@consilioweb/payload-support 2.0.1 → 4.0.0

package/src/endpoints/admin-chat.ts

@@ -1,7 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { Where } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { dbFind, dbCreate, dbUpdate } from '../utils/db'
 
@@ -111,7 +111,7 @@ export function createAdminChatGetEndpoint(slugs: CollectionSlugs): Endpoint {
  * Admin sends a message or closes a session.
  */
 export function createAdminChatPostEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const adminChatLimiter = new RateLimiter(60_000, 30, store)
+  const adminChatLimiter = new RateLimiter(60_000, 30, store, 'admin-chat')
   return {
     path: '/support/admin-chat',
     method: 'post',
@@ -150,7 +150,7 @@ export function createAdminChatPostEndpoint(slugs: CollectionSlugs, store?: Rate
 
         // Agent sends a message
         if (action === 'send' && message) {
-          if (await adminChatLimiter.check(String(req.user.id), req)) {
+          if (await adminChatLimiter.check(principalRateKey(req.user), req)) {
             return Response.json({ error: 'Rate limit atteint.' }, { status: 429 })
           }
 

package/src/endpoints/ai-agent.ts

@@ -2,7 +2,7 @@ import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { runAiAgent } from '../utils/aiAgent'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 
 /**
  * POST /api/support/ai-agent   body: { ticketId, confidenceThreshold? }
@@ -11,14 +11,14 @@ import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
  * (when confident) or escalates to a human with an internal note. Admin-only.
  */
 export function createAiAgentEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const limiter = new RateLimiter(60_000, 10, store)
+  const limiter = new RateLimiter(60_000, 10, store, 'ai-agent')
   return {
     path: '/support/ai-agent',
     method: 'post',
     handler: async (req) => {
       try {
         requireAdmin(req, slugs)
-        if (await limiter.check(String(req.user!.id), req)) {
+        if (await limiter.check(principalRateKey(req.user), req)) {
           return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
         }
         let body: { ticketId?: number | string; confidenceThreshold?: number } = {}

package/src/endpoints/ai.ts

@@ -2,13 +2,14 @@ import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { readSupportSettings, type SupportSettings } from '../utils/readSettings'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { resolveOllamaBaseUrl } from '../utils/aiProvider'
 
 async function getClient(aiSettings: SupportSettings['ai']) {
   const moduleName = '@anthropic-ai/sdk'
   const { default: Anthropic } = await import(moduleName)
   if (aiSettings.provider === 'ollama') {
-    const baseURL = process.env.OLLAMA_API_URL || 'https://ollama.orkelis.app/v1'
+    const baseURL = resolveOllamaBaseUrl()
     return new Anthropic({ apiKey: 'ollama', baseURL })
   }
   return new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY })
@@ -25,7 +26,7 @@ type AiAction = 'sentiment' | 'synthesis' | 'suggest_reply' | 'rewrite'
  * Admin-only endpoint for AI features in support.
  */
 export function createAiEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const limiter = new RateLimiter(60_000, 30, store)
+  const limiter = new RateLimiter(60_000, 30, store, 'ai')
   return {
     path: '/support/ai',
     method: 'post',
@@ -34,7 +35,7 @@ export function createAiEndpoint(slugs: CollectionSlugs, store?: RateLimitStore)
         const payload = req.payload
 
         requireAdmin(req, slugs)
-        if (await limiter.check(String(req.user!.id), req)) {
+        if (await limiter.check(principalRateKey(req.user), req)) {
           return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
         }
 

package/src/endpoints/auth-2fa.ts

@@ -4,6 +4,7 @@ import crypto, { createHmac } from 'crypto'
 import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { escapeHtml } from '../utils/emailTemplate'
 import { dbFind, dbUpdate } from '../utils/db'
+import { verifyTwoFactorChallenge } from '../utils/twoFactorChallenge'
 
