@consilioweb/payload-support 2.0.1 → 4.0.0

package/src/utils/ticketAccess.ts

@@ -13,11 +13,24 @@ import { dbFind } from './db'
  *
  * Returns an empty array when the client has no accessible tickets — callers MUST
  * treat that as "deny" (e.g. filter on a sentinel id) rather than "allow all".
+ *
+ * `mode` selects which of the two scopes is wanted:
+ *  - `'read'` (default) — owned tickets + every ticket collaborated on, whatever
+ *    the role. This is the historical behaviour and what `access.read` needs.
+ *  - `'write'` — owned tickets + collaborated tickets whose row carries
+ *    `role === 'collaborator'`. The invitation endpoint offers two roles and the
+ *    invitation email promises "lecteur (consultation)" for `viewer`, but nothing
+ *    ever read the field back: a viewer could post into the thread and trigger the
+ *    whole notification chain. Rows with no explicit role are treated as viewers
+ *    (the collection's own `defaultValue`), i.e. read-only — fail closed.
  */
+export type TicketAccessMode = 'read' | 'write'
+
 export async function resolveAccessibleTicketIds(
   payload: Payload,
   slugs: CollectionSlugs,
   clientId: number | string,
+  mode: TicketAccessMode = 'read',
 ): Promise<Array<number | string>> {
   const ids = new Set<number | string>()
 
@@ -41,7 +54,9 @@ export async function resolveAccessibleTicketIds(
       overrideAccess: true,
     })
     for (const r of collab.docs) {
-      const row = r as { ticket?: number | string | { id?: number | string } }
+      const row = r as { ticket?: number | string | { id?: number | string }; role?: string }
+      // `viewer` (and any row without an explicit role) grants read only.
+      if (mode === 'write' && row.role !== 'collaborator') continue
       const tid = typeof row.ticket === 'object' ? row.ticket?.id : row.ticket
       if (tid !== undefined && tid !== null) ids.add(tid)
     }

package/src/utils/twoFactorChallenge.ts

@@ -0,0 +1,80 @@
+import { createHmac, timingSafeEqual } from 'crypto'
+
+/**
+ * Proof that the password step already succeeded for this email address.
+ *
+ * `POST /support/2fa {action:'send'}` used to accept an email and nothing else.
+ * Its only guard was a limiter keyed on that email — 3 sends per hour — so an
+ * ANONYMOUS caller who knew a victim's address (they circulate in ticket threads
+ * and email copies) could burn the quota in three requests and leave the victim
+ * unable to obtain the code their own login now demands. Since the OAuth path
+ * enforces 2FA as well, that was a complete, renewable account lockout, plus an
+ * outbound-email amplifier and a way to overwrite a code already in flight.
+ *
+ * The fix keys the consumable resource to something the ATTACKER cannot produce:
+ * a short-lived signature issued only by a successful password (or Google)
+ * authentication. Same HMAC-over-PAYLOAD_SECRET construction as the tracking
+ * pixel, no storage, no new dependency.
+ *
+ * Format: `<expiry-ms>.<hex hmac>`. The signature covers the email AND the
+ * expiry, so neither can be swapped without invalidating the token, and a token
+ * issued for one account is useless for another.
+ */
+
+/** Matches the 10-minute validity of the code the challenge lets you request. */
+export const TWO_FACTOR_CHALLENGE_TTL_MS = 10 * 60 * 1000
+
+function challengeSecret(): string {
+  const secret = process.env.PAYLOAD_SECRET
+  if (!secret) {
+    // Fail closed: the codes themselves are hashed with this secret, so 2FA is
+    // already inoperable without it — never fall back to a source-visible value.
+    throw new Error(
+      '[support][2fa] PAYLOAD_SECRET is not set — refusing to issue a 2FA challenge with an insecure fallback secret',
+    )
+  }
+  return secret
+}
+
+function normalizeEmail(email: string): string {
+  return String(email).trim().toLowerCase()
+}
+
+function sign(email: string, expiresAt: number): string {
+  return createHmac('sha256', challengeSecret())
+    .update(`2fa-challenge:${normalizeEmail(email)}:${expiresAt}`)
+    .digest('hex')
+}
+
+/** Issued by the login endpoints once credentials have been verified. */
+export function issueTwoFactorChallenge(email: string, now: number = Date.now()): string {
+  const expiresAt = now + TWO_FACTOR_CHALLENGE_TTL_MS
+  return `${expiresAt}.${sign(email, expiresAt)}`
+}
+
+/** Constant-time; false on any malformed, expired or foreign token. */
+export function verifyTwoFactorChallenge(
+  email: unknown,
+  token: unknown,
+  now: number = Date.now(),
+): boolean {
+  if (typeof email !== 'string' || !email || typeof token !== 'string') return false
+  const separator = token.indexOf('.')
+  if (separator <= 0) return false
+
+  const expiresAt = Number(token.slice(0, separator))
+  if (!Number.isSafeInteger(expiresAt) || expiresAt <= now) return false
+
+  const received = token.slice(separator + 1)
+  if (!/^[0-9a-f]{64}$/i.test(received)) return false
+
+  let expected: string
+  try {
+    expected = sign(email, expiresAt)
+  } catch {
+    return false // no secret configured — fail closed
+  }
+  const a = Buffer.from(expected, 'hex')
+  const b = Buffer.from(received.toLowerCase(), 'hex')
+  return a.length === b.length && timingSafeEqual(a, b)
+}

