Repository navigation
Projects Developer Guide
The Projects module is the largest in FreeITSM: a portfolio of projects run three ways (Simple, Staged, Agile), with plans, a Gantt Timeline with dependencies and the critical path, people and RACI, a stakeholder map, scope, RAID, stage gates with checklists, budgets with forecasts and earned value, change control with baselines, intake and approval, benefits, reports drafted by an AI project manager, an Ask AI project assistant with memory that proposes changes you apply, work given to contractors (suppliers from Contracts), alerts and reminders, links to the rest of FreeITSM, templates and members-only projects. This page is the front door for developers; the detail is in a ten-part series.
The user guide is Projects; the phone layout is Mobile: Projects; the REST endpoints are REST API: Projects.
| Part | Read it when you need to know... |
|---|---|
| 1 Architecture | Where everything is (the full file map), how a request travels from the page to the database, ActorContext and ServiceError, permissions and every setting, members-only visibility, companies, methods, tools, tailoring and the Toolbox, how the JavaScript is organised, how to add a tab or a tool |
| 2 Schema | Every table with its CREATE TABLE, what each column means and who writes it, the foreign keys Database Verification adds, the ...Ready() guards, is_demo, how to make a schema change, useful SQL |
| 3 Services and API |
ProjectsService and ProjectToolsService method by method, every endpoint in api/projects/ (all tools.php actions) with JSON examples, the REST API, MCP and Warbot tools |
| 4 Plan, Timeline and dependencies | Stages, phases and sprints; project tasks as ordinary tasks; milestones; the Timeline; dependencies and the critical path (forward and backward pass, worked example); estimates and Capacity; the calendar |
| 5 Health and charts | Progress and health worked out on read, tolerances and exceptions, asset targets, the flow history, the PrjCharts library and its palette, earned value, the ten charts and where each lives |
| 6 Governance | RAID, RACI, stage gates and checklists, change control and baselines, intake and approval, benefits, the budget and labour costing |
| 7 Alerts, reports and AI | Every project.* event and bell, the alert scan and its ledger, reminders and nudges, reports (scheduled, approved, emailed), the AI project manager - exactly what it is told - the Ask AI project assistant (memory, coaching, proposals and applying them) and the Warbot / MCP assistants |
| 8 Connections, templates, people | The seven link kinds both ways, Documents, templates (format, built-ins, capture), the spreadsheet export, members, roles, the stakeholder map |
| 9 Demo data, testing and traps | The demo data and its generator, testing without touching real data (including the AI without a provider), the traps already fallen into, what is not built |
| 10 Contractors | A task given to a supplier and a person there: the two columns on tasks and project_members, includes/task_contractors.php, the Contracts rule in TasksService, the Tasks screen, Plan, members, Capacity, Ask AI, the optional email and its ledger, People's "Tasks with them", the REST fields and _optional_fields in the demo importer |
-
One path in. Pages call
api/projects/*.phpthroughPrj.api(); endpoints are thin and call a service; the rules live in the services andincludes/projects/*.php. The REST API, MCP and Warbot reuse the same services andincludes/projects/assistant.php. (1, 3) -
Health, progress and exceptions are worked out on read, never stored -
