@consilioweb/payload-support 0.16.0 → 1.1.0

package/src/__tests__/sanitizeHtml.test.ts

@@ -0,0 +1,165 @@
+import { describe, it, expect } from 'vitest'
+import { sanitizeMessageHtml } from '../utils/sanitizeHtml'
+
+describe('sanitizeMessageHtml — XSS vectors stripped', () => {
+  it('strips <script> tags entirely', () => {
+    const result = sanitizeMessageHtml('<script>alert(1)</script>hi')
+    expect(result).not.toContain('<script')
+    expect(result).not.toContain('alert')
+    expect(result).toContain('hi')
+  })
+
+  it('strips <script> with attributes', () => {
+    const result = sanitizeMessageHtml('<script src="evil.js" type="text/javascript"></script>safe')
+    expect(result).not.toContain('<script')
+    expect(result).toContain('safe')
+  })
+
+  it('strips onerror inline event handlers on <img>', () => {
+    const result = sanitizeMessageHtml('<img src="x" onerror="alert(1)">')
+    expect(result).not.toContain('onerror')
+  })
+
+  it('strips onclick inline event handlers', () => {
+    const result = sanitizeMessageHtml('<span onclick="stealCookies()">click me</span>')
+    expect(result).not.toContain('onclick')
+    expect(result).toContain('click me')
+  })
+
+  it('strips onmouseover event handler', () => {
+    const result = sanitizeMessageHtml('<div onmouseover="evil()">hover</div>')
+    expect(result).not.toContain('onmouseover')
+  })
+
+  it('strips javascript: URI in anchor href', () => {
+    const result = sanitizeMessageHtml('<a href="javascript:alert(1)">x</a>')
+    expect(result).not.toContain('javascript:')
+  })
+
+  it('strips javascript: URI with mixed case', () => {
+    const result = sanitizeMessageHtml('<a href="JaVaScRiPt:alert(1)">x</a>')
+    expect(result).not.toContain('avascript:')
+    expect(result).not.toContain('href="JaVaScRiPt')
+  })
+
+  it('strips <iframe>', () => {
+    const result = sanitizeMessageHtml('<iframe src="https://evil.com"></iframe>text')
+    expect(result).not.toContain('<iframe')
+    expect(result).toContain('text')
+  })
+
+  it('strips <embed>', () => {
+    const result = sanitizeMessageHtml('<embed src="payload.swf">text')
+    expect(result).not.toContain('<embed')
+    expect(result).toContain('text')
+  })
+
+  it('strips <object>', () => {
+    const result = sanitizeMessageHtml('<object data="evil.swf"></object>after')
+    expect(result).not.toContain('<object')
+    expect(result).toContain('after')
+  })
+})
+
+describe('sanitizeMessageHtml — legitimate formatting preserved', () => {
+  it('preserves <b> tag', () => {
+    const result = sanitizeMessageHtml('<b>bold text</b>')
+    expect(result).toContain('<b>bold text</b>')
+  })
+
+  it('preserves <strong> tag', () => {
+    const result = sanitizeMessageHtml('<strong>important</strong>')
+    expect(result).toContain('<strong>important</strong>')
+  })
+
+  it('preserves <a href="https://..."> anchor', () => {
+    const result = sanitizeMessageHtml('<a href="https://example.com">link</a>')
+    expect(result).toContain('href="https://example.com"')
+    expect(result).toContain('link')
+  })
+
+  it('adds rel="noopener noreferrer nofollow" to links (tabnabbing defense)', () => {
+    const result = sanitizeMessageHtml('<a href="https://example.com">link</a>')
+    expect(result).toContain('rel="noopener noreferrer nofollow"')
+  })
+
+  it('preserves <ul><li> list structure', () => {
+    const result = sanitizeMessageHtml('<ul><li>item 1</li><li>item 2</li></ul>')
+    expect(result).toContain('<ul>')
+    expect(result).toContain('<li>item 1</li>')
+    expect(result).toContain('<li>item 2</li>')
+  })
+
+  it('preserves <ol> numbered list', () => {
+    const result = sanitizeMessageHtml('<ol><li>first</li></ol>')
+    expect(result).toContain('<ol>')
+    expect(result).toContain('<li>first</li>')
+  })
+
+  it('preserves safe inline style: color', () => {
+    const result = sanitizeMessageHtml('<span style="color: red">colored</span>')
+    // sanitize-html normalises CSS by stripping the space after ':'
+    expect(result).toContain('color:red')
+    expect(result).toContain('colored')
+  })
+
+  it('preserves safe inline style: color hex', () => {
+    const result = sanitizeMessageHtml('<span style="color: #ff0000">red</span>')
+    expect(result).toContain('color:#ff0000')
+  })
+
+  it('preserves text-align style', () => {
+    const result = sanitizeMessageHtml('<p style="text-align: center">centered</p>')
+    // sanitize-html normalises CSS by stripping the space after ':'
+    expect(result).toContain('text-align:center')
+  })
+
+  it('preserves <blockquote>', () => {
+    const result = sanitizeMessageHtml('<blockquote>quoted text</blockquote>')
+    expect(result).toContain('<blockquote>')
+    expect(result).toContain('quoted text')
+  })
+
+  it('preserves <code> and <pre>', () => {
+    const result = sanitizeMessageHtml('<pre><code>const x = 1;</code></pre>')
+    expect(result).toContain('<pre>')
+    expect(result).toContain('<code>')
+    expect(result).toContain('const x = 1;')
+  })
+
+  it('preserves heading tags h1-h3', () => {
+    const result = sanitizeMessageHtml('<h1>Title</h1><h2>Sub</h2><h3>Sub2</h3>')
+    expect(result).toContain('<h1>Title</h1>')
+    expect(result).toContain('<h2>Sub</h2>')
+    expect(result).toContain('<h3>Sub2</h3>')
+  })
+})
+
+describe('sanitizeMessageHtml — dangerous style values stripped', () => {
+  it('strips expression() from style (IE CSS injection)', () => {
+    const result = sanitizeMessageHtml('<span style="width: expression(alert(1))">x</span>')
+    expect(result).not.toContain('expression')
+  })
+
+  it('strips url() from style', () => {
+    const result = sanitizeMessageHtml('<span style="background: url(javascript:alert(1))">x</span>')
+    expect(result).not.toContain('url(')
+  })
+})
+
+describe('sanitizeMessageHtml — edge cases', () => {
+  it('returns empty string unchanged when falsy', () => {
+    expect(sanitizeMessageHtml('')).toBe('')
+  })
+
+  it('handles plain text without HTML', () => {
+    const result = sanitizeMessageHtml('Hello world')
+    expect(result).toBe('Hello world')
+  })
+
+  it('does not escape regular ampersands in text', () => {
+    const result = sanitizeMessageHtml('Tom &amp; Jerry')
+    expect(result).toContain('Tom')
+    expect(result).toContain('Jerry')
+  })
+})

