@consilioweb/payload-support 0.16.0 → 1.0.0

package/src/endpoints/import-conversation.ts

@@ -2,6 +2,7 @@ import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { RateLimiter } from '../utils/rateLimiter'
 import { readSupportSettings } from '../utils/readSettings'
+import { dbFind, dbCreate } from '../utils/db'
 import crypto from 'crypto'
 
 interface ParsedConversation {
@@ -215,8 +216,7 @@ export function createImportConversationEndpoint(slugs: CollectionSlugs): Endpoi
         }
 
         // Find or create support client
-        const clientResult = await payload.find({
-          collection: slugs.supportClients as any,
+        const clientResult = await dbFind(payload, slugs.supportClients, {
           where: { email: { equals: conversation.client.email } },
           limit: 1,
           depth: 0,
@@ -230,8 +230,7 @@ export function createImportConversationEndpoint(slugs: CollectionSlugs): Endpoi
           const nameParts = conversation.client.name.split(' ')
           const randomPassword = crypto.randomBytes(48).toString('base64url')
 
-          client = await payload.create({
-            collection: slugs.supportClients as any,
+          client = await dbCreate(payload, slugs.supportClients, {
             data: {
               email: conversation.client.email,
               password: randomPassword,
@@ -245,8 +244,7 @@ export function createImportConversationEndpoint(slugs: CollectionSlugs): Endpoi
         }
 
         // Find admin user for authorAdmin
-        const adminUsers = await payload.find({
-          collection: slugs.users as any,
+        const adminUsers = await dbFind(payload, slugs.users, {
           limit: 1,
           depth: 0,
           overrideAccess: true,
@@ -254,8 +252,7 @@ export function createImportConversationEndpoint(slugs: CollectionSlugs): Endpoi
         const adminUserId = adminUsers.docs[0]?.id
 
         // Create ticket
-        const ticket = await payload.create({
-          collection: slugs.tickets as any,
+        const ticket = await dbCreate(payload, slugs.tickets, {
           data: {
             subject: conversation.subject,
             client: client.id,
@@ -271,8 +268,7 @@ export function createImportConversationEndpoint(slugs: CollectionSlugs): Endpoi
         for (const msg of conversation.messages) {
           const isAdmin = msg.from === 'admin'
 
-          await payload.create({
-            collection: slugs.ticketMessages as any,
+          await dbCreate(payload, slugs.ticketMessages, {
             data: {
               ticket: ticket.id,
               body: msg.content,

package/src/endpoints/index.ts

@@ -3,6 +3,7 @@ import type { CollectionSlugs } from '../utils/slugs'
 import type { SupportFeatures } from '../types'
 
 import { createAiEndpoint } from './ai'
+import { createAiAgentEndpoint } from './ai-agent'
 import { createClientIntelligenceEndpoint } from './client-intelligence'
 import { createSearchEndpoint } from './search'
 import { createKbSearchEndpoint } from './kb-search'
@@ -27,6 +28,7 @@ import { createAdminChatGetEndpoint, createAdminChatPostEndpoint } from './admin
 import { createAdminChatStreamEndpoint } from './admin-chat-stream'
 import { createAdminStatsEndpoint } from './admin-stats'
 import { createBillingEndpoint } from './billing'
+import { createInvoiceEndpoint } from './invoice'
 import { createTicketSynthesisEndpoint } from './ticket-synthesis'
 import { createEmailStatsEndpoint } from './email-stats'
 import { createSatisfactionEndpoint } from './satisfaction'
@@ -43,6 +45,9 @@ import { createDeleteAccountEndpoint } from './delete-account'
 import { createMergeClientsEndpoint } from './merge-clients'
 import { createImportConversationEndpoint } from './import-conversation'
 import { createProcessScheduledEndpoint } from './process-scheduled'
+import { createProcessSnoozeEndpoint } from './process-snooze'
+import { createProcessDigestsEndpoint } from './process-digests'
+import { createChannelsWebhookEndpoint } from './channels'
 import { createUserPrefsGetEndpoint, createUserPrefsPostEndpoint } from './user-prefs'
 import { createEscalateEndpoint } from './escalate'
 import { createTicketFeedbackEndpoint } from './ticket-feedback'
@@ -51,6 +56,7 @@ import { createInviteCollaboratorEndpoint } from './invite-collaborator'
 
