@consilioweb/payload-support 2.0.1 → 4.0.0

package/dist/index.js

@@ -1,6 +1,7 @@
 import { initTransaction, commitTransaction, killTransaction, getFieldsToSign, jwtSign, APIError } from 'payload';
 import crypto3, { createHash, timingSafeEqual, createHmac, randomBytes } from 'crypto';
 import PDFDocument from 'pdfkit';
+import { lookup } from 'dns/promises';
 import webpush from 'web-push';
 import sanitizeHtml from 'sanitize-html';
 
@@ -158,22 +159,44 @@ var PayloadRateLimitStore = class {
     return { payload: context };
   }
 };
+function principalRateKey(user) {
+  if (!user || user.id === void 0 || user.id === null) return "anonymous";
+  const collection = typeof user.collection === "string" && user.collection ? user.collection : "unknown";
+  return `${collection}:${String(user.id)}`;
+}
 var RateLimiter = class {
-  constructor(windowMs, maxRequests, store) {
+  /**
+   * @param namespace  Endpoint-scoped prefix for every key this limiter writes.
+   *   The store is SHARED (`rateLimitStore: 'payload'` builds one instance for
+   *   all endpoints), and the raw keys collide across endpoints: `ip` was used
+   *   by both the login and the chatbot limiter — 10 forged chatbot requests
+   *   locked a victim out of the portal for 15 minutes — and `String(user.id)`
+   *   by five different endpoints. Always pass one; it is optional only because
+   *   `RateLimiter` is part of the published API surface.
+   */
+  constructor(windowMs, maxRequests, store, namespace) {
     this.windowMs = windowMs;
     this.maxRequests = maxRequests;
     this.store = store ?? new MemoryRateLimitStore();
+    this.prefix = namespace ? `${namespace}:` : "";
   }
   windowMs;
   maxRequests;
   store;
+  prefix;
+  /** The key actually written to the store. Exposed for assertions in tests. */
+  scopedKey(key) {
+    return `${this.prefix}${key}`;
+  }
   async check(key, context) {
-    const entry = context === void 0 ? await this.store.increment(key, this.windowMs) : await this.store.increment(key, this.windowMs, context);
+    const scoped = this.scopedKey(key);
+    const entry = context === void 0 ? await this.store.increment(scoped, this.windowMs) : await this.store.increment(scoped, this.windowMs, context);
     return entry.count > this.maxRequests;
   }
   async reset(key, context) {
-    if (context === void 0) await this.store.reset(key);
-    else await this.store.reset(key, context);
+    const scoped = this.scopedKey(key);
+    if (context === void 0) await this.store.reset(scoped);
+    else await this.store.reset(scoped, context);
   }
 };
 var DEFAULT_INBOUND_EMAIL_LIMITS = {
@@ -211,7 +234,7 @@ function validateInboundEmailPayload(input, contentLength, limits = DEFAULT_INBO
 
 // src/endpoints/capabilities.ts
 function createInboundEmailEndpoint(capability, store) {
-  const limiter = new RateLimiter(6e4, 60, store);
+  const limiter = new RateLimiter(6e4, 60, store, "inbound-email");
   return {
     path: "/support-webhook/inbound-email",
     method: "post",
@@ -242,7 +265,7 @@ function createInboundEmailEndpoint(capability, store) {
   };
 }
 function createProjectSuggestionsEndpoint(slugs, capability, store) {
-  const limiter = new RateLimiter(6e4, 20, store);
+  const limiter = new RateLimiter(6e4, 20, store, "suggest-projects");
   return {
     path: "/support/suggest-projects",
     method: "post",
@@ -250,7 +273,7 @@ function createProjectSuggestionsEndpoint(slugs, capability, store) {
       if (!req.user || req.user.collection !== slugs.users) {
         return Response.json({ error: "Unauthorized" }, { status: 401 });
       }
-      const key = req.user?.id ? String(req.user.id) : "anonymous";
+      const key = principalRateKey(req.user);
       if (await limiter.check(key, req)) {
         return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
       }
@@ -259,7 +282,7 @@ function createProjectSuggestionsEndpoint(slugs, capability, store) {
   };
 }
 function createTicketTitleEndpoint(slugs, capability, store) {
-  const limiter = new RateLimiter(6e4, 20, store);
+  const limiter = new RateLimiter(6e4, 20, store, "ticket-title");
   return {
     path: "/support/ticket-title",
     method: "post",
@@ -281,7 +304,7 @@ function createTicketTitleEndpoint(slugs, capability, store) {
   };
 }
 function createGenerateMissingTitlesEndpoint(slugs, capability, store) {
-  const limiter = new RateLimiter(6e4, 5, store);
+  const limiter = new RateLimiter(6e4, 5, store, "generate-missing-titles");
   return {
     path: "/support/generate-missing-titles",
     method: "post",
@@ -368,55 +391,201 @@ function dbDelete(payload, slug, options) {
   return payload.delete({ collection: slug, ...options });
 }
 
