => ['operator']]);
+
+    $this->actingAs($operator)->get('/admin')->assertForbidden();
+});

src/tests/Feature/GlobalSearchAndRecentlyViewedTest.php

@@ -0,0 +1,147 @@
+<?php
+
+use App\Livewire\GlobalSearch;
+use App\Livewire\Operator\Queue;
+use App\Livewire\Operator\TicketShow as OperatorTicketShow;
+use App\Models\User;
+use Livewire\Livewire;
+
+test('opening a ticket records a view that surfaces in the operator sidebar, most recent first', function () {
+    seedStatusesAndPriorities();
+    $operator = operatorUser('recent-view@example.com');
+    $ticketA = makeTicket(['number' => '1001', 'subject' => 'First one']);
+    $ticketB = makeTicket(['number' => '1002', 'subject' => 'Second one']);
+
+    Livewire::actingAs($operator)->test(OperatorTicketShow::class, ['ticket' => $ticketA]);
+    Livewire::actingAs($operator)->test(OperatorTicketShow::class, ['ticket' => $ticketB]);
+
+    $queue = Livewire::actingAs($operator)->test(Queue::class);
+    $recent = $queue->instance()->recentlyViewed;
+
+    expect($recent->pluck('id')->all())->toBe([$ticketB->id, $ticketA->id]);
+});
+
+test('re-opening the same ticket bumps it to the top instead of duplicating it', function () {
+    seedStatusesAndPriorities();
+    $operator = operatorUser('recent-view-bump@example.com');
+    $ticketA = makeTicket(['number' => '1001']);
+    $ticketB = makeTicket(['number' => '1002']);
+
+    Livewire::actingAs($operator)->test(OperatorTicketShow::class, ['ticket' => $ticketA]);
+    Livewire::actingAs($operator)->test(OperatorTicketShow::class, ['ticket' => $ticketB]);
+    Livewire::actingAs($operator)->test(OperatorTicketShow::class, ['ticket' => $ticketA]);
+
+    $recent = Livewire::actingAs($operator)->test(Queue::class)->instance()->recentlyViewed;
+
+    expect($recent->pluck('id')->all())->toBe([$ticketA->id, $ticketB->id]);
+});
+
+test('global search only returns tickets the searching user is allowed to see', function () {
+    seedStatusesAndPriorities();
+    $operator = operatorUser('search-operator@example.com');
+    $clientA = User::query()->create(['name' => 'Client A', 'email' => 'client-a@example.com', 'roles' => ['client']]);
+    $clientB = User::query()->create(['name' => 'Client B', 'email' => 'client-b@example.com', 'roles' => ['client']]);
+
+    $ticketA = makeTicket(['number' => '2001', 'subject' => 'Unikalny temat A', 'customer_id' => $clientA->id, 'email' => $clientA->email]);
+    makeTicket(['number' => '2002', 'subject' => 'Unikalny temat B', 'customer_id' => $clientB->id, 'email' => $clientB->email]);
+
+    // Operator sees both, scoped only by the search term.
+    $operatorResults = Livewire::actingAs($operator)->test(GlobalSearch::class)
+        ->set('search', 'Unikalny')
+        ->instance()->results;
+    expect($operatorResults)->toHaveCount(2);
+
+    // Client A only ever sees their own ticket, even when the term matches both.
+    $clientResults = Livewire::actingAs($clientA)->test(GlobalSearch::class)
+        ->set('search', 'Unikalny')
+        ->instance()->results;
+    expect($clientResults->pluck('id')->all())->toBe([$ticketA->id]);
+});
+
+test('global search returns nothing for a blank query', function () {
+    seedStatusesAndPriorities();
+    $operator = operatorUser('search-blank@example.com');
+    makeTicket(['number' => '3001']);
+
+    $results = Livewire::actingAs($operator)->test(GlobalSearch::class)->instance()->results;
+
+    expect($results)->toBeEmpty();
+});
+
+test('the od: operator matches the reporter, not ticket content', function () {
+    seedStatusesAndPriorities();
+    $operator = operatorUser('search-od@example.com');
+    $byKacper = makeTicket(['number' => '4001', 'name' => 'Kacper Zbikowski', 'email' => 'kacper@example.com', 'subject' => 'Nieistotny temat']);
+    makeTicket(['number' => '4002', 'name' => 'Ktos Inny', 'email' => 'ktos@example.com', 'subject' => 'Kacper w temacie']);
+
+    $results = Livewire::actingAs($operator)->test(GlobalSearch::class)
+        ->set('search', 'od:Kacper')
+        ->instance()->results;
+
+    expect($results->pluck('id')->all())->toBe([$byKacper->id]);
+});
+
+test('the temat: operator matches only the subject', function () {
+    seedStatusesAndPriorities();
+    $operator = operatorUser('search-temat@example.com');
+    $matching = makeTicket(['number' => '4101', 'subject' => 'Awaria drukarki', 'body' => 'coś innego']);
+    makeTicket(['number' => '4102', 'subject' => 'Coś innego', 'body' => 'Awaria drukarki w opisie']);
+
+    $results = Livewire::actingAs($operator)->test(GlobalSearch::class)
+        ->set('search', 'temat:drukarki')
+        ->instance()->results;
+
+    expect($results->pluck('id')->all())->toBe([$matching->id]);
+});
+
+test('the treść: operator matches only ticket/message body, not the subject', function () {
+    seedStatusesAndPriorities();
+    $operator = operatorUser('search-tresc@example.com');
+    $matching = makeTicket(['number' => '4201', 'subject' => 'Coś innego', 'body' => 'Drukarka nie działa od rana']);
+    makeTicket(['number' => '4202', 'subject' => 'Drukarka znów nie działa', 'body' => 'coś innego']);
+
+    $results = Livewire::actingAs($operator)->test(GlobalSearch::class)
+        ->set('search', 'treść:drukarka')
+        ->instance()->results;
+
+    expect($results->pluck('id')->all())->toBe([$matching->id]);
+});
+
+test('the numer: operator matches the ticket number', function () {
+    seedStatusesAndPriorities();
+    $operator = operatorUser('search-numer@example.com');
+    $matching = makeTicket(['number' => '9999']);
+    makeTicket(['number' => '1111']);
+
+    $results = Livewire::actingAs($operator)->test(GlobalSearch::class)
+        ->set('search', 'numer:9999')
+        ->instance()->results;
+
+    expect($results->pluck('id')->all())->toBe([$matching->id]);
+});
+
+test('operators combine with AND, matching Gmail-style multi-field search', function () {
+    seedStatusesAndPriorities();
+    $operator = operatorUser('search-combo@example.com');
+    $matching = makeTicket(['number' => '4301', 'name' => 'Kacper Zbikowski', 'subject' => 'Awaria drukarki']);
+    makeTicket(['number' => '4302', 'name' => 'Kacper Zbikowski', 'subject' => 'Inny temat']);
+    makeTicket(['number' => '4303', 'name' => 'Ktos Inny', 'subject' => 'Awaria drukarki']);
+
+    $results = Livewire::actingAs($operator)->test(GlobalSearch::class)
+        ->set('search', 'od:Kacper temat:drukarki')
+        ->instance()->results;
+
+    expect($results->pluck('id')->all())->toBe([$matching->id]);
+});
+
+test('an unrecognized "key:value" token is treated as free text instead of being silently dropped', function () {
+    seedStatusesAndPriorities();
+    $operator = operatorUser('search-unrecognized@example.com');
+    $matching = makeTicket(['number' => '4401', 'subject' => 'status:pilne coś']);
+
+    $results = Livewire::actingAs($operator)->test(GlobalSearch::class)
+        ->set('search', 'status:pilne')
+        ->instance()->results;
+
+    expect($results->pluck('id')->all())->toBe([$matching->id]);
+});

