@consilioweb/payload-support 2.0.1 → 4.0.0

package/src/endpoints/oauth-google.ts

@@ -3,16 +3,74 @@ import { getFieldsToSign, jwtSign } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import crypto from 'crypto'
 import { dbFind, dbUpdate, dbCreate, dbFindByID } from '../utils/db'
+import { issueTwoFactorChallenge } from '../utils/twoFactorChallenge'
 
 /**
  * POST /api/support/oauth/google
  * Google OAuth — handles both login redirect and callback.
- * Body: { action: 'login' } or { code: string, state: string, cookieState: string }
+ * Body: { action: 'login' } or { code: string, state: string }
+ *
+ * The CSRF state is NOT taken from the body: `action: 'login'` issues it as an
+ * HttpOnly cookie and the callback reads it back from the `Cookie` header.
  */
 export interface OAuthGoogleOptions {
   allowedEmailDomains?: string[]
 }
 
+/** Name of the HttpOnly cookie carrying the CSRF state between the two steps. */
+export const OAUTH_STATE_COOKIE = 'support-oauth-state'
+
+/** Same window as the Google authorization code: 10 minutes is plenty. */
+const OAUTH_STATE_MAX_AGE = 600
+
+/**
+ * A successful `/support/2fa` verify stamps `twoFactorVerifiedAt`; the marker is
+ * valid for this window then consumed. Mirrors `TWO_FA_WINDOW_MS` in
+ * `collections/SupportClients.ts` — the two MUST stay in sync.
+ */
+const TWO_FA_WINDOW_MS = 5 * 60 * 1000
+
+/**
+ * Read one cookie from the request's own `Cookie` header.
+ *
+ * The callback used to compare `state` against a `cookieState` ALSO taken from
+ * the JSON body: two values from the same attacker-controlled place, so the CSRF
+ * check was a no-op for any non-browser caller (send the same string twice). The
+ * state is now issued as an HttpOnly cookie at the `login` step and read back
+ * here, server-side — the only place a browser cannot forge it from script.
+ */
+export function readCookie(header: string | null | undefined, name: string): string | null {
+  if (!header) return null
+  for (const part of header.split(';')) {
+    const eq = part.indexOf('=')
+    if (eq === -1) continue
+    if (part.slice(0, eq).trim() !== name) continue
+    try {
+      return decodeURIComponent(part.slice(eq + 1).trim())
+    } catch {
+      return part.slice(eq + 1).trim()
+    }
+  }
+  return null
+}
+
+/**
+ * Expire the state cookie: it is single-use, and leaving it live for the rest of
+ * its 10 minutes keeps a consumed CSRF token replayable for no benefit.
+ */
+export function clearedStateCookie(): string {
+  const secure = process.env.NODE_ENV === 'production'
+  return `${OAUTH_STATE_COOKIE}=; HttpOnly; ${secure ? 'Secure; ' : ''}SameSite=Lax; Path=/; Max-Age=0`
+}
+
+/** Constant-time comparison — the state is a secret for the length of the flow. */
+function statesMatch(a: string | null | undefined, b: string | null | undefined): boolean {
+  if (!a || !b) return false
+  const left = crypto.createHash('sha256').update(a).digest()
+  const right = crypto.createHash('sha256').update(b).digest()
+  return crypto.timingSafeEqual(left, right)
+}
+
 export function createOAuthGoogleEndpoint(slugs: CollectionSlugs, options?: OAuthGoogleOptions): Endpoint {
   return {
     path: '/support/oauth/google',
@@ -31,7 +89,7 @@ export function createOAuthGoogleEndpoint(slugs: CollectionSlugs, options?: OAut
 
       try {
         const body = await req.json!()
-        const { action, code, state: queryState, cookieState } = body
+        const { action, code, state: queryState } = body
 