+// src/utils/features.ts
+var DEFAULT_TICKETING_FEATURES = {
+  timeTracking: true,
+  ai: true,
+  satisfaction: true,
+  chat: true,
+  emailTracking: true,
+  canned: true,
+  merge: true,
+  snooze: true,
+  externalMessages: true,
+  clientHistory: true,
+  activityLog: true,
+  splitTicket: true,
+  scheduledReplies: true,
+  autoClose: true,
+  autoCloseDays: 7,
+  roundRobin: false
+};
+var BOOLEAN_FEATURE_KEYS = [
+  "timeTracking",
+  "ai",
+  "satisfaction",
+  "chat",
+  "emailTracking",
+  "canned",
+  "merge",
+  "snooze",
+  "externalMessages",
+  "clientHistory",
+  "activityLog",
+  "splitTicket",
+  "scheduledReplies",
+  "autoClose",
+  "roundRobin"
+];
+var PROJECTED_FEATURE_KEYS = ["autoClose", "autoCloseDays"];
+function normalizeFeatures(raw) {
+  const out = { ...DEFAULT_TICKETING_FEATURES };
+  if (!raw || typeof raw !== "object") return out;
+  const src = raw;
+  for (const key of BOOLEAN_FEATURE_KEYS) {
+    if (typeof src[key] === "boolean") out[key] = src[key];
+  }
+  const days = src.autoCloseDays;
+  if (typeof days === "number" && Number.isFinite(days) && days >= 1) {
+    out.autoCloseDays = Math.floor(days);
+  }
+  return out;
+}
+function projectAutoClose(features, autoClose) {
+  if (!autoClose) return features;
+  return {
+    ...features,
+    autoClose: typeof autoClose.enabled === "boolean" ? autoClose.enabled : features.autoClose,
+    autoCloseDays: typeof autoClose.daysBeforeClose === "number" && autoClose.daysBeforeClose >= 1 ? Math.floor(autoClose.daysBeforeClose) : features.autoCloseDays
+  };
+}
+function stripProjectedFeatures(features) {
+  const out = { ...features };
+  for (const key of PROJECTED_FEATURE_KEYS) delete out[key];
+  return out;
+}
+
 // src/utils/readSettings.ts
-var PREF_KEY = "support-settings";
+var SUPPORT_SETTINGS_PREF_KEY = "support-settings";
+var PREF_KEY = SUPPORT_SETTINGS_PREF_KEY;
 var USER_PREFS_KEY_PREFIX = "support-user-prefs";
+var LEGACY_ROUND_ROBIN_KEY = "support-round-robin";
+var SUPPORT_STAFF_SLUG_CONFIG_KEY = "supportStaffCollection";
+function resolveStaffPrefSlug(payload, staffSlug) {
+  if (staffSlug) return staffSlug;
+  const config = payload.config;
+  const registered = config?.custom?.[SUPPORT_STAFF_SLUG_CONFIG_KEY];
+  if (typeof registered === "string" && registered) return registered;
+  return config?.admin?.user || "users";
+}
 var DEFAULT_SETTINGS = {
   email: { fromAddress: "", fromName: "Support", replyToAddress: "" },
   ai: { provider: "anthropic", model: "claude-haiku-4-5-20251001", enableSentiment: true, enableSynthesis: true, enableSuggestion: true, enableRewrite: true },
   sla: { firstResponseMinutes: 120, resolutionMinutes: 1440, businessHoursOnly: true, escalationEmail: "" },
-  autoClose: { enabled: true, daysBeforeClose: 7, reminderDaysBefore: 2 }
+  autoClose: { enabled: true, daysBeforeClose: 7, reminderDaysBefore: 2 },
+  features: { ...DEFAULT_TICKETING_FEATURES }
 };
 var DEFAULT_USER_PREFS = {
   locale: "fr",
   signature: ""
 };
-var settingsCache = null;
+var settingsCache = /* @__PURE__ */ new Map();
 var SETTINGS_TTL_MS = 6e4;
+var SETTINGS_CACHE_MAX = 8;
+var warnedForeignSettingsRow = /* @__PURE__ */ new Set();
 function invalidateSupportSettingsCache() {
-  settingsCache = null;
+  settingsCache.clear();
+  warnedForeignSettingsRow.clear();
 }
-async function readSupportSettings(payload) {
-  if (settingsCache && Date.now() - settingsCache.ts < SETTINGS_TTL_MS) {
-    return settingsCache.value;
+function mergeSupportSettings(stored, base = DEFAULT_SETTINGS) {
+  const autoClose = { ...base.autoClose, ...stored?.autoClose };
+  return {
+    email: { ...base.email, ...stored?.email },
+    ai: { ...base.ai, ...stored?.ai },
+    sla: { ...base.sla, ...stored?.sla },
+    autoClose,
+    // `autoClose` / `autoCloseDays` are projections of the block above, so they
+    // are recomputed here rather than trusted from whatever was persisted.
+    features: projectAutoClose(
+      normalizeFeatures({ ...base.features, ...stored?.features }),
+      autoClose
+    )
+  };
+}
+async function readSupportSettingsState(payload, staffSlug) {
+  const staff = resolveStaffPrefSlug(payload, staffSlug);
+  const cached = settingsCache.get(staff);
+  if (cached && Date.now() - cached.ts < SETTINGS_TTL_MS) {
+    return cached.value;
   }
-  let value = { ...DEFAULT_SETTINGS };
+  let value = {
+    settings: mergeSupportSettings(null),
+    featuresConfigured: false
+  };
   try {
     const prefs = await dbFind(payload, "payload-preferences", {
-      where: { key: { equals: PREF_KEY } },
+      // Sibling keys are AND-ed by Payload. The `user.relationTo` clause is the
+      // security boundary: without it any authenticated principal can plant a
+      // `support-settings` row and own the plugin's server settings.
+      where: { key: { equals: PREF_KEY }, "user.relationTo": { equals: staff } },
+      // The upsert is scoped per admin user, so several rows can share the key.
+      // Sorting makes "last write wins" deterministic instead of arbitrary.
+      sort: "-updatedAt",
       limit: 1,
       depth: 0,
       overrideAccess: true
     });
     if (prefs.docs.length > 0) {
       const stored = prefs.docs[0].value;
-      value = {
-        email: { ...DEFAULT_SETTINGS.email, ...stored.email },
-        ai: { ...DEFAULT_SETTINGS.ai, ...stored.ai },
-        sla: { ...DEFAULT_SETTINGS.sla, ...stored.sla },
-        autoClose: { ...DEFAULT_SETTINGS.autoClose, ...stored.autoClose }
-      };
+      const featuresConfigured = !!stored.features && typeof stored.features === "object";
+      const settings = mergeSupportSettings(stored);
+      if (!featuresConfigured) {
+        settings.features.roundRobin = await readLegacyRoundRobin(payload, staff);
+      }
+      value = { settings, featuresConfigured };
+    } else {
+      await warnOnForeignSettingsRow(payload, staff);
     }
   } catch {
   }
-  settingsCache = { value, ts: Date.now() };
+  if (settingsCache.size >= SETTINGS_CACHE_MAX && !settingsCache.has(staff)) settingsCache.clear();
+  settingsCache.set(staff, { value, ts: Date.now() });
   return value;
 }
-async function readUserPrefs(payload, userId) {
+async function warnOnForeignSettingsRow(payload, staff) {
+  if (warnedForeignSettingsRow.has(staff)) return;
+  try {
+    const any = await dbFind(payload, "payload-preferences", {
+      where: { key: { equals: PREF_KEY } },
+      limit: 1,
+      depth: 0,
+      overrideAccess: true
+    });
+    if (any.docs.length === 0) return;
+    if (warnedForeignSettingsRow.size >= SETTINGS_CACHE_MAX) warnedForeignSettingsRow.clear();
+    warnedForeignSettingsRow.add(staff);
+    console.warn(
+      `[support] A "${PREF_KEY}" preference row exists but none is owned by the "${staff}" collection: the plugin is running on its DEFAULT settings. Either the staff auth collection differs from \`admin.user\`, or the row was written by a principal that is not staff \u2014 in which case it is ignored on purpose.`
+    );
+  } catch {
+  }
+}
+async function readSupportSettings(payload, staffSlug) {
+  return (await readSupportSettingsState(payload, staffSlug)).settings;
+}
+async function readLegacyRoundRobin(payload, staff) {
+  try {
+    const prefs = await dbFind(payload, "payload-preferences", {
+      where: { key: { equals: LEGACY_ROUND_ROBIN_KEY }, "user.relationTo": { equals: staff } },
+      limit: 1,
+      depth: 0,
+      overrideAccess: true
+    });
+    if (prefs.docs.length > 0) {
+      return prefs.docs[0].value?.enabled === true;
+    }
+  } catch {
+  }
+  return DEFAULT_TICKETING_FEATURES.roundRobin;
+}
+async function readUserPrefs(payload, userId, staffSlug) {
   try {
     const key = `${USER_PREFS_KEY_PREFIX}-${userId}`;
     const prefs = await dbFind(payload, "payload-preferences", {
-      where: { key: { equals: key } },
+      where: {
+        key: { equals: key },
+        "user.relationTo": { equals: resolveStaffPrefSlug(payload, staffSlug) }
+      },
       limit: 1,
       depth: 0,
       overrideAccess: true
@@ -432,13 +601,20 @@ async function readUserPrefs(payload, userId) {
   }
   return { ...DEFAULT_USER_PREFS };
 }
+function resolveOllamaBaseUrl() {
+  const baseURL = process.env.OLLAMA_API_URL;
+  if (!baseURL) {
+    throw new APIError("provider 'ollama' requires OLLAMA_API_URL", 500);
+  }
+  return baseURL;
+}
 
 // src/endpoints/ai.ts
 async function getClient(aiSettings) {
   const moduleName = "@anthropic-ai/sdk";
   const { default: Anthropic } = await import(moduleName);
   if (aiSettings.provider === "ollama") {
-    const baseURL = process.env.OLLAMA_API_URL || "https://ollama.orkelis.app/v1";
+    const baseURL = resolveOllamaBaseUrl();
     return new Anthropic({ apiKey: "ollama", baseURL });
   }
   return new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
@@ -447,7 +623,7 @@ function getModel(aiSettings) {
   return aiSettings.model || "claude-haiku-4-5-20251001";
 }
 function createAiEndpoint(slugs, store) {
-  const limiter = new RateLimiter(6e4, 30, store);
+  const limiter = new RateLimiter(6e4, 30, store, "ai");
   return {
     path: "/support/ai",
     method: "post",
@@ -455,7 +631,7 @@ function createAiEndpoint(slugs, store) {
       try {
         const payload = req.payload;
         requireAdmin(req, slugs);
-        if (await limiter.check(String(req.user.id), req)) {
+        if (await limiter.check(principalRateKey(req.user), req)) {
           return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
         }
         const settings = await readSupportSettings(payload);
@@ -637,7 +813,7 @@ async function applyAgentDecision(payload, slugs, ticketId, decision) {
 function getClient2(aiSettings) {
   const Anthropic = __require("@anthropic-ai/sdk").default;
   if (aiSettings.provider === "ollama") {
-    return new Anthropic({ apiKey: "ollama", baseURL: process.env.OLLAMA_API_URL || "https://ollama.orkelis.app/v1" });
+    return new Anthropic({ apiKey: "ollama", baseURL: resolveOllamaBaseUrl() });
   }
   return new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
 }
@@ -700,14 +876,14 @@ ${kbText || "(vide)"}`;
 