src/tests/Feature/OperatorClientSearchTest.php

@@ -0,0 +1,47 @@
+<?php
+
+use App\Livewire\Operator\ClientSearch;
+use App\Models\User;
+use Livewire\Livewire;
+
+test('searching by name or email finds matching accounts, empty search shows nothing', function () {
+    $operator = operatorUser('client-search-op@example.com');
+    $anna = User::query()->create(['name' => 'Anna Kowalska', 'email' => 'anna.kowalska@example.com', 'roles' => ['client']]);
+    User::query()->create(['name' => 'Jan Nowak', 'email' => 'jan.nowak@example.com', 'roles' => ['client']]);
+
+    $component = Livewire::actingAs($operator)->test(ClientSearch::class);
+    expect($component->instance()->results)->toHaveCount(0);
+
+    $component->set('search', 'Kowalska');
+    expect($component->instance()->results->pluck('id')->all())->toBe([$anna->id]);
+
+    $component->set('search', 'jan.nowak@example.com');
+    expect($component->instance()->results)->toHaveCount(1);
+
+    $component->set('search', 'nobody-matches-this');
+    expect($component->instance()->results)->toHaveCount(0);
+});
+
+test('results include the ticket count and are capped at 20', function () {
+    seedStatusesAndPriorities();
+    $operator = operatorUser('client-search-op2@example.com');
+    $client = User::query()->create(['name' => 'Piotr Testowy', 'email' => 'piotr@example.com', 'roles' => ['client']]);
+    makeTicket(['number' => '2001', 'customer_id' => $client->id, 'email' => $client->email, 'name' => $client->name]);
+    makeTicket(['number' => '2002', 'customer_id' => $client->id, 'email' => $client->email, 'name' => $client->name]);
+
+    foreach (range(1, 25) as $i) {
+        User::query()->create(['name' => "Testowy Kandydat {$i}", 'email' => "cand{$i}@example.com", 'roles' => ['client']]);
+    }
+
+    $component = Livewire::actingAs($operator)->test(ClientSearch::class)->set('search', 'Testowy');
+    expect($component->instance()->results)->toHaveCount(20);
+
+    $component->set('search', 'Piotr');
+    expect($component->instance()->results->first()->tickets_as_customer_count)->toBe(2);
+});
+
+test('a client cannot reach the operator client-search page', function () {
+    $client = User::query()->create(['name' => 'Client', 'email' => 'not-operator@example.com', 'roles' => ['client']]);
+
+    $this->actingAs($client)->get(route('operator.clients'))->assertForbidden();
+});

