@consilioweb/payload-support 0.16.0 → 1.0.0

package/src/endpoints/satisfaction.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireClient, handleAuthError } from '../utils/auth'
+import { dbFindByID, dbFind, dbCreate } from '../utils/db'
 
 /**
  * POST /api/support/satisfaction
@@ -17,13 +18,21 @@ export function createSatisfactionEndpoint(slugs: CollectionSlugs): Endpoint {
         requireClient(req, slugs)
 
         const body = await req.json!()
-        const { ticketId, rating, comment } = body
+        const { ticketId, rating, nps, comment } = body
 
-        if (!ticketId || !rating || !Number.isInteger(rating) || rating < 1 || rating > 5) {
-          return Response.json(
-            { error: 'ticketId et rating (entier 1-5) sont requis.' },
-            { status: 400 },
-          )
+        if (!ticketId) {
+          return Response.json({ error: 'ticketId est requis.' }, { status: 400 })
+        }
+        const hasRating = rating !== undefined && rating !== null
+        const hasNps = nps !== undefined && nps !== null
+        if (!hasRating && !hasNps) {
+          return Response.json({ error: 'Un rating (1-5) et/ou un nps (0-10) est requis.' }, { status: 400 })
+        }
+        if (hasRating && (!Number.isInteger(rating) || rating < 1 || rating > 5)) {
+          return Response.json({ error: 'rating doit être un entier 1-5.' }, { status: 400 })
+        }
+        if (hasNps && (!Number.isInteger(nps) || nps < 0 || nps > 10)) {
+          return Response.json({ error: 'nps doit être un entier 0-10.' }, { status: 400 })
         }
 
         if (comment && typeof comment === 'string' && comment.length > 5000) {
@@ -34,13 +43,12 @@ export function createSatisfactionEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         // Verify ticket belongs to client and is resolved
-        const ticket = await payload.findByID({
-          collection: slugs.tickets as any,
+        const ticket = await dbFindByID(payload, slugs.tickets, {
           id: ticketId,
           depth: 0,
           overrideAccess: false,
           user: req.user,
-        }) as any
+        })
 
         if (!ticket) {
           return Response.json({ error: 'Ticket introuvable.' }, { status: 404 })
@@ -54,8 +62,7 @@ export function createSatisfactionEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         // Check if survey already exists
-        const existing = await payload.find({
-          collection: slugs.satisfactionSurveys as any,
+        const existing = await dbFind(payload, slugs.satisfactionSurveys, {
           where: { ticket: { equals: ticketId } },
           limit: 1,
           depth: 0,
@@ -69,13 +76,13 @@ export function createSatisfactionEndpoint(slugs: CollectionSlugs): Endpoint {
           )
         }
 
-        const survey = await payload.create({
-          collection: slugs.satisfactionSurveys as any,
+        const survey = await dbCreate(payload, slugs.satisfactionSurveys, {
           data: {
             source: 'ticket',
             ticket: ticketId,
             client: req.user.id,
-            rating: Math.round(rating),
+            ...(hasRating ? { rating: Math.round(rating) } : {}),
+            ...(hasNps ? { nps: Math.round(nps) } : {}),
             ...(comment ? { comment: comment.trim() } : {}),
           },
           overrideAccess: true,

package/src/endpoints/search.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFind } from '../utils/db'
 
 /**
  * GET /api/support/search?q=term
@@ -24,8 +25,7 @@ export function createSearchEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         const [ticketsRes, clientsRes, messagesRes, articlesRes] = await Promise.all([
-          payload.find({
-            collection: slugs.tickets as any,
+          dbFind(payload, slugs.tickets, {
             where: {
               or: [
                 { ticketNumber: { contains: q } },
@@ -37,8 +37,7 @@ export function createSearchEndpoint(slugs: CollectionSlugs): Endpoint {
             depth: 1,
             overrideAccess: true,
           }),
-          payload.find({
-            collection: slugs.supportClients as any,
+          dbFind(payload, slugs.supportClients, {
             where: {
               or: [
                 { firstName: { contains: q } },
@@ -51,16 +50,14 @@ export function createSearchEndpoint(slugs: CollectionSlugs): Endpoint {
             depth: 0,
             overrideAccess: true,
           }),
-          payload.find({
-            collection: slugs.ticketMessages as any,
+          dbFind(payload, slugs.ticketMessages, {
             where: { body: { contains: q } },
             sort: '-createdAt',
             limit: 5,
             depth: 1,
             overrideAccess: true,
           }),
-          payload.find({
-            collection: slugs.knowledgeBase as any,
+          dbFind(payload, slugs.knowledgeBase, {
             where: { title: { contains: q } },
             limit: 5,
             depth: 0,