package/src/utils/urlSafety.ts

@@ -0,0 +1,230 @@
+import { lookup } from 'dns/promises'
+
+/**
+ * SSRF guards for every URL the SERVER follows on behalf of a user-supplied
+ * value (today: outbound webhook endpoints).
+ *
+ * `webhook-endpoints.url` is a plain `text` field with no validation, writable by
+ * any member of the staff collection, and `_sendToEndpoint` used to `fetch()` it
+ * with the default redirect policy. Pointing it at `http://169.254.169.254/…` or
+ * an internal service turned every ticket event into a blind SSRF, with the HTTP
+ * status echoed back into the admin through `lastStatus`.
+ *
+ * Three layers, because any one of them alone is bypassable:
+ *  1. `validateWebhookUrl` at WRITE time — rejects the scheme and the literal
+ *     private / loopback / link-local hosts before the row is saved.
+ *  2. `assertPublicHost` at SEND time — resolves the name and re-checks the
+ *     resolved addresses, so a DNS record flipped to 127.0.0.1 after the row was
+ *     validated is caught. It FAILS CLOSED: a resolution that errors, returns
+ *     nothing, or outruns `LOOKUP_TIMEOUT_MS` is treated as "do not connect".
+ *     Note the limit, honestly stated: `fetch` resolves the name a SECOND time,
+ *     so this narrows the rebinding window rather than closing it — closing it
+ *     would mean connecting to the address we validated (a custom dispatcher
+ *     lookup), which is a dependency this plugin does not take.
+ *  3. `safeFetch` follows redirects MANUALLY, re-running (1) and (2) on every
+ *     hop: a public host answering `302 Location: http://127.0.0.1:8080/` would
+ *     otherwise walk straight through the first two layers.
+ */
+
+/** Set `SUPPORT_ALLOW_INSECURE_WEBHOOKS=1` to allow plain http (local dev only). */
+function httpAllowed(): boolean {
+  return process.env.SUPPORT_ALLOW_INSECURE_WEBHOOKS === '1'
+}
+
+const BLOCKED_HOST_SUFFIXES = ['.local', '.localhost', '.internal', '.home.arpa']
+
+/** Dotted-quad only — no octal/hex shorthand, which `new URL()` normalises away anyway. */
+function parseIPv4(host: string): number[] | null {
+  const parts = host.split('.')
+  if (parts.length !== 4) return null
+  const octets: number[] = []
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part)) return null
+    const n = Number(part)
+    if (n > 255) return null
+    octets.push(n)
+  }
+  return octets
+}
+
+function isPrivateIPv4(octets: number[]): boolean {
+  const [a, b] = octets
+  if (a === 0) return true // "this network" / 0.0.0.0
+  if (a === 10) return true // 10/8
+  if (a === 127) return true // loopback
+  if (a === 169 && b === 254) return true // link-local, incl. cloud metadata
+  if (a === 172 && b >= 16 && b <= 31) return true // 172.16/12
+  if (a === 192 && b === 168) return true // 192.168/16
+  if (a === 192 && b === 0) return true // 192.0.0/24 + 192.0.2/24
+  if (a === 198 && (b === 18 || b === 19)) return true // benchmarking
+  if (a === 100 && b >= 64 && b <= 127) return true // CGNAT 100.64/10
+  if (a >= 224) return true // multicast + reserved + broadcast
+  return false
+}
+
+/**
+ * Handles the IPv4-mapped and IPv4-compatible forms — `::ffff:10.0.0.1` and
+ * `::ffff:a00:1` both reach 10.0.0.1 and both must be blocked.
+ */
+function isPrivateIPv6(host: string): boolean {
+  const lower = host.toLowerCase()
+  if (lower === '::' || lower === '::1') return true
