@consilioweb/payload-support 0.15.0 → 1.0.0

package/src/endpoints/invite-collaborator.ts

@@ -4,9 +4,16 @@ import { handleAuthError, AuthError } from '../utils/auth'
 import { escapeHtml, emailWrapper, emailButton, emailParagraph } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
 import { randomBytes } from 'crypto'
+import { RateLimiter } from '../utils/rateLimiter'
+import { dbFindByID, dbFind, dbCreate, dbUpdate, dbCount } from '../utils/db'
 
 const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
 
+// Anti-abuse limits: an invite can create a placeholder account AND send an
+// email, so cap both the volume per user and the collaborators per ticket.
+const MAX_COLLABORATORS_PER_TICKET = 20
+const inviteLimiter = new RateLimiter(60 * 60 * 1000, 10)
+
 /**
  * POST /api/support/tickets/:id/invite
  *
@@ -52,12 +59,11 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs): Endpoi
 
         const payload = req.payload
 
-        const ticket = await payload.findByID({
-          collection: slugs.tickets as any,
+        const ticket = await dbFindByID(payload, slugs.tickets, {
           id: ticketId,
           depth: 1,
           overrideAccess: true,
-        }) as any
+        })
         if (!ticket) return Response.json({ error: 'Ticket introuvable' }, { status: 404 })
 
         const isAdmin = req.user.collection === slugs.users
@@ -68,6 +74,21 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs): Endpoi
           return Response.json({ error: 'Forbidden' }, { status: 403 })
         }
 
+        // Anti-abuse: cap invite volume per user (in-memory, fail-closed).
+        if (inviteLimiter.check(String(req.user.id))) {
+          return Response.json({ error: 'Trop d\'invitations. Réessayez plus tard.' }, { status: 429 })
+        }
+
+        // Cap collaborators per ticket to prevent mass placeholder-account creation.
+        const collabCount = await dbCount(payload, 'ticket-collaborators', { where: { ticket: { equals: ticketId } }, overrideAccess: true })
+          .catch(() => ({ totalDocs: 0 }))
+        if (collabCount.totalDocs >= MAX_COLLABORATORS_PER_TICKET) {
+          return Response.json(
+            { error: `Limite de ${MAX_COLLABORATORS_PER_TICKET} collaborateurs atteinte sur ce ticket` },
+            { status: 429 },
+          )
+        }
+
         // Prevent inviting the primary owner (no-op)
         const ownerEmail =
           typeof ticket.client === 'object' ? (ticket.client?.email as string | undefined) : undefined
@@ -77,8 +98,7 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs): Endpoi
 
         // Find-or-create the invited support-client
         let inviteeId: number | string | null = null
-        const existing = await payload.find({
-          collection: slugs.supportClients as any,
+        const existing = await dbFind(payload, slugs.supportClients, {
           where: { email: { equals: email } },
           limit: 1,
           depth: 0,
@@ -90,8 +110,7 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs): Endpoi
           // Create a placeholder client; password is random — the invitee will reset
           // via the forgotPassword flow triggered by the SupportClients afterChange hook.
           const tempPassword = randomBytes(16).toString('hex')
-          const created = await payload.create({
-            collection: slugs.supportClients as any,
+          const created = await dbCreate(payload, slugs.supportClients, {
             data: {
               email,
               firstName: 'Invité',
@@ -111,8 +130,7 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs): Endpoi
         }
 
         // Upsert ticket-collaborator row (one per (ticket, client))
-        const dupe = await payload.find({
-          collection: 'ticket-collaborators' as any,
+        const dupe = await dbFind(payload, 'ticket-collaborators', {
           where: {
             and: [
               { ticket: { equals: ticketId } },
@@ -127,15 +145,13 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs): Endpoi
         const invitationToken = randomBytes(24).toString('hex')
 
         if (dupe.docs.length > 0) {
-          await payload.update({
-            collection: 'ticket-collaborators' as any,
+          await dbUpdate(payload, 'ticket-collaborators', {
             id: (dupe.docs[0] as any).id,
             data: { role, invitationToken },
             overrideAccess: true,
           })
         } else {
-          await payload.create({
-            collection: 'ticket-collaborators' as any,
+          await dbCreate(payload, 'ticket-collaborators', {
             data: {
               ticket: ticketId,
               client: inviteeId,
@@ -187,8 +203,7 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs): Endpoi
 
