@consilioweb/payload-support 2.0.0 → 3.0.0

package/dist/views/shared/sla.d.ts

@@ -0,0 +1,14 @@
+export type SlaState = 'ok' | 'warn' | 'breach' | 'none' | 'met';
+export interface SlaInput {
+    slaFirstResponseDue?: string | null;
+    slaFirstResponseBreached?: boolean | null;
+    firstResponseAt?: string | null;
+    slaResolutionDue?: string | null;
+    slaResolutionBreached?: boolean | null;
+}
+export declare function computeSlaState(t: SlaInput, now?: Date): {
+    state: SlaState;
+    remainingMs: number | null;
+    due: string | null;
+};
+export declare function formatSlaRemaining(remainingMs: number | null): string;

package/dist/views.d.ts

@@ -1,13 +1,13 @@
-export { default as TicketInboxView } from './views/TicketInboxView/index';
-export { default as TicketDetailView } from './views/TicketDetailView/index';
-export { default as SupportDashboardView } from './views/SupportDashboardView/index';
-export { default as NewTicketView } from './views/NewTicketView/index';
-export { default as TicketingSettingsView } from './views/TicketingSettingsView/index';
-export { default as LogsView } from './views/LogsView/index';
-export { default as ChatView } from './views/ChatView/index';
-export { default as CrmView } from './views/CrmView/index';
-export { default as PendingEmailsView } from './views/PendingEmailsView/index';
-export { default as EmailTrackingView } from './views/EmailTrackingView/index';
-export { default as BillingView } from './views/BillingView/index';
-export { default as TimeDashboardView } from './views/TimeDashboardView/index';
-export { default as ImportConversationView } from './views/ImportConversationView/index';
+export { default as TicketInboxView } from './views/TicketInboxView/index.js';
+export { default as TicketDetailView } from './views/TicketDetailView/index.js';
+export { default as SupportDashboardView } from './views/SupportDashboardView/index.js';
+export { default as NewTicketView } from './views/NewTicketView/index.js';
+export { default as TicketingSettingsView } from './views/TicketingSettingsView/index.js';
+export { default as LogsView } from './views/LogsView/index.js';
+export { default as ChatView } from './views/ChatView/index.js';
+export { default as CrmView } from './views/CrmView/index.js';
+export { default as PendingEmailsView } from './views/PendingEmailsView/index.js';
+export { default as EmailTrackingView } from './views/EmailTrackingView/index.js';
+export { default as BillingView } from './views/BillingView/index.js';
+export { default as TimeDashboardView } from './views/TimeDashboardView/index.js';
+export { default as ImportConversationView } from './views/ImportConversationView/index.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consilioweb/payload-support",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "description": "Payload CMS plugin — professional support & ticketing system with AI, SLA, time tracking, live chat, and more",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -31,14 +31,11 @@
