@consilioweb/payload-support 1.1.1 → 2.0.0

package/src/endpoints/index.ts

@@ -1,6 +1,14 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import type { SupportFeatures } from '../types'
+import type { RateLimitStore } from '../utils/rateLimiter'
+import type { SupportCapabilities } from '../types'
+import {
+  createGenerateMissingTitlesEndpoint,
+  createInboundEmailEndpoint,
+  createProjectSuggestionsEndpoint,
+  createTicketTitleEndpoint,
+} from './capabilities'
 
 import { createAiEndpoint } from './ai'
 import { createAiAgentEndpoint } from './ai-agent'
@@ -112,6 +120,8 @@ export { createInviteCollaboratorEndpoint } from './invite-collaborator'
 export interface SupportEndpointOptions {
   oauth?: OAuthGoogleOptions
   features?: Required<SupportFeatures>
+  rateLimitStore?: RateLimitStore
+  capabilities?: SupportCapabilities
 }
 
 /**
@@ -121,6 +131,7 @@ export interface SupportEndpointOptions {
  */
 export function createSupportEndpoints(slugs: CollectionSlugs, options?: SupportEndpointOptions): Endpoint[] {
   const f = options?.features
+  const rateLimitStore = options?.rateLimitStore
 
   // Core endpoints (always present)
   const endpoints: Endpoint[] = [
@@ -132,28 +143,28 @@ export function createSupportEndpoints(slugs: CollectionSlugs, options?: Support
     createExportCsvEndpoint(slugs),
     createExportDataEndpoint(slugs),
     createSeedKbEndpoint(slugs),
-    createLoginEndpoint(slugs),
-    createAuth2faEndpoint(slugs),
+    createLoginEndpoint(slugs, rateLimitStore),
+    createAuth2faEndpoint(slugs, rateLimitStore),
     createOAuthGoogleEndpoint(slugs, options?.oauth),
     createDeleteAccountEndpoint(slugs),
     createMergeClientsEndpoint(slugs),
-    createImportConversationEndpoint(slugs),
+    createImportConversationEndpoint(slugs, rateLimitStore),
     createPurgeLogsEndpoint(slugs),
-    createResendNotificationEndpoint(slugs),
+    createResendNotificationEndpoint(slugs, rateLimitStore),
     createUserPrefsGetEndpoint(slugs),
     createUserPrefsPostEndpoint(slugs),
     createEscalateEndpoint(slugs),
     createTicketFeedbackEndpoint(slugs),
-    createTransferTicketEndpoint(slugs),
-    createInviteCollaboratorEndpoint(slugs),
+    createTransferTicketEndpoint(slugs, rateLimitStore),
+    createInviteCollaboratorEndpoint(slugs, rateLimitStore),
   ]
 
