@consilioweb/payload-support 1.1.0 → 2.0.0

package/dist/styles/ChatView.module.scss

@@ -37,7 +37,7 @@ $font-stack: -apple-system, BlinkMacSystemFont, 'Inter', 'Segoe UI', system-ui,
 .container {
   display: flex;
   gap: 16px;
-  height: calc(100vh - 220px);
+  height: calc(100dvh - 220px);
   min-height: 500px;
 }
 

package/dist/styles/TicketDetail.module.scss

@@ -531,7 +531,7 @@
   gap: 8px;
   padding: 8px 14px;
   font-size: 12px;
-  color: #7c3aed;
+  color: #17807c;
   font-weight: 500;
 }
 
@@ -539,7 +539,7 @@
   display: flex;
   gap: 3px;
   span {
-    width: 5px; height: 5px; border-radius: 50%; background: #7c3aed;
+    width: 5px; height: 5px; border-radius: 50%; background: #17807c;
     animation: bounce 1.2s infinite;
     &:nth-child(2) { animation-delay: 150ms; }
     &:nth-child(3) { animation-delay: 300ms; }
@@ -612,7 +612,7 @@
   &:disabled { opacity: 0.4; cursor: not-allowed; }
 }
 
-// Bouton IA — accent purple, pill style
+// AI button — teal accent, pill style
 .toolbarBtnAi {
   background: var(--theme-accent-50, color-mix(in srgb, var(--theme-accent-500, #6b46e8) 10%, transparent));
   border-color: color-mix(in srgb, var(--theme-accent-500, #6b46e8) 25%, transparent);

package/dist/styles/_tokens.scss

@@ -18,7 +18,7 @@ $green: #16a34a;
 $amber: #d97706;
 $orange: #ea580c;
 $red: #dc2626;
-$purple: #7c3aed;
+$teal: #17807c;
 $cyan: #0891b2;
 
 // Mixins

package/dist/styles/theme.css

@@ -136,7 +136,7 @@
   --support-cat-core: #2563eb;
   --support-cat-communication: #16a34a;
   --support-cat-productivity: #d97706;
-  --support-cat-advanced: #7c3aed;
+  --support-cat-advanced: #17807c;
 
   /* ------------------------------------------
    * 8. PROJECT STATUS COLORS
@@ -385,7 +385,7 @@
   --support-activity-line-color: var(--support-border-color);
   --support-activity-dot-default: var(--support-text-muted);
   --support-activity-dot-status: var(--support-primary);
-  --support-activity-dot-assign: #7c3aed;
+  --support-activity-dot-assign: #17807c;
   --support-activity-dot-merge: #0891b2;
 
   /* ------------------------------------------
@@ -465,10 +465,10 @@
    * Indicator for messages scheduled to be
    * sent at a future date/time.
    * ------------------------------------------ */
-  --support-scheduled-bg: #f5f3ff;
+  --support-scheduled-bg: #eef8f7;
   --support-scheduled-border: #a78bfa;
   --support-scheduled-text: #5b21b6;
-  --support-scheduled-icon: #7c3aed;
+  --support-scheduled-icon: #17807c;
 
   /* ------------------------------------------
    * 34. EMAIL TRACKING
@@ -615,8 +615,8 @@
 
   /* Scheduled */
   --support-scheduled-bg: #2e1065;
-  --support-scheduled-border: #7c3aed;
-  --support-scheduled-text: #c4b5fd;
+  --support-scheduled-border: #17807c;
+  --support-scheduled-text: #80bbb7;
 
