@consilioweb/payload-support 0.15.0 → 1.0.0

package/src/endpoints/satisfaction.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireClient, handleAuthError } from '../utils/auth'
+import { dbFindByID, dbFind, dbCreate } from '../utils/db'
 
 /**
  * POST /api/support/satisfaction
@@ -17,13 +18,21 @@ export function createSatisfactionEndpoint(slugs: CollectionSlugs): Endpoint {
         requireClient(req, slugs)
 
         const body = await req.json!()
-        const { ticketId, rating, comment } = body
+        const { ticketId, rating, nps, comment } = body
 
-        if (!ticketId || !rating || !Number.isInteger(rating) || rating < 1 || rating > 5) {
-          return Response.json(
-            { error: 'ticketId et rating (entier 1-5) sont requis.' },
-            { status: 400 },
-          )
+        if (!ticketId) {
+          return Response.json({ error: 'ticketId est requis.' }, { status: 400 })
+        }
+        const hasRating = rating !== undefined && rating !== null
+        const hasNps = nps !== undefined && nps !== null
+        if (!hasRating && !hasNps) {
+          return Response.json({ error: 'Un rating (1-5) et/ou un nps (0-10) est requis.' }, { status: 400 })
+        }
+        if (hasRating && (!Number.isInteger(rating) || rating < 1 || rating > 5)) {
+          return Response.json({ error: 'rating doit être un entier 1-5.' }, { status: 400 })
+        }
+        if (hasNps && (!Number.isInteger(nps) || nps < 0 || nps > 10)) {
+          return Response.json({ error: 'nps doit être un entier 0-10.' }, { status: 400 })
         }
 
         if (comment && typeof comment === 'string' && comment.length > 5000) {
@@ -34,13 +43,12 @@ export function createSatisfactionEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         // Verify ticket belongs to client and is resolved
-        const ticket = await payload.findByID({
-          collection: slugs.tickets as any,
+        const ticket = await dbFindByID(payload, slugs.tickets, {
           id: ticketId,
           depth: 0,
           overrideAccess: false,
           user: req.user,
-        }) as any
+        })
 
         if (!ticket) {
           return Response.json({ error: 'Ticket introuvable.' }, { status: 404 })
@@ -54,8 +62,7 @@ export function createSatisfactionEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         // Check if survey already exists
-        const existing = await payload.find({
-          collection: slugs.satisfactionSurveys as any,
+        const existing = await dbFind(payload, slugs.satisfactionSurveys, {
           where: { ticket: { equals: ticketId } },
           limit: 1,
           depth: 0,
@@ -69,13 +76,13 @@ export function createSatisfactionEndpoint(slugs: CollectionSlugs): Endpoint {
           )
         }
 
-        const survey = await payload.create({
-          collection: slugs.satisfactionSurveys as any,
+        const survey = await dbCreate(payload, slugs.satisfactionSurveys, {
           data: {
             source: 'ticket',
             ticket: ticketId,
             client: req.user.id,
-            rating: Math.round(rating),
+            ...(hasRating ? { rating: Math.round(rating) } : {}),
+            ...(hasNps ? { nps: Math.round(nps) } : {}),
             ...(comment ? { comment: comment.trim() } : {}),
           },
           overrideAccess: true,

package/src/endpoints/search.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFind } from '../utils/db'
 
 /**
  * GET /api/support/search?q=term
@@ -24,8 +25,7 @@ export function createSearchEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         const [ticketsRes, clientsRes, messagesRes, articlesRes] = await Promise.all([
-          payload.find({
-            collection: slugs.tickets as any,
+          dbFind(payload, slugs.tickets, {
             where: {
               or: [
                 { ticketNumber: { contains: q } },
@@ -37,8 +37,7 @@ export function createSearchEndpoint(slugs: CollectionSlugs): Endpoint {
             depth: 1,
             overrideAccess: true,
           }),
-          payload.find({
-            collection: slugs.supportClients as any,
+          dbFind(payload, slugs.supportClients, {
             where: {
               or: [
                 { firstName: { contains: q } },
@@ -51,16 +50,14 @@ export function createSearchEndpoint(slugs: CollectionSlugs): Endpoint {
             depth: 0,
             overrideAccess: true,
           }),
-          payload.find({
-            collection: slugs.ticketMessages as any,
+          dbFind(payload, slugs.ticketMessages, {
             where: { body: { contains: q } },
             sort: '-createdAt',
             limit: 5,
             depth: 1,
             overrideAccess: true,
           }),
-          payload.find({
-            collection: slugs.knowledgeBase as any,
+          dbFind(payload, slugs.knowledgeBase, {
             where: { title: { contains: q } },
             limit: 5,
             depth: 0,