package/src/__tests__/sla.test.ts

@@ -0,0 +1,258 @@
+import { describe, it, expect } from 'vitest'
+import { computeSlaState, formatSlaRemaining } from '../views/shared/sla'
+
+// ---------------------------------------------------------------------------
+// computeSlaState
+// ---------------------------------------------------------------------------
+
+describe('computeSlaState — no SLA data', () => {
+  it('returns state "none" when no due date is set', () => {
+    const result = computeSlaState({})
+    expect(result.state).toBe('none')
+    expect(result.remainingMs).toBeNull()
+    expect(result.due).toBeNull()
+  })
+
+  it('returns state "none" when dueRaw is null', () => {
+    const result = computeSlaState({ slaFirstResponseDue: null })
+    expect(result.state).toBe('none')
+  })
+
+  it('returns state "none" when dueRaw is an invalid date string', () => {
+    const result = computeSlaState({ slaFirstResponseDue: 'not-a-date' })
+    expect(result.state).toBe('none')
+  })
+})
+
+describe('computeSlaState — first response SLA (no firstResponseAt)', () => {
+  const future2h = new Date(Date.now() + 2 * 3_600_000).toISOString()
+  const future30m = new Date(Date.now() + 30 * 60_000).toISOString()
+  const past = new Date(Date.now() - 60_000).toISOString()
+
+  it('returns "ok" when deadline is more than 1 hour away', () => {
+    const result = computeSlaState({ slaFirstResponseDue: future2h })
+    expect(result.state).toBe('ok')
+    expect(result.remainingMs).toBeGreaterThan(3_600_000)
+  })
+
+  it('returns "warn" when deadline is less than 1 hour away', () => {
+    const result = computeSlaState({ slaFirstResponseDue: future30m })
+    expect(result.state).toBe('warn')
+    expect(result.remainingMs).toBeGreaterThan(0)
+    expect(result.remainingMs).toBeLessThan(3_600_000)
+  })
+
+  it('returns "breach" when deadline is in the past', () => {
+    const result = computeSlaState({ slaFirstResponseDue: past })
+    expect(result.state).toBe('breach')
+    expect(result.remainingMs).toBeLessThan(0)
+  })
+
+  it('returns "breach" when slaFirstResponseBreached flag is set (even with future due)', () => {
+    const result = computeSlaState({
+      slaFirstResponseDue: future2h,
+      slaFirstResponseBreached: true,
+    })
+    expect(result.state).toBe('breach')
+  })
+
+  it('exposes the due ISO string in result', () => {
+    const result = computeSlaState({ slaFirstResponseDue: future2h })
+    expect(result.due).toBe(future2h)
+  })
+})
+
+describe('computeSlaState — resolution SLA (firstResponseAt present)', () => {
+  const firstResponseAt = new Date(Date.now() - 60_000).toISOString()
+  const future2h = new Date(Date.now() + 2 * 3_600_000).toISOString()
+  const past = new Date(Date.now() - 60_000).toISOString()
+
+  it('uses resolution SLA when firstResponseAt is set', () => {
+    const result = computeSlaState({
+      firstResponseAt,
+      slaFirstResponseDue: past, // would be breach if used
+      slaResolutionDue: future2h, // ok
+    })
+    // Should use resolution SLA → ok
+    expect(result.state).toBe('ok')
+    expect(result.due).toBe(future2h)
+  })
+
+  it('returns "breach" when resolution deadline is passed', () => {
+    const result = computeSlaState({
+      firstResponseAt,
+      slaResolutionDue: past,
+    })
+    expect(result.state).toBe('breach')
