@consilioweb/payload-support 2.0.1 → 3.0.0

package/src/__tests__/integration/core-behaviors.test.ts

@@ -1,81 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { buildTestPayload } from './buildTestPayload'
-
-const PW = 'test-pw-12345'
-
-async function makeClient(payload: Awaited<ReturnType<typeof buildTestPayload>>, email: string) {
-  return payload.create({ collection: 'support-clients', data: { email, password: PW, firstName: 'C', lastName: 'C', company: 'C' }, overrideAccess: true })
-}
-
-/**
- * Regression coverage for core ticketing behaviours that the P2 features will be
- * built on top of: ticket numbering, auto-status transitions on reply, and SLA
- * deadline assignment.
- */
-describe('core ticketing behaviours', () => {
-  it('auto-assigns a unique TK- number to each ticket', async () => {
-    const payload = await buildTestPayload()
-    const c = await makeClient(payload, 'num@example.com')
-    const t1 = await payload.create({ collection: 'tickets', data: { subject: 'one', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
-    const t2 = await payload.create({ collection: 'tickets', data: { subject: 'two', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
-    expect(t1.ticketNumber).toMatch(/^TK-\d{4}/)
-    expect(t2.ticketNumber).toMatch(/^TK-\d{4}/)
-    expect(t1.ticketNumber).not.toBe(t2.ticketNumber)
-  }, 60_000)
-
-  it('allocates sequential numbers under concurrent creation and after deletion', async () => {
-    const payload = await buildTestPayload()
-    const c = await makeClient(payload, 'concurrent-num@example.com')
-    const tickets = await Promise.all(
-      Array.from({ length: 12 }, (_, index) => payload.create({
-        collection: 'tickets',
-        data: { subject: `concurrent-${index}`, client: c.id, status: 'open', priority: 'normal' },
-        overrideAccess: true,
-      })),
-    )
-    const numbers = tickets.map((ticket) => Number(String(ticket.ticketNumber).replace('TK-', '')))
-    expect(new Set(numbers)).toHaveLength(12)
-
-    const highest = Math.max(...numbers)
-    await payload.delete({ collection: 'tickets', id: tickets[0].id, overrideAccess: true })
-    const next = await payload.create({
-      collection: 'tickets',
-      data: { subject: 'after-delete', client: c.id, status: 'open', priority: 'normal' },
-      overrideAccess: true,
-    })
-    expect(Number(String(next.ticketNumber).replace('TK-', ''))).toBe(highest + 1)
-  }, 60_000)
-
-  it('moves status to waiting_client on admin reply and back to open on client reply', async () => {
-    const payload = await buildTestPayload()
-    const c = await makeClient(payload, 'status@example.com')
-    const t = await payload.create({ collection: 'tickets', data: { subject: 'flow', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
-
-    await payload.create({ collection: 'ticket-messages', data: { ticket: t.id, body: 'admin reply', authorType: 'admin' }, overrideAccess: true })
-    let reread = await payload.findByID({ collection: 'tickets', id: t.id, overrideAccess: true })
-    expect(reread.status).toBe('waiting_client')
-
-    await payload.create({ collection: 'ticket-messages', data: { ticket: t.id, body: 'client reply', authorType: 'client', authorClient: c.id }, overrideAccess: true })
-    reread = await payload.findByID({ collection: 'tickets', id: t.id, overrideAccess: true })
-    expect(reread.status).toBe('open')
-  }, 60_000)
-
-  it('assigns SLA deadlines on create from the default policy', async () => {
-    const payload = await buildTestPayload()
-    await payload.create({
-      collection: 'sla-policies',
-      data: { name: 'Default', priority: 'normal', firstResponseTime: 60, resolutionTime: 240, businessHoursOnly: false, isDefault: true },
-      overrideAccess: true,
-    })
-    const c = await makeClient(payload, 'sla@example.com')
-    const t = await payload.create({ collection: 'tickets', data: { subject: 'sla', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
-
-    const reread = await payload.findByID({ collection: 'tickets', id: t.id, overrideAccess: true })
-    expect(reread.slaFirstResponseDue).toBeTruthy()
-    expect(reread.slaResolutionDue).toBeTruthy()
-    // resolution deadline must be later than the first-response deadline
-    expect(new Date(reread.slaResolutionDue as string).getTime()).toBeGreaterThan(
-      new Date(reread.slaFirstResponseDue as string).getTime(),
-    )
-  }, 60_000)
-})

