@consilioweb/payload-support 0.15.0 → 1.0.0

package/src/__tests__/sla.test.ts

@@ -0,0 +1,258 @@
+import { describe, it, expect } from 'vitest'
+import { computeSlaState, formatSlaRemaining } from '../views/shared/sla'
+
+// ---------------------------------------------------------------------------
+// computeSlaState
+// ---------------------------------------------------------------------------
+
+describe('computeSlaState — no SLA data', () => {
+  it('returns state "none" when no due date is set', () => {
+    const result = computeSlaState({})
+    expect(result.state).toBe('none')
+    expect(result.remainingMs).toBeNull()
+    expect(result.due).toBeNull()
+  })
+
+  it('returns state "none" when dueRaw is null', () => {
+    const result = computeSlaState({ slaFirstResponseDue: null })
+    expect(result.state).toBe('none')
+  })
+
+  it('returns state "none" when dueRaw is an invalid date string', () => {
+    const result = computeSlaState({ slaFirstResponseDue: 'not-a-date' })
+    expect(result.state).toBe('none')
+  })
+})
+
+describe('computeSlaState — first response SLA (no firstResponseAt)', () => {
+  const future2h = new Date(Date.now() + 2 * 3_600_000).toISOString()
+  const future30m = new Date(Date.now() + 30 * 60_000).toISOString()
+  const past = new Date(Date.now() - 60_000).toISOString()
+
+  it('returns "ok" when deadline is more than 1 hour away', () => {
+    const result = computeSlaState({ slaFirstResponseDue: future2h })
+    expect(result.state).toBe('ok')
+    expect(result.remainingMs).toBeGreaterThan(3_600_000)
+  })
+
+  it('returns "warn" when deadline is less than 1 hour away', () => {
+    const result = computeSlaState({ slaFirstResponseDue: future30m })
+    expect(result.state).toBe('warn')
+    expect(result.remainingMs).toBeGreaterThan(0)
+    expect(result.remainingMs).toBeLessThan(3_600_000)
+  })
+
+  it('returns "breach" when deadline is in the past', () => {
+    const result = computeSlaState({ slaFirstResponseDue: past })
+    expect(result.state).toBe('breach')
+    expect(result.remainingMs).toBeLessThan(0)
+  })
+
+  it('returns "breach" when slaFirstResponseBreached flag is set (even with future due)', () => {
+    const result = computeSlaState({
+      slaFirstResponseDue: future2h,
+      slaFirstResponseBreached: true,
+    })
+    expect(result.state).toBe('breach')
+  })
+
+  it('exposes the due ISO string in result', () => {
+    const result = computeSlaState({ slaFirstResponseDue: future2h })
+    expect(result.due).toBe(future2h)
+  })
+})
+
+describe('computeSlaState — resolution SLA (firstResponseAt present)', () => {
+  const firstResponseAt = new Date(Date.now() - 60_000).toISOString()
+  const future2h = new Date(Date.now() + 2 * 3_600_000).toISOString()
+  const past = new Date(Date.now() - 60_000).toISOString()
+
+  it('uses resolution SLA when firstResponseAt is set', () => {
+    const result = computeSlaState({
+      firstResponseAt,
+      slaFirstResponseDue: past, // would be breach if used
+      slaResolutionDue: future2h, // ok
+    })
+    // Should use resolution SLA → ok
+    expect(result.state).toBe('ok')
+    expect(result.due).toBe(future2h)
+  })
+
+  it('returns "breach" when resolution deadline is passed', () => {
+    const result = computeSlaState({
+      firstResponseAt,
+      slaResolutionDue: past,
+    })
