@consilioweb/payload-support 1.1.1 → 2.0.0

package/src/components/TicketConversation/components/ActionPanels.tsx

@@ -108,7 +108,7 @@ export function ExtMessagePanel({
           ))}
         </div>
       )}
-      <button onClick={handleSendExtMsg} disabled={sendingExtMsg || !extMsgBody.trim()} style={s.btn('#818cf8', sendingExtMsg || !extMsgBody.trim())}>
+      <button onClick={handleSendExtMsg} disabled={sendingExtMsg || !extMsgBody.trim()} style={s.btn('#1d2b4d', sendingExtMsg || !extMsgBody.trim())}>
         {sendingExtMsg ? 'Ajout...' : 'Ajouter (sans notification)'}
       </button>
     </div>
@@ -204,12 +204,12 @@ interface SnoozePanelProps {
 
 export function SnoozePanel({ snoozeSaving, handleSnooze }: SnoozePanelProps) {
   return (
-    <div style={{ padding: '14px 18px', borderRadius: '8px', backgroundColor: '#faf5ff', border: '1px solid #e9d5ff', marginBottom: '14px' }}>
+    <div style={{ padding: '14px 18px', borderRadius: '8px', backgroundColor: '#eef8f7', border: '1px solid #b8dcda', marginBottom: '14px' }}>
       <h4 style={{ fontSize: '13px', fontWeight: 600, marginBottom: '10px', color: '#5b21b6' }}>Snooze — masquer temporairement</h4>
       <div style={{ display: 'flex', gap: '8px', flexWrap: 'wrap', alignItems: 'center' }}>
-        <button onClick={() => handleSnooze(1)} disabled={snoozeSaving} style={{ ...s.outlineBtn('#8b5cf6', snoozeSaving), fontSize: '12px' }}>1 jour</button>
-        <button onClick={() => handleSnooze(3)} disabled={snoozeSaving} style={{ ...s.outlineBtn('#8b5cf6', snoozeSaving), fontSize: '12px' }}>3 jours</button>
-        <button onClick={() => handleSnooze(7)} disabled={snoozeSaving} style={{ ...s.outlineBtn('#8b5cf6', snoozeSaving), fontSize: '12px' }}>1 semaine</button>
+        <button onClick={() => handleSnooze(1)} disabled={snoozeSaving} style={{ ...s.outlineBtn('#17807c', snoozeSaving), fontSize: '12px' }}>1 jour</button>
+        <button onClick={() => handleSnooze(3)} disabled={snoozeSaving} style={{ ...s.outlineBtn('#17807c', snoozeSaving), fontSize: '12px' }}>3 jours</button>
+        <button onClick={() => handleSnooze(7)} disabled={snoozeSaving} style={{ ...s.outlineBtn('#17807c', snoozeSaving), fontSize: '12px' }}>1 semaine</button>
         <input
           type="datetime-local"
           onChange={(e) => { if (e.target.value) handleSnooze(null, e.target.value) }}

package/src/components/TicketConversation/components/ClientBar.tsx

@@ -26,7 +26,7 @@ export function ClientBar({ client }: { client: ClientInfo }) {
         <button
           type="button"
           onClick={() => window.open(`/api/admin/impersonate?clientId=${client.id}`, '_blank')}
-          style={{ ...s.ghostBtn('#7c3aed'), fontSize: '11px', padding: '4px 10px' }}
+          style={{ ...s.ghostBtn('#17807c'), fontSize: '11px', padding: '4px 10px' }}
           title="Se connecter au portail support en tant que ce client"
         >
           Voir en tant que client