src/tests/Feature/PageTitleTest.php

@@ -0,0 +1,46 @@
+<?php
+
+use App\Models\User;
+use Illuminate\Testing\TestResponse;
+
+function assertTitle(TestResponse $response, string $expectedContext): void
+{
+    $response->assertOk();
+    preg_match('#<title>(.*?)</title>#s', $response->getContent(), $m);
+    expect($m[1] ?? null)->toBe($expectedContext.' — Servicedesk');
+}
+
+test('login and landing pages get a page-specific title', function () {
+    assertTitle($this->get('/login'), 'Logowanie');
+    assertTitle($this->get('/'), 'Zgłoś problem');
+});
+
+test('client pages carry a distinct, ticket-specific title', function () {
+    seedStatusesAndPriorities();
+    $client = User::query()->create(['name' => 'Client', 'email' => 'title-client@example.com', 'roles' => ['client']]);
+    $ticket = makeTicket(['number' => '6001', 'subject' => 'Drukarka nie działa', 'customer_id' => $client->id, 'email' => $client->email]);
+
+    assertTitle($this->actingAs($client)->get('/client'), 'Moje zgłoszenia');
+    assertTitle($this->actingAs($client)->get('/client/new'), 'Nowe zgłoszenie');
+    assertTitle($this->actingAs($client)->get(route('client.ticket', $ticket)), '#6001 — Drukarka nie działa');
+});
+
+test('operator queue title reflects the currently selected queue', function () {
+    seedStatusesAndPriorities();
+    $operator = operatorUser('title-operator@example.com');
+    $ticket = makeTicket(['number' => '6101', 'subject' => 'Awaria monitora']);
+
+    assertTitle($this->actingAs($operator)->get('/operator'), 'Otwarte');
+    assertTitle($this->actingAs($operator)->get('/operator?queue=mine'), 'Moje zgłoszenia');
+    assertTitle($this->actingAs($operator)->get('/operator/new'), 'Nowe zgłoszenie');
+    assertTitle($this->actingAs($operator)->get('/operator/stats'), 'Statystyki');
+    assertTitle($this->actingAs($operator)->get('/operator/clients'), 'Klienci');
+    assertTitle($this->actingAs($operator)->get(route('operator.ticket', $ticket)), '#6101 — Awaria monitora');
+});
+
+test('admin panel title reflects the currently selected tab', function () {
+    $admin = adminUser();
+
+    assertTitle($this->actingAs($admin)->get('/admin'), 'Kategorie');
+    assertTitle($this->actingAs($admin)->get('/admin?tab=users'), 'Użytkownicy');
+});

src/tests/Feature/SmokeTest.php

@@ -31,16 +31,16 @@ test('every page renders without error against fully seeded data', function () {
     $this->get('/')->assertOk()->assertSee('Jak możemy pomóc');
     $this->get('/login')->assertOk()->assertSee('Nowe zgłoszenie bez logowania');
 
-    $this->actingAs($client)->get('/client')->assertOk()->assertSee('Moje zgłoszenia')->assertSee('Panel Klienta');
-    $this->actingAs($client)->get('/client/new')->assertOk()->assertSee('Panel Klienta');
-    $this->actingAs($client)->get(route('client.ticket', $clientTicket))->assertOk()->assertSee($clientTicket->subject)->assertSee('Panel Klienta');
+    $this->actingAs($client)->get('/client')->assertOk()->assertSee('Moje zgłoszenia')->assertSee('Klient');
+    $this->actingAs($client)->get('/client/new')->assertOk()->assertSee('Klient');
+    $this->actingAs($client)->get(route('client.ticket', $clientTicket))->assertOk()->assertSee($clientTicket->subject)->assertSee('Klient');
 
