@consilioweb/payload-support 0.16.0 → 1.1.0

package/src/endpoints/invoice.ts

@@ -0,0 +1,127 @@
+import type { Endpoint, Where } from 'payload'
+import type { CollectionSlugs } from '../utils/slugs'
+import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFind } from '../utils/db'
+import { escapeHtml } from '../utils/emailTemplate'
+import { generateInvoicePdf, type InvoiceLine } from '../utils/invoicePdf'
+
+/**
+ * GET /api/support/billing/invoice?from=YYYY-MM-DD&to=YYYY-MM-DD&projectId=...&format=html|pdf
+ *
+ * Admin-only. Renders an invoice for the billable tickets active in the period.
+ * `format=pdf` returns a real binary PDF (pdfkit); otherwise a self-contained,
+ * print-ready HTML document. Defaults to HTML.
+ */
+export function createInvoiceEndpoint(slugs: CollectionSlugs): Endpoint {
+  return {
+    path: '/support/billing/invoice',
+    method: 'get',
+    handler: async (req) => {
+      try {
+        requireAdmin(req, slugs)
+        const payload = req.payload
+        const url = new URL(req.url!)
+        const from = url.searchParams.get('from')
+        const to = url.searchParams.get('to')
+        const projectId = url.searchParams.get('projectId')
+        const format = url.searchParams.get('format') === 'pdf' ? 'pdf' : 'html'
+        if (!from || !to) {
+          return Response.json({ error: 'Paramètres from et to requis.' }, { status: 400 })
+        }
+
+        const toExclusive = new Date(to)
+        toExclusive.setDate(toExclusive.getDate() + 1)
+        const toIso = toExclusive.toISOString()
+
+        const where: Where = {
+          and: [
+            { billable: { equals: true } },
+            ...(projectId ? [{ project: { equals: Number(projectId) } } as Where] : []),
+            {
+              or: [
+                { and: [{ updatedAt: { greater_than_equal: from } }, { updatedAt: { less_than: toIso } }] },
+                { and: [{ createdAt: { greater_than_equal: from } }, { createdAt: { less_than: toIso } }] },
+                { and: [{ resolvedAt: { greater_than_equal: from } }, { resolvedAt: { less_than: toIso } }] },
+              ],
+            },
+          ],
+        }
+
+        const tickets: Array<Record<string, unknown>> = []
+        let page = 1
+        let hasMore = true
+        while (hasMore && page <= 50) {
+          const batch = await dbFind(payload, slugs.tickets, {
+            where, limit: 500, page, depth: 2, overrideAccess: true,
+            select: { ticketNumber: true, subject: true, billedAmount: true, totalTimeMinutes: true, project: true, client: true },
+          })
+          tickets.push(...(batch.docs as Array<Record<string, unknown>>))
+          hasMore = batch.hasNextPage ?? false
+          page++
+        }
+
+        // Shared structured lines (used by both HTML and PDF renderers).
+        let totalAmount = 0
+        let totalMinutes = 0
+        const lines: InvoiceLine[] = tickets.map((t) => {
+          const amount = typeof t.billedAmount === 'number' ? t.billedAmount : 0
+          const minutes = typeof t.totalTimeMinutes === 'number' ? t.totalTimeMinutes : 0
+          totalAmount += amount
+          totalMinutes += minutes
+          const client = typeof t.client === 'object' && t.client ? (t.client as { company?: string }).company || '' : ''
+          return { ticketNumber: String(t.ticketNumber || ''), subject: String(t.subject || ''), client, minutes, amount }
+        })
+
+        if (format === 'pdf') {
+          const pdf = await generateInvoicePdf({ from, to, projectId, lines, totalMinutes, totalAmount })
+          return new Response(new Uint8Array(pdf), {
+            status: 200,
+            headers: {
+              'Content-Type': 'application/pdf',
+              'Content-Disposition': `inline; filename="invoice-${from}_${to}.pdf"`,
+            },
+          })
+        }
+
+        const fmtAmount = (n: number) => `${n.toFixed(2)} €`
+        const fmtTime = (min: number) => `${Math.floor(min / 60)}h${String(min % 60).padStart(2, '0')}`
+        const rows = lines.map((l) => `<tr>
+            <td>${escapeHtml(l.ticketNumber)}</td>
+            <td>${escapeHtml(l.subject)}</td>
+            <td>${escapeHtml(l.client)}</td>
+            <td style="text-align:right;">${fmtTime(l.minutes)}</td>
+            <td style="text-align:right;">${fmtAmount(l.amount)}</td>
+          </tr>`).join('')
+
+        const html = `<!doctype html>
+<html lang="fr"><head><meta charset="utf-8"><title>Facture ${escapeHtml(from)} → ${escapeHtml(to)}</title>
+<style>
+  body { font-family: system-ui, -apple-system, sans-serif; color: #1e293b; max-width: 820px; margin: 32px auto; padding: 0 24px; }
+  h1 { font-size: 22px; margin: 0 0 4px; }
+  .period { color: #64748b; margin-bottom: 24px; }
+  table { width: 100%; border-collapse: collapse; font-size: 14px; }
+  th, td { padding: 8px 10px; border-bottom: 1px solid #e2e8f0; text-align: left; }
+  th { background: #f8fafc; font-size: 12px; text-transform: uppercase; letter-spacing: .04em; color: #475569; }
+  tfoot td { font-weight: 700; border-top: 2px solid #0f172a; border-bottom: none; }
+  @media print { body { margin: 0; } }
+</style></head>
+<body>
+  <h1>Facture / Pré-facture</h1>
+  <div class="period">Période : ${escapeHtml(from)} → ${escapeHtml(to)}${projectId ? ` · Projet #${escapeHtml(projectId)}` : ''}</div>
+  <table>
+    <thead><tr><th>Ticket</th><th>Sujet</th><th>Client</th><th style="text-align:right;">Temps</th><th style="text-align:right;">Montant</th></tr></thead>
+    <tbody>${rows || '<tr><td colspan="5" style="color:#94a3b8;">Aucun ticket facturable sur la période.</td></tr>'}</tbody>
+    <tfoot><tr><td colspan="3">Total (${lines.length} ticket${lines.length > 1 ? 's' : ''})</td><td style="text-align:right;">${fmtTime(totalMinutes)}</td><td style="text-align:right;">${fmtAmount(totalAmount)}</td></tr></tfoot>
+  </table>
+</body></html>`
+
+        return new Response(html, { status: 200, headers: { 'Content-Type': 'text/html; charset=utf-8' } })
+      } catch (error) {
+        const authResponse = handleAuthError(error)
+        if (authResponse) return authResponse
+        console.error('[invoice] Error:', error)
+        return Response.json({ error: 'Erreur interne' }, { status: 500 })
+      }
+    },
+  }
+}

