@consilioweb/payload-support 0.15.0 → 1.0.0

package/src/portal/auth/tickets/detail/TransferAndInviteActions.tsx

@@ -3,6 +3,7 @@
 import React, { useCallback, useEffect, useRef, useState } from 'react'
 
 type Toast = { type: 'success' | 'error'; message: string } | null
+type ToastPayload = NonNullable<Toast>
 type Modal = 'transfer' | 'invite' | null
 
 const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
@@ -116,7 +117,7 @@ function TransferModal({
 }: {
   ticketId: number | string
   onClose: () => void
-  onResult: (t: Toast) => void
+  onResult: (t: ToastPayload) => void
 }) {
   const [email, setEmail] = useState('')
   const [includeAttachments, setIncludeAttachments] = useState(true)
@@ -204,7 +205,7 @@ function InviteModal({
 }: {
   ticketId: number | string
   onClose: () => void
-  onResult: (t: Toast) => void
+  onResult: (t: ToastPayload) => void
 }) {
   const [email, setEmail] = useState('')
   const [role, setRole] = useState<'viewer' | 'collaborator'>('viewer')

package/src/portal/auth/tickets/detail/page.tsx

@@ -748,7 +748,7 @@ export default async function TicketDetailPage({ params }: { params: Promise<{ i
                         {/* Edit/delete actions for client messages */}
                         {isClient && msg.authorType === 'client' && !(msg as unknown as { deletedAt?: string }).deletedAt && (
                           <MessageActions
-                            messageId={msg.id}
+                            messageId={Number(msg.id)}
                             body={msg.body}
                             createdAt={msg.createdAt}
                           />
@@ -786,7 +786,7 @@ export default async function TicketDetailPage({ params }: { params: Promise<{ i
 
           {/* Typing indicator inside conversation */}
           <div className="px-4 sm:px-6 pb-2">
-            <TypingIndicator ticketId={ticket.id} />
+            <TypingIndicator ticketId={Number(ticket.id)} />
           </div>
         </div>
 

package/src/portal/helpers.ts

@@ -0,0 +1,46 @@
+import type { LiveChatSession } from './types'
+
+// ─── LocalStorage keys ──────────────────────────────────────
+
+export const LS_KEY = 'support-livechat'
+
+export function loadSession(): LiveChatSession | null {
+  if (typeof window === 'undefined') return null
+  try {
+    const raw = localStorage.getItem(LS_KEY)
+    if (!raw) return null
+    const session = JSON.parse(raw) as LiveChatSession
+
+    // Validate token expiry (24h) — extract timestamp from token
+    if (session.clientToken) {
+      const parts = session.clientToken.split('_')
+      if (parts.length === 4) {
+        const timestamp = parseInt(parts[2], 10)
+        if (!isNaN(timestamp) && Date.now() - timestamp > 24 * 60 * 60 * 1000) {
+          localStorage.removeItem(LS_KEY)
+          return null
+        }
+      }
+    }
+
+    return session
+  } catch {
+    return null
+  }
+}
+
+export function saveSession(session: LiveChatSession): void {
+  try {
+    localStorage.setItem(LS_KEY, JSON.stringify(session))
+  } catch {
+    // localStorage full or disabled
+  }
+}
+
+export function clearSession(): void {
+  try {
+    localStorage.removeItem(LS_KEY)
+  } catch {
+    // Ignore
+  }
+}

package/src/portal/login/page.tsx

@@ -55,14 +55,9 @@ function SupportLoginContent() {
         return
       }
 
-      // Check if 2FA is enabled for this user
-      if (data.user?.twoFactorEnabled) {
-        // Logout immediately (we need 2FA first)
-        await fetch('/api/support-clients/logout', {
-          method: 'POST',
-          credentials: 'include',
-        })
-
+      // Server requires 2FA: credentials were valid but NO session was issued.
+      // Request the code and switch to the verification step.
+      if (data.requires2FA) {
         // Send 2FA code
         setSending2FA(true)
         const codeRes = await fetch('/api/support/2fa', {