 // src/endpoints/ai-agent.ts
 function createAiAgentEndpoint(slugs, store) {
-  const limiter = new RateLimiter(6e4, 10, store);
+  const limiter = new RateLimiter(6e4, 10, store, "ai-agent");
   return {
     path: "/support/ai-agent",
     method: "post",
     handler: async (req) => {
       try {
         requireAdmin(req, slugs);
-        if (await limiter.check(String(req.user.id), req)) {
+        if (await limiter.check(principalRateKey(req.user), req)) {
           return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
         }
         let body = {};
@@ -737,7 +913,7 @@ async function getClient3(aiSettings) {
   const moduleName = "@anthropic-ai/sdk";
   const { default: Anthropic } = await import(moduleName);
   if (aiSettings.provider === "ollama") {
-    const baseURL = process.env.OLLAMA_API_URL || "https://ollama.orkelis.app/v1";
+    const baseURL = resolveOllamaBaseUrl();
     return new Anthropic({ apiKey: "ollama", baseURL });
   }
   return new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
@@ -747,11 +923,11 @@ function getModel2(aiSettings) {
 }
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 function createClientIntelligenceEndpoint(slugs, store) {
-  const limiter = new RateLimiter(6e4, 20, store);
+  const limiter = new RateLimiter(6e4, 20, store, "client-intelligence");
   const getHandler = async (req) => {
     try {
       requireAdmin(req, slugs);
-      if (await limiter.check(String(req.user.id), req)) {
+      if (await limiter.check(principalRateKey(req.user), req)) {
         return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
       }
       const payload = req.payload;
@@ -783,7 +959,7 @@ function createClientIntelligenceEndpoint(slugs, store) {
   const postHandler = async (req) => {
     try {
       requireAdmin(req, slugs);
-      if (await limiter.check(String(req.user.id), req)) {
+      if (await limiter.check(principalRateKey(req.user), req)) {
         return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
       }
       const payload = req.payload;
@@ -1412,6 +1588,14 @@ function createSplitTicketEndpoint(slugs) {
 // src/endpoints/typing.ts
 var typingState = /* @__PURE__ */ new Map();
 var TYPING_TTL = 5e3;
+var MAX_TYPING_KEYS = 500;
+var TICKET_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+function normalizeTicketId(raw) {
+  if (typeof raw === "number") return Number.isInteger(raw) && raw > 0 ? String(raw) : null;
+  if (typeof raw !== "string") return null;
+  const value = raw.trim();
+  return TICKET_ID_PATTERN.test(value) ? value : null;
+}
 function cleanExpired(ticketId) {
   const state = typingState.get(ticketId);
   if (!state) return;
@@ -1426,6 +1610,36 @@ function cleanExpired(ticketId) {
   }
   if (!state.admin && !state.client) typingState.delete(ticketId);
 }
+function sweepExpired() {
+  for (const key of Array.from(typingState.keys())) cleanExpired(key);
+}
+function evictOldest() {
+  let oldestKey = null;
+  let oldestTs = Infinity;
+  for (const [key, state] of typingState) {
+    const ts = Math.max(state.admin || 0, state.client || 0);
+    if (ts < oldestTs) {
+      oldestTs = ts;
+      oldestKey = key;
+    }
+  }
+  if (oldestKey !== null) typingState.delete(oldestKey);
+}
+async function mayAccessTicket(req, slugs, ticketId) {
+  const collection = req.user?.collection;
+  if (collection !== slugs.users && collection !== slugs.supportClients) return false;
+  try {
+    const doc = await dbFindByID(req.payload, slugs.tickets, {
+      id: ticketId,
+      depth: 0,
+      overrideAccess: false,
+      user: req.user
+    });
+    return !!doc;
+  } catch {
+    return false;
+  }
+}
 function createTypingPostEndpoint(slugs) {
   return {
     path: "/support/typing",
@@ -1436,11 +1650,18 @@ function createTypingPostEndpoint(slugs) {
           return Response.json({ error: "Unauthorized" }, { status: 401 });
         }
         const { ticketId } = await req.json();
-        if (!ticketId) {
+        const key = normalizeTicketId(ticketId);
+        if (!key) {
           return Response.json({ error: "ticketId required" }, { status: 400 });
         }
-        const key = String(ticketId);
+        if (!await mayAccessTicket(req, slugs, key)) {
+          return Response.json({ error: "Forbidden" }, { status: 403 });
+        }
         const state = typingState.get(key) || {};
+        if (!typingState.has(key) && typingState.size >= MAX_TYPING_KEYS) {
+          sweepExpired();
+          if (typingState.size >= MAX_TYPING_KEYS) evictOldest();
+        }
         if (req.user.collection === slugs.users) {
           state.admin = Date.now();
           state.adminName = req.user.firstName || "Support";
@@ -1461,30 +1682,33 @@ function createTypingGetEndpoint(slugs) {
     path: "/support/typing",
     method: "get",
     handler: async (req) => {
+      const idle = { typing: false, name: null };
       try {
         if (!req.user) {
           return Response.json({ error: "Unauthorized" }, { status: 401 });
         }
         const url = new URL(req.url);
-        const ticketId = url.searchParams.get("ticketId");
-        if (!ticketId) {
+        const key = normalizeTicketId(url.searchParams.get("ticketId"));
+        if (!key) {
           return Response.json({ error: "ticketId required" }, { status: 400 });
         }
-        cleanExpired(ticketId);
-        const state = typingState.get(ticketId);
+        cleanExpired(key);
+        const state = typingState.get(key);
+        if (!state) return Response.json(idle);
+        if (!await mayAccessTicket(req, slugs, key)) return Response.json(idle);
         if (req.user.collection === slugs.users) {
           return Response.json({
-            typing: !!state?.client,
-            name: state?.clientName || null
+            typing: !!state.client,
+            name: state.clientName || null
           });
         } else {
           return Response.json({
-            typing: !!state?.admin,
-            name: state?.adminName || null
+            typing: !!state.admin,
+            name: state.adminName || null
           });
         }
       } catch {
-        return Response.json({ typing: false, name: null });
+        return Response.json(idle);
       }
     }
   };
@@ -1573,25 +1797,6 @@ function createPresenceGetEndpoint(slugs) {
 }
 