-    $this->actingAs($operator)->get('/operator')->assertOk()->assertSee('Otwarte')->assertSee('Panel Operatora');
-    $this->actingAs($operator)->get('/operator/new')->assertOk()->assertSee($client->email)->assertSee('Panel Operatora');
-    $this->actingAs($operator)->get(route('operator.ticket', $anyTicket))->assertOk()->assertSee($anyTicket->subject)->assertSee('Panel Operatora');
+    $this->actingAs($operator)->get('/operator')->assertOk()->assertSee('Otwarte')->assertSee('Operator');
+    $this->actingAs($operator)->get('/operator/new')->assertOk()->assertSee($client->email)->assertSee('Operator');
+    $this->actingAs($operator)->get(route('operator.ticket', $anyTicket))->assertOk()->assertSee($anyTicket->subject)->assertSee('Operator');
 
     foreach (['categories', 'fields', 'users', 'teams', 'user-fields', 'reply-quick-actions', 'response-templates', 'statuses', 'priorities', 'templates', 'branding', 'config', 'about'] as $tab) {
-        $this->actingAs($admin)->get('/admin')->assertOk()->assertSee('Panel Administratora');
+        $this->actingAs($admin)->get('/admin')->assertOk()->assertSee('Administrator');
         Livewire::actingAs($admin)->test(Panel::class)
             ->call('setTab', $tab)
             ->assertOk();

src/tests/Feature/StatsCategoryBreakdownTest.php

@@ -0,0 +1,59 @@
+<?php
+
+use App\Livewire\Operator\Stats;
+use App\Models\Category;
+use App\Models\User;
+use Livewire\Livewire;
+
+test('byCategory counts tickets routed to a bare category (no subcategory) alongside subcategorized ones', function () {
+    seedStatusesAndPriorities();
+    $admin = User::query()->create(['name' => 'Admin', 'email' => 'stats-admin-cat@example.com', 'roles' => ['admin']]);
+
+    $it = Category::query()->create(['name' => 'IT-Pomoc']);
+    $vpn = $it->subcategories()->create(['name' => 'VPN']);
+    $delegacje = Category::query()->create(['name' => 'Delegacje']);
+
+    makeTicket(['number' => '7001', 'subcategory_id' => $vpn->id]);
+    makeTicket(['number' => '7002', 'subcategory_id' => $vpn->id]);
+    // Routed to a whole category with no subcategory (e.g. an IMAP mailbox
+    // routed to "całą kategorię") — previously invisible to byCategory().
+    makeTicket(['number' => '7003', 'category_id' => $delegacje->id]);
+    makeTicket(['number' => '7004', 'category_id' => $delegacje->id]);
+    makeTicket(['number' => '7005', 'category_id' => $delegacje->id]);
+
+    $rows = Livewire::actingAs($admin)->test(Stats::class)->instance()->byCategory;
+
+    expect($rows->firstWhere('label', 'IT-Pomoc'))->toBe(['label' => 'IT-Pomoc', 'count' => 2])
+        ->and($rows->firstWhere('label', 'Delegacje'))->toBe(['label' => 'Delegacje', 'count' => 3])
+        ->and($rows->count())->toBe(2);
+});
+
+test('byCategory sums both bare-category and subcategorized tickets into the same category total', function () {
+    seedStatusesAndPriorities();
+    $admin = User::query()->create(['name' => 'Admin', 'email' => 'stats-admin-cat-2@example.com', 'roles' => ['admin']]);
+
+    $it = Category::query()->create(['name' => 'IT-Pomoc']);
+    $vpn = $it->subcategories()->create(['name' => 'VPN']);
+
+    makeTicket(['number' => '7101', 'subcategory_id' => $vpn->id]);
+    makeTicket(['number' => '7102', 'category_id' => $it->id]);
+
+    $rows = Livewire::actingAs($admin)->test(Stats::class)->instance()->byCategory;
+
+    expect($rows->firstWhere('label', 'IT-Pomoc'))->toBe(['label' => 'IT-Pomoc', 'count' => 2]);
+});
+
+test('filterCategory includes tickets routed to a bare category with no subcategory', function () {
+    seedStatusesAndPriorities();
+    $admin = User::query()->create(['name' => 'Admin', 'email' => 'stats-admin-cat-3@example.com', 'roles' => ['admin']]);
+
+    $delegacje = Category::query()->create(['name' => 'Delegacje']);
+    makeTicket(['number' => '7201', 'category_id' => $delegacje->id]);
+    makeTicket(['number' => '7202']);
+
+    $kpis = Livewire::actingAs($admin)->test(Stats::class)
+        ->set('filterCategory', (string) $delegacje->id)
+        ->instance()->kpis;
+
+    expect($kpis['total'])->toBe(1);
+});