package/src/portal/types.ts

@@ -0,0 +1,15 @@
+export interface ChatMessage {
+  id: number | string
+  body: string
+  senderType: 'client' | 'agent' | 'system'
+  createdAt: string
+}
+
+export interface LiveChatSession {
+  clientToken: string
+  email: string
+  name: string
+  sessionId?: string
+}
+
+export type Screen = 'closed' | 'identify' | 'chat' | 'rating'

package/src/types/lucide-react.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Ambient stub for 'lucide-react'.
+ * lucide-react is an optional peer dependency — the host application installs it.
+ * This stub satisfies TypeScript when the plugin is type-checked in isolation.
+ */
+declare module 'lucide-react' {
+  import type { FC, SVGProps } from 'react'
+  type LucideIcon = FC<SVGProps<SVGSVGElement> & { size?: number | string; strokeWidth?: number | string }>
+  // Export every named icon as LucideIcon so any import resolves cleanly
+  const MessageCircle: LucideIcon
+  const Send: LucideIcon
+  const X: LucideIcon
+  const Minimize2: LucideIcon
+  const ArrowLeft: LucideIcon
+  const Inbox: LucideIcon
+  const Plus: LucideIcon
+  const Link2: LucideIcon
+  const Search: LucideIcon
+  const ChevronDown: LucideIcon
+  const ChevronUp: LucideIcon
+  const Paperclip: LucideIcon
+  const Settings: LucideIcon
+  const Mail: LucideIcon
+  const Bot: LucideIcon
+  const Clock: LucideIcon
+  const Timer: LucideIcon
+  const Globe: LucideIcon
+  const FileSignature: LucideIcon
+  export {
+    MessageCircle, Send, X, Minimize2, ArrowLeft,
+    Inbox, Plus, Link2, Search, ChevronDown, ChevronUp, Paperclip,
+    Settings, Mail, Bot, Clock, Timer, Globe, FileSignature,
+  }
+}

package/src/types/payload-config.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Ambient stub for '@payload-config'.
+ * The host application provides the real config; this stub satisfies
+ * TypeScript when the plugin is type-checked in isolation.
+ */
+declare module '@payload-config' {
+  import type { SanitizedConfig } from 'payload'
+  const config: Promise<SanitizedConfig>
+  export default config
+}

package/src/utils/adminNotification.ts

@@ -1,4 +1,5 @@
 import type { Payload } from 'payload'
+import { dbCreate } from './db'
 
 /**
  * Helper to create an admin notification.
@@ -20,8 +21,7 @@ export async function createAdminNotification(
   collectionSlug = 'admin-notifications',
 ): Promise<void> {
   try {
-    await payload.create({
-      collection: collectionSlug as any,
+    await dbCreate(payload, collectionSlug, {
       data: {
         title: data.title,
         message: data.message,