+  if (lower.startsWith('fe8') || lower.startsWith('fe9') || lower.startsWith('fea') || lower.startsWith('feb')) return true // fe80::/10
+  if (lower.startsWith('fc') || lower.startsWith('fd')) return true // fc00::/7 unique-local
+  if (lower.startsWith('ff')) return true // multicast
+
+  // IPv4-mapped / -compatible, dotted form: ::ffff:10.0.0.1
+  const dotted = lower.match(/^::(?:ffff:)?(\d{1,3}(?:\.\d{1,3}){3})$/)
+  if (dotted) {
+    const octets = parseIPv4(dotted[1])
+    return octets ? isPrivateIPv4(octets) : true
+  }
+
+  // IPv4-mapped, hex form: ::ffff:a00:1
+  const hex = lower.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/)
+  if (hex) {
+    const high = parseInt(hex[1], 16)
+    const low = parseInt(hex[2], 16)
+    return isPrivateIPv4([high >> 8, high & 0xff, low >> 8, low & 0xff])
+  }
+
+  return false
+}
+
+/** Strips the brackets WHATWG URL keeps around an IPv6 literal. */
+function normalizeHost(hostname: string): string {
+  const host = hostname.trim().toLowerCase()
+  return host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host
+}
+
+/**
+ * True when the host is a literal address (or a name) that must never be
+ * reached from the server. Names that are not literals are NOT blocked here —
+ * they are resolved and re-checked by `assertPublicHost`.
+ */
+export function isBlockedHost(hostname: string): boolean {
+  const host = normalizeHost(hostname)
+  if (!host) return true
+  if (host === 'localhost') return true
+  if (BLOCKED_HOST_SUFFIXES.some((suffix) => host.endsWith(suffix))) return true
+
+  const v4 = parseIPv4(host)
+  if (v4) return isPrivateIPv4(v4)
+  if (host.includes(':')) return isPrivateIPv6(host)
+  return false
+}
+
+export interface UrlValidationResult {
+  ok: boolean
+  /** Machine-readable reason, also used as the field validation message. */
+  reason?: 'invalid_url' | 'scheme_not_allowed' | 'private_host'
+  url?: URL
+}
+
+/** Scheme + literal-host validation. Cheap, synchronous, safe to run in a field `validate`. */
+export function validateWebhookUrl(raw: unknown): UrlValidationResult {
+  if (typeof raw !== 'string' || !raw.trim()) return { ok: false, reason: 'invalid_url' }
+  let url: URL
+  try {
+    url = new URL(raw.trim())
+  } catch {
+    return { ok: false, reason: 'invalid_url' }
+  }
+  if (url.protocol !== 'https:' && !(url.protocol === 'http:' && httpAllowed())) {
+    return { ok: false, reason: 'scheme_not_allowed' }
+  }
+  if (isBlockedHost(url.hostname)) return { ok: false, reason: 'private_host' }
+  return { ok: true, url }
+}
+
+/** French messages for the collection field — mirrors the rest of the admin UI. */
+export const WEBHOOK_URL_MESSAGES: Record<NonNullable<UrlValidationResult['reason']>, string> = {
+  invalid_url: 'URL invalide.',
+  scheme_not_allowed: 'Seules les URL https:// sont acceptées.',
+  private_host: 'Les adresses privées, loopback et link-local sont interdites (SSRF).',
+}
+
+/**
+ * Resolve the name and reject unless EVERY resolved address is public.
+ *
+ * FAIL-CLOSED on anything that is not a clean answer. The previous version
+ * returned `true` on its own timeout, on an empty answer and on every error, on
+ * the theory that "`fetch` would fail the same way". A slow resolver is not a
+ * failing resolver: an attacker-run authoritative server answering just after
+ * the deadline got this guard to wave the request through, and `fetch` then did
