@consilioweb/payload-support 1.1.0 → 2.0.0

package/src/endpoints/client-intelligence.ts

@@ -2,9 +2,11 @@ import type { Endpoint, PayloadRequest } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { readSupportSettings, type SupportSettings } from '../utils/readSettings'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 
-function getClient(aiSettings: SupportSettings['ai']) {
-  const Anthropic = require('@anthropic-ai/sdk').default
+async function getClient(aiSettings: SupportSettings['ai']) {
+  const moduleName = '@anthropic-ai/sdk'
+  const { default: Anthropic } = await import(moduleName)
   if (aiSettings.provider === 'ollama') {
     const baseURL = process.env.OLLAMA_API_URL || 'https://ollama.orkelis.app/v1'
     return new Anthropic({ apiKey: 'ollama', baseURL })
@@ -25,10 +27,14 @@ const CACHE_TTL_MS = 24 * 60 * 60 * 1000 // 24 hours
  * POST /api/support/client-intelligence?clientId=X
  * Force-refreshes the summary.
  */
-export function createClientIntelligenceEndpoint(slugs: CollectionSlugs): Endpoint[] {
+export function createClientIntelligenceEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint[] {
+  const limiter = new RateLimiter(60_000, 20, store)
   const getHandler = async (req: PayloadRequest) => {
     try {
       requireAdmin(req, slugs)
+      if (await limiter.check(String(req.user!.id), req)) {
+        return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
+      }
       const payload = req.payload
       const url = new URL(req.url || '', 'http://localhost')
       const clientId = url.searchParams.get('clientId')
@@ -64,6 +70,9 @@ export function createClientIntelligenceEndpoint(slugs: CollectionSlugs): Endpoi
   const postHandler = async (req: PayloadRequest) => {
     try {
       requireAdmin(req, slugs)
+      if (await limiter.check(String(req.user!.id), req)) {
+        return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
+      }
       const payload = req.payload
       const body = await req.json?.() || {}
       const clientId = body.clientId
@@ -197,7 +206,7 @@ Réponds en JSON strict (pas de markdown, pas de commentaires) avec cette struct
 Sois factuel. Ne dépasse pas 5 items par tableau. Réponds UNIQUEMENT avec le JSON.`
 
   // 6. Call AI
-  const anthropic = getClient(aiSettings)
+  const anthropic = await getClient(aiSettings)
   const model = getModel(aiSettings)
 
   const res = await anthropic.messages.create({

package/src/endpoints/import-conversation.ts

@@ -1,8 +1,9 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
-import { RateLimiter } from '../utils/rateLimiter'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { readSupportSettings } from '../utils/readSettings'
 import { dbFind, dbCreate } from '../utils/db'
+import { verifySecret } from '../utils/webhookSecurity'
 import crypto from 'crypto'
 
 interface ParsedConversation {
@@ -11,7 +12,6 @@ interface ParsedConversation {
   messages: { from: 'client' | 'admin'; name: string; date: string; content: string }[]
 }
 
-const importLimiter = new RateLimiter(3_600_000, 10) // 10 per hour
 
 function parseStructuredMarkdown(markdown: string): ParsedConversation | null {
   const clientMatch = markdown.match(
@@ -131,7 +131,8 @@ ONLY JSON, nothing else.`,
  * POST /api/support/import-conversation
  * Import a conversation from markdown into the ticket system.
  */
-export function createImportConversationEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createImportConversationEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
+  const importLimiter = new RateLimiter(3_600_000, 10, store)
   return {
     path: '/support/import-conversation',
     method: 'post',
@@ -143,7 +144,7 @@ export function createImportConversationEndpoint(slugs: CollectionSlugs): Endpoi
         const webhookSecret = req.headers.get('x-webhook-secret')
         let isAuthed = false
 
