@consilioweb/payload-support 0.16.0 → 1.1.0

package/src/collections/SupportClients.ts

@@ -1,4 +1,5 @@
-import type { CollectionConfig, CollectionAfterChangeHook } from 'payload'
+import type { CollectionConfig, CollectionAfterChangeHook, CollectionBeforeLoginHook } from 'payload'
+import { APIError } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { escapeHtml, emailWrapper, emailButton, emailParagraph } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
@@ -55,6 +56,40 @@ function createSendInvitationOnCreate(slugs: CollectionSlugs): CollectionAfterCh
   }
 }
 
+// ─── 2FA enforcement ─────────────────────────────────────
+
+// A successful /support/2fa "verify" stamps `twoFactorVerifiedAt`. Login is only
+// allowed within this window, after which the marker is consumed (single-use).
+const TWO_FA_WINDOW_MS = 5 * 60 * 1000
+
+/**
+ * Enforce 2FA at the auth layer for EVERY login path (custom endpoint AND the
+ * native /api/<collection>/login), closing the bypass where a token was issued
+ * before any 2FA check. Payload verifies the password BEFORE beforeLogin, and
+ * throwing here rolls back the session it just created — so no token is issued.
+ */
+function createEnforce2FA(slugs: CollectionSlugs): CollectionBeforeLoginHook {
+  return async ({ req, user }) => {
+    if (!(user as { twoFactorEnabled?: boolean })?.twoFactorEnabled) return user
+    const raw = (user as { twoFactorVerifiedAt?: string | null }).twoFactorVerifiedAt
+    const verifiedAt = raw ? new Date(raw).getTime() : 0
+    if (!(verifiedAt > Date.now() - TWO_FA_WINDOW_MS)) {
+      // Credentials valid, but a fresh 2FA verification is required.
+      throw new APIError('2FA_REQUIRED', 401)
+    }
+    // Single-use: consume the marker so the verified window can't be replayed.
+    await req.payload.update({
+      collection: slugs.supportClients,
+      id: user.id,
+      data: { twoFactorVerifiedAt: null },
+      req,
+      overrideAccess: true,
+    })
+    ;(user as { twoFactorVerifiedAt?: string | null }).twoFactorVerifiedAt = null
+    return user
+  }
+}
+
 // ─── Collection factory ──────────────────────────────────
 
 export function createSupportClientsCollection(slugs: CollectionSlugs): CollectionConfig {
@@ -184,6 +219,10 @@ export function createSupportClientsCollection(slugs: CollectionSlugs): Collecti
         name: 'opportunities',
         type: 'textarea',
         label: 'Opportunites commerciales',
+        access: {
+          // Admin-only: never serialize commercial notes onto the client's own doc.
+          read: ({ req }) => req.user?.collection === slugs.users,
+        },
         admin: {
           description: 'Notes commerciales (visible uniquement par les admins)',
         },
@@ -227,6 +266,19 @@ export function createSupportClientsCollection(slugs: CollectionSlugs): Collecti
         type: 'date',
         admin: { hidden: true },
       },
+      {
+        // Set by /support/2fa "verify"; gates login via the beforeLogin hook.
+        name: 'twoFactorVerifiedAt',
+        type: 'date',
+        admin: { hidden: true },
+      },
+      {
+        // Google OAuth subject id — accounts are linked by this, not email alone.
+        name: 'googleId',
+        type: 'text',
+        index: true,
+        admin: { hidden: true },
+      },
       {
         name: 'notifyOnReply',
         type: 'checkbox',
@@ -293,6 +345,10 @@ export function createSupportClientsCollection(slugs: CollectionSlugs): Collecti
         name: 'notes',
         type: 'textarea',
         label: 'Notes internes',
+        access: {
+          // Admin-only: never serialize internal notes onto the client's own doc.
+          read: ({ req }) => req.user?.collection === slugs.users,
+        },
         admin: {
           description: 'Visible uniquement par les admins',
           position: 'sidebar',
@@ -300,6 +356,7 @@ export function createSupportClientsCollection(slugs: CollectionSlugs): Collecti
       },
     ],
     hooks: {
+      beforeLogin: [createEnforce2FA(slugs)],
       afterChange: [createSendInvitationOnCreate(slugs)],
     },
     access: {