+    expect(result.state).toBe('breach')
+  })
+
+  it('returns "breach" when slaResolutionBreached flag is set', () => {
+    const result = computeSlaState({
+      firstResponseAt,
+      slaResolutionDue: future2h,
+      slaResolutionBreached: true,
+    })
+    expect(result.state).toBe('breach')
+  })
+})
+
+describe('computeSlaState — pinned "now" parameter', () => {
+  it('uses the provided "now" date for comparison', () => {
+    const due = '2024-01-15T10:00:00.000Z'
+    // now before due → ok
+    const before = new Date('2024-01-15T08:00:00.000Z')
+    expect(computeSlaState({ slaFirstResponseDue: due }, before).state).toBe('ok')
+    // now after due → breach
+    const after = new Date('2024-01-15T12:00:00.000Z')
+    expect(computeSlaState({ slaFirstResponseDue: due }, after).state).toBe('breach')
+    // now 30 min before due → warn
+    const soon = new Date('2024-01-15T09:35:00.000Z')
+    expect(computeSlaState({ slaFirstResponseDue: due }, soon).state).toBe('warn')
+  })
+})
+
+// ---------------------------------------------------------------------------
+// formatSlaRemaining
+// ---------------------------------------------------------------------------
+
+describe('formatSlaRemaining', () => {
+  it('returns "—" for null', () => {
+    expect(formatSlaRemaining(null)).toBe('—')
+  })
+
+  it('formats less-than-1-hour remaining as minutes (positive)', () => {
+    const thirtyMin = 30 * 60_000
+    expect(formatSlaRemaining(thirtyMin)).toBe('30m')
+  })
+
+  it('formats 0 remaining as "0m"', () => {
+    expect(formatSlaRemaining(0)).toBe('0m')
+  })
+
+  it('formats negative < 1 hour as −Xm', () => {
+    const minus15min = -(15 * 60_000)
+    expect(formatSlaRemaining(minus15min)).toBe('−15m')
+  })
+
+  it('formats exactly 1 hour as "1h"', () => {
+    const oneHour = 3_600_000
+    expect(formatSlaRemaining(oneHour)).toBe('1h')
+  })
+
+  it('formats 90 minutes as "1h 30"', () => {
+    const ninetyMin = 90 * 60_000
+    expect(formatSlaRemaining(ninetyMin)).toBe('1h 30')
+  })
+
+  it('formats negative hours as −Xh', () => {
+    const minus2h = -(2 * 3_600_000)
+    expect(formatSlaRemaining(minus2h)).toBe('−2h')
+  })
+
+  it('formats 24h+ as days (Xj)', () => {
+    const twoDays = 48 * 3_600_000
+    expect(formatSlaRemaining(twoDays)).toBe('2j')
+  })
+
+  it('formats negative 24h+ as −Xj', () => {
+    const minusThreeDays = -(3 * 24 * 3_600_000)
+    expect(formatSlaRemaining(minusThreeDays)).toBe('−3j')
+  })
+
+  it('formats whole hours without trailing "00" minutes', () => {
+    const twoHoursExact = 2 * 3_600_000
+    const result = formatSlaRemaining(twoHoursExact)
+    expect(result).toBe('2h')
+  })
+})
+
+// ---------------------------------------------------------------------------
+// calculateBusinessHoursDeadline (imported from hooks/checkSLA)
+// ---------------------------------------------------------------------------
+
+import { calculateBusinessHoursDeadline } from '../hooks/checkSLA'
+
+describe('calculateBusinessHoursDeadline', () => {
+  // Use UTC dates — the function uses local Date methods without TZ conversion.
+  // We pin times to Tuesday 2024-01-09 so all boundary math is predictable.
+
+  it('adds 60 minutes within the same business day', () => {
+    // Tuesday 2024-01-09 at 10:00 local
+    const start = new Date(2024, 0, 9, 10, 0, 0) // month is 0-indexed