projectDecorate()inincludes/projects/read.php. Only the alert scan remembers what it last saw, to fire on a change. (5, 7) -
Project tasks are ordinary Tasks-module tasks (
tasks.project_id,project_stage_id). Deleting a project detaches them. (4) -
Every new column has a guard. Code must keep working on an install that has the new code but has not run Database Verification -
projectPriorityColumn(),projectVisibilityReady(),...Ready(). (2) -
Every new reader of
projectsapplies members-only visibility -projectVisibleSql()/projectVisibleTo(). (1) - Judgement calls are settings (Projects β Settings), with today's behaviour as the default. (1)
- Tools are switched on by the method and by tailoring; a hidden tool's data is kept and its effects (exceptions, auto-baselines) are off. The Toolbox adds tools as a project grows. (1, 6)
-
Time-based alerts use the
workflow_scheduled_emissionsledger so each fires once, and are dispatched as the system so nobody misses one because they happened to trigger the scan. (7) - The AI only sees what the person asking can see, and the project's text reaches it as data, never instructions. (7)
- Test through the endpoints, as a non-admin, on a temporary project - or a scratch database - and never send real email. (9)
| Screen | Page | JavaScript |
|---|---|---|
| Portfolio (Cards, Roadmap, Charts) | projects/index.php |
assets/js/projects-portfolio.js, projects-charts.js
|
| A project (all tabs) | projects/view.php |
projects-view.js plus one file per area: projects-tools.js, -timeline.js, -milestones.js, -insights.js, -budget.js, -control.js, -intake.js, -benefits.js, -gatecheck.js, -reports.js, -targets.js, -toolbox.js
|
| Capacity | projects/capacity.php |
projects-capacity.js |
| Settings | projects/settings/index.php |
projects-settings.js, projects-templates.js
|
| Help | projects/help.php |
- |
| How it fits together (the interactive map and walk-through) | projects/tutorial.php |
projects-tour.js |
| Contractors on a task (the task window, card and filter) | tasks/index.php |
assets/js/tasks.js; rules in includes/task_contractors.php, choices from api/tasks/contractors.php (part 10) |
| Ask AI - the project assistant panel |
projects/view.php (markup), projects/includes/header.php (the button, when $prjAskAi) |
projects-assistant.js; rules in includes/projects/assistant_chat.php, endpoint api/projects/assistant_chat.php
|
| The Projects panel on other modules' records | (asset, change, problem, CMDB, contract, knowledge, ticket pages) | assets/js/project-links.js |
Shared helpers are assets/js/projects.js (window.Prj); styles are assets/css/projects.css; words are lang/en/projects.php.
FreeITSM β an open-source IT Service Management platform Β· github.com/edmozley/freeitsm Β· MIT licence
- Installation
- β° Scheduled tasks (cron jobs)
- Architecture
- π§ͺ Developer tests
- AI Providers
- Internationalisation (i18n)
- Timezones & Time Handling
- π Date & Time Formats
- Theming & Dark Mode
- ποΈ Recent β getting back to what you were doing
- β¨οΈ Command palette (βK)
- π Searching inside tickets
- π Attached documents
-
MobileβFriendly
- β³ π« Mobile: Tickets
- β³ π» Mobile: Assets
- β³ π Mobile: Calendar
- β³ π Mobile: Knowledge
- β³ π¦ Mobile: Service Status
- β³ πΌ Mobile: Watchtower
- β³ π§© Mobile: Problem Management
- β³ π Mobile: Change Management
- β³ πΏ Mobile: Software
- β³ β Mobile: Tasks
- β³ π Mobile: Forms
- β³ π Mobile: Contracts
- β³ π Mobile: Domains
- β³ π Mobile: People
- β³ π Mobile: Projects
- β³ ποΈ Mobile: Files
- β³ π Mobile: LMS
- β³ πΊοΈ Mobile: CMDB
- β³ πΊοΈ Mobile: Network Mapper
- β³ π§ Mobile: Process Mapper