+  })
+
+  it('returns "breach" when slaResolutionBreached flag is set', () => {
+    const result = computeSlaState({
+      firstResponseAt,
+      slaResolutionDue: future2h,
+      slaResolutionBreached: true,
+    })
+    expect(result.state).toBe('breach')
+  })
+})
+
+describe('computeSlaState — pinned "now" parameter', () => {
+  it('uses the provided "now" date for comparison', () => {
+    const due = '2024-01-15T10:00:00.000Z'
+    // now before due → ok
+    const before = new Date('2024-01-15T08:00:00.000Z')
+    expect(computeSlaState({ slaFirstResponseDue: due }, before).state).toBe('ok')
+    // now after due → breach
+    const after = new Date('2024-01-15T12:00:00.000Z')
+    expect(computeSlaState({ slaFirstResponseDue: due }, after).state).toBe('breach')
+    // now 30 min before due → warn
+    const soon = new Date('2024-01-15T09:35:00.000Z')
+    expect(computeSlaState({ slaFirstResponseDue: due }, soon).state).toBe('warn')
+  })
+})
+
+// ---------------------------------------------------------------------------
+// formatSlaRemaining
+// ---------------------------------------------------------------------------
+
+describe('formatSlaRemaining', () => {
+  it('returns "—" for null', () => {
+    expect(formatSlaRemaining(null)).toBe('—')
+  })
+
+  it('formats less-than-1-hour remaining as minutes (positive)', () => {
+    const thirtyMin = 30 * 60_000
+    expect(formatSlaRemaining(thirtyMin)).toBe('30m')
+  })
+
+  it('formats 0 remaining as "0m"', () => {
+    expect(formatSlaRemaining(0)).toBe('0m')
+  })
+
+  it('formats negative < 1 hour as −Xm', () => {
+    const minus15min = -(15 * 60_000)
+    expect(formatSlaRemaining(minus15min)).toBe('−15m')
+  })
+
+  it('formats exactly 1 hour as "1h"', () => {
+    const oneHour = 3_600_000
+    expect(formatSlaRemaining(oneHour)).toBe('1h')
+  })
+
+  it('formats 90 minutes as "1h 30"', () => {
+    const ninetyMin = 90 * 60_000
+    expect(formatSlaRemaining(ninetyMin)).toBe('1h 30')
+  })
+
+  it('formats negative hours as −Xh', () => {
+    const minus2h = -(2 * 3_600_000)
+    expect(formatSlaRemaining(minus2h)).toBe('−2h')
+  })
+
+  it('formats 24h+ as days (Xj)', () => {
+    const twoDays = 48 * 3_600_000
+    expect(formatSlaRemaining(twoDays)).toBe('2j')
+  })
+
+  it('formats negative 24h+ as −Xj', () => {
+    const minusThreeDays = -(3 * 24 * 3_600_000)
+    expect(formatSlaRemaining(minusThreeDays)).toBe('−3j')
+  })
+
+  it('formats whole hours without trailing "00" minutes', () => {
+    const twoHoursExact = 2 * 3_600_000
+    const result = formatSlaRemaining(twoHoursExact)
+    expect(result).toBe('2h')
+  })
+})
+
+// ---------------------------------------------------------------------------
+// calculateBusinessHoursDeadline (imported from hooks/checkSLA)
+// ---------------------------------------------------------------------------
+
+import { calculateBusinessHoursDeadline } from '../hooks/checkSLA'
+
+describe('calculateBusinessHoursDeadline', () => {
+  // Use UTC dates — the function uses local Date methods without TZ conversion.
+  // We pin times to Tuesday 2024-01-09 so all boundary math is predictable.
+
+  it('adds 60 minutes within the same business day', () => {
+    // Tuesday 2024-01-09 at 10:00 local
+    const start = new Date(2024, 0, 9, 10, 0, 0) // month is 0-indexed
