@consilioweb/payload-support 2.0.0 → 2.0.1

package/README.md

@@ -9,7 +9,7 @@
 [![MIT License](https://img.shields.io/badge/license-MIT-1f8a5b)](LICENSE)
 [![Node.js](https://img.shields.io/badge/node-18+-1f8a5b)](https://nodejs.org)
 [![Payload](https://img.shields.io/badge/payload-3.x-1f8a5b)](https://payloadcms.com)
-[![Tests](https://img.shields.io/badge/tests-102%20passing-1f8a5b)](src/__tests__)
+[![Tests](https://img.shields.io/badge/tests-132%20passing-1f8a5b)](src/__tests__)
 [![TypeScript](https://img.shields.io/badge/typescript-strict-1f8a5b)](https://www.typescriptlang.org)
 
 </div>
@@ -154,6 +154,8 @@ supportPlugin({ features: { chat: false, pendingEmails: false }, locale: 'en' })
 ```ts
 supportPlugin({
   features: { ai: true, sla: true, roundRobin: true, webhooks: true, snooze: true },
+  rateLimitStore: 'payload', // shared, persistent limits for multi-instance deployments
+  ticketNumber: { prefix: 'TK-', padding: 6 },
   ai: { provider: 'ollama', model: 'qwen2.5', baseUrl: process.env.OLLAMA_API_URL },
   email: { fromName: 'Support ACME', fromAddress: 'support@acme.com', replyTo: 'support@acme.com' },
   allowedEmailDomains: ['acme.com'],          // restrict OAuth auto-registration
@@ -163,6 +165,50 @@ supportPlugin({
 })
 ```
 
+### Deployment adapters
+
+Version 2 keeps provider-specific code in the host application while the plugin owns the
+generic support workflow. Optional capabilities include SMS, inbound email, digests, AI
+titles and summaries, detailed billing, volunteering, thread cleanup and project suggestions.
+
+```ts
+supportPlugin({
+  rateLimitStore: 'payload',
+  capabilities: {
+    sms: {
+      adapter: {
+        isConfigured: () => Boolean(process.env.SMS_PROVIDER_ACCOUNT),
+        send: async ({ message, to }) => mySmsProvider.send({ message, to }),
+      },
+    },
+    inboundEmail: {
+      secret: process.env.SUPPORT_WEBHOOK_SECRET,
+      secretHeader: 'x-webhook-secret',
+      handle: handleInboundSupportEmail,
+    },
+    detailedBilling: true,
+    volunteering: true,
+  },
+})
+```
+
+### Upgrading from 1.x
+
+Version 2.0 is a security and ownership release with intentional breaking changes:
+
+1. Generate an additive Payload migration for the new `support-counters` collection and,
+   when `rateLimitStore: 'payload'` is enabled, `support-rate-limits`. Run it before restart.
+2. Regenerate Payload types and the admin import map.
+3. Remove duplicated host routes and enable the plugin endpoints (`skipEndpoints: false`).
+4. Read portal authentication exclusively from the `HttpOnly` cookie. Login, OAuth and 2FA
+   responses no longer expose the JWT in JSON.
+5. Send cron and webhook secrets only through their configured headers. Query-string secrets
+   are rejected.
+6. Custom rate-limit stores must implement the asynchronous `RateLimitStore` interface.
+
+The process-local memory store remains the default for development and single-instance use.
+Use `rateLimitStore: 'payload'` or a shared custom store in production with multiple instances.
+
 ### Run the AI agent on a ticket
 
 ```ts
@@ -212,6 +258,9 @@ import type { SupportPluginConfig, SupportFeatures } from '@consilioweb/payload-
 | `features` | `SupportFeatures` | all `true` | Toggle each feature on/off. |
 | `ai` | `AIProviderConfig` | `anthropic` | AI provider: `anthropic` \| `openai` \| `ollama` \| `custom`. |
 | `email` | `EmailConfig` | — | `fromName`, `fromAddress`, `replyTo`. |
+| `rateLimitStore` | `RateLimitStore \| 'payload'` | memory | Persistent/shared storage for endpoint limits. |
+| `ticketNumber` | `{ prefix?, padding? }` | `TK-`, no padding | Atomic sequential ticket-number formatting. |
+| `capabilities` | `SupportCapabilities` | — | Optional host adapters for SMS, inbound email, AI and deployment-specific workflows. |
 | `locale` | `'fr' \| 'en'` | `'fr'` | Admin/portal language. |
 | `basePath` | `string` | `'/support'` | Admin views prefix. |
 | `userCollectionSlug` | `string` | `'users'` | Agents collection. |
@@ -333,7 +382,10 @@ Security is a first-class concern — several guardrails are validated by integr
 - **Cross-client isolation** — a client can never read another's tickets/messages (filtered by owned tickets).
 - **2FA** enforced server-side (`beforeLogin`); **OAuth** verifies the Google email.
 - **Sanitization** of message HTML server-side (stored-XSS protection).
-- **HMAC-signed** webhooks, signed tracking pixel, fail-closed secrets.
+- **HMAC-signed** webhooks and tracking pixels with constant-time verification and idempotent writes.
+- **Cookie-only JWTs** for portal authentication (`HttpOnly`, `Secure`, `SameSite=Lax`).
+- **Persistent rate limiting** for authentication, 2FA, chats, invitations, transfers and AI endpoints.
+- **Bounded inbound email** payloads and attachments; cron/webhook secrets are accepted in headers only.
 
 ### Reporting Security Issues
 
@@ -362,7 +414,7 @@ Contributions are very welcome!
 Run the checks before submitting:
 