package/src/collections/SupportTeam.ts

@@ -0,0 +1,27 @@
+import type { CollectionConfig } from 'payload'
+import type { CollectionSlugs } from '../utils/slugs'
+
+/**
+ * Support teams / workspaces. Agents belong to teams; tickets can be assigned to
+ * a team. When `SUPPORT_TEAM_SCOPING` is enabled, agents only see the tickets of
+ * their teams (plus team-less tickets) — see the Tickets read access.
+ */
+export function createSupportTeamCollection(slugs: CollectionSlugs): CollectionConfig {
+  return {
+    slug: slugs.supportTeams,
+    labels: { singular: 'Équipe support', plural: 'Équipes support' },
+    admin: { useAsTitle: 'name', group: 'Support', defaultColumns: ['name', 'members'] },
+    access: {
+      read: ({ req }) => req.user?.collection === slugs.users,
+      create: ({ req }) => req.user?.collection === slugs.users,
+      update: ({ req }) => req.user?.collection === slugs.users,
+      delete: ({ req }) => req.user?.collection === slugs.users,
+    },
+    fields: [
+      { name: 'name', type: 'text', required: true, label: 'Nom' },
+      { name: 'description', type: 'textarea', label: 'Description' },
+      { name: 'members', type: 'relationship', relationTo: slugs.users, hasMany: true, index: true, label: 'Membres (agents)' },
+    ],
+    timestamps: true,
+  }
+}

package/src/collections/TicketActivityLog.ts

@@ -1,5 +1,6 @@
-import type { CollectionConfig } from 'payload'
+import type { CollectionConfig, Where } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
+import { resolveAccessibleTicketIds } from '../utils/ticketAccess'
 
 // ─── Collection factory ──────────────────────────────────
 
@@ -21,6 +22,7 @@ export function createTicketActivityLogCollection(slugs: CollectionSlugs): Colle
         type: 'relationship',
         relationTo: slugs.tickets,
         required: true,
+        index: true,
         label: 'Ticket',
       },
       {
@@ -65,11 +67,14 @@ export function createTicketActivityLogCollection(slugs: CollectionSlugs): Colle
     ],
     access: {
       create: () => false, // Created only by hooks via overrideAccess
-      read: ({ req }) => {
+      read: async ({ req }) => {
         if (req.user?.collection === slugs.users) return true
-        // Clients can read activity logs for their own tickets
+        // Clients can read activity logs only for tickets they own/collaborate on.
+        // Constrain by `ticket IN (...)` rather than a nested relationship filter
+        // (security boundary). Empty set → sentinel id (fail closed).
         if (req.user?.collection === slugs.supportClients) {
-          return { 'ticket.client': { equals: req.user.id } }
+          const ids = await resolveAccessibleTicketIds(req.payload, slugs, req.user.id)
+          return { ticket: { in: ids.length > 0 ? ids : [-1] } } as Where
         }
         return false
       },

package/src/collections/TicketMessages.ts

@@ -6,6 +6,11 @@ import { createAdminNotification } from '../utils/adminNotification'
 import { dispatchWebhook } from '../utils/webhookDispatcher'
 import { readSupportSettings } from '../utils/readSettings'
 import { createCheckSlaOnReply } from '../hooks/checkSLA'
+import { resolveAccessibleTicketIds } from '../utils/ticketAccess'
+import { sanitizeMessageHtml } from '../utils/sanitizeHtml'
+import { queueClientNotification } from '../utils/notificationQueue'
+import { sendPushToUser } from '../utils/push'
+import { dbFind, dbCreate, dbFindByID } from '../utils/db'
 
 function createAssignAuthor(slugs: CollectionSlugs): CollectionBeforeChangeHook {
   return async ({ data, operation, req }) => {
@@ -90,30 +95,51 @@ function createNotifyClient(slugs: CollectionSlugs): CollectionAfterChangeHook {
 
       const replyPreview = (doc.body || '').replace(/\s+/g, ' ').trim().slice(0, 90)
 