+    const result = calculateBusinessHoursDeadline(start, 60)
+    expect(result.getHours()).toBe(11)
+    expect(result.getMinutes()).toBe(0)
+    expect(result.getDate()).toBe(9)
+  })
+
+  it('carries over minutes past end-of-day to the next business day', () => {
+    // Tuesday at 17:00, add 120 minutes (only 60 remain today: 17:00→18:00)
+    // Remaining 60 minutes spills into Wednesday morning: 9:00→10:00
+    const start = new Date(2024, 0, 9, 17, 0, 0)
+    const result = calculateBusinessHoursDeadline(start, 120)
+    expect(result.getDate()).toBe(10) // Wednesday
+    expect(result.getHours()).toBe(10)
+    expect(result.getMinutes()).toBe(0)
+  })
+
+  it('skips Saturday and Sunday', () => {
+    // Friday 2024-01-12 at 17:00, add 120 minutes → skips Sat/Sun → Monday 10:00
+    const start = new Date(2024, 0, 12, 17, 0, 0) // Friday
+    const result = calculateBusinessHoursDeadline(start, 120)
+    // 60 min remaining Friday (17→18), then 60 min on Monday (9→10)
+    expect(result.getDay()).toBe(1) // Monday
+    expect(result.getHours()).toBe(10)
+  })
+
+  it('moves a Saturday start to Monday 9:00 before counting', () => {
+    // Saturday at 10:00, add 60 minutes → Monday 10:00
+    const start = new Date(2024, 0, 13, 10, 0, 0) // Saturday
+    const result = calculateBusinessHoursDeadline(start, 60)
+    expect(result.getDay()).toBe(1) // Monday
+    expect(result.getHours()).toBe(10)
+  })
+
+  it('moves a Sunday start to Monday 9:00 before counting', () => {
+    // Sunday at 15:00, add 30 minutes → Monday 9:30
+    const start = new Date(2024, 0, 14, 15, 0, 0) // Sunday
+    const result = calculateBusinessHoursDeadline(start, 30)
+    expect(result.getDay()).toBe(1) // Monday
+    expect(result.getHours()).toBe(9)
+    expect(result.getMinutes()).toBe(30)
+  })
+
+  it('moves a before-hours start to 9:00 before counting', () => {
+    // Tuesday at 7:00 (before 9:00), add 30 minutes → 9:30 same day
+    const start = new Date(2024, 0, 9, 7, 0, 0)
+    const result = calculateBusinessHoursDeadline(start, 30)
+    expect(result.getDate()).toBe(9)
+    expect(result.getHours()).toBe(9)
+    expect(result.getMinutes()).toBe(30)
+  })
+
+  it('moves an after-hours start to next business day 9:00', () => {
+    // Tuesday at 19:00 (after 18:00), add 60 minutes → Wednesday 10:00
+    const start = new Date(2024, 0, 9, 19, 0, 0)
+    const result = calculateBusinessHoursDeadline(start, 60)
+    expect(result.getDate()).toBe(10) // Wednesday
+    expect(result.getHours()).toBe(10)
+  })
+
+  it('handles 0 minutes (deadline = start clamped to business hours)', () => {
+    const start = new Date(2024, 0, 9, 10, 30, 0) // Tuesday at 10:30
+    const result = calculateBusinessHoursDeadline(start, 0)
+    // Start is within business hours → no movement
+    expect(result.getDate()).toBe(9)
+    expect(result.getHours()).toBe(10)
+    expect(result.getMinutes()).toBe(30)
+  })
+
+  it('handles a full business day (540 min = 9 hours) spanning exactly one day', () => {
+    // Tuesday at 9:00, add 540 min (exactly one business day) → Tuesday 18:00
+    const start = new Date(2024, 0, 9, 9, 0, 0)
+    const result = calculateBusinessHoursDeadline(start, 540)
+    expect(result.getDate()).toBe(9)
+    expect(result.getHours()).toBe(18)
+    expect(result.getMinutes()).toBe(0)
+  })
+})