   // Conditional endpoints based on feature flags
   if (!f || f.ai !== false) {
-    endpoints.push(createAiEndpoint(slugs))
-    endpoints.push(createAiAgentEndpoint(slugs))
-    endpoints.push(...createClientIntelligenceEndpoint(slugs))
-    endpoints.push(createTicketSynthesisEndpoint(slugs))
+    endpoints.push(createAiEndpoint(slugs, rateLimitStore))
+    endpoints.push(createAiAgentEndpoint(slugs, rateLimitStore))
+    endpoints.push(...createClientIntelligenceEndpoint(slugs, rateLimitStore))
+    endpoints.push(createTicketSynthesisEndpoint(slugs, options?.capabilities?.aiSummaries, rateLimitStore))
   }
   if (!f || f.bulkActions !== false) endpoints.push(createBulkActionEndpoint(slugs))
   if (!f || f.merge !== false) endpoints.push(createMergeTicketsEndpoint(slugs))
@@ -168,18 +179,18 @@ export function createSupportEndpoints(slugs: CollectionSlugs, options?: Support
   if (!f || f.sla !== false) endpoints.push(createSlaCheckEndpoint(slugs))
   if (!f || f.autoClose !== false) {
     endpoints.push(createAutoCloseEndpoint(slugs))
-    endpoints.push(createSendReminderEndpoint(slugs))
+    endpoints.push(createSendReminderEndpoint(slugs, rateLimitStore))
   }
   if (!f || f.customStatuses !== false) endpoints.push(createStatusesEndpoint(slugs))
   if (!f || f.macros !== false) endpoints.push(createApplyMacroEndpoint(slugs))
   if (!f || f.roundRobin !== false) {
     endpoints.push(createRoundRobinConfigGetEndpoint(slugs), createRoundRobinConfigPostEndpoint(slugs))
   }
-  if (!f || f.chatbot !== false) endpoints.push(createChatbotEndpoint(slugs))
+  if (!f || f.chatbot !== false) endpoints.push(createChatbotEndpoint(slugs, rateLimitStore))
   if (!f || f.chat !== false) {
-    endpoints.push(createChatGetEndpoint(slugs), createChatPostEndpoint(slugs))
+    endpoints.push(createChatGetEndpoint(slugs), createChatPostEndpoint(slugs, rateLimitStore))
     endpoints.push(createChatStreamEndpoint(slugs))
-    endpoints.push(createAdminChatGetEndpoint(slugs), createAdminChatPostEndpoint(slugs))
+    endpoints.push(createAdminChatGetEndpoint(slugs), createAdminChatPostEndpoint(slugs, rateLimitStore))
     endpoints.push(createAdminChatStreamEndpoint(slugs))
   }
   if (!f || f.timeTracking !== false) {
@@ -197,6 +208,16 @@ export function createSupportEndpoints(slugs: CollectionSlugs, options?: Support
   endpoints.push(createChannelsWebhookEndpoint(slugs))
   endpoints.push(createVapidKeyEndpoint())
   endpoints.push(createPushSubscribeEndpoint(slugs))
+  if (options?.capabilities?.inboundEmail) {
+    endpoints.push(createInboundEmailEndpoint(options.capabilities.inboundEmail, rateLimitStore))
+  }
+  if (options?.capabilities?.projectSuggestions) {
+    endpoints.push(createProjectSuggestionsEndpoint(slugs, options.capabilities.projectSuggestions, rateLimitStore))
+  }
+  if (options?.capabilities?.aiTitles) {
+    endpoints.push(createTicketTitleEndpoint(slugs, options.capabilities.aiTitles, rateLimitStore))
+    endpoints.push(createGenerateMissingTitlesEndpoint(slugs, options.capabilities.aiTitles, rateLimitStore))
+  }
 
   return endpoints
 }

package/src/endpoints/invite-collaborator.ts

@@ -4,7 +4,7 @@ import { handleAuthError, AuthError } from '../utils/auth'
 import { escapeHtml, emailWrapper, emailButton, emailParagraph } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
 import { randomBytes } from 'crypto'
-import { RateLimiter } from '../utils/rateLimiter'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbFindByID, dbFind, dbCreate, dbUpdate, dbCount } from '../utils/db'
 
 const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
@@ -12,7 +12,6 @@ const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
 // Anti-abuse limits: an invite can create a placeholder account AND send an
 // email, so cap both the volume per user and the collaborators per ticket.
 const MAX_COLLABORATORS_PER_TICKET = 20
-const inviteLimiter = new RateLimiter(60 * 60 * 1000, 10)
 
 /**
  * POST /api/support/tickets/:id/invite
@@ -31,7 +30,8 @@ const inviteLimiter = new RateLimiter(60 * 60 * 1000, 10)
  *  - Sends an invitation email with a magic link `/support/tickets/:id?inviteToken=...`.
  *  - Returns { ok, invitedTo, role }.
  */
-export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
+  const inviteLimiter = new RateLimiter(60 * 60 * 1000, 10, store)
   return {
     path: '/support/tickets/:id/invite',
     method: 'post',
@@ -75,7 +75,7 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs): Endpoi
         }
 