package/src/utils/aiAgent.ts

@@ -0,0 +1,147 @@
+import type { Payload } from 'payload'
+import type { CollectionSlugs } from './slugs'
+import { readSupportSettings, type SupportSettings } from './readSettings'
+import { dbFind, dbFindByID, dbCreate, dbUpdate } from './db'
+
+export interface AgentDecision {
+  action: 'reply' | 'escalate'
+  reply?: string
+  reason?: string
+  confidence?: number
+}
+
+export interface AgentResult {
+  acted: 'reply' | 'escalate'
+  messageId?: number | string
+  confidence?: number
+}
+
+/**
+ * Execute an AI agent decision on a ticket. DETERMINISTIC (no LLM) — this is the
+ * tested core: a `reply` posts a public answer (attributed to the AI assistant),
+ * an `escalate` records an internal note with the reasoning and flags the ticket.
+ */
+export async function applyAgentDecision(
+  payload: Payload,
+  slugs: CollectionSlugs,
+  ticketId: number | string,
+  decision: AgentDecision,
+): Promise<AgentResult> {
+  if (decision.action === 'reply' && decision.reply && decision.reply.trim()) {
+    const msg = await dbCreate(payload, slugs.ticketMessages, {
+      data: {
+        ticket: ticketId,
+        body: decision.reply.trim(),
+        authorType: 'admin',
+        isInternal: false,
+        fromAlias: 'Assistant IA',
+      },
+      overrideAccess: true,
+    })
+    return { acted: 'reply', messageId: (msg as { id: number | string }).id, confidence: decision.confidence }
+  }
+
+  // Escalate: leave an internal note + flag the ticket for a human.
+  await dbCreate(payload, slugs.ticketMessages, {
+    data: {
+      ticket: ticketId,
+      body: `[Agent IA] Escalade vers un humain. Raison : ${decision.reason || 'non déterminée'} (confiance ${Math.round((decision.confidence ?? 0) * 100)} %).`,
+      authorType: 'admin',
+      isInternal: true,
+      skipNotification: true,
+    },
+    overrideAccess: true,
+  })
+  await dbUpdate(payload, slugs.tickets, { id: ticketId, data: { status: 'escalated' }, overrideAccess: true })
+  return { acted: 'escalate', confidence: decision.confidence }
+}
+
+// ─── LLM decision (runtime only — not unit-tested) ───────────────────
+
+function getClient(aiSettings: SupportSettings['ai']) {
+  const Anthropic = require('@anthropic-ai/sdk').default
+  if (aiSettings.provider === 'ollama') {
+    return new Anthropic({ apiKey: 'ollama', baseURL: process.env.OLLAMA_API_URL || 'https://ollama.orkelis.app/v1' })
+  }
+  return new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY })
+}
+
+function stripHtml(s: string): string {
+  return (s || '').replace(/<[^>]+>/g, ' ').replace(/\s+/g, ' ').trim()
+}
+
+function parseDecision(text: string): AgentDecision {
+  try {
+    const match = text.match(/\{[\s\S]*\}/)
+    if (match) {
+      const obj = JSON.parse(match[0])
+      return {
+        action: obj.action === 'reply' ? 'reply' : 'escalate',
+        reply: typeof obj.reply === 'string' ? obj.reply : undefined,
+        reason: typeof obj.reason === 'string' ? obj.reason : undefined,
+        confidence: typeof obj.confidence === 'number' ? obj.confidence : 0,
+      }
+    }
+  } catch { /* fall through */ }
+  return { action: 'escalate', reason: 'Réponse IA non interprétable', confidence: 0 }
+}
+
+/**
+ * Run the autonomous AI agent on a ticket: builds context (ticket + thread + KB),
+ * asks the LLM for a structured decision, applies a confidence threshold, then
+ * executes it via {@link applyAgentDecision}. Requires an AI provider at runtime.
+ */
+export async function runAiAgent(
+  payload: Payload,
+  slugs: CollectionSlugs,
+  ticketId: number | string,
+  opts?: { confidenceThreshold?: number },
+): Promise<AgentResult> {
+  const settings = await readSupportSettings(payload)
+  const threshold = opts?.confidenceThreshold ?? 0.7
+
+  const ticket = await dbFindByID(payload, slugs.tickets, { id: ticketId, depth: 0, overrideAccess: true })
+  const messages = await dbFind(payload, slugs.ticketMessages, { where: { ticket: { equals: ticketId } }, sort: 'createdAt', limit: 50, depth: 0, overrideAccess: true })
+  const kb = await dbFind(payload, slugs.knowledgeBase, { where: { published: { equals: true } }, limit: 20, depth: 0, overrideAccess: true })
+
+  const conversation = messages.docs.map((m) => `${(m as { authorType?: string }).authorType}: ${(m as { body?: string }).body || ''}`).join('\n')
+  const kbText = kb.docs
+    .map((a) => `# ${(a as { title?: string }).title || ''}\n${stripHtml(String((a as { content?: unknown }).content ?? ''))}`)
+    .join('\n\n')
+    .slice(0, 8000)
+
+  const prompt = `Tu es un agent de support IA. À partir du ticket et de la base de connaissances ci-dessous, décide :
+- "reply" si tu peux répondre avec certitude UNIQUEMENT à partir de la base de connaissances ;
+- "escalate" sinon (question hors KB, ambiguë, sensible, ou nécessitant une action humaine).
+Réponds en JSON STRICT, sans texte autour : {"action":"reply"|"escalate","reply":"<réponse au client si reply>","reason":"<courte raison>","confidence":<0 à 1>}.
+
+TICKET : ${(ticket as { subject?: string }).subject || ''}
+CONVERSATION :
+${conversation}
+
+BASE DE CONNAISSANCES :
+${kbText || '(vide)'}`
+
+  let decision: AgentDecision
+  try {
+    const client = getClient(settings.ai)
+    const resp = await client.messages.create({
+      model: settings.ai.model || 'claude-haiku-4-5-20251001',
+      max_tokens: 1024,
+      messages: [{ role: 'user', content: prompt }],
+    })
+    const text = resp?.content?.[0]?.text || ''
+    decision = parseDecision(text)
+  } catch (err) {
+    console.error('[support] AI agent decision failed:', err)
+    decision = { action: 'escalate', reason: 'Erreur du fournisseur IA', confidence: 0 }
+  }
+
+  // Confidence gate: only auto-reply when the model is confident enough.
+  const finalDecision: AgentDecision =
+    decision.action === 'reply' && (decision.confidence ?? 0) >= threshold
+      ? decision
+      : { action: 'escalate', reason: decision.reason || 'Confiance insuffisante pour une réponse automatique', confidence: decision.confidence }
+
+  return applyAgentDecision(payload, slugs, ticketId, finalDecision)
+}