         // Best-effort email log
         try {
-          await payload.create({
-            collection: slugs.emailLogs as any,
+          await dbCreate(payload, slugs.emailLogs, {
             data: {
               status: 'success',
               action: 'invite',

package/src/endpoints/invoice.ts

@@ -0,0 +1,127 @@
+import type { Endpoint, Where } from 'payload'
+import type { CollectionSlugs } from '../utils/slugs'
+import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFind } from '../utils/db'
+import { escapeHtml } from '../utils/emailTemplate'
+import { generateInvoicePdf, type InvoiceLine } from '../utils/invoicePdf'
+
+/**
+ * GET /api/support/billing/invoice?from=YYYY-MM-DD&to=YYYY-MM-DD&projectId=...&format=html|pdf
+ *
+ * Admin-only. Renders an invoice for the billable tickets active in the period.
+ * `format=pdf` returns a real binary PDF (pdfkit); otherwise a self-contained,
+ * print-ready HTML document. Defaults to HTML.
+ */
+export function createInvoiceEndpoint(slugs: CollectionSlugs): Endpoint {
+  return {
+    path: '/support/billing/invoice',
+    method: 'get',
+    handler: async (req) => {
+      try {
+        requireAdmin(req, slugs)
+        const payload = req.payload
+        const url = new URL(req.url!)
+        const from = url.searchParams.get('from')
+        const to = url.searchParams.get('to')
+        const projectId = url.searchParams.get('projectId')
+        const format = url.searchParams.get('format') === 'pdf' ? 'pdf' : 'html'
+        if (!from || !to) {
+          return Response.json({ error: 'Paramètres from et to requis.' }, { status: 400 })
+        }
+
+        const toExclusive = new Date(to)
+        toExclusive.setDate(toExclusive.getDate() + 1)
+        const toIso = toExclusive.toISOString()
+
+        const where: Where = {
+          and: [
+            { billable: { equals: true } },
+            ...(projectId ? [{ project: { equals: Number(projectId) } } as Where] : []),
+            {
+              or: [
+                { and: [{ updatedAt: { greater_than_equal: from } }, { updatedAt: { less_than: toIso } }] },
+                { and: [{ createdAt: { greater_than_equal: from } }, { createdAt: { less_than: toIso } }] },
+                { and: [{ resolvedAt: { greater_than_equal: from } }, { resolvedAt: { less_than: toIso } }] },
+              ],
+            },
+          ],
+        }
+
+        const tickets: Array<Record<string, unknown>> = []
+        let page = 1
+        let hasMore = true
+        while (hasMore && page <= 50) {
+          const batch = await dbFind(payload, slugs.tickets, {
+            where, limit: 500, page, depth: 2, overrideAccess: true,
+            select: { ticketNumber: true, subject: true, billedAmount: true, totalTimeMinutes: true, project: true, client: true },
+          })
+          tickets.push(...(batch.docs as Array<Record<string, unknown>>))
+          hasMore = batch.hasNextPage ?? false
+          page++
+        }
+
+        // Shared structured lines (used by both HTML and PDF renderers).
+        let totalAmount = 0
+        let totalMinutes = 0
+        const lines: InvoiceLine[] = tickets.map((t) => {
+          const amount = typeof t.billedAmount === 'number' ? t.billedAmount : 0
+          const minutes = typeof t.totalTimeMinutes === 'number' ? t.totalTimeMinutes : 0
+          totalAmount += amount
+          totalMinutes += minutes
+          const client = typeof t.client === 'object' && t.client ? (t.client as { company?: string }).company || '' : ''
+          return { ticketNumber: String(t.ticketNumber || ''), subject: String(t.subject || ''), client, minutes, amount }
+        })
+
+        if (format === 'pdf') {
+          const pdf = await generateInvoicePdf({ from, to, projectId, lines, totalMinutes, totalAmount })
+          return new Response(new Uint8Array(pdf), {
+            status: 200,
+            headers: {
+              'Content-Type': 'application/pdf',
+              'Content-Disposition': `inline; filename="invoice-${from}_${to}.pdf"`,
+            },
+          })
+        }
+
+        const fmtAmount = (n: number) => `${n.toFixed(2)} €`
+        const fmtTime = (min: number) => `${Math.floor(min / 60)}h${String(min % 60).padStart(2, '0')}`
+        const rows = lines.map((l) => `<tr>
+            <td>${escapeHtml(l.ticketNumber)}</td>
+            <td>${escapeHtml(l.subject)}</td>
+            <td>${escapeHtml(l.client)}</td>
+            <td style="text-align:right;">${fmtTime(l.minutes)}</td>
+            <td style="text-align:right;">${fmtAmount(l.amount)}</td>
+          </tr>`).join('')
+
+        const html = `<!doctype html>
+<html lang="fr"><head><meta charset="utf-8"><title>Facture ${escapeHtml(from)} → ${escapeHtml(to)}</title>
+<style>
+  body { font-family: system-ui, -apple-system, sans-serif; color: #1e293b; max-width: 820px; margin: 32px auto; padding: 0 24px; }
+  h1 { font-size: 22px; margin: 0 0 4px; }
+  .period { color: #64748b; margin-bottom: 24px; }
+  table { width: 100%; border-collapse: collapse; font-size: 14px; }
+  th, td { padding: 8px 10px; border-bottom: 1px solid #e2e8f0; text-align: left; }
+  th { background: #f8fafc; font-size: 12px; text-transform: uppercase; letter-spacing: .04em; color: #475569; }
+  tfoot td { font-weight: 700; border-top: 2px solid #0f172a; border-bottom: none; }
+  @media print { body { margin: 0; } }
+</style></head>
+<body>
+  <h1>Facture / Pré-facture</h1>
+  <div class="period">Période : ${escapeHtml(from)} → ${escapeHtml(to)}${projectId ? ` · Projet #${escapeHtml(projectId)}` : ''}</div>
+  <table>
+    <thead><tr><th>Ticket</th><th>Sujet</th><th>Client</th><th style="text-align:right;">Temps</th><th style="text-align:right;">Montant</th></tr></thead>
+    <tbody>${rows || '<tr><td colspan="5" style="color:#94a3b8;">Aucun ticket facturable sur la période.</td></tr>'}</tbody>
+    <tfoot><tr><td colspan="3">Total (${lines.length} ticket${lines.length > 1 ? 's' : ''})</td><td style="text-align:right;">${fmtTime(totalMinutes)}</td><td style="text-align:right;">${fmtAmount(totalAmount)}</td></tr></tfoot>
+  </table>
+</body></html>`
+
+        return new Response(html, { status: 200, headers: { 'Content-Type': 'text/html; charset=utf-8' } })
+      } catch (error) {
+        const authResponse = handleAuthError(error)
+        if (authResponse) return authResponse
+        console.error('[invoice] Error:', error)
+        return Response.json({ error: 'Erreur interne' }, { status: 500 })
+      }
+    },
+  }
+}