package/src/components/TicketConversation/components/QuickActions.tsx

@@ -57,14 +57,14 @@ export function QuickActions({
           </button>
         ))}
         {snoozeUntil && new Date(snoozeUntil) > new Date() && (
-          <button onClick={onCancelSnooze} disabled={snoozeSaving} style={{ ...s.ghostBtn('#7c3aed', snoozeSaving), fontSize: '12px', padding: '5px 10px' }}>
+          <button onClick={onCancelSnooze} disabled={snoozeSaving} style={{ ...s.ghostBtn('#17807c', snoozeSaving), fontSize: '12px', padding: '5px 10px' }}>
             Annuler snooze
           </button>
         )}
         <span style={{ borderLeft: `1px solid ${C.border}`, height: '20px', margin: '0 4px' }} />
         <button onClick={onToggleMerge} style={s.ghostBtn('#be185d')}>Fusionner</button>
         <button onClick={onToggleExtMsg} style={s.ghostBtn('#4f46e5')}>+ Message reçu</button>
-        <button onClick={onToggleSnooze} style={s.ghostBtn('#7c3aed')}>Snooze</button>
+        <button onClick={onToggleSnooze} style={s.ghostBtn('#17807c')}>Snooze</button>
         {showReminderButton && (
           <button onClick={onToggleReminder} style={s.ghostBtn('#ea580c')}>{'⏰'} Relancer</button>
         )}

package/src/components/TicketConversation/components/TicketHeader.tsx

@@ -57,7 +57,7 @@ export function TicketHeader({
         </span>
       )}
       {snoozeUntil && new Date(snoozeUntil) > new Date() && (
-        <span style={s.badge('#f5f3ff', '#7c3aed')}>
+        <span style={s.badge('#eef8f7', '#17807c')}>
           Snoozé {new Date(snoozeUntil).toLocaleDateString('fr-FR', { day: 'numeric', month: 'short', hour: '2-digit', minute: '2-digit' })}
         </span>
       )}