 function generateSecureCode(): string {
   const buf = crypto.randomBytes(4)
@@ -25,21 +26,21 @@ function hashCode(code: string): string {
  * Send or verify a 2FA code.
  */
 export function createAuth2faEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const sendLimiter = new RateLimiter(60 * 60 * 1000, 3, store)
-  const verifyLimiter = new RateLimiter(15 * 60 * 1000, 5, store)
+  const sendLimiter = new RateLimiter(60 * 60 * 1000, 3, store, '2fa:send')
+  const verifyLimiter = new RateLimiter(15 * 60 * 1000, 5, store, '2fa:verify')
   return {
     path: '/support/2fa',
     method: 'post',
     handler: async (req) => {
       try {
         const payload = req.payload
-        let body: { action?: string; email?: string; code?: string }
+        let body: { action?: string; email?: string; code?: string; challenge?: string }
         try {
           body = await req.json!()
         } catch {
           return Response.json({ error: 'Invalid JSON body' }, { status: 400 })
         }
-        const { action, email, code } = body
+        const { action, email, code, challenge } = body
 
         if (!action || !email) {
           return Response.json({ error: 'Paramètres manquants' }, { status: 400 })
@@ -48,6 +49,17 @@ export function createAuth2faEndpoint(slugs: CollectionSlugs, store?: RateLimitS
         const genericSendResponse = { success: true, message: 'Si un compte existe, un code a été envoyé.' }
 
         if (action === 'send') {
+          // The challenge is checked BEFORE the limiter on purpose: the limiter
+          // is keyed on the VICTIM's email, so letting an unauthenticated caller
+          // reach it is what made the lockout possible. No challenge, no budget
+          // consumed, no mail sent, no code overwritten.
+          if (!verifyTwoFactorChallenge(email, challenge)) {
+            return Response.json(
+              { error: 'Authentification requise avant l\'envoi d\'un code.' },
+              { status: 401 },
+            )
+          }
+
           if (await sendLimiter.check(email, req)) {
             return Response.json(genericSendResponse)
           }

package/src/endpoints/capabilities.ts

@@ -1,7 +1,7 @@
 import type { Endpoint, Where } from 'payload'
 import type { SupportCapabilities } from '../types'
 import type { CollectionSlugs } from '../utils/slugs'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import {
   validateInboundEmailPayload,
   verifySecret,
@@ -12,7 +12,7 @@ export function createInboundEmailEndpoint(
   capability: NonNullable<SupportCapabilities['inboundEmail']>,
   store?: RateLimitStore,
 ): Endpoint {
-  const limiter = new RateLimiter(60_000, 60, store)
+  const limiter = new RateLimiter(60_000, 60, store, 'inbound-email')
   return {
     path: '/support-webhook/inbound-email',
     method: 'post',
@@ -51,7 +51,7 @@ export function createProjectSuggestionsEndpoint(
   capability: NonNullable<SupportCapabilities['projectSuggestions']>,
   store?: RateLimitStore,
 ): Endpoint {
-  const limiter = new RateLimiter(60_000, 20, store)
+  const limiter = new RateLimiter(60_000, 20, store, 'suggest-projects')
   return {
     path: '/support/suggest-projects',
     method: 'post',
@@ -59,7 +59,7 @@ export function createProjectSuggestionsEndpoint(
       if (!req.user || req.user.collection !== slugs.users) {
         return Response.json({ error: 'Unauthorized' }, { status: 401 })
       }
-      const key = req.user?.id ? String(req.user.id) : 'anonymous'
+      const key = principalRateKey(req.user)
       if (await limiter.check(key, req)) {
         return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
       }
@@ -73,7 +73,7 @@ export function createTicketTitleEndpoint(
   capability: NonNullable<SupportCapabilities['aiTitles']>,
   store?: RateLimitStore,
 ): Endpoint {
-  const limiter = new RateLimiter(60_000, 20, store)
+  const limiter = new RateLimiter(60_000, 20, store, 'ticket-title')
   return {
     path: '/support/ticket-title',
     method: 'post',
@@ -100,7 +100,7 @@ export function createGenerateMissingTitlesEndpoint(
   capability: NonNullable<SupportCapabilities['aiTitles']>,
   store?: RateLimitStore,
 ): Endpoint {
-  const limiter = new RateLimiter(60_000, 5, store)
+  const limiter = new RateLimiter(60_000, 5, store, 'generate-missing-titles')
   return {
     path: '/support/generate-missing-titles',
     method: 'post',