package/src/endpoints/kb-search.ts

@@ -1,5 +1,6 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
+import { dbFind } from '../utils/db'
 
 // Combining diacritics range used to strip accents after NFD normalization.
 const DIACRITICS = /[̀-ͯ]/g
@@ -107,8 +108,7 @@ export function createKbSearchEndpoint(slugs: CollectionSlugs): Endpoint {
         // Always include the raw query for short single-word matches.
         orClauses.push({ title: { contains: q } })
 
-        const res = await payload.find({
-          collection: slugs.knowledgeBase as any,
+        const res = await dbFind(payload, slugs.knowledgeBase, {
           where: {
             and: [
               { published: { equals: true } },

package/src/endpoints/login.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { RateLimiter } from '../utils/rateLimiter'
+import { dbCreate } from '../utils/db'
 
 const loginLimiter = new RateLimiter(15 * 60_000, 10) // 10 per 15 min
 
@@ -13,6 +14,9 @@ export function createLoginEndpoint(slugs: CollectionSlugs): Endpoint {
     path: '/support/login',
     method: 'post',
     handler: async (req) => {
+      // NOTE: x-forwarded-for is spoofable unless this app sits strictly behind a
+      // trusted proxy that rewrites it. This IP rate-limit is a SECONDARY defense;
+      // the primary brute-force control is Payload's account lock (maxLoginAttempts).
       const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || req.headers.get('x-real-ip') || 'unknown'
 
       if (loginLimiter.check(ip)) {
@@ -43,8 +47,7 @@ export function createLoginEndpoint(slugs: CollectionSlugs): Endpoint {
         })
 
         // Log successful login (fire-and-forget)
-        payload.create({
-          collection: slugs.authLogs as any,
+        dbCreate(payload, slugs.authLogs, {
           data: { email, success: true, action: 'login', ipAddress: ip, userAgent },
           overrideAccess: true,
         }).catch(() => {})
@@ -71,13 +74,18 @@ export function createLoginEndpoint(slugs: CollectionSlugs): Endpoint {
       } catch (err: unknown) {
         const errorMessage = err instanceof Error ? err.message : 'Erreur inconnue'
 