src/tests/Feature/StatsSubcategoryBreakdownTest.php

@@ -28,3 +28,22 @@ test('bySubcategory groups tickets per subcategory, labeled "Category / Subcateg
         ->and($rows->firstWhere('label', 'Zamówienia / Sprzęt'))->toBe(['label' => 'Zamówienia / Sprzęt', 'count' => 1])
         ->and($rows->count())->toBe(3);
 });
+
+test('bySubcategory gives tickets routed to a bare category (no subcategory) their own "(bez podkategorii)" row', function () {
+    seedStatusesAndPriorities();
+    $admin = User::query()->create(['name' => 'Admin', 'email' => 'stats-admin-sub-2@example.com', 'roles' => ['admin']]);
+
+    $it = Category::query()->create(['name' => 'IT-Pomoc']);
+    $vpn = $it->subcategories()->create(['name' => 'VPN']);
+    $delegacje = Category::query()->create(['name' => 'Delegacje']);
+
+    makeTicket(['number' => '4101', 'subcategory_id' => $vpn->id]);
+    makeTicket(['number' => '4102', 'category_id' => $delegacje->id]);
+    makeTicket(['number' => '4103', 'category_id' => $delegacje->id]);
+
+    $rows = Livewire::actingAs($admin)->test(Stats::class)->instance()->bySubcategory;
+
+    expect($rows->firstWhere('label', 'IT-Pomoc / VPN'))->toBe(['label' => 'IT-Pomoc / VPN', 'count' => 1])
+        ->and($rows->firstWhere('label', 'Delegacje (bez podkategorii)'))->toBe(['label' => 'Delegacje (bez podkategorii)', 'count' => 2])
+        ->and($rows->count())->toBe(2);
+});

src/tests/Feature/TicketBusinessRulesTest.php

@@ -41,6 +41,18 @@ test('next ticket number is one above the current max', function () {
     expect(Ticket::nextNumber())->toBe('1002');
 });
 
+test('next ticket number compares numerically, not lexicographically, across differing digit counts', function () {
+    seedStatusesAndPriorities();
+
+    // A plain string MAX()/ORDER BY would rank '999' above '1000' (lexicographic
+    // "9" > "1"), which is exactly the bug nextNumber()'s length-first ordering
+    // guards against — see Ticket::nextNumber().
+    makeTicket(['number' => '999']);
+    makeTicket(['number' => '1000']);
+
+    expect(Ticket::nextNumber())->toBe('1001');
+});
+
 test('sla info reports overdue once the resolution deadline has passed', function () {
     seedStatusesAndPriorities();
 

src/tests/Feature/TicketFieldValuesSyncTest.php

@@ -0,0 +1,50 @@
+<?php
+
+use App\Models\Category;
+use App\Models\CustomField;
+
+test('creating a ticket with custom_fields populates ticket_field_values with matching rows', function () {
+    seedStatusesAndPriorities();
+    $category = Category::query()->create(['name' => 'IT-Pomoc']);
+    $subcategory = $category->subcategories()->create(['name' => 'VPN']);
+    $field = CustomField::query()->create(['label' => 'Teamviewer-ID', 'type' => 'text', 'required' => false, 'sort_order' => 1]);
+    $field->subcategories()->attach($subcategory->id, ['position' => 1]);
+
+    $ticket = makeTicket(['subcategory_id' => $subcategory->id, 'custom_fields' => [$field->id => '123-456']]);
+
+    expect($ticket->fieldValues)->toHaveCount(1);
+    expect($ticket->fieldValues->first()->custom_field_id)->toBe($field->id);
+    expect($ticket->fieldValues->first()->value)->toBe('123-456');
+});
+
+test('updating custom_fields keeps ticket_field_values in sync — added, changed and removed entries', function () {
+    seedStatusesAndPriorities();
+    $category = Category::query()->create(['name' => 'IT-Pomoc']);
+    $subcategory = $category->subcategories()->create(['name' => 'VPN']);
+    $fieldA = CustomField::query()->create(['label' => 'A', 'type' => 'text', 'required' => false, 'sort_order' => 1]);
+    $fieldB = CustomField::query()->create(['label' => 'B', 'type' => 'text', 'required' => false, 'sort_order' => 2]);
+    $fieldA->subcategories()->attach($subcategory->id, ['position' => 1]);
+    $fieldB->subcategories()->attach($subcategory->id, ['position' => 2]);
+
+    $ticket = makeTicket([
+        'subcategory_id' => $subcategory->id,
+        'custom_fields' => [$fieldA->id => 'first', $fieldB->id => 'second'],
+    ]);
+
+    $ticket->update(['custom_fields' => [$fieldA->id => 'changed']]);
+
+    expect($ticket->fieldValues()->count())->toBe(1);
+    expect($ticket->fieldValues()->first()->value)->toBe('changed');
+});
+
+test('a blank custom field value is not synced into ticket_field_values', function () {
+    seedStatusesAndPriorities();
+    $category = Category::query()->create(['name' => 'IT-Pomoc']);
+    $subcategory = $category->subcategories()->create(['name' => 'VPN']);
+    $field = CustomField::query()->create(['label' => 'A', 'type' => 'text', 'required' => false, 'sort_order' => 1]);
+    $field->subcategories()->attach($subcategory->id, ['position' => 1]);
+
+    $ticket = makeTicket(['subcategory_id' => $subcategory->id, 'custom_fields' => [$field->id => '']]);
+
+    expect($ticket->fieldValues()->count())->toBe(0);
+});