-        if (webhookSecret && process.env.SUPPORT_WEBHOOK_SECRET && webhookSecret === process.env.SUPPORT_WEBHOOK_SECRET) {
+        if (verifySecret(webhookSecret, process.env.SUPPORT_WEBHOOK_SECRET)) {
           isAuthed = true
         } else if (req.user && req.user.collection === slugs.users) {
           isAuthed = true
@@ -154,7 +155,7 @@ export function createImportConversationEndpoint(slugs: CollectionSlugs): Endpoi
         }
 
         const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || 'unknown'
-        if (importLimiter.check(ip)) {
+        if (await importLimiter.check(ip, req)) {
           return Response.json({ error: 'Rate limit exceeded. Maximum 10 imports per hour.' }, { status: 429 })
         }
 

package/src/endpoints/index.ts

@@ -1,6 +1,14 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import type { SupportFeatures } from '../types'
+import type { RateLimitStore } from '../utils/rateLimiter'
+import type { SupportCapabilities } from '../types'
+import {
+  createGenerateMissingTitlesEndpoint,
+  createInboundEmailEndpoint,
+  createProjectSuggestionsEndpoint,
+  createTicketTitleEndpoint,
+} from './capabilities'
 
 import { createAiEndpoint } from './ai'
 import { createAiAgentEndpoint } from './ai-agent'
@@ -112,6 +120,8 @@ export { createInviteCollaboratorEndpoint } from './invite-collaborator'
 export interface SupportEndpointOptions {
   oauth?: OAuthGoogleOptions
   features?: Required<SupportFeatures>
+  rateLimitStore?: RateLimitStore
+  capabilities?: SupportCapabilities
 }
 
 /**
@@ -121,6 +131,7 @@ export interface SupportEndpointOptions {
  */
 export function createSupportEndpoints(slugs: CollectionSlugs, options?: SupportEndpointOptions): Endpoint[] {
   const f = options?.features
+  const rateLimitStore = options?.rateLimitStore
 
   // Core endpoints (always present)
   const endpoints: Endpoint[] = [
@@ -132,28 +143,28 @@ export function createSupportEndpoints(slugs: CollectionSlugs, options?: Support
     createExportCsvEndpoint(slugs),
     createExportDataEndpoint(slugs),
     createSeedKbEndpoint(slugs),
-    createLoginEndpoint(slugs),
-    createAuth2faEndpoint(slugs),
+    createLoginEndpoint(slugs, rateLimitStore),
+    createAuth2faEndpoint(slugs, rateLimitStore),
     createOAuthGoogleEndpoint(slugs, options?.oauth),
     createDeleteAccountEndpoint(slugs),
     createMergeClientsEndpoint(slugs),
-    createImportConversationEndpoint(slugs),
+    createImportConversationEndpoint(slugs, rateLimitStore),
     createPurgeLogsEndpoint(slugs),
-    createResendNotificationEndpoint(slugs),
+    createResendNotificationEndpoint(slugs, rateLimitStore),
     createUserPrefsGetEndpoint(slugs),
     createUserPrefsPostEndpoint(slugs),
     createEscalateEndpoint(slugs),
     createTicketFeedbackEndpoint(slugs),
-    createTransferTicketEndpoint(slugs),
-    createInviteCollaboratorEndpoint(slugs),
+    createTransferTicketEndpoint(slugs, rateLimitStore),
+    createInviteCollaboratorEndpoint(slugs, rateLimitStore),
   ]
 
