@consilioweb/payload-support 0.16.0 → 1.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consilioweb/payload-support",
-  "version": "0.16.0",
+  "version": "1.0.0",
   "description": "Payload CMS plugin — professional support & ticketing system with AI, SLA, time tracking, live chat, and more",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -52,7 +52,9 @@
   "scripts": {
     "build": "tsup",
     "typecheck": "tsc --noEmit",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build",
+    "test": "vitest run",
+    "test:watch": "vitest"
   },
   "keywords": [
     "payload",
@@ -93,11 +95,11 @@
     "@payloadcms/next": "^3.0.0",
     "@payloadcms/translations": "^3.0.0",
     "@payloadcms/ui": "^3.0.0",
+    "lucide-react": ">=0.300.0",
     "next": "^14.0.0 || ^15.0.0 || ^16.0.0",
     "payload": "^3.0.0",
     "react": "^18.0.0 || ^19.0.0",
-    "react-dom": "^18.0.0 || ^19.0.0",
-    "lucide-react": ">=0.300.0"
+    "react-dom": "^18.0.0 || ^19.0.0"
   },
   "peerDependenciesMeta": {
     "@payloadcms/ui": {
@@ -114,26 +116,32 @@
     },
     "next": {
       "optional": true
-    },
-    "react": {
-      "optional": true
-    },
-    "react-dom": {
-      "optional": true
     }
   },
   "engines": {
     "node": ">=18"
   },
   "devDependencies": {
-    "@payloadcms/next": "^3.77.0",
-    "@payloadcms/translations": "^3.77.0",
-    "@payloadcms/ui": "^3.77.0",
+    "@payloadcms/db-sqlite": "^3.85.1",
+    "@payloadcms/graphql": "^3.85.1",
+    "@payloadcms/next": "^3.85.1",
+    "@payloadcms/richtext-lexical": "^3.85.1",
+    "@payloadcms/translations": "^3.85.1",
+    "@payloadcms/ui": "^3.85.1",
+    "@types/pdfkit": "^0.17.6",
     "@types/react": "^19.0.0",
+    "@types/sanitize-html": "^2.16.1",
     "esbuild-sass-plugin": "^3.7.0",
     "next": "^15.5.14",
-    "payload": "^3.77.0",
+    "payload": "^3.85.1",
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7",
     "tsup": "^8.0.0",
-    "typescript": "^5.5.0"
+    "typescript": "^5.5.0",
+    "vitest": "^4.1.9"
+  },
+  "dependencies": {
+    "pdfkit": "^0.19.1",
+    "sanitize-html": "^2.17.5"
   }
 }

package/src/__tests__/generateTrackingToken.test.ts

@@ -0,0 +1,53 @@
+import { describe, it, expect } from 'vitest'
+import { generateTrackingToken } from '../endpoints/track-open'
+
+describe('generateTrackingToken — determinism', () => {
+  it('returns the same token for identical inputs (deterministic)', () => {
+    const a = generateTrackingToken('42', '7', 'mysecret')
+    const b = generateTrackingToken('42', '7', 'mysecret')
+    expect(a).toBe(b)
+  })
+
+  it('always returns exactly 16 characters', () => {
+    const token = generateTrackingToken('1', '2', 'secret')
+    expect(token).toHaveLength(16)
+  })
+
+  it('returns only hex characters (0-9 a-f)', () => {
+    const token = generateTrackingToken('100', '200', 'anothersecret')
+    expect(token).toMatch(/^[0-9a-f]{16}$/)
+  })
+})
+
+describe('generateTrackingToken — sensitivity to inputs', () => {
+  it('produces different tokens for different ticketIds', () => {
+    const t1 = generateTrackingToken('1', '5', 'secret')
+    const t2 = generateTrackingToken('2', '5', 'secret')
+    expect(t1).not.toBe(t2)
+  })
+
+  it('produces different tokens for different messageIds', () => {
+    const t1 = generateTrackingToken('10', '1', 'secret')
+    const t2 = generateTrackingToken('10', '2', 'secret')
+    expect(t1).not.toBe(t2)
+  })
+
+  it('produces different tokens for different secrets', () => {
+    const t1 = generateTrackingToken('42', '7', 'secret-A')
+    const t2 = generateTrackingToken('42', '7', 'secret-B')
+    expect(t1).not.toBe(t2)
+  })
+
+  it('is sensitive to ticketId/messageId order (no commutative collision)', () => {
+    const t1 = generateTrackingToken('1', '23', 'secret')
+    const t2 = generateTrackingToken('12', '3', 'secret')
+    // '1:23' vs '12:3' — different strings → different HMACs
+    expect(t1).not.toBe(t2)
+  })
+
+  it('treats ticket "0" and messageId "0" differently from "00"/"00"', () => {
+    const t1 = generateTrackingToken('0', '0', 'secret')
+    const t2 = generateTrackingToken('00', '00', 'secret')
+    expect(t1).not.toBe(t2)
+  })
+})