+    const result = calculateBusinessHoursDeadline(start, 60)
+    expect(result.getHours()).toBe(11)
+    expect(result.getMinutes()).toBe(0)
+    expect(result.getDate()).toBe(9)
+  })
+
+  it('carries over minutes past end-of-day to the next business day', () => {
+    // Tuesday at 17:00, add 120 minutes (only 60 remain today: 17:00→18:00)
+    // Remaining 60 minutes spills into Wednesday morning: 9:00→10:00
+    const start = new Date(2024, 0, 9, 17, 0, 0)
+    const result = calculateBusinessHoursDeadline(start, 120)
+    expect(result.getDate()).toBe(10) // Wednesday
+    expect(result.getHours()).toBe(10)
+    expect(result.getMinutes()).toBe(0)
+  })
+
+  it('skips Saturday and Sunday', () => {
+    // Friday 2024-01-12 at 17:00, add 120 minutes → skips Sat/Sun → Monday 10:00
+    const start = new Date(2024, 0, 12, 17, 0, 0) // Friday
+    const result = calculateBusinessHoursDeadline(start, 120)
+    // 60 min remaining Friday (17→18), then 60 min on Monday (9→10)
+    expect(result.getDay()).toBe(1) // Monday
+    expect(result.getHours()).toBe(10)
+  })
+
+  it('moves a Saturday start to Monday 9:00 before counting', () => {
+    // Saturday at 10:00, add 60 minutes → Monday 10:00
+    const start = new Date(2024, 0, 13, 10, 0, 0) // Saturday
+    const result = calculateBusinessHoursDeadline(start, 60)
+    expect(result.getDay()).toBe(1) // Monday
+    expect(result.getHours()).toBe(10)
+  })
+
+  it('moves a Sunday start to Monday 9:00 before counting', () => {
+    // Sunday at 15:00, add 30 minutes → Monday 9:30
+    const start = new Date(2024, 0, 14, 15, 0, 0) // Sunday
+    const result = calculateBusinessHoursDeadline(start, 30)
+    expect(result.getDay()).toBe(1) // Monday
+    expect(result.getHours()).toBe(9)
+    expect(result.getMinutes()).toBe(30)
+  })
+
+  it('moves a before-hours start to 9:00 before counting', () => {
+    // Tuesday at 7:00 (before 9:00), add 30 minutes → 9:30 same day
+    const start = new Date(2024, 0, 9, 7, 0, 0)
+    const result = calculateBusinessHoursDeadline(start, 30)
+    expect(result.getDate()).toBe(9)
+    expect(result.getHours()).toBe(9)
+    expect(result.getMinutes()).toBe(30)
+  })
+
+  it('moves an after-hours start to next business day 9:00', () => {
+    // Tuesday at 19:00 (after 18:00), add 60 minutes → Wednesday 10:00
+    const start = new Date(2024, 0, 9, 19, 0, 0)
+    const result = calculateBusinessHoursDeadline(start, 60)
+    expect(result.getDate()).toBe(10) // Wednesday
+    expect(result.getHours()).toBe(10)
+  })
+
+  it('handles 0 minutes (deadline = start clamped to business hours)', () => {
+    const start = new Date(2024, 0, 9, 10, 30, 0) // Tuesday at 10:30
+    const result = calculateBusinessHoursDeadline(start, 0)
+    // Start is within business hours → no movement
+    expect(result.getDate()).toBe(9)
+    expect(result.getHours()).toBe(10)
+    expect(result.getMinutes()).toBe(30)
+  })
+
+  it('handles a full business day (540 min = 9 hours) spanning exactly one day', () => {
+    // Tuesday at 9:00, add 540 min (exactly one business day) → Tuesday 18:00
+    const start = new Date(2024, 0, 9, 9, 0, 0)
+    const result = calculateBusinessHoursDeadline(start, 540)
+    expect(result.getDate()).toBe(9)
+    expect(result.getHours()).toBe(18)
+    expect(result.getMinutes()).toBe(0)
+  })
+})

