@consilioweb/payload-support 0.16.0 → 1.1.0

package/src/__tests__/integration/isolation.test.ts

@@ -0,0 +1,81 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+
+const PW = 'test-pw-12345'
+
+/**
+ * Validates the cross-client isolation fix (P0-4): a support-client must never
+ * read another client's ticket messages / activity, and field-level access
+ * (P0-7) must hide admin-only fields from the client's own doc.
+ */
+describe('cross-client isolation (P0-4 / P0-7)', () => {
+  it('a client cannot read another client\'s ticket messages', async () => {
+    const payload = await buildTestPayload()
+
+    const a = await payload.create({ collection: 'support-clients', data: { email: 'iso-a@example.com', password: PW, firstName: 'A', lastName: 'A', company: 'A' }, overrideAccess: true })
+    const b = await payload.create({ collection: 'support-clients', data: { email: 'iso-b@example.com', password: PW, firstName: 'B', lastName: 'B', company: 'B' }, overrideAccess: true })
+
+    const ta = await payload.create({ collection: 'tickets', data: { subject: 'A ticket', client: a.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+    const tb = await payload.create({ collection: 'tickets', data: { subject: 'B ticket', client: b.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+
+    await payload.create({ collection: 'ticket-messages', data: { ticket: ta.id, body: 'SECRET-A-MESSAGE', authorType: 'admin' }, overrideAccess: true })
+    await payload.create({ collection: 'ticket-messages', data: { ticket: tb.id, body: 'SECRET-B-MESSAGE', authorType: 'admin' }, overrideAccess: true })
+
+    // Read messages AS client A, with access control enforced.
+    const asA = await payload.find({
+      collection: 'ticket-messages',
+      overrideAccess: false,
+      user: { ...a, collection: 'support-clients' } as never,
+      limit: 200,
+    })
+    const bodies = asA.docs.map((m) => (m as { body?: string }).body)
+
+    expect(bodies).toContain('SECRET-A-MESSAGE')
+    expect(bodies).not.toContain('SECRET-B-MESSAGE') // ← the cross-client boundary
+  }, 60_000)
+
+  it('a client cannot read another client\'s activity log', async () => {
+    const payload = await buildTestPayload()
+
+    const a = await payload.create({ collection: 'support-clients', data: { email: 'act-a@example.com', password: PW, firstName: 'A', lastName: 'A', company: 'A' }, overrideAccess: true })
+    const b = await payload.create({ collection: 'support-clients', data: { email: 'act-b@example.com', password: PW, firstName: 'B', lastName: 'B', company: 'B' }, overrideAccess: true })
+    const ta = await payload.create({ collection: 'tickets', data: { subject: 'A', client: a.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+    const tb = await payload.create({ collection: 'tickets', data: { subject: 'B', client: b.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+    await payload.create({ collection: 'ticket-activity-log', data: { ticket: ta.id, action: 'status_changed', detail: 'ACT-A' }, overrideAccess: true })
+    await payload.create({ collection: 'ticket-activity-log', data: { ticket: tb.id, action: 'status_changed', detail: 'ACT-B' }, overrideAccess: true })
+
+    const asA = await payload.find({
+      collection: 'ticket-activity-log',
+      overrideAccess: false,
+      user: { ...a, collection: 'support-clients' } as never,
+      limit: 200,
+    })
+    const details = asA.docs.map((m) => (m as { detail?: string }).detail)
+    expect(details).toContain('ACT-A')
+    expect(details).not.toContain('ACT-B')
+  }, 60_000)
+
+  it('does not serialize admin-only opportunities/notes to the client (P0-7)', async () => {
+    const payload = await buildTestPayload()
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'fa@example.com', password: PW, firstName: 'F', lastName: 'A', company: 'C', opportunities: 'SECRET-DEAL', notes: 'INTERNAL-NOTE' }, overrideAccess: true })
+
+    const asClient = await payload.findByID({
+      collection: 'support-clients',
+      id: c.id,
+      overrideAccess: false,
+      user: { ...c, collection: 'support-clients' } as never,
+    })
+    expect((asClient as { opportunities?: string }).opportunities).toBeFalsy()
+    expect((asClient as { notes?: string }).notes).toBeFalsy()
+
+    // Admin (users collection) still sees them.
+    const admin = await payload.create({ collection: 'users', data: { email: 'admin-fa@example.com', password: PW } as never, overrideAccess: true })
+    const asAdmin = await payload.findByID({
+      collection: 'support-clients',
+      id: c.id,
+      overrideAccess: false,
+      user: { ...admin, collection: 'users' } as never,
+    })
+    expect((asAdmin as { opportunities?: string }).opportunities).toBe('SECRET-DEAL')
+  }, 60_000)
+})