       "import": {
         "types": "./dist/views.d.ts",
         "default": "./dist/views.js"
-      },
-      "require": {
-        "types": "./dist/views.d.cts",
-        "default": "./dist/views.cjs"
       }
     },
     "./components/TicketConversation": {
       "import": {
+        "types": "./dist/components/TicketConversation/index.d.ts",
         "default": "./dist/components/TicketConversation/index.js"
       }
     }
@@ -46,18 +43,12 @@
   "files": [
     "dist",
     "src",
+    "!src/__tests__",
+    "!src/**/*.test.ts",
+    "!src/**/*.test.tsx",
     "README.md",
     "LICENSE"
   ],
-  "scripts": {
-    "build": "tsup",
-    "typecheck": "tsc --noEmit",
-    "prepublishOnly": "npm run build",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:e2e": "playwright test",
-    "test:e2e:ui": "playwright test --ui"
-  },
   "keywords": [
     "payload",
     "payload-cms",
@@ -94,43 +85,28 @@
   "author": "ConsilioWEB <contact@consilioweb.fr> (https://consilioweb.fr)",
   "license": "MIT",
   "peerDependencies": {
-    "@payloadcms/next": "^3.0.0",
-    "@payloadcms/translations": "^3.0.0",
-    "@payloadcms/ui": "^3.0.0",
+    "@payloadcms/next": "^3.37.0",
     "lucide-react": ">=0.300.0",
-    "next": "^14.0.0 || ^15.0.0 || ^16.0.0",
-    "payload": "^3.0.0",
-    "react": "^18.0.0 || ^19.0.0",
-    "react-dom": "^18.0.0 || ^19.0.0"
-  },
-  "peerDependenciesMeta": {
-    "@payloadcms/ui": {
-      "optional": true
-    },
-    "@payloadcms/translations": {
-      "optional": true
-    },
-    "@payloadcms/next": {
-      "optional": true
-    },
-    "lucide-react": {
-      "optional": true
-    },
-    "next": {
-      "optional": true
-    }
+    "next": "^15.2.9 || ^16.0.0",
+    "payload": "^3.37.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=20.9.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
   },
   "devDependencies": {
     "@payloadcms/db-sqlite": "^3.86.0",
-    "@playwright/test": "^1.49.0",
     "@payloadcms/graphql": "^3.86.0",
     "@payloadcms/next": "^3.86.0",
     "@payloadcms/richtext-lexical": "^3.86.0",
     "@payloadcms/translations": "^3.86.0",
     "@payloadcms/ui": "^3.86.0",
+    "@playwright/test": "^1.49.0",
     "@types/pdfkit": "^0.17.6",
     "@types/react": "^19.0.0",
     "@types/sanitize-html": "^2.16.1",
@@ -140,6 +116,7 @@
     "payload": "^3.86.0",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
+    "sharp": "0.34.5",
     "tsup": "^8.0.0",
     "typescript": "^5.5.0",
     "vitest": "^4.1.9"
@@ -148,5 +125,13 @@
     "pdfkit": "^0.19.1",
     "sanitize-html": "^2.17.5",
     "web-push": "^3.6.7"
+  },
+  "scripts": {
+    "build": "tsup && tsc -p tsconfig.types.json && node scripts/copy-subpath-types.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:e2e": "playwright test",
+    "test:e2e:ui": "playwright test --ui"
   }
-}
+}