package/src/endpoints/seed-kb.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFind, dbCreate } from '../utils/db'
 
 const KB_ARTICLES = [
   {
@@ -95,8 +96,7 @@ export function createSeedKbEndpoint(slugs: CollectionSlugs): Endpoint {
         let skipped = 0
 
         for (const article of KB_ARTICLES) {
-          const existing = await payload.find({
-            collection: slugs.knowledgeBase as any,
+          const existing = await dbFind(payload, slugs.knowledgeBase, {
             where: { slug: { equals: article.slug } },
             limit: 1,
             depth: 0,
@@ -126,8 +126,7 @@ export function createSeedKbEndpoint(slugs: CollectionSlugs): Endpoint {
             },
           }
 
-          await payload.create({
-            collection: slugs.knowledgeBase as any,
+          await dbCreate(payload, slugs.knowledgeBase, {
             data: {
               title: article.title,
               slug: article.slug,

package/src/endpoints/send-reminder.ts

@@ -0,0 +1,186 @@
+import type { Endpoint } from 'payload'
+import type { CollectionSlugs } from '../utils/slugs'
+import { requireAdmin, handleAuthError } from '../utils/auth'
+import { RateLimiter } from '../utils/rateLimiter'
+import { escapeHtml, emailWrapper, emailParagraph, emailButton } from '../utils/emailTemplate'
+import { readSupportSettings } from '../utils/readSettings'
+import { dbFindByID, dbFind, dbCreate, dbUpdate } from '../utils/db'
+
+// Manual reminders are a deliberate admin action, so the cap is generous —
+// it only exists to stop a runaway script, not normal usage.
+const reminderLimiter = new RateLimiter(60 * 60 * 1000, 30) // 30 per hour per admin
+
+const MIN_HOURS = 1
+const MAX_HOURS = 24 * 30 // 30 days
+
+function formatFr(date: Date, withTime: boolean): string {
+  return date.toLocaleString('fr-FR', {
+    day: 'numeric',
+    month: 'long',
+    year: 'numeric',
+    ...(withTime ? { hour: '2-digit', minute: '2-digit' } : {}),
+    timeZone: 'Europe/Paris',
+  })
+}
+
+/**
+ * POST /api/support/send-reminder
+ *
+ * Manually nudge a client whose ticket is awaiting their reply: sends a generic
+ * "your ticket will be closed if you don't respond" email, drops an internal
+ * note in the thread, and arms the ticket for automatic closure.
+ *
+ * Arming = set `status: waiting_client`, `autoCloseRemindedAt: now` (so the
+ * day-based cron reminder skips it) and `autoCloseScheduledAt: now + hours`.
+ * The existing `/api/support/auto-close` cron then resolves the ticket once the
+ * deadline passes — UNLESS the client replies first, which flips the status back
+ * to `open` and clears `autoCloseScheduledAt` (see TicketMessages auto-update hook).
+ *
+ * Admin-only, rate-limited.
+ */
+export function createSendReminderEndpoint(slugs: CollectionSlugs): Endpoint {
+  return {
+    path: '/support/send-reminder',
+    method: 'post',
+    handler: async (req) => {
+      try {
+        const payload = req.payload
+
+        requireAdmin(req, slugs)
+
+        if (reminderLimiter.check(String(req.user.id))) {
+          return Response.json(
+            { error: 'Trop de relances. Réessayez dans une heure.' },
+            { status: 429 },
+          )
+        }
+
+        let body: { ticketId?: string | number; hours?: number }
+        try {
+          body = await req.json!()
+        } catch {
+          return Response.json({ error: 'Invalid JSON body' }, { status: 400 })
+        }
+
+        const { ticketId } = body
+        if (!ticketId) {
+          return Response.json({ error: 'ticketId requis' }, { status: 400 })
+        }
+
+        const rawHours = Number(body.hours)
+        const hours = Number.isFinite(rawHours)
+          ? Math.min(MAX_HOURS, Math.max(MIN_HOURS, Math.round(rawHours)))
+          : 24
+
+        const ticket = await dbFindByID(payload, slugs.tickets, {
+          id: ticketId,
+          depth: 1,
+          overrideAccess: true,
+        })
+
+        if (!ticket) {
+          return Response.json({ error: 'Ticket introuvable' }, { status: 404 })
+        }
+
+        const client = typeof ticket.client === 'object' ? ticket.client : null
+        if (!client?.email) {
+          return Response.json({ error: 'Client sans email' }, { status: 400 })
+        }
+
+        const now = new Date()