package/src/__tests__/integration/ai-agent.test.ts

@@ -0,0 +1,46 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+import { applyAgentDecision } from '../../utils/aiAgent'
+import { resolveSlugs } from '../../utils/slugs'
+
+const slugs = resolveSlugs({ users: 'users' })
+const PW = 'test-pw-12345'
+
+/**
+ * Autonomous AI agent (P2 #8). The LLM decision is runtime-only; here we test the
+ * DETERMINISTIC execution of a decision: a `reply` posts a public AI answer, an
+ * `escalate` flags the ticket and records an internal note.
+ */
+describe('AI agent — decision execution (P2 #8)', () => {
+  it('reply decision posts a public answer attributed to the AI assistant', async () => {
+    const payload = await buildTestPayload()
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'aiagent@example.com', password: PW, firstName: 'A', lastName: 'I', company: 'C' }, overrideAccess: true })
+    const t = await payload.create({ collection: 'tickets', data: { subject: 'reset password', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+
+    const res = await applyAgentDecision(payload, slugs, t.id, { action: 'reply', reply: 'Cliquez sur « Mot de passe oublié » sur la page de connexion.', confidence: 0.95 })
+    expect(res.acted).toBe('reply')
+    expect(res.messageId).toBeTruthy()
+
+    const msgs = await payload.find({ collection: 'ticket-messages', where: { ticket: { equals: t.id } }, overrideAccess: true })
+    const aiMsg = msgs.docs.find((m) => (m as { fromAlias?: string }).fromAlias === 'Assistant IA') as { body?: string; isInternal?: boolean } | undefined
+    expect(aiMsg).toBeTruthy()
+    expect(aiMsg?.body).toContain('Mot de passe oublié')
+    expect(aiMsg?.isInternal).toBe(false)
+  }, 60_000)
+
+  it('escalate decision flags the ticket and adds an internal note', async () => {
+    const payload = await buildTestPayload()
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'aiagent2@example.com', password: PW, firstName: 'A', lastName: 'I', company: 'C' }, overrideAccess: true })
+    const t = await payload.create({ collection: 'tickets', data: { subject: 'legal question', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+
+    const res = await applyAgentDecision(payload, slugs, t.id, { action: 'escalate', reason: 'Question juridique', confidence: 0.2 })
+    expect(res.acted).toBe('escalate')
+
+    const reread = await payload.findByID({ collection: 'tickets', id: t.id, overrideAccess: true })
+    expect(reread.status).toBe('escalated')
+
+    const msgs = await payload.find({ collection: 'ticket-messages', where: { and: [{ ticket: { equals: t.id } }, { isInternal: { equals: true } }] }, overrideAccess: true })
+    const note = msgs.docs.find((m) => ((m as { body?: string }).body || '').includes('[Agent IA]'))
+    expect(note).toBeTruthy()
+  }, 60_000)
+})