         // Anti-abuse: cap invite volume per user (in-memory, fail-closed).
-        if (inviteLimiter.check(String(req.user.id))) {
+        if (await inviteLimiter.check(String(req.user.id), req)) {
           return Response.json({ error: 'Trop d\'invitations. Réessayez plus tard.' }, { status: 429 })
         }
 

package/src/endpoints/login.ts

@@ -1,15 +1,15 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
-import { RateLimiter } from '../utils/rateLimiter'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbCreate } from '../utils/db'
 
-const loginLimiter = new RateLimiter(15 * 60_000, 10) // 10 per 15 min
 
 /**
  * POST /api/support/login
  * Client login endpoint.
  */
-export function createLoginEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createLoginEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
+  const loginLimiter = new RateLimiter(15 * 60_000, 10, store)
   return {
     path: '/support/login',
     method: 'post',
@@ -19,7 +19,7 @@ export function createLoginEndpoint(slugs: CollectionSlugs): Endpoint {
       // the primary brute-force control is Payload's account lock (maxLoginAttempts).
       const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || req.headers.get('x-real-ip') || 'unknown'
 
-      if (loginLimiter.check(ip)) {
+      if (await loginLimiter.check(ip, req)) {
         return Response.json(
           { error: 'Trop de tentatives. Réessayez dans quelques minutes.' },
           { status: 429 },
@@ -66,7 +66,6 @@ export function createLoginEndpoint(slugs: CollectionSlugs): Endpoint {
           JSON.stringify({
             message: 'Login successful',
             user: result.user,
-            token: result.token,
             exp: result.exp,
           }),
           { status: 200, headers },

package/src/endpoints/oauth-google.ts

@@ -210,7 +210,7 @@ export function createOAuthGoogleEndpoint(slugs: CollectionSlugs, options?: OAut
             `payload-token=${token}; HttpOnly; ${cookieSecure ? 'Secure; ' : ''}SameSite=Lax; Path=/; Max-Age=${tokenExpiration}`,
           )
 
-          return new Response(JSON.stringify({ token, user: clientDoc, exp }), {
+          return new Response(JSON.stringify({ user: clientDoc, exp }), {
             status: 200,
             headers,
           })

package/src/endpoints/process-digests.ts

@@ -3,6 +3,7 @@ import type { CollectionSlugs } from '../utils/slugs'
 import { dbFind, dbFindByID, dbDelete } from '../utils/db'
 import { emailWrapper, emailParagraph, escapeHtml } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
+import { verifySecret } from '../utils/webhookSecurity'
 
 /**
  * POST /api/support/process-digests   body: { frequency?: 'daily' | 'weekly' }
@@ -18,7 +19,7 @@ export function createProcessDigestsEndpoint(slugs: CollectionSlugs): Endpoint {
     method: 'post',
     handler: async (req) => {
       const secret = req.headers.get('x-cron-secret')
-      if (!process.env.CRON_SECRET || secret !== process.env.CRON_SECRET) {
+      if (!verifySecret(secret, process.env.CRON_SECRET)) {
         return Response.json({ error: 'Non autorisé' }, { status: 401 })
       }
 

package/src/endpoints/process-scheduled.ts

@@ -4,6 +4,7 @@ import { escapeHtml } from '../utils/emailTemplate'
 import { fireWebhooks } from '../utils/fireWebhooks'
 import { readSupportSettings } from '../utils/readSettings'
 import { dbFind, dbFindByID, dbUpdate } from '../utils/db'
+import { verifySecret } from '../utils/webhookSecurity'
 
 /**
  * POST /api/support/process-scheduled
@@ -18,7 +19,7 @@ export function createProcessScheduledEndpoint(slugs: CollectionSlugs): Endpoint
       const secret = req.headers.get('x-cron-secret')
       const expectedSecret = process.env.CRON_SECRET
 
-      if (!expectedSecret || secret !== expectedSecret) {
+      if (!verifySecret(secret, expectedSecret)) {
         return Response.json({ error: 'Non autorisé' }, { status: 401 })
       }
 

package/src/endpoints/process-snooze.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { dbFind, dbUpdate, dbCreate } from '../utils/db'
+import { verifySecret } from '../utils/webhookSecurity'
 