+ * its OWN resolution — no deadline — and reached 127.0.0.1. So a timeout, a
+ * temporary resolver error (EAI_AGAIN/EAI_FAIL) and an empty answer all block.
+ *
+ * The ONE tolerated case is a definitive "this name does not exist"
+ * (ENOTFOUND / ENODATA): there is no address for `fetch` to reach either, so
+ * blocking would only swap one failure message for another.
+ *
+ * The deadline is generous on purpose — with fail-closed semantics it now costs
+ * a legitimate delivery when it fires, and a resolver needing more than 5s is
+ * broken, not slow. It still bounds the delivery: the `fetch` that follows has
+ * its own 10s abort.
+ */
+const LOOKUP_TIMEOUT_MS = 5000
+const LOOKUP_TIMED_OUT = Symbol('lookup-timed-out')
+/** Definitive "no such host" — nothing for `fetch` to connect to either. */
+const NONEXISTENT_HOST_CODES = new Set(['ENOTFOUND', 'ENODATA', 'NOTFOUND'])
+
+export async function assertPublicHost(hostname: string): Promise<boolean> {
+  const host = normalizeHost(hostname)
+  if (isBlockedHost(host)) return false
+  if (parseIPv4(host) || host.includes(':')) return true // already a literal, checked above
+  try {
+    // Bounded: a stalled resolver must not hold a webhook delivery open.
+    const addresses = await Promise.race([
+      lookup(host, { all: true }),
+      new Promise<typeof LOOKUP_TIMED_OUT>((resolve) =>
+        setTimeout(() => resolve(LOOKUP_TIMED_OUT), LOOKUP_TIMEOUT_MS).unref?.(),
+      ),
+    ])
+    if (addresses === LOOKUP_TIMED_OUT) return false
+    // `[].every()` is `true`: an empty answer must not read as "all public".
+    if (!Array.isArray(addresses) || addresses.length === 0) return false
+    return addresses.every((entry) => !isBlockedHost(entry.address))
+  } catch (error) {
+    const code = (error as { code?: string } | null)?.code
+    return typeof code === 'string' && NONEXISTENT_HOST_CODES.has(code)
+  }
+}
+
+export class BlockedRequestError extends Error {
+  constructor(public readonly reason: NonNullable<UrlValidationResult['reason']> | 'too_many_redirects') {
+    super(`Blocked outbound request: ${reason}`)
+    this.name = 'BlockedRequestError'
+  }
+}
+
+const MAX_REDIRECTS = 3
+
+/**
+ * `fetch` with SSRF guards on the initial URL AND on every redirect target.
+ *
+ * `redirect: 'manual'` is the point: the default policy follows 3xx inside
+ * undici, where no guard of ours can see the new target.
+ */
+export async function safeFetch(rawUrl: string, init: RequestInit): Promise<Response> {
+  let current = rawUrl
+  let body: BodyInit | null | undefined = init.body
+
+  for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+    const validation = validateWebhookUrl(current)
+    if (!validation.ok || !validation.url) throw new BlockedRequestError(validation.reason || 'invalid_url')
+    if (!(await assertPublicHost(validation.url.hostname))) throw new BlockedRequestError('private_host')
+
+    const response = await fetch(current, { ...init, body, redirect: 'manual' })
+    if (response.status < 300 || response.status > 399) return response
+
+    const location = response.headers.get('location')
+    if (!location) return response
+
+    current = new URL(location, current).toString()
+    // 303 (and, in practice, 301/302 on a POST) turns the follow-up into a GET.
+    if (response.status === 303) body = undefined
+  }
+
+  throw new BlockedRequestError('too_many_redirects')
+}

