@consilioweb/payload-support 0.15.0 → 1.0.0

package/src/endpoints/oauth-google.ts

@@ -1,6 +1,8 @@
 import type { Endpoint } from 'payload'
+import { getFieldsToSign, jwtSign } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import crypto from 'crypto'
+import { dbFind, dbUpdate, dbCreate, dbFindByID } from '../utils/db'
 
 /**
  * POST /api/support/oauth/google
@@ -89,22 +91,43 @@ export function createOAuthGoogleEndpoint(slugs: CollectionSlugs, options?: OAut
             return Response.json({ error: 'no_email' }, { status: 400 })
           }
 
+          // Only trust Google-verified emails — an unverified email matching an
+          // existing client would otherwise allow account takeover.
+          if (profile.verified_email !== true) {
+            return Response.json({ error: 'email_not_verified' }, { status: 403 })
+          }
+
           const payload = req.payload
 
-          // Find existing support client by email
-          const existing = await payload.find({
-            collection: slugs.supportClients as any,
-            where: { email: { equals: profile.email } },
+          // Resolve the account by the stable Google subject id first, then by the
+          // (verified) email — linking the googleId so subsequent logins are stable.
+          const byGoogle = await dbFind(payload, slugs.supportClients, {
+            where: { googleId: { equals: profile.id } },
             limit: 1,
             depth: 0,
             overrideAccess: true,
           })
+          let clientDoc = byGoogle.docs[0] as { id: number | string; email: string } | undefined
 
-          let clientDoc = existing.docs[0]
+          if (!clientDoc) {
+            const byEmail = await dbFind(payload, slugs.supportClients, {
+              where: { email: { equals: profile.email } },
+              limit: 1,
+              depth: 0,
+              overrideAccess: true,
+            })
+            clientDoc = byEmail.docs[0] as { id: number | string; email: string } | undefined
+            if (clientDoc && profile.id) {
+              await dbUpdate(payload, slugs.supportClients, {
+                id: clientDoc.id,
+                data: { googleId: profile.id },
+                overrideAccess: true,
+              })
+            }
+          }
 
-          // Auto-create account if needed
+          // Auto-create account if needed (domain restriction enforced)
           if (!clientDoc) {
-            // Domain restriction check for new accounts
             const allowedDomains = options?.allowedEmailDomains
             if (allowedDomains && allowedDomains.length > 0) {
               const emailDomain = profile.email.split('@')[1]?.toLowerCase()
@@ -122,50 +145,74 @@ export function createOAuthGoogleEndpoint(slugs: CollectionSlugs, options?: OAut
             const fullName = profile.name || profile.email.split('@')[0]
             const nameParts = fullName.split(' ')
 
-            clientDoc = await payload.create({
-              collection: slugs.supportClients as any,
+            clientDoc = await dbCreate(payload, slugs.supportClients, {
               data: {
                 email: profile.email,
                 firstName: nameParts[0] || fullName,
                 lastName: nameParts.slice(1).join(' ') || '-',
                 company: fullName,
+                googleId: profile.id,
                 password: autoPassword,
               },
               overrideAccess: true,
-            })
+            }) as { id: number | string; email: string }
           }
 