package/src/collections/SupportClients.ts

@@ -91,12 +91,33 @@ function createEnforce2FA(slugs: CollectionSlugs): CollectionBeforeLoginHook {
   }
 }
 
+/**
+ * Field-level write guard for the commercial / security fields.
+ *
+ * `access.update` on this collection intentionally lets a support-client PATCH
+ * their OWN document (the portal profile page writes firstName, phone, the
+ * notification toggles and the 2FA switch). Payload persists every other field of
+ * that same PATCH too, so without a field guard a client could self-promote
+ * (`tier`), rewrite the sales notes, or — worst — set `googleId`, which the Google
+ * OAuth callback resolves BEFORE the email and would hand them another account.
+ *
+ * Internal writers (2FA endpoints, OAuth linking, beforeLogin) all go through
+ * `overrideAccess: true`, which bypasses field access, so they are unaffected.
+ * `twoFactorEnabled` is deliberately NOT locked: it is a legitimate self-service
+ * toggle on the portal profile page.
+ */
+function createAdminOnlyFieldUpdate(slugs: CollectionSlugs) {
+  return ({ req }: { req: { user?: { collection?: string } | null } }) =>
+    req.user?.collection === slugs.users
+}
+
 // ─── Collection factory ──────────────────────────────────
 
 export function createSupportClientsCollection(
   slugs: CollectionSlugs,
   options?: { capabilities?: SupportCapabilities },
 ): CollectionConfig {
+  const adminOnlyFieldUpdate = createAdminOnlyFieldUpdate(slugs)
   return {
     slug: slugs.supportClients,
     labels: {
@@ -226,6 +247,7 @@ export function createSupportClientsCollection(
         access: {
           // Admin-only: never serialize commercial notes onto the client's own doc.
           read: ({ req }) => req.user?.collection === slugs.users,
+          update: adminOnlyFieldUpdate,
         },
         admin: {
           description: 'Notes commerciales (visible uniquement par les admins)',
@@ -235,6 +257,7 @@ export function createSupportClientsCollection(
         name: 'tier',
         type: 'select',
         label: 'Plan',
+        access: { update: adminOnlyFieldUpdate },
         options: [
           { label: 'Free', value: 'free' },
           { label: 'Basic', value: 'basic' },
@@ -248,6 +271,7 @@ export function createSupportClientsCollection(
         type: 'relationship',
         relationTo: slugs.users,
         label: 'Agent referent',
+        access: { update: adminOnlyFieldUpdate },
         admin: { position: 'sidebar' },
       },
       {
@@ -263,17 +287,20 @@ export function createSupportClientsCollection(
       {
         name: 'twoFactorCode',
         type: 'text',
+        access: { update: adminOnlyFieldUpdate },
         admin: { hidden: true },
       },
       {
         name: 'twoFactorExpiry',
         type: 'date',
+        access: { update: adminOnlyFieldUpdate },
         admin: { hidden: true },
       },
       {
         // Set by /support/2fa "verify"; gates login via the beforeLogin hook.
         name: 'twoFactorVerifiedAt',
         type: 'date',
+        access: { update: adminOnlyFieldUpdate },
         admin: { hidden: true },
       },
       {
@@ -281,6 +308,7 @@ export function createSupportClientsCollection(
         name: 'googleId',
         type: 'text',
         index: true,
+        access: { update: adminOnlyFieldUpdate },
         admin: { hidden: true },
       },
       {
@@ -352,6 +380,7 @@ export function createSupportClientsCollection(
         access: {
           // Admin-only: never serialize internal notes onto the client's own doc.
           read: ({ req }) => req.user?.collection === slugs.users,
+          update: adminOnlyFieldUpdate,
         },
         admin: {
           description: 'Visible uniquement par les admins',

package/src/collections/TicketCollaborators.ts

@@ -32,7 +32,12 @@ export function createTicketCollaboratorsCollection(slugs: CollectionSlugs): Col
         }
         return false
       },
-      create: ({ req }) => !!req.user,
+      // Staff only. This collection is the source of truth for
+      // resolveAccessibleTicketIds(), which widens `read` on tickets, messages
+      // and the activity log — so letting any authenticated principal POST here
+      // let a support client grant themselves access to any ticket by id.
+      // The /invite endpoint is unaffected: it writes with overrideAccess: true.
+      create: ({ req }) => req.user?.collection === slugs.users,
       update: () => false,
       delete: ({ req }) => req.user?.collection === slugs.users,
     },

package/src/collections/TicketMessages.ts

@@ -1,8 +1,8 @@
 import type { CollectionConfig, CollectionBeforeChangeHook, CollectionAfterChangeHook, Where } from 'payload'
+import { APIError } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import type { SupportCapabilities } from '../types'
 import { escapeHtml, emailWrapper, emailButton, emailQuote, emailParagraph, emailRichContent, emailTrackingPixel } from '../utils/emailTemplate'
-import { fireWebhooks } from '../utils/fireWebhooks'
 import { createAdminNotification } from '../utils/adminNotification'
 import { dispatchWebhook } from '../utils/webhookDispatcher'
 import { readSupportSettings } from '../utils/readSettings'
@@ -13,6 +13,38 @@ import { queueClientNotification } from '../utils/notificationQueue'
 import { sendPushToUser } from '../utils/push'
 import { dbFind, dbCreate, dbFindByID } from '../utils/db'
 