+        // 2FA gate: password was correct but a fresh 2FA verification is required.
+        // No session/cookie is issued (Payload rolled it back on the throw).
+        if (errorMessage.includes('2FA_REQUIRED')) {
+          return Response.json({ requires2FA: true }, { status: 200 })
+        }
+
         let errorReason = 'Identifiants incorrects'
         if (errorMessage.includes('locked') || errorMessage.includes('verrouillé') || errorMessage.includes('Too many')) {
           errorReason = 'Compte verrouillé (trop de tentatives)'
         }
 
-        payload.create({
-          collection: slugs.authLogs as any,
+        dbCreate(payload, slugs.authLogs, {
           data: { email, success: false, action: 'login', errorReason, ipAddress: ip, userAgent },
           overrideAccess: true,
         }).catch(() => {})

package/src/endpoints/merge-clients.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFind, dbFindByID, dbUpdate, dbDelete } from '../utils/db'
 
 /**
  * POST /api/support/merge-clients
@@ -23,8 +24,8 @@ export function createMergeClientsEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         const [source, target] = await Promise.all([
-          payload.findByID({ collection: slugs.supportClients as any, id: sourceId, depth: 0, overrideAccess: true }),
-          payload.findByID({ collection: slugs.supportClients as any, id: targetId, depth: 0, overrideAccess: true }),
+          dbFindByID(payload, slugs.supportClients, { id: sourceId, depth: 0, overrideAccess: true }),
+          dbFindByID(payload, slugs.supportClients, { id: targetId, depth: 0, overrideAccess: true }),
         ]) as [any, any]
 
         if (!source || !target) {
@@ -40,73 +41,67 @@ export function createMergeClientsEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         // 1. Transfer tickets
-        const tickets = await payload.find({
-          collection: slugs.tickets as any,
+        const tickets = await dbFind(payload, slugs.tickets, {
           where: { client: { equals: sourceId } },
           limit: 500,
           depth: 0,
           overrideAccess: true,
         })
         for (const ticket of tickets.docs) {
-          await payload.update({ collection: slugs.tickets as any, id: ticket.id, data: { client: targetId }, overrideAccess: true })
+          await dbUpdate(payload, slugs.tickets, { id: ticket.id, data: { client: targetId }, overrideAccess: true })
           results.tickets++
         }
 
         // 2. Transfer ticket messages (authorClient)
-        const messages = await payload.find({
-          collection: slugs.ticketMessages as any,
+        const messages = await dbFind(payload, slugs.ticketMessages, {
           where: { authorClient: { equals: sourceId } },
           limit: 1000,
           depth: 0,
           overrideAccess: true,
         })
         for (const msg of messages.docs) {
-          await payload.update({ collection: slugs.ticketMessages as any, id: msg.id, data: { authorClient: targetId }, overrideAccess: true })
+          await dbUpdate(payload, slugs.ticketMessages, { id: msg.id, data: { authorClient: targetId }, overrideAccess: true })
           results.ticketMessages++
         }
 
         // 3. Transfer chat messages
-        const chats = await payload.find({
-          collection: slugs.chatMessages as any,
+        const chats = await dbFind(payload, slugs.chatMessages, {
           where: { client: { equals: sourceId } },
           limit: 1000,
           depth: 0,
           overrideAccess: true,
         })
         for (const chat of chats.docs) {
-          await payload.update({ collection: slugs.chatMessages as any, id: chat.id, data: { client: targetId }, overrideAccess: true })
+          await dbUpdate(payload, slugs.chatMessages, { id: chat.id, data: { client: targetId }, overrideAccess: true })
           results.chatMessages++
         }
 
         // 4. Transfer pending emails
-        const pendingEmails = await payload.find({
-          collection: slugs.pendingEmails as any,
+        const pendingEmails = await dbFind(payload, slugs.pendingEmails, {
           where: { client: { equals: sourceId } },
           limit: 500,
           depth: 0,
           overrideAccess: true,
         })
         for (const pe of pendingEmails.docs) {
-          await payload.update({ collection: slugs.pendingEmails as any, id: pe.id, data: { client: targetId }, overrideAccess: true })
+          await dbUpdate(payload, slugs.pendingEmails, { id: pe.id, data: { client: targetId }, overrideAccess: true })
           results.pendingEmails++
         }
 