package/src/endpoints/seed-kb.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFind, dbCreate } from '../utils/db'
 
 const KB_ARTICLES = [
   {
@@ -95,8 +96,7 @@ export function createSeedKbEndpoint(slugs: CollectionSlugs): Endpoint {
         let skipped = 0
 
         for (const article of KB_ARTICLES) {
-          const existing = await payload.find({
-            collection: slugs.knowledgeBase as any,
+          const existing = await dbFind(payload, slugs.knowledgeBase, {
             where: { slug: { equals: article.slug } },
             limit: 1,
             depth: 0,
@@ -126,8 +126,7 @@ export function createSeedKbEndpoint(slugs: CollectionSlugs): Endpoint {
             },
           }
 
-          await payload.create({
-            collection: slugs.knowledgeBase as any,
+          await dbCreate(payload, slugs.knowledgeBase, {
             data: {
               title: article.title,
               slug: article.slug,

package/src/endpoints/send-reminder.ts

@@ -4,6 +4,7 @@ import { requireAdmin, handleAuthError } from '../utils/auth'
 import { RateLimiter } from '../utils/rateLimiter'
 import { escapeHtml, emailWrapper, emailParagraph, emailButton } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
+import { dbFindByID, dbFind, dbCreate, dbUpdate } from '../utils/db'
 
 // Manual reminders are a deliberate admin action, so the cap is generous —
 // it only exists to stop a runaway script, not normal usage.
@@ -71,12 +72,11 @@ export function createSendReminderEndpoint(slugs: CollectionSlugs): Endpoint {
           ? Math.min(MAX_HOURS, Math.max(MIN_HOURS, Math.round(rawHours)))
           : 24
 
-        const ticket = await payload.findByID({
-          collection: slugs.tickets as any,
+        const ticket = await dbFindByID(payload, slugs.tickets, {
           id: ticketId,
           depth: 1,
           overrideAccess: true,
-        }) as any
+        })
 
         if (!ticket) {
           return Response.json({ error: 'Ticket introuvable' }, { status: 404 })
@@ -102,8 +102,7 @@ export function createSendReminderEndpoint(slugs: CollectionSlugs): Endpoint {
         // response then to ticket creation.
         let waitingSince: string | undefined = ticket.firstResponseAt || ticket.createdAt
         try {
-          const lastAdminMsg = await payload.find({
-            collection: slugs.ticketMessages as any,
+          const lastAdminMsg = await dbFind(payload, slugs.ticketMessages, {
             where: {
               and: [
                 { ticket: { equals: ticketId } },
@@ -147,8 +146,7 @@ export function createSendReminderEndpoint(slugs: CollectionSlugs): Endpoint {
         })
 
         // Internal note for the conversation timeline (never sent to the client).
-        await payload.create({
-          collection: slugs.ticketMessages as any,
+        await dbCreate(payload, slugs.ticketMessages, {
           data: {
             ticket: ticketId,
             body: `Relance envoyée à ${client.email}. Fermeture automatique programmée le ${deadlineLabel} sans réponse du client.`,
@@ -162,8 +160,7 @@ export function createSendReminderEndpoint(slugs: CollectionSlugs): Endpoint {
         // Arm the ticket. `autoCloseRemindedAt: now` keeps the day-based cron
         // reminder from firing a second time; `autoCloseScheduledAt` is the hard
         // 24h-style deadline the cron close step honours.
-        await payload.update({
-          collection: slugs.tickets as any,
+        await dbUpdate(payload, slugs.tickets, {
           id: ticketId,
           data: {
             status: 'waiting_client',

package/src/endpoints/settings.ts

@@ -1,6 +1,8 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { invalidateSupportSettingsCache } from '../utils/readSettings'
+import { dbFind } from '../utils/db'
 
 const PREF_KEY = 'support-settings'
 
