@consilioweb/payload-support 2.0.0 → 3.0.0

package/dist/index.js

@@ -368,14 +368,81 @@ function dbDelete(payload, slug, options) {
   return payload.delete({ collection: slug, ...options });
 }
 
+// src/utils/features.ts
+var DEFAULT_TICKETING_FEATURES = {
+  timeTracking: true,
+  ai: true,
+  satisfaction: true,
+  chat: true,
+  emailTracking: true,
+  canned: true,
+  merge: true,
+  snooze: true,
+  externalMessages: true,
+  clientHistory: true,
+  activityLog: true,
+  splitTicket: true,
+  scheduledReplies: true,
+  autoClose: true,
+  autoCloseDays: 7,
+  roundRobin: false
+};
+var BOOLEAN_FEATURE_KEYS = [
+  "timeTracking",
+  "ai",
+  "satisfaction",
+  "chat",
+  "emailTracking",
+  "canned",
+  "merge",
+  "snooze",
+  "externalMessages",
+  "clientHistory",
+  "activityLog",
+  "splitTicket",
+  "scheduledReplies",
+  "autoClose",
+  "roundRobin"
+];
+var PROJECTED_FEATURE_KEYS = ["autoClose", "autoCloseDays"];
+function normalizeFeatures(raw) {
+  const out = { ...DEFAULT_TICKETING_FEATURES };
+  if (!raw || typeof raw !== "object") return out;
+  const src = raw;
+  for (const key of BOOLEAN_FEATURE_KEYS) {
+    if (typeof src[key] === "boolean") out[key] = src[key];
+  }
+  const days = src.autoCloseDays;
+  if (typeof days === "number" && Number.isFinite(days) && days >= 1) {
+    out.autoCloseDays = Math.floor(days);
+  }
+  return out;
+}
+function projectAutoClose(features, autoClose) {
+  if (!autoClose) return features;
+  return {
+    ...features,
+    autoClose: typeof autoClose.enabled === "boolean" ? autoClose.enabled : features.autoClose,
+    autoCloseDays: typeof autoClose.daysBeforeClose === "number" && autoClose.daysBeforeClose >= 1 ? Math.floor(autoClose.daysBeforeClose) : features.autoCloseDays
+  };
+}
+function stripProjectedFeatures(features) {
+  const out = { ...features };
+  for (const key of PROJECTED_FEATURE_KEYS) delete out[key];
+  return out;
+}
+
 // src/utils/readSettings.ts
-var PREF_KEY = "support-settings";
+var SUPPORT_SETTINGS_PREF_KEY = "support-settings";
+var PREF_KEY = SUPPORT_SETTINGS_PREF_KEY;
 var USER_PREFS_KEY_PREFIX = "support-user-prefs";
+var LEGACY_ROUND_ROBIN_KEY = "support-round-robin";
 var DEFAULT_SETTINGS = {
   email: { fromAddress: "", fromName: "Support", replyToAddress: "" },
   ai: { provider: "anthropic", model: "claude-haiku-4-5-20251001", enableSentiment: true, enableSynthesis: true, enableSuggestion: true, enableRewrite: true },
   sla: { firstResponseMinutes: 120, resolutionMinutes: 1440, businessHoursOnly: true, escalationEmail: "" },
-  autoClose: { enabled: true, daysBeforeClose: 7, reminderDaysBefore: 2 }
+  autoClose: { enabled: true, daysBeforeClose: 7, reminderDaysBefore: 2 },
+  features: { ...DEFAULT_TICKETING_FEATURES }
 };
 var DEFAULT_USER_PREFS = {
   locale: "fr",
@@ -386,32 +453,71 @@ var SETTINGS_TTL_MS = 6e4;
 function invalidateSupportSettingsCache() {
   settingsCache = null;
 }
-async function readSupportSettings(payload) {
+function mergeSupportSettings(stored, base = DEFAULT_SETTINGS) {
+  const autoClose = { ...base.autoClose, ...stored?.autoClose };
+  return {
+    email: { ...base.email, ...stored?.email },
+    ai: { ...base.ai, ...stored?.ai },
+    sla: { ...base.sla, ...stored?.sla },
+    autoClose,
+    // `autoClose` / `autoCloseDays` are projections of the block above, so they
+    // are recomputed here rather than trusted from whatever was persisted.
+    features: projectAutoClose(
+      normalizeFeatures({ ...base.features, ...stored?.features }),
+      autoClose
+    )
+  };
+}
+async function readSupportSettingsState(payload) {
   if (settingsCache && Date.now() - settingsCache.ts < SETTINGS_TTL_MS) {
     return settingsCache.value;
   }
-  let value = { ...DEFAULT_SETTINGS };
+  let value = {
+    settings: mergeSupportSettings(null),
+    featuresConfigured: false
+  };
   try {
     const prefs = await dbFind(payload, "payload-preferences", {
       where: { key: { equals: PREF_KEY } },
+      // The upsert is scoped per admin user, so several rows can share the key.
+      // Sorting makes "last write wins" deterministic instead of arbitrary.