package/src/utils/auth.ts

@@ -1,3 +1,4 @@
+import type { PayloadRequest } from 'payload'
 import type { CollectionSlugs } from './slugs'
 
 /**
@@ -19,9 +20,9 @@ export class AuthError extends Error {
  * Throws AuthError(401) if unauthenticated, AuthError(403) if not an admin.
  * Uses TypeScript assertion signature so `req.user` is narrowed to non-null after call.
  */
-export function requireAdmin(req: { user?: any }, slugs: CollectionSlugs): asserts req is { user: NonNullable<typeof req.user> } {
+export function requireAdmin(req: PayloadRequest, slugs: CollectionSlugs): asserts req is PayloadRequest & { user: NonNullable<PayloadRequest['user']> } {
   if (!req.user) throw new AuthError('Authentication required', 401)
-  if (req.user.collection !== slugs.users) throw new AuthError('Admin access required', 403)
+  if ((req.user as any).collection !== slugs.users) throw new AuthError('Admin access required', 403)
 }
 
 /**
@@ -29,9 +30,9 @@ export function requireAdmin(req: { user?: any }, slugs: CollectionSlugs): asser
  * Throws AuthError(401) if unauthenticated, AuthError(403) if not a client.
  * Uses TypeScript assertion signature so `req.user` is narrowed to non-null after call.
  */
-export function requireClient(req: { user?: any }, slugs: CollectionSlugs): asserts req is { user: NonNullable<typeof req.user> } {
+export function requireClient(req: PayloadRequest, slugs: CollectionSlugs): asserts req is PayloadRequest & { user: NonNullable<PayloadRequest['user']> } {
   if (!req.user) throw new AuthError('Authentication required', 401)
-  if (req.user.collection !== slugs.supportClients) throw new AuthError('Client access required', 403)
+  if ((req.user as any).collection !== slugs.supportClients) throw new AuthError('Client access required', 403)
 }
 
 /**

package/src/utils/channels.ts

@@ -0,0 +1,36 @@
+export type ChannelProvider = 'whatsapp' | 'messenger'
+
+/**
+ * Send an outbound reply to a social channel (WhatsApp / Messenger) via the Meta
+ * Graph API. RUNTIME-only: requires provider credentials in the environment.
+ * Returns `{ ok: false }` (and logs) when credentials are missing or the call fails.
+ */
+export async function sendChannelReply(provider: ChannelProvider, to: string, text: string): Promise<{ ok: boolean }> {
+  try {
+    if (provider === 'whatsapp') {
+      const token = process.env.WHATSAPP_TOKEN
+      const phoneId = process.env.WHATSAPP_PHONE_ID
+      if (!token || !phoneId) return { ok: false }
+      const res = await fetch(`https://graph.facebook.com/v21.0/${phoneId}/messages`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ messaging_product: 'whatsapp', to, type: 'text', text: { body: text } }),
+      })
+      return { ok: res.ok }
+    }
+    if (provider === 'messenger') {
+      const token = process.env.MESSENGER_PAGE_TOKEN
+      if (!token) return { ok: false }
+      const res = await fetch(`https://graph.facebook.com/v21.0/me/messages?access_token=${encodeURIComponent(token)}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ recipient: { id: to }, message: { text } }),
+      })
+      return { ok: res.ok }
+    }
+    return { ok: false }
+  } catch (err) {
+    console.error('[support] Channel send failed:', err)
+    return { ok: false }
+  }
+}