package/src/__tests__/integration/mentions-invoice.test.ts

@@ -0,0 +1,50 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+import { createInvoiceEndpoint } from '../../endpoints/invoice'
+import { resolveSlugs } from '../../utils/slugs'
+
+const slugs = resolveSlugs({ users: 'users' })
+const PW = 'test-pw-12345'
+
+/** @mentions (P2 #6): `@email` in a message resolves to agent IDs on `mentions`. */
+describe('@mentions (P2 #6)', () => {
+  it('resolves @email mentions in a message body to agent IDs', async () => {
+    const payload = await buildTestPayload()
+    const agent = await payload.create({ collection: 'users', data: { email: 'agent@example.com', password: PW } as never, overrideAccess: true })
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'mc@example.com', password: PW, firstName: 'M', lastName: 'C', company: 'C' }, overrideAccess: true })
+    const t = await payload.create({ collection: 'tickets', data: { subject: 'mention', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+
+    const m = await payload.create({
+      collection: 'ticket-messages',
+      data: { ticket: t.id, body: 'Hey @agent@example.com can you check this?', authorType: 'admin', isInternal: true },
+      overrideAccess: true,
+    })
+
+    const reread = await payload.findByID({ collection: 'ticket-messages', id: m.id, depth: 0, overrideAccess: true })
+    const mentions = (reread as { mentions?: Array<number | string> }).mentions || []
+    expect(mentions.map(String)).toContain(String(agent.id))
+  }, 60_000)
+})
+
+/** Invoice (P2 #6): a print-ready HTML invoice with the correct total. */
+describe('printable invoice (P2 #6)', () => {
+  it('renders an HTML invoice summing billable tickets', async () => {
+    const payload = await buildTestPayload()
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'inv@example.com', password: PW, firstName: 'I', lastName: 'V', company: 'ACME Corp' }, overrideAccess: true })
+    const t1 = await payload.create({ collection: 'tickets', data: { subject: 'inv-a', client: c.id, status: 'resolved', priority: 'normal', billable: true, billedAmount: 100 }, overrideAccess: true })
+    await payload.create({ collection: 'tickets', data: { subject: 'inv-b', client: c.id, status: 'resolved', priority: 'normal', billable: true, billedAmount: 50 }, overrideAccess: true })
+
+    const admin = await payload.create({ collection: 'users', data: { email: 'inv-admin@example.com', password: PW } as never, overrideAccess: true })
+    const from = new Date(Date.now() - 86_400_000).toISOString().slice(0, 10)
+    const to = new Date(Date.now() + 86_400_000).toISOString().slice(0, 10)
+    const ep = createInvoiceEndpoint(slugs)
+    const req = { payload, user: { ...admin, collection: 'users' }, url: `http://localhost/api/support/billing/invoice?from=${from}&to=${to}`, headers: new Headers({}) }
+    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
+
+    expect(res.headers.get('content-type')).toMatch(/text\/html/)
+    const body = await res.text()
+    expect(body).toContain('150.00 €') // 100 + 50
+    expect(body).toContain(String(t1.ticketNumber))
+    expect(body).toContain('ACME Corp')
+  }, 60_000)
+})