package/src/endpoints/kb-search.ts

@@ -1,5 +1,6 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
+import { dbFind } from '../utils/db'
 
 // Combining diacritics range used to strip accents after NFD normalization.
 const DIACRITICS = /[̀-ͯ]/g
@@ -107,8 +108,7 @@ export function createKbSearchEndpoint(slugs: CollectionSlugs): Endpoint {
         // Always include the raw query for short single-word matches.
         orClauses.push({ title: { contains: q } })
 
-        const res = await payload.find({
-          collection: slugs.knowledgeBase as any,
+        const res = await dbFind(payload, slugs.knowledgeBase, {
           where: {
             and: [
               { published: { equals: true } },

package/src/endpoints/login.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { RateLimiter } from '../utils/rateLimiter'
+import { dbCreate } from '../utils/db'
 
 const loginLimiter = new RateLimiter(15 * 60_000, 10) // 10 per 15 min
 
@@ -13,6 +14,9 @@ export function createLoginEndpoint(slugs: CollectionSlugs): Endpoint {
     path: '/support/login',
     method: 'post',
     handler: async (req) => {
+      // NOTE: x-forwarded-for is spoofable unless this app sits strictly behind a
+      // trusted proxy that rewrites it. This IP rate-limit is a SECONDARY defense;
+      // the primary brute-force control is Payload's account lock (maxLoginAttempts).
       const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || req.headers.get('x-real-ip') || 'unknown'
 
       if (loginLimiter.check(ip)) {
@@ -43,8 +47,7 @@ export function createLoginEndpoint(slugs: CollectionSlugs): Endpoint {
         })
 
