@consilioweb/payload-support 1.1.1 → 2.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consilioweb/payload-support",
-  "version": "1.1.1",
+  "version": "2.0.1",
   "description": "Payload CMS plugin — professional support & ticketing system with AI, SLA, time tracking, live chat, and more",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -49,15 +49,6 @@
     "README.md",
     "LICENSE"
   ],
-  "scripts": {
-    "build": "tsup",
-    "typecheck": "tsc --noEmit",
-    "prepublishOnly": "npm run build",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:e2e": "playwright test",
-    "test:e2e:ui": "playwright test --ui"
-  },
   "keywords": [
     "payload",
     "payload-cms",
@@ -124,22 +115,23 @@
     "node": ">=18"
   },
   "devDependencies": {
-    "@payloadcms/db-sqlite": "^3.85.1",
+    "@payloadcms/db-sqlite": "^3.86.0",
+    "@payloadcms/graphql": "^3.86.0",
+    "@payloadcms/next": "^3.86.0",
+    "@payloadcms/richtext-lexical": "^3.86.0",
+    "@payloadcms/translations": "^3.86.0",
+    "@payloadcms/ui": "^3.86.0",
     "@playwright/test": "^1.49.0",
-    "@payloadcms/graphql": "^3.85.1",
-    "@payloadcms/next": "^3.85.1",
-    "@payloadcms/richtext-lexical": "^3.85.1",
-    "@payloadcms/translations": "^3.85.1",
-    "@payloadcms/ui": "^3.85.1",
     "@types/pdfkit": "^0.17.6",
     "@types/react": "^19.0.0",
     "@types/sanitize-html": "^2.16.1",
     "@types/web-push": "^3.6.4",
     "esbuild-sass-plugin": "^3.7.0",
-    "next": "^15.5.14",
-    "payload": "^3.85.1",
+    "next": "^16.2.9",
+    "payload": "^3.86.0",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
+    "sharp": "0.34.5",
     "tsup": "^8.0.0",
     "typescript": "^5.5.0",
     "vitest": "^4.1.9"
@@ -148,5 +140,13 @@
     "pdfkit": "^0.19.1",
     "sanitize-html": "^2.17.5",
     "web-push": "^3.6.7"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:e2e": "playwright test",
+    "test:e2e:ui": "playwright test --ui"
   }
-}
+}

package/src/__tests__/aiSummaryRendering.test.ts

@@ -0,0 +1,21 @@
+import React from 'react'
+import { describe, expect, it } from 'vitest'
+import { renderAiSummary } from '../components/TicketConversation/components/AISummaryPanel'
+
+describe('AI summary rendering', () => {
+  it('escapes model-provided HTML instead of interpreting it', () => {
+    const nodes = renderAiSummary('<img src=x onerror=alert(1)>')
+    expect(nodes).toEqual(['<img src=x onerror=alert(1)>'])
+    expect(React.isValidElement(nodes[0])).toBe(false)
+  })
+
+  it('preserves bold markdown and line breaks without raw HTML', () => {
+    const nodes = renderAiSummary('**Résumé**\nSuite')
+    expect(React.isValidElement(nodes[0])).toBe(true)
+    expect((nodes[0] as React.ReactElement).type).toBe('strong')
+    expect((nodes[0] as React.ReactElement<{ children: string }>).props.children).toBe('Résumé')
+    expect(React.isValidElement(nodes[1])).toBe(true)
+    expect((nodes[1] as React.ReactElement).type).toBe('br')
+    expect(nodes[2]).toBe('Suite')
+  })
+})