package/src/utils/db.ts

@@ -0,0 +1,73 @@
+import type { Payload } from 'payload'
+
+/**
+ * Thin typed wrappers around Payload data operations.
+ *
+ * Collection slugs are user-overridable config (`string`), not Payload's literal
+ * `CollectionSlug` union — so every call site otherwise needs `collection: X as any`.
+ * These helpers isolate that single unavoidable cast in ONE place, removing the
+ * ~200 scattered `as any` while staying an EXACT behavioral pass-through of options.
+ *
+ * Returns default to `any` (callers consume docs loosely, as before). Pass a type
+ * argument to opt into stronger typing: `dbFind<TicketData>(payload, slug, { ... })`.
+ */
+
+interface PaginatedResult<T> {
+  docs: T[]
+  totalDocs: number
+  totalPages: number
+  page?: number
+  limit: number
+  hasNextPage: boolean
+  hasPrevPage: boolean
+  nextPage?: number | null
+  prevPage?: number | null
+}
+
+export function dbFind<T = any>(
+  payload: Payload,
+  slug: string,
+  options: Record<string, unknown> = {},
+): Promise<PaginatedResult<T>> {
+  return payload.find({ collection: slug as any, ...options }) as any
+}
+
+export function dbFindByID<T = any>(
+  payload: Payload,
+  slug: string,
+  options: { id: number | string } & Record<string, unknown>,
+): Promise<T> {
+  return payload.findByID({ collection: slug as any, ...options }) as any
+}
+
+export function dbCreate<T = any>(
+  payload: Payload,
+  slug: string,
+  options: Record<string, unknown>,
+): Promise<T> {
+  return (payload.create as any)({ collection: slug, ...options })
+}
+
+export function dbUpdate<T = any>(
+  payload: Payload,
+  slug: string,
+  options: Record<string, unknown>,
+): Promise<T> {
+  return (payload.update as any)({ collection: slug, ...options })
+}
+
+export function dbCount(
+  payload: Payload,
+  slug: string,
+  options: Record<string, unknown> = {},
+): Promise<{ totalDocs: number }> {
+  return payload.count({ collection: slug as any, ...options }) as any
+}
+
+export function dbDelete<T = any>(
+  payload: Payload,
+  slug: string,
+  options: Record<string, unknown>,
+): Promise<T> {
+  return (payload.delete as any)({ collection: slug, ...options })
+}

package/src/utils/emailTemplate.ts

@@ -16,6 +16,8 @@
  * emailInfoRow, escapeHtml, createEmailTemplateFactory must not change.
  */
 
+import { generateTrackingToken } from '../endpoints/track-open'
+
 // ─── Design tokens ───────────────────────────────────────────────────
 
 const COLORS = {
@@ -86,7 +88,12 @@ export function escapeHtml(str: string): string {
  */
 export function emailTrackingPixel(ticketId: number | string, messageId?: number | string, baseUrl?: string): string {
   const url = baseUrl || process.env.NEXT_PUBLIC_SERVER_URL || ''
-  const params = `t=${ticketId}${messageId ? `&m=${messageId}` : ''}`
+  const secret = process.env.PAYLOAD_SECRET || ''
+  // Open-tracking requires a signed URL (HMAC). Without a secret or a messageId we
+  // cannot sign, so we emit NO pixel rather than an unsigned (abusable) one.
+  if (!secret || messageId === undefined || messageId === null) return ''
+  const sig = generateTrackingToken(String(ticketId), String(messageId), secret)
+  const params = `t=${ticketId}&m=${messageId}&sig=${sig}`
   return `<img src="${url}/api/support/track-open?${params}" width="1" height="1" alt="" style="display:block;width:1px;height:1px;border:0;" />`
 }
 

package/src/utils/fireWebhooks.ts

@@ -1,5 +1,6 @@
 import type { Payload } from 'payload'
 import type { CollectionSlugs } from './slugs'
+import { dbFind, dbUpdate } from './db'
 