package/src/__tests__/integration/dashboard-volume.test.ts

@@ -1,31 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { buildTestPayload } from './buildTestPayload'
-import { createAdminStatsEndpoint } from '../../endpoints/admin-stats'
-import { resolveSlugs } from '../../utils/slugs'
-
-const slugs = resolveSlugs({ users: 'users' })
-const PW = 'test-pw-12345'
-
-/**
- * Dashboard real volume series (P2 #4): admin-stats returns a real per-day ticket
- * count for the last 7 days (replacing the previous synthetic distribution).
- */
-describe('dashboard real volume series (P2 #4)', () => {
-  it('returns 7 chronological daily buckets, today reflecting created tickets', async () => {
-    const payload = await buildTestPayload()
-    const c = await payload.create({ collection: 'support-clients', data: { email: 'vol@example.com', password: PW, firstName: 'V', lastName: 'O', company: 'C' }, overrideAccess: true })
-    for (let i = 0; i < 3; i++) {
-      await payload.create({ collection: 'tickets', data: { subject: `v${i}`, client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
-    }
-
-    const admin = await payload.create({ collection: 'users', data: { email: 'vol-admin@example.com', password: PW } as never, overrideAccess: true })
-    const ep = createAdminStatsEndpoint(slugs)
-    const req = { payload, user: { ...admin, collection: 'users' }, url: 'http://localhost/api/support/admin-stats', headers: new Headers({}) }
-    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
-    const json = await res.json()
-
-    expect(Array.isArray(json.volumeByDay)).toBe(true)
-    expect(json.volumeByDay).toHaveLength(7)
-    expect(json.volumeByDay[6].count).toBeGreaterThanOrEqual(3) // today (last bucket)
-  }, 60_000)
-})

package/src/__tests__/integration/digest.test.ts

@@ -1,48 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { buildTestPayload } from './buildTestPayload'
-import { createProcessDigestsEndpoint } from '../../endpoints/process-digests'
-import { resolveSlugs } from '../../utils/slugs'
-
-const slugs = resolveSlugs({ users: 'users' })
-const PW = 'test-pw-12345'
-
-/**
- * Digest notifications (P2 #5): clients on daily/weekly frequency have their reply
- * notifications queued instead of emailed immediately, then drained as one recap
- * by the process-digests cron. Immediate-frequency clients are never queued.
- */
-describe('digest notifications (P2 #5)', () => {
-  it('queues reply notifications for daily clients and drains them via the cron', async () => {
-    const payload = await buildTestPayload()
-    process.env.CRON_SECRET = 'test-cron-secret'
-    const c = await payload.create({ collection: 'support-clients', data: { email: 'digest@example.com', password: PW, firstName: 'D', lastName: 'G', company: 'C', notificationFrequency: 'daily' }, overrideAccess: true })
-    const t = await payload.create({ collection: 'tickets', data: { subject: 'digest', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
-
-    // Admin reply → queued (client is on daily cadence), not emailed.
-    await payload.create({ collection: 'ticket-messages', data: { ticket: t.id, body: 'admin reply', authorType: 'admin' }, overrideAccess: true })
-
-    const queued = await payload.find({ collection: 'notification-queue', where: { client: { equals: c.id } }, overrideAccess: true })
-    expect(queued.totalDocs).toBe(1)
-
-    // Daily digest cron drains the queue.
-    const ep = createProcessDigestsEndpoint(slugs)
-    const req = { payload, headers: new Headers({ 'x-cron-secret': 'test-cron-secret' }), json: async () => ({ frequency: 'daily' }) }
-    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
-    const json = await res.json()
-    expect(json.ok).toBe(true)
-    expect(json.items).toBeGreaterThanOrEqual(1)
-
-    const after = await payload.find({ collection: 'notification-queue', where: { client: { equals: c.id } }, overrideAccess: true })
-    expect(after.totalDocs).toBe(0)
-  }, 60_000)
-
-  it('does not queue for immediate-frequency clients', async () => {
-    const payload = await buildTestPayload()
-    const c = await payload.create({ collection: 'support-clients', data: { email: 'imm@example.com', password: PW, firstName: 'I', lastName: 'M', company: 'C' }, overrideAccess: true })
-    const t = await payload.create({ collection: 'tickets', data: { subject: 'imm', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
-    await payload.create({ collection: 'ticket-messages', data: { ticket: t.id, body: 'admin reply', authorType: 'admin' }, overrideAccess: true })
-
-    const queued = await payload.find({ collection: 'notification-queue', where: { client: { equals: c.id } }, overrideAccess: true })
-    expect(queued.totalDocs).toBe(0)
-  }, 60_000)
-})