package/src/__tests__/authResponses.test.ts

@@ -0,0 +1,69 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createLoginEndpoint } from '../endpoints/login'
+import { createOAuthGoogleEndpoint } from '../endpoints/oauth-google'
+import { resolveSlugs } from '../utils/slugs'
+
+const slugs = resolveSlugs()
+
+afterEach(() => {
+  vi.restoreAllMocks()
+})
+
+describe('authentication responses', () => {
+  it('keeps the login JWT exclusively in the HttpOnly cookie', async () => {
+    const endpoint = createLoginEndpoint(slugs)
+    const response = await endpoint.handler({
+      headers: new Headers(),
+      json: async () => ({ email: 'client@example.com', password: 'secret' }),
+      payload: {
+        login: vi.fn(async () => ({ token: 'jwt-secret', exp: 123, user: { id: 1 } })),
+        create: vi.fn(async () => ({})),
+      },
+    } as never)
+
+    expect(response.headers.get('set-cookie')).toContain('payload-token=jwt-secret')
+    expect(response.headers.get('set-cookie')).toContain('HttpOnly')
+    await expect(response.json()).resolves.toEqual({
+      message: 'Login successful',
+      user: { id: 1 },
+      exp: 123,
+    })
+  })
+
+  it('keeps the OAuth JWT exclusively in the HttpOnly cookie', async () => {
+    process.env.GOOGLE_OAUTH_CLIENT_ID = 'google-client'
+    process.env.GOOGLE_OAUTH_CLIENT_SECRET = 'google-secret'
+    process.env.NEXT_PUBLIC_SERVER_URL = 'https://example.test'
+    process.env.PAYLOAD_SECRET = 'payload-secret'
+
+    vi.spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(new Response(JSON.stringify({ access_token: 'google-token' })))
+      .mockResolvedValueOnce(new Response(JSON.stringify({
+        id: 'google-id',
+        email: 'client@example.com',
+        verified_email: true,
+      })))
+
+    const endpoint = createOAuthGoogleEndpoint(slugs)
+    const response = await endpoint.handler({
+      json: async () => ({ code: 'code', state: 'state', cookieState: 'state' }),
+      payload: {
+        collections: {
+          [slugs.supportClients]: {
+            config: { auth: { tokenExpiration: 7200 }, fields: [] },
+          },
+        },
+        find: vi.fn(async () => ({
+          docs: [{ id: 1, email: 'client@example.com' }],
+          totalDocs: 1,
+        })),
+      },
+    } as never)
+
+    expect(response.status).toBe(200)
+    expect(response.headers.get('set-cookie')).toMatch(/^payload-token=/)
+    const body = await response.json() as Record<string, unknown>
+    expect(body).not.toHaveProperty('token')
+    expect(body).toHaveProperty('user')
+  })
+})

package/src/__tests__/capabilities.test.ts

@@ -0,0 +1,71 @@
+import type { Config, Field } from 'payload'
+import { describe, expect, it, vi } from 'vitest'
+import { supportPlugin } from '../plugin'
+
+function fieldNames(fields: Field[]): string[] {
+  return fields.flatMap((field) => {
+    const own = 'name' in field && typeof field.name === 'string' ? [field.name] : []
+    const nested = 'fields' in field && Array.isArray(field.fields) ? fieldNames(field.fields) : []
+    return [...own, ...nested]
+  })
+}
+
+function configuredPlugin() {
+  return supportPlugin({
+    capabilities: {
+      aiSummaries: { generate: vi.fn(async () => undefined) },
+      aiTitles: { generate: vi.fn(async () => undefined) },
+      detailedBilling: true,
+      inboundEmail: {
+        secret: 'test-secret',
+        handle: vi.fn(async () => Response.json({ success: true })),
+      },
+      projectSuggestions: {
+        suggest: vi.fn(async () => Response.json({ suggestions: [] })),
+      },
+      sms: {
+        adapter: { send: vi.fn(async () => ({ sent: true })) },
+      },
+      threadCleanup: { clean: vi.fn(async () => undefined) },
+      volunteering: true,
+    },
+    rateLimitStore: 'payload',
+  })({ collections: [], endpoints: [] } as unknown as Config) as Config
+}
+
+describe('Support capabilities', () => {
+  it('owns the optional ticket, message and client fields', () => {
+    const config = configuredPlugin()
+    const collection = (slug: string) => config.collections?.find((item) => item.slug === slug)
+
+    expect(fieldNames(collection('tickets')!.fields)).toEqual(expect.arrayContaining([
+      'billingLines',
+      'billedAt',
+      'displayTitle',
+      'displayTitleStatus',
+      'volunteer',
+      'volunteerValue',
+      'waitingSince',
+    ]))
+    expect(fieldNames(collection('ticket-messages')!.fields)).toEqual(expect.arrayContaining([
+      'notifyBySms',
+      'smsTo',
+      'smsMessage',
+      'isMarkedAsNoise',
+      'emailBodyOriginal',
+    ]))
+    expect(fieldNames(collection('support-clients')!.fields)).toEqual(expect.arrayContaining([
+      'notifyBySmsChannel',
+      'preferredFormality',
+      'preferredTone',
+    ]))
+  })
+
+  it('registers protected deployment adapter endpoints in the module', () => {
+    const paths = configuredPlugin().endpoints?.map((endpoint) => endpoint.path)
+    expect(paths).toContain('/support-webhook/inbound-email')
+    expect(paths).toContain('/support/suggest-projects')
+    expect(paths).toContain('/support/ticket-title')
+    expect(paths).toContain('/support/generate-missing-titles')
+  })
+})