   // Conditional endpoints based on feature flags
   if (!f || f.ai !== false) {
-    endpoints.push(createAiEndpoint(slugs))
-    endpoints.push(createAiAgentEndpoint(slugs))
-    endpoints.push(...createClientIntelligenceEndpoint(slugs))
-    endpoints.push(createTicketSynthesisEndpoint(slugs))
+    endpoints.push(createAiEndpoint(slugs, rateLimitStore))
+    endpoints.push(createAiAgentEndpoint(slugs, rateLimitStore))
+    endpoints.push(...createClientIntelligenceEndpoint(slugs, rateLimitStore))
+    endpoints.push(createTicketSynthesisEndpoint(slugs, options?.capabilities?.aiSummaries, rateLimitStore))
   }
   if (!f || f.bulkActions !== false) endpoints.push(createBulkActionEndpoint(slugs))
   if (!f || f.merge !== false) endpoints.push(createMergeTicketsEndpoint(slugs))
@@ -168,18 +179,18 @@ export function createSupportEndpoints(slugs: CollectionSlugs, options?: Support
   if (!f || f.sla !== false) endpoints.push(createSlaCheckEndpoint(slugs))
   if (!f || f.autoClose !== false) {
     endpoints.push(createAutoCloseEndpoint(slugs))
-    endpoints.push(createSendReminderEndpoint(slugs))
+    endpoints.push(createSendReminderEndpoint(slugs, rateLimitStore))
   }
   if (!f || f.customStatuses !== false) endpoints.push(createStatusesEndpoint(slugs))
   if (!f || f.macros !== false) endpoints.push(createApplyMacroEndpoint(slugs))
   if (!f || f.roundRobin !== false) {
     endpoints.push(createRoundRobinConfigGetEndpoint(slugs), createRoundRobinConfigPostEndpoint(slugs))
   }
-  if (!f || f.chatbot !== false) endpoints.push(createChatbotEndpoint(slugs))
+  if (!f || f.chatbot !== false) endpoints.push(createChatbotEndpoint(slugs, rateLimitStore))
   if (!f || f.chat !== false) {
-    endpoints.push(createChatGetEndpoint(slugs), createChatPostEndpoint(slugs))
+    endpoints.push(createChatGetEndpoint(slugs), createChatPostEndpoint(slugs, rateLimitStore))
     endpoints.push(createChatStreamEndpoint(slugs))
-    endpoints.push(createAdminChatGetEndpoint(slugs), createAdminChatPostEndpoint(slugs))
+    endpoints.push(createAdminChatGetEndpoint(slugs), createAdminChatPostEndpoint(slugs, rateLimitStore))
     endpoints.push(createAdminChatStreamEndpoint(slugs))
   }
   if (!f || f.timeTracking !== false) {
@@ -197,6 +208,16 @@ export function createSupportEndpoints(slugs: CollectionSlugs, options?: Support
   endpoints.push(createChannelsWebhookEndpoint(slugs))
   endpoints.push(createVapidKeyEndpoint())
   endpoints.push(createPushSubscribeEndpoint(slugs))
+  if (options?.capabilities?.inboundEmail) {
+    endpoints.push(createInboundEmailEndpoint(options.capabilities.inboundEmail, rateLimitStore))
+  }
+  if (options?.capabilities?.projectSuggestions) {
+    endpoints.push(createProjectSuggestionsEndpoint(slugs, options.capabilities.projectSuggestions, rateLimitStore))
+  }
+  if (options?.capabilities?.aiTitles) {
+    endpoints.push(createTicketTitleEndpoint(slugs, options.capabilities.aiTitles, rateLimitStore))
+    endpoints.push(createGenerateMissingTitlesEndpoint(slugs, options.capabilities.aiTitles, rateLimitStore))
+  }
 
   return endpoints
 }

package/src/endpoints/invite-collaborator.ts

@@ -4,7 +4,7 @@ import { handleAuthError, AuthError } from '../utils/auth'
 import { escapeHtml, emailWrapper, emailButton, emailParagraph } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
 import { randomBytes } from 'crypto'
-import { RateLimiter } from '../utils/rateLimiter'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbFindByID, dbFind, dbCreate, dbUpdate, dbCount } from '../utils/db'
 
 const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
@@ -12,7 +12,6 @@ const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
 // Anti-abuse limits: an invite can create a placeholder account AND send an
 // email, so cap both the volume per user and the collaborators per ticket.
 const MAX_COLLABORATORS_PER_TICKET = 20
-const inviteLimiter = new RateLimiter(60 * 60 * 1000, 10)
 
 /**
  * POST /api/support/tickets/:id/invite
@@ -31,7 +30,8 @@ const inviteLimiter = new RateLimiter(60 * 60 * 1000, 10)
  *  - Sends an invitation email with a magic link `/support/tickets/:id?inviteToken=...`.
  *  - Returns { ok, invitedTo, role }.
  */
-export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
+  const inviteLimiter = new RateLimiter(60 * 60 * 1000, 10, store)
   return {
     path: '/support/tickets/:id/invite',
     method: 'post',
@@ -75,7 +75,7 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs): Endpoi
         }
 