@@ -63,8 +65,7 @@ export function createSettingsGetEndpoint(slugs: CollectionSlugs): Endpoint {
 
         requireAdmin(req, slugs)
 
-        const prefs = await payload.find({
-          collection: 'payload-preferences' as any,
+        const prefs = await dbFind(payload, 'payload-preferences', {
           where: { key: { equals: PREF_KEY } },
           limit: 1,
           depth: 0,
@@ -132,6 +133,8 @@ export function createSettingsPostEndpoint(slugs: CollectionSlugs): Endpoint {
           },
         })
 
+        invalidateSupportSettingsCache()
+
         return Response.json(merged)
       } catch (error) {
         const authResponse = handleAuthError(error)

package/src/endpoints/signature.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFind } from '../utils/db'
 
 const PREF_KEY = 'email-signature'
 
@@ -17,8 +18,7 @@ export function createSignatureGetEndpoint(slugs: CollectionSlugs): Endpoint {
 
         requireAdmin(req, slugs)
 
-        const prefs = await payload.find({
-          collection: 'payload-preferences' as any,
+        const prefs = await dbFind(payload, 'payload-preferences', {
           where: { key: { equals: `${PREF_KEY}-${req.user.id}` } },
           limit: 1,
           depth: 0,
@@ -56,8 +56,7 @@ export function createSignaturePostEndpoint(slugs: CollectionSlugs): Endpoint {
         const { signature } = (await req.json!()) as { signature: string }
         const key = `${PREF_KEY}-${req.user.id}`
 
-        const existing = await payload.find({
-          collection: 'payload-preferences' as any,
+        const existing = await dbFind(payload, 'payload-preferences', {
           where: { key: { equals: key } },
           limit: 1,
           depth: 0,

package/src/endpoints/sla-check.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFind } from '../utils/db'
 
 /**
  * GET /api/support/sla-check
@@ -19,8 +20,7 @@ export function createSlaCheckEndpoint(slugs: CollectionSlugs): Endpoint {
         const now = new Date()
         const nowISO = now.toISOString()
 
-        const { docs: tickets } = await payload.find({
-          collection: slugs.tickets as any,
+        const { docs: tickets } = await dbFind(payload, slugs.tickets, {
           where: {
             and: [
               { status: { in: ['open', 'waiting_client'] } },

package/src/endpoints/split-ticket.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFindByID, dbCreate, dbUpdate } from '../utils/db'
 
 /**
  * POST /api/support/split-ticket
@@ -21,8 +22,7 @@ export function createSplitTicketEndpoint(slugs: CollectionSlugs): Endpoint {
           return Response.json({ error: 'messageId required' }, { status: 400 })
         }
 
-        const message = await payload.findByID({
-          collection: slugs.ticketMessages as any,
+        const message = await dbFindByID(payload, slugs.ticketMessages, {
           id: messageId,
           depth: 1,
           overrideAccess: true,
@@ -42,8 +42,7 @@ export function createSplitTicketEndpoint(slugs: CollectionSlugs): Endpoint {
           : sourceTicket.client
 
         // Create new ticket
-        const newTicket = await payload.create({
-          collection: slugs.tickets as any,
+        const newTicket = await dbCreate(payload, slugs.tickets, {
           data: {
             subject: subject || `Split: ${sourceTicket.subject}`,
             client: clientId,
@@ -61,8 +60,7 @@ export function createSplitTicketEndpoint(slugs: CollectionSlugs): Endpoint {
           file: typeof a.file === 'object' ? a.file.id : a.file,
         })) || []
 
-        await payload.create({
-          collection: slugs.ticketMessages as any,
+        await dbCreate(payload, slugs.ticketMessages, {
           data: {
             ticket: newTicket.id,
             body: message.body,
@@ -77,8 +75,7 @@ export function createSplitTicketEndpoint(slugs: CollectionSlugs): Endpoint {
         })
 