package/src/__tests__/generateTrackingToken.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest'
-import { generateTrackingToken } from '../endpoints/track-open'
+import { generateTrackingToken, verifyTrackingToken } from '../endpoints/track-open'
 
 describe('generateTrackingToken — determinism', () => {
   it('returns the same token for identical inputs (deterministic)', () => {
@@ -8,14 +8,28 @@ describe('generateTrackingToken — determinism', () => {
     expect(a).toBe(b)
   })
 
-  it('always returns exactly 16 characters', () => {
+  it('returns the complete SHA-256 HMAC', () => {
     const token = generateTrackingToken('1', '2', 'secret')
-    expect(token).toHaveLength(16)
+    expect(token).toHaveLength(64)
   })
 
   it('returns only hex characters (0-9 a-f)', () => {
     const token = generateTrackingToken('100', '200', 'anothersecret')
-    expect(token).toMatch(/^[0-9a-f]{16}$/)
+    expect(token).toMatch(/^[0-9a-f]{64}$/)
+  })
+})
+
+describe('verifyTrackingToken', () => {
+  it('accepts the matching ticket and message signature', () => {
+    const token = generateTrackingToken('42', '7', 'secret')
+    expect(verifyTrackingToken('42', '7', token, 'secret')).toBe(true)
+  })
+
+  it('rejects malformed and mismatched signatures without throwing', () => {
+    const token = generateTrackingToken('42', '7', 'secret')
+    expect(verifyTrackingToken('42', '8', token, 'secret')).toBe(false)
+    expect(verifyTrackingToken('42', '7', 'not-hex', 'secret')).toBe(false)
+    expect(verifyTrackingToken('42', '7', token.slice(2), 'secret')).toBe(false)
   })
 })
 

package/src/__tests__/integration/core-behaviors.test.ts

@@ -23,6 +23,29 @@ describe('core ticketing behaviours', () => {
     expect(t1.ticketNumber).not.toBe(t2.ticketNumber)
   }, 60_000)
 
+  it('allocates sequential numbers under concurrent creation and after deletion', async () => {
+    const payload = await buildTestPayload()
+    const c = await makeClient(payload, 'concurrent-num@example.com')
+    const tickets = await Promise.all(
+      Array.from({ length: 12 }, (_, index) => payload.create({
+        collection: 'tickets',
+        data: { subject: `concurrent-${index}`, client: c.id, status: 'open', priority: 'normal' },
+        overrideAccess: true,
+      })),
+    )
+    const numbers = tickets.map((ticket) => Number(String(ticket.ticketNumber).replace('TK-', '')))
+    expect(new Set(numbers)).toHaveLength(12)
+
+    const highest = Math.max(...numbers)
+    await payload.delete({ collection: 'tickets', id: tickets[0].id, overrideAccess: true })
+    const next = await payload.create({
+      collection: 'tickets',
+      data: { subject: 'after-delete', client: c.id, status: 'open', priority: 'normal' },
+      overrideAccess: true,
+    })
+    expect(Number(String(next.ticketNumber).replace('TK-', ''))).toBe(highest + 1)
+  }, 60_000)
+
   it('moves status to waiting_client on admin reply and back to open on client reply', async () => {
     const payload = await buildTestPayload()
     const c = await makeClient(payload, 'status@example.com')