-          // Generate temp password, login, then rotate
-          const tempPassword = crypto.randomBytes(48).toString('base64url')
-          await payload.update({
-            collection: slugs.supportClients as any,
-            id: clientDoc.id,
-            data: { password: tempPassword },
-            overrideAccess: true,
-          })
-
-          const loginResult = await payload.login({
-            collection: slugs.supportClients as any,
-            data: { email: profile.email, password: tempPassword },
-          })
-
-          // Immediately rotate password
-          const postLoginPassword = crypto.randomBytes(48).toString('base64url')
-          await payload.update({
-            collection: slugs.supportClients as any,
-            id: clientDoc.id,
-            data: { password: postLoginPassword },
-            overrideAccess: true,
-          })
-
-          if (!loginResult.token) {
-            return Response.json({ error: 'login_failed' }, { status: 400 })
+          // Mint a Payload session WITHOUT touching the user's password.
+          // Uses Payload's own jwtSign/getFieldsToSign so the token format matches
+          // exactly, and replicates addSessionToUser for the sessions array.
+          const secret = process.env.PAYLOAD_SECRET
+          if (!secret) {
+            return Response.json({ error: 'server_misconfigured' }, { status: 500 })
+          }
+          const collectionConfig = (payload as any).collections[slugs.supportClients].config
+          const tokenExpiration: number = collectionConfig.auth?.tokenExpiration ?? 7200
+
+          let sid: string | undefined
+          if (collectionConfig.auth?.useSessions) {
+            sid = crypto.randomUUID()
+            const now = new Date()
+            const expiresAt = new Date(now.getTime() + tokenExpiration * 1000)
+            const fresh = (await dbFindByID(payload, slugs.supportClients, {
+              id: clientDoc.id,
+              depth: 0,
+              overrideAccess: true,
+              showHiddenFields: true,
+            })) as { sessions?: Array<{ id: string; createdAt: string; expiresAt: string }> }
+            const kept = Array.isArray(fresh?.sessions)
+              ? fresh.sessions.filter((s) => new Date(s.expiresAt) > now)
+              : []
+            await payload.db.updateOne({
+              collection: slugs.supportClients,
+              id: clientDoc.id,
+              data: {
+                sessions: [
+                  ...kept,
+                  { id: sid, createdAt: now.toISOString(), expiresAt: expiresAt.toISOString() },
+                ],
+              },
+              returning: false,
+            } as any)
           }
 
-          return Response.json({
-            token: loginResult.token,
-            user: loginResult.user,
-            exp: loginResult.exp,
+          const fieldsToSign = getFieldsToSign({
+            collectionConfig,
+            email: clientDoc.email,
+            sid,
+            user: { ...clientDoc, collection: slugs.supportClients },
+          } as any)
+          const { token, exp } = await jwtSign({ fieldsToSign, secret, tokenExpiration })
+
+          const headers = new Headers({ 'Content-Type': 'application/json' })
+          const cookieSecure = process.env.NODE_ENV === 'production'
+          headers.append(
+            'Set-Cookie',
+            `payload-token=${token}; HttpOnly; ${cookieSecure ? 'Secure; ' : ''}SameSite=Lax; Path=/; Max-Age=${tokenExpiration}`,
+          )
+
+          return new Response(JSON.stringify({ token, user: clientDoc, exp }), {
+            status: 200,
+            headers,
           })
         }
 

package/src/endpoints/pending-emails-process.ts

@@ -3,6 +3,7 @@ import type { CollectionSlugs } from '../utils/slugs'
 import { escapeHtml } from '../utils/emailTemplate'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { readSupportSettings } from '../utils/readSettings'
+import { dbFindByID, dbCreate, dbUpdate } from '../utils/db'
 
 /**
  * POST /api/support/pending-emails/:id/process
@@ -30,12 +31,11 @@ export function createPendingEmailsProcessEndpoint(slugs: CollectionSlugs): Endp
           return Response.json({ error: 'Invalid action' }, { status: 400 })
         }
 
-        const pendingEmail = await payload.findByID({
-          collection: slugs.pendingEmails as any,
+        const pendingEmail = await dbFindByID(payload, slugs.pendingEmails, {
           id: Number(id),
           depth: 1,
           overrideAccess: true,
-        }) as any
+        })
 
         if (!pendingEmail) {
           return Response.json({ error: 'Pending email not found' }, { status: 404 })
@@ -49,15 +49,13 @@ export function createPendingEmailsProcessEndpoint(slugs: CollectionSlugs): Endp
         let clientDoc = typeof pendingEmail.client === 'object' ? pendingEmail.client : null
 
         if (overrideClientId && overrideClientId !== clientDoc?.id) {
-          clientDoc = await payload.findByID({
-            collection: slugs.supportClients as any,
+          clientDoc = await dbFindByID(payload, slugs.supportClients, {
             id: overrideClientId,
             depth: 0,
             overrideAccess: true,
           })
 