   /* Email tracking */
   --support-email-pending: #64748b;

package/dist/views/TicketingSettingsView/client.cjs

@@ -129,7 +129,7 @@ function getCategories(t) {
     { key: "core", label: t("settingsView.categories.core"), color: adminTokens.V.blue },
     { key: "communication", label: t("settingsView.categories.communication"), color: adminTokens.V.green },
     { key: "productivity", label: t("settingsView.categories.productivity"), color: adminTokens.V.amber },
-    { key: "advanced", label: t("settingsView.categories.advanced"), color: "#7c3aed" }
+    { key: "advanced", label: t("settingsView.categories.advanced"), color: "#17807c" }
   ];
 }
 const Toggle = ({ checked, onChange, color = adminTokens.V.blue, size = "md" }) => {
@@ -421,7 +421,7 @@ const TicketingSettingsClient = () => {
       {
         title: t("settingsView.aiTitle"),
         icon: /* @__PURE__ */ jsxRuntime.jsx(lucideReact.Bot, { size: 16 }),
-        color: "#7c3aed",
+        color: "#17807c",
         defaultOpen: false,
         badge: features.ai ? /* @__PURE__ */ jsxRuntime.jsx("span", { className: ts__default.default.badge, style: { backgroundColor: "#dcfce7", color: "#166534" }, children: t("settingsView.aiBadgeActive") }) : /* @__PURE__ */ jsxRuntime.jsx("span", { className: ts__default.default.badge, style: { backgroundColor: "#fee2e2", color: "#991b1b" }, children: t("settingsView.aiBadgeInactive") }),
         children: [
@@ -484,7 +484,7 @@ const TicketingSettingsClient = () => {
               {
                 checked: settings.ai[item.key],
                 onChange: () => updateAI(item.key, !settings.ai[item.key]),
-                color: "#7c3aed",
+                color: "#17807c",
                 size: "sm"
               }
             ),

package/dist/views/TicketingSettingsView/client.js

@@ -123,7 +123,7 @@ function getCategories(t) {
     { key: "core", label: t("settingsView.categories.core"), color: V.blue },
     { key: "communication", label: t("settingsView.categories.communication"), color: V.green },
     { key: "productivity", label: t("settingsView.categories.productivity"), color: V.amber },
-    { key: "advanced", label: t("settingsView.categories.advanced"), color: "#7c3aed" }
+    { key: "advanced", label: t("settingsView.categories.advanced"), color: "#17807c" }
   ];
 }
 const Toggle = ({ checked, onChange, color = V.blue, size = "md" }) => {
@@ -415,7 +415,7 @@ const TicketingSettingsClient = () => {
       {
         title: t("settingsView.aiTitle"),
         icon: /* @__PURE__ */ jsx(Bot, { size: 16 }),
-        color: "#7c3aed",
+        color: "#17807c",
         defaultOpen: false,
         badge: features.ai ? /* @__PURE__ */ jsx("span", { className: ts.badge, style: { backgroundColor: "#dcfce7", color: "#166534" }, children: t("settingsView.aiBadgeActive") }) : /* @__PURE__ */ jsx("span", { className: ts.badge, style: { backgroundColor: "#fee2e2", color: "#991b1b" }, children: t("settingsView.aiBadgeInactive") }),
         children: [
@@ -478,7 +478,7 @@ const TicketingSettingsClient = () => {
               {
                 checked: settings.ai[item.key],
                 onChange: () => updateAI(item.key, !settings.ai[item.key]),
-                color: "#7c3aed",
+                color: "#17807c",
                 size: "sm"
               }
             ),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consilioweb/payload-support",
-  "version": "1.1.0",
+  "version": "2.0.0",
   "description": "Payload CMS plugin — professional support & ticketing system with AI, SLA, time tracking, live chat, and more",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -124,20 +124,20 @@
     "node": ">=18"
   },
   "devDependencies": {
-    "@payloadcms/db-sqlite": "^3.85.1",
+    "@payloadcms/db-sqlite": "^3.86.0",
     "@playwright/test": "^1.49.0",
-    "@payloadcms/graphql": "^3.85.1",
-    "@payloadcms/next": "^3.85.1",
-    "@payloadcms/richtext-lexical": "^3.85.1",
-    "@payloadcms/translations": "^3.85.1",
-    "@payloadcms/ui": "^3.85.1",
+    "@payloadcms/graphql": "^3.86.0",
+    "@payloadcms/next": "^3.86.0",
+    "@payloadcms/richtext-lexical": "^3.86.0",
+    "@payloadcms/translations": "^3.86.0",
+    "@payloadcms/ui": "^3.86.0",
     "@types/pdfkit": "^0.17.6",
     "@types/react": "^19.0.0",
     "@types/sanitize-html": "^2.16.1",
     "@types/web-push": "^3.6.4",
     "esbuild-sass-plugin": "^3.7.0",
-    "next": "^15.5.14",
-    "payload": "^3.85.1",
+    "next": "^16.2.9",
+    "payload": "^3.86.0",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "tsup": "^8.0.0",