 // Re-export all individual endpoint creators
 export { createAiEndpoint } from './ai'
+export { createAiAgentEndpoint } from './ai-agent'
 export { createSearchEndpoint } from './search'
 export { createKbSearchEndpoint } from './kb-search'
 export { createBulkActionEndpoint } from './bulk-action'
@@ -74,6 +80,7 @@ export { createAdminChatGetEndpoint, createAdminChatPostEndpoint } from './admin
 export { createAdminChatStreamEndpoint } from './admin-chat-stream'
 export { createAdminStatsEndpoint } from './admin-stats'
 export { createBillingEndpoint } from './billing'
+export { createInvoiceEndpoint } from './invoice'
 export { createTicketSynthesisEndpoint } from './ticket-synthesis'
 export { createEmailStatsEndpoint } from './email-stats'
 export { createSatisfactionEndpoint } from './satisfaction'
@@ -90,6 +97,9 @@ export { createDeleteAccountEndpoint } from './delete-account'
 export { createMergeClientsEndpoint } from './merge-clients'
 export { createImportConversationEndpoint } from './import-conversation'
 export { createProcessScheduledEndpoint } from './process-scheduled'
+export { createProcessSnoozeEndpoint } from './process-snooze'
+export { createProcessDigestsEndpoint } from './process-digests'
+export { createChannelsWebhookEndpoint } from './channels'
 export { createUserPrefsGetEndpoint, createUserPrefsPostEndpoint } from './user-prefs'
 export type { UserPrefs } from './user-prefs'
 export { createEscalateEndpoint } from './escalate'
@@ -139,6 +149,7 @@ export function createSupportEndpoints(slugs: CollectionSlugs, options?: Support
   // Conditional endpoints based on feature flags
   if (!f || f.ai !== false) {
     endpoints.push(createAiEndpoint(slugs))
+    endpoints.push(createAiAgentEndpoint(slugs))
     endpoints.push(...createClientIntelligenceEndpoint(slugs))
     endpoints.push(createTicketSynthesisEndpoint(slugs))
   }
@@ -169,13 +180,19 @@ export function createSupportEndpoints(slugs: CollectionSlugs, options?: Support
     endpoints.push(createAdminChatGetEndpoint(slugs), createAdminChatPostEndpoint(slugs))
     endpoints.push(createAdminChatStreamEndpoint(slugs))
   }
-  if (!f || f.timeTracking !== false) endpoints.push(createBillingEndpoint(slugs))
+  if (!f || f.timeTracking !== false) {
+    endpoints.push(createBillingEndpoint(slugs))
+    endpoints.push(createInvoiceEndpoint(slugs))
+  }
   if (!f || f.satisfaction !== false) endpoints.push(createSatisfactionEndpoint(slugs))
   if (!f || f.emailTracking !== false) {
     endpoints.push(createEmailStatsEndpoint(slugs), createTrackOpenEndpoint(slugs))
   }
   if (!f || f.pendingEmails !== false) endpoints.push(createPendingEmailsProcessEndpoint(slugs))
   if (!f || f.scheduledReplies !== false) endpoints.push(createProcessScheduledEndpoint(slugs))
+  if (!f || f.snooze !== false) endpoints.push(createProcessSnoozeEndpoint(slugs))
+  endpoints.push(createProcessDigestsEndpoint(slugs))
+  endpoints.push(createChannelsWebhookEndpoint(slugs))
 
   return endpoints
 }

package/src/endpoints/invite-collaborator.ts

@@ -4,9 +4,16 @@ import { handleAuthError, AuthError } from '../utils/auth'
 import { escapeHtml, emailWrapper, emailButton, emailParagraph } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
 import { randomBytes } from 'crypto'
+import { RateLimiter } from '../utils/rateLimiter'
+import { dbFindByID, dbFind, dbCreate, dbUpdate, dbCount } from '../utils/db'
 
 const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
 
+// Anti-abuse limits: an invite can create a placeholder account AND send an
+// email, so cap both the volume per user and the collaborators per ticket.
+const MAX_COLLABORATORS_PER_TICKET = 20
+const inviteLimiter = new RateLimiter(60 * 60 * 1000, 10)
+
 /**
  * POST /api/support/tickets/:id/invite
  *
@@ -52,12 +59,11 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs): Endpoi
 