         // Anti-abuse: cap invite volume per user (in-memory, fail-closed).
-        if (inviteLimiter.check(String(req.user.id))) {
+        if (await inviteLimiter.check(String(req.user.id), req)) {
           return Response.json({ error: 'Trop d\'invitations. Réessayez plus tard.' }, { status: 429 })
         }
 

package/src/endpoints/login.ts

@@ -1,15 +1,15 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
-import { RateLimiter } from '../utils/rateLimiter'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbCreate } from '../utils/db'
 
-const loginLimiter = new RateLimiter(15 * 60_000, 10) // 10 per 15 min
 
 /**
  * POST /api/support/login
  * Client login endpoint.
  */
-export function createLoginEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createLoginEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
+  const loginLimiter = new RateLimiter(15 * 60_000, 10, store)
   return {
     path: '/support/login',
     method: 'post',
@@ -19,7 +19,7 @@ export function createLoginEndpoint(slugs: CollectionSlugs): Endpoint {
       // the primary brute-force control is Payload's account lock (maxLoginAttempts).
       const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || req.headers.get('x-real-ip') || 'unknown'
 
-      if (loginLimiter.check(ip)) {
+      if (await loginLimiter.check(ip, req)) {
         return Response.json(
           { error: 'Trop de tentatives. Réessayez dans quelques minutes.' },
           { status: 429 },
@@ -66,7 +66,6 @@ export function createLoginEndpoint(slugs: CollectionSlugs): Endpoint {
           JSON.stringify({
             message: 'Login successful',
             user: result.user,
-            token: result.token,
             exp: result.exp,
           }),
           { status: 200, headers },

package/src/endpoints/oauth-google.ts

@@ -210,7 +210,7 @@ export function createOAuthGoogleEndpoint(slugs: CollectionSlugs, options?: OAut
             `payload-token=${token}; HttpOnly; ${cookieSecure ? 'Secure; ' : ''}SameSite=Lax; Path=/; Max-Age=${tokenExpiration}`,
           )
 
-          return new Response(JSON.stringify({ token, user: clientDoc, exp }), {
+          return new Response(JSON.stringify({ user: clientDoc, exp }), {
             status: 200,
             headers,
           })

package/src/endpoints/process-digests.ts

@@ -3,6 +3,7 @@ import type { CollectionSlugs } from '../utils/slugs'
 import { dbFind, dbFindByID, dbDelete } from '../utils/db'
 import { emailWrapper, emailParagraph, escapeHtml } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
+import { verifySecret } from '../utils/webhookSecurity'
 
 /**
  * POST /api/support/process-digests   body: { frequency?: 'daily' | 'weekly' }
@@ -18,7 +19,7 @@ export function createProcessDigestsEndpoint(slugs: CollectionSlugs): Endpoint {
     method: 'post',
     handler: async (req) => {
       const secret = req.headers.get('x-cron-secret')
-      if (!process.env.CRON_SECRET || secret !== process.env.CRON_SECRET) {
+      if (!verifySecret(secret, process.env.CRON_SECRET)) {
         return Response.json({ error: 'Non autorisé' }, { status: 401 })
       }
 

package/src/endpoints/process-scheduled.ts

@@ -4,6 +4,7 @@ import { escapeHtml } from '../utils/emailTemplate'
 import { fireWebhooks } from '../utils/fireWebhooks'
 import { readSupportSettings } from '../utils/readSettings'
 import { dbFind, dbFindByID, dbUpdate } from '../utils/db'
+import { verifySecret } from '../utils/webhookSecurity'
 
 /**
  * POST /api/support/process-scheduled
@@ -18,7 +19,7 @@ export function createProcessScheduledEndpoint(slugs: CollectionSlugs): Endpoint
       const secret = req.headers.get('x-cron-secret')
       const expectedSecret = process.env.CRON_SECRET
 
-      if (!expectedSecret || secret !== expectedSecret) {
+      if (!verifySecret(secret, expectedSecret)) {
         return Response.json({ error: 'Non autorisé' }, { status: 401 })
       }
 

package/src/endpoints/process-snooze.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { dbFind, dbUpdate, dbCreate } from '../utils/db'
+import { verifySecret } from '../utils/webhookSecurity'
 