package/src/__tests__/integration/nps.test.ts

@@ -0,0 +1,37 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+import { createAdminStatsEndpoint } from '../../endpoints/admin-stats'
+import { resolveSlugs } from '../../utils/slugs'
+
+const slugs = resolveSlugs({ users: 'users' })
+const PW = 'test-pw-12345'
+
+/**
+ * NPS (P2): satisfaction surveys can carry an NPS score (0-10), and admin-stats
+ * computes the Net Promoter Score = %promoters(9-10) − %detractors(0-6).
+ */
+describe('NPS (P2)', () => {
+  it('stores NPS scores and computes the NPS in admin-stats', async () => {
+    const payload = await buildTestPayload()
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'nps@example.com', password: PW, firstName: 'N', lastName: 'P', company: 'C' }, overrideAccess: true })
+
+    // 3 promoters (10,9,9), 1 passive (7), 2 detractors (3,5) → (3-2)/6 = 16.67% ≈ 17
+    for (const nps of [10, 9, 9, 7, 3, 5]) {
+      await payload.create({ collection: 'satisfaction-surveys', data: { source: 'ticket', client: c.id, nps }, overrideAccess: true })
+    }
+
+    const admin = await payload.create({ collection: 'users', data: { email: 'nps-admin@example.com', password: PW } as never, overrideAccess: true })
+    const ep = createAdminStatsEndpoint(slugs)
+    const req = {
+      payload,
+      user: { ...admin, collection: 'users' },
+      url: 'http://localhost/api/support/admin-stats',
+      headers: new Headers({}),
+    }
+    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
+    const json = await res.json()
+
+    expect(json.npsCount).toBe(6)
+    expect(json.npsScore).toBe(17)
+  }, 60_000)
+})

package/src/__tests__/integration/per-team-sla.test.ts

@@ -0,0 +1,44 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+import { createAdminStatsEndpoint } from '../../endpoints/admin-stats'
+import { resolveSlugs } from '../../utils/slugs'
+
+const slugs = resolveSlugs({ users: 'users' })
+const PW = 'test-pw-12345'
+
+/** Per-team SLA policies & dashboards (roadmap). */
+describe('per-team SLA & dashboards (roadmap)', () => {
+  it('uses the team-specific SLA policy over the global default', async () => {
+    const payload = await buildTestPayload()
+    const team = await payload.create({ collection: 'support-teams', data: { name: 'Team SLA' }, overrideAccess: true })
+    // Team policy: 2h resolution. Global default: 24h.
+    await payload.create({ collection: 'sla-policies', data: { name: 'Team', priority: 'normal', firstResponseTime: 30, resolutionTime: 120, businessHoursOnly: false, team: team.id }, overrideAccess: true })
+    await payload.create({ collection: 'sla-policies', data: { name: 'Default', priority: 'normal', firstResponseTime: 120, resolutionTime: 1440, businessHoursOnly: false, isDefault: true }, overrideAccess: true })
+
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'pts@example.com', password: PW, firstName: 'P', lastName: 'T', company: 'C' }, overrideAccess: true })
+    const t = await payload.create({ collection: 'tickets', data: { subject: 'team sla', client: c.id, status: 'open', priority: 'normal', team: team.id }, overrideAccess: true })
+
+    const reread = await payload.findByID({ collection: 'tickets', id: t.id, overrideAccess: true })
+    const created = new Date(reread.createdAt as string).getTime()
+    const diffMin = (new Date(reread.slaResolutionDue as string).getTime() - created) / 60000
+    expect(diffMin).toBeGreaterThan(110) // ~120 (team policy), NOT 1440 (default)
+    expect(diffMin).toBeLessThan(130)
+  }, 60_000)
+
+  it('scopes the dashboard counts to a team via ?teamId', async () => {
+    const payload = await buildTestPayload()
+    const teamC = await payload.create({ collection: 'support-teams', data: { name: 'Team C' }, overrideAccess: true })
+    const teamD = await payload.create({ collection: 'support-teams', data: { name: 'Team D' }, overrideAccess: true })
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'ptd@example.com', password: PW, firstName: 'P', lastName: 'D', company: 'C' }, overrideAccess: true })
+    await payload.create({ collection: 'tickets', data: { subject: 'c1', client: c.id, status: 'open', priority: 'normal', team: teamC.id }, overrideAccess: true })
+    await payload.create({ collection: 'tickets', data: { subject: 'c2', client: c.id, status: 'open', priority: 'normal', team: teamC.id }, overrideAccess: true })
+    await payload.create({ collection: 'tickets', data: { subject: 'd1', client: c.id, status: 'open', priority: 'normal', team: teamD.id }, overrideAccess: true })
+
+    const admin = await payload.create({ collection: 'users', data: { email: 'pt-admin@example.com', password: PW } as never, overrideAccess: true })
+    const ep = createAdminStatsEndpoint(slugs)
+    const req = { payload, user: { ...admin, collection: 'users' }, url: `http://localhost/api/support/admin-stats?teamId=${teamC.id}`, headers: new Headers({}) }
+    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
+    const json = await res.json()
+    expect(json.total).toBe(2) // only Team C's tickets
+  }, 60_000)
+})