- β³ βοΈ Mobile: Workflow
- β³ π₯οΈ Mobile: System
- β³ π Mobile: Reporting
- β³ π Mobile: System Wiki
- β³ π Mobile: Self-Service Portal
- β³ π§° Mobile: Techniques & Tricks
-
Security
- Layer 1 β which modules you can enter
- β³ π§© Module Access Control
- β³ π οΈ Module Access β Developer Guide
- Layer 2 β what you can administer
- β³ π Roles & Permissions
- β³ π οΈ Roles β Developer Guide
- β³ π€ Why capabilities are constants
- Layer 3 β the System module
- β³ π Admin Access Control
- Hardening
- β³ π Security review response 2026-08
- β³ π‘οΈ Security hardening 2026-08
- β³ π οΈ Security hardening 2026-08 β Developer Guide
- β³ π‘οΈ Round three β plain English
- β³ π οΈ Round three β Developer Guide
- β³ π‘οΈ CSRF protection (S4) β Developer Guide
- Single Sign-On (SSO)
- ποΈ LDAP & Active Directory
- π CardDAV contact sync
- Browser Extension
- API Reference
-
π REST API β how it works
- β³ π« REST API: Tickets
- β³ π» REST API: Assets
- β³ π΄ REST API: Problems
- β³ π REST API: Changes
- β³ π REST API: Knowledge
- β³ β REST API: Tasks
- β³ ποΈ REST API: CMDB
- β³ π REST API: Contracts
- β³ ποΈ REST API: Calendar
- β³ πΏ REST API: Software
- β³ π REST API: Domains
- β³ π¦ REST API: Service Status
- β³ βοΈ REST API: Morning Checks
- β³ π REST API: Forms
- β³ βοΈ REST API: Workflow
- β³ π·οΈ REST API: Cost centres
- β³ π§βπΌ REST API: Analysts
- β³ πΊοΈ REST API: Network Mapper
- β³ π§ Using the API docs page
- β³ π OpenAPI specification
- β³ β OpenAPI: kept correct
- β³ π οΈ Maintaining the catalogue
- Watchtower
-
Tickets
- β³ π Rota copy and paste β Developer Deep Dive
- β³ β Checklists & SOPs
- β³ βοΈ Mandatory fields
- β³ π·οΈ Ticket categories
- β³ π₯ Assigning tickets to a team, and escalation
- β³ π’ One board across every company
- β³ Mailbox Authentication
- β³ π€ Email send log
- β³ π Attachment size limits and large emails
- β³ Basic IMAP mailboxes
- β³ Email rendering & images
- β³ SLA Management
- β³ WhatsApp channel
-
β³
βοΈ Telegram channel - β³ β CSAT company scope and filters β Developer Guide
- β³ π₯ Microsoft Teams channel
- β³ π¨οΈ Mattermost channel
- β³ π¬ Web chat channel
- β³ π£ Slack channel
- β³ π Linking tickets
- β³ β Record previews
- β³ π Ticket notes: internal or shared
- β³ ποΈ Canned responses
- β³ βοΈ Limiting replies to particular senders
- β³ π¨ Telling the analyst a ticket is theirs
- β³ βοΈ Email signatures
- β³ π The public web address
- β³ π’ Ticket numbering
- β³ π Raising a ticket for someone else
- β³ π Merging tickets
- β³ π Confidential tickets
- β³ π₯ Portal managers
- β³ π Who has seen a ticket
- β³ π Reading long tickets
- β³ β Splitting tickets
- β³ β Selecting several tickets
- β³ ποΈ The folder pane
- β³ π½ Just my tickets, or no closed ones
- β³ π οΈ Snoozing tickets β Developer Guide
- β³ π₯ Collision detection
- β³ β±οΈ Time tracking
- β³ π Scheduled work in your own calendar
- Problem Management
- Tasks
- π Projects
-
Assets
- β³ π’ Moving an asset between companies
- β³ π Shared asset locations
- β³ π§βπΌ Assigning assets to analysts
- β³ π Warranty and lease alerts
- β³ π Leases
- β³ π Saved table views
- β³ π¨οΈ Recording anything, and importing it
- β³ π·οΈ QR asset labels
- β³ π Who holds what, and handover documents
- β³ π₯οΈ The inventory agent (PowerShell)
- β³ ποΈ Proxmox VE servers
- β³ βοΈ VMware Cloud Director servers
- β³ π Linking equipment to tickets
- β³ βοΈ Follow-up tasks on a ticket
- Knowledge
- Change Management
- Calendar
- Morning Checks
- Reporting
- Software
-
Forms
- β³ π¨ The form designer β Developer Guide
- β³ π Layout & the grid β Developer Guide