         // Step 1: Generate OAuth URL
         if (action === 'login') {
@@ -46,16 +104,30 @@ export function createOAuthGoogleEndpoint(slugs: CollectionSlugs, options?: OAut
             prompt: 'select_account',
           })
 
-          return Response.json({
-            url: `https://accounts.google.com/o/oauth2/v2/auth?${params}`,
-            state: oauthState,
-          })
+          const secure = process.env.NODE_ENV === 'production'
+          const loginHeaders = new Headers({ 'Content-Type': 'application/json' })
+          loginHeaders.append(
+            'Set-Cookie',
+            `${OAUTH_STATE_COOKIE}=${oauthState}; HttpOnly; ${secure ? 'Secure; ' : ''}SameSite=Lax; Path=/; Max-Age=${OAUTH_STATE_MAX_AGE}`,
+          )
+
+          return new Response(
+            JSON.stringify({
+              url: `https://accounts.google.com/o/oauth2/v2/auth?${params}`,
+              // Kept for callers that echo it back in the redirect URL; the
+              // server no longer trusts anything the caller returns.
+              state: oauthState,
+            }),
+            { status: 200, headers: loginHeaders },
+          )
         }
 
         // Step 2: Handle callback (code exchange)
         if (code) {
-          // Validate state
-          if (!cookieState || !queryState || cookieState !== queryState) {
+          // Validate state against the HttpOnly cookie set at the `login` step —
+          // NOT against a second copy taken from the request body.
+          const issuedState = readCookie(req.headers.get('cookie'), OAUTH_STATE_COOKIE)
+          if (!statesMatch(issuedState, queryState)) {
             return Response.json({ error: 'state_mismatch' }, { status: 400 })
           }
 
@@ -158,6 +230,54 @@ export function createOAuthGoogleEndpoint(slugs: CollectionSlugs, options?: OAut
             }) as { id: number | string; email: string }
           }
 
+          // Replay the 2FA rule BEFORE minting anything.
+          //
+          // This path never calls `payload.login`, so the `beforeLogin` hook
+          // `createEnforce2FA` (collections/SupportClients.ts) never runs: a
+          // client who turned 2FA on from the portal profile page could skip it
+          // entirely by clicking "Sign in with Google". Same contract as
+          // `endpoints/login.ts`: no token, `{ requires2FA: true }`, and the
+          // verified marker is single-use.
+          const twoFactorDoc = (await dbFindByID(payload, slugs.supportClients, {
+            id: clientDoc.id,
+            depth: 0,
+            overrideAccess: true,
+            showHiddenFields: true,
+          })) as { twoFactorEnabled?: boolean; twoFactorVerifiedAt?: string | null }
+
+          if (twoFactorDoc?.twoFactorEnabled) {
+            const raw = twoFactorDoc.twoFactorVerifiedAt
+            const verifiedAt = raw ? new Date(raw).getTime() : 0
+            if (!(verifiedAt > Date.now() - TWO_FA_WINDOW_MS)) {
+              // The authorization code is spent: the client has to restart the
+              // whole flow after verifying, so the state goes with it.
+              //
+              // Google just proved this identity, so the client is entitled to
+              // request a code: hand out the same short-lived challenge
+              // `endpoints/login.ts` mints, or `POST /support/2fa` would refuse
+              // to send one.
+              let challenge: string | undefined
+              try {
+                challenge = issueTwoFactorChallenge(clientDoc.email)
+              } catch {
+                // PAYLOAD_SECRET missing — 2FA is inoperable anyway; fail closed.
+              }
+              return new Response(JSON.stringify({ requires2FA: true, ...(challenge ? { challenge } : {}) }), {
+                status: 200,
+                headers: new Headers({
+                  'Content-Type': 'application/json',
+                  'Set-Cookie': clearedStateCookie(),
+                }),
+              })
+            }
+            // Consume the marker so the verified window cannot be replayed.
+            await dbUpdate(payload, slugs.supportClients, {
+              id: clientDoc.id,
+              data: { twoFactorVerifiedAt: null },
+              overrideAccess: true,
+            })
+          }
+
           // Mint a Payload session WITHOUT touching the user's password.
           // Uses Payload's own jwtSign/getFieldsToSign so the token format matches
           // exactly, and replicates addSessionToUser for the sessions array.
@@ -209,6 +329,8 @@ export function createOAuthGoogleEndpoint(slugs: CollectionSlugs, options?: OAut
             'Set-Cookie',
             `payload-token=${token}; HttpOnly; ${cookieSecure ? 'Secure; ' : ''}SameSite=Lax; Path=/; Max-Age=${tokenExpiration}`,
           )
+          // The state has done its job — do not leave it replayable.
+          headers.append('Set-Cookie', clearedStateCookie())
 