 // src/endpoints/settings.ts
-var PREF_KEY2 = "support-settings";
-var DEFAULT_SUPPORT_SETTINGS = {
-  email: { fromAddress: "", fromName: "Support", replyToAddress: "" },
-  ai: {
-    provider: "anthropic",
-    model: "claude-haiku-4-5-20251001",
-    enableSentiment: true,
-    enableSynthesis: true,
-    enableSuggestion: true,
-    enableRewrite: true
-  },
-  sla: {
-    firstResponseMinutes: 120,
-    resolutionMinutes: 1440,
-    businessHoursOnly: true,
-    escalationEmail: ""
-  },
-  autoClose: { enabled: true, daysBeforeClose: 7, reminderDaysBefore: 2 }
-};
 function createSettingsGetEndpoint(slugs) {
   return {
     path: "/support/settings",
@@ -1600,23 +1805,8 @@ function createSettingsGetEndpoint(slugs) {
       try {
         const payload = req.payload;
         requireAdmin(req, slugs);
-        const prefs = await dbFind(payload, "payload-preferences", {
-          where: { key: { equals: PREF_KEY2 } },
-          limit: 1,
-          depth: 0,
-          overrideAccess: true
-        });
-        let settings = { ...DEFAULT_SUPPORT_SETTINGS };
-        if (prefs.docs.length > 0) {
-          const stored = prefs.docs[0].value;
-          settings = {
-            email: { ...DEFAULT_SUPPORT_SETTINGS.email, ...stored.email },
-            ai: { ...DEFAULT_SUPPORT_SETTINGS.ai, ...stored.ai },
-            sla: { ...DEFAULT_SUPPORT_SETTINGS.sla, ...stored.sla },
-            autoClose: { ...DEFAULT_SUPPORT_SETTINGS.autoClose, ...stored.autoClose }
-          };
-        }
-        return Response.json(settings);
+        const { settings, featuresConfigured } = await readSupportSettingsState(payload);
+        return Response.json({ ...settings, featuresConfigured });
       } catch (error) {
         const authResponse = handleAuthError(error);
         if (authResponse) return authResponse;
@@ -1635,30 +1825,31 @@ function createSettingsPostEndpoint(slugs) {
         const payload = req.payload;
         requireAdmin(req, slugs);
         const body = await req.json();
-        const merged = {
-          email: { ...DEFAULT_SUPPORT_SETTINGS.email, ...body.email },
-          ai: { ...DEFAULT_SUPPORT_SETTINGS.ai, ...body.ai },
-          sla: { ...DEFAULT_SUPPORT_SETTINGS.sla, ...body.sla },
-          autoClose: { ...DEFAULT_SUPPORT_SETTINGS.autoClose, ...body.autoClose }
-        };
+        const { settings: current } = await readSupportSettingsState(payload);
+        const merged = mergeSupportSettings(body, current);
         await payload.db.upsert({
           collection: "payload-preferences",
           data: {
-            key: PREF_KEY2,
+            key: SUPPORT_SETTINGS_PREF_KEY,
             user: { relationTo: req.user.collection, value: req.user.id },
-            value: merged
+            value: {
+              ...merged,
+              // Persist the flags without the two projected ones, so `features`
+              // and the `autoClose` block can never drift apart.
+              features: stripProjectedFeatures(merged.features)
+            }
           },
           req: { payload, user: req.user },
           where: {
             and: [
-              { key: { equals: PREF_KEY2 } },
+              { key: { equals: SUPPORT_SETTINGS_PREF_KEY } },
               { "user.value": { equals: req.user.id } },
               { "user.relationTo": { equals: req.user.collection } }
             ]
           }
         });
         invalidateSupportSettingsCache();
-        return Response.json(merged);
+        return Response.json({ ...merged, featuresConfigured: true });
       } catch (error) {
         const authResponse = handleAuthError(error);
         if (authResponse) return authResponse;
@@ -1670,7 +1861,7 @@ function createSettingsPostEndpoint(slugs) {
 }
 
 // src/endpoints/signature.ts
-var PREF_KEY3 = "email-signature";
+var PREF_KEY2 = "email-signature";
 function createSignatureGetEndpoint(slugs) {
   return {
     path: "/support/signature",
@@ -1680,7 +1871,14 @@ function createSignatureGetEndpoint(slugs) {
         const payload = req.payload;
         requireAdmin(req, slugs);
         const prefs = await dbFind(payload, "payload-preferences", {
-          where: { key: { equals: `${PREF_KEY3}-${req.user.id}` } },
+          // Scope to the staff auth collection: `payload-preferences` accepts a
+          // write from ANY authenticated principal, and ids collide between auth
+          // collections — a support-client with the same id would otherwise own
+          // the `email-signature-<id>` row read back for the agent.
+          where: {
+            key: { equals: `${PREF_KEY2}-${req.user.id}` },
+            "user.relationTo": { equals: slugs.users }
+          },
           limit: 1,
           depth: 0,
           overrideAccess: true
@@ -1705,9 +1903,9 @@ function createSignaturePostEndpoint(slugs) {
         const payload = req.payload;
         requireAdmin(req, slugs);
         const { signature } = await req.json();
-        const key = `${PREF_KEY3}-${req.user.id}`;
+        const key = `${PREF_KEY2}-${req.user.id}`;
         const existing = await dbFind(payload, "payload-preferences", {
-          where: { key: { equals: key } },
+          where: { key: { equals: key }, "user.relationTo": { equals: slugs.users } },
           limit: 1,
           depth: 0,
           overrideAccess: true
@@ -1740,7 +1938,6 @@ function createSignaturePostEndpoint(slugs) {
 }
 
 // src/endpoints/round-robin-config.ts
-var PREF_KEY4 = "support-round-robin";
 function createRoundRobinConfigGetEndpoint(slugs) {
   return {
     path: "/support/round-robin-config",
@@ -1749,14 +1946,8 @@ function createRoundRobinConfigGetEndpoint(slugs) {
       try {
         const payload = req.payload;
         requireAdmin(req, slugs);
-        const prefs = await dbFind(payload, "payload-preferences", {
-          where: { key: { equals: PREF_KEY4 } },
-          limit: 1,
-          depth: 0,
-          overrideAccess: true
-        });
-        const enabled = prefs.docs.length > 0 ? prefs.docs[0].value?.enabled === true : false;
-        return Response.json({ enabled });
+        const { settings } = await readSupportSettingsState(payload);
+        return Response.json({ enabled: settings.features.roundRobin });
       } catch (error) {
         const authResponse = handleAuthError(error);
         if (authResponse) return authResponse;
@@ -1775,28 +1966,31 @@ function createRoundRobinConfigPostEndpoint(slugs) {
         const payload = req.payload;
         requireAdmin(req, slugs);
         const { enabled } = await req.json();
-        const existing = await dbFind(payload, "payload-preferences", {
-          where: { key: { equals: PREF_KEY4 } },
-          limit: 1,
-          depth: 0,
-          overrideAccess: true
-        });
+        const { settings: current } = await readSupportSettingsState(payload);
+        const merged = mergeSupportSettings(
+          { features: { ...current.features, roundRobin: !!enabled } },
+          current
+        );
         await payload.db.upsert({
           collection: "payload-preferences",
           data: {
-            key: PREF_KEY4,
+            key: SUPPORT_SETTINGS_PREF_KEY,
             user: { relationTo: req.user.collection, value: req.user.id },
-            value: { enabled: !!enabled }
+            value: {
+              ...merged,
+              features: stripProjectedFeatures(merged.features)
+            }
           },
           req: { payload, user: req.user },
           where: {
             and: [
-              { key: { equals: PREF_KEY4 } },
+              { key: { equals: SUPPORT_SETTINGS_PREF_KEY } },
               { "user.value": { equals: req.user.id } },
               { "user.relationTo": { equals: req.user.collection } }
             ]
           }
         });
+        invalidateSupportSettingsCache();
         return Response.json({ enabled: !!enabled });
       } catch (error) {
         const authResponse = handleAuthError(error);
@@ -2472,7 +2666,7 @@ function formatFr(date, withTime) {
   });
 }
 function createSendReminderEndpoint(slugs, store) {
-  const reminderLimiter = new RateLimiter(60 * 60 * 1e3, 30, store);
+  const reminderLimiter = new RateLimiter(60 * 60 * 1e3, 30, store, "send-reminder");
   return {
     path: "/support/send-reminder",
     method: "post",
@@ -2480,7 +2674,7 @@ function createSendReminderEndpoint(slugs, store) {
       try {
         const payload = req.payload;
         requireAdmin(req, slugs);
-        if (await reminderLimiter.check(String(req.user.id), req)) {
+        if (await reminderLimiter.check(principalRateKey(req.user), req)) {
           return Response.json(
             { error: "Trop de relances. R\xE9essayez dans une heure." },
             { status: 429 }
@@ -2783,8 +2977,14 @@ function createPurgeLogsEndpoint(slugs) {
 }
 