+/**
+ * Cross-tenant write guard for support-clients.
+ *
+ * `access.create` only checks WHICH collection the actor belongs to, so any
+ * authenticated support-client could POST a message onto an arbitrary ticket id.
+ * That is not just a data-integrity issue: the `afterChange` notification hooks
+ * would then mail the injected body to the real ticket owner from the legitimate
+ * support address (phishing over a trusted channel).
+ *
+ * We reuse `resolveAccessibleTicketIds()` — the same boundary `access.read` uses —
+ * so read and write scopes cannot drift apart. Staff writes and every internal
+ * `overrideAccess` write are untouched: they carry no `support-clients` user.
+ */
+function createRestrictClientTicketTarget(slugs: CollectionSlugs): CollectionBeforeChangeHook {
+  return async ({ data, operation, req, originalDoc }) => {
+    if (req.user?.collection !== slugs.supportClients) return data
+
+    const raw = (data as { ticket?: unknown }).ticket
+      ?? (operation === 'update' ? (originalDoc as { ticket?: unknown } | undefined)?.ticket : undefined)
+    const targetId = raw && typeof raw === 'object' ? (raw as { id?: unknown }).id : raw
+    if (targetId === undefined || targetId === null || targetId === '') {
+      throw new APIError('Ticket cible requis.', 400)
+    }
+
+    const accessible = await resolveAccessibleTicketIds(req.payload, slugs, req.user.id)
+    if (!accessible.some((id) => String(id) === String(targetId))) {
+      throw new APIError('Ticket inaccessible.', 403)
+    }
+    return data
+  }
+}
+
 function createAssignAuthor(slugs: CollectionSlugs): CollectionBeforeChangeHook {
   return async ({ data, operation, req }) => {
     if (operation === 'create' && req.user?.collection === slugs.supportClients) {
@@ -300,26 +332,12 @@ function createNotifyAdminOnClientMessage(slugs: CollectionSlugs, notificationSl
   }
 }
 
-function createFireMessageWebhooks(slugs: CollectionSlugs): CollectionAfterChangeHook {
-  return async ({ doc, operation, req }) => {
-    if (operation !== 'create') return doc
-    // Don't fire for scheduled messages that haven't been sent yet
-    if (doc.scheduledAt && !doc.scheduledSent) return doc
-    // Don't fire for internal notes
-    if (doc.isInternal) return doc
-
-    const ticketId = typeof doc.ticket === 'object' ? doc.ticket.id : doc.ticket
-    fireWebhooks(req.payload, slugs, 'ticket_replied', {
-      ticketId,
-      messageId: doc.id,
-      authorType: doc.authorType,
-      body: doc.body?.length > 500 ? doc.body.slice(0, 500) + '...' : doc.body,
-    })
-
-    return doc
-  }
-}
-
+/**
+ * Single outbound-webhook dispatcher for replies. See the matching comment in
+ * Tickets.ts: a second, unsigned dispatcher used to fire on this exact hook with
+ * the same guards, doubling every delivery. The `body` excerpt of the legacy
+ * payload is carried over so existing consumers do not regress.
+ */
 function createDispatchWebhookOnReply(slugs: CollectionSlugs): CollectionAfterChangeHook {
   return async ({ doc, operation, req }) => {
     if (operation !== 'create') return doc
@@ -328,7 +346,12 @@ function createDispatchWebhookOnReply(slugs: CollectionSlugs): CollectionAfterCh
 
     const ticketId = typeof doc.ticket === 'object' ? doc.ticket.id : doc.ticket
     dispatchWebhook(
-      { ticketId, messageId: doc.id, authorType: doc.authorType },
+      {
+        ticketId,
+        messageId: doc.id,
+        authorType: doc.authorType,
+        body: doc.body?.length > 500 ? doc.body.slice(0, 500) + '...' : doc.body,
+      },
       'ticket_replied',
       req.payload,
       slugs,
@@ -534,7 +557,7 @@ export function createTicketMessagesCollection(slugs: CollectionSlugs, options?:
       ] : []),
     ],
     hooks: {
-      beforeChange: [createSanitizeMessageHtml(), createResolveMentions(slugs), createAssignAuthor(slugs)],
+      beforeChange: [createRestrictClientTicketTarget(slugs), createSanitizeMessageHtml(), createResolveMentions(slugs), createAssignAuthor(slugs)],
       afterChange: [
         ...(options?.capabilities?.sms ? [createSmsNotification(slugs, options.capabilities.sms)] : []),
         createAutoUpdateStatus(slugs),
@@ -543,7 +566,6 @@ export function createTicketMessagesCollection(slugs: CollectionSlugs, options?:
         createCheckSlaOnReply(slugs, notificationSlug),
         createSyncTicketReplyToChat(slugs),
         createNotifyAdminOnClientMessage(slugs, notificationSlug),
-        createFireMessageWebhooks(slugs),
         createDispatchWebhookOnReply(slugs),
         createNotifyMentions(slugs),
         ...(options?.capabilities?.threadCleanup ? [createThreadCleanup(options.capabilities.threadCleanup)] : []),