         const payload = req.payload
 
-        const ticket = await payload.findByID({
-          collection: slugs.tickets as any,
+        const ticket = await dbFindByID(payload, slugs.tickets, {
           id: ticketId,
           depth: 1,
           overrideAccess: true,
-        }) as any
+        })
         if (!ticket) return Response.json({ error: 'Ticket introuvable' }, { status: 404 })
 
         const isAdmin = req.user.collection === slugs.users
@@ -68,6 +74,21 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs): Endpoi
           return Response.json({ error: 'Forbidden' }, { status: 403 })
         }
 
+        // Anti-abuse: cap invite volume per user (in-memory, fail-closed).
+        if (inviteLimiter.check(String(req.user.id))) {
+          return Response.json({ error: 'Trop d\'invitations. Réessayez plus tard.' }, { status: 429 })
+        }
+
+        // Cap collaborators per ticket to prevent mass placeholder-account creation.
+        const collabCount = await dbCount(payload, 'ticket-collaborators', { where: { ticket: { equals: ticketId } }, overrideAccess: true })
+          .catch(() => ({ totalDocs: 0 }))
+        if (collabCount.totalDocs >= MAX_COLLABORATORS_PER_TICKET) {
+          return Response.json(
+            { error: `Limite de ${MAX_COLLABORATORS_PER_TICKET} collaborateurs atteinte sur ce ticket` },
+            { status: 429 },
+          )
+        }
+
         // Prevent inviting the primary owner (no-op)
         const ownerEmail =
           typeof ticket.client === 'object' ? (ticket.client?.email as string | undefined) : undefined
@@ -77,8 +98,7 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs): Endpoi
 
         // Find-or-create the invited support-client
         let inviteeId: number | string | null = null
-        const existing = await payload.find({
-          collection: slugs.supportClients as any,
+        const existing = await dbFind(payload, slugs.supportClients, {
           where: { email: { equals: email } },
           limit: 1,
           depth: 0,
@@ -90,8 +110,7 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs): Endpoi
           // Create a placeholder client; password is random — the invitee will reset
           // via the forgotPassword flow triggered by the SupportClients afterChange hook.
           const tempPassword = randomBytes(16).toString('hex')
-          const created = await payload.create({
-            collection: slugs.supportClients as any,
+          const created = await dbCreate(payload, slugs.supportClients, {
             data: {
               email,
               firstName: 'Invité',
@@ -111,8 +130,7 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs): Endpoi
         }
 
         // Upsert ticket-collaborator row (one per (ticket, client))
-        const dupe = await payload.find({
-          collection: 'ticket-collaborators' as any,
+        const dupe = await dbFind(payload, 'ticket-collaborators', {
           where: {
             and: [
               { ticket: { equals: ticketId } },
@@ -127,15 +145,13 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs): Endpoi
         const invitationToken = randomBytes(24).toString('hex')
 
         if (dupe.docs.length > 0) {
-          await payload.update({
-            collection: 'ticket-collaborators' as any,
+          await dbUpdate(payload, 'ticket-collaborators', {
             id: (dupe.docs[0] as any).id,
             data: { role, invitationToken },
             overrideAccess: true,
           })
         } else {
-          await payload.create({
-            collection: 'ticket-collaborators' as any,
+          await dbCreate(payload, 'ticket-collaborators', {
             data: {
               ticket: ticketId,
               client: inviteeId,
@@ -187,8 +203,7 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs): Endpoi
 
         // Best-effort email log
         try {
-          await payload.create({
-            collection: slugs.emailLogs as any,
+          await dbCreate(payload, slugs.emailLogs, {
             data: {
               status: 'success',
               action: 'invite',