package/src/__tests__/aiSummaryRendering.test.ts

@@ -0,0 +1,21 @@
+import React from 'react'
+import { describe, expect, it } from 'vitest'
+import { renderAiSummary } from '../components/TicketConversation/components/AISummaryPanel'
+
+describe('AI summary rendering', () => {
+  it('escapes model-provided HTML instead of interpreting it', () => {
+    const nodes = renderAiSummary('<img src=x onerror=alert(1)>')
+    expect(nodes).toEqual(['<img src=x onerror=alert(1)>'])
+    expect(React.isValidElement(nodes[0])).toBe(false)
+  })
+
+  it('preserves bold markdown and line breaks without raw HTML', () => {
+    const nodes = renderAiSummary('**Résumé**\nSuite')
+    expect(React.isValidElement(nodes[0])).toBe(true)
+    expect((nodes[0] as React.ReactElement).type).toBe('strong')
+    expect((nodes[0] as React.ReactElement<{ children: string }>).props.children).toBe('Résumé')
+    expect(React.isValidElement(nodes[1])).toBe(true)
+    expect((nodes[1] as React.ReactElement).type).toBe('br')
+    expect(nodes[2]).toBe('Suite')
+  })
+})

package/src/__tests__/authResponses.test.ts

@@ -0,0 +1,69 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createLoginEndpoint } from '../endpoints/login'
+import { createOAuthGoogleEndpoint } from '../endpoints/oauth-google'
+import { resolveSlugs } from '../utils/slugs'
+
+const slugs = resolveSlugs()
+
+afterEach(() => {
+  vi.restoreAllMocks()
+})
+
+describe('authentication responses', () => {
+  it('keeps the login JWT exclusively in the HttpOnly cookie', async () => {
+    const endpoint = createLoginEndpoint(slugs)
+    const response = await endpoint.handler({
+      headers: new Headers(),
+      json: async () => ({ email: 'client@example.com', password: 'secret' }),
+      payload: {
+        login: vi.fn(async () => ({ token: 'jwt-secret', exp: 123, user: { id: 1 } })),
+        create: vi.fn(async () => ({})),
+      },
+    } as never)
+
+    expect(response.headers.get('set-cookie')).toContain('payload-token=jwt-secret')
+    expect(response.headers.get('set-cookie')).toContain('HttpOnly')
+    await expect(response.json()).resolves.toEqual({
+      message: 'Login successful',
+      user: { id: 1 },
+      exp: 123,
+    })
+  })
+
+  it('keeps the OAuth JWT exclusively in the HttpOnly cookie', async () => {
+    process.env.GOOGLE_OAUTH_CLIENT_ID = 'google-client'
+    process.env.GOOGLE_OAUTH_CLIENT_SECRET = 'google-secret'
+    process.env.NEXT_PUBLIC_SERVER_URL = 'https://example.test'
+    process.env.PAYLOAD_SECRET = 'payload-secret'
+
+    vi.spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(new Response(JSON.stringify({ access_token: 'google-token' })))
+      .mockResolvedValueOnce(new Response(JSON.stringify({
+        id: 'google-id',
+        email: 'client@example.com',
+        verified_email: true,
+      })))
+
+    const endpoint = createOAuthGoogleEndpoint(slugs)
+    const response = await endpoint.handler({
+      json: async () => ({ code: 'code', state: 'state', cookieState: 'state' }),
+      payload: {
+        collections: {
+          [slugs.supportClients]: {
+            config: { auth: { tokenExpiration: 7200 }, fields: [] },
+          },
+        },
+        find: vi.fn(async () => ({
+          docs: [{ id: 1, email: 'client@example.com' }],
+          totalDocs: 1,
+        })),
+      },
+    } as never)
+
+    expect(response.status).toBe(200)
+    expect(response.headers.get('set-cookie')).toMatch(/^payload-token=/)
+    const body = await response.json() as Record<string, unknown>
+    expect(body).not.toHaveProperty('token')
+    expect(body).toHaveProperty('user')
+  })
+})

