security hardening

models.js

@@ -11,7 +11,7 @@ mongoose.model('Host', new mongoose.Schema({
     memFree: Number,
     cpuUsage: Number,
     diskFree: Number,
-    lastSeen: { type: Number, default: Date.now() },  // Add this
+    lastSeen: { type: Number, default: Date.now },
     lostInUse: { type: [Number], default: [] },
     statsHistory: [{
         timestamp: Number,
@@ -792,33 +792,37 @@ mongoose.model('ErrorLog', new mongoose.Schema({
 
 // ===== Broccolini Bot Models =====
 
-mongoose.model('Ticket', new mongoose.Schema({
+const ticketSchema = new mongoose.Schema({
     gmailThreadId: { type: String, required: true, unique: true, index: true },
     discordThreadId: String,
     broccoliniTicketId: Number,
-    lastSyncedBroccoliniArticleId: Number, // last agent reply we pushed to Discord/Gmail
+    lastSyncedBroccoliniArticleId: Number,
     senderEmail: { type: String, required: true },
     subject: String,
     createdAt: { type: Date, default: Date.now },
     status: { type: String, default: 'open', enum: ['open', 'closed'] },
     transcriptMessageId: String,
-    claimedBy: String, // Discord user ID or display name
+    claimedBy: String,
     escalated: { type: Boolean, default: false },
-    escalationTier: { type: Number, default: 0 }, // 0 = none, 1 = tier 2, 2 = tier 3
+    escalationTier: { type: Number, default: 0 },
     ticketNumber: Number,
     renameCount: { type: Number, default: 0 },
     renameWindowStart: Date,
     priority: { type: String, default: 'normal', enum: ['low', 'normal', 'medium', 'high'] },
-    ticketTag: String, // e.g. server-down, billing – used for channel name prefix (after priority emoji)
+    ticketTag: String,
     lastActivity: Date,
     reminderSent: { type: Boolean, default: false },
     welcomeMessageId: String,
     claimerId: String,
     staffChannelId: String,
     parentCategoryId: String,
-    unclaimedReminderssent: { type: [Number], default: [] },
+    unclaimedRemindersSent: { type: [Number], default: [] },
     lastMessageAuthorIsStaff: { type: Boolean, default: false }
-}));
+});
+ticketSchema.index({ status: 1, lastActivity: 1 });
+ticketSchema.index({ senderEmail: 1, status: 1 });
+ticketSchema.index({ discordThreadId: 1 });
+mongoose.model('Ticket', ticketSchema);
 
 mongoose.model('TicketCounter', new mongoose.Schema({
     senderLocal: { type: String, required: true, unique: true },