package/src/__tests__/integration/invoice-pdf.test.ts

@@ -1,30 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { buildTestPayload } from './buildTestPayload'
-import { createInvoiceEndpoint } from '../../endpoints/invoice'
-import { resolveSlugs } from '../../utils/slugs'
-
-const slugs = resolveSlugs({ users: 'users' })
-const PW = 'test-pw-12345'
-
-/** Native binary PDF invoice (roadmap): `format=pdf` returns a real PDF document. */
-describe('binary PDF invoice (roadmap)', () => {
-  it('returns an application/pdf document with the %PDF header', async () => {
-    const payload = await buildTestPayload()
-    const c = await payload.create({ collection: 'support-clients', data: { email: 'pdf@example.com', password: PW, firstName: 'P', lastName: 'D', company: 'ACME Corp' }, overrideAccess: true })
-    await payload.create({ collection: 'tickets', data: { subject: 'pdf-a', client: c.id, status: 'resolved', priority: 'normal', billable: true, billedAmount: 100 }, overrideAccess: true })
-    await payload.create({ collection: 'tickets', data: { subject: 'pdf-b', client: c.id, status: 'resolved', priority: 'normal', billable: true, billedAmount: 50 }, overrideAccess: true })
-
-    const admin = await payload.create({ collection: 'users', data: { email: 'pdf-admin@example.com', password: PW } as never, overrideAccess: true })
-    const from = new Date(Date.now() - 86_400_000).toISOString().slice(0, 10)
-    const to = new Date(Date.now() + 86_400_000).toISOString().slice(0, 10)
-    const ep = createInvoiceEndpoint(slugs)
-    const req = { payload, user: { ...admin, collection: 'users' }, url: `http://localhost/api/support/billing/invoice?from=${from}&to=${to}&format=pdf`, headers: new Headers({}) }
-    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
-
-    expect(res.status).toBe(200)
-    expect(res.headers.get('content-type')).toMatch(/application\/pdf/)
-    const buf = Buffer.from(await res.arrayBuffer())
-    expect(buf.subarray(0, 4).toString('latin1')).toBe('%PDF')
-    expect(buf.length).toBeGreaterThan(500)
-  }, 60_000)
-})