package/src/__tests__/capabilities.test.ts

@@ -0,0 +1,71 @@
+import type { Config, Field } from 'payload'
+import { describe, expect, it, vi } from 'vitest'
+import { supportPlugin } from '../plugin'
+
+function fieldNames(fields: Field[]): string[] {
+  return fields.flatMap((field) => {
+    const own = 'name' in field && typeof field.name === 'string' ? [field.name] : []
+    const nested = 'fields' in field && Array.isArray(field.fields) ? fieldNames(field.fields) : []
+    return [...own, ...nested]
+  })
+}
+
+function configuredPlugin() {
+  return supportPlugin({
+    capabilities: {
+      aiSummaries: { generate: vi.fn(async () => undefined) },
+      aiTitles: { generate: vi.fn(async () => undefined) },
+      detailedBilling: true,
+      inboundEmail: {
+        secret: 'test-secret',
+        handle: vi.fn(async () => Response.json({ success: true })),
+      },
+      projectSuggestions: {
+        suggest: vi.fn(async () => Response.json({ suggestions: [] })),
+      },
+      sms: {
+        adapter: { send: vi.fn(async () => ({ sent: true })) },
+      },
+      threadCleanup: { clean: vi.fn(async () => undefined) },
+      volunteering: true,
+    },
+    rateLimitStore: 'payload',
+  })({ collections: [], endpoints: [] } as unknown as Config) as Config
+}
+
+describe('Support capabilities', () => {
+  it('owns the optional ticket, message and client fields', () => {
+    const config = configuredPlugin()
+    const collection = (slug: string) => config.collections?.find((item) => item.slug === slug)
+
+    expect(fieldNames(collection('tickets')!.fields)).toEqual(expect.arrayContaining([
+      'billingLines',
+      'billedAt',
+      'displayTitle',
+      'displayTitleStatus',
+      'volunteer',
+      'volunteerValue',
+      'waitingSince',
+    ]))
+    expect(fieldNames(collection('ticket-messages')!.fields)).toEqual(expect.arrayContaining([
+      'notifyBySms',
+      'smsTo',
+      'smsMessage',
+      'isMarkedAsNoise',
+      'emailBodyOriginal',
+    ]))
+    expect(fieldNames(collection('support-clients')!.fields)).toEqual(expect.arrayContaining([
+      'notifyBySmsChannel',
+      'preferredFormality',
+      'preferredTone',
+    ]))
+  })
+
+  it('registers protected deployment adapter endpoints in the module', () => {
+    const paths = configuredPlugin().endpoints?.map((endpoint) => endpoint.path)
+    expect(paths).toContain('/support-webhook/inbound-email')
+    expect(paths).toContain('/support/suggest-projects')
+    expect(paths).toContain('/support/ticket-title')
+    expect(paths).toContain('/support/generate-missing-titles')
+  })
+})

package/src/__tests__/generateTrackingToken.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest'
-import { generateTrackingToken } from '../endpoints/track-open'
+import { generateTrackingToken, verifyTrackingToken } from '../endpoints/track-open'
 
 describe('generateTrackingToken — determinism', () => {
   it('returns the same token for identical inputs (deterministic)', () => {
@@ -8,14 +8,28 @@ describe('generateTrackingToken — determinism', () => {
     expect(a).toBe(b)
   })
 