         // Add system note on source ticket
-        await payload.create({
-          collection: slugs.ticketMessages as any,
+        await dbCreate(payload, slugs.ticketMessages, {
           data: {
             ticket: sourceTicket.id,
             body: `Message extrait vers le ticket ${newTicket.ticketNumber}`,
@@ -95,8 +92,7 @@ export function createSplitTicketEndpoint(slugs: CollectionSlugs): Endpoint {
           : []
 
         if (!existingRelated.includes(newTicket.id)) {
-          await payload.update({
-            collection: slugs.tickets as any,
+          await dbUpdate(payload, slugs.tickets, {
             id: sourceTicket.id,
             data: { relatedTickets: [...existingRelated, newTicket.id] },
             overrideAccess: true,
@@ -104,8 +100,7 @@ export function createSplitTicketEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         // Log activity
-        await payload.create({
-          collection: slugs.ticketActivityLog as any,
+        await dbCreate(payload, slugs.ticketActivityLog, {
           data: {
             ticket: sourceTicket.id,
             action: 'split',

package/src/endpoints/statuses.ts

@@ -1,5 +1,6 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
+import { dbFind } from '../utils/db'
 
 /**
  * GET /api/support/statuses
@@ -17,8 +18,7 @@ export function createStatusesEndpoint(slugs: CollectionSlugs): Endpoint {
           return Response.json({ error: 'Unauthorized' }, { status: 401 })
         }
 
-        const { docs } = await payload.find({
-          collection: slugs.ticketStatuses as any,
+        const { docs } = await dbFind(payload, slugs.ticketStatuses, {
           sort: 'sortOrder',
           limit: 100,
           depth: 0,

package/src/endpoints/ticket-feedback.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireClient, handleAuthError } from '../utils/auth'
+import { dbFind, dbFindByID, dbCreate } from '../utils/db'
 
 /**
  * POST /api/support/tickets/:id/feedback
@@ -46,8 +47,7 @@ export function createTicketFeedbackEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         // Find ticket and check it belongs to the requesting client
-        const ticket = (await payload.findByID({
-          collection: slugs.tickets as any,
+        const ticket = (await dbFindByID(payload, slugs.tickets, {
           id: ticketId,
           depth: 0,
           overrideAccess: true,
@@ -66,8 +66,7 @@ export function createTicketFeedbackEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         // Check no feedback already exists for this ticket
-        const existing = await payload.find({
-          collection: 'ticket-feedback' as any,
+        const existing = await dbFind(payload, 'ticket-feedback', {
           where: { ticket: { equals: ticketId } },
           limit: 1,
           depth: 0,
@@ -80,8 +79,7 @@ export function createTicketFeedbackEndpoint(slugs: CollectionSlugs): Endpoint {
           )
         }
 
-        const feedback = await payload.create({
-          collection: 'ticket-feedback' as any,
+        const feedback = await dbCreate(payload, 'ticket-feedback', {
           data: {
             ticket: ticketId,
             client: req.user.id,

package/src/endpoints/ticket-synthesis.ts

@@ -2,6 +2,7 @@ import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { generateTicketSynthesis } from '../utils/generateTicketSynthesis'
+import { dbFindByID } from '../utils/db'
 
 /**
  * POST /api/support/ticket-synthesis?ticketId=X[&force=true]
@@ -38,8 +39,7 @@ export function createTicketSynthesisEndpoint(slugs: CollectionSlugs): Endpoint
         }
 
         if (!force) {
-          const existing = await payload.findByID({
-            collection: slugs.tickets as any,
+          const existing = await dbFindByID(payload, slugs.tickets, {
             id: ticketId,
             depth: 0,
             overrideAccess: true,

package/src/endpoints/track-open.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { createHmac } from 'crypto'
+import { dbFindByID, dbUpdate, dbCreate } from '../utils/db'
 
 // 1x1 transparent GIF (43 bytes)
 const TRANSPARENT_GIF = Buffer.from(
@@ -34,23 +35,16 @@ export function createTrackOpenEndpoint(slugs: CollectionSlugs): Endpoint {
       const parsedId = ticketId ? Number(ticketId) : NaN
       const parsedMsgId = messageId ? Number(messageId) : NaN
 