package/src/__tests__/integration/isolation.test.ts

@@ -1,81 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { buildTestPayload } from './buildTestPayload'
-
-const PW = 'test-pw-12345'
-
-/**
- * Validates the cross-client isolation fix (P0-4): a support-client must never
- * read another client's ticket messages / activity, and field-level access
- * (P0-7) must hide admin-only fields from the client's own doc.
- */
-describe('cross-client isolation (P0-4 / P0-7)', () => {
-  it('a client cannot read another client\'s ticket messages', async () => {
-    const payload = await buildTestPayload()
-
-    const a = await payload.create({ collection: 'support-clients', data: { email: 'iso-a@example.com', password: PW, firstName: 'A', lastName: 'A', company: 'A' }, overrideAccess: true })
-    const b = await payload.create({ collection: 'support-clients', data: { email: 'iso-b@example.com', password: PW, firstName: 'B', lastName: 'B', company: 'B' }, overrideAccess: true })
-
-    const ta = await payload.create({ collection: 'tickets', data: { subject: 'A ticket', client: a.id, status: 'open', priority: 'normal' }, overrideAccess: true })
-    const tb = await payload.create({ collection: 'tickets', data: { subject: 'B ticket', client: b.id, status: 'open', priority: 'normal' }, overrideAccess: true })
-
-    await payload.create({ collection: 'ticket-messages', data: { ticket: ta.id, body: 'SECRET-A-MESSAGE', authorType: 'admin' }, overrideAccess: true })
-    await payload.create({ collection: 'ticket-messages', data: { ticket: tb.id, body: 'SECRET-B-MESSAGE', authorType: 'admin' }, overrideAccess: true })
-
-    // Read messages AS client A, with access control enforced.
-    const asA = await payload.find({
-      collection: 'ticket-messages',
-      overrideAccess: false,
-      user: { ...a, collection: 'support-clients' } as never,
-      limit: 200,
-    })
-    const bodies = asA.docs.map((m) => (m as { body?: string }).body)
-
-    expect(bodies).toContain('SECRET-A-MESSAGE')
-    expect(bodies).not.toContain('SECRET-B-MESSAGE') // ← the cross-client boundary
-  }, 60_000)
-
-  it('a client cannot read another client\'s activity log', async () => {
-    const payload = await buildTestPayload()
-
-    const a = await payload.create({ collection: 'support-clients', data: { email: 'act-a@example.com', password: PW, firstName: 'A', lastName: 'A', company: 'A' }, overrideAccess: true })
-    const b = await payload.create({ collection: 'support-clients', data: { email: 'act-b@example.com', password: PW, firstName: 'B', lastName: 'B', company: 'B' }, overrideAccess: true })
-    const ta = await payload.create({ collection: 'tickets', data: { subject: 'A', client: a.id, status: 'open', priority: 'normal' }, overrideAccess: true })
-    const tb = await payload.create({ collection: 'tickets', data: { subject: 'B', client: b.id, status: 'open', priority: 'normal' }, overrideAccess: true })
-    await payload.create({ collection: 'ticket-activity-log', data: { ticket: ta.id, action: 'status_changed', detail: 'ACT-A' }, overrideAccess: true })
-    await payload.create({ collection: 'ticket-activity-log', data: { ticket: tb.id, action: 'status_changed', detail: 'ACT-B' }, overrideAccess: true })
-
-    const asA = await payload.find({
-      collection: 'ticket-activity-log',
-      overrideAccess: false,
-      user: { ...a, collection: 'support-clients' } as never,
-      limit: 200,
-    })
-    const details = asA.docs.map((m) => (m as { detail?: string }).detail)
-    expect(details).toContain('ACT-A')
-    expect(details).not.toContain('ACT-B')
-  }, 60_000)
-
-  it('does not serialize admin-only opportunities/notes to the client (P0-7)', async () => {
-    const payload = await buildTestPayload()
-    const c = await payload.create({ collection: 'support-clients', data: { email: 'fa@example.com', password: PW, firstName: 'F', lastName: 'A', company: 'C', opportunities: 'SECRET-DEAL', notes: 'INTERNAL-NOTE' }, overrideAccess: true })
-
-    const asClient = await payload.findByID({
-      collection: 'support-clients',
-      id: c.id,
-      overrideAccess: false,
-      user: { ...c, collection: 'support-clients' } as never,
-    })
-    expect((asClient as { opportunities?: string }).opportunities).toBeFalsy()
-    expect((asClient as { notes?: string }).notes).toBeFalsy()
-
-    // Admin (users collection) still sees them.
-    const admin = await payload.create({ collection: 'users', data: { email: 'admin-fa@example.com', password: PW } as never, overrideAccess: true })
-    const asAdmin = await payload.findByID({
-      collection: 'support-clients',
-      id: c.id,
-      overrideAccess: false,
-      user: { ...admin, collection: 'users' } as never,
-    })
-    expect((asAdmin as { opportunities?: string }).opportunities).toBe('SECRET-DEAL')
-  }, 60_000)
-})

