Read the attachment disk from config, not env (secrets S3)

The three reads were `config('ticketing.storage_disk', env('TICKETING_STORAGE_DISK', 'local'))`,
but this package had no config file at all — so the config() lookup was always
null and env() was the only reader.

Once `config:cache` runs in production, a runtime env() returns NULL. Every
ticket attachment would have silently gone to the 'local' disk, ignoring
whatever the operator had configured — and previously-stored attachments would
404 because show() looked on the wrong disk.

Verified rather than assumed: with TICKETING_STORAGE_DISK=s3proof set,
config() returned 's3proof' both cached and uncached, while env() returned
's3proof' uncached and NULL cached.

Adds config/ticketing.php + mergeConfigFrom so the value is captured at
cache time, and drops the env() fallbacks.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

composer.json

@@ -1,7 +1,7 @@
 {
     "name": "dashboard/ticketing",
     "description": "Help desk ticketing snap-in for the Dashboard platform",
-    "version": "1.0.1",
+    "version": "1.0.2",
     "type": "library",
     "require": {
         "php": "^8.2",

config/ticketing.php

@@ -0,0 +1,15 @@
+<?php
+
+return [
+
+    /*
+     * The filesystem disk ticket attachments are stored on. Read at runtime via
+     * config('ticketing.storage_disk') — NOT env() — so it survives config:cache
+     * in production. Before this file existed the controllers read
+     * env('TICKETING_STORAGE_DISK') directly, which returns null once the config
+     * is cached, silently forcing every attachment onto the 'local' disk and
+     * orphaning anything an operator had pointed elsewhere (secrets spec S3).
+     */
+    'storage_disk' => env('TICKETING_STORAGE_DISK', 'local'),
+
+];

src/Http/Controllers/TicketAttachmentController.php

@@ -49,7 +49,7 @@ class TicketAttachmentController extends Controller
         ]);
 
         $file = $request->file('file');
-        $disk = config('ticketing.storage_disk', env('TICKETING_STORAGE_DISK', 'local'));
+        $disk = config('ticketing.storage_disk', 'local');
         $path = $file->store('ticketing/attachments/' . $ticket->id, $disk);
 
         TicketAttachment::create([
@@ -71,7 +71,7 @@ class TicketAttachmentController extends Controller
             abort(403);
         }
 
-        $disk = config('ticketing.storage_disk', env('TICKETING_STORAGE_DISK', 'local'));
+        $disk = config('ticketing.storage_disk', 'local');
         return Storage::disk($disk)->download($attachment->path, $attachment->filename);
     }
 }

src/Http/Controllers/TicketController.php

@@ -322,7 +322,7 @@ class TicketController extends Controller
         ]);
 
         if ($request->hasFile('attachments')) {
-            $disk = config('ticketing.storage_disk', env('TICKETING_STORAGE_DISK', 'local'));
+            $disk = config('ticketing.storage_disk', 'local');
             foreach ($request->file('attachments') as $file) {
                 if (!$file->isValid()) continue;
                 $path = $file->store('ticketing/attachments/' . $ticket->id, $disk);

src/TicketingServiceProvider.php

@@ -6,7 +6,13 @@ use Illuminate\Support\ServiceProvider;
 
 class TicketingServiceProvider extends ServiceProvider
 {
-    public function register(): void {}
+    public function register(): void
+    {
+        // Merge so config('ticketing.*') resolves even when the host app has not
+        // published a copy — and, crucially, so the value is captured by
+        // config:cache instead of being read from env() at runtime (S3).
+        $this->mergeConfigFrom(__DIR__.'/../config/ticketing.php', 'ticketing');
+    }
 
     public function boot(): void
     {