+      sort: "-updatedAt",
       limit: 1,
       depth: 0,
       overrideAccess: true
     });
     if (prefs.docs.length > 0) {
       const stored = prefs.docs[0].value;
-      value = {
-        email: { ...DEFAULT_SETTINGS.email, ...stored.email },
-        ai: { ...DEFAULT_SETTINGS.ai, ...stored.ai },
-        sla: { ...DEFAULT_SETTINGS.sla, ...stored.sla },
-        autoClose: { ...DEFAULT_SETTINGS.autoClose, ...stored.autoClose }
-      };
+      const featuresConfigured = !!stored.features && typeof stored.features === "object";
+      const settings = mergeSupportSettings(stored);
+      if (!featuresConfigured) {
+        settings.features.roundRobin = await readLegacyRoundRobin(payload);
+      }
+      value = { settings, featuresConfigured };
     }
   } catch {
   }
   settingsCache = { value, ts: Date.now() };
   return value;
 }
+async function readSupportSettings(payload) {
+  return (await readSupportSettingsState(payload)).settings;
+}
+async function readLegacyRoundRobin(payload) {
+  try {
+    const prefs = await dbFind(payload, "payload-preferences", {
+      where: { key: { equals: LEGACY_ROUND_ROBIN_KEY } },
+      limit: 1,
+      depth: 0,
+      overrideAccess: true
+    });
+    if (prefs.docs.length > 0) {
+      return prefs.docs[0].value?.enabled === true;
+    }
+  } catch {
+  }
+  return DEFAULT_TICKETING_FEATURES.roundRobin;
+}
 async function readUserPrefs(payload, userId) {
   try {
     const key = `${USER_PREFS_KEY_PREFIX}-${userId}`;
@@ -432,13 +538,20 @@ async function readUserPrefs(payload, userId) {
   }
   return { ...DEFAULT_USER_PREFS };
 }
+function resolveOllamaBaseUrl() {
+  const baseURL = process.env.OLLAMA_API_URL;
+  if (!baseURL) {
+    throw new APIError("provider 'ollama' requires OLLAMA_API_URL", 500);
+  }
+  return baseURL;
+}
 
 // src/endpoints/ai.ts
 async function getClient(aiSettings) {
   const moduleName = "@anthropic-ai/sdk";
   const { default: Anthropic } = await import(moduleName);
   if (aiSettings.provider === "ollama") {
-    const baseURL = process.env.OLLAMA_API_URL || "https://ollama.orkelis.app/v1";
+    const baseURL = resolveOllamaBaseUrl();
     return new Anthropic({ apiKey: "ollama", baseURL });
   }
   return new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
@@ -637,7 +750,7 @@ async function applyAgentDecision(payload, slugs, ticketId, decision) {
 function getClient2(aiSettings) {
   const Anthropic = __require("@anthropic-ai/sdk").default;
   if (aiSettings.provider === "ollama") {
-    return new Anthropic({ apiKey: "ollama", baseURL: process.env.OLLAMA_API_URL || "https://ollama.orkelis.app/v1" });
+    return new Anthropic({ apiKey: "ollama", baseURL: resolveOllamaBaseUrl() });
   }
   return new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
 }
@@ -737,7 +850,7 @@ async function getClient3(aiSettings) {
   const moduleName = "@anthropic-ai/sdk";
   const { default: Anthropic } = await import(moduleName);
   if (aiSettings.provider === "ollama") {
-    const baseURL = process.env.OLLAMA_API_URL || "https://ollama.orkelis.app/v1";
+    const baseURL = resolveOllamaBaseUrl();
     return new Anthropic({ apiKey: "ollama", baseURL });
   }
   return new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
@@ -1573,25 +1686,6 @@ function createPresenceGetEndpoint(slugs) {
 }
 
 // src/endpoints/settings.ts
-var PREF_KEY2 = "support-settings";
-var DEFAULT_SUPPORT_SETTINGS = {
-  email: { fromAddress: "", fromName: "Support", replyToAddress: "" },
-  ai: {
-    provider: "anthropic",
-    model: "claude-haiku-4-5-20251001",
-    enableSentiment: true,
-    enableSynthesis: true,
-    enableSuggestion: true,
-    enableRewrite: true
-  },
-  sla: {
-    firstResponseMinutes: 120,
-    resolutionMinutes: 1440,
-    businessHoursOnly: true,
-    escalationEmail: ""
-  },
-  autoClose: { enabled: true, daysBeforeClose: 7, reminderDaysBefore: 2 }
-};
 function createSettingsGetEndpoint(slugs) {
   return {
     path: "/support/settings",
@@ -1600,23 +1694,8 @@ function createSettingsGetEndpoint(slugs) {
       try {
         const payload = req.payload;
         requireAdmin(req, slugs);
-        const prefs = await dbFind(payload, "payload-preferences", {
-          where: { key: { equals: PREF_KEY2 } },
-          limit: 1,
-          depth: 0,
-          overrideAccess: true
-        });
-        let settings = { ...DEFAULT_SUPPORT_SETTINGS };
-        if (prefs.docs.length > 0) {
-          const stored = prefs.docs[0].value;
-          settings = {
-            email: { ...DEFAULT_SUPPORT_SETTINGS.email, ...stored.email },
-            ai: { ...DEFAULT_SUPPORT_SETTINGS.ai, ...stored.ai },
-            sla: { ...DEFAULT_SUPPORT_SETTINGS.sla, ...stored.sla },
-            autoClose: { ...DEFAULT_SUPPORT_SETTINGS.autoClose, ...stored.autoClose }
-          };
-        }
-        return Response.json(settings);
+        const { settings, featuresConfigured } = await readSupportSettingsState(payload);
+        return Response.json({ ...settings, featuresConfigured });
       } catch (error) {
         const authResponse = handleAuthError(error);
         if (authResponse) return authResponse;
@@ -1635,30 +1714,31 @@ function createSettingsPostEndpoint(slugs) {
         const payload = req.payload;
         requireAdmin(req, slugs);
         const body = await req.json();
-        const merged = {
-          email: { ...DEFAULT_SUPPORT_SETTINGS.email, ...body.email },
-          ai: { ...DEFAULT_SUPPORT_SETTINGS.ai, ...body.ai },
-          sla: { ...DEFAULT_SUPPORT_SETTINGS.sla, ...body.sla },
-          autoClose: { ...DEFAULT_SUPPORT_SETTINGS.autoClose, ...body.autoClose }
-        };
+        const { settings: current } = await readSupportSettingsState(payload);
+        const merged = mergeSupportSettings(body, current);
         await payload.db.upsert({
           collection: "payload-preferences",
           data: {
-            key: PREF_KEY2,
+            key: SUPPORT_SETTINGS_PREF_KEY,
             user: { relationTo: req.user.collection, value: req.user.id },
-            value: merged
+            value: {
+              ...merged,
+              // Persist the flags without the two projected ones, so `features`
+              // and the `autoClose` block can never drift apart.
