@consilioweb/payload-support 0.5.1

package/src/endpoints/chat-stream.ts

@@ -0,0 +1,127 @@
+import type { Endpoint } from 'payload'
+import type { CollectionSlugs } from '../utils/slugs'
+import { requireClient, handleAuthError } from '../utils/auth'
+
+/**
+ * GET /api/support/chat-stream?session=xxx
+ * Server-Sent Events endpoint for real-time chat messages (client-side).
+ * Replaces polling on GET /api/support/chat for connected clients.
+ * The existing polling endpoint is kept as fallback.
+ */
+export function createChatStreamEndpoint(slugs: CollectionSlugs): Endpoint {
+  return {
+    path: '/support/chat-stream',
+    method: 'get',
+    handler: async (req) => {
+      try {
+        requireClient(req, slugs)
+      } catch (error) {
+        const authResponse = handleAuthError(error)
+        if (authResponse) return authResponse
+        return Response.json({ error: 'Unauthorized' }, { status: 401 })
+      }
+
+      const url = new URL(req.url!)
+      const sessionId = url.searchParams.get('session')
+      const userId = req.user!.id
+
+      if (!sessionId) {
+        return Response.json({ error: 'Missing session parameter' }, { status: 400 })
+      }
+
+      // Verify session belongs to user
+      const existing = await req.payload.find({
+        collection: slugs.chatMessages as any,
+        where: {
+          session: { equals: sessionId },
+          client: { equals: userId },
+        },
+        limit: 1,
+        overrideAccess: true,
+      })
+
+      if (existing.docs.length === 0) {
+        return Response.json({ error: 'Session invalide' }, { status: 403 })
+      }
+
+      let lastCheck = new Date().toISOString()
+      const encoder = new TextEncoder()
+
+      const stream = new ReadableStream({
+        start(controller) {
+          // Send initial connection event
+          controller.enqueue(
+            encoder.encode(`data: ${JSON.stringify({ type: 'connected', session: sessionId })}\n\n`),
+          )
+
+          // Poll DB every 2 seconds for new messages
+          const interval = setInterval(async () => {
+            try {
+              const messages = await req.payload.find({
+                collection: slugs.chatMessages as any,
+                where: {
+                  session: { equals: sessionId },
+                  createdAt: { greater_than: lastCheck },
+                },
+                sort: 'createdAt',
+                limit: 50,
+                depth: 1,
+                overrideAccess: true,
+              })
+
+              if (messages.docs.length > 0) {
+                const data = JSON.stringify({
+                  type: 'messages',
+                  data: messages.docs,
+                })
+                controller.enqueue(encoder.encode(`data: ${data}\n\n`))
+                lastCheck = (messages.docs[messages.docs.length - 1] as any).createdAt
+
+                // Check if session was closed
+                const lastMsg = messages.docs[messages.docs.length - 1] as any
+                if (lastMsg.status === 'closed') {
+                  controller.enqueue(
+                    encoder.encode(
+                      `data: ${JSON.stringify({ type: 'closed', session: sessionId })}\n\n`,
+                    ),
+                  )
+                }
+              }
+            } catch (error) {
+              console.warn('[support] chat-stream SSE poll error:', error)
+            }
+          }, 2000)
+
+          // Heartbeat every 30s to keep connection alive
+          const heartbeat = setInterval(() => {
+            try {
+              controller.enqueue(encoder.encode(`: heartbeat\n\n`))
+            } catch {
+              // Stream already closed
+            }
+          }, 30000)
+
+          // Cleanup on client disconnect
+          req.signal?.addEventListener('abort', () => {
+            clearInterval(interval)
+            clearInterval(heartbeat)
+            try {
+              controller.close()
+            } catch {
+              // Already closed
+            }
+          })
+        },
+      })
+
+      return new Response(stream, {
+        headers: {
+          'Content-Type': 'text/event-stream',
+          'Cache-Control': 'no-cache, no-transform',
+          Connection: 'keep-alive',
+          'X-Accel-Buffering': 'no', // Disable nginx buffering
+        },
+      })
+    },
+  }
+}