package/src/utils/webhookDispatcher.ts

@@ -2,8 +2,18 @@ import crypto from 'crypto'
 import type { BasePayload } from 'payload'
 import type { CollectionSlugs } from './slugs'
 import { dbFind, dbUpdate } from './db'
+import { safeFetch } from './urlSafety'
 
-type WebhookEvent = 'ticket_created' | 'ticket_resolved' | 'ticket_replied' | 'sla_breached'
+/**
+ * Outbound webhook events. Must stay in sync with the `events` options of the
+ * webhook-endpoints collection.
+ */
+export type WebhookEvent =
+  | 'ticket_created'
+  | 'ticket_resolved'
+  | 'ticket_replied'
+  | 'ticket_assigned'
+  | 'sla_breached'
 
 /**
  * Dispatch outbound webhooks for a given event.
@@ -21,9 +31,12 @@ export function dispatchWebhook(
   event: WebhookEvent,
   payload: BasePayload,
   slugs: CollectionSlugs,
-): void {
-  // Fire and forget — do not await
-  void _dispatch(data, event, payload, slugs)
+): Promise<void> {
+  // Fire and forget for callers (hooks never await it); the promise is returned so
+  // tests — and any caller that wants to — can wait for delivery to settle.
+  const done = _dispatch(data, event, payload, slugs)
+  void done
+  return done
 }
 
 async function _dispatch(
@@ -49,9 +62,9 @@ async function _dispatch(
 
     const body = JSON.stringify({ event, data, timestamp: new Date().toISOString() })
 
-    for (const endpoint of endpoints) {
-      void _sendToEndpoint(endpoint as any, body, payload, slugs)
-    }
+    await Promise.allSettled(
+      endpoints.map((endpoint) => _sendToEndpoint(endpoint as any, body, payload, slugs)),
+    )
   } catch (err) {
     console.error(`[webhook] Failed to fetch endpoints for event ${event}:`, err)
   }
@@ -78,7 +91,10 @@ async function _sendToEndpoint(
       headers['X-Webhook-Signature'] = signature
     }
 
-    const response = await fetch(endpoint.url, {
+    // safeFetch: rejects non-https and private / loopback / link-local targets,
+    // re-resolves the name before connecting (DNS rebinding) and re-checks every
+    // redirect hop instead of letting undici follow a 302 into the private range.
+    const response = await safeFetch(endpoint.url, {
       method: 'POST',
       headers,
       body,

package/src/views/ChatView/client.tsx

@@ -40,6 +40,11 @@ export const ChatViewClient: React.FC = () => {
   const sessionsPollTimeout = useRef<NodeJS.Timeout>(undefined)
   const messagesPollInterval = useRef(3000)
   const messagesPollTimeout = useRef<NodeJS.Timeout>(undefined)
+  // Serialized snapshot of the last sessions payload. The change detection MUST
+  // live outside the setSessions updater: React skips the updater entirely on the
+  // eager-state path, so a flag assigned inside it stops being written after the
+  // first render and the adaptive backoff then climbs to its ceiling and stays there.
+  const sessionsSnapshotRef = useRef<string>('')
 
   // Fetch sessions list
   const [sessionExpired, setSessionExpired] = useState(false)
@@ -50,15 +55,14 @@ export const ChatViewClient: React.FC = () => {
       if (res.status === 401 || res.status === 403) { setSessionExpired(true); return }
       if (res.ok) {
         const data = await res.json()
-        setSessions((prev) => {
-          const newActive = data.active || []
-          const newClosed = data.closed || []
-          if (JSON.stringify(prev.active) !== JSON.stringify(newActive) || JSON.stringify(prev.closed) !== JSON.stringify(newClosed)) {
-            hadChanges = true
-            return { active: newActive, closed: newClosed }
-          }
-          return prev
-        })
+        const newActive = data.active || []
+        const newClosed = data.closed || []
+        const snapshot = JSON.stringify([newActive, newClosed])
+        if (snapshot !== sessionsSnapshotRef.current) {
+          sessionsSnapshotRef.current = snapshot
+          hadChanges = true
+          setSessions({ active: newActive, closed: newClosed })
+        }
       }
     } catch { /* ignore */ }
     setLoading(false)