           return new Response(JSON.stringify({ user: clientDoc, exp }), {
             status: 200,

package/src/endpoints/process-scheduled.ts

@@ -1,7 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { escapeHtml } from '../utils/emailTemplate'
-import { fireWebhooks } from '../utils/fireWebhooks'
+import { dispatchWebhook } from '../utils/webhookDispatcher'
 import { readSupportSettings } from '../utils/readSettings'
 import { dbFind, dbFindByID, dbUpdate } from '../utils/db'
 import { verifySecret } from '../utils/webhookSecurity'
@@ -112,13 +112,18 @@ export function createProcessScheduledEndpoint(slugs: CollectionSlugs): Endpoint
             }
 
             // Fire webhook for the now-sent reply
-            fireWebhooks(payload, slugs, 'ticket_replied', {
-              ticketId,
-              messageId: msg.id,
-              authorType: msg.authorType,
-              scheduled: true,
-              body: msg.body?.length > 500 ? msg.body.slice(0, 500) + '...' : msg.body,
-            })
+            dispatchWebhook(
+              {
+                ticketId,
+                messageId: msg.id,
+                authorType: msg.authorType,
+                scheduled: true,
+                body: msg.body?.length > 500 ? msg.body.slice(0, 500) + '...' : msg.body,
+              },
+              'ticket_replied',
+              payload,
+              slugs,
+            )
 
             results.processed++
           } catch (err) {

package/src/endpoints/resend-notification.ts

@@ -1,7 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { escapeHtml } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
 import { dbFindByID } from '../utils/db'
@@ -12,7 +12,7 @@ import { dbFindByID } from '../utils/db'
  * Resend the email notification for a specific ticket message. Admin-only.
  */
 export function createResendNotificationEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const resendLimiter = new RateLimiter(60 * 60 * 1000, 10, store)
+  const resendLimiter = new RateLimiter(60 * 60 * 1000, 10, store, 'resend-notification')
   return {
     path: '/support/resend-notification',
     method: 'post',
@@ -22,7 +22,7 @@ export function createResendNotificationEndpoint(slugs: CollectionSlugs, store?:
 
         requireAdmin(req, slugs)
 
-        if (await resendLimiter.check(String(req.user.id), req)) {
+        if (await resendLimiter.check(principalRateKey(req.user), req)) {
           return Response.json(
             { error: 'Trop de renvois. Réessayez dans une heure.' },
             { status: 429 },

package/src/endpoints/round-robin-config.ts

@@ -1,9 +1,24 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
-import { dbFind } from '../utils/db'
+import {
+  SUPPORT_SETTINGS_PREF_KEY as PREF_KEY,
+  invalidateSupportSettingsCache,
+  mergeSupportSettings,
+  readSupportSettingsState,
+} from '../utils/readSettings'
+import { stripProjectedFeatures } from '../utils/features'
 