 /**
  * POST /api/support/process-snooze
@@ -20,7 +21,7 @@ export function createProcessSnoozeEndpoint(slugs: CollectionSlugs): Endpoint {
     handler: async (req) => {
       const secret = req.headers.get('x-cron-secret')
       const expectedSecret = process.env.CRON_SECRET
-      if (!expectedSecret || secret !== expectedSecret) {
+      if (!verifySecret(secret, expectedSecret)) {
         return Response.json({ error: 'Non autorisé' }, { status: 401 })
       }
 

package/src/endpoints/resend-notification.ts

@@ -1,18 +1,18 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
-import { RateLimiter } from '../utils/rateLimiter'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { escapeHtml } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
 import { dbFindByID } from '../utils/db'
 
-const resendLimiter = new RateLimiter(60 * 60 * 1000, 10) // 10 per hour
 
 /**
  * POST /api/support/resend-notification
  * Resend the email notification for a specific ticket message. Admin-only.
  */
-export function createResendNotificationEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createResendNotificationEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
+  const resendLimiter = new RateLimiter(60 * 60 * 1000, 10, store)
   return {
     path: '/support/resend-notification',
     method: 'post',
@@ -22,7 +22,7 @@ export function createResendNotificationEndpoint(slugs: CollectionSlugs): Endpoi
 
         requireAdmin(req, slugs)
 
-        if (resendLimiter.check(String(req.user.id))) {
+        if (await resendLimiter.check(String(req.user.id), req)) {
           return Response.json(
             { error: 'Trop de renvois. Réessayez dans une heure.' },
             { status: 429 },

package/src/endpoints/send-reminder.ts

@@ -1,14 +1,13 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
-import { RateLimiter } from '../utils/rateLimiter'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { escapeHtml, emailWrapper, emailParagraph, emailButton } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
 import { dbFindByID, dbFind, dbCreate, dbUpdate } from '../utils/db'
 
 // Manual reminders are a deliberate admin action, so the cap is generous —
 // it only exists to stop a runaway script, not normal usage.
-const reminderLimiter = new RateLimiter(60 * 60 * 1000, 30) // 30 per hour per admin
 
 const MIN_HOURS = 1
 const MAX_HOURS = 24 * 30 // 30 days
@@ -38,7 +37,8 @@ function formatFr(date: Date, withTime: boolean): string {
  *
  * Admin-only, rate-limited.
  */
-export function createSendReminderEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createSendReminderEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
+  const reminderLimiter = new RateLimiter(60 * 60 * 1000, 30, store)
   return {
     path: '/support/send-reminder',
     method: 'post',
@@ -48,7 +48,7 @@ export function createSendReminderEndpoint(slugs: CollectionSlugs): Endpoint {
 
         requireAdmin(req, slugs)
 
-        if (reminderLimiter.check(String(req.user.id))) {
+        if (await reminderLimiter.check(String(req.user.id), req)) {
           return Response.json(
             { error: 'Trop de relances. Réessayez dans une heure.' },
             { status: 429 },

package/src/endpoints/ticket-synthesis.ts

@@ -3,6 +3,8 @@ import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { generateTicketSynthesis } from '../utils/generateTicketSynthesis'
 import { dbFindByID } from '../utils/db'
+import type { SupportCapabilities } from '../types'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 
 /**
  * POST /api/support/ticket-synthesis?ticketId=X[&force=true]
@@ -16,13 +18,21 @@ import { dbFindByID } from '../utils/db'
  * - The hook on Tickets clears aiSummary when a ticket is reopened, so the next pass through
  *   "resolved" status will trigger a regeneration automatically.
  */
-export function createTicketSynthesisEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createTicketSynthesisEndpoint(
+  slugs: CollectionSlugs,
+  generator?: SupportCapabilities['aiSummaries'],
+  store?: RateLimitStore,
+): Endpoint {
+  const limiter = new RateLimiter(60_000, 20, store)
   return {
     path: '/support/ticket-synthesis',
     method: 'post',
     handler: async (req) => {
       try {
         requireAdmin(req, slugs)
+        if (await limiter.check(String(req.user!.id), req)) {
+          return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
+        }
         const payload = req.payload
 
         const url = new URL(req.url || '', 'http://localhost')
@@ -54,7 +64,12 @@ export function createTicketSynthesisEndpoint(slugs: CollectionSlugs): Endpoint
           }
         }
 