         // Log successful login (fire-and-forget)
-        payload.create({
-          collection: slugs.authLogs as any,
+        dbCreate(payload, slugs.authLogs, {
           data: { email, success: true, action: 'login', ipAddress: ip, userAgent },
           overrideAccess: true,
         }).catch(() => {})
@@ -71,13 +74,18 @@ export function createLoginEndpoint(slugs: CollectionSlugs): Endpoint {
       } catch (err: unknown) {
         const errorMessage = err instanceof Error ? err.message : 'Erreur inconnue'
 
+        // 2FA gate: password was correct but a fresh 2FA verification is required.
+        // No session/cookie is issued (Payload rolled it back on the throw).
+        if (errorMessage.includes('2FA_REQUIRED')) {
+          return Response.json({ requires2FA: true }, { status: 200 })
+        }
+
         let errorReason = 'Identifiants incorrects'
         if (errorMessage.includes('locked') || errorMessage.includes('verrouillé') || errorMessage.includes('Too many')) {
           errorReason = 'Compte verrouillé (trop de tentatives)'
         }
 
-        payload.create({
-          collection: slugs.authLogs as any,
+        dbCreate(payload, slugs.authLogs, {
           data: { email, success: false, action: 'login', errorReason, ipAddress: ip, userAgent },
           overrideAccess: true,
         }).catch(() => {})

package/src/endpoints/merge-clients.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFind, dbFindByID, dbUpdate, dbDelete } from '../utils/db'
 
 /**
  * POST /api/support/merge-clients
@@ -23,8 +24,8 @@ export function createMergeClientsEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         const [source, target] = await Promise.all([
-          payload.findByID({ collection: slugs.supportClients as any, id: sourceId, depth: 0, overrideAccess: true }),
-          payload.findByID({ collection: slugs.supportClients as any, id: targetId, depth: 0, overrideAccess: true }),
+          dbFindByID(payload, slugs.supportClients, { id: sourceId, depth: 0, overrideAccess: true }),
+          dbFindByID(payload, slugs.supportClients, { id: targetId, depth: 0, overrideAccess: true }),
         ]) as [any, any]
 
         if (!source || !target) {
@@ -40,73 +41,67 @@ export function createMergeClientsEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         // 1. Transfer tickets
-        const tickets = await payload.find({
-          collection: slugs.tickets as any,
+        const tickets = await dbFind(payload, slugs.tickets, {
           where: { client: { equals: sourceId } },
           limit: 500,
           depth: 0,
           overrideAccess: true,
         })
         for (const ticket of tickets.docs) {
-          await payload.update({ collection: slugs.tickets as any, id: ticket.id, data: { client: targetId }, overrideAccess: true })
+          await dbUpdate(payload, slugs.tickets, { id: ticket.id, data: { client: targetId }, overrideAccess: true })
           results.tickets++
         }
 
         // 2. Transfer ticket messages (authorClient)
-        const messages = await payload.find({
-          collection: slugs.ticketMessages as any,
+        const messages = await dbFind(payload, slugs.ticketMessages, {
           where: { authorClient: { equals: sourceId } },
           limit: 1000,
           depth: 0,
           overrideAccess: true,
         })
         for (const msg of messages.docs) {
-          await payload.update({ collection: slugs.ticketMessages as any, id: msg.id, data: { authorClient: targetId }, overrideAccess: true })
+          await dbUpdate(payload, slugs.ticketMessages, { id: msg.id, data: { authorClient: targetId }, overrideAccess: true })
           results.ticketMessages++
         }
 
