Phase 2b: backend services, routes, and notification triggers

Attachments: multer-backed uploads with random-hex filenames,
streaming downloads with Content-Disposition, 25MB limit,
mimetype allowlist, audit entries, orphan cleanup on DB failure.

Full-text search: searchTicketIds + searchComments via raw SQL
ranked with ts_rank, composable filters via Prisma.sql/join,
hydrated with findMany and reordered via Map to preserve rank.

Pagination: listTicketsPaged returns {data,total,page,pageSize}
only when page/pageSize present (array response stays default,
so the Goddard n8n flow is unchanged).

Bulk actions: reassign/close/setSeverity/setStatus on POST /bulk,
writes one audit entry per ticket via createMany.

Analytics: summarize(window) runs 5 parallel groupBy + raw-SQL
queries for open-by-severity, status counts, queue load,
age buckets, percentile_cont median resolution hours.

CSV export streams matching tickets via res.write; saved views
CRUD with per-user ownership checks (403 cross-user, 404 missing).

Notifications: in-app Notification rows gated by prefs, email via
nodemailer (SMTP_HOST-gated, no-op when unset), outgoing webhooks
with HMAC-SHA256 signed POST and 3-retry exponential backoff.
Triggers wired into createTicket/updateTicket/addComment; mention
detection via parseMentions skips self-notify.

Infra: docker-compose uploads volume + SMTP env passthrough;
.env.example SMTP section.

43 server tests passing (attachment/webhook/notification/savedView
services covered; bulkAction covered in ticketService).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

server/src/services/commentService.ts

@@ -1,5 +1,7 @@
 import prisma from '../lib/prisma';
 import { HttpError } from '../lib/httpError';
+import * as notificationService from './notificationService';
+import { logger } from '../lib/logger';
 
 export async function addComment(ticketIdOrDisplay: string, body: string, actorId: string) {
   const ticket = await prisma.ticket.findFirst({
@@ -17,6 +19,23 @@ export async function addComment(ticketIdOrDisplay: string, body: string, actorI
     }),
   ]);
 
+  notificationService
+    .notifyCommentCreated(ticket.id, comment.id)
+    .catch((err: Error) => logger.error({ err }, 'notifyCommentCreated failed'));
+
+  const usernames = notificationService.parseMentions(body);
+  if (usernames.length > 0) {
+    prisma.user
+      .findMany({ where: { username: { in: usernames } }, select: { id: true } })
+      .then((users) => {
+        const ids = users.map((u) => u.id).filter((id) => id !== actorId);
+        if (ids.length > 0) {
+          return notificationService.notifyMention(ticket.id, comment.id, ids);
+        }
+      })
+      .catch((err: Error) => logger.error({ err }, 'mention notification failed'));
+  }
+
   return comment;
 }