+              features: stripProjectedFeatures(merged.features)
+            }
           },
           req: { payload, user: req.user },
           where: {
             and: [
-              { key: { equals: PREF_KEY2 } },
+              { key: { equals: SUPPORT_SETTINGS_PREF_KEY } },
               { "user.value": { equals: req.user.id } },
               { "user.relationTo": { equals: req.user.collection } }
             ]
           }
         });
         invalidateSupportSettingsCache();
-        return Response.json(merged);
+        return Response.json({ ...merged, featuresConfigured: true });
       } catch (error) {
         const authResponse = handleAuthError(error);
         if (authResponse) return authResponse;
@@ -1670,7 +1750,7 @@ function createSettingsPostEndpoint(slugs) {
 }
 
 // src/endpoints/signature.ts
-var PREF_KEY3 = "email-signature";
+var PREF_KEY2 = "email-signature";
 function createSignatureGetEndpoint(slugs) {
   return {
     path: "/support/signature",
@@ -1680,7 +1760,7 @@ function createSignatureGetEndpoint(slugs) {
         const payload = req.payload;
         requireAdmin(req, slugs);
         const prefs = await dbFind(payload, "payload-preferences", {
-          where: { key: { equals: `${PREF_KEY3}-${req.user.id}` } },
+          where: { key: { equals: `${PREF_KEY2}-${req.user.id}` } },
           limit: 1,
           depth: 0,
           overrideAccess: true
@@ -1705,7 +1785,7 @@ function createSignaturePostEndpoint(slugs) {
         const payload = req.payload;
         requireAdmin(req, slugs);
         const { signature } = await req.json();
-        const key = `${PREF_KEY3}-${req.user.id}`;
+        const key = `${PREF_KEY2}-${req.user.id}`;
         const existing = await dbFind(payload, "payload-preferences", {
           where: { key: { equals: key } },
           limit: 1,
@@ -1740,7 +1820,6 @@ function createSignaturePostEndpoint(slugs) {
 }
 
 // src/endpoints/round-robin-config.ts
-var PREF_KEY4 = "support-round-robin";
 function createRoundRobinConfigGetEndpoint(slugs) {
   return {
     path: "/support/round-robin-config",
@@ -1749,14 +1828,8 @@ function createRoundRobinConfigGetEndpoint(slugs) {
       try {
         const payload = req.payload;
         requireAdmin(req, slugs);
-        const prefs = await dbFind(payload, "payload-preferences", {
-          where: { key: { equals: PREF_KEY4 } },
-          limit: 1,
-          depth: 0,
-          overrideAccess: true
-        });
-        const enabled = prefs.docs.length > 0 ? prefs.docs[0].value?.enabled === true : false;
-        return Response.json({ enabled });
+        const { settings } = await readSupportSettingsState(payload);
+        return Response.json({ enabled: settings.features.roundRobin });
       } catch (error) {
         const authResponse = handleAuthError(error);
         if (authResponse) return authResponse;
@@ -1775,28 +1848,31 @@ function createRoundRobinConfigPostEndpoint(slugs) {
         const payload = req.payload;
         requireAdmin(req, slugs);
         const { enabled } = await req.json();
-        const existing = await dbFind(payload, "payload-preferences", {
-          where: { key: { equals: PREF_KEY4 } },
-          limit: 1,
-          depth: 0,
-          overrideAccess: true
-        });
+        const { settings: current } = await readSupportSettingsState(payload);
+        const merged = mergeSupportSettings(
+          { features: { ...current.features, roundRobin: !!enabled } },
+          current
+        );
         await payload.db.upsert({
           collection: "payload-preferences",
           data: {
-            key: PREF_KEY4,
+            key: SUPPORT_SETTINGS_PREF_KEY,
             user: { relationTo: req.user.collection, value: req.user.id },
-            value: { enabled: !!enabled }
+            value: {
+              ...merged,
+              features: stripProjectedFeatures(merged.features)
+            }
           },
           req: { payload, user: req.user },
           where: {
             and: [
-              { key: { equals: PREF_KEY4 } },
+              { key: { equals: SUPPORT_SETTINGS_PREF_KEY } },
               { "user.value": { equals: req.user.id } },
               { "user.relationTo": { equals: req.user.collection } }
             ]
           }
         });
+        invalidateSupportSettingsCache();
         return Response.json({ enabled: !!enabled });
       } catch (error) {
         const authResponse = handleAuthError(error);
@@ -4058,7 +4134,7 @@ function createInvoiceEndpoint(slugs) {
 function getClient4(aiSettings) {
   const Anthropic = __require("@anthropic-ai/sdk").default;
   if (aiSettings.provider === "ollama") {
-    const baseURL = process.env.OLLAMA_API_URL || "https://ollama.orkelis.app/v1";
+    const baseURL = resolveOllamaBaseUrl();
     return new Anthropic({ apiKey: "ollama", baseURL });
   }
   return new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
@@ -5751,62 +5827,73 @@ function createImportConversationEndpoint(slugs, store) {
     }
   };
 }
-
-// src/utils/fireWebhooks.ts
-async function fireWebhooks(payload, slugs, event, data) {
+function dispatchWebhook(data, event, payload, slugs) {
+  const done = _dispatch(data, event, payload, slugs);