-        const result = await generateTicketSynthesis({ payload, slugs, ticketId })
+        const result = generator
+          ? await generator.generate(payload, ticketId)
+          : await generateTicketSynthesis({ payload, slugs, ticketId })
+        if (!result) {
+          return Response.json({ error: 'Generation unavailable' }, { status: 502 })
+        }
         return Response.json(result)
       } catch (err) {
         const authResponse = handleAuthError(err)

package/src/endpoints/track-open.ts

@@ -1,6 +1,6 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
-import { createHmac } from 'crypto'
+import { createHmac, timingSafeEqual } from 'crypto'
 import { dbFindByID, dbUpdate, dbCreate } from '../utils/db'
 
 // 1x1 transparent GIF (43 bytes)
@@ -14,7 +14,20 @@ const TRANSPARENT_GIF = Buffer.from(
  * Use this when building tracking URLs in email templates.
  */
 export function generateTrackingToken(ticketId: string, messageId: string, secret: string): string {
-  return createHmac('sha256', secret).update(`${ticketId}:${messageId}`).digest('hex').substring(0, 16)
+  return createHmac('sha256', secret).update(`${ticketId}:${messageId}`).digest('hex')
+}
+
+export function verifyTrackingToken(
+  ticketId: string,
+  messageId: string,
+  signature: string,
+  secret: string,
+): boolean {
+  if (!/^[0-9a-f]{64}$/i.test(signature)) return false
+
+  const expected = Buffer.from(generateTrackingToken(ticketId, messageId, secret), 'hex')
+  const received = Buffer.from(signature, 'hex')
+  return expected.length === received.length && timingSafeEqual(expected, received)
 }
 
 /**
@@ -40,8 +53,10 @@ export function createTrackOpenEndpoint(slugs: CollectionSlugs): Endpoint {
       // and the silent "tracking writes without auth" hole.
       const secret = process.env.PAYLOAD_SECRET || ''
       const validSig =
-        !!secret && !!ticketId && !!messageId && !!sig &&
-        sig === generateTrackingToken(ticketId, messageId, secret)
+        !!secret && Number.isInteger(parsedId) && parsedId > 0 &&
+        Number.isInteger(parsedMsgId) && parsedMsgId > 0 &&
+        !!ticketId && !!messageId && !!sig &&
+        verifyTrackingToken(ticketId, messageId, sig, secret)
 
       if (!validSig) {
         // Return transparent GIF silently (don't leak information, don't process)
@@ -59,6 +74,17 @@ export function createTrackOpenEndpoint(slugs: CollectionSlugs): Endpoint {
         try {
           const payload = req.payload
 
+          const msg = await dbFindByID(payload, slugs.ticketMessages, {
+            id: parsedMsgId,
+            depth: 0,
+            overrideAccess: true,
+            select: { ticket: true, emailOpenedAt: true },
+          }) as any
+          const messageTicketId = typeof msg?.ticket === 'object' ? msg.ticket?.id : msg?.ticket
+          if (!msg || String(messageTicketId) !== String(parsedId)) {
+            return transparentGifResponse()
+          }
+
           const ticket = await dbFindByID(payload, slugs.tickets, {
             id: parsedId,
             depth: 0,
@@ -81,13 +107,6 @@ export function createTrackOpenEndpoint(slugs: CollectionSlugs): Endpoint {
 
           // Track at message level
           if (Number.isInteger(parsedMsgId) && parsedMsgId > 0) {
-            const msg = await dbFindByID(payload, slugs.ticketMessages, {
-              id: parsedMsgId,
-              depth: 0,
-              overrideAccess: true,
-              select: { emailOpenedAt: true },
-            }) as any
-
             if (msg && !msg.emailOpenedAt) {
               await dbUpdate(payload, slugs.ticketMessages, {
                 id: parsedMsgId,
@@ -127,16 +146,20 @@ export function createTrackOpenEndpoint(slugs: CollectionSlugs): Endpoint {
         }
       }
 