-const PREF_KEY = 'support-round-robin'
+/**
+ * Round-robin used to live in its own `support-round-robin` preference row,
+ * while the admin UI toggled a `roundRobin` flag in `localStorage` — the two
+ * never met, so the toggle had no effect on assignment.
+ *
+ * Both endpoints below now read and write `settings.features.roundRobin`, the
+ * same value `/api/support/settings` exposes and `Tickets`' auto-assign hook
+ * reads. The legacy row is still honoured on read until the first save (see
+ * `readSupportSettingsState`), so an install that had it enabled keeps it.
+ */
 
 /**
  * GET /api/support/round-robin-config — Get round-robin enabled status
@@ -18,18 +33,9 @@ export function createRoundRobinConfigGetEndpoint(slugs: CollectionSlugs): Endpo
 
         requireAdmin(req, slugs)
 
-        const prefs = await dbFind(payload, 'payload-preferences', {
-          where: { key: { equals: PREF_KEY } },
-          limit: 1,
-          depth: 0,
-          overrideAccess: true,
-        })
-
-        const enabled = prefs.docs.length > 0
-          ? (prefs.docs[0].value as { enabled?: boolean })?.enabled === true
-          : false
+        const { settings } = await readSupportSettingsState(payload)
 
-        return Response.json({ enabled })
+        return Response.json({ enabled: settings.features.roundRobin })
       } catch (error) {
         const authResponse = handleAuthError(error)
         if (authResponse) return authResponse
@@ -55,19 +61,21 @@ export function createRoundRobinConfigPostEndpoint(slugs: CollectionSlugs): Endp
 
         const { enabled } = (await req.json!()) as { enabled: boolean }
 
-        const existing = await dbFind(payload, 'payload-preferences', {
-          where: { key: { equals: PREF_KEY } },
-          limit: 1,
-          depth: 0,
-          overrideAccess: true,
-        })
+        const { settings: current } = await readSupportSettingsState(payload)
+        const merged = mergeSupportSettings(
+          { features: { ...current.features, roundRobin: !!enabled } },
+          current,
+        )
 
         await payload.db.upsert({
           collection: 'payload-preferences',
           data: {
             key: PREF_KEY,
             user: { relationTo: req.user!.collection, value: req.user!.id },
-            value: { enabled: !!enabled },
+            value: {
+              ...merged,
+              features: stripProjectedFeatures(merged.features),
+            } as unknown as Record<string, unknown>,
           },
           req: { payload, user: req.user } as any,
           where: {
@@ -79,6 +87,8 @@ export function createRoundRobinConfigPostEndpoint(slugs: CollectionSlugs): Endp
           },
         })
 
+        invalidateSupportSettingsCache()
+
         return Response.json({ enabled: !!enabled })
       } catch (error) {
         const authResponse = handleAuthError(error)

package/src/endpoints/send-reminder.ts

@@ -1,7 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { escapeHtml, emailWrapper, emailParagraph, emailButton } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
 import { dbFindByID, dbFind, dbCreate, dbUpdate } from '../utils/db'
@@ -38,7 +38,7 @@ function formatFr(date: Date, withTime: boolean): string {
  * Admin-only, rate-limited.
  */
 export function createSendReminderEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const reminderLimiter = new RateLimiter(60 * 60 * 1000, 30, store)
+  const reminderLimiter = new RateLimiter(60 * 60 * 1000, 30, store, 'send-reminder')
   return {
     path: '/support/send-reminder',
     method: 'post',
@@ -48,7 +48,7 @@ export function createSendReminderEndpoint(slugs: CollectionSlugs, store?: RateL
 
         requireAdmin(req, slugs)
 