package/src/collections/AutomationRules.ts

@@ -0,0 +1,66 @@
+import type { CollectionConfig } from 'payload'
+import type { CollectionSlugs } from '../utils/slugs'
+
+const CONDITION_FIELDS = ['status', 'priority', 'category', 'source', 'subject'] as const
+const ACTION_TYPES = [
+  { label: 'Définir le statut', value: 'set_status' },
+  { label: 'Définir la priorité', value: 'set_priority' },
+  { label: 'Définir la catégorie', value: 'set_category' },
+  { label: 'Assigner à (id agent)', value: 'assign' },
+  { label: 'Ajouter un tag', value: 'add_tag' },
+]
+
+/**
+ * Visual automation rules (Zendesk-style triggers): when an event fires, if the
+ * conditions match the ticket, the actions are applied. Evaluated by the
+ * `createApplyAutomationRules` hook on the Tickets collection.
+ */
+export function createAutomationRulesCollection(slugs: CollectionSlugs): CollectionConfig {
+  return {
+    slug: slugs.automationRules,
+    labels: { singular: 'Règle d\'automatisation', plural: 'Règles d\'automatisation' },
+    admin: { useAsTitle: 'name', group: 'Support', defaultColumns: ['name', 'event', 'enabled', 'order'] },
+    access: {
+      read: ({ req }) => req.user?.collection === slugs.users,
+      create: ({ req }) => req.user?.collection === slugs.users,
+      update: ({ req }) => req.user?.collection === slugs.users,
+      delete: ({ req }) => req.user?.collection === slugs.users,
+    },
+    fields: [
+      { name: 'name', type: 'text', required: true, label: 'Nom' },
+      { name: 'enabled', type: 'checkbox', defaultValue: true, label: 'Active', index: true },
+      {
+        name: 'event', type: 'select', defaultValue: 'ticket_created', index: true, label: 'Déclencheur',
+        options: [
+          { label: 'Ticket créé', value: 'ticket_created' },
+          { label: 'Ticket mis à jour', value: 'ticket_updated' },
+          { label: 'Changement de statut', value: 'ticket_status_changed' },
+        ],
+      },
+      {
+        name: 'matchType', type: 'select', defaultValue: 'all', label: 'Correspondance',
+        options: [{ label: 'Toutes les conditions (ET)', value: 'all' }, { label: 'Au moins une (OU)', value: 'any' }],
+      },
+      { name: 'order', type: 'number', defaultValue: 0, label: 'Ordre d\'évaluation' },
+      {
+        name: 'conditions', type: 'array', label: 'Conditions',
+        fields: [
+          { name: 'field', type: 'select', required: true, options: CONDITION_FIELDS.map((v) => ({ label: v, value: v })) },
+          {
+            name: 'operator', type: 'select', defaultValue: 'equals', required: true,
+            options: [{ label: '= égal', value: 'equals' }, { label: '≠ différent', value: 'not_equals' }, { label: 'contient', value: 'contains' }],
+          },
+          { name: 'value', type: 'text', required: true },
+        ],
+      },
+      {
+        name: 'actions', type: 'array', label: 'Actions',
+        fields: [
+          { name: 'type', type: 'select', required: true, options: ACTION_TYPES },
+          { name: 'value', type: 'text', required: true },
+        ],
+      },
+    ],
+    timestamps: true,
+  }
+}

package/src/collections/NotificationQueue.ts

@@ -0,0 +1,30 @@
+import type { CollectionConfig } from 'payload'
+import type { CollectionSlugs } from '../utils/slugs'
+
+/**
+ * Pending client notifications, queued instead of sent immediately when the
+ * client's `notificationFrequency` is `daily` or `weekly`. The `process-digests`
+ * cron drains this per client and sends a single recap email.
+ */
+export function createNotificationQueueCollection(slugs: CollectionSlugs): CollectionConfig {
+  return {
+    slug: slugs.notificationQueue,
+    labels: { singular: 'Notification en file', plural: 'Notifications en file' },
+    admin: { hidden: true, group: 'Support', defaultColumns: ['client', 'type', 'title', 'createdAt'] },
+    access: {
+      // Internal: written/drained only via overrideAccess (hooks + cron).
+      create: () => false,
+      update: () => false,
+      read: ({ req }) => req.user?.collection === slugs.users,
+      delete: ({ req }) => req.user?.collection === slugs.users,
+    },
+    fields: [
+      { name: 'client', type: 'relationship', relationTo: slugs.supportClients, required: true, index: true, label: 'Client' },
+      { name: 'type', type: 'text', label: 'Type' },
+      { name: 'title', type: 'text', label: 'Titre' },
+      { name: 'message', type: 'textarea', label: 'Message' },
+      { name: 'ticket', type: 'relationship', relationTo: slugs.tickets, label: 'Ticket' },
+    ],
+    timestamps: true,
+  }
+}