package/src/__tests__/integration/push.test.ts

@@ -0,0 +1,75 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+import { createVapidKeyEndpoint, createPushSubscribeEndpoint } from '../../endpoints/push'
+import { sendPushToUser } from '../../utils/push'
+import { resolveSlugs } from '../../utils/slugs'
+
+const slugs = resolveSlugs({ users: 'users' })
+const PW = 'test-pw-12345'
+
+/** Native push / browser notifications (roadmap). */
+describe('push notifications (roadmap)', () => {
+  it('subscribe stores a subscription row for the agent', async () => {
+    const payload = await buildTestPayload()
+    const admin = await payload.create({ collection: 'users', data: { email: 'push-admin@example.com', password: PW } as never, overrideAccess: true })
+    const ep = createPushSubscribeEndpoint(slugs)
+    const req = {
+      payload,
+      user: { ...admin, collection: 'users' },
+      headers: new Headers({ 'user-agent': 'vitest' }),
+      json: async () => ({ subscription: { endpoint: 'https://push.example.com/abc', keys: { p256dh: 'pk', auth: 'ak' } } }),
+    }
+    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
+    expect(res.status).toBe(200)
+
+    const stored = await payload.find({ collection: 'push-subscriptions', where: { endpoint: { equals: 'https://push.example.com/abc' } }, overrideAccess: true })
+    expect(stored.docs.length).toBe(1)
+    expect((stored.docs[0] as { auth?: string }).auth).toBe('ak')
+  }, 60_000)
+
+  it('subscribe is idempotent on endpoint (upsert, no duplicate)', async () => {
+    const payload = await buildTestPayload()
+    const admin = await payload.create({ collection: 'users', data: { email: 'push-admin2@example.com', password: PW } as never, overrideAccess: true })
+    const ep = createPushSubscribeEndpoint(slugs)
+    const mk = (auth: string) => ({
+      payload,
+      user: { ...admin, collection: 'users' },
+      headers: new Headers({}),
+      json: async () => ({ subscription: { endpoint: 'https://push.example.com/dup', keys: { p256dh: 'pk', auth } } }),
+    })
+    await (ep.handler as (r: unknown) => Promise<Response>)(mk('first'))
+    await (ep.handler as (r: unknown) => Promise<Response>)(mk('second'))
+    const stored = await payload.find({ collection: 'push-subscriptions', where: { endpoint: { equals: 'https://push.example.com/dup' } }, overrideAccess: true })
+    expect(stored.docs.length).toBe(1)
+    expect((stored.docs[0] as { auth?: string }).auth).toBe('second')
+  }, 60_000)
+
+  it('subscribe rejects an anonymous request', async () => {
+    const payload = await buildTestPayload()
+    const ep = createPushSubscribeEndpoint(slugs)
+    const req = {
+      payload,
+      user: null,
+      headers: new Headers({}),
+      json: async () => ({ subscription: { endpoint: 'https://push.example.com/x', keys: { p256dh: 'pk', auth: 'ak' } } }),
+    }
+    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
+    expect(res.status).toBe(401)
+  }, 60_000)
+
+  it('vapid-public-key returns null when VAPID is not configured', async () => {
+    delete process.env.VAPID_PUBLIC_KEY
+    const ep = createVapidKeyEndpoint()
+    const res = await (ep.handler as (r: unknown) => Promise<Response>)({})
+    const json = await res.json()
+    expect(json.publicKey).toBeNull()
+  })
+
+  it('sendPushToUser no-ops without VAPID keys', async () => {
+    delete process.env.VAPID_PUBLIC_KEY
+    delete process.env.VAPID_PRIVATE_KEY
+    const payload = await buildTestPayload()
+    const result = await sendPushToUser(payload, slugs, 1, { title: 'Hi', body: 'There' })
+    expect(result.sent).toBe(0)
+  }, 60_000)
+})