package/src/__tests__/rateLimiter.test.ts

@@ -1,89 +1,83 @@
-import { describe, it, expect, vi, afterEach } from 'vitest'
-import { RateLimiter } from '../utils/rateLimiter'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { MemoryRateLimitStore, PayloadRateLimitStore, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 
 afterEach(() => {
   vi.useRealTimers()
 })
 
-describe('RateLimiter — under the limit', () => {
-  it('allows the first request', () => {
-    const limiter = new RateLimiter(60_000, 5)
-    expect(limiter.check('user:1')).toBe(false)
-  })
-
-  it('allows requests up to the maximum (maxRequests = 3)', () => {
-    const limiter = new RateLimiter(60_000, 3)
-    expect(limiter.check('key')).toBe(false) // count = 1
-    expect(limiter.check('key')).toBe(false) // count = 2
-    expect(limiter.check('key')).toBe(false) // count = 3
-  })
-})
-
-describe('RateLimiter — exceeding the limit', () => {
-  it('blocks the request when count exceeds maxRequests', () => {
+describe('RateLimiter', () => {
+  it('allows requests up to the maximum and then blocks', async () => {
     const limiter = new RateLimiter(60_000, 2)
-    limiter.check('key') // count = 1
-    limiter.check('key') // count = 2
-    // count = 3 > maxRequests(2) → blocked
-    expect(limiter.check('key')).toBe(true)
+    await expect(limiter.check('key')).resolves.toBe(false)
+    await expect(limiter.check('key')).resolves.toBe(false)
+    await expect(limiter.check('key')).resolves.toBe(true)
+    await expect(limiter.check('key')).resolves.toBe(true)
   })
 
-  it('keeps blocking subsequent requests after limit exceeded', () => {
+  it('resets only the targeted key', async () => {
     const limiter = new RateLimiter(60_000, 1)
-    limiter.check('key') // count = 1, passes
-    expect(limiter.check('key')).toBe(true)  // count = 2 → blocked
-    expect(limiter.check('key')).toBe(true)  // count = 3 → still blocked
-  })
-})
+    await limiter.check('key-a')
+    await limiter.check('key-b')
+    await expect(limiter.check('key-a')).resolves.toBe(true)
+    await expect(limiter.check('key-b')).resolves.toBe(true)
 
-describe('RateLimiter — reset', () => {
-  it('allows requests again after manual reset', () => {
-    const limiter = new RateLimiter(60_000, 1)
-    limiter.check('key') // count = 1
-    expect(limiter.check('key')).toBe(true) // blocked
-    limiter.reset('key')
-    expect(limiter.check('key')).toBe(false) // reset → allowed again
+    await limiter.reset('key-a')
+
+    await expect(limiter.check('key-a')).resolves.toBe(false)
+    await expect(limiter.check('key-b')).resolves.toBe(true)
   })
 
-  it('reset only affects the targeted key', () => {
-    const limiter = new RateLimiter(60_000, 1)
-    limiter.check('keyA')
-    limiter.check('keyA') // keyA blocked
-    limiter.check('keyB')
-    limiter.check('keyB') // keyB blocked
+  it('opens a new window after expiry', async () => {
+    vi.useFakeTimers()
+    const limiter = new RateLimiter(1_000, 1)
+    await limiter.check('key')
+    await expect(limiter.check('key')).resolves.toBe(true)
 