package/src/endpoints/invoice.ts

@@ -0,0 +1,127 @@
+import type { Endpoint, Where } from 'payload'
+import type { CollectionSlugs } from '../utils/slugs'
+import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFind } from '../utils/db'
+import { escapeHtml } from '../utils/emailTemplate'
+import { generateInvoicePdf, type InvoiceLine } from '../utils/invoicePdf'
+
+/**
+ * GET /api/support/billing/invoice?from=YYYY-MM-DD&to=YYYY-MM-DD&projectId=...&format=html|pdf
+ *
+ * Admin-only. Renders an invoice for the billable tickets active in the period.
+ * `format=pdf` returns a real binary PDF (pdfkit); otherwise a self-contained,
+ * print-ready HTML document. Defaults to HTML.
+ */
+export function createInvoiceEndpoint(slugs: CollectionSlugs): Endpoint {
+  return {
+    path: '/support/billing/invoice',
+    method: 'get',
+    handler: async (req) => {
+      try {
+        requireAdmin(req, slugs)
+        const payload = req.payload
+        const url = new URL(req.url!)
+        const from = url.searchParams.get('from')
+        const to = url.searchParams.get('to')
+        const projectId = url.searchParams.get('projectId')
+        const format = url.searchParams.get('format') === 'pdf' ? 'pdf' : 'html'
+        if (!from || !to) {
+          return Response.json({ error: 'Paramètres from et to requis.' }, { status: 400 })
+        }
+
+        const toExclusive = new Date(to)
+        toExclusive.setDate(toExclusive.getDate() + 1)
+        const toIso = toExclusive.toISOString()
+
+        const where: Where = {
+          and: [
+            { billable: { equals: true } },
+            ...(projectId ? [{ project: { equals: Number(projectId) } } as Where] : []),
+            {
+              or: [
+                { and: [{ updatedAt: { greater_than_equal: from } }, { updatedAt: { less_than: toIso } }] },
+                { and: [{ createdAt: { greater_than_equal: from } }, { createdAt: { less_than: toIso } }] },
+                { and: [{ resolvedAt: { greater_than_equal: from } }, { resolvedAt: { less_than: toIso } }] },
+              ],
+            },
+          ],
+        }
+
+        const tickets: Array<Record<string, unknown>> = []
+        let page = 1
+        let hasMore = true
+        while (hasMore && page <= 50) {
+          const batch = await dbFind(payload, slugs.tickets, {
+            where, limit: 500, page, depth: 2, overrideAccess: true,
+            select: { ticketNumber: true, subject: true, billedAmount: true, totalTimeMinutes: true, project: true, client: true },
+          })
+          tickets.push(...(batch.docs as Array<Record<string, unknown>>))
+          hasMore = batch.hasNextPage ?? false
+          page++
+        }
+
+        // Shared structured lines (used by both HTML and PDF renderers).
+        let totalAmount = 0
+        let totalMinutes = 0
+        const lines: InvoiceLine[] = tickets.map((t) => {
+          const amount = typeof t.billedAmount === 'number' ? t.billedAmount : 0
+          const minutes = typeof t.totalTimeMinutes === 'number' ? t.totalTimeMinutes : 0
+          totalAmount += amount
+          totalMinutes += minutes
+          const client = typeof t.client === 'object' && t.client ? (t.client as { company?: string }).company || '' : ''
+          return { ticketNumber: String(t.ticketNumber || ''), subject: String(t.subject || ''), client, minutes, amount }
+        })
+
+        if (format === 'pdf') {
+          const pdf = await generateInvoicePdf({ from, to, projectId, lines, totalMinutes, totalAmount })
+          return new Response(new Uint8Array(pdf), {
+            status: 200,
+            headers: {
+              'Content-Type': 'application/pdf',
+              'Content-Disposition': `inline; filename="invoice-${from}_${to}.pdf"`,
+            },
+          })
+        }
+
+        const fmtAmount = (n: number) => `${n.toFixed(2)} €`
+        const fmtTime = (min: number) => `${Math.floor(min / 60)}h${String(min % 60).padStart(2, '0')}`
+        const rows = lines.map((l) => `<tr>
+            <td>${escapeHtml(l.ticketNumber)}</td>
+            <td>${escapeHtml(l.subject)}</td>
+            <td>${escapeHtml(l.client)}</td>
+            <td style="text-align:right;">${fmtTime(l.minutes)}</td>
+            <td style="text-align:right;">${fmtAmount(l.amount)}</td>
+          </tr>`).join('')
+
+        const html = `<!doctype html>
+<html lang="fr"><head><meta charset="utf-8"><title>Facture ${escapeHtml(from)} → ${escapeHtml(to)}</title>
+<style>
+  body { font-family: system-ui, -apple-system, sans-serif; color: #1e293b; max-width: 820px; margin: 32px auto; padding: 0 24px; }
+  h1 { font-size: 22px; margin: 0 0 4px; }
+  .period { color: #64748b; margin-bottom: 24px; }
+  table { width: 100%; border-collapse: collapse; font-size: 14px; }
+  th, td { padding: 8px 10px; border-bottom: 1px solid #e2e8f0; text-align: left; }
+  th { background: #f8fafc; font-size: 12px; text-transform: uppercase; letter-spacing: .04em; color: #475569; }
+  tfoot td { font-weight: 700; border-top: 2px solid #0f172a; border-bottom: none; }
+  @media print { body { margin: 0; } }
+</style></head>
+<body>
+  <h1>Facture / Pré-facture</h1>
+  <div class="period">Période : ${escapeHtml(from)} → ${escapeHtml(to)}${projectId ? ` · Projet #${escapeHtml(projectId)}` : ''}</div>
+  <table>
+    <thead><tr><th>Ticket</th><th>Sujet</th><th>Client</th><th style="text-align:right;">Temps</th><th style="text-align:right;">Montant</th></tr></thead>
+    <tbody>${rows || '<tr><td colspan="5" style="color:#94a3b8;">Aucun ticket facturable sur la période.</td></tr>'}</tbody>
+    <tfoot><tr><td colspan="3">Total (${lines.length} ticket${lines.length > 1 ? 's' : ''})</td><td style="text-align:right;">${fmtTime(totalMinutes)}</td><td style="text-align:right;">${fmtAmount(totalAmount)}</td></tr></tfoot>
+  </table>
+</body></html>`
+
+        return new Response(html, { status: 200, headers: { 'Content-Type': 'text/html; charset=utf-8' } })
+      } catch (error) {
+        const authResponse = handleAuthError(error)
+        if (authResponse) return authResponse
+        console.error('[invoice] Error:', error)
+        return Response.json({ error: 'Erreur interne' }, { status: 500 })
+      }
+    },
+  }
+}