-        if (await reminderLimiter.check(String(req.user.id), req)) {
+        if (await reminderLimiter.check(principalRateKey(req.user), req)) {
           return Response.json(
             { error: 'Trop de relances. Réessayez dans une heure.' },
             { status: 429 },

package/src/endpoints/settings.ts

@@ -1,59 +1,21 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
-import { invalidateSupportSettingsCache } from '../utils/readSettings'
-import { dbFind } from '../utils/db'
-
-const PREF_KEY = 'support-settings'
-
-interface SupportSettings {
-  email: {
-    fromAddress: string
-    fromName: string
-    replyToAddress: string
-  }
-  ai: {
-    provider: 'anthropic' | 'openai' | 'gemini' | 'ollama'
-    model: string
-    enableSentiment: boolean
-    enableSynthesis: boolean
-    enableSuggestion: boolean
-    enableRewrite: boolean
-  }
-  sla: {
-    firstResponseMinutes: number
-    resolutionMinutes: number
-    businessHoursOnly: boolean
-    escalationEmail: string
-  }
-  autoClose: {
-    enabled: boolean
-    daysBeforeClose: number
-    reminderDaysBefore: number
-  }
-}
-
-const DEFAULT_SUPPORT_SETTINGS: SupportSettings = {
-  email: { fromAddress: '', fromName: 'Support', replyToAddress: '' },
-  ai: {
-    provider: 'anthropic',
-    model: 'claude-haiku-4-5-20251001',
-    enableSentiment: true,
-    enableSynthesis: true,
-    enableSuggestion: true,
-    enableRewrite: true,
-  },
-  sla: {
-    firstResponseMinutes: 120,
-    resolutionMinutes: 1440,
-    businessHoursOnly: true,
-    escalationEmail: '',
-  },
-  autoClose: { enabled: true, daysBeforeClose: 7, reminderDaysBefore: 2 },
-}
+import {
+  SUPPORT_SETTINGS_PREF_KEY as PREF_KEY,
+  invalidateSupportSettingsCache,
+  mergeSupportSettings,
+  readSupportSettingsState,
+  type SupportSettings,
+} from '../utils/readSettings'
+import { stripProjectedFeatures } from '../utils/features'
 
 /**
  * GET /api/support/settings — Read support settings
+ *
+ * `featuresConfigured` tells the admin UI whether the server has ever had
+ * feature flags saved; a client still holding pre-2.1 `localStorage` flags uses
+ * it to seed the server once instead of losing its configuration.
  */
 export function createSettingsGetEndpoint(slugs: CollectionSlugs): Endpoint {
   return {
@@ -65,25 +27,9 @@ export function createSettingsGetEndpoint(slugs: CollectionSlugs): Endpoint {
 
         requireAdmin(req, slugs)
 
-        const prefs = await dbFind(payload, 'payload-preferences', {
-          where: { key: { equals: PREF_KEY } },
-          limit: 1,
-          depth: 0,
-          overrideAccess: true,
-        })
-
-        let settings = { ...DEFAULT_SUPPORT_SETTINGS }
-        if (prefs.docs.length > 0) {
-          const stored = prefs.docs[0].value as Partial<SupportSettings>
-          settings = {
-            email: { ...DEFAULT_SUPPORT_SETTINGS.email, ...stored.email },
-            ai: { ...DEFAULT_SUPPORT_SETTINGS.ai, ...stored.ai },
-            sla: { ...DEFAULT_SUPPORT_SETTINGS.sla, ...stored.sla },
-            autoClose: { ...DEFAULT_SUPPORT_SETTINGS.autoClose, ...stored.autoClose },
-          }
-        }
+        const { settings, featuresConfigured } = await readSupportSettingsState(payload)
 
-        return Response.json(settings)
+        return Response.json({ ...settings, featuresConfigured })
       } catch (error) {
         const authResponse = handleAuthError(error)
         if (authResponse) return authResponse
@@ -95,7 +41,11 @@ export function createSettingsGetEndpoint(slugs: CollectionSlugs): Endpoint {
 }
 