package/src/__tests__/integration/auth.test.ts

@@ -0,0 +1,43 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+
+const PW = 'test-pw-12345'
+
+/**
+ * Validates the server-side 2FA enforcement (P0-2): the beforeLogin hook must
+ * block login when 2FA is enabled without a fresh verification marker, allow it
+ * with one, and consume the marker (single-use) so it can't be replayed.
+ */
+describe('2FA enforcement (P0-2)', () => {
+  it('blocks login without a fresh marker, allows with one, then consumes it', async () => {
+    const payload = await buildTestPayload()
+
+    const c = await payload.create({
+      collection: 'support-clients',
+      data: { email: '2fa@example.com', password: PW, firstName: 'T', lastName: 'F', company: 'C', twoFactorEnabled: true },
+      overrideAccess: true,
+    })
+
+    // No marker → blocked even with the correct password.
+    await expect(
+      payload.login({ collection: 'support-clients', data: { email: '2fa@example.com', password: PW } }),
+    ).rejects.toThrow(/2FA_REQUIRED/)
+
+    // Fresh marker → login succeeds.
+    await payload.update({ collection: 'support-clients', id: c.id, data: { twoFactorVerifiedAt: new Date().toISOString() }, overrideAccess: true })
+    const ok = await payload.login({ collection: 'support-clients', data: { email: '2fa@example.com', password: PW } })
+    expect(ok.token).toBeTruthy()
+
+    // Marker is single-use → the next login is blocked again.
+    await expect(
+      payload.login({ collection: 'support-clients', data: { email: '2fa@example.com', password: PW } }),
+    ).rejects.toThrow(/2FA_REQUIRED/)
+  }, 60_000)
+
+  it('lets a non-2FA client log in normally', async () => {
+    const payload = await buildTestPayload()
+    await payload.create({ collection: 'support-clients', data: { email: 'no2fa@example.com', password: PW, firstName: 'N', lastName: 'O', company: 'C' }, overrideAccess: true })
+    const ok = await payload.login({ collection: 'support-clients', data: { email: 'no2fa@example.com', password: PW } })
+    expect(ok.token).toBeTruthy()
+  }, 60_000)
+})

package/src/__tests__/integration/automation-rules.test.ts

@@ -0,0 +1,68 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+
+const PW = 'test-pw-12345'
+
+/**
+ * Automation rules engine (P2 #7): when a ticket event fires and the rule's
+ * conditions match, its actions are applied — in a single guarded update (no loop).
+ */
+describe('automation rules engine (P2 #7)', () => {
+  it('applies actions when conditions match, leaves non-matching tickets untouched', async () => {
+    const payload = await buildTestPayload()
+    await payload.create({
+      collection: 'automation-rules',
+      data: {
+        name: 'Bugs are urgent',
+        enabled: true,
+        event: 'ticket_created',
+        matchType: 'all',
+        order: 0,
+        conditions: [{ field: 'category', operator: 'equals', value: 'bug' }],
+        actions: [{ type: 'set_priority', value: 'urgent' }],
+      },
+      overrideAccess: true,
+    })
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'auto@example.com', password: PW, firstName: 'A', lastName: 'U', company: 'C' }, overrideAccess: true })
+
+    // Matching ticket → priority upgraded to urgent by the rule.
+    const bug = await payload.create({ collection: 'tickets', data: { subject: 'crash', client: c.id, status: 'open', priority: 'normal', category: 'bug' }, overrideAccess: true })
+    const bugRead = await payload.findByID({ collection: 'tickets', id: bug.id, overrideAccess: true })
+    expect(bugRead.priority).toBe('urgent')
+
+    // Non-matching ticket → unchanged.
+    const q = await payload.create({ collection: 'tickets', data: { subject: 'how to', client: c.id, status: 'open', priority: 'normal', category: 'question' }, overrideAccess: true })
+    const qRead = await payload.findByID({ collection: 'tickets', id: q.id, overrideAccess: true })
+    expect(qRead.priority).toBe('normal')
+  }, 60_000)
+
+  it('supports multiple actions and the "any" match type', async () => {
+    const payload = await buildTestPayload()
+    await payload.create({
+      collection: 'automation-rules',
+      data: {
+        name: 'Triage hosting/feature',
+        enabled: true,
+        event: 'ticket_created',
+        matchType: 'any',
+        order: 0,
+        conditions: [
+          { field: 'category', operator: 'equals', value: 'hosting' },
+          { field: 'subject', operator: 'contains', value: 'urgent' },
+        ],
+        actions: [
+          { type: 'set_status', value: 'escalated' },
+          { type: 'set_priority', value: 'high' },
+        ],
+      },
+      overrideAccess: true,
+    })
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'auto2@example.com', password: PW, firstName: 'A', lastName: 'U', company: 'C' }, overrideAccess: true })
+
+    // Matches via subject contains "urgent" (any) → both actions applied.
+    const t = await payload.create({ collection: 'tickets', data: { subject: 'this is URGENT please', client: c.id, status: 'open', priority: 'low', category: 'question' }, overrideAccess: true })
+    const r = await payload.findByID({ collection: 'tickets', id: t.id, overrideAccess: true })
+    expect(r.status).toBe('escalated')
+    expect(r.priority).toBe('high')
+  }, 60_000)
+})