-      await req.payload.sendEmail({
-        to: client.email,
-        ...(supportEmail ? { replyTo: supportEmail } : {}),
-        ...(internalBcc ? { bcc: internalBcc } : {}),
-        subject: `Re: [${ticketNumber}] ${subject}`,
-        html: emailWrapper(`Nouvelle reponse — ${ticketNumber}`, [
-          emailParagraph(`Bonjour <strong>${escapeHtml(client.firstName || '')}</strong>,`),
-          emailParagraph(`Notre equipe a apporte une reponse a votre ticket <strong>${escapeHtml(ticketNumber)}</strong> — <em>${escapeHtml(subject)}</em>.`),
-          rawContent,
-          emailButton('Consulter le ticket', portalUrl),
-          emailParagraph('<span style="font-size: 13px; color: #6b7280;">Vous pouvez egalement repondre directement a cet email. Votre message sera automatiquement ajoute au ticket.</span>'),
-          emailTrackingPixel(ticketId, doc.id),
-        ].join(''), {
-          kind: 'reply',
-          preheader: replyPreview ? `${replyPreview}…` : `Nouvelle reponse a votre ticket ${ticketNumber}`,
-        }),
-      })
+      // Digest: clients on daily/weekly frequency are queued, not emailed now.
+      const freq = (client as { notificationFrequency?: string }).notificationFrequency
+      if (freq === 'daily' || freq === 'weekly') {
+        await queueClientNotification(req.payload, slugs, {
+          client: (client as { id: number | string }).id,
+          type: 'reply',
+          title: `Nouvelle reponse — ${ticketNumber}`,
+          message: replyPreview || `Reponse a votre ticket ${ticketNumber}`,
+          ticket: ticketId,
+        })
+        return doc
+      }
 
-      await req.payload.update({
-        collection: slugs.ticketMessages,
-        id: doc.id,
-        data: { emailSentAt: new Date().toISOString(), emailSentTo: client.email },
-        overrideAccess: true,
-      })
+      // Fire-and-forget: don't block the reply mutation on the SMTP round-trip
+      // (200-500ms). The email + its emailSentAt bookkeeping run detached.
+      void (async () => {
+        try {
+          await req.payload.sendEmail({
+            to: client.email,
+            ...(supportEmail ? { replyTo: supportEmail } : {}),
+            ...(internalBcc ? { bcc: internalBcc } : {}),
+            subject: `Re: [${ticketNumber}] ${subject}`,
+            html: emailWrapper(`Nouvelle reponse — ${ticketNumber}`, [
+              emailParagraph(`Bonjour <strong>${escapeHtml(client.firstName || '')}</strong>,`),
+              emailParagraph(`Notre equipe a apporte une reponse a votre ticket <strong>${escapeHtml(ticketNumber)}</strong> — <em>${escapeHtml(subject)}</em>.`),
+              rawContent,
+              emailButton('Consulter le ticket', portalUrl),
+              emailParagraph('<span style="font-size: 13px; color: #6b7280;">Vous pouvez egalement repondre directement a cet email. Votre message sera automatiquement ajoute au ticket.</span>'),
+              emailTrackingPixel(ticketId, doc.id),
+            ].join(''), {
+              kind: 'reply',
+              preheader: replyPreview ? `${replyPreview}…` : `Nouvelle reponse a votre ticket ${ticketNumber}`,
+            }),
+          })
+
+          await req.payload.update({
+            collection: slugs.ticketMessages,
+            id: doc.id,
+            data: { emailSentAt: new Date().toISOString(), emailSentTo: client.email },
+            overrideAccess: true,
+          })
+        } catch (err) {
+          console.error('[support] Failed to notify client (async):', err)
+        }
+      })()
     } catch (err) {
       console.error('[support] Failed to notify client:', err)
     }
@@ -161,8 +187,7 @@ function createSyncTicketReplyToChat(slugs: CollectionSlugs): CollectionAfterCha
       const clientId = typeof ticket.client === 'object' ? (ticket.client as { id: number | string }).id : ticket.client
 
       // Create a chat message so the client sees it in the widget
-      await payload.create({
-        collection: slugs.chatMessages as any,
+      await dbCreate(payload, slugs.chatMessages, {
         data: {
           session: ticket.chatSession,
           client: clientId,
@@ -236,6 +261,16 @@ function createNotifyAdminOnClientMessage(slugs: CollectionSlugs, notificationSl
       const preview = doc.body?.length > 500 ? doc.body.slice(0, 500) + '...' : doc.body
       const headerTitle = isNewTicket ? `Nouveau ticket ${ticketNumber}` : `Nouveau message — ${ticketNumber}`
 