package/src/__tests__/integration/mentions-invoice.test.ts

@@ -1,50 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { buildTestPayload } from './buildTestPayload'
-import { createInvoiceEndpoint } from '../../endpoints/invoice'
-import { resolveSlugs } from '../../utils/slugs'
-
-const slugs = resolveSlugs({ users: 'users' })
-const PW = 'test-pw-12345'
-
-/** @mentions (P2 #6): `@email` in a message resolves to agent IDs on `mentions`. */
-describe('@mentions (P2 #6)', () => {
-  it('resolves @email mentions in a message body to agent IDs', async () => {
-    const payload = await buildTestPayload()
-    const agent = await payload.create({ collection: 'users', data: { email: 'agent@example.com', password: PW } as never, overrideAccess: true })
-    const c = await payload.create({ collection: 'support-clients', data: { email: 'mc@example.com', password: PW, firstName: 'M', lastName: 'C', company: 'C' }, overrideAccess: true })
-    const t = await payload.create({ collection: 'tickets', data: { subject: 'mention', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
-
-    const m = await payload.create({
-      collection: 'ticket-messages',
-      data: { ticket: t.id, body: 'Hey @agent@example.com can you check this?', authorType: 'admin', isInternal: true },
-      overrideAccess: true,
-    })
-
-    const reread = await payload.findByID({ collection: 'ticket-messages', id: m.id, depth: 0, overrideAccess: true })
-    const mentions = (reread as { mentions?: Array<number | string> }).mentions || []
-    expect(mentions.map(String)).toContain(String(agent.id))
-  }, 60_000)
-})
-
-/** Invoice (P2 #6): a print-ready HTML invoice with the correct total. */
-describe('printable invoice (P2 #6)', () => {
-  it('renders an HTML invoice summing billable tickets', async () => {
-    const payload = await buildTestPayload()
-    const c = await payload.create({ collection: 'support-clients', data: { email: 'inv@example.com', password: PW, firstName: 'I', lastName: 'V', company: 'ACME Corp' }, overrideAccess: true })
-    const t1 = await payload.create({ collection: 'tickets', data: { subject: 'inv-a', client: c.id, status: 'resolved', priority: 'normal', billable: true, billedAmount: 100 }, overrideAccess: true })
-    await payload.create({ collection: 'tickets', data: { subject: 'inv-b', client: c.id, status: 'resolved', priority: 'normal', billable: true, billedAmount: 50 }, overrideAccess: true })
-
-    const admin = await payload.create({ collection: 'users', data: { email: 'inv-admin@example.com', password: PW } as never, overrideAccess: true })
-    const from = new Date(Date.now() - 86_400_000).toISOString().slice(0, 10)
-    const to = new Date(Date.now() + 86_400_000).toISOString().slice(0, 10)
-    const ep = createInvoiceEndpoint(slugs)
-    const req = { payload, user: { ...admin, collection: 'users' }, url: `http://localhost/api/support/billing/invoice?from=${from}&to=${to}`, headers: new Headers({}) }
-    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
-
-    expect(res.headers.get('content-type')).toMatch(/text\/html/)
-    const body = await res.text()
-    expect(body).toContain('150.00 €') // 100 + 50
-    expect(body).toContain(String(t1.ticketNumber))
-    expect(body).toContain('ACME Corp')
-  }, 60_000)
-})

package/src/__tests__/integration/nps.test.ts

@@ -1,37 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { buildTestPayload } from './buildTestPayload'
-import { createAdminStatsEndpoint } from '../../endpoints/admin-stats'
-import { resolveSlugs } from '../../utils/slugs'
-
-const slugs = resolveSlugs({ users: 'users' })
-const PW = 'test-pw-12345'
-
-/**
- * NPS (P2): satisfaction surveys can carry an NPS score (0-10), and admin-stats
- * computes the Net Promoter Score = %promoters(9-10) − %detractors(0-6).
- */
-describe('NPS (P2)', () => {
-  it('stores NPS scores and computes the NPS in admin-stats', async () => {
-    const payload = await buildTestPayload()
-    const c = await payload.create({ collection: 'support-clients', data: { email: 'nps@example.com', password: PW, firstName: 'N', lastName: 'P', company: 'C' }, overrideAccess: true })
-
-    // 3 promoters (10,9,9), 1 passive (7), 2 detractors (3,5) → (3-2)/6 = 16.67% ≈ 17
-    for (const nps of [10, 9, 9, 7, 3, 5]) {
-      await payload.create({ collection: 'satisfaction-surveys', data: { source: 'ticket', client: c.id, nps }, overrideAccess: true })
-    }
-
-    const admin = await payload.create({ collection: 'users', data: { email: 'nps-admin@example.com', password: PW } as never, overrideAccess: true })
-    const ep = createAdminStatsEndpoint(slugs)
-    const req = {
-      payload,
-      user: { ...admin, collection: 'users' },
-      url: 'http://localhost/api/support/admin-stats',
-      headers: new Headers({}),
-    }
-    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
-    const json = await res.json()
-
-    expect(json.npsCount).toBe(6)
-    expect(json.npsScore).toBe(17)
-  }, 60_000)
-})