 // src/endpoints/chatbot.ts
-function createChatbotEndpoint(slugs, store) {
-  const chatbotLimiter = new RateLimiter(6e4, 10, store);
+var DEFAULT_CHATBOT_MAX_PER_HOUR = 200;
+function resolveMaxPerHour(explicit) {
+  const fromEnv = Number(process.env.SUPPORT_CHATBOT_MAX_PER_HOUR);
+  return Number.isFinite(fromEnv) && fromEnv > 0 ? fromEnv : DEFAULT_CHATBOT_MAX_PER_HOUR;
+}
+function createChatbotEndpoint(slugs, store, maxPerHour) {
+  const chatbotLimiter = new RateLimiter(6e4, 10, store, "chatbot:ip");
+  const globalLimiter = new RateLimiter(60 * 6e4, resolveMaxPerHour(), store, "chatbot:global");
   return {
     path: "/support/chatbot",
     method: "post",
@@ -2804,6 +3004,15 @@ function createChatbotEndpoint(slugs, store) {
         if (!question?.trim() || question.trim().length < 5) {
           return Response.json({ error: "Question too short" }, { status: 400 });
         }
+        if (await globalLimiter.check("all", req)) {
+          return Response.json({
+            answer: null,
+            confidence: 0,
+            suggestion: "create_ticket",
+            aiUnavailable: true,
+            message: "L'assistant est momentan\xE9ment indisponible. Cr\xE9ez un ticket, un agent vous r\xE9pondra."
+          });
+        }
         const payload = req.payload;
         const articles = await dbFind(payload, slugs.knowledgeBase, {
           where: { published: { equals: true } },
@@ -2916,8 +3125,8 @@ function createChatGetEndpoint(slugs) {
   };
 }
 function createChatPostEndpoint(slugs, store) {
-  const chatSessionLimiter = new RateLimiter(36e5, 5, store);
-  const chatMessageLimiter = new RateLimiter(6e4, 15, store);
+  const chatSessionLimiter = new RateLimiter(36e5, 5, store, "chat:session");
+  const chatMessageLimiter = new RateLimiter(6e4, 15, store, "chat:message");
   return {
     path: "/support/chat",
     method: "post",
@@ -2933,8 +3142,9 @@ function createChatPostEndpoint(slugs, store) {
         }
         const { action, session, message } = body;
         const userId = String(req.user.id);
+        const rateKey = principalRateKey(req.user);
         if (action === "start") {
-          if (await chatSessionLimiter.check(userId, req)) {
+          if (await chatSessionLimiter.check(rateKey, req)) {
             return Response.json({ error: "Trop de sessions cr\xE9\xE9es. R\xE9essayez plus tard." }, { status: 429 });
           }
           const sessionId = `chat_${crypto3.randomBytes(16).toString("hex")}`;
@@ -2951,7 +3161,7 @@ function createChatPostEndpoint(slugs, store) {
           return Response.json({ session: sessionId, messages: [systemMsg] });
         }
         if (action === "send" && session && message) {
-          if (await chatMessageLimiter.check(userId, req)) {
+          if (await chatMessageLimiter.check(rateKey, req)) {
             return Response.json({ error: "Trop de messages. Attendez un moment." }, { status: 429 });
           }
           const trimmedMessage = String(message).trim();
@@ -3191,7 +3401,7 @@ function createAdminChatGetEndpoint(slugs) {
   };
 }
 function createAdminChatPostEndpoint(slugs, store) {
-  const adminChatLimiter = new RateLimiter(6e4, 30, store);
+  const adminChatLimiter = new RateLimiter(6e4, 30, store, "admin-chat");
   return {
     path: "/support/admin-chat",
     method: "post",
@@ -3220,7 +3430,7 @@ function createAdminChatPostEndpoint(slugs, store) {
         }
         const clientId = typeof sessionMsg.docs[0].client === "object" ? sessionMsg.docs[0].client.id : sessionMsg.docs[0].client;
         if (action === "send" && message) {
-          if (await adminChatLimiter.check(String(req.user.id), req)) {
+          if (await adminChatLimiter.check(principalRateKey(req.user), req)) {
             return Response.json({ error: "Rate limit atteint." }, { status: 429 });
           }
           const trimmedMessage = String(message).trim();
@@ -4058,7 +4268,7 @@ function createInvoiceEndpoint(slugs) {
 function getClient4(aiSettings) {
   const Anthropic = __require("@anthropic-ai/sdk").default;
   if (aiSettings.provider === "ollama") {
-    const baseURL = process.env.OLLAMA_API_URL || "https://ollama.orkelis.app/v1";
+    const baseURL = resolveOllamaBaseUrl();
     return new Anthropic({ apiKey: "ollama", baseURL });
   }
   return new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
@@ -4175,14 +4385,14 @@ Reponds UNIQUEMENT avec la liste de puces, rien d'autre.`;
 
 // src/endpoints/ticket-synthesis.ts
 function createTicketSynthesisEndpoint(slugs, generator, store) {
-  const limiter = new RateLimiter(6e4, 20, store);
+  const limiter = new RateLimiter(6e4, 20, store, "ticket-synthesis");
   return {
     path: "/support/ticket-synthesis",
     method: "post",
     handler: async (req) => {
       try {
         requireAdmin(req, slugs);
-        if (await limiter.check(String(req.user.id), req)) {
+        if (await limiter.check(principalRateKey(req.user), req)) {
           return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
         }
         const payload = req.payload;
@@ -4226,15 +4436,17 @@ function createTicketSynthesisEndpoint(slugs, generator, store) {
 }
 
 // src/endpoints/email-stats.ts
-function createEmailStatsEndpoint(slugs) {
+function createEmailStatsEndpoint(slugs, store) {
+  const statsLimiter = new RateLimiter(6e4, 20, store, "email-stats");
   return {
     path: "/support/email-stats",
     method: "get",
     handler: async (req) => {
       try {
         const payload = req.payload;
-        if (!req.user) {
-          return Response.json({ error: "Unauthorized" }, { status: 401 });
+        requireAdmin(req, slugs);
+        if (await statsLimiter.check(principalRateKey(req.user), req)) {
+          return Response.json({ error: "Too many requests." }, { status: 429 });
         }
         const url = new URL(req.url);
         const days = Math.min(Number(url.searchParams.get("days")) || 7, 365);
@@ -4301,6 +4513,8 @@ function createEmailStatsEndpoint(slugs) {
           actions: Object.fromEntries(actionMap)
         });
       } catch (err) {
+        const authResponse = handleAuthError(err);
+        if (authResponse) return authResponse;
         console.error("[email-stats] Error:", err);
         return Response.json({ error: "Internal server error" }, { status: 500 });
       }
@@ -4733,7 +4947,7 @@ function createPendingEmailsProcessEndpoint(slugs) {
 
 // src/endpoints/resend-notification.ts
 function createResendNotificationEndpoint(slugs, store) {
-  const resendLimiter = new RateLimiter(60 * 60 * 1e3, 10, store);
+  const resendLimiter = new RateLimiter(60 * 60 * 1e3, 10, store, "resend-notification");
   return {
     path: "/support/resend-notification",
     method: "post",
@@ -4741,7 +4955,7 @@ function createResendNotificationEndpoint(slugs, store) {
       try {
         const payload = req.payload;
         requireAdmin(req, slugs);
-        if (await resendLimiter.check(String(req.user.id), req)) {
+        if (await resendLimiter.check(principalRateKey(req.user), req)) {
           return Response.json(
             { error: "Trop de renvois. R\xE9essayez dans une heure." },
             { status: 429 }
@@ -4942,10 +5156,48 @@ function createSeedKbEndpoint(slugs) {
     }
   };
 }
+var TWO_FACTOR_CHALLENGE_TTL_MS = 10 * 60 * 1e3;
+function challengeSecret() {
+  const secret = process.env.PAYLOAD_SECRET;
+  if (!secret) {
+    throw new Error(
+      "[support][2fa] PAYLOAD_SECRET is not set \u2014 refusing to issue a 2FA challenge with an insecure fallback secret"
+    );
+  }
+  return secret;
+}
+function normalizeEmail(email) {
+  return String(email).trim().toLowerCase();
+}
+function sign(email, expiresAt) {
+  return createHmac("sha256", challengeSecret()).update(`2fa-challenge:${normalizeEmail(email)}:${expiresAt}`).digest("hex");
+}
+function issueTwoFactorChallenge(email, now = Date.now()) {
+  const expiresAt = now + TWO_FACTOR_CHALLENGE_TTL_MS;
+  return `${expiresAt}.${sign(email, expiresAt)}`;
+}
+function verifyTwoFactorChallenge(email, token, now = Date.now()) {
+  if (typeof email !== "string" || !email || typeof token !== "string") return false;
+  const separator = token.indexOf(".");
+  if (separator <= 0) return false;
+  const expiresAt = Number(token.slice(0, separator));
+  if (!Number.isSafeInteger(expiresAt) || expiresAt <= now) return false;
+  const received = token.slice(separator + 1);
+  if (!/^[0-9a-f]{64}$/i.test(received)) return false;
+  let expected;
+  try {
+    expected = sign(email, expiresAt);
+  } catch {
+    return false;
+  }
+  const a = Buffer.from(expected, "hex");
+  const b = Buffer.from(received.toLowerCase(), "hex");
+  return a.length === b.length && timingSafeEqual(a, b);
+}
 