package/src/endpoints/chat.ts

@@ -2,7 +2,7 @@ import type { Endpoint } from 'payload'
 import type { Where } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import crypto from 'crypto'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { requireClient, handleAuthError } from '../utils/auth'
 import { dbFind, dbCreate } from '../utils/db'
 
@@ -67,8 +67,8 @@ export function createChatGetEndpoint(slugs: CollectionSlugs): Endpoint {
  * Send a message or start a new chat session. Client-only.
  */
 export function createChatPostEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const chatSessionLimiter = new RateLimiter(3_600_000, 5, store)
-  const chatMessageLimiter = new RateLimiter(60_000, 15, store)
+  const chatSessionLimiter = new RateLimiter(3_600_000, 5, store, 'chat:session')
+  const chatMessageLimiter = new RateLimiter(60_000, 15, store, 'chat:message')
   return {
     path: '/support/chat',
     method: 'post',
@@ -86,10 +86,12 @@ export function createChatPostEndpoint(slugs: CollectionSlugs, store?: RateLimit
         }
         const { action, session, message } = body
         const userId = String(req.user.id)
+        // Collection-qualified: agent #7 and support-client #7 must not share a budget.
+        const rateKey = principalRateKey(req.user)
 
         // Start a new session
         if (action === 'start') {
-          if (await chatSessionLimiter.check(userId, req)) {
+          if (await chatSessionLimiter.check(rateKey, req)) {
             return Response.json({ error: 'Trop de sessions créées. Réessayez plus tard.' }, { status: 429 })
           }
 
@@ -111,7 +113,7 @@ export function createChatPostEndpoint(slugs: CollectionSlugs, store?: RateLimit
 
         // Send a message
         if (action === 'send' && session && message) {
-          if (await chatMessageLimiter.check(userId, req)) {
+          if (await chatMessageLimiter.check(rateKey, req)) {
             return Response.json({ error: 'Trop de messages. Attendez un moment.' }, { status: 429 })
           }
 

package/src/endpoints/chatbot.ts

@@ -4,13 +4,38 @@ import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbFind } from '../utils/db'
 
 
+/**
+ * Global hourly ceiling on chatbot calls, all callers combined.
+ *
+ * The per-IP window below is keyed on the FIRST hop of `X-Forwarded-For`, a
+ * value the caller sends itself: an anonymous client rotating that header gets a
+ * fresh window on every request. Unlike `login.ts` — where the account lock is
+ * the primary control — this endpoint has no second line of defence, and every
+ * accepted call ships ~50 KB of knowledge base to the Anthropic API on the
+ * operator's key. This unkeyed ceiling makes the bill bounded even when the
+ * per-IP key is bypassed. Raise it with `SUPPORT_CHATBOT_MAX_PER_HOUR` on a
+ * high-traffic portal, or pass `maxPerHour` when building the endpoint.
+ */
+export const DEFAULT_CHATBOT_MAX_PER_HOUR = 200
+
+function resolveMaxPerHour(explicit?: number): number {
+  if (typeof explicit === 'number' && explicit > 0) return explicit
+  const fromEnv = Number(process.env.SUPPORT_CHATBOT_MAX_PER_HOUR)
+  return Number.isFinite(fromEnv) && fromEnv > 0 ? fromEnv : DEFAULT_CHATBOT_MAX_PER_HOUR
+}
+
 /**
  * POST /api/support/chatbot
  * AI chatbot that answers from the knowledge base before creating a ticket.
  * Public endpoint (accessible from the support portal).
  */
-export function createChatbotEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const chatbotLimiter = new RateLimiter(60_000, 10, store)
+export function createChatbotEndpoint(
+  slugs: CollectionSlugs,
+  store?: RateLimitStore,
+  maxPerHour?: number,
+): Endpoint {
+  const chatbotLimiter = new RateLimiter(60_000, 10, store, 'chatbot:ip')
+  const globalLimiter = new RateLimiter(60 * 60_000, resolveMaxPerHour(maxPerHour), store, 'chatbot:global')
   return {
     path: '/support/chatbot',
     method: 'post',
@@ -33,6 +58,27 @@ export function createChatbotEndpoint(slugs: CollectionSlugs, store?: RateLimitS
           return Response.json({ error: 'Question too short' }, { status: 400 })
         }
 