+      // Browser push to the assigned agent (RUNTIME no-op without VAPID keys).
+      const assignedId = assignedAdmin?.id ?? (ticket.assignedTo && typeof ticket.assignedTo !== 'object' ? ticket.assignedTo : undefined)
+      if (assignedId) {
+        void sendPushToUser(payload, slugs, assignedId, {
+          title: headerTitle,
+          body: `${clientName}: ${preview || subject}`,
+          url: `/admin/collections/${slugs.tickets}/${ticketId}`,
+        }).catch(() => { /* best-effort */ })
+      }
+
       if (primaryEmail) {
         await payload.sendEmail({
           // INTERNAL email (to the support team) — recipients are the contact
@@ -302,6 +337,72 @@ function createDispatchWebhookOnReply(slugs: CollectionSlugs): CollectionAfterCh
   }
 }
 
+/**
+ * Sanitize submitted rich HTML before persistence. `bodyHtml` is rendered via
+ * dangerouslySetInnerHTML in the admin & portal, so unsanitized HTML is a
+ * stored-XSS vector (→ admin session theft → cross-client access). Runs for
+ * every writer (client AND admin) — neither needs to store scripts.
+ */
+function createSanitizeMessageHtml(): CollectionBeforeChangeHook {
+  return ({ data }) => {
+    if (data && typeof data.bodyHtml === 'string' && data.bodyHtml) {
+      data.bodyHtml = sanitizeMessageHtml(data.bodyHtml)
+    }
+    return data
+  }
+}
+
+// Matches `@someone@example.com` mentions inside a message body.
+const MENTION_RE = /@([^\s@]+@[^\s@]+\.[^\s@]+)/g
+
+/**
+ * Resolve `@email` mentions in the message body to agent (users) IDs, stored on
+ * the `mentions` field so the UI can highlight them and we can notify them.
+ */
+function createResolveMentions(slugs: CollectionSlugs): CollectionBeforeChangeHook {
+  return async ({ data, operation, req }) => {
+    if (operation !== 'create') return data
+    const body = typeof data?.body === 'string' ? data.body : ''
+    const emails = Array.from(new Set([...body.matchAll(MENTION_RE)].map((m) => m[1].toLowerCase())))
+    if (emails.length === 0) return data
+    try {
+      const users = await dbFind(req.payload, slugs.users, { where: { email: { in: emails } }, limit: 50, depth: 0, overrideAccess: true })
+      const ids = users.docs.map((u) => (u as { id: number | string }).id)
+      if (ids.length > 0) data.mentions = ids
+    } catch { /* users lookup is best-effort */ }
+    return data
+  }
+}
+
+/** Email the agents mentioned in a freshly-created message. */
+function createNotifyMentions(slugs: CollectionSlugs): CollectionAfterChangeHook {
+  return async ({ doc, operation, req }) => {
+    if (operation !== 'create') return doc
+    const mentions: Array<number | string | { id: number | string }> = Array.isArray(doc.mentions) ? doc.mentions : []
+    if (mentions.length === 0) return doc
+    const ticketId = typeof doc.ticket === 'object' ? doc.ticket.id : doc.ticket
+    const baseUrl = process.env.NEXT_PUBLIC_SERVER_URL || ''
+    for (const m of mentions) {
+      const userId = typeof m === 'object' ? m.id : m
+      try {
+        const user = await dbFindByID(req.payload, slugs.users, { id: userId, depth: 0, overrideAccess: true })
+        if (!user?.email) continue
+        await req.payload.sendEmail({
+          to: user.email,
+          subject: `Vous avez ete mentionne — ticket #${ticketId}`,
+          html: emailWrapper('Mention', [
+            emailParagraph(`Vous avez ete mentionne dans un message du ticket <strong>#${escapeHtml(String(ticketId))}</strong>.`),
+            ...(baseUrl ? [emailButton('Ouvrir le ticket', `${baseUrl}/admin/collections/${slugs.tickets}/${ticketId}`, 'dark')] : []),
+          ].join(''), { kind: 'system' }),
+        })
+      } catch (err) {
+        console.error('[support] Failed to notify mention:', err)
+      }
+    }
+    return doc
+  }
+}
+
 export function createTicketMessagesCollection(slugs: CollectionSlugs, options?: {
   notificationSlug?: string
 }): CollectionConfig {
@@ -312,14 +413,14 @@ export function createTicketMessagesCollection(slugs: CollectionSlugs, options?:
     labels: { singular: 'Message', plural: 'Messages' },
     admin: { hidden: true, group: 'Support', defaultColumns: ['ticket', 'authorType', 'createdAt'] },