         // 3. Transfer chat messages
-        const chats = await payload.find({
-          collection: slugs.chatMessages as any,
+        const chats = await dbFind(payload, slugs.chatMessages, {
           where: { client: { equals: sourceId } },
           limit: 1000,
           depth: 0,
           overrideAccess: true,
         })
         for (const chat of chats.docs) {
-          await payload.update({ collection: slugs.chatMessages as any, id: chat.id, data: { client: targetId }, overrideAccess: true })
+          await dbUpdate(payload, slugs.chatMessages, { id: chat.id, data: { client: targetId }, overrideAccess: true })
           results.chatMessages++
         }
 
         // 4. Transfer pending emails
-        const pendingEmails = await payload.find({
-          collection: slugs.pendingEmails as any,
+        const pendingEmails = await dbFind(payload, slugs.pendingEmails, {
           where: { client: { equals: sourceId } },
           limit: 500,
           depth: 0,
           overrideAccess: true,
         })
         for (const pe of pendingEmails.docs) {
-          await payload.update({ collection: slugs.pendingEmails as any, id: pe.id, data: { client: targetId }, overrideAccess: true })
+          await dbUpdate(payload, slugs.pendingEmails, { id: pe.id, data: { client: targetId }, overrideAccess: true })
           results.pendingEmails++
         }
 
         // 5. Transfer satisfaction surveys
-        const surveys = await payload.find({
-          collection: slugs.satisfactionSurveys as any,
+        const surveys = await dbFind(payload, slugs.satisfactionSurveys, {
           where: { client: { equals: sourceId } },
           limit: 500,
           depth: 0,
           overrideAccess: true,
         })
         for (const survey of surveys.docs) {
-          await payload.update({ collection: slugs.satisfactionSurveys as any, id: survey.id, data: { client: targetId }, overrideAccess: true })
+          await dbUpdate(payload, slugs.satisfactionSurveys, { id: survey.id, data: { client: targetId }, overrideAccess: true })
           results.satisfactionSurveys++
         }
 
         // 6. Delete source client
-        await payload.delete({
-          collection: slugs.supportClients as any,
+        await dbDelete(payload, slugs.supportClients, {
           id: sourceId,
           overrideAccess: true,
         })

package/src/endpoints/merge-tickets.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFind, dbFindByID, dbCreate, dbUpdate, dbDelete } from '../utils/db'
 
 /**
  * POST /api/support/merge-tickets
@@ -27,8 +28,8 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         const [source, target] = await Promise.all([
-          payload.findByID({ collection: slugs.tickets as any, id: sourceTicketId, depth: 0, overrideAccess: true }),
-          payload.findByID({ collection: slugs.tickets as any, id: targetTicketId, depth: 0, overrideAccess: true }),
+          dbFindByID(payload, slugs.tickets, { id: sourceTicketId, depth: 0, overrideAccess: true }),
+          dbFindByID(payload, slugs.tickets, { id: targetTicketId, depth: 0, overrideAccess: true }),
         ])
 
         if (!source) return Response.json({ error: 'Ticket source introuvable' }, { status: 404 })
@@ -42,8 +43,7 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         // Move all messages from source to target
-        const messages = await payload.find({
-          collection: slugs.ticketMessages as any,
+        const messages = await dbFind(payload, slugs.ticketMessages, {
           where: { ticket: { equals: sourceTicketId } },
           limit: 500,
           depth: 0,
@@ -51,8 +51,7 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
         })
 
         for (const msg of messages.docs) {
-          await payload.update({
-            collection: slugs.ticketMessages as any,
+          await dbUpdate(payload, slugs.ticketMessages, {
             id: msg.id,
             data: { ticket: targetTicketId },
             overrideAccess: true,
@@ -60,8 +59,7 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         // Move time entries
-        const timeEntries = await payload.find({
-          collection: slugs.timeEntries as any,
+        const timeEntries = await dbFind(payload, slugs.timeEntries, {
           where: { ticket: { equals: sourceTicketId } },
           limit: 500,
           depth: 0,
@@ -69,8 +67,7 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
         })
 
         for (const entry of timeEntries.docs) {
-          await payload.update({
-            collection: slugs.timeEntries as any,
+          await dbUpdate(payload, slugs.timeEntries, {
             id: entry.id,
             data: { ticket: targetTicketId },
             overrideAccess: true,
@@ -79,8 +76,7 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
 