package/src/__tests__/integration/sanitization.test.ts

@@ -0,0 +1,35 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+
+const PW = 'test-pw-12345'
+
+/**
+ * Validates that the bodyHtml sanitization (P0-1) is actually wired into the
+ * TicketMessages beforeChange hook — i.e. stored HTML is stripped of script /
+ * event handlers before it can be persisted and later rendered.
+ */
+describe('stored-XSS sanitization on write (P0-1)', () => {
+  it('strips <script> and inline handlers from bodyHtml at persistence', async () => {
+    const payload = await buildTestPayload()
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'xss@example.com', password: PW, firstName: 'X', lastName: 'S', company: 'C' }, overrideAccess: true })
+    const t = await payload.create({ collection: 'tickets', data: { subject: 'xss', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+
+    const m = await payload.create({
+      collection: 'ticket-messages',
+      data: {
+        ticket: t.id,
+        body: 'hello',
+        bodyHtml: '<img src=x onerror=alert(1)><script>alert(2)</script><a href="javascript:alert(3)">x</a><b>kept</b>',
+        authorType: 'client',
+        authorClient: c.id,
+      },
+      overrideAccess: true,
+    })
+
+    const stored = (m as { bodyHtml?: string }).bodyHtml || ''
+    expect(stored).not.toMatch(/onerror/i)
+    expect(stored).not.toMatch(/<script/i)
+    expect(stored).not.toMatch(/javascript:/i)
+    expect(stored).toContain('<b>kept</b>') // legitimate formatting preserved
+  }, 60_000)
+})