src/tests/Feature/TicketListPaginationTest.php

@@ -0,0 +1,80 @@
+<?php
+
+use App\Livewire\Client\Dashboard;
+use App\Livewire\Client\TicketShow;
+use App\Livewire\Operator\Queue;
+use App\Models\User;
+use Livewire\Livewire;
+
+test('the operator queue paginates instead of rendering every matching ticket at once', function () {
+    seedStatusesAndPriorities();
+    $operator = operatorUser('queue-page@example.com');
+
+    foreach (range(1, 55) as $i) {
+        makeTicket(['number' => str_pad($i, 4, '0', STR_PAD_LEFT)]);
+    }
+
+    $component = Livewire::actingAs($operator)->test(Queue::class);
+
+    expect($component->instance()->filteredTickets)->toHaveCount(50)
+        ->and($component->instance()->filteredTickets->total())->toBe(55);
+
+    $component->call('gotoPage', 2);
+
+    expect($component->instance()->filteredTickets)->toHaveCount(5);
+});
+
+test('changing the queue search resets the operator to page 1', function () {
+    seedStatusesAndPriorities();
+    $operator = operatorUser('queue-page-reset@example.com');
+
+    foreach (range(1, 55) as $i) {
+        makeTicket(['number' => str_pad($i, 4, '0', STR_PAD_LEFT), 'subject' => 'Zgłoszenie']);
+    }
+    makeTicket(['number' => '9999', 'subject' => 'Unikalny temat']);
+
+    $component = Livewire::actingAs($operator)->test(Queue::class)->call('gotoPage', 2);
+    expect($component->instance()->filteredTickets->currentPage())->toBe(2);
+
+    $component->set('search', 'Unikalny');
+
+    expect($component->instance()->filteredTickets->currentPage())->toBe(1)
+        ->and($component->instance()->filteredTickets)->toHaveCount(1);
+});
+
+test('the client dashboard paginates current/archive tickets separately', function () {
+    seedStatusesAndPriorities();
+    $client = User::query()->create(['name' => 'Client', 'email' => 'dash-page@example.com', 'roles' => ['client']]);
+
+    foreach (range(1, 25) as $i) {
+        makeTicket(['number' => str_pad($i, 4, '0', STR_PAD_LEFT), 'customer_id' => $client->id, 'email' => $client->email, 'name' => $client->name, 'status_key' => 'new']);
+    }
+    foreach (range(1, 3) as $i) {
+        makeTicket(['number' => '90'.$i, 'customer_id' => $client->id, 'email' => $client->email, 'name' => $client->name, 'status_key' => 'closed']);
+    }
+
+    $component = Livewire::actingAs($client)->test(Dashboard::class);
+
+    expect($component->instance()->currentTickets)->toHaveCount(20)
+        ->and($component->instance()->currentTickets->total())->toBe(25)
+        ->and($component->instance()->archiveTickets)->toHaveCount(3);
+});
+
+test('"Inne Twoje zgłoszenia" shows only a handful until "Pokaż wszystkie" is clicked', function () {
+    seedStatusesAndPriorities();
+    $client = User::query()->create(['name' => 'Client', 'email' => 'other-tickets@example.com', 'roles' => ['client']]);
+    $viewed = makeTicket(['number' => '5000', 'customer_id' => $client->id, 'email' => $client->email, 'name' => $client->name]);
+
+    foreach (range(1, 8) as $i) {
+        makeTicket(['number' => '60'.$i, 'customer_id' => $client->id, 'email' => $client->email, 'name' => $client->name]);
+    }
+
+    $component = Livewire::actingAs($client)->test(TicketShow::class, ['ticket' => $viewed]);
+
+    expect($component->instance()->otherTickets)->toHaveCount(5)
+        ->and($component->instance()->otherTicketsCount)->toBe(8);
+
+    $component->call('revealAllOtherTickets');
+
+    expect($component->instance()->otherTickets)->toHaveCount(8);
+});