     fields: [
-      { name: 'ticket', type: 'relationship', relationTo: slugs.tickets, required: true, label: 'Ticket' },
+      { name: 'ticket', type: 'relationship', relationTo: slugs.tickets, required: true, index: true, label: 'Ticket' },
       { name: 'body', type: 'textarea', required: true, label: 'Message' },
       { name: 'bodyHtml', type: 'textarea', label: 'Message HTML', admin: { hidden: true } },
       {
         type: 'row',
         fields: [
           {
-            name: 'authorType', type: 'select', label: 'Type d\'auteur', defaultValue: 'admin',
+            name: 'authorType', type: 'select', index: true, label: 'Type d\'auteur', defaultValue: 'admin',
             options: [
               { label: 'Client', value: 'client' },
               { label: 'Support', value: 'admin' },
@@ -348,8 +449,9 @@ export function createTicketMessagesCollection(slugs: CollectionSlugs, options?:
       },
       { name: 'isInternal', type: 'checkbox', defaultValue: false, label: 'Note interne', admin: { position: 'sidebar' } },
       { name: 'isSolution', type: 'checkbox', defaultValue: false, label: 'Reponse solution', admin: { position: 'sidebar' } },
+      { name: 'mentions', type: 'relationship', relationTo: slugs.users, hasMany: true, label: 'Agents mentionnes', admin: { hidden: true } },
       { name: 'skipNotification', type: 'checkbox', defaultValue: false, label: 'Sans notification', admin: { position: 'sidebar', condition: (data) => data?.skipNotification === true } },
-      { name: 'scheduledAt', type: 'date', label: 'Programme pour', admin: { date: { pickerAppearance: 'dayAndTime' }, position: 'sidebar', condition: (data) => !!data?.scheduledAt } },
+      { name: 'scheduledAt', type: 'date', index: true, label: 'Programme pour', admin: { date: { pickerAppearance: 'dayAndTime' }, position: 'sidebar', condition: (data) => !!data?.scheduledAt } },
       { name: 'scheduledSent', type: 'checkbox', defaultValue: false, admin: { hidden: true } },
       { name: 'editedAt', type: 'date', label: 'Modifie le', admin: { hidden: true } },
       { name: 'deletedAt', type: 'date', label: 'Supprime le', admin: { hidden: true } },
@@ -358,7 +460,7 @@ export function createTicketMessagesCollection(slugs: CollectionSlugs, options?:
       { name: 'emailOpenedAt', type: 'date', label: 'Email ouvert le', admin: { hidden: true } },
     ],
     hooks: {
-      beforeChange: [createAssignAuthor(slugs)],
+      beforeChange: [createSanitizeMessageHtml(), createResolveMentions(slugs), createAssignAuthor(slugs)],
       afterChange: [
         createAutoUpdateStatus(slugs),
         createNotifyClient(slugs),
@@ -368,16 +470,23 @@ export function createTicketMessagesCollection(slugs: CollectionSlugs, options?:
         createNotifyAdminOnClientMessage(slugs, notificationSlug),
         createFireMessageWebhooks(slugs),
         createDispatchWebhookOnReply(slugs),
+        createNotifyMentions(slugs),
       ],
     },
     access: {
       create: ({ req }) => req.user?.collection === slugs.users || req.user?.collection === slugs.supportClients,
-      read: ({ req }) => {
+      read: async ({ req }) => {
         if (req.user?.collection === slugs.users) return true
         if (req.user?.collection === slugs.supportClients) {
+          // Constrain to tickets the client owns or collaborates on, then filter
+          // messages by `ticket IN (...)`. We do NOT use a nested relationship
+          // filter ('ticket.client') as the security boundary — its behaviour
+          // through the SQLite adapter is not guaranteed. Empty set → sentinel
+          // id so the IN matches nothing (fail closed).
+          const ids = await resolveAccessibleTicketIds(req.payload, slugs, req.user.id)
           return {
             and: [
-              { 'ticket.client': { equals: req.user.id } } as Where,
+              { ticket: { in: ids.length > 0 ? ids : [-1] } } as Where,
               { isInternal: { equals: false } } as Where,
               { or: [{ scheduledAt: { exists: false } } as Where, { scheduledSent: { equals: true } } as Where] } as Where,
             ],