+        const deadline = new Date(now.getTime() + hours * 60 * 60 * 1000)
+
+        const settings = await readSupportSettings(payload)
+        const ticketNumber = ticket.ticketNumber || 'TK-????'
+        const subject = ticket.subject || 'Support'
+        const baseUrl = process.env.NEXT_PUBLIC_SERVER_URL || ''
+        const portalUrl = `${baseUrl}/support/tickets/${ticketId}`
+        const replyTo = settings.email.replyToAddress || process.env.SUPPORT_REPLY_TO || ''
+
+        // "En attente depuis le …" — anchored on our last public reply (that's
+        // what the client owes a response to), falling back to the first
+        // response then to ticket creation.
+        let waitingSince: string | undefined = ticket.firstResponseAt || ticket.createdAt
+        try {
+          const lastAdminMsg = await dbFind(payload, slugs.ticketMessages, {
+            where: {
+              and: [
+                { ticket: { equals: ticketId } },
+                { authorType: { equals: 'admin' } },
+                { isInternal: { equals: false } },
+              ],
+            },
+            sort: '-createdAt',
+            limit: 1,
+            depth: 0,
+            overrideAccess: true,
+          })
+          if (lastAdminMsg.docs.length > 0 && lastAdminMsg.docs[0].createdAt) {
+            waitingSince = lastAdminMsg.docs[0].createdAt as string
+          }
+        } catch { /* fallback already set */ }
+
+        const sinceLabel = waitingSince ? formatFr(new Date(waitingSince), false) : null
+        const deadlineLabel = formatFr(deadline, true)
+
+        await payload.sendEmail({
+          to: client.email,
+          ...(replyTo ? { replyTo } : {}),
+          subject: `Rappel : [${ticketNumber}] ${subject} — votre réponse est attendue`,
+          html: emailWrapper(`Votre ticket attend votre réponse`, [
+            emailParagraph(`Bonjour <strong>${escapeHtml(client.firstName || '')}</strong>,`),
+            emailParagraph(
+              `Votre ticket <strong>${escapeHtml(ticketNumber)}</strong> — <em>${escapeHtml(String(subject))}</em> — est en attente de votre réponse${sinceLabel ? ` depuis le ${escapeHtml(sinceLabel)}` : ''}.`,
+            ),
+            emailParagraph(
+              `<strong>Sans retour de votre part, ce ticket sera automatiquement clôturé le ${escapeHtml(deadlineLabel)}.</strong>`,
+            ),
+            emailParagraph(
+              `Si vous avez encore besoin d'assistance, il vous suffit de répondre à ce message — votre réponse maintiendra le ticket ouvert.`,
+            ),
+            emailButton('Répondre au ticket', portalUrl, 'primary'),
+          ].join(''), {
+            kind: 'alert',
+            preheader: `Sans réponse de votre part, votre ticket ${ticketNumber} sera clôturé le ${deadlineLabel}.`,
+          }),
+        })
+
+        // Internal note for the conversation timeline (never sent to the client).
+        await dbCreate(payload, slugs.ticketMessages, {
+          data: {
+            ticket: ticketId,
+            body: `Relance envoyée à ${client.email}. Fermeture automatique programmée le ${deadlineLabel} sans réponse du client.`,
+            authorType: 'admin',
+            isInternal: true,
+            skipNotification: true,
+          },
+          overrideAccess: true,
+        })
+
+        // Arm the ticket. `autoCloseRemindedAt: now` keeps the day-based cron
+        // reminder from firing a second time; `autoCloseScheduledAt` is the hard
+        // 24h-style deadline the cron close step honours.
+        await dbUpdate(payload, slugs.tickets, {
+          id: ticketId,
+          data: {
+            status: 'waiting_client',
+            autoCloseRemindedAt: now.toISOString(),
+            autoCloseScheduledAt: deadline.toISOString(),
+          },
+          overrideAccess: true,
+        })
+
+        return Response.json({
+          success: true,
+          sentTo: client.email,
+          scheduledCloseAt: deadline.toISOString(),
+        })
+      } catch (error) {
+        const authResponse = handleAuthError(error)
+        if (authResponse) return authResponse
+        console.error('[send-reminder] Error:', error)
+        return Response.json({ error: 'Erreur interne' }, { status: 500 })
+      }
+    },
+  }
+}