 /**
- * POST /api/support/settings — Save all support settings (admin-only)
+ * POST /api/support/settings — Save support settings (admin-only)
+ *
+ * The body is merged onto the CURRENT settings, not onto the defaults: the
+ * feature-flag screen posts `{ features }` alone, and that must not reset the
+ * email / AI / SLA blocks.
  */
 export function createSettingsPostEndpoint(slugs: CollectionSlugs): Endpoint {
   return {
@@ -109,19 +59,20 @@ export function createSettingsPostEndpoint(slugs: CollectionSlugs): Endpoint {
 
         const body = (await req.json!()) as Partial<SupportSettings>
 
-        const merged: SupportSettings = {
-          email: { ...DEFAULT_SUPPORT_SETTINGS.email, ...body.email },
-          ai: { ...DEFAULT_SUPPORT_SETTINGS.ai, ...body.ai },
-          sla: { ...DEFAULT_SUPPORT_SETTINGS.sla, ...body.sla },
-          autoClose: { ...DEFAULT_SUPPORT_SETTINGS.autoClose, ...body.autoClose },
-        }
+        const { settings: current } = await readSupportSettingsState(payload)
+        const merged = mergeSupportSettings(body, current)
 
         await payload.db.upsert({
           collection: 'payload-preferences',
           data: {
             key: PREF_KEY,
             user: { relationTo: req.user!.collection, value: req.user!.id },
-            value: merged as unknown as Record<string, unknown>,
+            value: {
+              ...merged,
+              // Persist the flags without the two projected ones, so `features`
+              // and the `autoClose` block can never drift apart.
+              features: stripProjectedFeatures(merged.features),
+            } as unknown as Record<string, unknown>,
           },
           req: { payload, user: req.user } as any,
           where: {
@@ -135,7 +86,7 @@ export function createSettingsPostEndpoint(slugs: CollectionSlugs): Endpoint {
 
         invalidateSupportSettingsCache()
 
-        return Response.json(merged)
+        return Response.json({ ...merged, featuresConfigured: true })
       } catch (error) {
         const authResponse = handleAuthError(error)
         if (authResponse) return authResponse

package/src/endpoints/signature.ts

@@ -19,7 +19,14 @@ export function createSignatureGetEndpoint(slugs: CollectionSlugs): Endpoint {
         requireAdmin(req, slugs)
 
         const prefs = await dbFind(payload, 'payload-preferences', {
-          where: { key: { equals: `${PREF_KEY}-${req.user.id}` } },
+          // Scope to the staff auth collection: `payload-preferences` accepts a
+          // write from ANY authenticated principal, and ids collide between auth
+          // collections — a support-client with the same id would otherwise own
+          // the `email-signature-<id>` row read back for the agent.
+          where: {
+            key: { equals: `${PREF_KEY}-${req.user.id}` },
+            'user.relationTo': { equals: slugs.users },
+          },
           limit: 1,
           depth: 0,
           overrideAccess: true,
@@ -57,7 +64,7 @@ export function createSignaturePostEndpoint(slugs: CollectionSlugs): Endpoint {
         const key = `${PREF_KEY}-${req.user.id}`
 
         const existing = await dbFind(payload, 'payload-preferences', {
-          where: { key: { equals: key } },
+          where: { key: { equals: key }, 'user.relationTo': { equals: slugs.users } },
           limit: 1,
           depth: 0,
           overrideAccess: true,

package/src/endpoints/ticket-synthesis.ts

@@ -4,7 +4,7 @@ import { requireAdmin, handleAuthError } from '../utils/auth'
 import { generateTicketSynthesis } from '../utils/generateTicketSynthesis'
 import { dbFindByID } from '../utils/db'
 import type { SupportCapabilities } from '../types'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 
 /**
  * POST /api/support/ticket-synthesis?ticketId=X[&force=true]
@@ -23,14 +23,14 @@ export function createTicketSynthesisEndpoint(
   generator?: SupportCapabilities['aiSummaries'],
   store?: RateLimitStore,
 ): Endpoint {
-  const limiter = new RateLimiter(60_000, 20, store)
+  const limiter = new RateLimiter(60_000, 20, store, 'ticket-synthesis')
   return {
     path: '/support/ticket-synthesis',
     method: 'post',
     handler: async (req) => {
       try {
         requireAdmin(req, slugs)
-        if (await limiter.check(String(req.user!.id), req)) {
+        if (await limiter.check(principalRateKey(req.user), req)) {
           return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
         }
         const payload = req.payload