package/src/endpoints/chat.ts

@@ -0,0 +1,188 @@
+import type { Endpoint } from 'payload'
+import type { Where } from 'payload'
+import type { CollectionSlugs } from '../utils/slugs'
+import crypto from 'crypto'
+import { RateLimiter } from '../utils/rateLimiter'
+import { requireClient, handleAuthError } from '../utils/auth'
+
+const chatSessionLimiter = new RateLimiter(3_600_000, 5) // 5 sessions per hour
+const chatMessageLimiter = new RateLimiter(60_000, 15) // 15 messages per minute
+
+/**
+ * GET /api/support/chat?session=xxx&after=timestamp
+ * Fetch chat messages for a session (polling). Client-only.
+ */
+export function createChatGetEndpoint(slugs: CollectionSlugs): Endpoint {
+  return {
+    path: '/support/chat',
+    method: 'get',
+    handler: async (req) => {
+      try {
+        const payload = req.payload
+
+        requireClient(req, slugs)
+
+        const url = new URL(req.url!)
+        const session = url.searchParams.get('session')
+        const after = url.searchParams.get('after')
+
+        if (!session) {
+          return Response.json({ error: 'Session requise' }, { status: 400 })
+        }
+
+        const where: Where = {
+          session: { equals: session },
+          client: { equals: req.user.id },
+        }
+
+        if (after) {
+          where.createdAt = { greater_than: after }
+        }
+
+        const messages = await payload.find({
+          collection: slugs.chatMessages as any,
+          where,
+          sort: 'createdAt',
+          limit: 100,
+          depth: 1,
+          overrideAccess: true,
+        })
+
+        return new Response(JSON.stringify({ messages: messages.docs, session }), {
+          headers: {
+            'Content-Type': 'application/json',
+            'Cache-Control': 'private, max-age=300, stale-while-revalidate=600',
+          },
+        })
+      } catch (error) {
+        const authResponse = handleAuthError(error)
+        if (authResponse) return authResponse
+        console.error('[support/chat] GET Error:', error)
+        return Response.json({ error: 'Erreur interne du serveur' }, { status: 500 })
+      }
+    },
+  }
+}
+
+/**
+ * POST /api/support/chat
+ * Send a message or start a new chat session. Client-only.
+ */
+export function createChatPostEndpoint(slugs: CollectionSlugs): Endpoint {
+  return {
+    path: '/support/chat',
+    method: 'post',
+    handler: async (req) => {
+      try {
+        const payload = req.payload
+
+        requireClient(req, slugs)
+
+        let body: { action?: string; session?: string; message?: string }
+        try {
+          body = await req.json!()
+        } catch {
+          return Response.json({ error: 'Invalid JSON body' }, { status: 400 })
+        }
+        const { action, session, message } = body
+        const userId = String(req.user.id)
+
+        // Start a new session
+        if (action === 'start') {
+          if (chatSessionLimiter.check(userId)) {
+            return Response.json({ error: 'Trop de sessions créées. Réessayez plus tard.' }, { status: 429 })
+          }
+
+          const sessionId = `chat_${crypto.randomBytes(16).toString('hex')}`
+
+          const systemMsg = await payload.create({
+            collection: slugs.chatMessages as any,
+            data: {
+              session: sessionId,
+              client: req.user.id,
+              senderType: 'system',
+              message: 'Chat démarré. Un agent vous répondra sous peu.',
+              status: 'active',
+            },
+            overrideAccess: true,
+          })
+
+          return Response.json({ session: sessionId, messages: [systemMsg] })
+        }
+
+        // Send a message
+        if (action === 'send' && session && message) {
+          if (chatMessageLimiter.check(userId)) {
+            return Response.json({ error: 'Trop de messages. Attendez un moment.' }, { status: 429 })
+          }
+
+          const trimmedMessage = String(message).trim()
+          if (!trimmedMessage || trimmedMessage.length > 2000) {
+            return Response.json({ error: 'Message invalide (1-2000 caractères).' }, { status: 400 })
+          }
+
+          // Verify session belongs to user
+          const existing = await payload.find({
+            collection: slugs.chatMessages as any,
+            where: { session: { equals: session }, client: { equals: req.user.id } },
+            limit: 1,
+            overrideAccess: true,
+          })
+
+          if (existing.docs.length === 0) {
+            return Response.json({ error: 'Session invalide' }, { status: 403 })
+          }
+
+          const newMsg = await payload.create({
+            collection: slugs.chatMessages as any,
+            data: {
+              session,
+              client: req.user.id,
+              senderType: 'client',
+              message: trimmedMessage,
+              status: 'active',
+            },
+            overrideAccess: true,
+          })
+
+          return Response.json({ message: newMsg })
+        }
+
+        // Close session
+        if (action === 'close' && session) {
+          const existing = await payload.find({
+            collection: slugs.chatMessages as any,
+            where: { session: { equals: session }, client: { equals: req.user.id } },
+            limit: 1,
+            overrideAccess: true,
+          })
+
+          if (existing.docs.length === 0) {
+            return Response.json({ error: 'Session invalide' }, { status: 403 })
+          }
+
+          await payload.create({
+            collection: slugs.chatMessages as any,
+            data: {
+              session,
+              client: req.user.id,
+              senderType: 'system',
+              message: 'Chat terminé par le client.',
+              status: 'closed',
+            },
+            overrideAccess: true,
+          })
+
+          return Response.json({ closed: true })
+        }
+
+        return Response.json({ error: 'Action invalide' }, { status: 400 })
+      } catch (error) {
+        const authResponse = handleAuthError(error)
+        if (authResponse) return authResponse
+        console.error('[support/chat] POST Error:', error)
+        return Response.json({ error: 'Erreur interne du serveur' }, { status: 500 })
+      }
+    },
+  }
+}