package/src/components/TicketConversation/index.tsx

@@ -525,7 +525,7 @@ const TicketConversation: React.FC = () => {
                                 return sched.scheduledSent ? (
                                   <span style={s.badge('#f0fdf4', '#16a34a')}>{'\u2713'} Programmé le {createdDate} — rédigé le {scheduledDate !== createdDate ? scheduledDate : createdDate}</span>
                                 ) : (
-                                  <span style={s.badge('#f3e8ff', '#7c3aed')}>{'\u23F0'} Rédigé le {createdDate} — envoi programmé le {scheduledDate}</span>
+                                  <span style={s.badge('#eef8f7', '#17807c')}>{'\u23F0'} Rédigé le {createdDate} — envoi programmé le {scheduledDate}</span>
                                 )
                               })()}
                             </span>
@@ -723,12 +723,12 @@ const TicketConversation: React.FC = () => {
       {clientTyping && (
         <div style={{
           display: 'flex', alignItems: 'center', gap: 8, padding: '8px 12px',
-          fontSize: 12, color: '#7c3aed', fontWeight: 500,
+          fontSize: 12, color: '#17807c', fontWeight: 500,
         }}>
           <span style={{ display: 'flex', gap: 2 }}>
-            <span style={{ width: 5, height: 5, borderRadius: '50%', backgroundColor: '#7c3aed', animation: 'bounce 1s infinite', animationDelay: '0ms' }} />
-            <span style={{ width: 5, height: 5, borderRadius: '50%', backgroundColor: '#7c3aed', animation: 'bounce 1s infinite', animationDelay: '150ms' }} />
-            <span style={{ width: 5, height: 5, borderRadius: '50%', backgroundColor: '#7c3aed', animation: 'bounce 1s infinite', animationDelay: '300ms' }} />
+            <span style={{ width: 5, height: 5, borderRadius: '50%', backgroundColor: '#17807c', animation: 'bounce 1s infinite', animationDelay: '0ms' }} />
+            <span style={{ width: 5, height: 5, borderRadius: '50%', backgroundColor: '#17807c', animation: 'bounce 1s infinite', animationDelay: '150ms' }} />
+            <span style={{ width: 5, height: 5, borderRadius: '50%', backgroundColor: '#17807c', animation: 'bounce 1s infinite', animationDelay: '300ms' }} />
           </span>
           {clientTypingName || 'Client'} est en train d&apos;écrire...
         </div>
@@ -777,7 +777,7 @@ const TicketConversation: React.FC = () => {
             <button
               onClick={handleAiSuggestReply}
               disabled={aiReplying || messages.length === 0}
-              style={{ ...s.outlineBtn('#7c3aed', aiReplying || messages.length === 0), fontSize: '11px', padding: '3px 10px', borderRadius: '14px' }}
+              style={{ ...s.outlineBtn('#17807c', aiReplying || messages.length === 0), fontSize: '11px', padding: '3px 10px', borderRadius: '14px' }}
             >
               {aiReplying ? 'Génération...' : 'Suggestion IA'}
             </button>
@@ -903,7 +903,7 @@ const TicketConversation: React.FC = () => {
             <button
               onClick={() => setShowSchedule(!showSchedule)}
               disabled={!replyBody.trim() && !replyHtml}
-              style={{ ...s.outlineBtn('#7c3aed', !replyBody.trim() && !replyHtml), fontSize: '12px', padding: '8px 12px' }}
+              style={{ ...s.outlineBtn('#17807c', !replyBody.trim() && !replyHtml), fontSize: '12px', padding: '8px 12px' }}
               title="Programmer l'envoi à une date/heure précise"
             >
               {'\u23F0'}
@@ -911,8 +911,8 @@ const TicketConversation: React.FC = () => {
           )}
         </div>
         {showSchedule && (
-          <div style={{ display: 'flex', gap: '8px', alignItems: 'center', marginTop: '8px', padding: '10px 14px', borderRadius: '8px', backgroundColor: '#faf5ff', border: '1px solid #e9d5ff' }}>
-            <span style={{ fontSize: '12px', fontWeight: 600, color: '#7c3aed' }}>Programmer pour :</span>
+          <div style={{ display: 'flex', gap: '8px', alignItems: 'center', marginTop: '8px', padding: '10px 14px', borderRadius: '8px', backgroundColor: '#eef8f7', border: '1px solid #b8dcda' }}>
+            <span style={{ fontSize: '12px', fontWeight: 600, color: '#17807c' }}>Programmer pour :</span>
             <input
               type="datetime-local"
               value={scheduleDate}
@@ -923,7 +923,7 @@ const TicketConversation: React.FC = () => {
             <button
               onClick={handleScheduleReply}
               disabled={sending || !scheduleDate || (!replyBody.trim() && !replyHtml)}
-              style={{ ...s.btn('#7c3aed', sending || !scheduleDate || (!replyBody.trim() && !replyHtml)), fontSize: '12px', padding: '6px 14px' }}
+              style={{ ...s.btn('#17807c', sending || !scheduleDate || (!replyBody.trim() && !replyHtml)), fontSize: '12px', padding: '6px 14px' }}
             >
               {sending ? '...' : '\u23F0 Programmer'}
             </button>

package/src/endpoints/admin-chat.ts

@@ -1,11 +1,10 @@
 import type { Endpoint } from 'payload'
 import type { Where } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
-import { RateLimiter } from '../utils/rateLimiter'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { dbFind, dbCreate, dbUpdate } from '../utils/db'
 
-const adminChatLimiter = new RateLimiter(60_000, 30) // 30 per minute
 
 /**
  * GET /api/support/admin-chat?session=xxx&after=timestamp
@@ -111,7 +110,8 @@ export function createAdminChatGetEndpoint(slugs: CollectionSlugs): Endpoint {
  * POST /api/support/admin-chat
  * Admin sends a message or closes a session.
  */
-export function createAdminChatPostEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createAdminChatPostEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
+  const adminChatLimiter = new RateLimiter(60_000, 30, store)
   return {
     path: '/support/admin-chat',
     method: 'post',
@@ -150,7 +150,7 @@ export function createAdminChatPostEndpoint(slugs: CollectionSlugs): Endpoint {
 