+  return done;
+}
+async function _dispatch(data, event, payload, slugs) {
   try {
-    const endpoints = await dbFind(payload, slugs.webhookEndpoints, {
+    const { docs: endpoints } = await dbFind(payload, slugs.webhookEndpoints, {
       where: {
-        active: { equals: true },
-        events: { contains: event }
+        and: [
+          { active: { equals: true } },
+          { events: { contains: event } }
+        ]
       },
       limit: 50,
       depth: 0,
       overrideAccess: true
     });
-    if (endpoints.docs.length === 0) return;
-    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    if (endpoints.length === 0) return;
+    const body = JSON.stringify({ event, data, timestamp: (/* @__PURE__ */ new Date()).toISOString() });
     await Promise.allSettled(
-      endpoints.docs.map(async (endpoint) => {
-        try {
-          const res = await fetch(endpoint.url, {
-            method: "POST",
-            headers: {
-              "Content-Type": "application/json",
-              ...endpoint.secret ? { "X-Webhook-Secret": endpoint.secret } : {}
-            },
-            body: JSON.stringify({ event, data, timestamp }),
-            signal: AbortSignal.timeout(1e4)
-          });
-          try {
-            await dbUpdate(payload, slugs.webhookEndpoints, {
-              id: endpoint.id,
-              data: {
-                lastTriggeredAt: timestamp,
-                lastStatus: res.status
-              },
-              overrideAccess: true
-            });
-          } catch {
-          }
-        } catch (error) {
-          console.warn(`[support] Webhook delivery failed: ${endpoint.url}`, error);
-          try {
-            await dbUpdate(payload, slugs.webhookEndpoints, {
-              id: endpoint.id,
-              data: {
-                lastTriggeredAt: timestamp,
-                lastStatus: 0
-              },
-              overrideAccess: true
-            });
-          } catch {
-          }
-        }
-      })
+      endpoints.map((endpoint) => _sendToEndpoint(endpoint, body, payload, slugs))
     );
-  } catch (error) {
-    console.error("[support] Failed to fire webhooks:", error);
+  } catch (err) {
+    console.error(`[webhook] Failed to fetch endpoints for event ${event}:`, err);
+  }
+}
+async function _sendToEndpoint(endpoint, body, payload, slugs) {
+  try {
+    const headers = {
+      "Content-Type": "application/json",
+      "User-Agent": "PayloadSupport-Webhook/1.0"
+    };
+    if (endpoint.secret) {
+      const signature = crypto3.createHmac("sha256", endpoint.secret).update(body).digest("hex");
+      headers["X-Webhook-Signature"] = signature;
+    }
+    const response = await fetch(endpoint.url, {
+      method: "POST",
+      headers,
+      body,
+      signal: AbortSignal.timeout(1e4)
+      // 10s timeout
+    });
+    await dbUpdate(payload, slugs.webhookEndpoints, {
+      id: endpoint.id,
+      data: {
+        lastTriggeredAt: (/* @__PURE__ */ new Date()).toISOString(),
+        lastStatus: response.status
+      },
+      overrideAccess: true
+    });
+    if (!response.ok) {
+      console.warn(`[webhook] ${endpoint.name || endpoint.url} returned ${response.status}`);
+    }
+  } catch (err) {
+    console.error(`[webhook] Failed to call ${endpoint.name || endpoint.url}:`, err);
+    try {
+      await dbUpdate(payload, slugs.webhookEndpoints, {
+        id: endpoint.id,
+        data: {
+          lastTriggeredAt: (/* @__PURE__ */ new Date()).toISOString(),
+          lastStatus: 0
+        },
+        overrideAccess: true
+      });
+    } catch {
+    }
   }
 }
 
@@ -5893,13 +5980,18 @@ function createProcessScheduledEndpoint(slugs) {
                 overrideAccess: true
               });
             }
-            fireWebhooks(payload, slugs, "ticket_replied", {
-              ticketId,
-              messageId: msg.id,
-              authorType: msg.authorType,
-              scheduled: true,
-              body: msg.body?.length > 500 ? msg.body.slice(0, 500) + "..." : msg.body
-            });
+            dispatchWebhook(
+              {
+                ticketId,
+                messageId: msg.id,
+                authorType: msg.authorType,
+                scheduled: true,
+                body: msg.body?.length > 500 ? msg.body.slice(0, 500) + "..." : msg.body
+              },
+              "ticket_replied",
+              payload,
+              slugs
+            );
             results.processed++;
           } catch (err) {
             console.error(`[process-scheduled] Error processing message ${message.id}:`, err);
@@ -6869,74 +6961,6 @@ async function createAdminNotification(payload, data, collectionSlug = "admin-no
     console.error("[notification] Failed to create:", err);
   }
 }
-function dispatchWebhook(data, event, payload, slugs) {
-  void _dispatch(data, event, payload, slugs);
-}
-async function _dispatch(data, event, payload, slugs) {
-  try {
-    const { docs: endpoints } = await dbFind(payload, slugs.webhookEndpoints, {
-      where: {
-        and: [
-          { active: { equals: true } },
-          { events: { contains: event } }
-        ]
-      },
-      limit: 50,
-      depth: 0,
-      overrideAccess: true
-    });
-    if (endpoints.length === 0) return;