package/src/collections/SatisfactionSurveys.ts

@@ -60,12 +60,21 @@ export function createSatisfactionSurveysCollection(slugs: CollectionSlugs): Col
       {
         name: 'rating',
         type: 'number',
-        required: true,
         min: 1,
         max: 5,
         label: 'Note (1-5)',
         admin: {
-          description: '1 = Très insatisfait, 5 = Très satisfait',
+          description: '1 = Très insatisfait, 5 = Très satisfait (CSAT)',
+        },
+      },
+      {
+        name: 'nps',
+        type: 'number',
+        min: 0,
+        max: 10,
+        label: 'NPS (0-10)',
+        admin: {
+          description: '« Recommanderiez-vous ? » — promoteur 9-10, passif 7-8, détracteur 0-6',
         },
       },
       {

package/src/collections/SupportClients.ts

@@ -1,4 +1,5 @@
-import type { CollectionConfig, CollectionAfterChangeHook } from 'payload'
+import type { CollectionConfig, CollectionAfterChangeHook, CollectionBeforeLoginHook } from 'payload'
+import { APIError } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { escapeHtml, emailWrapper, emailButton, emailParagraph } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
@@ -55,6 +56,40 @@ function createSendInvitationOnCreate(slugs: CollectionSlugs): CollectionAfterCh
   }
 }
 
+// ─── 2FA enforcement ─────────────────────────────────────
+
+// A successful /support/2fa "verify" stamps `twoFactorVerifiedAt`. Login is only
+// allowed within this window, after which the marker is consumed (single-use).
+const TWO_FA_WINDOW_MS = 5 * 60 * 1000
+
+/**
+ * Enforce 2FA at the auth layer for EVERY login path (custom endpoint AND the
+ * native /api/<collection>/login), closing the bypass where a token was issued
+ * before any 2FA check. Payload verifies the password BEFORE beforeLogin, and
+ * throwing here rolls back the session it just created — so no token is issued.
+ */
+function createEnforce2FA(slugs: CollectionSlugs): CollectionBeforeLoginHook {
+  return async ({ req, user }) => {
+    if (!(user as { twoFactorEnabled?: boolean })?.twoFactorEnabled) return user
+    const raw = (user as { twoFactorVerifiedAt?: string | null }).twoFactorVerifiedAt
+    const verifiedAt = raw ? new Date(raw).getTime() : 0
+    if (!(verifiedAt > Date.now() - TWO_FA_WINDOW_MS)) {
+      // Credentials valid, but a fresh 2FA verification is required.
+      throw new APIError('2FA_REQUIRED', 401)
+    }
+    // Single-use: consume the marker so the verified window can't be replayed.
+    await req.payload.update({
+      collection: slugs.supportClients,
+      id: user.id,
+      data: { twoFactorVerifiedAt: null },
+      req,
+      overrideAccess: true,
+    })
+    ;(user as { twoFactorVerifiedAt?: string | null }).twoFactorVerifiedAt = null
+    return user
+  }
+}
+
 // ─── Collection factory ──────────────────────────────────
 