-          await payload.update({
-            collection: slugs.pendingEmails as any,
+          await dbUpdate(payload, slugs.pendingEmails, {
             id: Number(id),
             data: { client: overrideClientId },
             overrideAccess: true,
@@ -78,8 +76,7 @@ export function createPendingEmailsProcessEndpoint(slugs: CollectionSlugs): Endp
         })) || []
 
         if (action === 'ignore') {
-          await payload.update({
-            collection: slugs.pendingEmails as any,
+          await dbUpdate(payload, slugs.pendingEmails, {
             id: Number(id),
             data: {
               status: 'ignored',
@@ -92,8 +89,7 @@ export function createPendingEmailsProcessEndpoint(slugs: CollectionSlugs): Endp
         }
 
         if (action === 'create_ticket') {
-          const newTicket = await payload.create({
-            collection: slugs.tickets as any,
+          const newTicket = await dbCreate(payload, slugs.tickets, {
             data: {
               subject: pendingEmail.subject,
               client: clientId!,
@@ -103,10 +99,9 @@ export function createPendingEmailsProcessEndpoint(slugs: CollectionSlugs): Endp
               source: 'email',
             },
             overrideAccess: true,
-          }) as any
+          })
 
-          await payload.create({
-            collection: slugs.ticketMessages as any,
+          await dbCreate(payload, slugs.ticketMessages, {
             data: {
               ticket: newTicket.id,
               body: pendingEmail.body,
@@ -136,8 +131,7 @@ export function createPendingEmailsProcessEndpoint(slugs: CollectionSlugs): Endp
             console.error('[pending-email-process] Failed to send notification:', err)
           }
 
-          await payload.update({
-            collection: slugs.pendingEmails as any,
+          await dbUpdate(payload, slugs.pendingEmails, {
             id: Number(id),
             data: {
               status: 'processed',
@@ -160,19 +154,17 @@ export function createPendingEmailsProcessEndpoint(slugs: CollectionSlugs): Endp
             return Response.json({ error: 'ticketId is required for add_to_ticket' }, { status: 400 })
           }
 
-          const targetTicket = await payload.findByID({
-            collection: slugs.tickets as any,
+          const targetTicket = await dbFindByID(payload, slugs.tickets, {
             id: ticketId,
             depth: 0,
             overrideAccess: true,
-          }) as any
+          })
 
           if (!targetTicket) {
             return Response.json({ error: 'Target ticket not found' }, { status: 404 })
           }
 
-          await payload.create({
-            collection: slugs.ticketMessages as any,
+          await dbCreate(payload, slugs.ticketMessages, {
             data: {
               ticket: ticketId,
               body: pendingEmail.body,
@@ -185,16 +177,14 @@ export function createPendingEmailsProcessEndpoint(slugs: CollectionSlugs): Endp
           })
 
           if (targetTicket.status === 'resolved') {
-            await payload.update({
-              collection: slugs.tickets as any,
+            await dbUpdate(payload, slugs.tickets, {
               id: ticketId,
               data: { status: 'open' },
               overrideAccess: true,
             })
           }
 
-          await payload.update({
-            collection: slugs.pendingEmails as any,
+          await dbUpdate(payload, slugs.pendingEmails, {
             id: Number(id),
             data: {
               status: 'processed',