         // 5. Transfer satisfaction surveys
-        const surveys = await payload.find({
-          collection: slugs.satisfactionSurveys as any,
+        const surveys = await dbFind(payload, slugs.satisfactionSurveys, {
           where: { client: { equals: sourceId } },
           limit: 500,
           depth: 0,
           overrideAccess: true,
         })
         for (const survey of surveys.docs) {
-          await payload.update({ collection: slugs.satisfactionSurveys as any, id: survey.id, data: { client: targetId }, overrideAccess: true })
+          await dbUpdate(payload, slugs.satisfactionSurveys, { id: survey.id, data: { client: targetId }, overrideAccess: true })
           results.satisfactionSurveys++
         }
 
         // 6. Delete source client
-        await payload.delete({
-          collection: slugs.supportClients as any,
+        await dbDelete(payload, slugs.supportClients, {
           id: sourceId,
           overrideAccess: true,
         })

package/src/endpoints/merge-tickets.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFind, dbFindByID, dbCreate, dbUpdate, dbDelete } from '../utils/db'
 
 /**
  * POST /api/support/merge-tickets
@@ -27,8 +28,8 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         const [source, target] = await Promise.all([
-          payload.findByID({ collection: slugs.tickets as any, id: sourceTicketId, depth: 0, overrideAccess: true }),
-          payload.findByID({ collection: slugs.tickets as any, id: targetTicketId, depth: 0, overrideAccess: true }),
+          dbFindByID(payload, slugs.tickets, { id: sourceTicketId, depth: 0, overrideAccess: true }),
+          dbFindByID(payload, slugs.tickets, { id: targetTicketId, depth: 0, overrideAccess: true }),
         ])
 
         if (!source) return Response.json({ error: 'Ticket source introuvable' }, { status: 404 })
@@ -42,8 +43,7 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         // Move all messages from source to target
-        const messages = await payload.find({
-          collection: slugs.ticketMessages as any,
+        const messages = await dbFind(payload, slugs.ticketMessages, {
           where: { ticket: { equals: sourceTicketId } },
           limit: 500,
           depth: 0,
@@ -51,8 +51,7 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
         })
 
         for (const msg of messages.docs) {
-          await payload.update({
-            collection: slugs.ticketMessages as any,
+          await dbUpdate(payload, slugs.ticketMessages, {
             id: msg.id,
             data: { ticket: targetTicketId },
             overrideAccess: true,
@@ -60,8 +59,7 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         // Move time entries
-        const timeEntries = await payload.find({
-          collection: slugs.timeEntries as any,
+        const timeEntries = await dbFind(payload, slugs.timeEntries, {
           where: { ticket: { equals: sourceTicketId } },
           limit: 500,
           depth: 0,
@@ -69,8 +67,7 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
         })
 
         for (const entry of timeEntries.docs) {
-          await payload.update({
-            collection: slugs.timeEntries as any,
+          await dbUpdate(payload, slugs.timeEntries, {
             id: entry.id,
             data: { ticket: targetTicketId },
             overrideAccess: true,
@@ -79,8 +76,7 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
 
         // Add internal note to target
         const sourceNumber = (source as any).ticketNumber || `#${sourceTicketId}`
-        await payload.create({
-          collection: slugs.ticketMessages as any,
+        await dbCreate(payload, slugs.ticketMessages, {
           data: {
             ticket: targetTicketId,
             body: `Messages fusionnés depuis ${sourceNumber} (${messages.totalDocs} messages, ${timeEntries.totalDocs} entrées de temps)`,
@@ -92,15 +88,13 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
         })
 
         // Delete source ticket
-        await payload.delete({
-          collection: slugs.tickets as any,
+        await dbDelete(payload, slugs.tickets, {
           id: sourceTicketId,
           overrideAccess: true,
         })
 
         // Recalculate totalTimeMinutes on target
-        const allTimeEntries = await payload.find({
-          collection: slugs.timeEntries as any,
+        const allTimeEntries = await dbFind(payload, slugs.timeEntries, {
           where: { ticket: { equals: targetTicketId } },
           limit: 500,
           depth: 0,
@@ -112,8 +106,7 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
           0,
         )
 
-        await payload.update({
-          collection: slugs.tickets as any,
+        await dbUpdate(payload, slugs.tickets, {
           id: targetTicketId,
           data: { totalTimeMinutes: totalMinutes },
           overrideAccess: true,