         // Agent sends a message
         if (action === 'send' && message) {
-          if (adminChatLimiter.check(String(req.user.id))) {
+          if (await adminChatLimiter.check(String(req.user.id), req)) {
             return Response.json({ error: 'Rate limit atteint.' }, { status: 429 })
           }
 

package/src/endpoints/ai-agent.ts

@@ -2,6 +2,7 @@ import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { runAiAgent } from '../utils/aiAgent'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 
 /**
  * POST /api/support/ai-agent   body: { ticketId, confidenceThreshold? }
@@ -9,13 +10,17 @@ import { runAiAgent } from '../utils/aiAgent'
  * Runs the autonomous AI agent on a ticket: it either posts a KB-grounded answer
  * (when confident) or escalates to a human with an internal note. Admin-only.
  */
-export function createAiAgentEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createAiAgentEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
+  const limiter = new RateLimiter(60_000, 10, store)
   return {
     path: '/support/ai-agent',
     method: 'post',
     handler: async (req) => {
       try {
         requireAdmin(req, slugs)
+        if (await limiter.check(String(req.user!.id), req)) {
+          return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
+        }
         let body: { ticketId?: number | string; confidenceThreshold?: number } = {}
         try { body = (await req.json!()) as typeof body } catch { /* no body */ }
         if (!body.ticketId) {

package/src/endpoints/ai.ts

@@ -2,10 +2,11 @@ import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { readSupportSettings, type SupportSettings } from '../utils/readSettings'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 
-function getClient(aiSettings: SupportSettings['ai']) {
-  // Dynamic import to avoid hard dependency
-  const Anthropic = require('@anthropic-ai/sdk').default
+async function getClient(aiSettings: SupportSettings['ai']) {
+  const moduleName = '@anthropic-ai/sdk'
+  const { default: Anthropic } = await import(moduleName)
   if (aiSettings.provider === 'ollama') {
     const baseURL = process.env.OLLAMA_API_URL || 'https://ollama.orkelis.app/v1'
     return new Anthropic({ apiKey: 'ollama', baseURL })
@@ -23,7 +24,8 @@ type AiAction = 'sentiment' | 'synthesis' | 'suggest_reply' | 'rewrite'
  * POST /api/support/ai
  * Admin-only endpoint for AI features in support.
  */
-export function createAiEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createAiEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
+  const limiter = new RateLimiter(60_000, 30, store)
   return {
     path: '/support/ai',
     method: 'post',
@@ -32,6 +34,9 @@ export function createAiEndpoint(slugs: CollectionSlugs): Endpoint {
         const payload = req.payload
 
         requireAdmin(req, slugs)
+        if (await limiter.check(String(req.user!.id), req)) {
+          return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
+        }
 
         const settings = await readSupportSettings(payload)
         const aiSettings = settings.ai
@@ -43,7 +48,7 @@ export function createAiEndpoint(slugs: CollectionSlugs): Endpoint {
         }
         const { action } = body as { action: AiAction }
 
-        const anthropic = getClient(aiSettings)
+        const anthropic = await getClient(aiSettings)
         const model = getModel(aiSettings)
 
         if (action === 'sentiment') {

package/src/endpoints/auth-2fa.ts

@@ -1,13 +1,10 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import crypto, { createHmac } from 'crypto'
-import { RateLimiter } from '../utils/rateLimiter'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { escapeHtml } from '../utils/emailTemplate'
 import { dbFind, dbUpdate } from '../utils/db'
 