package/src/endpoints/settings.ts

@@ -1,6 +1,8 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { invalidateSupportSettingsCache } from '../utils/readSettings'
+import { dbFind } from '../utils/db'
 
 const PREF_KEY = 'support-settings'
 
@@ -63,8 +65,7 @@ export function createSettingsGetEndpoint(slugs: CollectionSlugs): Endpoint {
 
         requireAdmin(req, slugs)
 
-        const prefs = await payload.find({
-          collection: 'payload-preferences' as any,
+        const prefs = await dbFind(payload, 'payload-preferences', {
           where: { key: { equals: PREF_KEY } },
           limit: 1,
           depth: 0,
@@ -132,6 +133,8 @@ export function createSettingsPostEndpoint(slugs: CollectionSlugs): Endpoint {
           },
         })
 
+        invalidateSupportSettingsCache()
+
         return Response.json(merged)
       } catch (error) {
         const authResponse = handleAuthError(error)

package/src/endpoints/signature.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFind } from '../utils/db'
 
 const PREF_KEY = 'email-signature'
 
@@ -17,8 +18,7 @@ export function createSignatureGetEndpoint(slugs: CollectionSlugs): Endpoint {
 
         requireAdmin(req, slugs)
 
-        const prefs = await payload.find({
-          collection: 'payload-preferences' as any,
+        const prefs = await dbFind(payload, 'payload-preferences', {
           where: { key: { equals: `${PREF_KEY}-${req.user.id}` } },
           limit: 1,
           depth: 0,
@@ -56,8 +56,7 @@ export function createSignaturePostEndpoint(slugs: CollectionSlugs): Endpoint {
         const { signature } = (await req.json!()) as { signature: string }
         const key = `${PREF_KEY}-${req.user.id}`
 
-        const existing = await payload.find({
-          collection: 'payload-preferences' as any,
+        const existing = await dbFind(payload, 'payload-preferences', {
           where: { key: { equals: key } },
           limit: 1,
           depth: 0,

package/src/endpoints/sla-check.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFind } from '../utils/db'
 
 /**
  * GET /api/support/sla-check
@@ -19,8 +20,7 @@ export function createSlaCheckEndpoint(slugs: CollectionSlugs): Endpoint {
         const now = new Date()
         const nowISO = now.toISOString()
 
-        const { docs: tickets } = await payload.find({
-          collection: slugs.tickets as any,
+        const { docs: tickets } = await dbFind(payload, slugs.tickets, {
           where: {
             and: [
               { status: { in: ['open', 'waiting_client'] } },

package/src/endpoints/split-ticket.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFindByID, dbCreate, dbUpdate } from '../utils/db'
 
 /**
  * POST /api/support/split-ticket
@@ -21,8 +22,7 @@ export function createSplitTicketEndpoint(slugs: CollectionSlugs): Endpoint {
           return Response.json({ error: 'messageId required' }, { status: 400 })
         }
 
-        const message = await payload.findByID({
-          collection: slugs.ticketMessages as any,
+        const message = await dbFindByID(payload, slugs.ticketMessages, {
           id: messageId,
           depth: 1,
           overrideAccess: true,
@@ -42,8 +42,7 @@ export function createSplitTicketEndpoint(slugs: CollectionSlugs): Endpoint {
           : sourceTicket.client
 
         // Create new ticket
-        const newTicket = await payload.create({
-          collection: slugs.tickets as any,
+        const newTicket = await dbCreate(payload, slugs.tickets, {
           data: {
             subject: subject || `Split: ${sourceTicket.subject}`,
             client: clientId,
@@ -61,8 +60,7 @@ export function createSplitTicketEndpoint(slugs: CollectionSlugs): Endpoint {
           file: typeof a.file === 'object' ? a.file.id : a.file,
         })) || []
 