 /**
  * POST /api/support/process-snooze
@@ -20,7 +21,7 @@ export function createProcessSnoozeEndpoint(slugs: CollectionSlugs): Endpoint {
     handler: async (req) => {
       const secret = req.headers.get('x-cron-secret')
       const expectedSecret = process.env.CRON_SECRET
-      if (!expectedSecret || secret !== expectedSecret) {
+      if (!verifySecret(secret, expectedSecret)) {
         return Response.json({ error: 'Non autorisé' }, { status: 401 })
       }
 

package/src/endpoints/resend-notification.ts

@@ -1,18 +1,18 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
-import { RateLimiter } from '../utils/rateLimiter'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { escapeHtml } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
 import { dbFindByID } from '../utils/db'
 
-const resendLimiter = new RateLimiter(60 * 60 * 1000, 10) // 10 per hour
 
 /**
  * POST /api/support/resend-notification
  * Resend the email notification for a specific ticket message. Admin-only.
  */
-export function createResendNotificationEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createResendNotificationEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
+  const resendLimiter = new RateLimiter(60 * 60 * 1000, 10, store)
   return {
     path: '/support/resend-notification',
     method: 'post',
@@ -22,7 +22,7 @@ export function createResendNotificationEndpoint(slugs: CollectionSlugs): Endpoi
 
         requireAdmin(req, slugs)
 
-        if (resendLimiter.check(String(req.user.id))) {
+        if (await resendLimiter.check(String(req.user.id), req)) {
           return Response.json(
             { error: 'Trop de renvois. Réessayez dans une heure.' },
             { status: 429 },

package/src/endpoints/send-reminder.ts

@@ -1,14 +1,13 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
-import { RateLimiter } from '../utils/rateLimiter'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { escapeHtml, emailWrapper, emailParagraph, emailButton } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
 import { dbFindByID, dbFind, dbCreate, dbUpdate } from '../utils/db'
 
 // Manual reminders are a deliberate admin action, so the cap is generous —
 // it only exists to stop a runaway script, not normal usage.
-const reminderLimiter = new RateLimiter(60 * 60 * 1000, 30) // 30 per hour per admin
 
 const MIN_HOURS = 1
 const MAX_HOURS = 24 * 30 // 30 days
@@ -38,7 +37,8 @@ function formatFr(date: Date, withTime: boolean): string {
  *
  * Admin-only, rate-limited.
  */
-export function createSendReminderEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createSendReminderEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
+  const reminderLimiter = new RateLimiter(60 * 60 * 1000, 30, store)
   return {
     path: '/support/send-reminder',
     method: 'post',
@@ -48,7 +48,7 @@ export function createSendReminderEndpoint(slugs: CollectionSlugs): Endpoint {
 
         requireAdmin(req, slugs)
 
-        if (reminderLimiter.check(String(req.user.id))) {
+        if (await reminderLimiter.check(String(req.user.id), req)) {
           return Response.json(
             { error: 'Trop de relances. Réessayez dans une heure.' },
             { status: 429 },

package/src/endpoints/ticket-synthesis.ts

@@ -3,6 +3,8 @@ import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { generateTicketSynthesis } from '../utils/generateTicketSynthesis'
 import { dbFindByID } from '../utils/db'
+import type { SupportCapabilities } from '../types'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 
 /**
  * POST /api/support/ticket-synthesis?ticketId=X[&force=true]
@@ -16,13 +18,21 @@ import { dbFindByID } from '../utils/db'
  * - The hook on Tickets clears aiSummary when a ticket is reopened, so the next pass through
  *   "resolved" status will trigger a regeneration automatically.
  */
-export function createTicketSynthesisEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createTicketSynthesisEndpoint(
+  slugs: CollectionSlugs,
+  generator?: SupportCapabilities['aiSummaries'],
+  store?: RateLimitStore,
+): Endpoint {
+  const limiter = new RateLimiter(60_000, 20, store)
   return {
     path: '/support/ticket-synthesis',
     method: 'post',
     handler: async (req) => {
       try {
         requireAdmin(req, slugs)
+        if (await limiter.check(String(req.user!.id), req)) {
+          return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
+        }
         const payload = req.payload
 
         const url = new URL(req.url || '', 'http://localhost')
@@ -54,7 +64,12 @@ export function createTicketSynthesisEndpoint(slugs: CollectionSlugs): Endpoint
           }
         }
 