-    limiter.reset('keyA')
-    expect(limiter.check('keyA')).toBe(false) // keyA allowed
-    expect(limiter.check('keyB')).toBe(true)  // keyB still blocked
+    vi.advanceTimersByTime(1_001)
+
+    await expect(limiter.check('key')).resolves.toBe(false)
   })
-})
 
-describe('RateLimiter — window expiry', () => {
-  it('resets the counter automatically after the window expires', () => {
-    vi.useFakeTimers()
-    const windowMs = 1_000
-    const limiter = new RateLimiter(windowMs, 2)
+  it('shares counters between limiter instances using the same store', async () => {
+    const store = new MemoryRateLimitStore()
+    const firstProcess = new RateLimiter(60_000, 1, store)
+    const secondProcess = new RateLimiter(60_000, 1, store)
 
-    limiter.check('key') // count = 1
-    limiter.check('key') // count = 2
-    expect(limiter.check('key')).toBe(true) // blocked
+    await expect(firstProcess.check('shared')).resolves.toBe(false)
+    await expect(secondProcess.check('shared')).resolves.toBe(true)
+  })
 
-    // Advance past the window
-    vi.advanceTimersByTime(windowMs + 1)
+  it('supports an asynchronous persistent store adapter', async () => {
+    const increment = vi.fn(async () => ({ count: 2, resetAt: Date.now() + 1_000 }))
+    const store: RateLimitStore = {
+      increment,
+      reset: vi.fn(async () => undefined),
+    }
+    const limiter = new RateLimiter(1_000, 1, store)
 
-    // The next check should open a new window
-    expect(limiter.check('key')).toBe(false) // new window, count = 1
+    await expect(limiter.check('client:42')).resolves.toBe(true)
+    expect(increment).toHaveBeenCalledWith('client:42', 1_000)
   })
-})
 
-describe('RateLimiter — key independence', () => {
-  it('tracks different keys independently', () => {
-    const limiter = new RateLimiter(60_000, 1)
-    // key-A hits limit
-    limiter.check('key-A') // count = 1
-    expect(limiter.check('key-A')).toBe(true) // blocked
+  it('persists counters through the Payload adapter', async () => {
+    let record: { id: number; key: string; count: number; resetAt: string } | undefined
+    const payload = {
+      find: vi.fn(async () => ({ docs: record ? [record] : [] })),
+      create: vi.fn(async ({ data }: { data: typeof record }) => {
+        record = { ...data!, id: 1 }
+        return record
+      }),
+      update: vi.fn(async ({ data }: { data: Partial<typeof record> }) => {
+        record = { ...record!, ...data }
+        return record
+      }),
+      delete: vi.fn(async () => undefined),
+    }
+    const store = new PayloadRateLimitStore()
+    const firstProcess = new RateLimiter(60_000, 1, store)
+    const secondProcess = new RateLimiter(60_000, 1, store)
 
-    // key-B untouched
-    expect(limiter.check('key-B')).toBe(false) // fresh key, allowed
+    await expect(firstProcess.check('shared', payload)).resolves.toBe(false)
+    await expect(secondProcess.check('shared', payload)).resolves.toBe(true)
   })
 })