package/src/__tests__/integration/sla-pause.test.ts

@@ -0,0 +1,39 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+
+const PW = 'test-pw-12345'
+
+/**
+ * SLA pause-on-hold (P2): time spent waiting on the client must not count against
+ * the resolution SLA — the resolution deadline is pushed forward by the paused span.
+ */
+describe('SLA pause-on-hold (P2)', () => {
+  it('extends the resolution deadline by the time spent in waiting_client', async () => {
+    const payload = await buildTestPayload()
+    await payload.create({ collection: 'sla-policies', data: { name: 'P', priority: 'normal', firstResponseTime: 60, resolutionTime: 240, businessHoursOnly: false, isDefault: true }, overrideAccess: true })
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'pause@example.com', password: PW, firstName: 'P', lastName: 'H', company: 'C' }, overrideAccess: true })
+    const t = await payload.create({ collection: 'tickets', data: { subject: 'pause', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+
+    const before = await payload.findByID({ collection: 'tickets', id: t.id, overrideAccess: true })
+    const dueBefore = new Date(before.slaResolutionDue as string).getTime()
+    expect(dueBefore).toBeGreaterThan(0)
+
+    // Enter hold → the clock should pause.
+    await payload.update({ collection: 'tickets', id: t.id, data: { status: 'waiting_client' }, overrideAccess: true })
+    const mid = await payload.findByID({ collection: 'tickets', id: t.id, overrideAccess: true })
+    expect(mid.slaPausedAt).toBeTruthy()
+
+    // Simulate ~2h of waiting by backdating the pause marker (status unchanged → hook no-op).
+    const twoHoursAgo = new Date(Date.now() - 2 * 3_600_000).toISOString()
+    await payload.update({ collection: 'tickets', id: t.id, data: { slaPausedAt: twoHoursAgo }, overrideAccess: true })
+
+    // Leave hold → deadline extended, pause cleared.
+    await payload.update({ collection: 'tickets', id: t.id, data: { status: 'open' }, overrideAccess: true })
+    const after = await payload.findByID({ collection: 'tickets', id: t.id, overrideAccess: true })
+
+    expect(after.slaPausedAt).toBeFalsy()
+    const extensionMs = new Date(after.slaResolutionDue as string).getTime() - dueBefore
+    expect(extensionMs).toBeGreaterThan(1.9 * 3_600_000)
+    expect(extensionMs).toBeLessThan(2.2 * 3_600_000)
+  }, 60_000)
+})

package/src/__tests__/integration/smoke.test.ts

@@ -0,0 +1,26 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+
+describe('integration harness', () => {
+  it('boots Payload with the support plugin and round-trips a ticket', async () => {
+    const payload = await buildTestPayload()
+
+    const client = await payload.create({
+      collection: 'support-clients',
+      data: { email: 'smoke@example.com', password: 'pw-smoke-123', firstName: 'Smoke', lastName: 'Test', company: 'ACME' },
+      overrideAccess: true,
+    })
+
+    const ticket = await payload.create({
+      collection: 'tickets',
+      data: { subject: 'Smoke ticket', client: client.id, status: 'open', priority: 'normal' },
+      overrideAccess: true,
+    })
+
+    expect(ticket.id).toBeTruthy()
+    expect(ticket.ticketNumber).toMatch(/^TK-/)
+
+    const reread = await payload.findByID({ collection: 'tickets', id: ticket.id, overrideAccess: true })
+    expect(reread.subject).toBe('Smoke ticket')
+  }, 60_000)
+})