package/src/collections/Tickets.ts

@@ -3,13 +3,13 @@ import type {
   CollectionBeforeChangeHook,
   CollectionAfterChangeHook,
   CollectionBeforeDeleteHook,
+  CollectionBeforeValidateHook,
   Field,
   Where,
 } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import type { SupportCapabilities } from '../types'
 import { escapeHtml, emailWrapper, emailParagraph, emailButton } from '../utils/emailTemplate'
-import { fireWebhooks } from '../utils/fireWebhooks'
 import { createAdminNotification } from '../utils/adminNotification'
 import { dispatchWebhook } from '../utils/webhookDispatcher'
 import { readSupportSettings } from '../utils/readSettings'
@@ -96,13 +96,52 @@ function createAssignTicketNumber(
 
 function createAssignClientOnCreate(slugs: CollectionSlugs): CollectionBeforeChangeHook {
   return async ({ data, operation, req }) => {
-    if (operation === 'create' && req.user?.collection === slugs.supportClients && !data.client) {
+    // Unconditional, NOT `if (!data.client)`: a support-client posting an explicit
+    // `client` id would otherwise open a ticket in someone else's name.
+    if (operation === 'create' && req.user?.collection === slugs.supportClients) {
       data.client = req.user.id
     }
     return data
   }
 }
 
+/**
+ * Fields a support-client is allowed to submit when opening a ticket from the
+ * portal. Everything else (billing, SLA, assignment, counters, AI bookkeeping,
+ * `client`, `source`) is server-owned.
+ */
+const CLIENT_CREATABLE_TICKET_FIELDS = ['subject', 'category', 'priority', 'project'] as const
+
+/**
+ * Allow-list the payload of a client-initiated ticket creation.
+ *
+ * `access.create` grants any authenticated support-client the right to create a
+ * ticket, and Payload happily persists every field it is handed — including
+ * `paymentStatus: 'paid'`, `billable: false`, `assignedTo` or `slaPolicy`, all of
+ * which the billing endpoints read back as trusted input.
+ *
+ * Runs as `beforeValidate` so the later `beforeChange` hooks (ticket number
+ * allocation, round-robin assignment) can still set the server-owned fields they
+ * own. Update is already covered by `createRestrictClientUpdates`.
+ */
+function createRestrictClientCreate(slugs: CollectionSlugs): CollectionBeforeValidateHook {
+  return async ({ data, operation, req }) => {
+    if (operation !== 'create') return data
+    if (req.user?.collection !== slugs.supportClients) return data
+
+    const incoming = (data ?? {}) as Record<string, unknown>
+    const sanitized: Record<string, unknown> = {}
+    for (const field of CLIENT_CREATABLE_TICKET_FIELDS) {
+      if (incoming[field] !== undefined) sanitized[field] = incoming[field]
+    }
+    // Clients open tickets; they do not get to pick the initial workflow state.
+    sanitized.status = 'open'
+    sanitized.client = req.user.id
+    sanitized.source = 'portal'
+    return sanitized
+  }
+}
+
 const autoPaidAt: CollectionBeforeChangeHook = async ({ data, operation, originalDoc }) => {
   if (operation !== 'update') return data
   if (data.paymentStatus === 'paid' && originalDoc?.paymentStatus !== 'paid' && !data.paidAt) {
@@ -133,16 +172,10 @@ function createAutoAssignAdmin(slugs: CollectionSlugs): CollectionBeforeChangeHo
       const { payload } = req
       let roundRobinEnabled = false
       try {
-        const prefs = await payload.find({
-          collection: 'payload-preferences',
-          where: { key: { equals: 'support-round-robin' } },
-          limit: 1,
-          depth: 0,
-          overrideAccess: true,
-        })
-        if (prefs.docs.length > 0) {
-          roundRobinEnabled = (prefs.docs[0].value as { enabled?: boolean })?.enabled === true
-        }
+        // Single source of truth: the `features` block of the support settings,
+        // which also falls back to the legacy `support-round-robin` row.
+        const settings = await readSupportSettings(payload)
+        roundRobinEnabled = settings.features.roundRobin === true
       } catch (err) { console.warn('[support] Failed to read round-robin preferences:', err) }
 