-      return new Response(TRANSPARENT_GIF, {
-        status: 200,
-        headers: {
-          'Content-Type': 'image/gif',
-          'Content-Length': String(TRANSPARENT_GIF.length),
-          'Cache-Control': 'no-store, no-cache, must-revalidate, max-age=0',
-          'Pragma': 'no-cache',
-          'Expires': '0',
-        },
-      })
+      return transparentGifResponse()
     },
   }
 }
+
+function transparentGifResponse(): Response {
+  return new Response(TRANSPARENT_GIF, {
+    status: 200,
+    headers: {
+      'Content-Type': 'image/gif',
+      'Content-Length': String(TRANSPARENT_GIF.length),
+      'Cache-Control': 'no-store, no-cache, must-revalidate, max-age=0',
+      'Pragma': 'no-cache',
+      'Expires': '0',
+    },
+  })
+}

package/src/endpoints/transfer-ticket.ts

@@ -3,7 +3,7 @@ import type { CollectionSlugs } from '../utils/slugs'
 import { handleAuthError, AuthError } from '../utils/auth'
 import { escapeHtml, emailWrapper, emailButton, emailParagraph } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
-import { RateLimiter } from '../utils/rateLimiter'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbFindByID, dbFind, dbCreate, dbCount } from '../utils/db'
 
 // Simple RFC-5322 style sanity check — same level of strictness as the
@@ -16,7 +16,6 @@ const MAX_TRANSFERS_PER_DAY = 5
 // In-memory fail-closed rate limiter — enforced even when the persistent
 // emailLogs-based check is unavailable (collection disabled). Prevents the
 // endpoint from becoming an unbounded outbound mailer.
-const transferLimiter = new RateLimiter(24 * 60 * 60 * 1000, MAX_TRANSFERS_PER_DAY)
 
 /**
  * POST /api/support/tickets/:id/transfer
@@ -33,7 +32,8 @@ const transferLimiter = new RateLimiter(24 * 60 * 60 * 1000, MAX_TRANSFERS_PER_D
  *  - Logs the action in `email-logs` (action='transfer') when that collection exists
  *  - Rate-limited to 5 transfers per ticket per 24h
  */
-export function createTransferTicketEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createTransferTicketEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
+  const transferLimiter = new RateLimiter(24 * 60 * 60 * 1000, MAX_TRANSFERS_PER_DAY, store)
   return {
     path: '/support/tickets/:id/transfer',
     method: 'post',
@@ -82,7 +82,7 @@ export function createTransferTicketEndpoint(slugs: CollectionSlugs): Endpoint {
 
         // Fail-closed in-memory rate limit (per user + ticket): enforced even
         // when the persistent emailLogs check below cannot run.
-        if (transferLimiter.check(`${req.user.id}:${ticketId}`)) {
+        if (await transferLimiter.check(`${req.user.id}:${ticketId}`, req)) {
           return Response.json(
             { error: `Limite atteinte (${MAX_TRANSFERS_PER_DAY} transferts par 24h sur ce ticket)` },
             { status: 429 },

package/src/index.ts

@@ -23,6 +23,13 @@ export { resolveSlugs, DEFAULT_SLUGS } from './utils/slugs'
 export type { CollectionSlugs } from './utils/slugs'
 export { readSupportSettings, readUserPrefs, DEFAULT_SETTINGS, DEFAULT_USER_PREFS } from './utils/readSettings'
 export type { SupportSettings, UserPrefs } from './utils/readSettings'
+export { MemoryRateLimitStore, PayloadRateLimitStore, RateLimiter } from './utils/rateLimiter'
+export type { RateLimitEntry, RateLimitStore } from './utils/rateLimiter'
+export { DEFAULT_INBOUND_EMAIL_LIMITS, validateInboundEmailPayload, verifySecret } from './utils/webhookSecurity'
+export type { InboundEmailInput, InboundEmailLimits, InboundEmailValidationError } from './utils/webhookSecurity'
+
+// Endpoint factories for framework adapters (for example Next route handlers).
+export { createLoginEndpoint, createOAuthGoogleEndpoint, createTrackOpenEndpoint } from './endpoints'
 export { createAdminNotification } from './utils/adminNotification'
 export { dispatchWebhook } from './utils/webhookDispatcher'
 export { generateTicketSynthesis } from './utils/generateTicketSynthesis'