package/src/endpoints/process-digests.ts

@@ -0,0 +1,93 @@
+import type { Endpoint } from 'payload'
+import type { CollectionSlugs } from '../utils/slugs'
+import { dbFind, dbFindByID, dbDelete } from '../utils/db'
+import { emailWrapper, emailParagraph, escapeHtml } from '../utils/emailTemplate'
+import { readSupportSettings } from '../utils/readSettings'
+
+/**
+ * POST /api/support/process-digests   body: { frequency?: 'daily' | 'weekly' }
+ *
+ * Drains the notification queue for clients whose `notificationFrequency` matches
+ * the requested cadence, sending each one a single recap email. Run a daily job
+ * with `frequency=daily` and a weekly job with `frequency=weekly`.
+ * Protected by the x-cron-secret header.
+ */
+export function createProcessDigestsEndpoint(slugs: CollectionSlugs): Endpoint {
+  return {
+    path: '/support/process-digests',
+    method: 'post',
+    handler: async (req) => {
+      const secret = req.headers.get('x-cron-secret')
+      if (!process.env.CRON_SECRET || secret !== process.env.CRON_SECRET) {
+        return Response.json({ error: 'Non autorisé' }, { status: 401 })
+      }
+
+      try {
+        const payload = req.payload
+        let body: { frequency?: string } = {}
+        try { body = (await req.json!()) as { frequency?: string } } catch { /* no body */ }
+        const frequency = body.frequency === 'weekly' ? 'weekly' : 'daily'
+
+        const settings = await readSupportSettings(payload)
+        const replyTo = settings.email.replyToAddress || process.env.SUPPORT_EMAIL || ''
+        const baseUrl = process.env.NEXT_PUBLIC_SERVER_URL || ''
+
+        // Gather all queued items, grouped by client.
+        type Item = { id: number | string; title?: string; message?: string }
+        const itemsByClient = new Map<string, Item[]>()
+        let page = 1
+        let hasMore = true
+        while (hasMore && page <= 50) {
+          const batch = await dbFind(payload, slugs.notificationQueue, { limit: 200, page, depth: 0, overrideAccess: true, sort: 'createdAt' })
+          for (const it of batch.docs) {
+            const raw = it as { client?: number | string | { id?: number | string } } & Item
+            const clientId = typeof raw.client === 'object' ? raw.client?.id : raw.client
+            if (clientId === undefined || clientId === null) continue
+            const key = String(clientId)
+            if (!itemsByClient.has(key)) itemsByClient.set(key, [])
+            itemsByClient.get(key)!.push({ id: raw.id, title: raw.title, message: raw.message })
+          }
+          hasMore = batch.hasNextPage ?? false
+          page++
+        }
+
+        const results = { clients: 0, items: 0, errors: 0 }
+        for (const [clientId, items] of itemsByClient) {
+          try {
+            const client = await dbFindByID(payload, slugs.supportClients, { id: clientId, depth: 0, overrideAccess: true })
+            // Only deliver for clients whose cadence matches this run.
+            if (!client || client.notificationFrequency !== frequency) continue
+
+            if (client.email) {
+              const rows = items
+                .map((i) => `<tr><td style="padding:8px 0;font-size:14px;color:#1e293b;border-bottom:1px solid #f1f5f9;"><strong>${escapeHtml(i.title || '')}</strong><br/><span style="color:#64748b;font-size:13px;">${escapeHtml(i.message || '')}</span></td></tr>`)
+                .join('')
+              const html = emailWrapper('Recapitulatif de vos tickets', [
+                emailParagraph(`Bonjour <strong>${escapeHtml(client.firstName || '')}</strong>,`),
+                emailParagraph(`Voici le recapitulatif de l'activite sur vos tickets (${items.length} notification${items.length > 1 ? 's' : ''}) :`),
+                `<table cellpadding="0" cellspacing="0" border="0" width="100%">${rows}</table>`,
+                ...(baseUrl ? [emailParagraph(`<a href="${baseUrl}/support/dashboard">Acceder a votre espace support</a>`)] : []),
+              ].join(''), { kind: 'system' })
+              await payload.sendEmail({ to: client.email, ...(replyTo ? { replyTo } : {}), subject: `Recapitulatif support (${items.length})`, html })
+            }
+
+            // Drain the queue regardless of email success (avoid resend loops).
+            for (const i of items) {
+              try { await dbDelete(payload, slugs.notificationQueue, { id: i.id, overrideAccess: true }) } catch { /* ignore */ }
+            }
+            results.clients++
+            results.items += items.length
+          } catch (err) {
+            console.error('[process-digests] client error:', err)
+            results.errors++
+          }
+        }
+
+        return Response.json({ ok: true, frequency, ...results })
+      } catch (err) {
+        console.error('[process-digests] Error:', err)
+        return Response.json({ error: 'Erreur interne' }, { status: 500 })
+      }
+    },
+  }
+}

package/src/endpoints/process-scheduled.ts

@@ -3,6 +3,7 @@ import type { CollectionSlugs } from '../utils/slugs'
 import { escapeHtml } from '../utils/emailTemplate'
 import { fireWebhooks } from '../utils/fireWebhooks'
 import { readSupportSettings } from '../utils/readSettings'
+import { dbFind, dbFindByID, dbUpdate } from '../utils/db'
 