-    const body = JSON.stringify({ event, data, timestamp: (/* @__PURE__ */ new Date()).toISOString() });
-    for (const endpoint of endpoints) {
-      void _sendToEndpoint(endpoint, body, payload, slugs);
-    }
-  } catch (err) {
-    console.error(`[webhook] Failed to fetch endpoints for event ${event}:`, err);
-  }
-}
-async function _sendToEndpoint(endpoint, body, payload, slugs) {
-  try {
-    const headers = {
-      "Content-Type": "application/json",
-      "User-Agent": "PayloadSupport-Webhook/1.0"
-    };
-    if (endpoint.secret) {
-      const signature = crypto3.createHmac("sha256", endpoint.secret).update(body).digest("hex");
-      headers["X-Webhook-Signature"] = signature;
-    }
-    const response = await fetch(endpoint.url, {
-      method: "POST",
-      headers,
-      body,
-      signal: AbortSignal.timeout(1e4)
-      // 10s timeout
-    });
-    await dbUpdate(payload, slugs.webhookEndpoints, {
-      id: endpoint.id,
-      data: {
-        lastTriggeredAt: (/* @__PURE__ */ new Date()).toISOString(),
-        lastStatus: response.status
-      },
-      overrideAccess: true
-    });
-    if (!response.ok) {
-      console.warn(`[webhook] ${endpoint.name || endpoint.url} returned ${response.status}`);
-    }
-  } catch (err) {
-    console.error(`[webhook] Failed to call ${endpoint.name || endpoint.url}:`, err);
-    try {
-      await dbUpdate(payload, slugs.webhookEndpoints, {
-        id: endpoint.id,
-        data: {
-          lastTriggeredAt: (/* @__PURE__ */ new Date()).toISOString(),
-          lastStatus: 0
-        },
-        overrideAccess: true
-      });
-    } catch {
-    }
-  }
-}
 
 // src/hooks/ticketStatusEmail.ts
 var STATUS_LABELS = {
@@ -7553,12 +7577,28 @@ function createAssignTicketNumber(slugs, options) {
 }
 function createAssignClientOnCreate(slugs) {
   return async ({ data, operation, req }) => {
-    if (operation === "create" && req.user?.collection === slugs.supportClients && !data.client) {
+    if (operation === "create" && req.user?.collection === slugs.supportClients) {
       data.client = req.user.id;
     }
     return data;
   };
 }
+var CLIENT_CREATABLE_TICKET_FIELDS = ["subject", "category", "priority", "project"];
+function createRestrictClientCreate(slugs) {
+  return async ({ data, operation, req }) => {
+    if (operation !== "create") return data;
+    if (req.user?.collection !== slugs.supportClients) return data;
+    const incoming = data ?? {};
+    const sanitized = {};
+    for (const field2 of CLIENT_CREATABLE_TICKET_FIELDS) {
+      if (incoming[field2] !== void 0) sanitized[field2] = incoming[field2];
+    }
+    sanitized.status = "open";
+    sanitized.client = req.user.id;
+    sanitized.source = "portal";
+    return sanitized;
+  };
+}
 var autoPaidAt = async ({ data, operation, originalDoc }) => {
   if (operation !== "update") return data;
   if (data.paymentStatus === "paid" && originalDoc?.paymentStatus !== "paid" && !data.paidAt) {
@@ -7584,16 +7624,8 @@ function createAutoAssignAdmin(slugs) {
       const { payload } = req;
       let roundRobinEnabled = false;
       try {
-        const prefs = await payload.find({
-          collection: "payload-preferences",
-          where: { key: { equals: "support-round-robin" } },
-          limit: 1,
-          depth: 0,
-          overrideAccess: true
-        });
-        if (prefs.docs.length > 0) {
-          roundRobinEnabled = prefs.docs[0].value?.enabled === true;
-        }
+        const settings = await readSupportSettings(payload);
+        roundRobinEnabled = settings.features.roundRobin === true;
       } catch (err) {
         console.warn("[support] Failed to read round-robin preferences:", err);
       }
@@ -7802,54 +7834,6 @@ function createNotifyClientOnResolve(slugs) {
     return doc;
   };
 }
-function createFireTicketWebhooks(slugs) {
-  return async ({ doc, previousDoc, operation, req }) => {
-    const { payload } = req;
-    if (operation === "create") {
-      fireWebhooks(payload, slugs, "ticket_created", {
-        id: doc.id,
-        ticketNumber: doc.ticketNumber,
-        subject: doc.subject,
-        status: doc.status,
-        priority: doc.priority,
-        category: doc.category
-      });
-      return doc;
-    }
-    if (operation === "update" && previousDoc) {
-      if (previousDoc.status !== doc.status && doc.status === "resolved") {
-        fireWebhooks(payload, slugs, "ticket_resolved", {
-          id: doc.id,
-          ticketNumber: doc.ticketNumber,
-          subject: doc.subject,
-          previousStatus: previousDoc.status
-        });
-        const clientId = typeof doc.client === "object" ? doc.client?.id : doc.client;
-        if (clientId) {
-          payload.update({
-            collection: "client-summaries",
-            where: { client: { equals: clientId } },
-            data: { generatedAt: (/* @__PURE__ */ new Date(0)).toISOString() },
-            // Force cache expiry
-            overrideAccess: true
-          }).catch(() => {
-          });
-        }
-      }
-      const oldAssigned = typeof previousDoc.assignedTo === "object" ? previousDoc.assignedTo?.id : previousDoc.assignedTo;
-      const newAssigned = typeof doc.assignedTo === "object" ? doc.assignedTo?.id : doc.assignedTo;