package/src/endpoints/chatbot.ts

@@ -0,0 +1,113 @@
+import type { Endpoint } from 'payload'
+import type { CollectionSlugs } from '../utils/slugs'
+import { RateLimiter } from '../utils/rateLimiter'
+
+const chatbotLimiter = new RateLimiter(60_000, 10) // 10 requests per minute per IP
+
+/**
+ * POST /api/support/chatbot
+ * AI chatbot that answers from the knowledge base before creating a ticket.
+ * Public endpoint (accessible from the support portal).
+ */
+export function createChatbotEndpoint(slugs: CollectionSlugs): Endpoint {
+  return {
+    path: '/support/chatbot',
+    method: 'post',
+    handler: async (req) => {
+      try {
+        const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || req.headers.get('x-real-ip') || 'unknown'
+        if (chatbotLimiter.check(ip)) {
+          return Response.json({ error: 'Too many requests. Please wait a moment.' }, { status: 429 })
+        }
+
+        let body: { question?: string }
+        try {
+          body = await req.json!()
+        } catch {
+          return Response.json({ error: 'Invalid JSON body' }, { status: 400 })
+        }
+        const { question } = body
+
+        if (!question?.trim() || question.trim().length < 5) {
+          return Response.json({ error: 'Question too short' }, { status: 400 })
+        }
+
+        const payload = req.payload
+
+        const articles = await payload.find({
+          collection: slugs.knowledgeBase as any,
+          where: { published: { equals: true } },
+          limit: 100,
+          depth: 0,
+          overrideAccess: true,
+        })
+
+        if (articles.docs.length === 0) {
+          return Response.json({
+            answer: null,
+            confidence: 0,
+            suggestion: 'create_ticket',
+            message: 'Aucun article disponible. Créez un ticket pour obtenir de l\'aide.',
+          })
+        }
+
+        const knowledgeContext = articles.docs
+          .map((a: any) => `## ${a.title}\n${JSON.stringify(a.body || '').slice(0, 500)}`)
+          .join('\n\n---\n\n')
+
+        const apiKey = process.env.ANTHROPIC_API_KEY
+        if (!apiKey) {
+          return Response.json({
+            answer: null,
+            confidence: 0,
+            suggestion: 'create_ticket',
+            message: 'Le chatbot IA n\'est pas configuré.',
+          })
+        }
+
+        const Anthropic = require('@anthropic-ai/sdk').default
+        const anthropic = new Anthropic({ apiKey })
+
+        const response = await anthropic.messages.create({
+          model: 'claude-haiku-4-5-20251001',
+          max_tokens: 500,
+          messages: [
+            {
+              role: 'user',
+              content: `Tu es un assistant de support. Tu dois répondre à la question du client en utilisant UNIQUEMENT les articles de la base de connaissances ci-dessous. Si la réponse n'est pas dans la base, dis-le clairement.
+
+BASE DE CONNAISSANCES :
+${knowledgeContext}
+
+QUESTION DU CLIENT :
+${question}
+
+Réponds en français, de manière concise et utile. Si tu ne trouves pas la réponse dans la base, réponds exactement "INCONNU" et rien d'autre.`,
+            },
+          ],
+        })
+
+        const answer = response.content[0].type === 'text' ? response.content[0].text : ''
+
+        if (answer.trim() === 'INCONNU' || answer.trim().length < 10) {
+          return Response.json({
+            answer: null,
+            confidence: 0,
+            suggestion: 'create_ticket',
+            message: 'Je n\'ai pas trouvé de réponse dans notre base de connaissances. Souhaitez-vous créer un ticket de support ?',
+          })
+        }
+
+        return Response.json({
+          answer: answer.trim(),
+          confidence: 1,
+          suggestion: 'resolved',
+          message: null,
+        })
+      } catch (error) {
+        console.error('[chatbot] Error:', error)
+        return Response.json({ error: 'Internal server error' }, { status: 500 })
+      }
+    },
+  }
+}