 /**
  * POST /api/support/process-scheduled
@@ -29,8 +30,7 @@ export function createProcessScheduledEndpoint(slugs: CollectionSlugs): Endpoint
         const results = { processed: 0, errors: 0 }
 
         // Find all messages where scheduledAt is in the past and scheduledSent is not true
-        const scheduled = await payload.find({
-          collection: slugs.ticketMessages as any,
+        const scheduled = await dbFind(payload, slugs.ticketMessages, {
           where: {
             and: [
               { scheduledAt: { less_than_equal: now.toISOString() } },
@@ -53,8 +53,7 @@ export function createProcessScheduledEndpoint(slugs: CollectionSlugs): Endpoint
             const ticketId = typeof msg.ticket === 'object' ? msg.ticket.id : msg.ticket
 
             // Fetch the ticket with client data
-            const ticket = await payload.findByID({
-              collection: slugs.tickets as any,
+            const ticket = await dbFindByID(payload, slugs.tickets, {
               id: ticketId,
               depth: 1,
               overrideAccess: true,
@@ -84,8 +83,7 @@ export function createProcessScheduledEndpoint(slugs: CollectionSlugs): Endpoint
               })
 
               // Record email delivery info
-              await payload.update({
-                collection: slugs.ticketMessages as any,
+              await dbUpdate(payload, slugs.ticketMessages, {
                 id: msg.id,
                 data: {
                   scheduledSent: true,
@@ -96,8 +94,7 @@ export function createProcessScheduledEndpoint(slugs: CollectionSlugs): Endpoint
               })
             } else {
               // No email needed (internal note or no client email), just mark as sent
-              await payload.update({
-                collection: slugs.ticketMessages as any,
+              await dbUpdate(payload, slugs.ticketMessages, {
                 id: msg.id,
                 data: { scheduledSent: true },
                 overrideAccess: true,
@@ -106,8 +103,7 @@ export function createProcessScheduledEndpoint(slugs: CollectionSlugs): Endpoint
 
             // Update ticket status if this is an admin reply
             if (msg.authorType === 'admin' && !msg.isInternal) {
-              await payload.update({
-                collection: slugs.tickets as any,
+              await dbUpdate(payload, slugs.tickets, {
                 id: ticketId,
                 data: { status: 'waiting_client' },
                 overrideAccess: true,

package/src/endpoints/process-snooze.ts

@@ -0,0 +1,78 @@
+import type { Endpoint } from 'payload'
+import type { CollectionSlugs } from '../utils/slugs'
+import { dbFind, dbUpdate, dbCreate } from '../utils/db'
+
+/**
+ * POST /api/support/process-snooze
+ *
+ * Wakes up tickets whose snooze deadline has passed: clears `snoozeUntil` so the
+ * ticket stops being filtered out of the inbox, and records a `snooze_expired`
+ * activity entry. Tickets also resurface automatically once `snoozeUntil` is in
+ * the past (the inbox query hides only future snoozes) — this cron just cleans up
+ * the stale field and leaves an audit trail.
+ *
+ * Protected by the `x-cron-secret` header (same pattern as process-scheduled).
+ */
+export function createProcessSnoozeEndpoint(slugs: CollectionSlugs): Endpoint {
+  return {
+    path: '/support/process-snooze',
+    method: 'post',
+    handler: async (req) => {
+      const secret = req.headers.get('x-cron-secret')
+      const expectedSecret = process.env.CRON_SECRET
+      if (!expectedSecret || secret !== expectedSecret) {
+        return Response.json({ error: 'Non autorisé' }, { status: 401 })
+      }
+
+      try {
+        const payload = req.payload
+        const nowIso = new Date().toISOString()
+        const results = { processed: 0, errors: 0 }
+
+        const due = await dbFind(payload, slugs.tickets, {
+          where: {
+            and: [
+              { snoozeUntil: { exists: true } },
+              { snoozeUntil: { less_than_equal: nowIso } },
+            ],
+          },
+          limit: 500,
+          depth: 0,
+          overrideAccess: true,
+          select: { id: true, ticketNumber: true },
+        })
+
+        for (const ticket of due.docs) {
+          try {
+            await dbUpdate(payload, slugs.tickets, {
+              id: (ticket as { id: number | string }).id,
+              data: { snoozeUntil: null },
+              overrideAccess: true,
+            })
+            // Audit trail — best-effort (activity-log may be unavailable).
+            try {
+              await dbCreate(payload, slugs.ticketActivityLog, {
+                data: {
+                  ticket: (ticket as { id: number | string }).id,
+                  action: 'snooze_expired',
+                  detail: 'Snooze échu — ticket réactivé',
+                  actorType: 'system',
+                },
+                overrideAccess: true,
+              })
+            } catch { /* activity log optional */ }
+            results.processed++
+          } catch (err) {
+            console.error('[support] Failed to wake snoozed ticket:', err)
+            results.errors++
+          }
+        }
+
+        return Response.json({ ok: true, ...results })
+      } catch (err) {
+        console.error('[process-snooze] Error:', err)
+        return Response.json({ error: 'Erreur interne' }, { status: 500 })
+      }
+    },
+  }
+}