-        const result = await generateTicketSynthesis({ payload, slugs, ticketId })
+        const result = generator
+          ? await generator.generate(payload, ticketId)
+          : await generateTicketSynthesis({ payload, slugs, ticketId })
+        if (!result) {
+          return Response.json({ error: 'Generation unavailable' }, { status: 502 })
+        }
         return Response.json(result)
       } catch (err) {
         const authResponse = handleAuthError(err)

package/src/endpoints/track-open.ts

@@ -1,6 +1,6 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
-import { createHmac } from 'crypto'
+import { createHmac, timingSafeEqual } from 'crypto'
 import { dbFindByID, dbUpdate, dbCreate } from '../utils/db'
 
 // 1x1 transparent GIF (43 bytes)
@@ -14,7 +14,20 @@ const TRANSPARENT_GIF = Buffer.from(
  * Use this when building tracking URLs in email templates.
  */
 export function generateTrackingToken(ticketId: string, messageId: string, secret: string): string {
-  return createHmac('sha256', secret).update(`${ticketId}:${messageId}`).digest('hex').substring(0, 16)
+  return createHmac('sha256', secret).update(`${ticketId}:${messageId}`).digest('hex')
+}
+
+export function verifyTrackingToken(
+  ticketId: string,
+  messageId: string,
+  signature: string,
+  secret: string,
+): boolean {
+  if (!/^[0-9a-f]{64}$/i.test(signature)) return false
+
+  const expected = Buffer.from(generateTrackingToken(ticketId, messageId, secret), 'hex')
+  const received = Buffer.from(signature, 'hex')
+  return expected.length === received.length && timingSafeEqual(expected, received)
 }
 
 /**
@@ -40,8 +53,10 @@ export function createTrackOpenEndpoint(slugs: CollectionSlugs): Endpoint {
       // and the silent "tracking writes without auth" hole.
       const secret = process.env.PAYLOAD_SECRET || ''
       const validSig =
-        !!secret && !!ticketId && !!messageId && !!sig &&
-        sig === generateTrackingToken(ticketId, messageId, secret)
+        !!secret && Number.isInteger(parsedId) && parsedId > 0 &&
+        Number.isInteger(parsedMsgId) && parsedMsgId > 0 &&
+        !!ticketId && !!messageId && !!sig &&
+        verifyTrackingToken(ticketId, messageId, sig, secret)
 
       if (!validSig) {
         // Return transparent GIF silently (don't leak information, don't process)
@@ -59,6 +74,17 @@ export function createTrackOpenEndpoint(slugs: CollectionSlugs): Endpoint {
         try {
           const payload = req.payload
 
+          const msg = await dbFindByID(payload, slugs.ticketMessages, {
+            id: parsedMsgId,
+            depth: 0,
+            overrideAccess: true,
+            select: { ticket: true, emailOpenedAt: true },
+          }) as any
+          const messageTicketId = typeof msg?.ticket === 'object' ? msg.ticket?.id : msg?.ticket
+          if (!msg || String(messageTicketId) !== String(parsedId)) {
+            return transparentGifResponse()
+          }
+
           const ticket = await dbFindByID(payload, slugs.tickets, {
             id: parsedId,
             depth: 0,
@@ -81,13 +107,6 @@ export function createTrackOpenEndpoint(slugs: CollectionSlugs): Endpoint {
 