- β³ ποΈ Collections β grouping submissions
- β³ π Submissions as PDFs
- β³ β‘ What happens next β a form's own actions
- β³ π οΈ Sections & conditional logic β Developer Guide
- β³ π οΈ Lookup fields β Developer Guide
- β³ π‘οΈ Catalogue request approvals
- People
- Domains
- ποΈ Files
- Contracts
- Service Status
- π Notifications
- π¨ War Room
- Self-Service Portal
- LMS
- Process Mapper
- CMDB
- Network Mapper
- Workflows
- Issue trackers (Jira, Azure DevOps)
- System
-
Overview
- β³ π Progress tracker
- β³ Concepts & vocabulary
- β³ Email routing & mailboxes
- β³ Settings: global vs per-company
- β³ Users & self-service
- β³ Staff cross-company access
- β³ π’ One board across every company
- β³ Worked examples
- β³ Pitfalls & gotchas
- β³ Scope: what it's for
- β³ π οΈ Developer Guide (make a module multi-company)
- β³ ποΈ Case study: CMDB (a linked graph)
- β³ π§ͺ Test harness (prove it's isolated)
- What this is
-
π Bugs resolved
- β³ π Projects: adding a phase did nothing on Save
- β³ π Leavers could still sign in
- β³ πΌοΈ Logo and courses broke on Apache with PHP-FPM
- β³ π’ Chat tickets ignored your ticket numbering
- β³ π Dates shown as a dash, or in server time
- β³ π Assets β Users showed people from other companies
- β³ π Restricted analysts could read other modules' data
- β³ πΌοΈ Replies with a picture in the thread failed to send
- β³ π Reply attachments never reached the customer
- β³ π οΈ Outbound email attachments β Developer Guide
- β³ π A global SSO provider was missing from the portal
- β³ π Behind a proxy, the SSO redirect said http
- β³ βοΈ The portal tagline moved when you saved it
- β³ π¨ The portal settings screen forgot what you saved
- β³ π‘οΈ The approvals inbox said "Error" and nothing else
- β³ π A table's answers were missing from the PDF
- β³ β A single-select column let you tick every option
- β³ π The portal ignored a form's field widths
- β³ π The tasks board stopped taking clicks
- β³ ποΈ #121 The index list is out of date after upgrading
- β³ π #133 The calendar subscription was empty
- β³ π #131 Tasks always reopened on the board
- β³ π₯ #129 Every page returned HTTP 500 after upgrading
- β³ π³ #127 A PHP warning above the System page
- β³ π #126 Notes stamped with the server's clock
- β³ π Storing every date in UTC
- β³ πͺ The portal was down for everyone signed in
- β³ βοΈ #120 Workflow notes could never be written
- β³ βοΈ #123 Three errors when running Database Verification
- β³ π #122 The description box was a stub in the corner
- β³ π£ Demo data deleted real accounts
- β³ π #117 Sign-in redirected to the wrong address
- β³ π¨ #108 The priority dot was invisible
- β³ β±οΈ #116 Time logged from the right-click menu
- β³ π #114 API keys refused by our own guard
- β³ ποΈ #110 Assigning a task told nobody
- β³ πͺ #107 Signed out while still working
- β³ π #103 "Share with Requester" reached nobody
- β³ π #102 Search found nothing for hyphens
- β³ πͺ #101 Source code editor opened behind
- β³ βοΈ #88 Subtasks could not be ticked off
- β³ π» #84 Asset deep link selected nothing
- β³ π« #79 A new ticket arrived with no status
- β³ π§ #79 A ticket from email did not say so
- β³ π #78 Bell opened to nothing
- β³ π¬ #77 Mail only collected from Inbox
- β³ π #74 The default password could not be changed
- β³ π¦ #70 Renaming an impact level
- β³ π€ #67 App-only mailboxes could not send
- β³ π #45 Verify only ever worked for Microsoft
- β³ π #45 IMAP reported as not authenticated
- β³ βοΈ An email template stopped escaping itself
- β³ π The portal dashboard showed the wrong time
- β³ π’ The folder said 99 and the list showed 96