 ```bash
-npm run typecheck && npm test && npm run build
+pnpm typecheck && pnpm test && pnpm build
 ```
 
 <img src="https://raw.githubusercontent.com/andreasbm/readme/master/assets/lines/rainbow.png" width="100%" alt="" />
@@ -371,6 +423,21 @@ npm run typecheck && npm test && npm run build
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 
+### [2.0.1] — 2026-07-16
+
+- 🌍 Loads the complete shared FR/EN catalogs in every support admin view, fixing raw keys such as ticket statuses, relative dates, time tracking, tags and billing labels.
+- 🧭 Removes translation-key collisions in the support dashboard and settings views.
+- ✅ Adds regression coverage for all 518 literal translation keys used by the support UI and keeps both locales aligned (132 tests passing).
+
+### [2.0.0] — 2026-07-16
+
+- 🔐 Security hardening for authentication, tracking pixels, webhook/cron secrets, HTML/AI output and inbound-email limits.
+- 🚦 Asynchronous persistent rate limiting with a Payload-backed store and memory fallback.
+- 🔢 Atomic persistent ticket counters with configurable prefix and padding.
+- 🧩 Typed deployment adapters for SMS, inbound email, AI workflows, billing, volunteering, cleanup and project suggestions.
+- 🏗️ The plugin is now the single owner of generic support collections, hooks, views and endpoints.
+- ✅ 124 tests covering the security regressions and new capabilities.
+
 ### [1.1.1] — 2026-06-26
 
 - 🐛 **Fix client ticket reopen**: allow clients to set `waiting_support` (the status the portal's "Reopen" button sends). It was silently rejected, leaving the ticket `resolved`.

package/dist/components/TicketConversation/hooks/useTranslation.cjs

@@ -3,17 +3,38 @@
 var react = require('react');
 var frTranslations = require('../locales/fr.json');
 var enTranslations = require('../locales/en.json');
+var frViewTranslations = require('../../../views/shared/locales/fr.json');
+var enViewTranslations = require('../../../views/shared/locales/en.json');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var frTranslations__default = /*#__PURE__*/_interopDefault(frTranslations);
 var enTranslations__default = /*#__PURE__*/_interopDefault(enTranslations);
+var frViewTranslations__default = /*#__PURE__*/_interopDefault(frViewTranslations);
+var enViewTranslations__default = /*#__PURE__*/_interopDefault(enViewTranslations);
 
 const LOCALE_STORAGE_KEY = "support_locale";
 const DEFAULT_LOCALE = "fr";
+function mergeTranslations(base, supplement) {
+  const merged = { ...base };
+  for (const [key, value] of Object.entries(supplement)) {
+    const current = merged[key];
+    if (current != null && value != null && typeof current === "object" && typeof value === "object" && !Array.isArray(current) && !Array.isArray(value)) {
+      merged[key] = mergeTranslations(
+        current,
+        value
+      );
+      continue;
+    }
+    if (current === void 0 || typeof current !== "object" && typeof value === "object") {
+      merged[key] = value;
+    }
+  }
+  return merged;
+}
 const translations = {
-  fr: frTranslations__default.default,
-  en: enTranslations__default.default
+  fr: mergeTranslations(frTranslations__default.default, frViewTranslations__default.default),
+  en: mergeTranslations(enTranslations__default.default, enViewTranslations__default.default)
 };
 function getNestedValue(obj, path) {
   const keys = path.split(".");
@@ -75,4 +96,6 @@ function useTranslation() {
 
 exports.DEFAULT_LOCALE = DEFAULT_LOCALE;
 exports.LOCALE_STORAGE_KEY = LOCALE_STORAGE_KEY;
+exports.getNestedValue = getNestedValue;
+exports.translations = translations;
 exports.useTranslation = useTranslation;

package/dist/components/TicketConversation/hooks/useTranslation.js

@@ -2,12 +2,31 @@
 import { useState, useEffect, useCallback } from 'react';