-        await payload.create({
-          collection: slugs.ticketMessages as any,
+        await dbCreate(payload, slugs.ticketMessages, {
           data: {
             ticket: newTicket.id,
             body: message.body,
@@ -77,8 +75,7 @@ export function createSplitTicketEndpoint(slugs: CollectionSlugs): Endpoint {
         })
 
         // Add system note on source ticket
-        await payload.create({
-          collection: slugs.ticketMessages as any,
+        await dbCreate(payload, slugs.ticketMessages, {
           data: {
             ticket: sourceTicket.id,
             body: `Message extrait vers le ticket ${newTicket.ticketNumber}`,
@@ -95,8 +92,7 @@ export function createSplitTicketEndpoint(slugs: CollectionSlugs): Endpoint {
           : []
 
         if (!existingRelated.includes(newTicket.id)) {
-          await payload.update({
-            collection: slugs.tickets as any,
+          await dbUpdate(payload, slugs.tickets, {
             id: sourceTicket.id,
             data: { relatedTickets: [...existingRelated, newTicket.id] },
             overrideAccess: true,
@@ -104,8 +100,7 @@ export function createSplitTicketEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         // Log activity
-        await payload.create({
-          collection: slugs.ticketActivityLog as any,
+        await dbCreate(payload, slugs.ticketActivityLog, {
           data: {
             ticket: sourceTicket.id,
             action: 'split',

package/src/endpoints/statuses.ts

@@ -1,5 +1,6 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
+import { dbFind } from '../utils/db'
 
 /**
  * GET /api/support/statuses
@@ -17,8 +18,7 @@ export function createStatusesEndpoint(slugs: CollectionSlugs): Endpoint {
           return Response.json({ error: 'Unauthorized' }, { status: 401 })
         }
 
-        const { docs } = await payload.find({
-          collection: slugs.ticketStatuses as any,
+        const { docs } = await dbFind(payload, slugs.ticketStatuses, {
           sort: 'sortOrder',
           limit: 100,
           depth: 0,

package/src/endpoints/ticket-feedback.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireClient, handleAuthError } from '../utils/auth'
+import { dbFind, dbFindByID, dbCreate } from '../utils/db'
 
 /**
  * POST /api/support/tickets/:id/feedback
@@ -46,8 +47,7 @@ export function createTicketFeedbackEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         // Find ticket and check it belongs to the requesting client
-        const ticket = (await payload.findByID({
-          collection: slugs.tickets as any,
+        const ticket = (await dbFindByID(payload, slugs.tickets, {
           id: ticketId,
           depth: 0,
           overrideAccess: true,
@@ -66,8 +66,7 @@ export function createTicketFeedbackEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         // Check no feedback already exists for this ticket
-        const existing = await payload.find({
-          collection: 'ticket-feedback' as any,
+        const existing = await dbFind(payload, 'ticket-feedback', {
           where: { ticket: { equals: ticketId } },
           limit: 1,
           depth: 0,
@@ -80,8 +79,7 @@ export function createTicketFeedbackEndpoint(slugs: CollectionSlugs): Endpoint {
           )
         }
 
-        const feedback = await payload.create({
-          collection: 'ticket-feedback' as any,
+        const feedback = await dbCreate(payload, 'ticket-feedback', {
           data: {
             ticket: ticketId,
             client: req.user.id,

package/src/endpoints/ticket-synthesis.ts

@@ -2,6 +2,7 @@ import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { generateTicketSynthesis } from '../utils/generateTicketSynthesis'
+import { dbFindByID } from '../utils/db'
 
 /**
  * POST /api/support/ticket-synthesis?ticketId=X[&force=true]
@@ -38,8 +39,7 @@ export function createTicketSynthesisEndpoint(slugs: CollectionSlugs): Endpoint
         }
 
         if (!force) {
-          const existing = await payload.findByID({
-            collection: slugs.tickets as any,
+          const existing = await dbFindByID(payload, slugs.tickets, {
             id: ticketId,
             depth: 0,
             overrideAccess: true,

package/src/endpoints/track-open.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { createHmac } from 'crypto'
+import { dbFindByID, dbUpdate, dbCreate } from '../utils/db'
 