-      // Validate HMAC signature
+      // Open-tracking REQUIRES a valid HMAC signature. Without one we never
+      // process (no DB writes) — this prevents enumeration/abuse of t/m params
+      // and the silent "tracking writes without auth" hole.
       const secret = process.env.PAYLOAD_SECRET || ''
-      if (secret && ticketId && messageId && sig) {
-        const expected = generateTrackingToken(ticketId, messageId, secret)
-        if (sig !== expected) {
-          // Return transparent GIF silently (don't leak information)
-          return new Response(TRANSPARENT_GIF, {
-            status: 200,
-            headers: {
-              'Content-Type': 'image/gif',
-              'Content-Length': String(TRANSPARENT_GIF.length),
-              'Cache-Control': 'no-store, no-cache, must-revalidate, max-age=0',
-            },
-          })
-        }
-      } else if (secret && (!sig || !ticketId || !messageId)) {
-        // Missing signature param: return GIF but don't process
+      const validSig =
+        !!secret && !!ticketId && !!messageId && !!sig &&
+        sig === generateTrackingToken(ticketId, messageId, secret)
+
+      if (!validSig) {
+        // Return transparent GIF silently (don't leak information, don't process)
         return new Response(TRANSPARENT_GIF, {
           status: 200,
           headers: {
@@ -65,8 +59,7 @@ export function createTrackOpenEndpoint(slugs: CollectionSlugs): Endpoint {
         try {
           const payload = req.payload
 
-          const ticket = await payload.findByID({
-            collection: slugs.tickets as any,
+          const ticket = await dbFindByID(payload, slugs.tickets, {
             id: parsedId,
             depth: 0,
             overrideAccess: true,
@@ -78,8 +71,7 @@ export function createTrackOpenEndpoint(slugs: CollectionSlugs): Endpoint {
             const fiveMinAgo = Date.now() - 5 * 60 * 1000
 
             if (lastRead < fiveMinAgo) {
-              await payload.update({
-                collection: slugs.tickets as any,
+              await dbUpdate(payload, slugs.tickets, {
                 id: parsedId,
                 data: { lastClientReadAt: new Date().toISOString() },
                 overrideAccess: true,
@@ -89,8 +81,7 @@ export function createTrackOpenEndpoint(slugs: CollectionSlugs): Endpoint {
 
           // Track at message level
           if (Number.isInteger(parsedMsgId) && parsedMsgId > 0) {
-            const msg = await payload.findByID({
-              collection: slugs.ticketMessages as any,
+            const msg = await dbFindByID(payload, slugs.ticketMessages, {
               id: parsedMsgId,
               depth: 0,
               overrideAccess: true,
@@ -98,15 +89,13 @@ export function createTrackOpenEndpoint(slugs: CollectionSlugs): Endpoint {
             }) as any
 
             if (msg && !msg.emailOpenedAt) {
-              await payload.update({
-                collection: slugs.ticketMessages as any,
+              await dbUpdate(payload, slugs.ticketMessages, {
                 id: parsedMsgId,
                 data: { emailOpenedAt: new Date().toISOString() },
                 overrideAccess: true,
               })
 
-              const ticketInfo = await payload.findByID({
-                collection: slugs.tickets as any,
+              const ticketInfo = await dbFindByID(payload, slugs.tickets, {
                 id: parsedId,
                 depth: 1,
                 overrideAccess: true,
@@ -119,8 +108,7 @@ export function createTrackOpenEndpoint(slugs: CollectionSlugs): Endpoint {
 
               // Try to create admin notification (collection may not exist)
               try {
-                await payload.create({
-                  collection: 'admin-notifications' as any,
+                await dbCreate(payload, 'admin-notifications', {
                   data: {
                     title: `Email ouvert — ${ticketInfo?.ticketNumber || 'TK-????'}`,
                     message: `${clientName} a ouvert votre email pour "${ticketInfo?.subject || 'ticket'}"`,

package/src/endpoints/transfer-ticket.ts

@@ -3,6 +3,8 @@ import type { CollectionSlugs } from '../utils/slugs'
 import { handleAuthError, AuthError } from '../utils/auth'
 import { escapeHtml, emailWrapper, emailButton, emailParagraph } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
+import { RateLimiter } from '../utils/rateLimiter'
+import { dbFindByID, dbFind, dbCreate, dbCount } from '../utils/db'
 