 // src/endpoints/login.ts
 function createLoginEndpoint(slugs, store) {
-  const loginLimiter = new RateLimiter(15 * 6e4, 10, store);
+  const loginLimiter = new RateLimiter(15 * 6e4, 10, store, "login");
   return {
     path: "/support/login",
     method: "post",
@@ -4998,7 +5250,12 @@ function createLoginEndpoint(slugs, store) {
       } catch (err) {
         const errorMessage = err instanceof Error ? err.message : "Erreur inconnue";
         if (errorMessage.includes("2FA_REQUIRED")) {
-          return Response.json({ requires2FA: true }, { status: 200 });
+          let challenge;
+          try {
+            challenge = issueTwoFactorChallenge(email);
+          } catch {
+          }
+          return Response.json({ requires2FA: true, ...challenge ? { challenge } : {} }, { status: 200 });
         }
         let errorReason = "Identifiants incorrects";
         if (errorMessage.includes("locked") || errorMessage.includes("verrouill\xE9") || errorMessage.includes("Too many")) {
@@ -5030,8 +5287,8 @@ function hashCode(code) {
   return createHmac("sha256", secret).update(code).digest("hex");
 }
 function createAuth2faEndpoint(slugs, store) {
-  const sendLimiter = new RateLimiter(60 * 60 * 1e3, 3, store);
-  const verifyLimiter = new RateLimiter(15 * 60 * 1e3, 5, store);
+  const sendLimiter = new RateLimiter(60 * 60 * 1e3, 3, store, "2fa:send");
+  const verifyLimiter = new RateLimiter(15 * 60 * 1e3, 5, store, "2fa:verify");
   return {
     path: "/support/2fa",
     method: "post",
@@ -5044,12 +5301,18 @@ function createAuth2faEndpoint(slugs, store) {
         } catch {
           return Response.json({ error: "Invalid JSON body" }, { status: 400 });
         }
-        const { action, email, code } = body;
+        const { action, email, code, challenge } = body;
         if (!action || !email) {
           return Response.json({ error: "Param\xE8tres manquants" }, { status: 400 });
         }
         const genericSendResponse = { success: true, message: "Si un compte existe, un code a \xE9t\xE9 envoy\xE9." };
         if (action === "send") {
+          if (!verifyTwoFactorChallenge(email, challenge)) {
+            return Response.json(
+              { error: "Authentification requise avant l'envoi d'un code." },
+              { status: 401 }
+            );
+          }
           if (await sendLimiter.check(email, req)) {
             return Response.json(genericSendResponse);
           }
@@ -5143,6 +5406,33 @@ function createAuth2faEndpoint(slugs, store) {
     }
   };
 }
+var OAUTH_STATE_COOKIE = "support-oauth-state";
+var OAUTH_STATE_MAX_AGE = 600;
+var TWO_FA_WINDOW_MS = 5 * 60 * 1e3;
+function readCookie(header, name) {
+  if (!header) return null;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    if (part.slice(0, eq).trim() !== name) continue;
+    try {
+      return decodeURIComponent(part.slice(eq + 1).trim());
+    } catch {
+      return part.slice(eq + 1).trim();
+    }
+  }
+  return null;
+}
+function clearedStateCookie() {
+  const secure = process.env.NODE_ENV === "production";
+  return `${OAUTH_STATE_COOKIE}=; HttpOnly; ${secure ? "Secure; " : ""}SameSite=Lax; Path=/; Max-Age=0`;
+}
+function statesMatch(a, b) {
+  if (!a || !b) return false;
+  const left = crypto3.createHash("sha256").update(a).digest();
+  const right = crypto3.createHash("sha256").update(b).digest();
+  return crypto3.timingSafeEqual(left, right);
+}
 function createOAuthGoogleEndpoint(slugs, options) {
   return {
     path: "/support/oauth/google",
@@ -5159,7 +5449,7 @@ function createOAuthGoogleEndpoint(slugs, options) {
       }
       try {
         const body = await req.json();
-        const { action, code, state: queryState, cookieState } = body;
+        const { action, code, state: queryState } = body;
         if (action === "login") {
           const oauthState = crypto3.randomBytes(32).toString("hex");
           const redirectUri = `${baseUrl}/api/support/oauth/google`;
@@ -5171,13 +5461,25 @@ function createOAuthGoogleEndpoint(slugs, options) {
             state: oauthState,
             prompt: "select_account"
           });
-          return Response.json({
-            url: `https://accounts.google.com/o/oauth2/v2/auth?${params}`,
-            state: oauthState
-          });
+          const secure = process.env.NODE_ENV === "production";
+          const loginHeaders = new Headers({ "Content-Type": "application/json" });
+          loginHeaders.append(
+            "Set-Cookie",
+            `${OAUTH_STATE_COOKIE}=${oauthState}; HttpOnly; ${secure ? "Secure; " : ""}SameSite=Lax; Path=/; Max-Age=${OAUTH_STATE_MAX_AGE}`
+          );
+          return new Response(
+            JSON.stringify({
+              url: `https://accounts.google.com/o/oauth2/v2/auth?${params}`,
+              // Kept for callers that echo it back in the redirect URL; the
+              // server no longer trusts anything the caller returns.
+              state: oauthState
+            }),
+            { status: 200, headers: loginHeaders }
+          );
         }
         if (code) {
-          if (!cookieState || !queryState || cookieState !== queryState) {
+          const issuedState = readCookie(req.headers.get("cookie"), OAUTH_STATE_COOKIE);
+          if (!statesMatch(issuedState, queryState)) {
             return Response.json({ error: "state_mismatch" }, { status: 400 });
           }
           const redirectUri = `${baseUrl}/api/support/oauth/google`;
@@ -5259,6 +5561,35 @@ function createOAuthGoogleEndpoint(slugs, options) {
               overrideAccess: true
             });
           }
+          const twoFactorDoc = await dbFindByID(payload, slugs.supportClients, {
+            id: clientDoc.id,
+            depth: 0,
+            overrideAccess: true,
+            showHiddenFields: true
+          });
+          if (twoFactorDoc?.twoFactorEnabled) {
+            const raw = twoFactorDoc.twoFactorVerifiedAt;
+            const verifiedAt = raw ? new Date(raw).getTime() : 0;
+            if (!(verifiedAt > Date.now() - TWO_FA_WINDOW_MS)) {
+              let challenge;
+              try {
+                challenge = issueTwoFactorChallenge(clientDoc.email);
+              } catch {
+              }
+              return new Response(JSON.stringify({ requires2FA: true, ...challenge ? { challenge } : {} }), {
+                status: 200,
+                headers: new Headers({
+                  "Content-Type": "application/json",
+                  "Set-Cookie": clearedStateCookie()
+                })
+              });
+            }
+            await dbUpdate(payload, slugs.supportClients, {
+              id: clientDoc.id,
+              data: { twoFactorVerifiedAt: null },
+              overrideAccess: true
+            });
+          }
           const secret = process.env.PAYLOAD_SECRET;
           if (!secret) {
             return Response.json({ error: "server_misconfigured" }, { status: 500 });
@@ -5302,6 +5633,7 @@ function createOAuthGoogleEndpoint(slugs, options) {
             "Set-Cookie",
             `payload-token=${token}; HttpOnly; ${cookieSecure ? "Secure; " : ""}SameSite=Lax; Path=/; Max-Age=${tokenExpiration}`
           );
+          headers.append("Set-Cookie", clearedStateCookie());
           return new Response(JSON.stringify({ user: clientDoc, exp }), {
             status: 200,
             headers
@@ -5608,7 +5940,7 @@ ONLY JSON, nothing else.`
   }
 }
 function createImportConversationEndpoint(slugs, store) {
-  const importLimiter = new RateLimiter(36e5, 10, store);
+  const importLimiter = new RateLimiter(36e5, 10, store, "import-conversation");
   return {
     path: "/support/import-conversation",
     method: "post",
@@ -5751,62 +6083,204 @@ function createImportConversationEndpoint(slugs, store) {
     }
   };
 }
+function httpAllowed() {
+  return process.env.SUPPORT_ALLOW_INSECURE_WEBHOOKS === "1";
+}
+var BLOCKED_HOST_SUFFIXES = [".local", ".localhost", ".internal", ".home.arpa"];
+function parseIPv4(host) {
+  const parts = host.split(".");
+  if (parts.length !== 4) return null;
+  const octets = [];
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part)) return null;
+    const n = Number(part);
+    if (n > 255) return null;
+    octets.push(n);
+  }
+  return octets;
+}
+function isPrivateIPv4(octets) {
+  const [a, b] = octets;
+  if (a === 0) return true;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 192 && b === 0) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a >= 224) return true;
+  return false;
+}
+function isPrivateIPv6(host) {
+  const lower = host.toLowerCase();
+  if (lower === "::" || lower === "::1") return true;
+  if (lower.startsWith("fe8") || lower.startsWith("fe9") || lower.startsWith("fea") || lower.startsWith("feb")) return true;
+  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
+  if (lower.startsWith("ff")) return true;
+  const dotted = lower.match(/^::(?:ffff:)?(\d{1,3}(?:\.\d{1,3}){3})$/);
+  if (dotted) {
+    const octets = parseIPv4(dotted[1]);
+    return octets ? isPrivateIPv4(octets) : true;
+  }
+  const hex = lower.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+  if (hex) {
+    const high = parseInt(hex[1], 16);
+    const low = parseInt(hex[2], 16);
+    return isPrivateIPv4([high >> 8, high & 255, low >> 8, low & 255]);
+  }
+  return false;
+}
+function normalizeHost(hostname) {
+  const host = hostname.trim().toLowerCase();
+  return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+}
+function isBlockedHost(hostname) {
+  const host = normalizeHost(hostname);
+  if (!host) return true;
+  if (host === "localhost") return true;
+  if (BLOCKED_HOST_SUFFIXES.some((suffix) => host.endsWith(suffix))) return true;
+  const v4 = parseIPv4(host);
+  if (v4) return isPrivateIPv4(v4);
+  if (host.includes(":")) return isPrivateIPv6(host);
+  return false;
+}
+function validateWebhookUrl(raw) {
+  if (typeof raw !== "string" || !raw.trim()) return { ok: false, reason: "invalid_url" };
+  let url;
+  try {
+    url = new URL(raw.trim());
+  } catch {
+    return { ok: false, reason: "invalid_url" };
+  }
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && httpAllowed())) {
+    return { ok: false, reason: "scheme_not_allowed" };
+  }
+  if (isBlockedHost(url.hostname)) return { ok: false, reason: "private_host" };
+  return { ok: true, url };
+}
+var WEBHOOK_URL_MESSAGES = {
+  invalid_url: "URL invalide.",
+  scheme_not_allowed: "Seules les URL https:// sont accept\xE9es.",
+  private_host: "Les adresses priv\xE9es, loopback et link-local sont interdites (SSRF)."
+};
+var LOOKUP_TIMEOUT_MS = 5e3;
+var LOOKUP_TIMED_OUT = /* @__PURE__ */ Symbol("lookup-timed-out");
+var NONEXISTENT_HOST_CODES = /* @__PURE__ */ new Set(["ENOTFOUND", "ENODATA", "NOTFOUND"]);
+async function assertPublicHost(hostname) {
+  const host = normalizeHost(hostname);
+  if (isBlockedHost(host)) return false;
+  if (parseIPv4(host) || host.includes(":")) return true;
+  try {
+    const addresses = await Promise.race([
+      lookup(host, { all: true }),
+      new Promise(
+        (resolve) => setTimeout(() => resolve(LOOKUP_TIMED_OUT), LOOKUP_TIMEOUT_MS).unref?.()
+      )
+    ]);
+    if (addresses === LOOKUP_TIMED_OUT) return false;
+    if (!Array.isArray(addresses) || addresses.length === 0) return false;
+    return addresses.every((entry) => !isBlockedHost(entry.address));
+  } catch (error) {
+    const code = error?.code;
+    return typeof code === "string" && NONEXISTENT_HOST_CODES.has(code);
+  }
+}
+var BlockedRequestError = class extends Error {
+  constructor(reason) {
+    super(`Blocked outbound request: ${reason}`);
+    this.reason = reason;
+    this.name = "BlockedRequestError";
+  }
+  reason;
+};
+var MAX_REDIRECTS = 3;
+async function safeFetch(rawUrl, init) {
+  let current = rawUrl;
+  let body = init.body;
+  for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+    const validation = validateWebhookUrl(current);
+    if (!validation.ok || !validation.url) throw new BlockedRequestError(validation.reason || "invalid_url");
+    if (!await assertPublicHost(validation.url.hostname)) throw new BlockedRequestError("private_host");
+    const response = await fetch(current, { ...init, body, redirect: "manual" });
+    if (response.status < 300 || response.status > 399) return response;
+    const location = response.headers.get("location");
+    if (!location) return response;
+    current = new URL(location, current).toString();
+    if (response.status === 303) body = void 0;
+  }
+  throw new BlockedRequestError("too_many_redirects");
+}
 