 // 1x1 transparent GIF (43 bytes)
 const TRANSPARENT_GIF = Buffer.from(
@@ -34,23 +35,16 @@ export function createTrackOpenEndpoint(slugs: CollectionSlugs): Endpoint {
       const parsedId = ticketId ? Number(ticketId) : NaN
       const parsedMsgId = messageId ? Number(messageId) : NaN
 
-      // Validate HMAC signature
+      // Open-tracking REQUIRES a valid HMAC signature. Without one we never
+      // process (no DB writes) — this prevents enumeration/abuse of t/m params
+      // and the silent "tracking writes without auth" hole.
       const secret = process.env.PAYLOAD_SECRET || ''
-      if (secret && ticketId && messageId && sig) {
-        const expected = generateTrackingToken(ticketId, messageId, secret)
-        if (sig !== expected) {
-          // Return transparent GIF silently (don't leak information)
-          return new Response(TRANSPARENT_GIF, {
-            status: 200,
-            headers: {
-              'Content-Type': 'image/gif',
-              'Content-Length': String(TRANSPARENT_GIF.length),
-              'Cache-Control': 'no-store, no-cache, must-revalidate, max-age=0',
-            },
-          })
-        }
-      } else if (secret && (!sig || !ticketId || !messageId)) {
-        // Missing signature param: return GIF but don't process
+      const validSig =
+        !!secret && !!ticketId && !!messageId && !!sig &&
+        sig === generateTrackingToken(ticketId, messageId, secret)
+
+      if (!validSig) {
+        // Return transparent GIF silently (don't leak information, don't process)
         return new Response(TRANSPARENT_GIF, {
           status: 200,
           headers: {
@@ -65,8 +59,7 @@ export function createTrackOpenEndpoint(slugs: CollectionSlugs): Endpoint {
         try {
           const payload = req.payload
 
-          const ticket = await payload.findByID({
-            collection: slugs.tickets as any,
+          const ticket = await dbFindByID(payload, slugs.tickets, {
             id: parsedId,
             depth: 0,
             overrideAccess: true,
@@ -78,8 +71,7 @@ export function createTrackOpenEndpoint(slugs: CollectionSlugs): Endpoint {
             const fiveMinAgo = Date.now() - 5 * 60 * 1000
 
             if (lastRead < fiveMinAgo) {
-              await payload.update({
-                collection: slugs.tickets as any,
+              await dbUpdate(payload, slugs.tickets, {
                 id: parsedId,
                 data: { lastClientReadAt: new Date().toISOString() },
                 overrideAccess: true,
@@ -89,8 +81,7 @@ export function createTrackOpenEndpoint(slugs: CollectionSlugs): Endpoint {
 
           // Track at message level
           if (Number.isInteger(parsedMsgId) && parsedMsgId > 0) {
-            const msg = await payload.findByID({
-              collection: slugs.ticketMessages as any,
+            const msg = await dbFindByID(payload, slugs.ticketMessages, {
               id: parsedMsgId,
               depth: 0,
               overrideAccess: true,
@@ -98,15 +89,13 @@ export function createTrackOpenEndpoint(slugs: CollectionSlugs): Endpoint {
             }) as any
 
             if (msg && !msg.emailOpenedAt) {
-              await payload.update({
-                collection: slugs.ticketMessages as any,
+              await dbUpdate(payload, slugs.ticketMessages, {
                 id: parsedMsgId,
                 data: { emailOpenedAt: new Date().toISOString() },
                 overrideAccess: true,
               })
 
-              const ticketInfo = await payload.findByID({
-                collection: slugs.tickets as any,
+              const ticketInfo = await dbFindByID(payload, slugs.tickets, {
                 id: parsedId,
                 depth: 1,
                 overrideAccess: true,
@@ -119,8 +108,7 @@ export function createTrackOpenEndpoint(slugs: CollectionSlugs): Endpoint {
 
               // Try to create admin notification (collection may not exist)
               try {
-                await payload.create({
-                  collection: 'admin-notifications' as any,
+                await dbCreate(payload, 'admin-notifications', {
                   data: {
                     title: `Email ouvert — ${ticketInfo?.ticketNumber || 'TK-????'}`,
                     message: `${clientName} a ouvert votre email pour "${ticketInfo?.subject || 'ticket'}"`,