+        // Not keyed on anything the caller controls — see the note above.
+        // Placed after validation so malformed requests do not eat the budget.
+        //
+        // Over budget, the answer DEGRADES, it does not fail: a shared counter
+        // that returns 429 hands an anonymous visitor a switch to turn the
+        // chatbot off for everybody (the per-IP key above is spoofable, so
+        // exhausting the ceiling costs nothing). The deflection path — "no
+        // answer here, open a ticket" — is the exact response this endpoint
+        // already returns when the knowledge base is empty or the API key is
+        // missing, so no caller learns a new shape, and the bill stays capped
+        // because the AI call below is never reached.
+        if (await globalLimiter.check('all', req)) {
+          return Response.json({
+            answer: null,
+            confidence: 0,
+            suggestion: 'create_ticket',
+            aiUnavailable: true,
+            message: 'L\'assistant est momentanément indisponible. Créez un ticket, un agent vous répondra.',
+          })
+        }
+
         const payload = req.payload
 
         const articles = await dbFind(payload, slugs.knowledgeBase, {

package/src/endpoints/client-intelligence.ts

@@ -2,13 +2,14 @@ import type { Endpoint, PayloadRequest } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { readSupportSettings, type SupportSettings } from '../utils/readSettings'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { resolveOllamaBaseUrl } from '../utils/aiProvider'
 
 async function getClient(aiSettings: SupportSettings['ai']) {
   const moduleName = '@anthropic-ai/sdk'
   const { default: Anthropic } = await import(moduleName)
   if (aiSettings.provider === 'ollama') {
-    const baseURL = process.env.OLLAMA_API_URL || 'https://ollama.orkelis.app/v1'
+    const baseURL = resolveOllamaBaseUrl()
     return new Anthropic({ apiKey: 'ollama', baseURL })
   }
   return new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY })
@@ -28,11 +29,11 @@ const CACHE_TTL_MS = 24 * 60 * 60 * 1000 // 24 hours
  * Force-refreshes the summary.
  */
 export function createClientIntelligenceEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint[] {
-  const limiter = new RateLimiter(60_000, 20, store)
+  const limiter = new RateLimiter(60_000, 20, store, 'client-intelligence')
   const getHandler = async (req: PayloadRequest) => {
     try {
       requireAdmin(req, slugs)
-      if (await limiter.check(String(req.user!.id), req)) {
+      if (await limiter.check(principalRateKey(req.user), req)) {
         return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
       }
       const payload = req.payload
@@ -70,7 +71,7 @@ export function createClientIntelligenceEndpoint(slugs: CollectionSlugs, store?:
   const postHandler = async (req: PayloadRequest) => {
     try {
       requireAdmin(req, slugs)
-      if (await limiter.check(String(req.user!.id), req)) {
+      if (await limiter.check(principalRateKey(req.user), req)) {
         return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
       }
       const payload = req.payload

package/src/endpoints/email-stats.ts

@@ -1,12 +1,23 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
+import { handleAuthError, requireAdmin } from '../utils/auth'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbFind } from '../utils/db'
 