-  it('always returns exactly 16 characters', () => {
+  it('returns the complete SHA-256 HMAC', () => {
     const token = generateTrackingToken('1', '2', 'secret')
-    expect(token).toHaveLength(16)
+    expect(token).toHaveLength(64)
   })
 
   it('returns only hex characters (0-9 a-f)', () => {
     const token = generateTrackingToken('100', '200', 'anothersecret')
-    expect(token).toMatch(/^[0-9a-f]{16}$/)
+    expect(token).toMatch(/^[0-9a-f]{64}$/)
+  })
+})
+
+describe('verifyTrackingToken', () => {
+  it('accepts the matching ticket and message signature', () => {
+    const token = generateTrackingToken('42', '7', 'secret')
+    expect(verifyTrackingToken('42', '7', token, 'secret')).toBe(true)
+  })
+
+  it('rejects malformed and mismatched signatures without throwing', () => {
+    const token = generateTrackingToken('42', '7', 'secret')
+    expect(verifyTrackingToken('42', '8', token, 'secret')).toBe(false)
+    expect(verifyTrackingToken('42', '7', 'not-hex', 'secret')).toBe(false)
+    expect(verifyTrackingToken('42', '7', token.slice(2), 'secret')).toBe(false)
   })
 })
 

package/src/__tests__/integration/core-behaviors.test.ts

@@ -23,6 +23,29 @@ describe('core ticketing behaviours', () => {
     expect(t1.ticketNumber).not.toBe(t2.ticketNumber)
   }, 60_000)
 
+  it('allocates sequential numbers under concurrent creation and after deletion', async () => {
+    const payload = await buildTestPayload()
+    const c = await makeClient(payload, 'concurrent-num@example.com')
+    const tickets = await Promise.all(
+      Array.from({ length: 12 }, (_, index) => payload.create({
+        collection: 'tickets',
+        data: { subject: `concurrent-${index}`, client: c.id, status: 'open', priority: 'normal' },
+        overrideAccess: true,
+      })),
+    )
+    const numbers = tickets.map((ticket) => Number(String(ticket.ticketNumber).replace('TK-', '')))
+    expect(new Set(numbers)).toHaveLength(12)
+
+    const highest = Math.max(...numbers)
+    await payload.delete({ collection: 'tickets', id: tickets[0].id, overrideAccess: true })
+    const next = await payload.create({
+      collection: 'tickets',
+      data: { subject: 'after-delete', client: c.id, status: 'open', priority: 'normal' },
+      overrideAccess: true,
+    })
+    expect(Number(String(next.ticketNumber).replace('TK-', ''))).toBe(highest + 1)
+  }, 60_000)
+
   it('moves status to waiting_client on admin reply and back to open on client reply', async () => {
     const payload = await buildTestPayload()
     const c = await makeClient(payload, 'status@example.com')

package/src/__tests__/rateLimiter.test.ts

@@ -1,89 +1,83 @@
-import { describe, it, expect, vi, afterEach } from 'vitest'
-import { RateLimiter } from '../utils/rateLimiter'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { MemoryRateLimitStore, PayloadRateLimitStore, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 
 afterEach(() => {
   vi.useRealTimers()
 })
 