package/src/__tests__/integration/buildTestPayload.ts

@@ -0,0 +1,52 @@
+import { buildConfig, getPayload, type Payload, type CollectionConfig, type SanitizedConfig } from 'payload'
+import { sqliteAdapter } from '@payloadcms/db-sqlite'
+import { lexicalEditor } from '@payloadcms/richtext-lexical'
+import sharp from 'sharp'
+import { supportPlugin } from '../../plugin'
+
+/**
+ * Boots a real Payload instance backed by an in-memory SQLite database, with the
+ * support plugin applied. Used by integration tests to exercise access control,
+ * hooks and endpoints for real (the unit tests only cover pure functions).
+ *
+ * `skipViews: true` avoids loading the admin view components (which resolve to the
+ * built dist subpath and need bundling) — integration tests use the Local API only.
+ */
+
+// Minimal host collections the plugin relies on.
+const Users: CollectionConfig = {
+  slug: 'users',
+  auth: true,
+  fields: [{ name: 'name', type: 'text' }],
+}
+
+const Media: CollectionConfig = {
+  slug: 'media',
+  upload: { staticDir: '/tmp/payload-support-test-media' },
+  fields: [{ name: 'alt', type: 'text' }],
+}
+
+let cached: Promise<Payload> | null = null
+
+export function buildTestPayload(): Promise<Payload> {
+  if (cached) return cached
+  process.env.PAYLOAD_SECRET = process.env.PAYLOAD_SECRET || 'test-secret-payload-support-integration'
+  cached = (async () => {
+    const config: SanitizedConfig = await buildConfig({
+      secret: process.env.PAYLOAD_SECRET as string,
+      db: sqliteAdapter({ client: { url: ':memory:' } }),
+      editor: lexicalEditor(),
+      collections: [Users, Media],
+      plugins: [
+        supportPlugin({
+          features: { chat: false, pendingEmails: false },
+          skipViews: true,
+        }),
+      ],
+      sharp,
+      telemetry: false,
+    })
+    return getPayload({ config })
+  })()
+  return cached
+}