-// src/utils/fireWebhooks.ts
-async function fireWebhooks(payload, slugs, event, data) {
+// src/utils/webhookDispatcher.ts
+function dispatchWebhook(data, event, payload, slugs) {
+  const done = _dispatch(data, event, payload, slugs);
+  return done;
+}
+async function _dispatch(data, event, payload, slugs) {
   try {
-    const endpoints = await dbFind(payload, slugs.webhookEndpoints, {
+    const { docs: endpoints } = await dbFind(payload, slugs.webhookEndpoints, {
       where: {
-        active: { equals: true },
-        events: { contains: event }
+        and: [
+          { active: { equals: true } },
+          { events: { contains: event } }
+        ]
       },
       limit: 50,
       depth: 0,
       overrideAccess: true
     });
-    if (endpoints.docs.length === 0) return;
-    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    if (endpoints.length === 0) return;
+    const body = JSON.stringify({ event, data, timestamp: (/* @__PURE__ */ new Date()).toISOString() });
     await Promise.allSettled(
-      endpoints.docs.map(async (endpoint) => {
-        try {
-          const res = await fetch(endpoint.url, {
-            method: "POST",
-            headers: {
-              "Content-Type": "application/json",
-              ...endpoint.secret ? { "X-Webhook-Secret": endpoint.secret } : {}
-            },
-            body: JSON.stringify({ event, data, timestamp }),
-            signal: AbortSignal.timeout(1e4)
-          });
-          try {
-            await dbUpdate(payload, slugs.webhookEndpoints, {
-              id: endpoint.id,
-              data: {
-                lastTriggeredAt: timestamp,
-                lastStatus: res.status
-              },
-              overrideAccess: true
-            });
-          } catch {
-          }
-        } catch (error) {
-          console.warn(`[support] Webhook delivery failed: ${endpoint.url}`, error);
-          try {
-            await dbUpdate(payload, slugs.webhookEndpoints, {
-              id: endpoint.id,
-              data: {
-                lastTriggeredAt: timestamp,
-                lastStatus: 0
-              },
-              overrideAccess: true
-            });
-          } catch {
-          }
-        }
-      })
+      endpoints.map((endpoint) => _sendToEndpoint(endpoint, body, payload, slugs))
     );
-  } catch (error) {
-    console.error("[support] Failed to fire webhooks:", error);
+  } catch (err) {
+    console.error(`[webhook] Failed to fetch endpoints for event ${event}:`, err);
+  }
+}
+async function _sendToEndpoint(endpoint, body, payload, slugs) {
+  try {
+    const headers = {
+      "Content-Type": "application/json",
+      "User-Agent": "PayloadSupport-Webhook/1.0"
+    };
+    if (endpoint.secret) {
+      const signature = crypto3.createHmac("sha256", endpoint.secret).update(body).digest("hex");
+      headers["X-Webhook-Signature"] = signature;
+    }
+    const response = await safeFetch(endpoint.url, {
+      method: "POST",
+      headers,
+      body,
+      signal: AbortSignal.timeout(1e4)
+      // 10s timeout
+    });
+    await dbUpdate(payload, slugs.webhookEndpoints, {
+      id: endpoint.id,
+      data: {
+        lastTriggeredAt: (/* @__PURE__ */ new Date()).toISOString(),
+        lastStatus: response.status
+      },
+      overrideAccess: true
+    });
+    if (!response.ok) {
+      console.warn(`[webhook] ${endpoint.name || endpoint.url} returned ${response.status}`);
+    }
+  } catch (err) {
+    console.error(`[webhook] Failed to call ${endpoint.name || endpoint.url}:`, err);
+    try {
+      await dbUpdate(payload, slugs.webhookEndpoints, {
+        id: endpoint.id,
+        data: {
+          lastTriggeredAt: (/* @__PURE__ */ new Date()).toISOString(),
+          lastStatus: 0
+        },
+        overrideAccess: true
+      });
+    } catch {
+    }
   }
 }
 