package/src/__tests__/integration/snooze.test.ts

@@ -0,0 +1,68 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+import { createProcessSnoozeEndpoint } from '../../endpoints/process-snooze'
+import { resolveSlugs } from '../../utils/slugs'
+
+const PW = 'test-pw-12345'
+const slugs = resolveSlugs({ users: 'users' })
+
+async function makeClient(payload: Awaited<ReturnType<typeof buildTestPayload>>, email: string) {
+  return payload.create({ collection: 'support-clients', data: { email, password: PW, firstName: 'S', lastName: 'N', company: 'C' }, overrideAccess: true })
+}
+
+/**
+ * Snooze wake-up cron (P2): a snoozed ticket must be hidden from the inbox while
+ * `snoozeUntil` is in the future, resurface once it passes, and the cron must
+ * clear expired snoozes (audit trail) while leaving future ones untouched.
+ */
+describe('snooze wake-up cron + inbox hide (P2)', () => {
+  it('cron clears expired snoozeUntil and leaves future ones', async () => {
+    const payload = await buildTestPayload()
+    process.env.CRON_SECRET = 'test-cron-secret'
+    const c = await makeClient(payload, 'snz@example.com')
+    const past = new Date(Date.now() - 3_600_000).toISOString()
+    const future = new Date(Date.now() + 3_600_000).toISOString()
+    const tPast = await payload.create({ collection: 'tickets', data: { subject: 'past', client: c.id, status: 'open', priority: 'normal', snoozeUntil: past }, overrideAccess: true })
+    const tFuture = await payload.create({ collection: 'tickets', data: { subject: 'future', client: c.id, status: 'open', priority: 'normal', snoozeUntil: future }, overrideAccess: true })
+
+    const ep = createProcessSnoozeEndpoint(slugs)
+    const req = { payload, headers: new Headers({ 'x-cron-secret': 'test-cron-secret' }) }
+    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
+    const json = await res.json()
+    expect(json.ok).toBe(true)
+    expect(json.processed).toBeGreaterThanOrEqual(1)
+
+    const rePast = await payload.findByID({ collection: 'tickets', id: tPast.id, overrideAccess: true })
+    const reFuture = await payload.findByID({ collection: 'tickets', id: tFuture.id, overrideAccess: true })
+    expect(rePast.snoozeUntil).toBeFalsy() // woken up
+    expect(reFuture.snoozeUntil).toBeTruthy() // still snoozed
+  }, 60_000)
+
+  it('rejects the cron without the secret', async () => {
+    const payload = await buildTestPayload()
+    process.env.CRON_SECRET = 'test-cron-secret'
+    const ep = createProcessSnoozeEndpoint(slugs)
+    const req = { payload, headers: new Headers({}) }
+    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
+    expect(res.status).toBe(401)
+  }, 60_000)
+
+  it('the inbox snooze-hide query excludes future-snoozed tickets', async () => {
+    const payload = await buildTestPayload()
+    const c = await makeClient(payload, 'snz2@example.com')
+    const visible = await payload.create({ collection: 'tickets', data: { subject: 'visible', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+    const hidden = await payload.create({ collection: 'tickets', data: { subject: 'hidden', client: c.id, status: 'open', priority: 'normal', snoozeUntil: new Date(Date.now() + 3_600_000).toISOString() }, overrideAccess: true })
+
+    const nowIso = new Date().toISOString()
+    // Same where the inbox builds via query params.
+    const found = await payload.find({
+      collection: 'tickets',
+      where: { and: [{ or: [{ snoozeUntil: { exists: false } }, { snoozeUntil: { less_than_equal: nowIso } }] }] },
+      limit: 200,
+      overrideAccess: true,
+    })
+    const ids = found.docs.map((t) => t.id)
+    expect(ids).toContain(visible.id)
+    expect(ids).not.toContain(hidden.id)
+  }, 60_000)
+})

package/src/__tests__/integration/teams.test.ts

@@ -0,0 +1,38 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+
+const PW = 'test-pw-12345'
+
+/**
+ * Multi-team / workspaces (roadmap): with `SUPPORT_TEAM_SCOPING` enabled, an agent
+ * only sees tickets of the teams they belong to (plus team-less tickets).
+ */
+describe('multi-team scoping (roadmap)', () => {
+  it('scopes ticket visibility to the agent\'s teams when enabled', async () => {
+    process.env.SUPPORT_TEAM_SCOPING = '1'
+    const payload = await buildTestPayload()
+
+    const agentA = await payload.create({ collection: 'users', data: { email: 'team-a@example.com', password: PW } as never, overrideAccess: true })
+    const agentB = await payload.create({ collection: 'users', data: { email: 'team-b@example.com', password: PW } as never, overrideAccess: true })
+    const teamA = await payload.create({ collection: 'support-teams', data: { name: 'Team A', members: [agentA.id] }, overrideAccess: true })
+    const teamB = await payload.create({ collection: 'support-teams', data: { name: 'Team B', members: [agentB.id] }, overrideAccess: true })
+
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'team-c@example.com', password: PW, firstName: 'T', lastName: 'C', company: 'C' }, overrideAccess: true })
+    const tA = await payload.create({ collection: 'tickets', data: { subject: 'A', client: c.id, status: 'open', priority: 'normal', team: teamA.id }, overrideAccess: true })
+    const tB = await payload.create({ collection: 'tickets', data: { subject: 'B', client: c.id, status: 'open', priority: 'normal', team: teamB.id }, overrideAccess: true })
+    const tNone = await payload.create({ collection: 'tickets', data: { subject: 'none', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+
+    const asA = await payload.find({
+      collection: 'tickets',
+      overrideAccess: false,
+      user: { ...agentA, collection: 'users' } as never,
+      limit: 200,
+    })
+    const ids = asA.docs.map((t) => String(t.id))
+    expect(ids).toContain(String(tA.id))
+    expect(ids).toContain(String(tNone.id)) // team-less tickets stay visible
+    expect(ids).not.toContain(String(tB.id)) // other team's ticket hidden
+
+    delete process.env.SUPPORT_TEAM_SCOPING
+  }, 60_000)
+})