package/src/__tests__/integration/channels.test.ts

@@ -0,0 +1,52 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+import { createChannelsWebhookEndpoint } from '../../endpoints/channels'
+import { resolveSlugs } from '../../utils/slugs'
+
+const slugs = resolveSlugs({ users: 'users' })
+
+/**
+ * Social channels (roadmap): the inbound webhook turns a normalized WhatsApp /
+ * Messenger message into a ticket (creating the channel client on first contact)
+ * and appends follow-ups to the same open ticket.
+ */
+describe('social channels inbound webhook (roadmap)', () => {
+  it('creates a ticket from a WhatsApp message, then appends follow-ups', async () => {
+    const payload = await buildTestPayload()
+    process.env.CHANNELS_WEBHOOK_SECRET = 'test-channel-secret'
+    const ep = createChannelsWebhookEndpoint(slugs)
+    const post = (payloadBody: unknown) =>
+      (ep.handler as (r: unknown) => Promise<Response>)({
+        payload,
+        headers: new Headers({ 'x-channel-secret': 'test-channel-secret' }),
+        json: async () => payloadBody,
+      })
+
+    const res1 = await post({ provider: 'whatsapp', from: '33612345678', name: 'Jean', text: "Bonjour, j'ai besoin d'aide" })
+    const j1 = await res1.json()
+    expect(j1.ok).toBe(true)
+    expect(j1.createdTicket).toBe(true)
+
+    const ticket = await payload.findByID({ collection: 'tickets', id: j1.ticketId, overrideAccess: true })
+    expect(ticket.source).toBe('whatsapp')
+
+    const msgs1 = await payload.find({ collection: 'ticket-messages', where: { ticket: { equals: j1.ticketId } }, overrideAccess: true })
+    expect(msgs1.docs.some((m) => ((m as { body?: string }).body || '').includes("besoin d'aide"))).toBe(true)
+
+    // Follow-up from the same sender → same ticket, no new ticket.
+    const res2 = await post({ provider: 'whatsapp', from: '33612345678', text: 'Toujours bloqué' })
+    const j2 = await res2.json()
+    expect(j2.createdTicket).toBe(false)
+    expect(String(j2.ticketId)).toBe(String(j1.ticketId))
+  }, 60_000)
+
+  it('rejects without the channel secret', async () => {
+    const payload = await buildTestPayload()
+    process.env.CHANNELS_WEBHOOK_SECRET = 'test-channel-secret'
+    const ep = createChannelsWebhookEndpoint(slugs)
+    const res = await (ep.handler as (r: unknown) => Promise<Response>)({
+      payload, headers: new Headers({}), json: async () => ({ provider: 'whatsapp', from: 'x', text: 'y' }),
+    })
+    expect(res.status).toBe(401)
+  }, 60_000)
+})

package/src/__tests__/integration/core-behaviors.test.ts

@@ -0,0 +1,58 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+
+const PW = 'test-pw-12345'
+
+async function makeClient(payload: Awaited<ReturnType<typeof buildTestPayload>>, email: string) {
+  return payload.create({ collection: 'support-clients', data: { email, password: PW, firstName: 'C', lastName: 'C', company: 'C' }, overrideAccess: true })
+}
+
+/**
+ * Regression coverage for core ticketing behaviours that the P2 features will be
+ * built on top of: ticket numbering, auto-status transitions on reply, and SLA
+ * deadline assignment.
+ */
+describe('core ticketing behaviours', () => {
+  it('auto-assigns a unique TK- number to each ticket', async () => {
+    const payload = await buildTestPayload()
+    const c = await makeClient(payload, 'num@example.com')
+    const t1 = await payload.create({ collection: 'tickets', data: { subject: 'one', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+    const t2 = await payload.create({ collection: 'tickets', data: { subject: 'two', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+    expect(t1.ticketNumber).toMatch(/^TK-\d{4}/)
+    expect(t2.ticketNumber).toMatch(/^TK-\d{4}/)
+    expect(t1.ticketNumber).not.toBe(t2.ticketNumber)
+  }, 60_000)
+
+  it('moves status to waiting_client on admin reply and back to open on client reply', async () => {
+    const payload = await buildTestPayload()
+    const c = await makeClient(payload, 'status@example.com')
+    const t = await payload.create({ collection: 'tickets', data: { subject: 'flow', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+
+    await payload.create({ collection: 'ticket-messages', data: { ticket: t.id, body: 'admin reply', authorType: 'admin' }, overrideAccess: true })
+    let reread = await payload.findByID({ collection: 'tickets', id: t.id, overrideAccess: true })
+    expect(reread.status).toBe('waiting_client')
+
+    await payload.create({ collection: 'ticket-messages', data: { ticket: t.id, body: 'client reply', authorType: 'client', authorClient: c.id }, overrideAccess: true })
+    reread = await payload.findByID({ collection: 'tickets', id: t.id, overrideAccess: true })
+    expect(reread.status).toBe('open')
+  }, 60_000)
+
+  it('assigns SLA deadlines on create from the default policy', async () => {
+    const payload = await buildTestPayload()
+    await payload.create({
+      collection: 'sla-policies',
+      data: { name: 'Default', priority: 'normal', firstResponseTime: 60, resolutionTime: 240, businessHoursOnly: false, isDefault: true },
+      overrideAccess: true,
+    })
+    const c = await makeClient(payload, 'sla@example.com')
+    const t = await payload.create({ collection: 'tickets', data: { subject: 'sla', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+
+    const reread = await payload.findByID({ collection: 'tickets', id: t.id, overrideAccess: true })
+    expect(reread.slaFirstResponseDue).toBeTruthy()
+    expect(reread.slaResolutionDue).toBeTruthy()
+    // resolution deadline must be later than the first-response deadline
+    expect(new Date(reread.slaResolutionDue as string).getTime()).toBeGreaterThan(
+      new Date(reread.slaFirstResponseDue as string).getTime(),
+    )
+  }, 60_000)
+})