package/src/collections/AutomationRules.ts

@@ -0,0 +1,66 @@
+import type { CollectionConfig } from 'payload'
+import type { CollectionSlugs } from '../utils/slugs'
+
+const CONDITION_FIELDS = ['status', 'priority', 'category', 'source', 'subject'] as const
+const ACTION_TYPES = [
+  { label: 'Définir le statut', value: 'set_status' },
+  { label: 'Définir la priorité', value: 'set_priority' },
+  { label: 'Définir la catégorie', value: 'set_category' },
+  { label: 'Assigner à (id agent)', value: 'assign' },
+  { label: 'Ajouter un tag', value: 'add_tag' },
+]
+
+/**
+ * Visual automation rules (Zendesk-style triggers): when an event fires, if the
+ * conditions match the ticket, the actions are applied. Evaluated by the
+ * `createApplyAutomationRules` hook on the Tickets collection.
+ */
+export function createAutomationRulesCollection(slugs: CollectionSlugs): CollectionConfig {
+  return {
+    slug: slugs.automationRules,
+    labels: { singular: 'Règle d\'automatisation', plural: 'Règles d\'automatisation' },
+    admin: { useAsTitle: 'name', group: 'Support', defaultColumns: ['name', 'event', 'enabled', 'order'] },
+    access: {
+      read: ({ req }) => req.user?.collection === slugs.users,
+      create: ({ req }) => req.user?.collection === slugs.users,
+      update: ({ req }) => req.user?.collection === slugs.users,
+      delete: ({ req }) => req.user?.collection === slugs.users,
+    },
+    fields: [
+      { name: 'name', type: 'text', required: true, label: 'Nom' },
+      { name: 'enabled', type: 'checkbox', defaultValue: true, label: 'Active', index: true },
+      {
+        name: 'event', type: 'select', defaultValue: 'ticket_created', index: true, label: 'Déclencheur',
+        options: [
+          { label: 'Ticket créé', value: 'ticket_created' },
+          { label: 'Ticket mis à jour', value: 'ticket_updated' },
+          { label: 'Changement de statut', value: 'ticket_status_changed' },
+        ],
+      },
+      {
+        name: 'matchType', type: 'select', defaultValue: 'all', label: 'Correspondance',
+        options: [{ label: 'Toutes les conditions (ET)', value: 'all' }, { label: 'Au moins une (OU)', value: 'any' }],
+      },
+      { name: 'order', type: 'number', defaultValue: 0, label: 'Ordre d\'évaluation' },
+      {
+        name: 'conditions', type: 'array', label: 'Conditions',
+        fields: [
+          { name: 'field', type: 'select', required: true, options: CONDITION_FIELDS.map((v) => ({ label: v, value: v })) },
+          {
+            name: 'operator', type: 'select', defaultValue: 'equals', required: true,
+            options: [{ label: '= égal', value: 'equals' }, { label: '≠ différent', value: 'not_equals' }, { label: 'contient', value: 'contains' }],
+          },
+          { name: 'value', type: 'text', required: true },
+        ],
+      },
+      {
+        name: 'actions', type: 'array', label: 'Actions',
+        fields: [
+          { name: 'type', type: 'select', required: true, options: ACTION_TYPES },
+          { name: 'value', type: 'text', required: true },
+        ],
+      },
+    ],
+    timestamps: true,
+  }
+}