package/src/__tests__/integration/per-team-sla.test.ts

@@ -1,44 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { buildTestPayload } from './buildTestPayload'
-import { createAdminStatsEndpoint } from '../../endpoints/admin-stats'
-import { resolveSlugs } from '../../utils/slugs'
-
-const slugs = resolveSlugs({ users: 'users' })
-const PW = 'test-pw-12345'
-
-/** Per-team SLA policies & dashboards (roadmap). */
-describe('per-team SLA & dashboards (roadmap)', () => {
-  it('uses the team-specific SLA policy over the global default', async () => {
-    const payload = await buildTestPayload()
-    const team = await payload.create({ collection: 'support-teams', data: { name: 'Team SLA' }, overrideAccess: true })
-    // Team policy: 2h resolution. Global default: 24h.
-    await payload.create({ collection: 'sla-policies', data: { name: 'Team', priority: 'normal', firstResponseTime: 30, resolutionTime: 120, businessHoursOnly: false, team: team.id }, overrideAccess: true })
-    await payload.create({ collection: 'sla-policies', data: { name: 'Default', priority: 'normal', firstResponseTime: 120, resolutionTime: 1440, businessHoursOnly: false, isDefault: true }, overrideAccess: true })
-
-    const c = await payload.create({ collection: 'support-clients', data: { email: 'pts@example.com', password: PW, firstName: 'P', lastName: 'T', company: 'C' }, overrideAccess: true })
-    const t = await payload.create({ collection: 'tickets', data: { subject: 'team sla', client: c.id, status: 'open', priority: 'normal', team: team.id }, overrideAccess: true })
-
-    const reread = await payload.findByID({ collection: 'tickets', id: t.id, overrideAccess: true })
-    const created = new Date(reread.createdAt as string).getTime()
-    const diffMin = (new Date(reread.slaResolutionDue as string).getTime() - created) / 60000
-    expect(diffMin).toBeGreaterThan(110) // ~120 (team policy), NOT 1440 (default)
-    expect(diffMin).toBeLessThan(130)
-  }, 60_000)
-
-  it('scopes the dashboard counts to a team via ?teamId', async () => {
-    const payload = await buildTestPayload()
-    const teamC = await payload.create({ collection: 'support-teams', data: { name: 'Team C' }, overrideAccess: true })
-    const teamD = await payload.create({ collection: 'support-teams', data: { name: 'Team D' }, overrideAccess: true })
-    const c = await payload.create({ collection: 'support-clients', data: { email: 'ptd@example.com', password: PW, firstName: 'P', lastName: 'D', company: 'C' }, overrideAccess: true })
-    await payload.create({ collection: 'tickets', data: { subject: 'c1', client: c.id, status: 'open', priority: 'normal', team: teamC.id }, overrideAccess: true })
-    await payload.create({ collection: 'tickets', data: { subject: 'c2', client: c.id, status: 'open', priority: 'normal', team: teamC.id }, overrideAccess: true })
-    await payload.create({ collection: 'tickets', data: { subject: 'd1', client: c.id, status: 'open', priority: 'normal', team: teamD.id }, overrideAccess: true })
-
-    const admin = await payload.create({ collection: 'users', data: { email: 'pt-admin@example.com', password: PW } as never, overrideAccess: true })
-    const ep = createAdminStatsEndpoint(slugs)
-    const req = { payload, user: { ...admin, collection: 'users' }, url: `http://localhost/api/support/admin-stats?teamId=${teamC.id}`, headers: new Headers({}) }
-    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
-    const json = await res.json()
-    expect(json.total).toBe(2) // only Team C's tickets
-  }, 60_000)
-})