package/src/__tests__/trackOpenEndpoint.test.ts

@@ -0,0 +1,54 @@
+import { describe, expect, it, vi } from 'vitest'
+import { createTrackOpenEndpoint, generateTrackingToken } from '../endpoints/track-open'
+import { resolveSlugs } from '../utils/slugs'
+
+const secret = 'test-payload-secret'
+
+function createRequest(ticketId: string, messageId: string, signature: string) {
+  const findByID = vi.fn(async ({ collection }: { collection: string }) => {
+    if (collection === 'ticket-messages') {
+      return { id: Number(messageId), ticket: Number(ticketId) + 1, emailOpenedAt: null }
+    }
+    return { id: Number(ticketId), lastClientReadAt: null }
+  })
+  const update = vi.fn()
+  return {
+    req: {
+      url: `https://example.test/api/support/track-open?t=${ticketId}&m=${messageId}&sig=${signature}`,
+      payload: { findByID, update },
+    },
+    findByID,
+    update,
+  }
+}
+
+describe('track-open endpoint', () => {
+  it('does not query the database for signed non-numeric identifiers', async () => {
+    process.env.PAYLOAD_SECRET = secret
+    const ticketId = 'not-a-ticket'
+    const messageId = 'not-a-message'
+    const signature = generateTrackingToken(ticketId, messageId, secret)
+    const { req, findByID, update } = createRequest(ticketId, messageId, signature)
+    const endpoint = createTrackOpenEndpoint(resolveSlugs())
+
+    const response = await endpoint.handler(req as never)
+
+    expect(response.status).toBe(200)
+    expect(findByID).not.toHaveBeenCalled()
+    expect(update).not.toHaveBeenCalled()
+  })
+
+  it('does not mutate when the signed message belongs to another ticket', async () => {
+    process.env.PAYLOAD_SECRET = secret
+    const ticketId = '10'
+    const messageId = '20'
+    const signature = generateTrackingToken(ticketId, messageId, secret)
+    const { req, update } = createRequest(ticketId, messageId, signature)
+    const endpoint = createTrackOpenEndpoint(resolveSlugs())
+
+    const response = await endpoint.handler(req as never)
+
+    expect(response.status).toBe(200)
+    expect(update).not.toHaveBeenCalled()
+  })
+})

package/src/__tests__/translations.test.ts

@@ -0,0 +1,67 @@
+import { readdirSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { getNestedValue, translations } from '../components/TicketConversation/hooks/useTranslation'
+
+function collectSourceFiles(directory: string): string[] {
+  return readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+    const path = join(directory, entry.name)
+
+    if (entry.isDirectory()) return collectSourceFiles(path)
+    return /\.(?:ts|tsx)$/.test(entry.name) ? [path] : []
+  })
+}
+
+function collectTranslationKeys(): string[] {
+  const keys = new Set<string>()
+  const sourceDirectories = [join(process.cwd(), 'src/components'), join(process.cwd(), 'src/views')]
+  const translationCall = /\b(?:t|tFn)\(\s*(['"`])([^'"`]+)\1/g
+
+  for (const file of sourceDirectories.flatMap(collectSourceFiles)) {
+    const source = readFileSync(file, 'utf8')
+
+    for (const match of source.matchAll(translationCall)) {
+      keys.add(match[2])
+    }
+  }
+
+  return [...keys].sort()
+}
+
+function flattenCatalog(value: Record<string, unknown>, prefix = ''): string[] {
+  return Object.entries(value).flatMap(([key, entry]) => {
+    const path = prefix ? `${prefix}.${key}` : key
+
+    if (entry != null && typeof entry === 'object' && !Array.isArray(entry)) {
+      return flattenCatalog(entry as Record<string, unknown>, path)
+    }
+
+    return [path]
+  })
+}
+
+describe('support translations', () => {
+  const usedKeys = collectTranslationKeys()
+
+  it.each(['fr', 'en'] as const)('defines every literal key used by support views in %s', (locale) => {
+    const catalogKeys = new Set(flattenCatalog(translations[locale]))
+    const missingKeys = usedKeys.filter((key) => !catalogKeys.has(key))
+
+    expect(missingKeys).toEqual([])
+  })
+
+  it('keeps the French and English catalogs aligned', () => {
+    expect(flattenCatalog(translations.fr).sort()).toEqual(flattenCatalog(translations.en).sort())
+  })
+
+  it.each([
+    'ticket.status.pending',
+    'inbox.timeAgo.now',
+    'detail.addTime',
+    'detail.addTagBtn',
+    'detail.billing.title',
+  ])('resolves the regression key %s', (key) => {
+    expect(getNestedValue(translations.fr, key)).not.toBe(key)
+    expect(getNestedValue(translations.en, key)).not.toBe(key)
+  })
+})