-const sendLimiter = new RateLimiter(60 * 60 * 1000, 3) // 3 per hour
-const verifyLimiter = new RateLimiter(15 * 60 * 1000, 5) // 5 per 15 min
-
 function generateSecureCode(): string {
   const buf = crypto.randomBytes(4)
   const num = buf.readUInt32BE(0) % 900000 + 100000
@@ -27,7 +24,9 @@ function hashCode(code: string): string {
  * POST /api/support/2fa
  * Send or verify a 2FA code.
  */
-export function createAuth2faEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createAuth2faEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
+  const sendLimiter = new RateLimiter(60 * 60 * 1000, 3, store)
+  const verifyLimiter = new RateLimiter(15 * 60 * 1000, 5, store)
   return {
     path: '/support/2fa',
     method: 'post',
@@ -49,7 +48,7 @@ export function createAuth2faEndpoint(slugs: CollectionSlugs): Endpoint {
         const genericSendResponse = { success: true, message: 'Si un compte existe, un code a été envoyé.' }
 
         if (action === 'send') {
-          if (sendLimiter.check(email)) {
+          if (await sendLimiter.check(email, req)) {
             return Response.json(genericSendResponse)
           }
 
@@ -98,7 +97,7 @@ export function createAuth2faEndpoint(slugs: CollectionSlugs): Endpoint {
             return Response.json({ error: 'Code manquant' }, { status: 400 })
           }
 
-          if (verifyLimiter.check(email)) {
+          if (await verifyLimiter.check(email, req)) {
             return Response.json(
               { error: 'Trop de tentatives. Réessayez dans 15 minutes.' },
               { status: 429 },

package/src/endpoints/auto-close.ts

@@ -3,6 +3,7 @@ import type { CollectionSlugs } from '../utils/slugs'
 import { escapeHtml } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
 import { dbFind, dbCreate, dbUpdate } from '../utils/db'
+import { verifySecret } from '../utils/webhookSecurity'
 
 /**
  * GET /api/support/auto-close
@@ -16,7 +17,7 @@ export function createAutoCloseEndpoint(slugs: CollectionSlugs): Endpoint {
       const secret = req.headers.get('x-cron-secret')
       const expectedSecret = process.env.CRON_SECRET
 
-      if (!expectedSecret || secret !== expectedSecret) {
+      if (!verifySecret(secret, expectedSecret)) {
         return Response.json({ error: 'Non autorisé' }, { status: 401 })
       }
 

