8326: Fix the Leantime ticket search and user directory

[turegjorup]

Link to ticket

https://leantime.itkdev.dk/#/tickets/showTicket/8326

Stacked on #109, which adds the logger this uses — the log output in that PR is what identified both causes. Base changes to develop once #109 merges.

Description

Two independent failures, both on the repo advisories page.

searchCriteria.status was sent as an array. Leantime wants one scalar and answers -32000 Server error to a list. Probed against leantime.itkdev.dk with the production key:

status	result
['1','2','3','4'] — what we sent	ERROR -32000
omitted	65 tickets
'3'	2
'1,2,3,4'	4

So implode(',', self::OPEN_STATUS_IDS), which keeps the existing meaning exactly.

users.getAll answers -32001 You are not allowed to perform this action for our API key. This sits on the same path — findOpenSecurityTickets() resolves an assignee name per ticket, so the page stayed broken on the status fix alone, as soon as one ticket matched.

The directory now comes from the data-api plugin instead, which is already installed on that instance and serves id, email, name over the key we hold. loadUsers() pages workers until a short page arrives, comparing against the limit the plugin echoes rather than the one we sent — it caps at 1000 silently, and comparing to our own number would stop after the first page.

Ticket creation stays on JSON-RPC: data-api is read-only by design.

Note the path is /APIData/API/, case-sensitive. The plugin's own README documents /apidata/api/, which answers 404.

Verified against the live instance

Running the patched service against leantime.itkdev.dk:

findOpenSecurityTickets: 0 project(s); assignee resolved on 0 of them
directory: 24 users with an email

No exception — the page renders. Zero open tickets is the correct answer: the four the search returns are Cybersikkerhedsopdatering august 2026, … 26Q3, … 25Q4 and an unrelated OS2display agreement. Leantime's term is a LIKE, so Cyber+sikkerhedsopdatering matches; the exact-headline check then rejects them, which is what it is for.

Worth a separate decision

Those human-created tickets are named Cybersikkerhedsopdatering while this app creates and looks for Sikkerhedsopdatering. If that is the name people actually use, the app will create duplicates next to them. Not changed here — it is a naming call, not a bug.

Ticket assignment still needs the Leantime user permission, or findUserIdByEmail() returns null and tickets are created unassigned — already handled, with a warning flash.

Screenshot of the result

No user interface changes; the page renders its normal rows instead of the error flash.

Checklist

• My code is covered by test cases.
• My code passes our test (all our tests).
• My code passes our static analysis suite.
• My code passes our continuous integration process.

[github-actions]

API Specification - Non-breaking changes

No changelog changes

[codecov-commenter]

Codecov Report

❌ Patch coverage is 80.95238% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 42.32%. Comparing base (a03c8d9) to head (f9da5b5).

Files with missing lines	Patch %	Lines
src/Service/LeantimeService.php	80.95%	8 Missing ⚠️

Additional details and impacted files

@@                          Coverage Diff                          @@
##             feature/log-leantime-api-errors     #110      +/-   ##
=====================================================================
+ Coverage                              41.13%   42.32%   +1.18%     
- Complexity                              1133     1138       +5     
=====================================================================
  Files                                    150      150              
  Lines                                   3588     3615      +27     
=====================================================================
+ Hits                                    1476     1530      +54     
+ Misses                                  2112     2085      -27     

Flag	Coverage Δ
unittests	42.32% <80.95%> (+1.18%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.