 export function createSupportClientsCollection(slugs: CollectionSlugs): CollectionConfig {
@@ -184,6 +219,10 @@ export function createSupportClientsCollection(slugs: CollectionSlugs): Collecti
         name: 'opportunities',
         type: 'textarea',
         label: 'Opportunites commerciales',
+        access: {
+          // Admin-only: never serialize commercial notes onto the client's own doc.
+          read: ({ req }) => req.user?.collection === slugs.users,
+        },
         admin: {
           description: 'Notes commerciales (visible uniquement par les admins)',
         },
@@ -227,6 +266,19 @@ export function createSupportClientsCollection(slugs: CollectionSlugs): Collecti
         type: 'date',
         admin: { hidden: true },
       },
+      {
+        // Set by /support/2fa "verify"; gates login via the beforeLogin hook.
+        name: 'twoFactorVerifiedAt',
+        type: 'date',
+        admin: { hidden: true },
+      },
+      {
+        // Google OAuth subject id — accounts are linked by this, not email alone.
+        name: 'googleId',
+        type: 'text',
+        index: true,
+        admin: { hidden: true },
+      },
       {
         name: 'notifyOnReply',
         type: 'checkbox',
@@ -293,6 +345,10 @@ export function createSupportClientsCollection(slugs: CollectionSlugs): Collecti
         name: 'notes',
         type: 'textarea',
         label: 'Notes internes',
+        access: {
+          // Admin-only: never serialize internal notes onto the client's own doc.
+          read: ({ req }) => req.user?.collection === slugs.users,
+        },
         admin: {
           description: 'Visible uniquement par les admins',
           position: 'sidebar',
@@ -300,6 +356,7 @@ export function createSupportClientsCollection(slugs: CollectionSlugs): Collecti
       },
     ],
     hooks: {
+      beforeLogin: [createEnforce2FA(slugs)],
       afterChange: [createSendInvitationOnCreate(slugs)],
     },
     access: {

package/src/collections/SupportTeam.ts

@@ -0,0 +1,27 @@
+import type { CollectionConfig } from 'payload'
+import type { CollectionSlugs } from '../utils/slugs'
+
+/**
+ * Support teams / workspaces. Agents belong to teams; tickets can be assigned to
+ * a team. When `SUPPORT_TEAM_SCOPING` is enabled, agents only see the tickets of
+ * their teams (plus team-less tickets) — see the Tickets read access.
+ */
+export function createSupportTeamCollection(slugs: CollectionSlugs): CollectionConfig {
+  return {
+    slug: slugs.supportTeams,
+    labels: { singular: 'Équipe support', plural: 'Équipes support' },
+    admin: { useAsTitle: 'name', group: 'Support', defaultColumns: ['name', 'members'] },
+    access: {
+      read: ({ req }) => req.user?.collection === slugs.users,
+      create: ({ req }) => req.user?.collection === slugs.users,
+      update: ({ req }) => req.user?.collection === slugs.users,
+      delete: ({ req }) => req.user?.collection === slugs.users,
+    },
+    fields: [
+      { name: 'name', type: 'text', required: true, label: 'Nom' },
+      { name: 'description', type: 'textarea', label: 'Description' },
+      { name: 'members', type: 'relationship', relationTo: slugs.users, hasMany: true, index: true, label: 'Membres (agents)' },
+    ],
+    timestamps: true,
+  }
+}

package/src/collections/TicketActivityLog.ts

@@ -1,5 +1,6 @@
-import type { CollectionConfig } from 'payload'
+import type { CollectionConfig, Where } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
+import { resolveAccessibleTicketIds } from '../utils/ticketAccess'
 
 // ─── Collection factory ──────────────────────────────────
 
@@ -21,6 +22,7 @@ export function createTicketActivityLogCollection(slugs: CollectionSlugs): Colle
         type: 'relationship',
         relationTo: slugs.tickets,
         required: true,
+        index: true,
         label: 'Ticket',
       },
       {
@@ -65,11 +67,14 @@ export function createTicketActivityLogCollection(slugs: CollectionSlugs): Colle
     ],
     access: {
       create: () => false, // Created only by hooks via overrideAccess
-      read: ({ req }) => {
+      read: async ({ req }) => {
         if (req.user?.collection === slugs.users) return true
-        // Clients can read activity logs for their own tickets
+        // Clients can read activity logs only for tickets they own/collaborate on.
+        // Constrain by `ticket IN (...)` rather than a nested relationship filter
+        // (security boundary). Empty set → sentinel id (fail closed).
         if (req.user?.collection === slugs.supportClients) {
-          return { 'ticket.client': { equals: req.user.id } }
+          const ids = await resolveAccessibleTicketIds(req.payload, slugs, req.user.id)
+          return { ticket: { in: ids.length > 0 ? ids : [-1] } } as Where
         }
         return false
       },