package/src/__tests__/webhookSecurity.test.ts

@@ -0,0 +1,58 @@
+import { describe, expect, it } from 'vitest'
+import {
+  DEFAULT_INBOUND_EMAIL_LIMITS,
+  validateInboundEmailPayload,
+  verifySecret,
+} from '../utils/webhookSecurity'
+import { createProcessDigestsEndpoint } from '../endpoints/process-digests'
+import { resolveSlugs } from '../utils/slugs'
+
+describe('verifySecret', () => {
+  it('accepts an exact secret and rejects missing, malformed or different values', () => {
+    expect(verifySecret('expected-secret', 'expected-secret')).toBe(true)
+    expect(verifySecret(undefined, 'expected-secret')).toBe(false)
+    expect(verifySecret('short', 'expected-secret')).toBe(false)
+    expect(verifySecret('different-secret', 'expected-secret')).toBe(false)
+  })
+})
+
+describe('cron endpoint authentication', () => {
+  it('rejects missing, forged and query-string secrets', async () => {
+    process.env.CRON_SECRET = 'expected-secret'
+    const endpoint = createProcessDigestsEndpoint(resolveSlugs())
+    for (const request of [
+      { headers: new Headers(), url: 'http://localhost/api/support/process-digests' },
+      { headers: new Headers({ 'x-cron-secret': 'forged' }), url: 'http://localhost/api/support/process-digests' },
+      { headers: new Headers(), url: 'http://localhost/api/support/process-digests?secret=expected-secret' },
+    ]) {
+      const response = await endpoint.handler(request as never)
+      expect(response.status).toBe(401)
+    }
+  })
+})
+
+describe('inbound email limits', () => {
+  const base = { senderEmail: 'client@example.com', subject: 'Help', body: 'Hello' }
+
+  it('rejects requests larger than 25 MiB', () => {
+    expect(validateInboundEmailPayload(base, DEFAULT_INBOUND_EMAIL_LIMITS.maxRequestBytes + 1))
+      .toEqual({ code: 'request_too_large', status: 413 })
+  })
+
+  it('rejects more than 10 attachments', () => {
+    const attachments = Array.from({ length: 11 }, (_, index) => ({ filename: `${index}.txt`, size: 1 }))
+    expect(validateInboundEmailPayload({ ...base, attachments }))
+      .toEqual({ code: 'too_many_attachments', status: 413 })
+  })
+
+  it('rejects an attachment larger than 10 MiB', () => {
+    const attachments = [{ filename: 'large.zip', size: DEFAULT_INBOUND_EMAIL_LIMITS.maxAttachmentBytes + 1 }]
+    expect(validateInboundEmailPayload({ ...base, attachments }))
+      .toEqual({ code: 'attachment_too_large', status: 413 })
+  })
+
+  it('rejects oversized text fields', () => {
+    expect(validateInboundEmailPayload({ ...base, subject: 'x'.repeat(1_001) }))
+      .toEqual({ code: 'text_field_too_large', status: 413 })
+  })
+})

package/src/collections/PendingEmails.ts

@@ -1,5 +1,6 @@
 import type { CollectionConfig } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
+import { verifySecret } from '../utils/webhookSecurity'
 
 // ─── Collection factory ──────────────────────────────────
 
@@ -20,7 +21,7 @@ export function createPendingEmailsCollection(slugs: CollectionSlugs): Collectio
         // Allow admin users or webhook calls with secret header
         if (req.user?.collection === slugs.users) return true
         const webhookSecret = req.headers.get('x-webhook-secret')
-        if (webhookSecret && process.env.SUPPORT_WEBHOOK_SECRET && webhookSecret === process.env.SUPPORT_WEBHOOK_SECRET) return true
+        if (verifySecret(webhookSecret, process.env.SUPPORT_WEBHOOK_SECRET)) return true
         return false
       },
     },