package/src/endpoints/transfer-ticket.ts

@@ -3,7 +3,7 @@ import type { CollectionSlugs } from '../utils/slugs'
 import { handleAuthError, AuthError } from '../utils/auth'
 import { escapeHtml, emailWrapper, emailButton, emailParagraph } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbFindByID, dbFind, dbCreate, dbCount } from '../utils/db'
 
 // Simple RFC-5322 style sanity check — same level of strictness as the
@@ -13,6 +13,21 @@ const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
 
 const MAX_TRANSFERS_PER_DAY = 5
 
+/**
+ * Per-USER ceiling, ticket-independent.
+ *
+ * Both existing quotas (the in-memory limiter keyed `<user>:<ticket>` and the
+ * `email-logs` count) are per TICKET, and a support-client can open as many
+ * tickets as they want — so "5 transfers / 24 h" resets on every new ticket and
+ * the endpoint is an unbounded outbound mailer: the operator's From address, a
+ * "Récapitulatif support" subject, and 1 000 characters chosen by the caller,
+ * to any mailbox. This second quota is what actually bounds the volume.
+ *
+ * Applied to support-clients only: staff already hold the whole mailing surface
+ * of the admin panel, and capping them here would break legitimate bulk recaps.
+ */
+const MAX_TRANSFERS_PER_USER_PER_DAY = 15
+
 // In-memory fail-closed rate limiter — enforced even when the persistent
 // emailLogs-based check is unavailable (collection disabled). Prevents the
 // endpoint from becoming an unbounded outbound mailer.
@@ -33,7 +48,8 @@ const MAX_TRANSFERS_PER_DAY = 5
  *  - Rate-limited to 5 transfers per ticket per 24h
  */
 export function createTransferTicketEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const transferLimiter = new RateLimiter(24 * 60 * 60 * 1000, MAX_TRANSFERS_PER_DAY, store)
+  const transferLimiter = new RateLimiter(24 * 60 * 60 * 1000, MAX_TRANSFERS_PER_DAY, store, 'transfer:ticket')
+  const transferUserLimiter = new RateLimiter(24 * 60 * 60 * 1000, MAX_TRANSFERS_PER_USER_PER_DAY, store, 'transfer:user')
   return {
     path: '/support/tickets/:id/transfer',
     method: 'post',
@@ -82,13 +98,22 @@ export function createTransferTicketEndpoint(slugs: CollectionSlugs, store?: Rat
 
         // Fail-closed in-memory rate limit (per user + ticket): enforced even
         // when the persistent emailLogs check below cannot run.
-        if (await transferLimiter.check(`${req.user.id}:${ticketId}`, req)) {
+        if (await transferLimiter.check(`${principalRateKey(req.user)}:${ticketId}`, req)) {
           return Response.json(
             { error: `Limite atteinte (${MAX_TRANSFERS_PER_DAY} transferts par 24h sur ce ticket)` },
             { status: 429 },
           )
         }
 
+        // Ticket-independent quota — the per-ticket ones above reset on every
+        // newly created ticket, which a client can do at will.
+        if (!isAdmin && await transferUserLimiter.check(principalRateKey(req.user), req)) {
+          return Response.json(
+            { error: `Limite atteinte (${MAX_TRANSFERS_PER_USER_PER_DAY} transferts par 24h)` },
+            { status: 429 },
+          )
+        }
+
         // Rate limit: count transfers in last 24h for this ticket
         try {
           const since = new Date(Date.now() - 24 * 60 * 60 * 1000).toISOString()