package/src/endpoints/delete-account.ts

@@ -0,0 +1,129 @@
+import type { Endpoint } from 'payload'
+import type { CollectionSlugs } from '../utils/slugs'
+import { requireClient, handleAuthError } from '../utils/auth'
+
+/**
+ * POST /api/support/delete-account
+ * RGPD — Right to erasure (Article 17).
+ * Allows a support client to request permanent deletion of their account.
+ * Uses batch deletes via `where` clauses instead of sequential per-document deletion.
+ */
+export function createDeleteAccountEndpoint(slugs: CollectionSlugs): Endpoint {
+  return {
+    path: '/support/delete-account',
+    method: 'post',
+    handler: async (req) => {
+      try {
+        const payload = req.payload
+
+        requireClient(req, slugs)
+
+        const body = await req.json!()
+        const { confirmPassword } = body
+
+        if (!confirmPassword) {
+          return Response.json(
+            { error: 'Mot de passe requis pour confirmer la suppression.' },
+            { status: 400 },
+          )
+        }
+
+        // Verify password
+        try {
+          await payload.login({
+            collection: slugs.supportClients as any,
+            data: { email: req.user.email!, password: confirmPassword },
+          })
+        } catch {
+          return Response.json(
+            { error: 'Mot de passe incorrect.' },
+            { status: 403 },
+          )
+        }
+
+        const clientId = req.user.id
+
+        // 1. Find all ticket IDs for this client
+        const tickets = await payload.find({
+          collection: slugs.tickets as any,
+          where: { client: { equals: clientId } },
+          limit: 10000,
+          depth: 0,
+          overrideAccess: true,
+          select: { id: true },
+        })
+
+        const ticketIds = tickets.docs.map((t) => t.id)
+
+        // 2. Batch delete related data using where clauses
+        if (ticketIds.length > 0) {
+          await payload.delete({
+            collection: slugs.ticketMessages as any,
+            where: { ticket: { in: ticketIds } },
+            overrideAccess: true,
+          })
+
+          await payload.delete({
+            collection: slugs.ticketActivityLog as any,
+            where: { ticket: { in: ticketIds } },
+            overrideAccess: true,
+          })
+
+          await payload.delete({
+            collection: slugs.timeEntries as any,
+            where: { ticket: { in: ticketIds } },
+            overrideAccess: true,
+          })
+
+          // Delete all tickets
+          await payload.delete({
+            collection: slugs.tickets as any,
+            where: { client: { equals: clientId } },
+            overrideAccess: true,
+          })
+        }
+
+        // 3. Batch delete satisfaction surveys
+        await payload.delete({
+          collection: slugs.satisfactionSurveys as any,
+          where: { client: { equals: clientId } },
+          overrideAccess: true,
+        })
+
+        // 4. Batch delete chat messages
+        await payload.delete({
+          collection: slugs.chatMessages as any,
+          where: { client: { equals: clientId } },
+          overrideAccess: true,
+        })
+
+        // 5. Delete the client account
+        await payload.delete({
+          collection: slugs.supportClients as any,
+          id: clientId,
+          overrideAccess: true,
+        })
+
+        const headers = new Headers({ 'Content-Type': 'application/json' })
+        const secure = process.env.NODE_ENV === 'production'
+        headers.append(
+          'Set-Cookie',
+          `payload-token=; HttpOnly; ${secure ? 'Secure; ' : ''}SameSite=Lax; Path=/; Max-Age=0`,
+        )
+
+        return new Response(
+          JSON.stringify({
+            deleted: true,
+            message: 'Votre compte et toutes vos données ont été supprimés définitivement.',
+          }),
+          { status: 200, headers },
+        )
+      } catch (err) {
+        const authResponse = handleAuthError(err)
+        if (authResponse) return authResponse
+        console.error('[delete-account] Error:', err)
+        return Response.json({ error: 'Erreur interne' }, { status: 500 })
+      }
+    },
+  }
+}