package/src/endpoints/capabilities.ts

@@ -0,0 +1,144 @@
+import type { Endpoint, Where } from 'payload'
+import type { SupportCapabilities } from '../types'
+import type { CollectionSlugs } from '../utils/slugs'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import {
+  validateInboundEmailPayload,
+  verifySecret,
+  type InboundEmailInput,
+} from '../utils/webhookSecurity'
+
+export function createInboundEmailEndpoint(
+  capability: NonNullable<SupportCapabilities['inboundEmail']>,
+  store?: RateLimitStore,
+): Endpoint {
+  const limiter = new RateLimiter(60_000, 60, store)
+  return {
+    path: '/support-webhook/inbound-email',
+    method: 'post',
+    handler: async (req) => {
+      const secretHeader = capability.secretHeader || 'x-webhook-secret'
+      if (!verifySecret(req.headers.get(secretHeader), capability.secret)) {
+        return Response.json({ error: 'Unauthorized' }, { status: 401 })
+      }
+      const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim()
+        || req.headers.get('x-real-ip')
+        || 'unknown'
+      if (await limiter.check(ip, req)) {
+        return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
+      }
+
+      const declaredLength = Number(req.headers.get('content-length') || 0) || undefined
+      let input: Record<string, unknown>
+      try {
+        input = await req.json!() as Record<string, unknown>
+      } catch {
+        return Response.json({ error: 'Invalid JSON body' }, { status: 400 })
+      }
+      const measuredLength = new TextEncoder().encode(JSON.stringify(input)).byteLength
+      const validation = validateInboundEmailPayload(
+        input as InboundEmailInput,
+        Math.max(declaredLength || 0, measuredLength),
+      )
+      if (validation) return Response.json({ error: validation.code }, { status: validation.status })
+      return capability.handle(req, input as InboundEmailInput)
+    },
+  }
+}
+
+export function createProjectSuggestionsEndpoint(
+  slugs: CollectionSlugs,
+  capability: NonNullable<SupportCapabilities['projectSuggestions']>,
+  store?: RateLimitStore,
+): Endpoint {
+  const limiter = new RateLimiter(60_000, 20, store)
+  return {
+    path: '/support/suggest-projects',
+    method: 'post',
+    handler: async (req) => {
+      if (!req.user || req.user.collection !== slugs.users) {
+        return Response.json({ error: 'Unauthorized' }, { status: 401 })
+      }
+      const key = req.user?.id ? String(req.user.id) : 'anonymous'
+      if (await limiter.check(key, req)) {
+        return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
+      }
+      return capability.suggest(req)
+    },
+  }
+}
+
+export function createTicketTitleEndpoint(
+  slugs: CollectionSlugs,
+  capability: NonNullable<SupportCapabilities['aiTitles']>,
+  store?: RateLimitStore,
+): Endpoint {
+  const limiter = new RateLimiter(60_000, 20, store)
+  return {
+    path: '/support/ticket-title',
+    method: 'post',
+    handler: async (req) => {
+      if (!req.user || req.user.collection !== slugs.users) {
+        return Response.json({ error: 'Unauthorized' }, { status: 401 })
+      }
+      if (await limiter.check(String(req.user.id), req)) {
+        return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
+      }
+      const ticketId = Number(new URL(req.url || '', 'http://localhost').searchParams.get('ticketId'))
+      if (!Number.isFinite(ticketId) || ticketId <= 0) {
+        return Response.json({ error: 'ticketId required' }, { status: 400 })
+      }
+      const title = await capability.generate(req.payload, ticketId)
+      if (!title) return Response.json({ error: 'Generation unavailable' }, { status: 502 })
+      return Response.json({ title, status: 'suggested' })
+    },
+  }
+}
+
+export function createGenerateMissingTitlesEndpoint(
+  slugs: CollectionSlugs,
+  capability: NonNullable<SupportCapabilities['aiTitles']>,
+  store?: RateLimitStore,
+): Endpoint {
+  const limiter = new RateLimiter(60_000, 5, store)
+  return {
+    path: '/support/generate-missing-titles',
+    method: 'post',
+    handler: async (req) => {
+      if (!req.user || req.user.collection !== slugs.users) {
+        return Response.json({ error: 'Unauthorized' }, { status: 401 })
+      }
+      if (await limiter.check(String(req.user.id), req)) {
+        return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
+      }
+      const limit = Math.min(
+        Math.max(Number(new URL(req.url || '', 'http://localhost').searchParams.get('limit')) || 8, 1),
+        20,
+      )
+      const where: Where = {
+        and: [
+          { displayTitle: { exists: false } },
+          { displayTitleStatus: { not_equals: 'error' } },
+        ],
+      }
+      const batch = await req.payload.find({
+        collection: slugs.tickets,
+        where,
+        limit,
+        depth: 0,
+        overrideAccess: true,
+        sort: '-createdAt',
+      })
+      let generated = 0
+      for (const ticket of batch.docs) {
+        if (await capability.generate(req.payload, ticket.id)) generated++
+      }
+      const remaining = await req.payload.count({
+        collection: slugs.tickets,
+        where,
+        overrideAccess: true,
+      })
+      return Response.json({ generated, remaining: remaining.totalDocs })
+    },
+  }
+}

package/src/endpoints/channels.ts

@@ -2,6 +2,7 @@ import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { dbFind, dbCreate } from '../utils/db'
 import { randomBytes } from 'crypto'
+import { verifySecret } from '../utils/webhookSecurity'
 