       const admins = await payload.find({
@@ -384,62 +417,6 @@ function createNotifyClientOnResolve(slugs: CollectionSlugs): CollectionAfterCha
   }
 }
 
-function createFireTicketWebhooks(slugs: CollectionSlugs): CollectionAfterChangeHook {
-  return async ({ doc, previousDoc, operation, req }) => {
-    const { payload } = req
-
-    if (operation === 'create') {
-      // ticket_created
-      fireWebhooks(payload, slugs, 'ticket_created', {
-        id: doc.id,
-        ticketNumber: doc.ticketNumber,
-        subject: doc.subject,
-        status: doc.status,
-        priority: doc.priority,
-        category: doc.category,
-      })
-      return doc
-    }
-
-    if (operation === 'update' && previousDoc) {
-      // ticket_resolved
-      if (previousDoc.status !== doc.status && doc.status === 'resolved') {
-        fireWebhooks(payload, slugs, 'ticket_resolved', {
-          id: doc.id,
-          ticketNumber: doc.ticketNumber,
-          subject: doc.subject,
-          previousStatus: previousDoc.status,
-        })
-
-        // Invalidate client summary cache so it refreshes on next view
-        const clientId = typeof doc.client === 'object' ? doc.client?.id : doc.client
-        if (clientId) {
-          payload.update({
-            collection: 'client-summaries',
-            where: { client: { equals: clientId } },
-            data: { generatedAt: new Date(0).toISOString() }, // Force cache expiry
-            overrideAccess: true,
-          }).catch(() => { /* silent — collection might not exist yet */ })
-        }
-      }
-
-      // ticket_assigned
-      const oldAssigned = typeof previousDoc.assignedTo === 'object' ? previousDoc.assignedTo?.id : previousDoc.assignedTo
-      const newAssigned = typeof doc.assignedTo === 'object' ? doc.assignedTo?.id : doc.assignedTo
-      if (newAssigned && oldAssigned !== newAssigned) {
-        fireWebhooks(payload, slugs, 'ticket_assigned', {
-          id: doc.id,
-          ticketNumber: doc.ticketNumber,
-          subject: doc.subject,
-          assignedTo: newAssigned,
-        })
-      }
-    }
-
-    return doc
-  }
-}
-
 function createNotifyAdminOnNewTicket(slugs: CollectionSlugs, notificationSlug: string): CollectionAfterChangeHook {
   return async ({ doc, operation, req }) => {
     if (operation !== 'create') return doc
@@ -462,24 +439,82 @@ function createNotifyAdminOnNewTicket(slugs: CollectionSlugs, notificationSlug:
   }
 }
 
+/**
+ * Single outbound-webhook dispatcher for tickets.
+ *
+ * Until 2.x two dispatchers were registered side by side on these very hooks with
+ * identical guards, so every subscriber received TWO POSTs per event, with two
+ * incompatible body shapes and two auth schemes — the legacy one shipping the
+ * endpoint secret in clear in `X-Webhook-Secret`, which defeated the HMAC of the
+ * other. Only the HMAC path remains; its payloads absorb the legacy fields
+ * (`id`, `status`, `priority`, `category`, `previousStatus`, `assignedTo`) so
+ * consumers of either shape keep working.
+ */
 function createDispatchWebhookOnTicket(slugs: CollectionSlugs): CollectionAfterChangeHook {
   return async ({ doc, previousDoc, operation, req }) => {
+    const { payload } = req
+
     if (operation === 'create') {
       dispatchWebhook(
-        { ticketId: doc.id, ticketNumber: doc.ticketNumber, subject: doc.subject },
+        {
+          ticketId: doc.id,
+          id: doc.id,
+          ticketNumber: doc.ticketNumber,
+          subject: doc.subject,
+          status: doc.status,
+          priority: doc.priority,
+          category: doc.category,
+        },
         'ticket_created',
-        req.payload,
+        payload,
         slugs,
       )
+      return doc
     }
 