package/src/endpoints/email-stats.ts

@@ -0,0 +1,109 @@
+import type { Endpoint } from 'payload'
+import type { CollectionSlugs } from '../utils/slugs'
+
+/**
+ * GET /api/support/email-stats?days=7
+ * Aggregates EmailLogs data for the tracking dashboard. Admin-only.
+ */
+export function createEmailStatsEndpoint(slugs: CollectionSlugs): Endpoint {
+  return {
+    path: '/support/email-stats',
+    method: 'get',
+    handler: async (req) => {
+      try {
+        const payload = req.payload
+
+        if (!req.user) {
+          return Response.json({ error: 'Unauthorized' }, { status: 401 })
+        }
+
+        const url = new URL(req.url!)
+        const days = Math.min(Number(url.searchParams.get('days')) || 7, 365)
+        const cutoff = new Date(Date.now() - days * 24 * 60 * 60 * 1000).toISOString()
+
+        const allDocs: Array<{
+          status: string
+          processingTimeMs?: number | null
+          action?: string | null
+          createdAt: string
+        }> = []
+        const MAX_PAGES = 50
+        let page = 1
+        let hasMore = true
+
+        while (hasMore && page <= MAX_PAGES) {
+          const result = await payload.find({
+            collection: slugs.emailLogs as any,
+            where: { createdAt: { greater_than: cutoff } },
+            sort: '-createdAt',
+            limit: 500,
+            page,
+            depth: 0,
+            overrideAccess: true,
+            select: {
+              status: true,
+              processingTimeMs: true,
+              action: true,
+              createdAt: true,
+            },
+          })
+
+          allDocs.push(
+            ...result.docs.map((d: any) => ({
+              status: d.status,
+              processingTimeMs: d.processingTimeMs,
+              action: d.action,
+              createdAt: d.createdAt,
+            })),
+          )
+
+          hasMore = result.hasNextPage
+          page++
+        }
+
+        const total = allDocs.length
+        const success = allDocs.filter((d) => d.status === 'success').length
+        const errors = allDocs.filter((d) => d.status === 'error').length
+        const ignored = allDocs.filter((d) => d.status === 'ignored').length
+        const successRate = total > 0 ? Math.round((success / total) * 1000) / 10 : 0
+
+        const withTime = allDocs.filter((d) => typeof d.processingTimeMs === 'number' && d.processingTimeMs > 0)
+        const avgProcessingTime = withTime.length > 0
+          ? Math.round(withTime.reduce((sum, d) => sum + (d.processingTimeMs || 0), 0) / withTime.length)
+          : 0
+
+        // Daily breakdown
+        const dailyMap = new Map<string, { success: number; error: number; ignored: number }>()
+        for (const doc of allDocs) {
+          const day = doc.createdAt.slice(0, 10)
+          const entry = dailyMap.get(day) || { success: 0, error: 0, ignored: 0 }
+          if (doc.status === 'success') entry.success++
+          else if (doc.status === 'error') entry.error++
+          else if (doc.status === 'ignored') entry.ignored++
+          dailyMap.set(day, entry)
+        }
+
+        // Action breakdown
+        const actionMap = new Map<string, number>()
+        for (const doc of allDocs) {
+          const action = doc.action || 'unknown'
+          actionMap.set(action, (actionMap.get(action) || 0) + 1)
+        }
+
+        return Response.json({
+          total,
+          success,
+          errors,
+          ignored,
+          successRate,
+          avgProcessingTime,
+          daily: Object.fromEntries(dailyMap),
+          actions: Object.fromEntries(actionMap),
+        })
+      } catch (err) {
+        console.error('[email-stats] Error:', err)
+        return Response.json({ error: 'Internal server error' }, { status: 500 })
+      }
+    },
+  }
+}