           // Track at message level
           if (Number.isInteger(parsedMsgId) && parsedMsgId > 0) {
-            const msg = await dbFindByID(payload, slugs.ticketMessages, {
-              id: parsedMsgId,
-              depth: 0,
-              overrideAccess: true,
-              select: { emailOpenedAt: true },
-            }) as any
-
             if (msg && !msg.emailOpenedAt) {
               await dbUpdate(payload, slugs.ticketMessages, {
                 id: parsedMsgId,
@@ -127,16 +146,20 @@ export function createTrackOpenEndpoint(slugs: CollectionSlugs): Endpoint {
         }
       }
 
-      return new Response(TRANSPARENT_GIF, {
-        status: 200,
-        headers: {
-          'Content-Type': 'image/gif',
-          'Content-Length': String(TRANSPARENT_GIF.length),
-          'Cache-Control': 'no-store, no-cache, must-revalidate, max-age=0',
-          'Pragma': 'no-cache',
-          'Expires': '0',
-        },
-      })
+      return transparentGifResponse()
     },
   }
 }
+
+function transparentGifResponse(): Response {
+  return new Response(TRANSPARENT_GIF, {
+    status: 200,
+    headers: {
+      'Content-Type': 'image/gif',
+      'Content-Length': String(TRANSPARENT_GIF.length),
+      'Cache-Control': 'no-store, no-cache, must-revalidate, max-age=0',
+      'Pragma': 'no-cache',
+      'Expires': '0',
+    },
+  })
+}

package/src/endpoints/transfer-ticket.ts

@@ -3,7 +3,7 @@ import type { CollectionSlugs } from '../utils/slugs'
 import { handleAuthError, AuthError } from '../utils/auth'
 import { escapeHtml, emailWrapper, emailButton, emailParagraph } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
-import { RateLimiter } from '../utils/rateLimiter'
+import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbFindByID, dbFind, dbCreate, dbCount } from '../utils/db'
 
 // Simple RFC-5322 style sanity check — same level of strictness as the
@@ -16,7 +16,6 @@ const MAX_TRANSFERS_PER_DAY = 5
 // In-memory fail-closed rate limiter — enforced even when the persistent
 // emailLogs-based check is unavailable (collection disabled). Prevents the
 // endpoint from becoming an unbounded outbound mailer.
-const transferLimiter = new RateLimiter(24 * 60 * 60 * 1000, MAX_TRANSFERS_PER_DAY)
 
 /**
  * POST /api/support/tickets/:id/transfer
@@ -33,7 +32,8 @@ const transferLimiter = new RateLimiter(24 * 60 * 60 * 1000, MAX_TRANSFERS_PER_D
  *  - Logs the action in `email-logs` (action='transfer') when that collection exists
  *  - Rate-limited to 5 transfers per ticket per 24h
  */
-export function createTransferTicketEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createTransferTicketEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
+  const transferLimiter = new RateLimiter(24 * 60 * 60 * 1000, MAX_TRANSFERS_PER_DAY, store)
   return {
     path: '/support/tickets/:id/transfer',
     method: 'post',
@@ -82,7 +82,7 @@ export function createTransferTicketEndpoint(slugs: CollectionSlugs): Endpoint {
 
         // Fail-closed in-memory rate limit (per user + ticket): enforced even
         // when the persistent emailLogs check below cannot run.
-        if (transferLimiter.check(`${req.user.id}:${ticketId}`)) {
+        if (await transferLimiter.check(`${req.user.id}:${ticketId}`, req)) {
           return Response.json(
             { error: `Limite atteinte (${MAX_TRANSFERS_PER_DAY} transferts par 24h sur ce ticket)` },
             { status: 429 },