-    if (operation === 'update' && previousDoc?.status !== doc.status && doc.status === 'resolved') {
-      dispatchWebhook(
-        { ticketId: doc.id, ticketNumber: doc.ticketNumber, subject: doc.subject },
-        'ticket_resolved',
-        req.payload,
-        slugs,
-      )
+    if (operation === 'update' && previousDoc) {
+      if (previousDoc.status !== doc.status && doc.status === 'resolved') {
+        dispatchWebhook(
+          {
+            ticketId: doc.id,
+            id: doc.id,
+            ticketNumber: doc.ticketNumber,
+            subject: doc.subject,
+            previousStatus: previousDoc.status,
+          },
+          'ticket_resolved',
+          payload,
+          slugs,
+        )
+
+        // Invalidate client summary cache so it refreshes on next view
+        const clientId = typeof doc.client === 'object' ? doc.client?.id : doc.client
+        if (clientId) {
+          payload.update({
+            collection: 'client-summaries',
+            where: { client: { equals: clientId } },
+            data: { generatedAt: new Date(0).toISOString() }, // Force cache expiry
+            overrideAccess: true,
+          }).catch(() => { /* silent — collection might not exist yet */ })
+        }
+      }
+
+      const oldAssigned = typeof previousDoc.assignedTo === 'object' ? previousDoc.assignedTo?.id : previousDoc.assignedTo
+      const newAssigned = typeof doc.assignedTo === 'object' ? doc.assignedTo?.id : doc.assignedTo
+      if (newAssigned && oldAssigned !== newAssigned) {
+        dispatchWebhook(
+          {
+            ticketId: doc.id,
+            id: doc.id,
+            ticketNumber: doc.ticketNumber,
+            subject: doc.subject,
+            assignedTo: newAssigned,
+          },
+          'ticket_assigned',
+          payload,
+          slugs,
+        )
+      }
     }
 
     return doc
@@ -626,7 +661,10 @@ export function createTicketsCollection(slugs: CollectionSlugs, options?: {
             { label: 'Paiement partiel', value: 'partial' },
             { label: 'Payé', value: 'paid' },
           ],
-          access: { update: ({ req }) => req.user?.collection === 'users' },
+          // `slugs.users`, not the literal 'users': the users collection slug is
+          // configurable, and a hard-coded one silently opens this field to everybody
+          // on a host that renamed it.
+          access: { update: ({ req }) => req.user?.collection === slugs.users },
           admin: { width: '50%', condition: (data) => !!data?.invoice },
         },
         {
@@ -890,6 +928,7 @@ export function createTicketsCollection(slugs: CollectionSlugs, options?: {
       { name: 'totalTimeMinutes', type: 'number', defaultValue: 0, label: 'Temps total (minutes)', admin: { readOnly: true, position: 'sidebar' } },
     ],
     hooks: {
+      beforeValidate: [createRestrictClientCreate(slugs)],
       beforeChange: [
         createAssignTicketNumber(slugs, options?.ticketNumber),
         createAssignClientOnCreate(slugs),
@@ -910,7 +949,6 @@ export function createTicketsCollection(slugs: CollectionSlugs, options?: {
         createNotifyClientOnResolve(slugs),
         createTicketStatusEmail(slugs),
         createNotifyAdminOnNewTicket(slugs, notificationSlug),
-        createFireTicketWebhooks(slugs),
         createDispatchWebhookOnTicket(slugs),
         createApplyAutomationRules(slugs),
       ],