package/src/endpoints/kb-search.ts

@@ -1,5 +1,6 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
+import { dbFind } from '../utils/db'
 
 // Combining diacritics range used to strip accents after NFD normalization.
 const DIACRITICS = /[̀-ͯ]/g
@@ -107,8 +108,7 @@ export function createKbSearchEndpoint(slugs: CollectionSlugs): Endpoint {
         // Always include the raw query for short single-word matches.
         orClauses.push({ title: { contains: q } })
 
-        const res = await payload.find({
-          collection: slugs.knowledgeBase as any,
+        const res = await dbFind(payload, slugs.knowledgeBase, {
           where: {
             and: [
               { published: { equals: true } },

package/src/endpoints/login.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { RateLimiter } from '../utils/rateLimiter'
+import { dbCreate } from '../utils/db'
 
 const loginLimiter = new RateLimiter(15 * 60_000, 10) // 10 per 15 min
 
@@ -13,6 +14,9 @@ export function createLoginEndpoint(slugs: CollectionSlugs): Endpoint {
     path: '/support/login',
     method: 'post',
     handler: async (req) => {
+      // NOTE: x-forwarded-for is spoofable unless this app sits strictly behind a
+      // trusted proxy that rewrites it. This IP rate-limit is a SECONDARY defense;
+      // the primary brute-force control is Payload's account lock (maxLoginAttempts).
       const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || req.headers.get('x-real-ip') || 'unknown'
 
       if (loginLimiter.check(ip)) {
@@ -43,8 +47,7 @@ export function createLoginEndpoint(slugs: CollectionSlugs): Endpoint {
         })
 
         // Log successful login (fire-and-forget)
-        payload.create({
-          collection: slugs.authLogs as any,
+        dbCreate(payload, slugs.authLogs, {
           data: { email, success: true, action: 'login', ipAddress: ip, userAgent },
           overrideAccess: true,
         }).catch(() => {})
@@ -71,13 +74,18 @@ export function createLoginEndpoint(slugs: CollectionSlugs): Endpoint {
       } catch (err: unknown) {
         const errorMessage = err instanceof Error ? err.message : 'Erreur inconnue'
 