 /**
  * GET /api/support/email-stats?days=7
  * Aggregates EmailLogs data for the tracking dashboard. Admin-only.
+ *
+ * The guard used to be `!!req.user`, which ANY authenticated principal
+ * satisfies — a support-client, or a member of any other auth collection of the
+ * host app. That leaked the operational aggregate of `email-logs` (volume,
+ * failure rate, per-day and per-action breakdown) even though the collection's
+ * own `read` is staff-only, because the pages below are fetched with
+ * `overrideAccess: true`. It also handed any account an amplification primitive:
+ * up to 25 000 rows read and materialised per call, with no rate limit.
  */
-export function createEmailStatsEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createEmailStatsEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
+  const statsLimiter = new RateLimiter(60_000, 20, store, 'email-stats')
   return {
     path: '/support/email-stats',
     method: 'get',
@@ -14,8 +25,11 @@ export function createEmailStatsEndpoint(slugs: CollectionSlugs): Endpoint {
       try {
         const payload = req.payload
 
-        if (!req.user) {
-          return Response.json({ error: 'Unauthorized' }, { status: 401 })
+        requireAdmin(req, slugs)
+
+        // Keyed on the authenticated user id, not on a spoofable header.
+        if (await statsLimiter.check(principalRateKey(req.user), req)) {
+          return Response.json({ error: 'Too many requests.' }, { status: 429 })
         }
 
         const url = new URL(req.url!)
@@ -101,6 +115,8 @@ export function createEmailStatsEndpoint(slugs: CollectionSlugs): Endpoint {
           actions: Object.fromEntries(actionMap),
         })
       } catch (err) {
+        const authResponse = handleAuthError(err)
+        if (authResponse) return authResponse
         console.error('[email-stats] Error:', err)
         return Response.json({ error: 'Internal server error' }, { status: 500 })
       }

package/src/endpoints/import-conversation.ts

@@ -132,7 +132,7 @@ ONLY JSON, nothing else.`,
  * Import a conversation from markdown into the ticket system.
  */
 export function createImportConversationEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const importLimiter = new RateLimiter(3_600_000, 10, store)
+  const importLimiter = new RateLimiter(3_600_000, 10, store, 'import-conversation')
   return {
     path: '/support/import-conversation',
     method: 'post',

package/src/endpoints/index.ts

@@ -199,7 +199,7 @@ export function createSupportEndpoints(slugs: CollectionSlugs, options?: Support
   }
   if (!f || f.satisfaction !== false) endpoints.push(createSatisfactionEndpoint(slugs))
   if (!f || f.emailTracking !== false) {
-    endpoints.push(createEmailStatsEndpoint(slugs), createTrackOpenEndpoint(slugs))
+    endpoints.push(createEmailStatsEndpoint(slugs, rateLimitStore), createTrackOpenEndpoint(slugs))
   }
   if (!f || f.pendingEmails !== false) endpoints.push(createPendingEmailsProcessEndpoint(slugs))
   if (!f || f.scheduledReplies !== false) endpoints.push(createProcessScheduledEndpoint(slugs))

package/src/endpoints/invite-collaborator.ts

@@ -4,7 +4,7 @@ import { handleAuthError, AuthError } from '../utils/auth'
 import { escapeHtml, emailWrapper, emailButton, emailParagraph } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
 import { randomBytes } from 'crypto'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbFindByID, dbFind, dbCreate, dbUpdate, dbCount } from '../utils/db'
 
 const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
@@ -13,6 +13,21 @@ const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
 // email, so cap both the volume per user and the collaborators per ticket.
 const MAX_COLLABORATORS_PER_TICKET = 20
 