package/src/views/CrmView/client.tsx

@@ -144,26 +144,25 @@ export const CrmClient: React.FC = () => {
   const fetchDetail = useCallback(async (clientId: number) => {
     setDetailLoading(true)
     try {
-      const [clientRes, ticketsRes, projectsRes, timeRes] = await Promise.all([
+      const [clientRes, ticketsRes, projectsRes] = await Promise.all([
         fetch(`/api/support-clients/${clientId}?depth=0`),
         fetch(`/api/tickets?where[client][equals]=${clientId}&sort=-createdAt&limit=20&depth=0`),
         fetch(`/api/projects?where[client][equals]=${clientId}&depth=0`),
-        fetch(`/api/time-entries?limit=0&depth=0`),
       ])
 
       const client = clientRes.ok ? await clientRes.json() : null
       const tickets = ticketsRes.ok ? (await ticketsRes.json()).docs || [] : []
       const projects = projectsRes.ok ? (await projectsRes.json()).docs || [] : []
 
-      // Get time entries for this client's tickets
-      const ticketIds = tickets.map((t: { id: number }) => t.id)
-      let totalTimeMinutes = 0
-      if (timeRes.ok) {
-        const timeData = await timeRes.json()
-        totalTimeMinutes = timeData.docs
-          .filter((e: { ticket: number }) => ticketIds.includes(e.ticket))
-          .reduce((sum: number, e: { duration: number }) => sum + (e.duration || 0), 0)
-      }
+      // Sum the per-ticket rollup maintained by the TimeEntries afterChange /
+      // afterDelete hooks. This used to download the ENTIRE time-entries table
+      // (via limit=0, which does not mean "no document") only to keep the rows whose
+      // ticket is one of the 20 listed here — same result, O(1) payload instead of
+      // O(all time entries ever recorded).
+      const totalTimeMinutes = tickets.reduce(
+        (sum: number, t: { totalTimeMinutes?: number }) => sum + (t.totalTimeMinutes || 0),
+        0,
+      )
 
       const openTickets = tickets.filter((t: { status: string }) =>
         ['open', 'waiting_client'].includes(t.status),

package/src/views/TicketDetailView/client.tsx

@@ -6,7 +6,7 @@ import Link from 'next/link'
 import { RichTextEditor, type RichTextEditorHandle } from '../../components/RichTextEditor/index'
 import { hasCodeBlocks, MessageWithCodeBlocks, CodeBlockRendererHtml } from '../../components/TicketConversation/components/CodeBlock'
 import { CodeBlockInserter } from '../../components/TicketConversation/components/CodeBlockInserter'
-import { getFeatures } from '../shared/config'
+import { useFeatures } from '../../components/TicketConversation/hooks/useFeatures'
 import { computeSlaState, formatSlaRemaining } from '../shared/sla'
 import { useTranslation } from '../../components/TicketConversation/hooks/useTranslation'
 import { DATE_LOCALE } from '../shared/dateLocale'
@@ -21,7 +21,7 @@ export const TicketDetailClient: React.FC = () => {
   const { t } = useTranslation()
   const searchParams = useSearchParams()
   const ticketId = searchParams.get('id')
-  const features = getFeatures()
+  const { features } = useFeatures()
   const editorRef = useRef<RichTextEditorHandle>(null)
   const threadEndRef = useRef<HTMLDivElement>(null)
   const dropdownRef = useRef<HTMLDivElement>(null)