src/tests/Feature/TicketSourceValidationTest.php

@@ -0,0 +1,38 @@
+<?php
+
+use App\Models\Ticket;
+
+test('a ticket accepts every known source value', function () {
+    seedStatusesAndPriorities();
+
+    foreach (Ticket::SOURCES as $source) {
+        $ticket = makeTicket(['number' => uniqid(), 'source' => $source]);
+        expect($ticket->source)->toBe($source);
+    }
+});
+
+test('creating a ticket with an unrecognized source throws instead of silently storing it', function () {
+    seedStatusesAndPriorities();
+
+    expect(fn () => makeTicket(['source' => 'totally-made-up']))
+        ->toThrow(InvalidArgumentException::class);
+});
+
+test('a ticket message accepts a null source (implicit web) and the known email source', function () {
+    seedStatusesAndPriorities();
+    $ticket = makeTicket();
+
+    $webMessage = $ticket->messages()->create(['author_name' => 'A', 'body' => 'web reply']);
+    $mailMessage = $ticket->messages()->create(['author_name' => 'B', 'body' => 'mail reply', 'source' => 'email']);
+
+    expect($webMessage->source)->toBeNull()
+        ->and($mailMessage->source)->toBe('email');
+});
+
+test('a ticket message with an unrecognized source throws instead of silently storing it', function () {
+    seedStatusesAndPriorities();
+    $ticket = makeTicket();
+
+    expect(fn () => $ticket->messages()->create(['author_name' => 'A', 'body' => 'x', 'source' => 'totally-made-up']))
+        ->toThrow(InvalidArgumentException::class);
+});

wiki/admin/README.md

@@ -7,7 +7,8 @@ treści (szablony, szybkie akcje, e-maile), wygląd/branding oraz integracje
 (LDAP, poczta SMTP/IMAP, BookStack, AI, API).
 
 Domyślnie każde konto ląduje po zalogowaniu w panelu Klienta; przełącz się do
-panelu Administratora przez menu profilu (prawy górny róg).
+panelu Administratora suwakiem Klient/Operator/Administrator na środku
+górnego paska.
 
 ## Kategorie i pola dodatkowe
 
@@ -238,10 +239,12 @@ razem, zamiast być rozrzucone po różnych zakładkach.
 
 ## Integracje
 
-- **LDAP** — host, port, base DN, bind DN + hasło, SSL, filtr użytkownika
-  (`(uid={0})` domyślnie), auto-provisioning gości, ograniczenie tworzenia
-  kont/zgłaszania tylko przez LDAP. Przycisk **„Testuj połączenie”** sprawdza
-  bind bez zapisywania zmian.
+- **LDAP** — **Typ katalogu** (LLDAP/OpenLDAP domyślnie, albo Active
+  Directory — zmienia oczekiwany schemat i domyślny atrybut logowania), host,
+  port, base DN, bind DN + hasło, SSL, filtr użytkownika (`(uid={0})` dla
+  LLDAP, `(sAMAccountName={0})` dla AD), auto-provisioning gości, ograniczenie
+  tworzenia kont/zgłaszania tylko przez LDAP. Przycisk **„Testuj połączenie”**
+  sprawdza bind bez zapisywania zmian.
 
   > Po świeżej instalacji (`migrate:fresh --seed`) LDAP i SMTP zawierają
   > **przykładowe wartości** (`ldap.example.com`, `smtp.example.com`,
@@ -350,6 +353,17 @@ razem, zamiast być rozrzucone po różnych zakładkach.
   - **Prompt systemowy podsumowania** — edytowalne pole tekstowe z gotową
     wartością domyślną i przyciskiem **„Resetuj”**.
 
+## Logi
+
+Zakładka **„Logi”** pokazuje zawartość plików `storage/logs/*.log` (aplikacja,
+IMAP, automatyzacja AI, import z Heska, itd.) bez potrzeby dostępu do
+kontenera przez SSH/shell. Lista plików po lewej pokazuje rozmiar i datę
+ostatniej modyfikacji (najnowsze na górze) — kliknięcie ładuje zawartość.
+Filtry: poziom (ERROR/WARNING/INFO/...), wyszukiwanie tekstowe i liczba
+pokazywanych wpisów (100–3000, pokazuje ostatnie N pasujących), plus
+opcjonalne automatyczne odświeżanie co 5 s. Widok jest tylko do odczytu i
+dostępny wyłącznie dla administratorów.
+
 ## API
 