+/**
+ * Long-window ceiling on ACCOUNT CREATIONS per inviter.
+ *
+ * The two existing quotas are per hour (10 invites) and per ticket (20
+ * collaborators); neither bounds the total number of `support-clients` rows a
+ * single client can conjure, nor the total number of third parties it can mail,
+ * since a client can open as many tickets as it wants. This one is only consumed
+ * when the invited address has NO account yet — inviting an existing client
+ * (the normal case) never touches it.
+ *
+ * Applied to support-clients only: staff onboarding is a legitimate bulk flow.
+ */
+const MAX_NEW_ACCOUNTS_PER_INVITER = 30
+const NEW_ACCOUNT_WINDOW_MS = 7 * 24 * 60 * 60 * 1000
+
 /**
  * POST /api/support/tickets/:id/invite
  *
@@ -31,7 +46,8 @@ const MAX_COLLABORATORS_PER_TICKET = 20
  *  - Returns { ok, invitedTo, role }.
  */
 export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const inviteLimiter = new RateLimiter(60 * 60 * 1000, 10, store)
+  const inviteLimiter = new RateLimiter(60 * 60 * 1000, 10, store, 'invite-collaborator')
+  const newAccountLimiter = new RateLimiter(NEW_ACCOUNT_WINDOW_MS, MAX_NEW_ACCOUNTS_PER_INVITER, store, 'invite-collaborator:new-account')
   return {
     path: '/support/tickets/:id/invite',
     method: 'post',
@@ -75,7 +91,7 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs, store?:
         }
 
         // Anti-abuse: cap invite volume per user (in-memory, fail-closed).
-        if (await inviteLimiter.check(String(req.user.id), req)) {
+        if (await inviteLimiter.check(principalRateKey(req.user), req)) {
           return Response.json({ error: 'Trop d\'invitations. Réessayez plus tard.' }, { status: 429 })
         }
 
@@ -107,6 +123,16 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs, store?:
         if (existing.docs.length > 0) {
           inviteeId = (existing.docs[0] as any).id
         } else {
+          // Creating an account for an address nobody vouched for — bounded over a
+          // long window so the endpoint cannot be used to mass-create ghost
+          // accounts and mail arbitrary third parties.
+          if (!isAdmin && await newAccountLimiter.check(principalRateKey(req.user), req)) {
+            return Response.json(
+              { error: 'Trop de nouveaux comptes invités. Réessayez plus tard.' },
+              { status: 429 },
+            )
+          }
+
           // Create a placeholder client; password is random — the invitee will reset
           // via the forgotPassword flow triggered by the SupportClients afterChange hook.
           const tempPassword = randomBytes(16).toString('hex')

package/src/endpoints/login.ts

@@ -2,6 +2,7 @@ import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbCreate } from '../utils/db'
+import { issueTwoFactorChallenge } from '../utils/twoFactorChallenge'
 
 
 /**
@@ -9,7 +10,7 @@ import { dbCreate } from '../utils/db'
  * Client login endpoint.
  */
 export function createLoginEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const loginLimiter = new RateLimiter(15 * 60_000, 10, store)
+  const loginLimiter = new RateLimiter(15 * 60_000, 10, store, 'login')
   return {
     path: '/support/login',
     method: 'post',
@@ -75,8 +76,20 @@ export function createLoginEndpoint(slugs: CollectionSlugs, store?: RateLimitSto
 
         // 2FA gate: password was correct but a fresh 2FA verification is required.
         // No session/cookie is issued (Payload rolled it back on the throw).
+        //
+        // The password check just succeeded, so this is where the short-lived
+        // proof for `POST /support/2fa {action:'send'}` is minted: without it,
+        // that endpoint would keep letting an anonymous caller burn a victim's
+        // send quota and lock them out of their own account.
         if (errorMessage.includes('2FA_REQUIRED')) {
-          return Response.json({ requires2FA: true }, { status: 200 })
+          let challenge: string | undefined
+          try {
+            challenge = issueTwoFactorChallenge(email)
+          } catch {
+            // PAYLOAD_SECRET missing: 2FA cannot operate at all (codes are
+            // hashed with it). Answer without a challenge — fail closed.
+          }
+          return Response.json({ requires2FA: true, ...(challenge ? { challenge } : {}) }, { status: 200 })
         }
 
         let errorReason = 'Identifiants incorrects'