package/src/endpoints/purge-logs.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbDelete } from '../utils/db'
 
 /**
  * DELETE /api/support/purge-logs?collection=email-logs&days=30
@@ -32,8 +33,7 @@ export function createPurgeLogsEndpoint(slugs: CollectionSlugs): Endpoint {
 
         const cutoff = days > 0 ? new Date(Date.now() - days * 86400000).toISOString() : null
 
-        const result = await payload.delete({
-          collection: allowedCollections[collection] as any,
+        const result = await dbDelete(payload, allowedCollections[collection], {
           where: cutoff
             ? { createdAt: { less_than: cutoff } }
             : { id: { exists: true } },

package/src/endpoints/resend-notification.ts

@@ -4,6 +4,7 @@ import { requireAdmin, handleAuthError } from '../utils/auth'
 import { RateLimiter } from '../utils/rateLimiter'
 import { escapeHtml } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
+import { dbFindByID } from '../utils/db'
 
 const resendLimiter = new RateLimiter(60 * 60 * 1000, 10) // 10 per hour
 
@@ -40,8 +41,7 @@ export function createResendNotificationEndpoint(slugs: CollectionSlugs): Endpoi
           return Response.json({ error: 'messageId requis' }, { status: 400 })
         }
 
-        const message = await payload.findByID({
-          collection: slugs.ticketMessages as any,
+        const message = await dbFindByID(payload, slugs.ticketMessages, {
           id: messageId,
           depth: 0,
           overrideAccess: true,
@@ -52,8 +52,7 @@ export function createResendNotificationEndpoint(slugs: CollectionSlugs): Endpoi
         }
 
         const ticketId = typeof message.ticket === 'object' ? message.ticket.id : message.ticket
-        const ticket = await payload.findByID({
-          collection: slugs.tickets as any,
+        const ticket = await dbFindByID(payload, slugs.tickets, {
           id: ticketId,
           depth: 1,
           overrideAccess: true,

package/src/endpoints/round-robin-config.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFind } from '../utils/db'
 
 const PREF_KEY = 'support-round-robin'
 
@@ -17,8 +18,7 @@ export function createRoundRobinConfigGetEndpoint(slugs: CollectionSlugs): Endpo
 
         requireAdmin(req, slugs)
 
-        const prefs = await payload.find({
-          collection: 'payload-preferences' as any,
+        const prefs = await dbFind(payload, 'payload-preferences', {
           where: { key: { equals: PREF_KEY } },
           limit: 1,
           depth: 0,
@@ -55,8 +55,7 @@ export function createRoundRobinConfigPostEndpoint(slugs: CollectionSlugs): Endp
 
         const { enabled } = (await req.json!()) as { enabled: boolean }
 
-        const existing = await payload.find({
-          collection: 'payload-preferences' as any,
+        const existing = await dbFind(payload, 'payload-preferences', {
           where: { key: { equals: PREF_KEY } },
           limit: 1,
           depth: 0,