-describe('RateLimiter — under the limit', () => {
-  it('allows the first request', () => {
-    const limiter = new RateLimiter(60_000, 5)
-    expect(limiter.check('user:1')).toBe(false)
-  })
-
-  it('allows requests up to the maximum (maxRequests = 3)', () => {
-    const limiter = new RateLimiter(60_000, 3)
-    expect(limiter.check('key')).toBe(false) // count = 1
-    expect(limiter.check('key')).toBe(false) // count = 2
-    expect(limiter.check('key')).toBe(false) // count = 3
-  })
-})
-
-describe('RateLimiter — exceeding the limit', () => {
-  it('blocks the request when count exceeds maxRequests', () => {
+describe('RateLimiter', () => {
+  it('allows requests up to the maximum and then blocks', async () => {
     const limiter = new RateLimiter(60_000, 2)
-    limiter.check('key') // count = 1
-    limiter.check('key') // count = 2
-    // count = 3 > maxRequests(2) → blocked
-    expect(limiter.check('key')).toBe(true)
+    await expect(limiter.check('key')).resolves.toBe(false)
+    await expect(limiter.check('key')).resolves.toBe(false)
+    await expect(limiter.check('key')).resolves.toBe(true)
+    await expect(limiter.check('key')).resolves.toBe(true)
   })
 
-  it('keeps blocking subsequent requests after limit exceeded', () => {
+  it('resets only the targeted key', async () => {
     const limiter = new RateLimiter(60_000, 1)
-    limiter.check('key') // count = 1, passes
-    expect(limiter.check('key')).toBe(true)  // count = 2 → blocked
-    expect(limiter.check('key')).toBe(true)  // count = 3 → still blocked
-  })
-})
+    await limiter.check('key-a')
+    await limiter.check('key-b')
+    await expect(limiter.check('key-a')).resolves.toBe(true)
+    await expect(limiter.check('key-b')).resolves.toBe(true)
 
-describe('RateLimiter — reset', () => {
-  it('allows requests again after manual reset', () => {
-    const limiter = new RateLimiter(60_000, 1)
-    limiter.check('key') // count = 1
-    expect(limiter.check('key')).toBe(true) // blocked
-    limiter.reset('key')
-    expect(limiter.check('key')).toBe(false) // reset → allowed again
+    await limiter.reset('key-a')
+
+    await expect(limiter.check('key-a')).resolves.toBe(false)
+    await expect(limiter.check('key-b')).resolves.toBe(true)
   })
 
-  it('reset only affects the targeted key', () => {
-    const limiter = new RateLimiter(60_000, 1)
-    limiter.check('keyA')
-    limiter.check('keyA') // keyA blocked
-    limiter.check('keyB')
-    limiter.check('keyB') // keyB blocked
+  it('opens a new window after expiry', async () => {
+    vi.useFakeTimers()
+    const limiter = new RateLimiter(1_000, 1)
+    await limiter.check('key')
+    await expect(limiter.check('key')).resolves.toBe(true)
 
-    limiter.reset('keyA')
-    expect(limiter.check('keyA')).toBe(false) // keyA allowed
-    expect(limiter.check('keyB')).toBe(true)  // keyB still blocked
+    vi.advanceTimersByTime(1_001)
+
+    await expect(limiter.check('key')).resolves.toBe(false)
   })
-})
 
-describe('RateLimiter — window expiry', () => {
-  it('resets the counter automatically after the window expires', () => {
-    vi.useFakeTimers()
-    const windowMs = 1_000
-    const limiter = new RateLimiter(windowMs, 2)
+  it('shares counters between limiter instances using the same store', async () => {
+    const store = new MemoryRateLimitStore()
+    const firstProcess = new RateLimiter(60_000, 1, store)
+    const secondProcess = new RateLimiter(60_000, 1, store)
 
-    limiter.check('key') // count = 1
-    limiter.check('key') // count = 2
-    expect(limiter.check('key')).toBe(true) // blocked
+    await expect(firstProcess.check('shared')).resolves.toBe(false)
+    await expect(secondProcess.check('shared')).resolves.toBe(true)
+  })
 
-    // Advance past the window
-    vi.advanceTimersByTime(windowMs + 1)
+  it('supports an asynchronous persistent store adapter', async () => {
+    const increment = vi.fn(async () => ({ count: 2, resetAt: Date.now() + 1_000 }))
+    const store: RateLimitStore = {
+      increment,
+      reset: vi.fn(async () => undefined),
+    }
+    const limiter = new RateLimiter(1_000, 1, store)
 