-      if (newAssigned && oldAssigned !== newAssigned) {
-        fireWebhooks(payload, slugs, "ticket_assigned", {
-          id: doc.id,
-          ticketNumber: doc.ticketNumber,
-          subject: doc.subject,
-          assignedTo: newAssigned
-        });
-      }
-    }
-    return doc;
-  };
-}
 function createNotifyAdminOnNewTicket(slugs, notificationSlug) {
   return async ({ doc, operation, req }) => {
     if (operation !== "create") return doc;
@@ -7870,21 +7854,66 @@ function createNotifyAdminOnNewTicket(slugs, notificationSlug) {
 }
 function createDispatchWebhookOnTicket(slugs) {
   return async ({ doc, previousDoc, operation, req }) => {
+    const { payload } = req;
     if (operation === "create") {
       dispatchWebhook(
-        { ticketId: doc.id, ticketNumber: doc.ticketNumber, subject: doc.subject },
+        {
+          ticketId: doc.id,
+          id: doc.id,
+          ticketNumber: doc.ticketNumber,
+          subject: doc.subject,
+          status: doc.status,
+          priority: doc.priority,
+          category: doc.category
+        },
         "ticket_created",
-        req.payload,
+        payload,
         slugs
       );
+      return doc;
     }
-    if (operation === "update" && previousDoc?.status !== doc.status && doc.status === "resolved") {
-      dispatchWebhook(
-        { ticketId: doc.id, ticketNumber: doc.ticketNumber, subject: doc.subject },
-        "ticket_resolved",
-        req.payload,
-        slugs
-      );
+    if (operation === "update" && previousDoc) {
+      if (previousDoc.status !== doc.status && doc.status === "resolved") {
+        dispatchWebhook(
+          {
+            ticketId: doc.id,
+            id: doc.id,
+            ticketNumber: doc.ticketNumber,
+            subject: doc.subject,
+            previousStatus: previousDoc.status
+          },
+          "ticket_resolved",
+          payload,
+          slugs
+        );
+        const clientId = typeof doc.client === "object" ? doc.client?.id : doc.client;
+        if (clientId) {
+          payload.update({
+            collection: "client-summaries",
+            where: { client: { equals: clientId } },
+            data: { generatedAt: (/* @__PURE__ */ new Date(0)).toISOString() },
+            // Force cache expiry
+            overrideAccess: true
+          }).catch(() => {
+          });
+        }
+      }
+      const oldAssigned = typeof previousDoc.assignedTo === "object" ? previousDoc.assignedTo?.id : previousDoc.assignedTo;
+      const newAssigned = typeof doc.assignedTo === "object" ? doc.assignedTo?.id : doc.assignedTo;
+      if (newAssigned && oldAssigned !== newAssigned) {
+        dispatchWebhook(
+          {
+            ticketId: doc.id,
+            id: doc.id,
+            ticketNumber: doc.ticketNumber,
+            subject: doc.subject,
+            assignedTo: newAssigned
+          },
+          "ticket_assigned",
+          payload,
+          slugs
+        );
+      }
     }
     return doc;
   };
@@ -8010,7 +8039,10 @@ function createTicketsCollection(slugs, options) {
             { label: "Paiement partiel", value: "partial" },
             { label: "Pay\xE9", value: "paid" }
           ],
-          access: { update: ({ req }) => req.user?.collection === "users" },
+          // `slugs.users`, not the literal 'users': the users collection slug is
+          // configurable, and a hard-coded one silently opens this field to everybody
+          // on a host that renamed it.
+          access: { update: ({ req }) => req.user?.collection === slugs.users },
           admin: { width: "50%", condition: (data) => !!data?.invoice }
         },
         {
@@ -8292,6 +8324,7 @@ function createTicketsCollection(slugs, options) {
       { name: "totalTimeMinutes", type: "number", defaultValue: 0, label: "Temps total (minutes)", admin: { readOnly: true, position: "sidebar" } }
     ],
     hooks: {
+      beforeValidate: [createRestrictClientCreate(slugs)],
       beforeChange: [
         createAssignTicketNumber(slugs, options?.ticketNumber),
         createAssignClientOnCreate(slugs),
@@ -8312,7 +8345,6 @@ function createTicketsCollection(slugs, options) {
         createNotifyClientOnResolve(slugs),
         createTicketStatusEmail(slugs),
         createNotifyAdminOnNewTicket(slugs, notificationSlug),
-        createFireTicketWebhooks(slugs),
         createDispatchWebhookOnTicket(slugs),
         createApplyAutomationRules(slugs)
       ],
@@ -8493,6 +8525,21 @@ async function queueClientNotification(payload, slugs, item) {
 }
 
 // src/collections/TicketMessages.ts
+function createRestrictClientTicketTarget(slugs) {
+  return async ({ data, operation, req, originalDoc }) => {
+    if (req.user?.collection !== slugs.supportClients) return data;
+    const raw = data.ticket ?? (operation === "update" ? originalDoc?.ticket : void 0);
+    const targetId = raw && typeof raw === "object" ? raw.id : raw;
+    if (targetId === void 0 || targetId === null || targetId === "") {
+      throw new APIError("Ticket cible requis.", 400);
+    }
+    const accessible = await resolveAccessibleTicketIds(req.payload, slugs, req.user.id);
+    if (!accessible.some((id) => String(id) === String(targetId))) {