         // Add internal note to target
         const sourceNumber = (source as any).ticketNumber || `#${sourceTicketId}`
-        await payload.create({
-          collection: slugs.ticketMessages as any,
+        await dbCreate(payload, slugs.ticketMessages, {
           data: {
             ticket: targetTicketId,
             body: `Messages fusionnés depuis ${sourceNumber} (${messages.totalDocs} messages, ${timeEntries.totalDocs} entrées de temps)`,
@@ -92,15 +88,13 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
         })
 
         // Delete source ticket
-        await payload.delete({
-          collection: slugs.tickets as any,
+        await dbDelete(payload, slugs.tickets, {
           id: sourceTicketId,
           overrideAccess: true,
         })
 
         // Recalculate totalTimeMinutes on target
-        const allTimeEntries = await payload.find({
-          collection: slugs.timeEntries as any,
+        const allTimeEntries = await dbFind(payload, slugs.timeEntries, {
           where: { ticket: { equals: targetTicketId } },
           limit: 500,
           depth: 0,
@@ -112,8 +106,7 @@ export function createMergeTicketsEndpoint(slugs: CollectionSlugs): Endpoint {
           0,
         )
 
-        await payload.update({
-          collection: slugs.tickets as any,
+        await dbUpdate(payload, slugs.tickets, {
           id: targetTicketId,
           data: { totalTimeMinutes: totalMinutes },
           overrideAccess: true,

package/src/endpoints/oauth-google.ts

@@ -1,6 +1,8 @@
 import type { Endpoint } from 'payload'
+import { getFieldsToSign, jwtSign } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import crypto from 'crypto'
+import { dbFind, dbUpdate, dbCreate, dbFindByID } from '../utils/db'
 
 /**
  * POST /api/support/oauth/google
@@ -89,22 +91,43 @@ export function createOAuthGoogleEndpoint(slugs: CollectionSlugs, options?: OAut
             return Response.json({ error: 'no_email' }, { status: 400 })
           }
 
+          // Only trust Google-verified emails — an unverified email matching an
+          // existing client would otherwise allow account takeover.
+          if (profile.verified_email !== true) {
+            return Response.json({ error: 'email_not_verified' }, { status: 403 })
+          }
+
           const payload = req.payload
 
-          // Find existing support client by email
-          const existing = await payload.find({
-            collection: slugs.supportClients as any,
-            where: { email: { equals: profile.email } },
+          // Resolve the account by the stable Google subject id first, then by the
+          // (verified) email — linking the googleId so subsequent logins are stable.
+          const byGoogle = await dbFind(payload, slugs.supportClients, {
+            where: { googleId: { equals: profile.id } },
             limit: 1,
             depth: 0,
             overrideAccess: true,
           })
+          let clientDoc = byGoogle.docs[0] as { id: number | string; email: string } | undefined
 
-          let clientDoc = existing.docs[0]
+          if (!clientDoc) {
+            const byEmail = await dbFind(payload, slugs.supportClients, {
+              where: { email: { equals: profile.email } },
+              limit: 1,
+              depth: 0,
+              overrideAccess: true,
+            })
+            clientDoc = byEmail.docs[0] as { id: number | string; email: string } | undefined
+            if (clientDoc && profile.id) {
+              await dbUpdate(payload, slugs.supportClients, {
+                id: clientDoc.id,
+                data: { googleId: profile.id },
+                overrideAccess: true,
+              })
+            }
+          }
 
-          // Auto-create account if needed
+          // Auto-create account if needed (domain restriction enforced)
           if (!clientDoc) {
-            // Domain restriction check for new accounts
             const allowedDomains = options?.allowedEmailDomains
             if (allowedDomains && allowedDomains.length > 0) {
               const emailDomain = profile.email.split('@')[1]?.toLowerCase()
@@ -122,50 +145,74 @@ export function createOAuthGoogleEndpoint(slugs: CollectionSlugs, options?: OAut
             const fullName = profile.name || profile.email.split('@')[0]
             const nameParts = fullName.split(' ')
 