package/src/__tests__/integration/dashboard-volume.test.ts

@@ -0,0 +1,31 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+import { createAdminStatsEndpoint } from '../../endpoints/admin-stats'
+import { resolveSlugs } from '../../utils/slugs'
+
+const slugs = resolveSlugs({ users: 'users' })
+const PW = 'test-pw-12345'
+
+/**
+ * Dashboard real volume series (P2 #4): admin-stats returns a real per-day ticket
+ * count for the last 7 days (replacing the previous synthetic distribution).
+ */
+describe('dashboard real volume series (P2 #4)', () => {
+  it('returns 7 chronological daily buckets, today reflecting created tickets', async () => {
+    const payload = await buildTestPayload()
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'vol@example.com', password: PW, firstName: 'V', lastName: 'O', company: 'C' }, overrideAccess: true })
+    for (let i = 0; i < 3; i++) {
+      await payload.create({ collection: 'tickets', data: { subject: `v${i}`, client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+    }
+
+    const admin = await payload.create({ collection: 'users', data: { email: 'vol-admin@example.com', password: PW } as never, overrideAccess: true })
+    const ep = createAdminStatsEndpoint(slugs)
+    const req = { payload, user: { ...admin, collection: 'users' }, url: 'http://localhost/api/support/admin-stats', headers: new Headers({}) }
+    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
+    const json = await res.json()
+
+    expect(Array.isArray(json.volumeByDay)).toBe(true)
+    expect(json.volumeByDay).toHaveLength(7)
+    expect(json.volumeByDay[6].count).toBeGreaterThanOrEqual(3) // today (last bucket)
+  }, 60_000)
+})

package/src/__tests__/integration/digest.test.ts

@@ -0,0 +1,48 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+import { createProcessDigestsEndpoint } from '../../endpoints/process-digests'
+import { resolveSlugs } from '../../utils/slugs'
+
+const slugs = resolveSlugs({ users: 'users' })
+const PW = 'test-pw-12345'
+
+/**
+ * Digest notifications (P2 #5): clients on daily/weekly frequency have their reply
+ * notifications queued instead of emailed immediately, then drained as one recap
+ * by the process-digests cron. Immediate-frequency clients are never queued.
+ */
+describe('digest notifications (P2 #5)', () => {
+  it('queues reply notifications for daily clients and drains them via the cron', async () => {
+    const payload = await buildTestPayload()
+    process.env.CRON_SECRET = 'test-cron-secret'
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'digest@example.com', password: PW, firstName: 'D', lastName: 'G', company: 'C', notificationFrequency: 'daily' }, overrideAccess: true })
+    const t = await payload.create({ collection: 'tickets', data: { subject: 'digest', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+
+    // Admin reply → queued (client is on daily cadence), not emailed.
+    await payload.create({ collection: 'ticket-messages', data: { ticket: t.id, body: 'admin reply', authorType: 'admin' }, overrideAccess: true })
+
+    const queued = await payload.find({ collection: 'notification-queue', where: { client: { equals: c.id } }, overrideAccess: true })
+    expect(queued.totalDocs).toBe(1)
+
+    // Daily digest cron drains the queue.
+    const ep = createProcessDigestsEndpoint(slugs)
+    const req = { payload, headers: new Headers({ 'x-cron-secret': 'test-cron-secret' }), json: async () => ({ frequency: 'daily' }) }
+    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
+    const json = await res.json()
+    expect(json.ok).toBe(true)
+    expect(json.items).toBeGreaterThanOrEqual(1)
+
+    const after = await payload.find({ collection: 'notification-queue', where: { client: { equals: c.id } }, overrideAccess: true })
+    expect(after.totalDocs).toBe(0)
+  }, 60_000)
+
+  it('does not queue for immediate-frequency clients', async () => {
+    const payload = await buildTestPayload()
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'imm@example.com', password: PW, firstName: 'I', lastName: 'M', company: 'C' }, overrideAccess: true })
+    const t = await payload.create({ collection: 'tickets', data: { subject: 'imm', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+    await payload.create({ collection: 'ticket-messages', data: { ticket: t.id, body: 'admin reply', authorType: 'admin' }, overrideAccess: true })
+
+    const queued = await payload.find({ collection: 'notification-queue', where: { client: { equals: c.id } }, overrideAccess: true })
+    expect(queued.totalDocs).toBe(0)
+  }, 60_000)
+})