+      throw new APIError("Ticket inaccessible.", 403);
+    }
+    return data;
+  };
+}
 function createAssignAuthor(slugs) {
   return async ({ data, operation, req }) => {
     if (operation === "create" && req.user?.collection === slugs.supportClients) {
@@ -8727,21 +8774,6 @@ function createNotifyAdminOnClientMessage(slugs, notificationSlug) {
     return doc;
   };
 }
-function createFireMessageWebhooks(slugs) {
-  return async ({ doc, operation, req }) => {
-    if (operation !== "create") return doc;
-    if (doc.scheduledAt && !doc.scheduledSent) return doc;
-    if (doc.isInternal) return doc;
-    const ticketId = typeof doc.ticket === "object" ? doc.ticket.id : doc.ticket;
-    fireWebhooks(req.payload, slugs, "ticket_replied", {
-      ticketId,
-      messageId: doc.id,
-      authorType: doc.authorType,
-      body: doc.body?.length > 500 ? doc.body.slice(0, 500) + "..." : doc.body
-    });
-    return doc;
-  };
-}
 function createDispatchWebhookOnReply(slugs) {
   return async ({ doc, operation, req }) => {
     if (operation !== "create") return doc;
@@ -8749,7 +8781,12 @@ function createDispatchWebhookOnReply(slugs) {
     if (doc.scheduledAt && !doc.scheduledSent) return doc;
     const ticketId = typeof doc.ticket === "object" ? doc.ticket.id : doc.ticket;
     dispatchWebhook(
-      { ticketId, messageId: doc.id, authorType: doc.authorType },
+      {
+        ticketId,
+        messageId: doc.id,
+        authorType: doc.authorType,
+        body: doc.body?.length > 500 ? doc.body.slice(0, 500) + "..." : doc.body
+      },
       "ticket_replied",
       req.payload,
       slugs
@@ -8932,7 +8969,7 @@ function createTicketMessagesCollection(slugs, options) {
       ] : []
     ],
     hooks: {
-      beforeChange: [createSanitizeMessageHtml(), createResolveMentions(slugs), createAssignAuthor(slugs)],
+      beforeChange: [createRestrictClientTicketTarget(slugs), createSanitizeMessageHtml(), createResolveMentions(slugs), createAssignAuthor(slugs)],
       afterChange: [
         ...options?.capabilities?.sms ? [createSmsNotification(slugs, options.capabilities.sms)] : [],
         createAutoUpdateStatus(slugs),
@@ -8941,7 +8978,6 @@ function createTicketMessagesCollection(slugs, options) {
         createCheckSlaOnReply(slugs, notificationSlug),
         createSyncTicketReplyToChat(slugs),
         createNotifyAdminOnClientMessage(slugs, notificationSlug),
-        createFireMessageWebhooks(slugs),
         createDispatchWebhookOnReply(slugs),
         createNotifyMentions(slugs),
         ...options?.capabilities?.threadCleanup ? [createThreadCleanup(options.capabilities.threadCleanup)] : []
@@ -9034,7 +9070,11 @@ function createEnforce2FA(slugs) {
     return user;
   };
 }
+function createAdminOnlyFieldUpdate(slugs) {
+  return ({ req }) => req.user?.collection === slugs.users;
+}
 function createSupportClientsCollection(slugs, options) {
+  const adminOnlyFieldUpdate = createAdminOnlyFieldUpdate(slugs);
   return {
     slug: slugs.supportClients,
     labels: {
@@ -9164,7 +9204,8 @@ function createSupportClientsCollection(slugs, options) {
         label: "Opportunites commerciales",
         access: {
           // Admin-only: never serialize commercial notes onto the client's own doc.
-          read: ({ req }) => req.user?.collection === slugs.users
+          read: ({ req }) => req.user?.collection === slugs.users,
+          update: adminOnlyFieldUpdate
         },
         admin: {
           description: "Notes commerciales (visible uniquement par les admins)"
@@ -9174,6 +9215,7 @@ function createSupportClientsCollection(slugs, options) {
         name: "tier",
         type: "select",
         label: "Plan",
+        access: { update: adminOnlyFieldUpdate },
         options: [
           { label: "Free", value: "free" },
           { label: "Basic", value: "basic" },
@@ -9187,6 +9229,7 @@ function createSupportClientsCollection(slugs, options) {
         type: "relationship",
         relationTo: slugs.users,
         label: "Agent referent",
+        access: { update: adminOnlyFieldUpdate },
         admin: { position: "sidebar" }
       },
       {
@@ -9202,17 +9245,20 @@ function createSupportClientsCollection(slugs, options) {
       {
         name: "twoFactorCode",
         type: "text",
+        access: { update: adminOnlyFieldUpdate },
         admin: { hidden: true }
       },
       {
         name: "twoFactorExpiry",
         type: "date",
+        access: { update: adminOnlyFieldUpdate },
         admin: { hidden: true }
       },
       {
         // Set by /support/2fa "verify"; gates login via the beforeLogin hook.
         name: "twoFactorVerifiedAt",
         type: "date",
+        access: { update: adminOnlyFieldUpdate },
         admin: { hidden: true }
       },
       {
@@ -9220,6 +9266,7 @@ function createSupportClientsCollection(slugs, options) {
         name: "googleId",
         type: "text",
         index: true,
+        access: { update: adminOnlyFieldUpdate },
         admin: { hidden: true }
       },
       {
@@ -9290,7 +9337,8 @@ function createSupportClientsCollection(slugs, options) {
         label: "Notes internes",
         access: {
           // Admin-only: never serialize internal notes onto the client's own doc.