 // Simple RFC-5322 style sanity check — same level of strictness as the
 // portal forms used elsewhere in the plugin. Server-side validation only;
@@ -11,6 +13,11 @@ const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
 
 const MAX_TRANSFERS_PER_DAY = 5
 
+// In-memory fail-closed rate limiter — enforced even when the persistent
+// emailLogs-based check is unavailable (collection disabled). Prevents the
+// endpoint from becoming an unbounded outbound mailer.
+const transferLimiter = new RateLimiter(24 * 60 * 60 * 1000, MAX_TRANSFERS_PER_DAY)
+
 /**
  * POST /api/support/tickets/:id/transfer
  *
@@ -56,12 +63,11 @@ export function createTransferTicketEndpoint(slugs: CollectionSlugs): Endpoint {
         const payload = req.payload
 
         // Load ticket (ownership check happens here too)
-        const ticket = await payload.findByID({
-          collection: slugs.tickets as any,
+        const ticket = await dbFindByID(payload, slugs.tickets, {
           id: ticketId,
           depth: 1,
           overrideAccess: true,
-        }) as any
+        })
         if (!ticket) return Response.json({ error: 'Ticket introuvable' }, { status: 404 })
 
         const isAdmin = req.user.collection === slugs.users
@@ -74,11 +80,19 @@ export function createTransferTicketEndpoint(slugs: CollectionSlugs): Endpoint {
           return Response.json({ error: 'Forbidden' }, { status: 403 })
         }
 
+        // Fail-closed in-memory rate limit (per user + ticket): enforced even
+        // when the persistent emailLogs check below cannot run.
+        if (transferLimiter.check(`${req.user.id}:${ticketId}`)) {
+          return Response.json(
+            { error: `Limite atteinte (${MAX_TRANSFERS_PER_DAY} transferts par 24h sur ce ticket)` },
+            { status: 429 },
+          )
+        }
+
         // Rate limit: count transfers in last 24h for this ticket
         try {
           const since = new Date(Date.now() - 24 * 60 * 60 * 1000).toISOString()
-          const existing = await payload.count({
-            collection: slugs.emailLogs as any,
+          const existing = await dbCount(payload, slugs.emailLogs, {
             where: {
               and: [
                 { action: { equals: 'transfer' } },
@@ -99,8 +113,7 @@ export function createTransferTicketEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         // Fetch non-internal messages, ordered chronologically
-        const messages = await payload.find({
-          collection: slugs.ticketMessages as any,
+        const messages = await dbFind(payload, slugs.ticketMessages, {
           where: {
             and: [
               { ticket: { equals: ticketId } },
@@ -206,8 +219,7 @@ export function createTransferTicketEndpoint(slugs: CollectionSlugs): Endpoint {
 
         // Log the transfer (best-effort)
         try {
-          await payload.create({
-            collection: slugs.emailLogs as any,
+          await dbCreate(payload, slugs.emailLogs, {
             data: {
               status: 'success',
               action: 'transfer',

package/src/endpoints/user-prefs.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFind } from '../utils/db'
 
 const PREF_KEY_PREFIX = 'support-user-prefs'
 
@@ -29,8 +30,7 @@ export function createUserPrefsGetEndpoint(slugs: CollectionSlugs): Endpoint {
 
         const key = `${PREF_KEY_PREFIX}-${req.user!.id}`
 
-        const prefs = await payload.find({
-          collection: 'payload-preferences' as any,
+        const prefs = await dbFind(payload, 'payload-preferences', {
           where: { key: { equals: key } },
           limit: 1,
           depth: 0,
@@ -74,8 +74,7 @@ export function createUserPrefsPostEndpoint(slugs: CollectionSlugs): Endpoint {
         const key = `${PREF_KEY_PREFIX}-${req.user!.id}`
 
         // Read existing prefs to merge
-        const existing = await payload.find({
-          collection: 'payload-preferences' as any,
+        const existing = await dbFind(payload, 'payload-preferences', {
           where: { key: { equals: key } },
           limit: 1,
           depth: 0,