package/src/__tests__/integration/invoice-pdf.test.ts

@@ -0,0 +1,30 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+import { createInvoiceEndpoint } from '../../endpoints/invoice'
+import { resolveSlugs } from '../../utils/slugs'
+
+const slugs = resolveSlugs({ users: 'users' })
+const PW = 'test-pw-12345'
+
+/** Native binary PDF invoice (roadmap): `format=pdf` returns a real PDF document. */
+describe('binary PDF invoice (roadmap)', () => {
+  it('returns an application/pdf document with the %PDF header', async () => {
+    const payload = await buildTestPayload()
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'pdf@example.com', password: PW, firstName: 'P', lastName: 'D', company: 'ACME Corp' }, overrideAccess: true })
+    await payload.create({ collection: 'tickets', data: { subject: 'pdf-a', client: c.id, status: 'resolved', priority: 'normal', billable: true, billedAmount: 100 }, overrideAccess: true })
+    await payload.create({ collection: 'tickets', data: { subject: 'pdf-b', client: c.id, status: 'resolved', priority: 'normal', billable: true, billedAmount: 50 }, overrideAccess: true })
+
+    const admin = await payload.create({ collection: 'users', data: { email: 'pdf-admin@example.com', password: PW } as never, overrideAccess: true })
+    const from = new Date(Date.now() - 86_400_000).toISOString().slice(0, 10)
+    const to = new Date(Date.now() + 86_400_000).toISOString().slice(0, 10)
+    const ep = createInvoiceEndpoint(slugs)
+    const req = { payload, user: { ...admin, collection: 'users' }, url: `http://localhost/api/support/billing/invoice?from=${from}&to=${to}&format=pdf`, headers: new Headers({}) }
+    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
+
+    expect(res.status).toBe(200)
+    expect(res.headers.get('content-type')).toMatch(/application\/pdf/)
+    const buf = Buffer.from(await res.arrayBuffer())
+    expect(buf.subarray(0, 4).toString('latin1')).toBe('%PDF')
+    expect(buf.length).toBeGreaterThan(500)
+  }, 60_000)
+})