+        // 2FA gate: password was correct but a fresh 2FA verification is required.
+        // No session/cookie is issued (Payload rolled it back on the throw).
+        if (errorMessage.includes('2FA_REQUIRED')) {
+          return Response.json({ requires2FA: true }, { status: 200 })
+        }
+
         let errorReason = 'Identifiants incorrects'
         if (errorMessage.includes('locked') || errorMessage.includes('verrouillé') || errorMessage.includes('Too many')) {
           errorReason = 'Compte verrouillé (trop de tentatives)'
         }
 
-        payload.create({
-          collection: slugs.authLogs as any,
+        dbCreate(payload, slugs.authLogs, {
           data: { email, success: false, action: 'login', errorReason, ipAddress: ip, userAgent },
           overrideAccess: true,
         }).catch(() => {})

package/src/endpoints/merge-clients.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFind, dbFindByID, dbUpdate, dbDelete } from '../utils/db'
 
 /**
  * POST /api/support/merge-clients
@@ -23,8 +24,8 @@ export function createMergeClientsEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         const [source, target] = await Promise.all([
-          payload.findByID({ collection: slugs.supportClients as any, id: sourceId, depth: 0, overrideAccess: true }),
-          payload.findByID({ collection: slugs.supportClients as any, id: targetId, depth: 0, overrideAccess: true }),
+          dbFindByID(payload, slugs.supportClients, { id: sourceId, depth: 0, overrideAccess: true }),
+          dbFindByID(payload, slugs.supportClients, { id: targetId, depth: 0, overrideAccess: true }),
         ]) as [any, any]
 
         if (!source || !target) {
@@ -40,73 +41,67 @@ export function createMergeClientsEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         // 1. Transfer tickets
-        const tickets = await payload.find({
-          collection: slugs.tickets as any,
+        const tickets = await dbFind(payload, slugs.tickets, {
           where: { client: { equals: sourceId } },
           limit: 500,
           depth: 0,
           overrideAccess: true,
         })
         for (const ticket of tickets.docs) {
-          await payload.update({ collection: slugs.tickets as any, id: ticket.id, data: { client: targetId }, overrideAccess: true })
+          await dbUpdate(payload, slugs.tickets, { id: ticket.id, data: { client: targetId }, overrideAccess: true })
           results.tickets++
         }
 
         // 2. Transfer ticket messages (authorClient)
-        const messages = await payload.find({
-          collection: slugs.ticketMessages as any,
+        const messages = await dbFind(payload, slugs.ticketMessages, {
           where: { authorClient: { equals: sourceId } },
           limit: 1000,
           depth: 0,
           overrideAccess: true,
         })
         for (const msg of messages.docs) {
-          await payload.update({ collection: slugs.ticketMessages as any, id: msg.id, data: { authorClient: targetId }, overrideAccess: true })
+          await dbUpdate(payload, slugs.ticketMessages, { id: msg.id, data: { authorClient: targetId }, overrideAccess: true })
           results.ticketMessages++
         }
 
         // 3. Transfer chat messages
-        const chats = await payload.find({
-          collection: slugs.chatMessages as any,
+        const chats = await dbFind(payload, slugs.chatMessages, {
           where: { client: { equals: sourceId } },
           limit: 1000,
           depth: 0,
           overrideAccess: true,
         })
         for (const chat of chats.docs) {
-          await payload.update({ collection: slugs.chatMessages as any, id: chat.id, data: { client: targetId }, overrideAccess: true })
+          await dbUpdate(payload, slugs.chatMessages, { id: chat.id, data: { client: targetId }, overrideAccess: true })
           results.chatMessages++
         }
 
         // 4. Transfer pending emails
-        const pendingEmails = await payload.find({
-          collection: slugs.pendingEmails as any,
+        const pendingEmails = await dbFind(payload, slugs.pendingEmails, {
           where: { client: { equals: sourceId } },
           limit: 500,
           depth: 0,
           overrideAccess: true,
         })
         for (const pe of pendingEmails.docs) {
-          await payload.update({ collection: slugs.pendingEmails as any, id: pe.id, data: { client: targetId }, overrideAccess: true })
+          await dbUpdate(payload, slugs.pendingEmails, { id: pe.id, data: { client: targetId }, overrideAccess: true })
           results.pendingEmails++
         }
 