-    // The next check should open a new window
-    expect(limiter.check('key')).toBe(false) // new window, count = 1
+    await expect(limiter.check('client:42')).resolves.toBe(true)
+    expect(increment).toHaveBeenCalledWith('client:42', 1_000)
   })
-})
 
-describe('RateLimiter — key independence', () => {
-  it('tracks different keys independently', () => {
-    const limiter = new RateLimiter(60_000, 1)
-    // key-A hits limit
-    limiter.check('key-A') // count = 1
-    expect(limiter.check('key-A')).toBe(true) // blocked
+  it('persists counters through the Payload adapter', async () => {
+    let record: { id: number; key: string; count: number; resetAt: string } | undefined
+    const payload = {
+      find: vi.fn(async () => ({ docs: record ? [record] : [] })),
+      create: vi.fn(async ({ data }: { data: typeof record }) => {
+        record = { ...data!, id: 1 }
+        return record
+      }),
+      update: vi.fn(async ({ data }: { data: Partial<typeof record> }) => {
+        record = { ...record!, ...data }
+        return record
+      }),
+      delete: vi.fn(async () => undefined),
+    }
+    const store = new PayloadRateLimitStore()
+    const firstProcess = new RateLimiter(60_000, 1, store)
+    const secondProcess = new RateLimiter(60_000, 1, store)
 
-    // key-B untouched
-    expect(limiter.check('key-B')).toBe(false) // fresh key, allowed
+    await expect(firstProcess.check('shared', payload)).resolves.toBe(false)
+    await expect(secondProcess.check('shared', payload)).resolves.toBe(true)
   })
 })

package/src/__tests__/trackOpenEndpoint.test.ts

@@ -0,0 +1,54 @@
+import { describe, expect, it, vi } from 'vitest'
+import { createTrackOpenEndpoint, generateTrackingToken } from '../endpoints/track-open'
+import { resolveSlugs } from '../utils/slugs'
+
+const secret = 'test-payload-secret'
+
+function createRequest(ticketId: string, messageId: string, signature: string) {
+  const findByID = vi.fn(async ({ collection }: { collection: string }) => {
+    if (collection === 'ticket-messages') {
+      return { id: Number(messageId), ticket: Number(ticketId) + 1, emailOpenedAt: null }
+    }
+    return { id: Number(ticketId), lastClientReadAt: null }
+  })
+  const update = vi.fn()
+  return {
+    req: {
+      url: `https://example.test/api/support/track-open?t=${ticketId}&m=${messageId}&sig=${signature}`,
+      payload: { findByID, update },
+    },
+    findByID,
+    update,
+  }
+}
+
+describe('track-open endpoint', () => {
+  it('does not query the database for signed non-numeric identifiers', async () => {
+    process.env.PAYLOAD_SECRET = secret
+    const ticketId = 'not-a-ticket'
+    const messageId = 'not-a-message'
+    const signature = generateTrackingToken(ticketId, messageId, secret)
+    const { req, findByID, update } = createRequest(ticketId, messageId, signature)
+    const endpoint = createTrackOpenEndpoint(resolveSlugs())
+
+    const response = await endpoint.handler(req as never)
+
+    expect(response.status).toBe(200)
+    expect(findByID).not.toHaveBeenCalled()
+    expect(update).not.toHaveBeenCalled()
+  })
+
+  it('does not mutate when the signed message belongs to another ticket', async () => {
+    process.env.PAYLOAD_SECRET = secret
+    const ticketId = '10'
+    const messageId = '20'
+    const signature = generateTrackingToken(ticketId, messageId, secret)
+    const { req, update } = createRequest(ticketId, messageId, signature)
+    const endpoint = createTrackOpenEndpoint(resolveSlugs())
+
+    const response = await endpoint.handler(req as never)
+
+    expect(response.status).toBe(200)
+    expect(update).not.toHaveBeenCalled()
+  })
+})