package/src/__tests__/integration/isolation.test.ts

@@ -0,0 +1,81 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+
+const PW = 'test-pw-12345'
+
+/**
+ * Validates the cross-client isolation fix (P0-4): a support-client must never
+ * read another client's ticket messages / activity, and field-level access
+ * (P0-7) must hide admin-only fields from the client's own doc.
+ */
+describe('cross-client isolation (P0-4 / P0-7)', () => {
+  it('a client cannot read another client\'s ticket messages', async () => {
+    const payload = await buildTestPayload()
+
+    const a = await payload.create({ collection: 'support-clients', data: { email: 'iso-a@example.com', password: PW, firstName: 'A', lastName: 'A', company: 'A' }, overrideAccess: true })
+    const b = await payload.create({ collection: 'support-clients', data: { email: 'iso-b@example.com', password: PW, firstName: 'B', lastName: 'B', company: 'B' }, overrideAccess: true })
+
+    const ta = await payload.create({ collection: 'tickets', data: { subject: 'A ticket', client: a.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+    const tb = await payload.create({ collection: 'tickets', data: { subject: 'B ticket', client: b.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+
+    await payload.create({ collection: 'ticket-messages', data: { ticket: ta.id, body: 'SECRET-A-MESSAGE', authorType: 'admin' }, overrideAccess: true })
+    await payload.create({ collection: 'ticket-messages', data: { ticket: tb.id, body: 'SECRET-B-MESSAGE', authorType: 'admin' }, overrideAccess: true })
+
+    // Read messages AS client A, with access control enforced.
+    const asA = await payload.find({
+      collection: 'ticket-messages',
+      overrideAccess: false,
+      user: { ...a, collection: 'support-clients' } as never,
+      limit: 200,
+    })
+    const bodies = asA.docs.map((m) => (m as { body?: string }).body)
+
+    expect(bodies).toContain('SECRET-A-MESSAGE')
+    expect(bodies).not.toContain('SECRET-B-MESSAGE') // ← the cross-client boundary
+  }, 60_000)
+
+  it('a client cannot read another client\'s activity log', async () => {
+    const payload = await buildTestPayload()
+
+    const a = await payload.create({ collection: 'support-clients', data: { email: 'act-a@example.com', password: PW, firstName: 'A', lastName: 'A', company: 'A' }, overrideAccess: true })
+    const b = await payload.create({ collection: 'support-clients', data: { email: 'act-b@example.com', password: PW, firstName: 'B', lastName: 'B', company: 'B' }, overrideAccess: true })
+    const ta = await payload.create({ collection: 'tickets', data: { subject: 'A', client: a.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+    const tb = await payload.create({ collection: 'tickets', data: { subject: 'B', client: b.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+    await payload.create({ collection: 'ticket-activity-log', data: { ticket: ta.id, action: 'status_changed', detail: 'ACT-A' }, overrideAccess: true })
+    await payload.create({ collection: 'ticket-activity-log', data: { ticket: tb.id, action: 'status_changed', detail: 'ACT-B' }, overrideAccess: true })
+
+    const asA = await payload.find({
+      collection: 'ticket-activity-log',
+      overrideAccess: false,
+      user: { ...a, collection: 'support-clients' } as never,
+      limit: 200,
+    })
+    const details = asA.docs.map((m) => (m as { detail?: string }).detail)
+    expect(details).toContain('ACT-A')
+    expect(details).not.toContain('ACT-B')
+  }, 60_000)
+
+  it('does not serialize admin-only opportunities/notes to the client (P0-7)', async () => {
+    const payload = await buildTestPayload()
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'fa@example.com', password: PW, firstName: 'F', lastName: 'A', company: 'C', opportunities: 'SECRET-DEAL', notes: 'INTERNAL-NOTE' }, overrideAccess: true })
+
+    const asClient = await payload.findByID({
+      collection: 'support-clients',
+      id: c.id,
+      overrideAccess: false,
+      user: { ...c, collection: 'support-clients' } as never,
+    })
+    expect((asClient as { opportunities?: string }).opportunities).toBeFalsy()
+    expect((asClient as { notes?: string }).notes).toBeFalsy()
+
+    // Admin (users collection) still sees them.
+    const admin = await payload.create({ collection: 'users', data: { email: 'admin-fa@example.com', password: PW } as never, overrideAccess: true })
+    const asAdmin = await payload.findByID({
+      collection: 'support-clients',
+      id: c.id,
+      overrideAccess: false,
+      user: { ...admin, collection: 'users' } as never,
+    })
+    expect((asAdmin as { opportunities?: string }).opportunities).toBe('SECRET-DEAL')
+  }, 60_000)
+})