         // 5. Transfer satisfaction surveys
-        const surveys = await payload.find({
-          collection: slugs.satisfactionSurveys as any,
+        const surveys = await dbFind(payload, slugs.satisfactionSurveys, {
           where: { client: { equals: sourceId } },
           limit: 500,
           depth: 0,
           overrideAccess: true,
         })
         for (const survey of surveys.docs) {
-          await payload.update({ collection: slugs.satisfactionSurveys as any, id: survey.id, data: { client: targetId }, overrideAccess: true })
+          await dbUpdate(payload, slugs.satisfactionSurveys, { id: survey.id, data: { client: targetId }, overrideAccess: true })
           results.satisfactionSurveys++
         }
 
         // 6. Delete source client
-        await payload.delete({
-          collection: slugs.supportClients as any,
+        await dbDelete(payload, slugs.supportClients, {
           id: sourceId,
           overrideAccess: true,
         })

package/src/endpoints/merge-tickets.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFind, dbFindByID, dbCreate, dbUpdate, dbDelete } from '../utils/db'
 
 /**
  * POST /api/support/merge-tickets
@@ -27,8 +28,8 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         const [source, target] = await Promise.all([
-          payload.findByID({ collection: slugs.tickets as any, id: sourceTicketId, depth: 0, overrideAccess: true }),
-          payload.findByID({ collection: slugs.tickets as any, id: targetTicketId, depth: 0, overrideAccess: true }),
+          dbFindByID(payload, slugs.tickets, { id: sourceTicketId, depth: 0, overrideAccess: true }),
+          dbFindByID(payload, slugs.tickets, { id: targetTicketId, depth: 0, overrideAccess: true }),
         ])
 
         if (!source) return Response.json({ error: 'Ticket source introuvable' }, { status: 404 })
@@ -42,8 +43,7 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         // Move all messages from source to target
-        const messages = await payload.find({
-          collection: slugs.ticketMessages as any,
+        const messages = await dbFind(payload, slugs.ticketMessages, {
           where: { ticket: { equals: sourceTicketId } },
           limit: 500,
           depth: 0,
@@ -51,8 +51,7 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
         })
 
         for (const msg of messages.docs) {
-          await payload.update({
-            collection: slugs.ticketMessages as any,
+          await dbUpdate(payload, slugs.ticketMessages, {
             id: msg.id,
             data: { ticket: targetTicketId },
             overrideAccess: true,
@@ -60,8 +59,7 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         // Move time entries
-        const timeEntries = await payload.find({
-          collection: slugs.timeEntries as any,
+        const timeEntries = await dbFind(payload, slugs.timeEntries, {
           where: { ticket: { equals: sourceTicketId } },
           limit: 500,
           depth: 0,
@@ -69,8 +67,7 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
         })
 
         for (const entry of timeEntries.docs) {
-          await payload.update({
-            collection: slugs.timeEntries as any,
+          await dbUpdate(payload, slugs.timeEntries, {
             id: entry.id,
             data: { ticket: targetTicketId },
             overrideAccess: true,
@@ -79,8 +76,7 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
 
         // Add internal note to target
         const sourceNumber = (source as any).ticketNumber || `#${sourceTicketId}`
-        await payload.create({
-          collection: slugs.ticketMessages as any,
+        await dbCreate(payload, slugs.ticketMessages, {
           data: {
             ticket: targetTicketId,
             body: `Messages fusionnés depuis ${sourceNumber} (${messages.totalDocs} messages, ${timeEntries.totalDocs} entrées de temps)`,
@@ -92,15 +88,13 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
         })
 
         // Delete source ticket
-        await payload.delete({
-          collection: slugs.tickets as any,
+        await dbDelete(payload, slugs.tickets, {
           id: sourceTicketId,
           overrideAccess: true,
         })
 
         // Recalculate totalTimeMinutes on target
-        const allTimeEntries = await payload.find({
-          collection: slugs.timeEntries as any,
+        const allTimeEntries = await dbFind(payload, slugs.timeEntries, {
           where: { ticket: { equals: targetTicketId } },
           limit: 500,
           depth: 0,
@@ -112,8 +106,7 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
           0,
         )
 
-        await payload.update({
-          collection: slugs.tickets as any,
+        await dbUpdate(payload, slugs.tickets, {
           id: targetTicketId,
           data: { totalTimeMinutes: totalMinutes },
           overrideAccess: true,