 const PROVIDERS = ['whatsapp', 'messenger'] as const
 type Provider = (typeof PROVIDERS)[number]
@@ -22,7 +23,7 @@ export function createChannelsWebhookEndpoint(slugs: CollectionSlugs): Endpoint
     method: 'post',
     handler: async (req) => {
       const secret = req.headers.get('x-channel-secret')
-      if (!process.env.CHANNELS_WEBHOOK_SECRET || secret !== process.env.CHANNELS_WEBHOOK_SECRET) {
+      if (!verifySecret(secret, process.env.CHANNELS_WEBHOOK_SECRET)) {
         return Response.json({ error: 'Non autorisé' }, { status: 401 })
       }
 

package/src/endpoints/chat.ts

@@ -2,12 +2,10 @@ import type { Endpoint } from 'payload'
 import type { Where } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import crypto from 'crypto'
-import { RateLimiter } from '../utils/rateLimiter'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { requireClient, handleAuthError } from '../utils/auth'
 import { dbFind, dbCreate } from '../utils/db'
 
-const chatSessionLimiter = new RateLimiter(3_600_000, 5) // 5 sessions per hour
-const chatMessageLimiter = new RateLimiter(60_000, 15) // 15 messages per minute
 
 /**
  * GET /api/support/chat?session=xxx&after=timestamp
@@ -68,7 +66,9 @@ export function createChatGetEndpoint(slugs: CollectionSlugs): Endpoint {
  * POST /api/support/chat
  * Send a message or start a new chat session. Client-only.
  */
-export function createChatPostEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createChatPostEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
+  const chatSessionLimiter = new RateLimiter(3_600_000, 5, store)
+  const chatMessageLimiter = new RateLimiter(60_000, 15, store)
   return {
     path: '/support/chat',
     method: 'post',
@@ -89,7 +89,7 @@ export function createChatPostEndpoint(slugs: CollectionSlugs): Endpoint {
 
         // Start a new session
         if (action === 'start') {
-          if (chatSessionLimiter.check(userId)) {
+          if (await chatSessionLimiter.check(userId, req)) {
             return Response.json({ error: 'Trop de sessions créées. Réessayez plus tard.' }, { status: 429 })
           }
 
@@ -111,7 +111,7 @@ export function createChatPostEndpoint(slugs: CollectionSlugs): Endpoint {
 
         // Send a message
         if (action === 'send' && session && message) {
-          if (chatMessageLimiter.check(userId)) {
+          if (await chatMessageLimiter.check(userId, req)) {
             return Response.json({ error: 'Trop de messages. Attendez un moment.' }, { status: 429 })
           }
 

package/src/endpoints/chatbot.ts

@@ -1,23 +1,23 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
-import { RateLimiter } from '../utils/rateLimiter'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbFind } from '../utils/db'
 
-const chatbotLimiter = new RateLimiter(60_000, 10) // 10 requests per minute per IP
 
 /**
  * POST /api/support/chatbot
  * AI chatbot that answers from the knowledge base before creating a ticket.
  * Public endpoint (accessible from the support portal).
  */
-export function createChatbotEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createChatbotEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
+  const chatbotLimiter = new RateLimiter(60_000, 10, store)
   return {
     path: '/support/chatbot',
     method: 'post',
     handler: async (req) => {
       try {
         const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || req.headers.get('x-real-ip') || 'unknown'
-        if (chatbotLimiter.check(ip)) {
+        if (await chatbotLimiter.check(ip, req)) {
           return Response.json({ error: 'Too many requests. Please wait a moment.' }, { status: 429 })
         }
 