 /**
  * Fire all active webhooks matching the given event.
@@ -14,8 +15,7 @@ export async function fireWebhooks(
 ): Promise<void> {
   try {
     // Find all active webhook endpoints subscribed to this event
-    const endpoints = await payload.find({
-      collection: slugs.webhookEndpoints as any,
+    const endpoints = await dbFind(payload, slugs.webhookEndpoints, {
       where: {
         active: { equals: true },
         events: { contains: event },
@@ -45,8 +45,7 @@ export async function fireWebhooks(
 
           // Update webhook metadata (best-effort, don't throw on failure)
           try {
-            await payload.update({
-              collection: slugs.webhookEndpoints as any,
+            await dbUpdate(payload, slugs.webhookEndpoints, {
               id: endpoint.id,
               data: {
                 lastTriggeredAt: timestamp,
@@ -62,8 +61,7 @@ export async function fireWebhooks(
 
           // Record the failure
           try {
-            await payload.update({
-              collection: slugs.webhookEndpoints as any,
+            await dbUpdate(payload, slugs.webhookEndpoints, {
               id: endpoint.id,
               data: {
                 lastTriggeredAt: timestamp,

package/src/utils/generateTicketSynthesis.ts

@@ -1,6 +1,7 @@
 import type { Payload } from 'payload'
 import type { CollectionSlugs } from './slugs'
 import { readSupportSettings, type SupportSettings } from './readSettings'
+import { dbFindByID, dbUpdate, dbFind } from './db'
 
 function getClient(aiSettings: SupportSettings['ai']) {
   // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -53,8 +54,7 @@ export async function generateTicketSynthesis(args: {
     return { summary: '', generatedAt: new Date().toISOString(), status: 'skipped', reason: 'synthesis disabled' }
   }
 
-  const ticket = await payload.findByID({
-    collection: slugs.tickets as any,
+  const ticket = await dbFindByID(payload, slugs.tickets, {
     id: ticketId,
     depth: 1,
     overrideAccess: true,
@@ -65,16 +65,14 @@ export async function generateTicketSynthesis(args: {
   }
 
   // Mark as pending so the UI can show a spinner
-  await payload.update({
-    collection: slugs.tickets as any,
+  await dbUpdate(payload, slugs.tickets, {
     id: ticketId,
     data: { aiSummaryStatus: 'pending' },
     overrideAccess: true,
   }).catch(() => { /* non-blocking */ })
 
   // Load all ticket messages, ordered chronologically
-  const messagesResult = await payload.find({
-    collection: slugs.ticketMessages as any,
+  const messagesResult = await dbFind(payload, slugs.ticketMessages, {
     where: { ticket: { equals: ticketId } },
     sort: 'createdAt',
     limit: 500,
@@ -86,8 +84,7 @@ export async function generateTicketSynthesis(args: {
 
   if (messages.length === 0) {
     const generatedAt = new Date().toISOString()
-    await payload.update({
-      collection: slugs.tickets as any,
+    await dbUpdate(payload, slugs.tickets, {
       id: ticketId,
       data: {
         aiSummary: '(Aucun message dans ce ticket)',
@@ -153,8 +150,7 @@ Reponds UNIQUEMENT avec la liste de puces, rien d'autre.`
     const summary = res.content[0]?.type === 'text' ? res.content[0].text.trim() : ''
     const generatedAt = new Date().toISOString()
 
-    await payload.update({
-      collection: slugs.tickets as any,
+    await dbUpdate(payload, slugs.tickets, {
       id: ticketId,
       data: {
         aiSummary: summary,
@@ -167,8 +163,7 @@ Reponds UNIQUEMENT avec la liste de puces, rien d'autre.`
     return { summary, generatedAt, status: 'done' }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err)
-    await payload.update({
-      collection: slugs.tickets as any,
+    await dbUpdate(payload, slugs.tickets, {
       id: ticketId,
       data: { aiSummaryStatus: 'error' },
       overrideAccess: true,