-            clientDoc = await payload.create({
-              collection: slugs.supportClients as any,
+            clientDoc = await dbCreate(payload, slugs.supportClients, {
               data: {
                 email: profile.email,
                 firstName: nameParts[0] || fullName,
                 lastName: nameParts.slice(1).join(' ') || '-',
                 company: fullName,
+                googleId: profile.id,
                 password: autoPassword,
               },
               overrideAccess: true,
-            })
+            }) as { id: number | string; email: string }
           }
 
-          // Generate temp password, login, then rotate
-          const tempPassword = crypto.randomBytes(48).toString('base64url')
-          await payload.update({
-            collection: slugs.supportClients as any,
-            id: clientDoc.id,
-            data: { password: tempPassword },
-            overrideAccess: true,
-          })
-
-          const loginResult = await payload.login({
-            collection: slugs.supportClients as any,
-            data: { email: profile.email, password: tempPassword },
-          })
-
-          // Immediately rotate password
-          const postLoginPassword = crypto.randomBytes(48).toString('base64url')
-          await payload.update({
-            collection: slugs.supportClients as any,
-            id: clientDoc.id,
-            data: { password: postLoginPassword },
-            overrideAccess: true,
-          })
-
-          if (!loginResult.token) {
-            return Response.json({ error: 'login_failed' }, { status: 400 })
+          // Mint a Payload session WITHOUT touching the user's password.
+          // Uses Payload's own jwtSign/getFieldsToSign so the token format matches
+          // exactly, and replicates addSessionToUser for the sessions array.
+          const secret = process.env.PAYLOAD_SECRET
+          if (!secret) {
+            return Response.json({ error: 'server_misconfigured' }, { status: 500 })
+          }
+          const collectionConfig = (payload as any).collections[slugs.supportClients].config
+          const tokenExpiration: number = collectionConfig.auth?.tokenExpiration ?? 7200
+
+          let sid: string | undefined
+          if (collectionConfig.auth?.useSessions) {
+            sid = crypto.randomUUID()
+            const now = new Date()
+            const expiresAt = new Date(now.getTime() + tokenExpiration * 1000)
+            const fresh = (await dbFindByID(payload, slugs.supportClients, {
+              id: clientDoc.id,
+              depth: 0,
+              overrideAccess: true,
+              showHiddenFields: true,
+            })) as { sessions?: Array<{ id: string; createdAt: string; expiresAt: string }> }
+            const kept = Array.isArray(fresh?.sessions)
+              ? fresh.sessions.filter((s) => new Date(s.expiresAt) > now)
+              : []
+            await payload.db.updateOne({
+              collection: slugs.supportClients,
+              id: clientDoc.id,
+              data: {
+                sessions: [
+                  ...kept,
+                  { id: sid, createdAt: now.toISOString(), expiresAt: expiresAt.toISOString() },
+                ],
+              },
+              returning: false,
+            } as any)
           }
 
-          return Response.json({
-            token: loginResult.token,
-            user: loginResult.user,
-            exp: loginResult.exp,
+          const fieldsToSign = getFieldsToSign({
+            collectionConfig,
+            email: clientDoc.email,
+            sid,
+            user: { ...clientDoc, collection: slugs.supportClients },
+          } as any)
+          const { token, exp } = await jwtSign({ fieldsToSign, secret, tokenExpiration })
+
+          const headers = new Headers({ 'Content-Type': 'application/json' })
+          const cookieSecure = process.env.NODE_ENV === 'production'
+          headers.append(
+            'Set-Cookie',
+            `payload-token=${token}; HttpOnly; ${cookieSecure ? 'Secure; ' : ''}SameSite=Lax; Path=/; Max-Age=${tokenExpiration}`,
+          )
+
+          return new Response(JSON.stringify({ token, user: clientDoc, exp }), {
+            status: 200,
+            headers,
           })
         }