package/src/endpoints/client-intelligence.ts

@@ -2,9 +2,11 @@ import type { Endpoint, PayloadRequest } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { readSupportSettings, type SupportSettings } from '../utils/readSettings'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 
-function getClient(aiSettings: SupportSettings['ai']) {
-  const Anthropic = require('@anthropic-ai/sdk').default
+async function getClient(aiSettings: SupportSettings['ai']) {
+  const moduleName = '@anthropic-ai/sdk'
+  const { default: Anthropic } = await import(moduleName)
   if (aiSettings.provider === 'ollama') {
     const baseURL = process.env.OLLAMA_API_URL || 'https://ollama.orkelis.app/v1'
     return new Anthropic({ apiKey: 'ollama', baseURL })
@@ -25,10 +27,14 @@ const CACHE_TTL_MS = 24 * 60 * 60 * 1000 // 24 hours
  * POST /api/support/client-intelligence?clientId=X
  * Force-refreshes the summary.
  */
-export function createClientIntelligenceEndpoint(slugs: CollectionSlugs): Endpoint[] {
+export function createClientIntelligenceEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint[] {
+  const limiter = new RateLimiter(60_000, 20, store)
   const getHandler = async (req: PayloadRequest) => {
     try {
       requireAdmin(req, slugs)
+      if (await limiter.check(String(req.user!.id), req)) {
+        return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
+      }
       const payload = req.payload
       const url = new URL(req.url || '', 'http://localhost')
       const clientId = url.searchParams.get('clientId')
@@ -64,6 +70,9 @@ export function createClientIntelligenceEndpoint(slugs: CollectionSlugs): Endpoi
   const postHandler = async (req: PayloadRequest) => {
     try {
       requireAdmin(req, slugs)
+      if (await limiter.check(String(req.user!.id), req)) {
+        return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
+      }
       const payload = req.payload
       const body = await req.json?.() || {}
       const clientId = body.clientId
@@ -197,7 +206,7 @@ Réponds en JSON strict (pas de markdown, pas de commentaires) avec cette struct
 Sois factuel. Ne dépasse pas 5 items par tableau. Réponds UNIQUEMENT avec le JSON.`
 
   // 6. Call AI
-  const anthropic = getClient(aiSettings)
+  const anthropic = await getClient(aiSettings)
   const model = getModel(aiSettings)
 
   const res = await anthropic.messages.create({

package/src/endpoints/import-conversation.ts

@@ -1,8 +1,9 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
-import { RateLimiter } from '../utils/rateLimiter'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { readSupportSettings } from '../utils/readSettings'
 import { dbFind, dbCreate } from '../utils/db'
+import { verifySecret } from '../utils/webhookSecurity'
 import crypto from 'crypto'
 
 interface ParsedConversation {
@@ -11,7 +12,6 @@ interface ParsedConversation {
   messages: { from: 'client' | 'admin'; name: string; date: string; content: string }[]
 }
 
-const importLimiter = new RateLimiter(3_600_000, 10) // 10 per hour
 
 function parseStructuredMarkdown(markdown: string): ParsedConversation | null {
   const clientMatch = markdown.match(
@@ -131,7 +131,8 @@ ONLY JSON, nothing else.`,
  * POST /api/support/import-conversation
  * Import a conversation from markdown into the ticket system.
  */
-export function createImportConversationEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createImportConversationEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
+  const importLimiter = new RateLimiter(3_600_000, 10, store)
   return {
     path: '/support/import-conversation',
     method: 'post',
@@ -143,7 +144,7 @@ export function createImportConversationEndpoint(slugs: CollectionSlugs): Endpoi
         const webhookSecret = req.headers.get('x-webhook-secret')
         let isAuthed = false
 
-        if (webhookSecret && process.env.SUPPORT_WEBHOOK_SECRET && webhookSecret === process.env.SUPPORT_WEBHOOK_SECRET) {
+        if (verifySecret(webhookSecret, process.env.SUPPORT_WEBHOOK_SECRET)) {
           isAuthed = true
         } else if (req.user && req.user.collection === slugs.users) {
           isAuthed = true
@@ -154,7 +155,7 @@ export function createImportConversationEndpoint(slugs: CollectionSlugs): Endpoi
         }
 
         const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || 'unknown'
-        if (importLimiter.check(ip)) {
+        if (await importLimiter.check(ip, req)) {
           return Response.json({ error: 'Rate limit exceeded. Maximum 10 imports per hour.' }, { status: 429 })
         }