package/src/collections/Tickets.ts

@@ -13,8 +13,11 @@ import { createAdminNotification } from '../utils/adminNotification'
 import { dispatchWebhook } from '../utils/webhookDispatcher'
 import { readSupportSettings } from '../utils/readSettings'
 import { createTicketStatusEmail } from '../hooks/ticketStatusEmail'
-import { createAssignSlaDeadlines, createCheckSlaOnResolve } from '../hooks/checkSLA'
+import { createAssignSlaDeadlines, createCheckSlaOnResolve, createPauseSlaOnHold } from '../hooks/checkSLA'
+import { createApplyAutomationRules } from '../hooks/automationRules'
+import { isTeamScopingEnabled, resolveAgentTeamIds } from '../utils/teamAccess'
 import { generateTicketSynthesis } from '../utils/generateTicketSynthesis'
+import { dbFind, dbCreate, dbDelete } from '../utils/db'
 
 // ─── Hooks ───────────────────────────────────────────────
 
@@ -314,64 +317,6 @@ function createNotifyClientOnResolve(slugs: CollectionSlugs): CollectionAfterCha
   }
 }
 
-function createAutoCalculateSLA(slugs: CollectionSlugs): CollectionAfterChangeHook {
-  return async ({ doc, operation, req }) => {
-    if (operation !== 'create') return doc
-    try {
-      const { payload } = req
-      const ticketPriority = doc.priority || 'normal'
-
-      // Try to find a SLA policy matching the ticket's priority first
-      let policy: any = null
-      const byPriority = await payload.find({
-        collection: slugs.slaPolicies as any,
-        where: { priority: { equals: ticketPriority } },
-        limit: 1,
-        depth: 0,
-        overrideAccess: true,
-      })
-      if (byPriority.docs.length > 0) {
-        policy = byPriority.docs[0]
-      } else {
-        // Fall back to the default policy
-        const defaults = await payload.find({
-          collection: slugs.slaPolicies as any,
-          where: { isDefault: { equals: true } },
-          limit: 1,
-          depth: 0,
-          overrideAccess: true,
-        })
-        if (defaults.docs.length > 0) {
-          policy = defaults.docs[0]
-        }
-      }
-
-      if (!policy) return doc
-
-      // SLA fields are in minutes (firstResponseTime, resolutionTime)
-      const now = new Date()
-      const firstResponseMinutes = policy.firstResponseTime || 240 // default 4h
-      const resolutionMinutes = policy.resolutionTime || 1440 // default 24h
-      const firstResponseDue = new Date(now.getTime() + firstResponseMinutes * 60000)
-      const resolutionDue = new Date(now.getTime() + resolutionMinutes * 60000)
-
-      await payload.update({
-        collection: slugs.tickets as any,
-        id: doc.id,
-        data: {
-          slaPolicy: policy.id,
-          slaFirstResponseDue: firstResponseDue.toISOString(),
-          slaResolutionDue: resolutionDue.toISOString(),
-        },
-        overrideAccess: true,
-      })
-    } catch (err) {
-      console.error('[support] Failed to auto-calculate SLA:', err)
-    }
-    return doc
-  }
-}
-
 function createFireTicketWebhooks(slugs: CollectionSlugs): CollectionAfterChangeHook {
   return async ({ doc, previousDoc, operation, req }) => {
     const { payload } = req
@@ -478,8 +423,7 @@ function createCascadeDelete(slugs: CollectionSlugs): CollectionBeforeDeleteHook
   return async ({ id, req }) => {
     const collections = [slugs.ticketMessages, slugs.ticketActivityLog, slugs.timeEntries, slugs.satisfactionSurveys]
     for (const slug of collections) {
-      await req.payload.delete({
-        collection: slug as any,
+      await dbDelete(req.payload, slug, {
         where: { ticket: { equals: id } },
         overrideAccess: true,
       })
@@ -619,7 +563,7 @@ export function createTicketsCollection(slugs: CollectionSlugs, options?: {
         type: 'row',
         fields: [
           {
-            name: 'status', type: 'select', defaultValue: 'open', label: 'Statut',
+            name: 'status', type: 'select', index: true, defaultValue: 'open', label: 'Statut',
             options: [
               { label: 'Ouvert', value: 'open' },