package/src/collections/NotificationQueue.ts

@@ -0,0 +1,30 @@
+import type { CollectionConfig } from 'payload'
+import type { CollectionSlugs } from '../utils/slugs'
+
+/**
+ * Pending client notifications, queued instead of sent immediately when the
+ * client's `notificationFrequency` is `daily` or `weekly`. The `process-digests`
+ * cron drains this per client and sends a single recap email.
+ */
+export function createNotificationQueueCollection(slugs: CollectionSlugs): CollectionConfig {
+  return {
+    slug: slugs.notificationQueue,
+    labels: { singular: 'Notification en file', plural: 'Notifications en file' },
+    admin: { hidden: true, group: 'Support', defaultColumns: ['client', 'type', 'title', 'createdAt'] },
+    access: {
+      // Internal: written/drained only via overrideAccess (hooks + cron).
+      create: () => false,
+      update: () => false,
+      read: ({ req }) => req.user?.collection === slugs.users,
+      delete: ({ req }) => req.user?.collection === slugs.users,
+    },
+    fields: [
+      { name: 'client', type: 'relationship', relationTo: slugs.supportClients, required: true, index: true, label: 'Client' },
+      { name: 'type', type: 'text', label: 'Type' },
+      { name: 'title', type: 'text', label: 'Titre' },
+      { name: 'message', type: 'textarea', label: 'Message' },
+      { name: 'ticket', type: 'relationship', relationTo: slugs.tickets, label: 'Ticket' },
+    ],
+    timestamps: true,
+  }
+}

package/src/collections/PushSubscription.ts

@@ -0,0 +1,28 @@
+import type { CollectionConfig } from 'payload'
+import type { CollectionSlugs } from '../utils/slugs'
+
+/**
+ * Web Push subscriptions for agents (browser notifications). Written by the
+ * /support/push/subscribe endpoint and drained by `sendPushToUser`.
+ */
+export function createPushSubscriptionCollection(slugs: CollectionSlugs): CollectionConfig {
+  return {
+    slug: slugs.pushSubscriptions,
+    labels: { singular: 'Abonnement push', plural: 'Abonnements push' },
+    admin: { hidden: true, group: 'Support', defaultColumns: ['user', 'endpoint', 'createdAt'] },
+    access: {
+      create: () => false, // written via the subscribe endpoint (overrideAccess)
+      read: ({ req }) => req.user?.collection === slugs.users,
+      update: () => false,
+      delete: ({ req }) => req.user?.collection === slugs.users,
+    },
+    fields: [
+      { name: 'user', type: 'relationship', relationTo: slugs.users, index: true, label: 'Agent' },
+      { name: 'endpoint', type: 'text', required: true, index: true, label: 'Endpoint' },
+      { name: 'p256dh', type: 'text', label: 'Clé p256dh' },
+      { name: 'auth', type: 'text', label: 'Clé auth' },
+      { name: 'userAgent', type: 'text', label: 'User-Agent' },
+    ],
+    timestamps: true,
+  }
+}

package/src/collections/SatisfactionSurveys.ts

@@ -60,12 +60,21 @@ export function createSatisfactionSurveysCollection(slugs: CollectionSlugs): Col
       {
         name: 'rating',
         type: 'number',
-        required: true,
         min: 1,
         max: 5,
         label: 'Note (1-5)',
         admin: {
-          description: '1 = Très insatisfait, 5 = Très satisfait',
+          description: '1 = Très insatisfait, 5 = Très satisfait (CSAT)',
+        },
+      },
+      {
+        name: 'nps',
+        type: 'number',
+        min: 0,
+        max: 10,
+        label: 'NPS (0-10)',
+        admin: {
+          description: '« Recommanderiez-vous ? » — promoteur 9-10, passif 7-8, détracteur 0-6',
         },
       },
       {

package/src/collections/SlaPolicies.ts

@@ -111,6 +111,16 @@ export function createSlaPoliciesCollection(slugs: CollectionSlugs): CollectionC
           description: 'Utiliser cette politique pour les tickets sans SLA spécifique (par priorité)',
         },
       },
+      {
+        name: 'team',
+        type: 'relationship',
+        relationTo: slugs.supportTeams,
+        index: true,
+        label: 'Équipe (optionnel)',
+        admin: {
+          description: "Limiter cette politique à une équipe — prioritaire sur la politique par défaut",
+        },
+      },
     ],
     access: {
       create: ({ req }) => req.user?.collection === slugs.users,