package/src/views/TicketInboxView/client.tsx

@@ -165,12 +165,17 @@ export const TicketInboxClient: React.FC = () => {
       try {
         // Exclude snoozed tickets from the counts too (mirrors the list query).
         const sn = `where[and][0][or][0][snoozeUntil][exists]=false&where[and][0][or][1][snoozeUntil][less_than_equal]=${encodeURIComponent(new Date().toISOString())}`
+        // `/count` is a real SQL COUNT. The previous limit=0 idiom did NOT mean
+        // "no document": Payload disables pagination for limit=0, skips the count
+        // query and derives totalDocs from the rows it just materialised — so each
+        // of these five counters used to read the whole tickets table (relations
+        // included) just to display a badge.
         const [all, openRes, waiting, resolved, breach] = await Promise.all([
-          fetch(`/api/tickets?limit=0&depth=0&${sn}`, { credentials: 'include' }),
-          fetch(`/api/tickets?limit=0&depth=0&where[status][equals]=open&${sn}`, { credentials: 'include' }),
-          fetch(`/api/tickets?limit=0&depth=0&where[status][equals]=waiting_client&${sn}`, { credentials: 'include' }),
-          fetch(`/api/tickets?limit=0&depth=0&where[status][equals]=resolved&${sn}`, { credentials: 'include' }),
-          fetch(`/api/tickets?limit=0&depth=0&where[or][0][slaFirstResponseBreached][equals]=true&where[or][1][slaResolutionBreached][equals]=true&${sn}`, { credentials: 'include' }),
+          fetch(`/api/tickets/count?${sn}`, { credentials: 'include' }),
+          fetch(`/api/tickets/count?where[status][equals]=open&${sn}`, { credentials: 'include' }),
+          fetch(`/api/tickets/count?where[status][equals]=waiting_client&${sn}`, { credentials: 'include' }),
+          fetch(`/api/tickets/count?where[status][equals]=resolved&${sn}`, { credentials: 'include' }),
+          fetch(`/api/tickets/count?where[or][0][slaFirstResponseBreached][equals]=true&where[or][1][slaResolutionBreached][equals]=true&${sn}`, { credentials: 'include' }),
         ])
         const [a, o, w, r, b] = await Promise.all([all.json(), openRes.json(), waiting.json(), resolved.json(), breach.json()])
         setCounts({

package/src/views/TicketingSettingsView/client.tsx

@@ -4,7 +4,8 @@ import React, { useState, useEffect } from 'react'
 import { Settings, Mail, Bot, Clock, Timer, Globe, FileSignature } from 'lucide-react'
 import { V, btnStyle } from '../shared/adminTokens'
 import { AdminViewHeader } from '../shared/AdminViewHeader'
-import { getFeatures, saveFeatures, DEFAULT_FEATURES, type TicketingFeatures } from '../../components/TicketConversation/config'
+import { DEFAULT_FEATURES, type TicketingFeatures } from '../../components/TicketConversation/config'
+import { useFeatures } from '../../components/TicketConversation/hooks/useFeatures'
 import { useTranslation } from '../../components/TicketConversation/hooks/useTranslation'
 import ts from '../../styles/TicketingSettings.module.scss'
 
@@ -301,7 +302,7 @@ export const TicketingSettingsClient: React.FC = () => {
   const { t } = useTranslation()
   const FEATURE_LIST = React.useMemo(() => getFeatureList(t), [t])
   const CATEGORIES = React.useMemo(() => getCategories(t), [t])
-  const [features, setFeatures] = useState<TicketingFeatures>(() => getFeatures())
+  const { features, setFeatures, save: saveFeatures } = useFeatures()
   const [settings, setSettings] = useState<AllSettings>(DEFAULT_SETTINGS)
   const [signature, setSignature] = useState('')
   const [saved, setSaved] = useState(false)
@@ -355,15 +356,16 @@ export const TicketingSettingsClient: React.FC = () => {
 