               { label: 'En attente client', value: 'waiting_client' },
@@ -630,7 +574,7 @@ export function createTicketsCollection(slugs: CollectionSlugs, options?: {
             admin: { width: '50%' },
           },
           {
-            name: 'priority', type: 'select', defaultValue: 'normal', label: 'Priorite',
+            name: 'priority', type: 'select', index: true, defaultValue: 'normal', label: 'Priorite',
             options: [
               { label: 'Basse', value: 'low' },
               { label: 'Normale', value: 'normal' },
@@ -644,7 +588,7 @@ export function createTicketsCollection(slugs: CollectionSlugs, options?: {
       {
         type: 'row',
         fields: [
-          { name: 'client', type: 'relationship', relationTo: slugs.supportClients, required: true, label: 'Client', admin: { width: '50%' } },
+          { name: 'client', type: 'relationship', relationTo: slugs.supportClients, required: true, index: true, label: 'Client', admin: { width: '50%' } },
         ],
       },
       // Billing collapsible
@@ -710,8 +654,8 @@ export function createTicketsCollection(slugs: CollectionSlugs, options?: {
           {
             type: 'row',
             fields: [
-              { name: 'slaFirstResponseDue', type: 'date', label: 'Echeance 1ere reponse (SLA)', admin: { readOnly: true, width: '50%', date: { displayFormat: 'dd/MM/yyyy HH:mm' } } },
-              { name: 'slaResolutionDue', type: 'date', label: 'Echeance resolution (SLA)', admin: { readOnly: true, width: '50%', date: { displayFormat: 'dd/MM/yyyy HH:mm' } } },
+              { name: 'slaFirstResponseDue', type: 'date', index: true, label: 'Echeance 1ere reponse (SLA)', admin: { readOnly: true, width: '50%', date: { displayFormat: 'dd/MM/yyyy HH:mm' } } },
+              { name: 'slaResolutionDue', type: 'date', index: true, label: 'Echeance resolution (SLA)', admin: { readOnly: true, width: '50%', date: { displayFormat: 'dd/MM/yyyy HH:mm' } } },
             ],
           },
           {
@@ -719,6 +663,7 @@ export function createTicketsCollection(slugs: CollectionSlugs, options?: {
             fields: [
               { name: 'slaFirstResponseBreached', type: 'checkbox', label: '1ere reponse depassee', admin: { readOnly: true, width: '50%' } },
               { name: 'slaResolutionBreached', type: 'checkbox', label: 'Resolution depassee', admin: { readOnly: true, width: '50%' } },
+              { name: 'slaPausedAt', type: 'date', label: 'SLA en pause depuis', admin: { hidden: true } },
             ],
           },
         ],
@@ -739,14 +684,14 @@ export function createTicketsCollection(slugs: CollectionSlugs, options?: {
           },
           { name: 'mergedInto', type: 'relationship', relationTo: slugs.tickets, label: 'Fusionne dans', admin: { readOnly: true } },
           { name: 'autoCloseRemindedAt', type: 'date', label: 'Rappel auto-close envoye', admin: { readOnly: true, date: { displayFormat: 'dd/MM/yyyy HH:mm' } } },
-          { name: 'autoCloseScheduledAt', type: 'date', label: 'Fermeture auto programmee', admin: { readOnly: true, date: { displayFormat: 'dd/MM/yyyy HH:mm' }, description: 'Echeance ferme posee par une relance manuelle. Le ticket se ferme apres cette date sans reponse client.' } },
+          { name: 'autoCloseScheduledAt', type: 'date', index: true, label: 'Fermeture auto programmee', admin: { readOnly: true, date: { displayFormat: 'dd/MM/yyyy HH:mm' }, description: 'Echeance ferme posee par une relance manuelle. Le ticket se ferme apres cette date sans reponse client.' } },
         ],
       },
       // Sidebar
       { name: 'ticketNumber', type: 'text', unique: true, label: 'N° Ticket', admin: { position: 'sidebar' } },
       { name: 'slaPolicy', type: 'relationship', relationTo: slugs.slaPolicies, label: 'Politique SLA', admin: { position: 'sidebar' } },
       {
-        name: 'category', type: 'select', label: 'Categorie',
+        name: 'category', type: 'select', index: true, label: 'Categorie',
         options: [