 import frTranslations from '../locales/fr.json';
 import enTranslations from '../locales/en.json';
+import frViewTranslations from '../../../views/shared/locales/fr.json';
+import enViewTranslations from '../../../views/shared/locales/en.json';
 
 const LOCALE_STORAGE_KEY = "support_locale";
 const DEFAULT_LOCALE = "fr";
+function mergeTranslations(base, supplement) {
+  const merged = { ...base };
+  for (const [key, value] of Object.entries(supplement)) {
+    const current = merged[key];
+    if (current != null && value != null && typeof current === "object" && typeof value === "object" && !Array.isArray(current) && !Array.isArray(value)) {
+      merged[key] = mergeTranslations(
+        current,
+        value
+      );
+      continue;
+    }
+    if (current === void 0 || typeof current !== "object" && typeof value === "object") {
+      merged[key] = value;
+    }
+  }
+  return merged;
+}
 const translations = {
-  fr: frTranslations,
-  en: enTranslations
+  fr: mergeTranslations(frTranslations, frViewTranslations),
+  en: mergeTranslations(enTranslations, enViewTranslations)
 };
 function getNestedValue(obj, path) {
   const keys = path.split(".");
@@ -67,4 +86,4 @@ function useTranslation() {
   return { t, locale, setLocale };
 }
 
-export { DEFAULT_LOCALE, LOCALE_STORAGE_KEY, useTranslation };
+export { DEFAULT_LOCALE, LOCALE_STORAGE_KEY, getNestedValue, translations, useTranslation };

package/dist/views/SupportDashboardView/client.cjs

@@ -406,7 +406,7 @@ const SupportDashboardClient = () => {
           /* @__PURE__ */ jsxRuntime.jsx(VolumeChart, { data: volumeData })
         ] }),
         /* @__PURE__ */ jsxRuntime.jsxs("div", { className: styles__default.default.panel, children: [
-          /* @__PURE__ */ jsxRuntime.jsx("h2", { className: styles__default.default.panelTitle, children: t("dashboard.csat") }),
+          /* @__PURE__ */ jsxRuntime.jsx("h2", { className: styles__default.default.panelTitle, children: t("dashboard.csatTitle") }),
           /* @__PURE__ */ jsxRuntime.jsx(CSATRing, { score: stats.satisfactionAvg, count: stats.satisfactionCount })
         ] })
       ] })

package/dist/views/SupportDashboardView/client.js

@@ -400,7 +400,7 @@ const SupportDashboardClient = () => {
           /* @__PURE__ */ jsx(VolumeChart, { data: volumeData })
         ] }),
         /* @__PURE__ */ jsxs("div", { className: styles.panel, children: [
-          /* @__PURE__ */ jsx("h2", { className: styles.panelTitle, children: t("dashboard.csat") }),
+          /* @__PURE__ */ jsx("h2", { className: styles.panelTitle, children: t("dashboard.csatTitle") }),
           /* @__PURE__ */ jsx(CSATRing, { score: stats.satisfactionAvg, count: stats.satisfactionCount })
         ] })
       ] })

package/dist/views/TicketingSettingsView/client.cjs

@@ -305,7 +305,7 @@ const TicketingSettingsClient = () => {
     /* @__PURE__ */ jsxRuntime.jsxs(
       CollapsibleSection,
       {
-        title: t("settingsView.features"),
+        title: t("settingsView.featuresTitle"),
         icon: /* @__PURE__ */ jsxRuntime.jsx(lucideReact.Settings, { size: 16 }),
         color: adminTokens.V.blue,
         badge: /* @__PURE__ */ jsxRuntime.jsxs("span", { className: ts__default.default.badge, style: { backgroundColor: "#dbeafe", color: "#1e40af" }, children: [

package/dist/views/TicketingSettingsView/client.js

@@ -299,7 +299,7 @@ const TicketingSettingsClient = () => {
     /* @__PURE__ */ jsxs(
       CollapsibleSection,
       {
-        title: t("settingsView.features"),
+        title: t("settingsView.featuresTitle"),
         icon: /* @__PURE__ */ jsx(Settings, { size: 16 }),
         color: V.blue,
         badge: /* @__PURE__ */ jsxs("span", { className: ts.badge, style: { backgroundColor: "#dbeafe", color: "#1e40af" }, children: [