   const handleSave = async () => {
     setSaving(true)
-    // Save features to localStorage (UI-only flags)
-    saveFeatures(features)
-    // Save global settings + per-user prefs
+    // Feature flags and the other blocks share one preference row, so the two
+    // writes are sequenced: running them in parallel would make the second
+    // request merge onto settings read before the first one landed.
+    const featuresOk = await saveFeatures(features)
     const [settingsOk, prefsOk] = await Promise.all([
       saveSettingsToAPI(settings),
       saveUserPrefs({ locale: settings.locale.language, signature }),
     ])
     setSaving(false)
-    if (settingsOk && prefsOk) {
+    if (featuresOk && settingsOk && prefsOk) {
       setSaved(true)
       setTimeout(() => setSaved(false), 3000)
     }

package/src/views/shared/config.ts

@@ -1,82 +1,16 @@
 /**
- * Feature flags for the ticketing module.
- * Each feature can be enabled/disabled by the admin.
- * When disabled, the corresponding UI section is hidden entirely.
+ * Ticketing feature flags — re-export of the shared implementation.
+ *
+ * See `utils/features.ts`. This module is kept so that
+ * `views/shared/index.ts` and existing view imports keep resolving.
  */
-export interface TicketingFeatures {
-  /** Time tracking: timer, manual entries, billing */
-  timeTracking: boolean
-  /** AI features: sentiment, synthesis, suggestion, rewrite */
-  ai: boolean
-  /** Satisfaction surveys: CSAT rating after resolution */
-  satisfaction: boolean
-  /** Live chat integration: chat -> ticket conversion */
-  chat: boolean
-  /** Email tracking: pixel tracking, open/sent status per message */
-  emailTracking: boolean
-  /** Canned responses: quick reply templates */
-  canned: boolean
-  /** Ticket merge: combine two tickets into one */
-  merge: boolean
-  /** Snooze: temporarily hide a ticket */
-  snooze: boolean
-  /** External messages: add messages received outside the system */
-  externalMessages: boolean
-  /** Client history: past tickets, projects, notes sidebar */
-  clientHistory: boolean
-  /** Activity log: audit trail of actions on the ticket */
-  activityLog: boolean
-  /** Split ticket: extract a message into a new ticket */
-  splitTicket: boolean
-  /** Scheduled replies: send a message at a future date */
-  scheduledReplies: boolean
-  /** Auto-close: automatically resolve inactive tickets */
-  autoClose: boolean
-  /** Auto-close delay in days (used by auto-close cron) */
-  autoCloseDays: number
-  /** Round-robin: distribute new tickets evenly among agents */
-  roundRobin: boolean
-}
-
-/** Default features -- all enabled */
-export const DEFAULT_FEATURES: TicketingFeatures = {
-  timeTracking: true,
-  ai: true,
-  satisfaction: true,
-  chat: true,
-  emailTracking: true,
-  canned: true,
-  merge: true,
-  snooze: true,
-  externalMessages: true,
-  clientHistory: true,
-  activityLog: true,
-  splitTicket: true,
-  scheduledReplies: true,
-  autoClose: true,
-  autoCloseDays: 7,
-  roundRobin: false,
-}
-
-const STORAGE_KEY = 'ticketing_features'
-
-/** Read features from localStorage (falls back to defaults) */
-export function getFeatures(): TicketingFeatures {
-  if (typeof window === 'undefined') return DEFAULT_FEATURES
-  try {
-    const stored = localStorage.getItem(STORAGE_KEY)
-    if (stored) {
-      const parsed = JSON.parse(stored)
-      return { ...DEFAULT_FEATURES, ...parsed }
-    }
-  } catch { /* ignore */ }
-  return DEFAULT_FEATURES
-}
-
-/** Save features to localStorage */
-export function saveFeatures(features: TicketingFeatures): void {
-  if (typeof window === 'undefined') return
-  try {
-    localStorage.setItem(STORAGE_KEY, JSON.stringify(features))
-  } catch { /* ignore */ }
-}
+export {
+  DEFAULT_TICKETING_FEATURES,
+  DEFAULT_TICKETING_FEATURES as DEFAULT_FEATURES,
+  FEATURES_CACHE_KEY,
+  fetchFeatures,
+  getFeatures,
+  normalizeFeatures,
+  saveFeatures,
+} from '../../utils/features'
+export type { TicketingFeatures } from '../../utils/features'