-          read: ({ req }) => req.user?.collection === slugs.users
+          read: ({ req }) => req.user?.collection === slugs.users,
+          update: adminOnlyFieldUpdate
         },
         admin: {
           description: "Visible uniquement par les admins",
@@ -9363,36 +9411,49 @@ function createSupportClientsCollection(slugs, options) {
 }
 
 // src/collections/TimeEntries.ts
+async function recalculateTicketTime(payload, slugs, ticketId) {
+  let totalMinutes = 0;
+  let page = 1;
+  let hasMore = true;
+  while (hasMore) {
+    const entries = await payload.find({
+      collection: slugs.timeEntries,
+      where: { ticket: { equals: ticketId } },
+      limit: 100,
+      page,
+      depth: 0,
+      overrideAccess: true,
+      select: { duration: true }
+    });
+    for (const entry of entries.docs) {
+      totalMinutes += entry.duration || 0;
+    }
+    hasMore = entries.hasNextPage ?? false;
+    page++;
+  }
+  await payload.update({
+    collection: slugs.tickets,
+    id: ticketId,
+    data: { totalTimeMinutes: totalMinutes },
+    overrideAccess: true
+  });
+}
 function createRecalculateTicketTime(slugs) {
   return async ({ doc, req }) => {
     if (!doc.ticket) return;
-    const { payload } = req;
     const ticketId = typeof doc.ticket === "object" ? doc.ticket.id : doc.ticket;
-    let totalMinutes = 0;
-    let page = 1;
-    let hasMore = true;
-    while (hasMore) {
-      const entries = await payload.find({
-        collection: slugs.timeEntries,
-        where: { ticket: { equals: ticketId } },
-        limit: 100,
-        page,
-        depth: 0,
-        overrideAccess: true,
-        select: { duration: true }
-      });
-      for (const entry of entries.docs) {
-        totalMinutes += entry.duration || 0;
-      }
-      hasMore = entries.hasNextPage ?? false;
-      page++;
+    await recalculateTicketTime(req.payload, slugs, ticketId);
+  };
+}
+function createRecalculateTicketTimeOnDelete(slugs) {
+  return async ({ doc, req }) => {
+    if (!doc?.ticket) return;
+    const ticketId = typeof doc.ticket === "object" ? doc.ticket.id : doc.ticket;
+    try {
+      await recalculateTicketTime(req.payload, slugs, ticketId);
+    } catch (err) {
+      console.error("[support] Failed to recalculate ticket time after delete:", err);
     }
-    await payload.update({
-      collection: slugs.tickets,
-      id: ticketId,
-      data: { totalTimeMinutes: totalMinutes },
-      overrideAccess: true
-    });
   };
 }
 function createTimeEntriesCollection(slugs) {
@@ -9454,7 +9515,8 @@ function createTimeEntriesCollection(slugs) {
       }
     ],
     hooks: {
-      afterChange: [createRecalculateTicketTime(slugs)]
+      afterChange: [createRecalculateTicketTime(slugs)],
+      afterDelete: [createRecalculateTicketTimeOnDelete(slugs)]
     },
     access: {
       create: ({ req }) => req.user?.collection === slugs.users,
@@ -10880,7 +10942,12 @@ function createTicketCollaboratorsCollection(slugs) {
         }
         return false;
       },
-      create: ({ req }) => !!req.user,
+      // Staff only. This collection is the source of truth for
+      // resolveAccessibleTicketIds(), which widens `read` on tickets, messages
+      // and the activity log — so letting any authenticated principal POST here
+      // let a support client grant themselves access to any ticket by id.
+      // The /invite endpoint is unaffected: it writes with overrideAccess: true.
+      create: ({ req }) => req.user?.collection === slugs.users,
       update: () => false,
       delete: ({ req }) => req.user?.collection === slugs.users
     },
@@ -11221,4 +11288,4 @@ function supportPlugin(config) {
   };
 }
 
-export { DEFAULT_FEATURES, DEFAULT_INBOUND_EMAIL_LIMITS, DEFAULT_SETTINGS, DEFAULT_SLUGS, DEFAULT_USER_PREFS, MemoryRateLimitStore, PayloadRateLimitStore, RateLimiter, calculateBusinessHoursDeadline, createAdminNotification, createAssignSlaDeadlines, createAuthLogsCollection, createCannedResponsesCollection, createChatMessagesCollection, createCheckSlaOnReply, createCheckSlaOnResolve, createEmailLogsCollection, createKnowledgeBaseCollection, createLoginEndpoint, createMacrosCollection, createOAuthGoogleEndpoint, createPendingEmailsCollection, createSatisfactionSurveysCollection, createSlaPoliciesCollection, createSupportClientsCollection, createTicketActivityLogCollection, createTicketCollaboratorsCollection, createTicketMessagesCollection, createTicketStatusEmail, createTicketStatusesCollection, createTicketsCollection, createTimeEntriesCollection, createTrackOpenEndpoint, createWebhookEndpointsCollection, dispatchWebhook, generateTicketSynthesis, readSupportSettings, readUserPrefs, resolveSlugs, supportPlugin, validateInboundEmailPayload, verifySecret };
+export { DEFAULT_FEATURES, DEFAULT_INBOUND_EMAIL_LIMITS, DEFAULT_SETTINGS, DEFAULT_SLUGS, DEFAULT_TICKETING_FEATURES, DEFAULT_USER_PREFS, MemoryRateLimitStore, PayloadRateLimitStore, RateLimiter, calculateBusinessHoursDeadline, createAdminNotification, createAssignSlaDeadlines, createAuthLogsCollection, createCannedResponsesCollection, createChatMessagesCollection, createCheckSlaOnReply, createCheckSlaOnResolve, createEmailLogsCollection, createKnowledgeBaseCollection, createLoginEndpoint, createMacrosCollection, createOAuthGoogleEndpoint, createPendingEmailsCollection, createSatisfactionSurveysCollection, createSlaPoliciesCollection, createSupportClientsCollection, createTicketActivityLogCollection, createTicketCollaboratorsCollection, createTicketMessagesCollection, createTicketStatusEmail, createTicketStatusesCollection, createTicketsCollection, createTimeEntriesCollection, createTrackOpenEndpoint, createWebhookEndpointsCollection, dispatchWebhook, generateTicketSynthesis, normalizeFeatures, projectAutoClose, readSupportSettings, readSupportSettingsState, readUserPrefs, resolveSlugs, stripProjectedFeatures, supportPlugin, validateInboundEmailPayload, verifySecret };