package/src/__tests__/integration/push.test.ts

@@ -1,75 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { buildTestPayload } from './buildTestPayload'
-import { createVapidKeyEndpoint, createPushSubscribeEndpoint } from '../../endpoints/push'
-import { sendPushToUser } from '../../utils/push'
-import { resolveSlugs } from '../../utils/slugs'
-
-const slugs = resolveSlugs({ users: 'users' })
-const PW = 'test-pw-12345'
-
-/** Native push / browser notifications (roadmap). */
-describe('push notifications (roadmap)', () => {
-  it('subscribe stores a subscription row for the agent', async () => {
-    const payload = await buildTestPayload()
-    const admin = await payload.create({ collection: 'users', data: { email: 'push-admin@example.com', password: PW } as never, overrideAccess: true })
-    const ep = createPushSubscribeEndpoint(slugs)
-    const req = {
-      payload,
-      user: { ...admin, collection: 'users' },
-      headers: new Headers({ 'user-agent': 'vitest' }),
-      json: async () => ({ subscription: { endpoint: 'https://push.example.com/abc', keys: { p256dh: 'pk', auth: 'ak' } } }),
-    }
-    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
-    expect(res.status).toBe(200)
-
-    const stored = await payload.find({ collection: 'push-subscriptions', where: { endpoint: { equals: 'https://push.example.com/abc' } }, overrideAccess: true })
-    expect(stored.docs.length).toBe(1)
-    expect((stored.docs[0] as { auth?: string }).auth).toBe('ak')
-  }, 60_000)
-
-  it('subscribe is idempotent on endpoint (upsert, no duplicate)', async () => {
-    const payload = await buildTestPayload()
-    const admin = await payload.create({ collection: 'users', data: { email: 'push-admin2@example.com', password: PW } as never, overrideAccess: true })
-    const ep = createPushSubscribeEndpoint(slugs)
-    const mk = (auth: string) => ({
-      payload,
-      user: { ...admin, collection: 'users' },
-      headers: new Headers({}),
-      json: async () => ({ subscription: { endpoint: 'https://push.example.com/dup', keys: { p256dh: 'pk', auth } } }),
-    })
-    await (ep.handler as (r: unknown) => Promise<Response>)(mk('first'))
-    await (ep.handler as (r: unknown) => Promise<Response>)(mk('second'))
-    const stored = await payload.find({ collection: 'push-subscriptions', where: { endpoint: { equals: 'https://push.example.com/dup' } }, overrideAccess: true })
-    expect(stored.docs.length).toBe(1)
-    expect((stored.docs[0] as { auth?: string }).auth).toBe('second')
-  }, 60_000)
-
-  it('subscribe rejects an anonymous request', async () => {
-    const payload = await buildTestPayload()
-    const ep = createPushSubscribeEndpoint(slugs)
-    const req = {
-      payload,
-      user: null,
-      headers: new Headers({}),
-      json: async () => ({ subscription: { endpoint: 'https://push.example.com/x', keys: { p256dh: 'pk', auth: 'ak' } } }),
-    }
-    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
-    expect(res.status).toBe(401)
-  }, 60_000)
-
-  it('vapid-public-key returns null when VAPID is not configured', async () => {
-    delete process.env.VAPID_PUBLIC_KEY
-    const ep = createVapidKeyEndpoint()
-    const res = await (ep.handler as (r: unknown) => Promise<Response>)({})
-    const json = await res.json()
-    expect(json.publicKey).toBeNull()
-  })
-
-  it('sendPushToUser no-ops without VAPID keys', async () => {
-    delete process.env.VAPID_PUBLIC_KEY
-    delete process.env.VAPID_PRIVATE_KEY
-    const payload = await buildTestPayload()
-    const result = await sendPushToUser(payload, slugs, 1, { title: 'Hi', body: 'There' })
-    expect(result.sent).toBe(0)
-  }, 60_000)
-})

package/src/__tests__/integration/sanitization.test.ts

@@ -1,35 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { buildTestPayload } from './buildTestPayload'
-
-const PW = 'test-pw-12345'
-
-/**
- * Validates that the bodyHtml sanitization (P0-1) is actually wired into the
- * TicketMessages beforeChange hook — i.e. stored HTML is stripped of script /
- * event handlers before it can be persisted and later rendered.
- */
-describe('stored-XSS sanitization on write (P0-1)', () => {
-  it('strips <script> and inline handlers from bodyHtml at persistence', async () => {
-    const payload = await buildTestPayload()
-    const c = await payload.create({ collection: 'support-clients', data: { email: 'xss@example.com', password: PW, firstName: 'X', lastName: 'S', company: 'C' }, overrideAccess: true })
-    const t = await payload.create({ collection: 'tickets', data: { subject: 'xss', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
-
-    const m = await payload.create({
-      collection: 'ticket-messages',
-      data: {
-        ticket: t.id,
-        body: 'hello',
-        bodyHtml: '<img src=x onerror=alert(1)><script>alert(2)</script><a href="javascript:alert(3)">x</a><b>kept</b>',
-        authorType: 'client',
-        authorClient: c.id,
-      },
-      overrideAccess: true,
-    })
-
-    const stored = (m as { bodyHtml?: string }).bodyHtml || ''
-    expect(stored).not.toMatch(/onerror/i)
-    expect(stored).not.toMatch(/<script/i)
-    expect(stored).not.toMatch(/javascript:/i)
-    expect(stored).toContain('<b>kept</b>') // legitimate formatting preserved
-  }, 60_000)
-})