           { label: 'Bug / Dysfonctionnement', value: 'bug' },
           { label: 'Modification de contenu', value: 'content' },
@@ -756,7 +701,8 @@ export function createTicketsCollection(slugs: CollectionSlugs, options?: {
         ],
         admin: { position: 'sidebar' },
       },
-      { name: 'assignedTo', type: 'relationship', relationTo: slugs.users, label: 'Assigne a', admin: { position: 'sidebar' } },
+      { name: 'assignedTo', type: 'relationship', relationTo: slugs.users, index: true, label: 'Assigne a', admin: { position: 'sidebar' } },
+      { name: 'team', type: 'relationship', relationTo: slugs.supportTeams, index: true, label: 'Equipe', admin: { position: 'sidebar' } },
       {
         name: 'source', type: 'select', defaultValue: 'portal', label: 'Source',
         options: [
@@ -764,6 +710,8 @@ export function createTicketsCollection(slugs: CollectionSlugs, options?: {
           { label: 'Chat en direct', value: 'live-chat' },
           { label: 'Email', value: 'email' },
           { label: 'Admin', value: 'admin' },
+          { label: 'WhatsApp', value: 'whatsapp' },
+          { label: 'Messenger', value: 'messenger' },
         ],
         admin: { position: 'sidebar' },
       },
@@ -811,8 +759,8 @@ export function createTicketsCollection(slugs: CollectionSlugs, options?: {
       afterChange: [
         createTrackSLA(slugs),
         createTrackAiSummaryOnResolve(slugs),
-        createAutoCalculateSLA(slugs),
         createAssignSlaDeadlines(slugs, notificationSlug),
+        createPauseSlaOnHold(slugs),
         createCheckSlaOnResolve(slugs, notificationSlug),
         createLogTicketActivity(slugs),
         createNotifyOnAssignment(slugs),
@@ -821,6 +769,7 @@ export function createTicketsCollection(slugs: CollectionSlugs, options?: {
         createNotifyAdminOnNewTicket(slugs, notificationSlug),
         createFireTicketWebhooks(slugs),
         createDispatchWebhookOnTicket(slugs),
+        createApplyAutomationRules(slugs),
       ],
       beforeDelete: [createCascadeDelete(slugs)],
     },
@@ -831,15 +780,24 @@ export function createTicketsCollection(slugs: CollectionSlugs, options?: {
         return false
       },
       read: async ({ req }) => {
-        if (req.user?.collection === slugs.users) return true
+        if (req.user?.collection === slugs.users) {
+          if (!isTeamScopingEnabled()) return true
+          // Team scoping (opt-in): agents see their teams' tickets + team-less ones.
+          const teamIds = await resolveAgentTeamIds(req.payload, slugs, req.user.id)
+          return {
+            or: [
+              { team: { in: teamIds.length > 0 ? teamIds : [-1] } },
+              { team: { exists: false } },
+            ],
+          } as Where
+        }
         if (req.user?.collection === slugs.supportClients) {
           // Owner OR collaborator (via ticket-collaborators table).
           // We resolve the collaborator ticket-ids upfront so we keep a single Where
           // expression — Payload's access fns support async returns.
           let collabTicketIds: Array<number | string> = []
           try {
-            const rows = await req.payload.find({
-              collection: 'ticket-collaborators' as any,
+            const rows = await dbFind(req.payload, 'ticket-collaborators', {
               where: { client: { equals: req.user.id } },
               limit: 1000,
               depth: 0,

package/src/collections/index.ts

@@ -17,3 +17,7 @@ export { createTicketStatusesCollection } from './TicketStatuses'
 export { createClientSummariesCollection } from './ClientSummaries'
 export { createTicketFeedbackCollection } from './TicketFeedback'
 export { createTicketCollaboratorsCollection } from './TicketCollaborators'
+export { createNotificationQueueCollection } from './NotificationQueue'
+export { createAutomationRulesCollection } from './AutomationRules'
+export { createSupportTeamCollection } from './SupportTeam'
+export { createPushSubscriptionCollection } from './PushSubscription'