package/src/index.ts

@@ -23,6 +23,13 @@ export { resolveSlugs, DEFAULT_SLUGS } from './utils/slugs'
 export type { CollectionSlugs } from './utils/slugs'
 export { readSupportSettings, readUserPrefs, DEFAULT_SETTINGS, DEFAULT_USER_PREFS } from './utils/readSettings'
 export type { SupportSettings, UserPrefs } from './utils/readSettings'
+export { MemoryRateLimitStore, PayloadRateLimitStore, RateLimiter } from './utils/rateLimiter'
+export type { RateLimitEntry, RateLimitStore } from './utils/rateLimiter'
+export { DEFAULT_INBOUND_EMAIL_LIMITS, validateInboundEmailPayload, verifySecret } from './utils/webhookSecurity'
+export type { InboundEmailInput, InboundEmailLimits, InboundEmailValidationError } from './utils/webhookSecurity'
+
+// Endpoint factories for framework adapters (for example Next route handlers).
+export { createLoginEndpoint, createOAuthGoogleEndpoint, createTrackOpenEndpoint } from './endpoints'
 export { createAdminNotification } from './utils/adminNotification'
 export { dispatchWebhook } from './utils/webhookDispatcher'
 export { generateTicketSynthesis } from './utils/generateTicketSynthesis'

package/src/plugin.ts

@@ -27,7 +27,10 @@ import {
   createAutomationRulesCollection,
   createSupportTeamCollection,
   createPushSubscriptionCollection,
+  createSupportRateLimitsCollection,
+  createSupportCountersCollection,
 } from './collections'
+import { PayloadRateLimitStore } from './utils/rateLimiter'
 
 function viewConfig(component: string, path: string): AdminViewConfig {
   return { Component: component, path: path as `/${string}` }
@@ -68,6 +71,9 @@ export function supportPlugin(config?: SupportPluginConfig): Plugin {
     ...config?.collectionSlugs,
     users: config?.userCollectionSlug || 'users',
   })
+  const rateLimitStore = config?.rateLimitStore === 'payload'
+    ? new PayloadRateLimitStore(slugs.rateLimits)
+    : config?.rateLimitStore
 
   return (incomingConfig: Config): Config => {
     const existingCollections = incomingConfig.collections || []
@@ -80,14 +86,17 @@ export function supportPlugin(config?: SupportPluginConfig): Plugin {
       projectCollectionSlug: config?.projectCollectionSlug,
       documentsCollectionSlug: config?.documentsCollectionSlug,
       notificationSlug: config?.notificationSlug,
+      ticketNumber: config?.ticketNumber,
+      capabilities: config?.capabilities,
     }
     const messageOptions = {
       notificationSlug: config?.notificationSlug,
+      capabilities: config?.capabilities,
     }
     const supportCollections = [
       createTicketsCollection(slugs, ticketOptions),
       createTicketMessagesCollection(slugs, messageOptions),
-      createSupportClientsCollection(slugs),
+      createSupportClientsCollection(slugs, { capabilities: config?.capabilities }),
       createCannedResponsesCollection(slugs),
       createTicketActivityLogCollection(slugs),
       createSatisfactionSurveysCollection(slugs),
@@ -98,7 +107,11 @@ export function supportPlugin(config?: SupportPluginConfig): Plugin {
       createAutomationRulesCollection(slugs),
       createSupportTeamCollection(slugs),
       createPushSubscriptionCollection(slugs),
+      createSupportCountersCollection(slugs.counters),
     ]
+    if (config?.rateLimitStore === 'payload') {
+      supportCollections.push(createSupportRateLimitsCollection(slugs.rateLimits))
+    }
 
     // Auth logs (conditional)
     if (features.authLogs !== false) supportCollections.push(createAuthLogsCollection(slugs))
@@ -150,6 +163,8 @@ export function supportPlugin(config?: SupportPluginConfig): Plugin {
     const supportEndpoints = createSupportEndpoints(slugs, {
       oauth: { allowedEmailDomains: config?.allowedEmailDomains },
       features,
+      rateLimitStore,
+      capabilities: config?.capabilities,
     })
 
     return {

package/src/portal/LiveChat.tsx

@@ -441,7 +441,7 @@ export function LiveChat() {
         width: 380,
         maxWidth: 'calc(100vw - 32px)',
         height: screen === 'identify' || screen === 'rating' ? 'auto' : 520,
-        maxHeight: 'calc(100vh - 32px)',
+        maxHeight: 'calc(100dvh - 32px)',
         borderRadius: 16,
         border: '3px solid #000',
         backgroundColor: '#fff',