package/src/__tests__/rateLimiter.test.ts

@@ -0,0 +1,89 @@
+import { describe, it, expect, vi, afterEach } from 'vitest'
+import { RateLimiter } from '../utils/rateLimiter'
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('RateLimiter — under the limit', () => {
+  it('allows the first request', () => {
+    const limiter = new RateLimiter(60_000, 5)
+    expect(limiter.check('user:1')).toBe(false)
+  })
+
+  it('allows requests up to the maximum (maxRequests = 3)', () => {
+    const limiter = new RateLimiter(60_000, 3)
+    expect(limiter.check('key')).toBe(false) // count = 1
+    expect(limiter.check('key')).toBe(false) // count = 2
+    expect(limiter.check('key')).toBe(false) // count = 3
+  })
+})
+
+describe('RateLimiter — exceeding the limit', () => {
+  it('blocks the request when count exceeds maxRequests', () => {
+    const limiter = new RateLimiter(60_000, 2)
+    limiter.check('key') // count = 1
+    limiter.check('key') // count = 2
+    // count = 3 > maxRequests(2) → blocked
+    expect(limiter.check('key')).toBe(true)
+  })
+
+  it('keeps blocking subsequent requests after limit exceeded', () => {
+    const limiter = new RateLimiter(60_000, 1)
+    limiter.check('key') // count = 1, passes
+    expect(limiter.check('key')).toBe(true)  // count = 2 → blocked
+    expect(limiter.check('key')).toBe(true)  // count = 3 → still blocked
+  })
+})
+
+describe('RateLimiter — reset', () => {
+  it('allows requests again after manual reset', () => {
+    const limiter = new RateLimiter(60_000, 1)
+    limiter.check('key') // count = 1
+    expect(limiter.check('key')).toBe(true) // blocked
+    limiter.reset('key')
+    expect(limiter.check('key')).toBe(false) // reset → allowed again
+  })
+
+  it('reset only affects the targeted key', () => {
+    const limiter = new RateLimiter(60_000, 1)
+    limiter.check('keyA')
+    limiter.check('keyA') // keyA blocked
+    limiter.check('keyB')
+    limiter.check('keyB') // keyB blocked
+
+    limiter.reset('keyA')
+    expect(limiter.check('keyA')).toBe(false) // keyA allowed
+    expect(limiter.check('keyB')).toBe(true)  // keyB still blocked
+  })
+})
+
+describe('RateLimiter — window expiry', () => {
+  it('resets the counter automatically after the window expires', () => {
+    vi.useFakeTimers()
+    const windowMs = 1_000
+    const limiter = new RateLimiter(windowMs, 2)
+
+    limiter.check('key') // count = 1
+    limiter.check('key') // count = 2
+    expect(limiter.check('key')).toBe(true) // blocked
+
+    // Advance past the window
+    vi.advanceTimersByTime(windowMs + 1)
+
+    // The next check should open a new window
+    expect(limiter.check('key')).toBe(false) // new window, count = 1
+  })
+})
+
+describe('RateLimiter — key independence', () => {
+  it('tracks different keys independently', () => {
+    const limiter = new RateLimiter(60_000, 1)
+    // key-A hits limit
+    limiter.check('key-A') // count = 1
+    expect(limiter.check('key-A')).toBe(true) // blocked
+
+    // key-B untouched
+    expect(limiter.check('key-B')).toBe(false) // fresh key, allowed
+  })
+})