package/src/__tests__/integration/sla-pause.test.ts

@@ -1,39 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { buildTestPayload } from './buildTestPayload'
-
-const PW = 'test-pw-12345'
-
-/**
- * SLA pause-on-hold (P2): time spent waiting on the client must not count against
- * the resolution SLA — the resolution deadline is pushed forward by the paused span.
- */
-describe('SLA pause-on-hold (P2)', () => {
-  it('extends the resolution deadline by the time spent in waiting_client', async () => {
-    const payload = await buildTestPayload()
-    await payload.create({ collection: 'sla-policies', data: { name: 'P', priority: 'normal', firstResponseTime: 60, resolutionTime: 240, businessHoursOnly: false, isDefault: true }, overrideAccess: true })
-    const c = await payload.create({ collection: 'support-clients', data: { email: 'pause@example.com', password: PW, firstName: 'P', lastName: 'H', company: 'C' }, overrideAccess: true })
-    const t = await payload.create({ collection: 'tickets', data: { subject: 'pause', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
-
-    const before = await payload.findByID({ collection: 'tickets', id: t.id, overrideAccess: true })
-    const dueBefore = new Date(before.slaResolutionDue as string).getTime()
-    expect(dueBefore).toBeGreaterThan(0)
-
-    // Enter hold → the clock should pause.
-    await payload.update({ collection: 'tickets', id: t.id, data: { status: 'waiting_client' }, overrideAccess: true })
-    const mid = await payload.findByID({ collection: 'tickets', id: t.id, overrideAccess: true })
-    expect(mid.slaPausedAt).toBeTruthy()
-
-    // Simulate ~2h of waiting by backdating the pause marker (status unchanged → hook no-op).
-    const twoHoursAgo = new Date(Date.now() - 2 * 3_600_000).toISOString()
-    await payload.update({ collection: 'tickets', id: t.id, data: { slaPausedAt: twoHoursAgo }, overrideAccess: true })
-
-    // Leave hold → deadline extended, pause cleared.
-    await payload.update({ collection: 'tickets', id: t.id, data: { status: 'open' }, overrideAccess: true })
-    const after = await payload.findByID({ collection: 'tickets', id: t.id, overrideAccess: true })
-
-    expect(after.slaPausedAt).toBeFalsy()
-    const extensionMs = new Date(after.slaResolutionDue as string).getTime() - dueBefore
-    expect(extensionMs).toBeGreaterThan(1.9 * 3_600_000)
-    expect(extensionMs).toBeLessThan(2.2 * 3_600_000)
-  }, 60_000)
-})

package/src/__tests__/integration/smoke.test.ts

@@ -1,26 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { buildTestPayload } from './buildTestPayload'
-
-describe('integration harness', () => {
-  it('boots Payload with the support plugin and round-trips a ticket', async () => {
-    const payload = await buildTestPayload()
-
-    const client = await payload.create({
-      collection: 'support-clients',
-      data: { email: 'smoke@example.com', password: 'pw-smoke-123', firstName: 'Smoke', lastName: 'Test', company: 'ACME' },
-      overrideAccess: true,
-    })
-
-    const ticket = await payload.create({
-      collection: 'tickets',
-      data: { subject: 'Smoke ticket', client: client.id, status: 'open', priority: 'normal' },
-      overrideAccess: true,
-    })
-
-    expect(ticket.id).toBeTruthy()
-    expect(ticket.ticketNumber).toMatch(/^TK-/)
-
-    const reread = await payload.findByID({ collection: 'tickets', id: ticket.id, overrideAccess: true })
-    expect(reread.subject).toBe('Smoke ticket')
-  }, 60_000)
-})