package/src/portal/auth/ChatWidget.tsx

@@ -215,7 +215,7 @@ function ChatWidgetInner() {
       {!isOpen && (
         <button
           onClick={() => setIsOpen(true)}
-          className="fixed bottom-6 right-6 z-50 flex h-14 w-14 items-center justify-center rounded-full border-3 border-black bg-[#00E5FF] shadow-[4px_4px_0px_#000] transition-all hover:translate-x-[2px] hover:translate-y-[2px] hover:shadow-[2px_2px_0px_#000] dark:border-gray-600 dark:shadow-[4px_4px_0px_#333]"
+          className="fixed bottom-6 right-6 z-50 flex h-14 w-14 items-center justify-center rounded-full border-3 border-black bg-[#00E5FF] shadow-[4px_4px_0px_#000] transition-[color,background-color,border-color,box-shadow,transform] motion-reduce:transition-none hover:translate-x-[2px] hover:translate-y-[2px] hover:shadow-[2px_2px_0px_#000] dark:border-gray-600 dark:shadow-[4px_4px_0px_#333]"
           title="Chat en direct"
         >
           <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2.5" strokeLinecap="round" strokeLinejoin="round" className="h-6 w-6">
@@ -274,7 +274,7 @@ function ChatWidgetInner() {
                 </p>
                 <button
                   onClick={startChat}
-                  className="rounded-xl border-3 border-black bg-[#00E5FF] px-6 py-3 text-sm font-black text-black shadow-[4px_4px_0px_#000] transition-all hover:translate-x-[2px] hover:translate-y-[2px] hover:shadow-[2px_2px_0px_#000]"
+                  className="rounded-xl border-3 border-black bg-[#00E5FF] px-6 py-3 text-sm font-black text-black shadow-[4px_4px_0px_#000] transition-[color,background-color,border-color,box-shadow,transform] motion-reduce:transition-none hover:translate-x-[2px] hover:translate-y-[2px] hover:shadow-[2px_2px_0px_#000]"
                 >
                   Démarrer le chat
                 </button>
@@ -320,7 +320,7 @@ function ChatWidgetInner() {
                 <p className="mb-3 text-sm text-gray-500 dark:text-gray-400">Le chat est terminé.</p>
                 <button
                   onClick={resetChat}
-                  className="rounded-xl border-2 border-black bg-[#FFD600] px-4 py-2 text-xs font-bold text-black shadow-[2px_2px_0px_#000] transition-all hover:translate-x-[1px] hover:translate-y-[1px] hover:shadow-[1px_1px_0px_#000]"
+                  className="rounded-xl border-2 border-black bg-[#FFD600] px-4 py-2 text-xs font-bold text-black shadow-[2px_2px_0px_#000] transition-[color,background-color,border-color,box-shadow,transform] motion-reduce:transition-none hover:translate-x-[1px] hover:translate-y-[1px] hover:shadow-[1px_1px_0px_#000]"
                 >
                   Nouveau chat
                 </button>
@@ -344,7 +344,7 @@ function ChatWidgetInner() {
                 <button
                   type="submit"
                   disabled={!input.trim() || sending}
-                  className="rounded-xl border-2 border-black bg-[#00E5FF] px-3 py-2 font-bold text-black transition-all hover:shadow-[2px_2px_0px_#000] disabled:opacity-50 dark:border-gray-600"
+                  className="rounded-xl border-2 border-black bg-[#00E5FF] px-3 py-2 font-bold text-black transition-[color,background-color,border-color,box-shadow,transform] motion-reduce:transition-none hover:shadow-[2px_2px_0px_#000] disabled:opacity-50 dark:border-gray-600"
                 >
                   <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2.5" strokeLinecap="round" strokeLinejoin="round" className="h-4 w-4">
                     <line x1="22" y1="2" x2="11" y2="13" />