 Panel `/admin/api-docs` udostępnia interaktywną dokumentację (Swagger) REST API

wiki/client/README.md

@@ -2,8 +2,9 @@
 
 Panel klienta (`/client`) służy do zgłaszania problemów/próśb i śledzenia ich
 rozwiązania. Po zalogowaniu każde konto domyślnie ląduje właśnie tutaj — nawet jeśli
-posiada też uprawnienia operatora lub administratora (przełączysz się przez menu
-profilu w prawym górnym rogu). Dzwoneczek powiadomień w górnym pasku pokazuje
+posiada też uprawnienia operatora lub administratora (przełączysz się suwakiem
+Klient/Operator/Administrator na środku górnego paska — pokazuje tylko te panele,
+do których masz dostęp). Dzwoneczek powiadomień w górnym pasku pokazuje
 tylko **nieprzeczytane** powiadomienia — kliknięcie usuwa je z listy.
 
 ## Zgłaszanie nowej sprawy
@@ -43,7 +44,10 @@ Dashboard klienta dzieli zgłoszenia na dwie zakładki:
 - **Archiwum** — zgłoszenia zamknięte.
 
 Pole wyszukiwania nad listą przeszukuje numer, temat i treść zgłoszenia (oraz
-odpowiedzi w wątku).
+odpowiedzi w wątku). Obie zakładki są stronicowane (20 zgłoszeń na stronę),
+niezależnie od siebie — przełączenie zakładki nie cofa Cię na pierwszą stronę
+drugiej. **Ctrl+K**/**Cmd+K** otwiera też globalną wyszukiwarkę zgłoszeń z
+dowolnego miejsca w aplikacji (tylko Twoich zgłoszeń).
 
 Otwórz dowolne zgłoszenie, by zobaczyć:
 

wiki/operator/README.md

@@ -4,7 +4,8 @@ Panel operatora (`/operator`) to miejsce pracy z kolejką zgłoszeń: przegląd,
 odpowiadanie, zmiana statusu/priorytetu/przypisania oraz statystyki zespołu.
 
 Domyślnie każde konto ląduje po zalogowaniu w panelu Klienta; przełącz się do
-panelu Operatora przez menu profilu (prawy górny róg), jeśli konto ma tę rolę.
+panelu Operatora suwakiem Klient/Operator/Administrator na środku górnego
+paska, jeśli konto ma tę rolę.
 Dzwoneczek powiadomień w górnym pasku (widoczny we wszystkich panelach) pokazuje
 Twoje **nieprzeczytane** powiadomienia, aktualizowane **na żywo** w chwili ich
 utworzenia (niezależny od tego 30-sekundowy fallback dogrywa to, co ominęłoby
@@ -31,9 +32,24 @@ Panel główny (`/operator`) pokazuje listę zgłoszeń z zakładkami po lewej s
   widzi wszystkie zespoły; też bez zamkniętych).
 
 Nie-administratorzy widzą tylko zgłoszenia swoich zespołów, zgłoszenia bez
-przypisanego zespołu, oraz wszystko przypisane bezpośrednio do nich.
+przypisanego zespołu, oraz wszystko przypisane bezpośrednio do nich. Lista
+jest stronicowana (50 zgłoszeń na stronę) — zmiana filtra/wyszukiwania/
+zakładki wraca automatycznie na pierwszą stronę.
 
-**Filtry** nad tabelą: status, priorytet, kategoria, wyszukiwanie po numerze/
+Na pasku bocznym, nad zakładkami: przycisk **„Szukaj”** otwiera globalną
+wyszukiwarkę zgłoszeń (dostępną z każdej strony też pod **Ctrl+K**/**Cmd+K**)
+— oprócz zwykłego szukania po treści rozumie też operatory `od:`, `temat:`,
+`treść:` i `numer:` (np. `od:kowalski temat:drukarka`), które można łączyć.
+Niżej — **„Ostatnio przeglądane”**: ostatnie 6 zgłoszeń, które faktycznie
+otworzyłeś, najnowsze na górze.
+
+**Klienci** (przycisk nad tabelą) — osobna wyszukiwarka po imieniu/nazwisku/
+e-mailu dowolnego konta (nie tylko klientów), pokazuje liczbę jego zgłoszeń i
+prowadzi od razu do kolejki przefiltrowanej do tego klienta.
+
+**Filtry** nad tabelą: status, priorytet, kategoria (opcja **„Bez kategorii”**
+pokazuje zgłoszenia bez przypisanej kategorii i podkategorii — np. z poczty
+IMAP, która nie trafiła w żadną), wyszukiwanie po numerze/
 temacie/kliencie/treści zgłoszenia i odpowiedzi w wątku. **Kolumny** można dowolnie
 włączać/wyłączać przyciskiem „Kolumny” (numer, temat, klient, kategoria,
 podkategoria, priorytet, status, SLA, przypisany, zespół, utworzono — kilka z