@@ -5893,13 +6367,18 @@ function createProcessScheduledEndpoint(slugs) {
                 overrideAccess: true
               });
             }
-            fireWebhooks(payload, slugs, "ticket_replied", {
-              ticketId,
-              messageId: msg.id,
-              authorType: msg.authorType,
-              scheduled: true,
-              body: msg.body?.length > 500 ? msg.body.slice(0, 500) + "..." : msg.body
-            });
+            dispatchWebhook(
+              {
+                ticketId,
+                messageId: msg.id,
+                authorType: msg.authorType,
+                scheduled: true,
+                body: msg.body?.length > 500 ? msg.body.slice(0, 500) + "..." : msg.body
+              },
+              "ticket_replied",
+              payload,
+              slugs
+            );
             results.processed++;
           } catch (err) {
             console.error(`[process-scheduled] Error processing message ${message.id}:`, err);
@@ -6225,7 +6704,7 @@ function createUserPrefsGetEndpoint(slugs) {
         requireAdmin(req, slugs);
         const key = `${PREF_KEY_PREFIX}-${req.user.id}`;
         const prefs = await dbFind(payload, "payload-preferences", {
-          where: { key: { equals: key } },
+          where: { key: { equals: key }, "user.relationTo": { equals: slugs.users } },
           limit: 1,
           depth: 0,
           overrideAccess: true
@@ -6259,7 +6738,7 @@ function createUserPrefsPostEndpoint(slugs) {
         const body = await req.json();
         const key = `${PREF_KEY_PREFIX}-${req.user.id}`;
         const existing = await dbFind(payload, "payload-preferences", {
-          where: { key: { equals: key } },
+          where: { key: { equals: key }, "user.relationTo": { equals: slugs.users } },
           limit: 1,
           depth: 0,
           overrideAccess: true
@@ -6415,8 +6894,10 @@ function createTicketFeedbackEndpoint(slugs) {
 // src/endpoints/transfer-ticket.ts
 var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 var MAX_TRANSFERS_PER_DAY = 5;
+var MAX_TRANSFERS_PER_USER_PER_DAY = 15;
 function createTransferTicketEndpoint(slugs, store) {
-  const transferLimiter = new RateLimiter(24 * 60 * 60 * 1e3, MAX_TRANSFERS_PER_DAY, store);
+  const transferLimiter = new RateLimiter(24 * 60 * 60 * 1e3, MAX_TRANSFERS_PER_DAY, store, "transfer:ticket");
+  const transferUserLimiter = new RateLimiter(24 * 60 * 60 * 1e3, MAX_TRANSFERS_PER_USER_PER_DAY, store, "transfer:user");
   return {
     path: "/support/tickets/:id/transfer",
     method: "post",
@@ -6451,12 +6932,18 @@ function createTransferTicketEndpoint(slugs, store) {
         if (!isAdmin && !isOwner) {
           return Response.json({ error: "Forbidden" }, { status: 403 });
         }
-        if (await transferLimiter.check(`${req.user.id}:${ticketId}`, req)) {
+        if (await transferLimiter.check(`${principalRateKey(req.user)}:${ticketId}`, req)) {
           return Response.json(
             { error: `Limite atteinte (${MAX_TRANSFERS_PER_DAY} transferts par 24h sur ce ticket)` },
             { status: 429 }
           );
         }
+        if (!isAdmin && await transferUserLimiter.check(principalRateKey(req.user), req)) {
+          return Response.json(
+            { error: `Limite atteinte (${MAX_TRANSFERS_PER_USER_PER_DAY} transferts par 24h)` },
+            { status: 429 }
+          );
+        }
         try {
           const since = new Date(Date.now() - 24 * 60 * 60 * 1e3).toISOString();
           const existing = await dbCount(payload, slugs.emailLogs, {
@@ -6598,8 +7085,11 @@ function statusToLabel(status) {
 }
 var EMAIL_RE2 = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 var MAX_COLLABORATORS_PER_TICKET = 20;
+var MAX_NEW_ACCOUNTS_PER_INVITER = 30;
+var NEW_ACCOUNT_WINDOW_MS = 7 * 24 * 60 * 60 * 1e3;
 function createInviteCollaboratorEndpoint(slugs, store) {
-  const inviteLimiter = new RateLimiter(60 * 60 * 1e3, 10, store);
+  const inviteLimiter = new RateLimiter(60 * 60 * 1e3, 10, store, "invite-collaborator");
+  const newAccountLimiter = new RateLimiter(NEW_ACCOUNT_WINDOW_MS, MAX_NEW_ACCOUNTS_PER_INVITER, store, "invite-collaborator:new-account");
   return {
     path: "/support/tickets/:id/invite",
     method: "post",
@@ -6634,7 +7124,7 @@ function createInviteCollaboratorEndpoint(slugs, store) {
         if (!isAdmin && !isOwner) {
           return Response.json({ error: "Forbidden" }, { status: 403 });
         }
-        if (await inviteLimiter.check(String(req.user.id), req)) {
+        if (await inviteLimiter.check(principalRateKey(req.user), req)) {
           return Response.json({ error: "Trop d'invitations. R\xE9essayez plus tard." }, { status: 429 });
         }
         const collabCount = await dbCount(payload, "ticket-collaborators", { where: { ticket: { equals: ticketId } }, overrideAccess: true }).catch(() => ({ totalDocs: 0 }));
@@ -6658,6 +7148,12 @@ function createInviteCollaboratorEndpoint(slugs, store) {
         if (existing.docs.length > 0) {
           inviteeId = existing.docs[0].id;
         } else {
+          if (!isAdmin && await newAccountLimiter.check(principalRateKey(req.user), req)) {
+            return Response.json(
+              { error: "Trop de nouveaux comptes invit\xE9s. R\xE9essayez plus tard." },
+              { status: 429 }
+            );
+          }
           const tempPassword = randomBytes(16).toString("hex");
           const created = await dbCreate(payload, slugs.supportClients, {
             data: {
@@ -6829,7 +7325,7 @@ function createSupportEndpoints(slugs, options) {
   }
   if (!f || f.satisfaction !== false) endpoints.push(createSatisfactionEndpoint(slugs));
   if (!f || f.emailTracking !== false) {
-    endpoints.push(createEmailStatsEndpoint(slugs), createTrackOpenEndpoint(slugs));
+    endpoints.push(createEmailStatsEndpoint(slugs, rateLimitStore), createTrackOpenEndpoint(slugs));
   }
   if (!f || f.pendingEmails !== false) endpoints.push(createPendingEmailsProcessEndpoint(slugs));
   if (!f || f.scheduledReplies !== false) endpoints.push(createProcessScheduledEndpoint(slugs));
@@ -6869,74 +7365,6 @@ async function createAdminNotification(payload, data, collectionSlug = "admin-no
     console.error("[notification] Failed to create:", err);
   }
 }
-function dispatchWebhook(data, event, payload, slugs) {
-  void _dispatch(data, event, payload, slugs);
-}
-async function _dispatch(data, event, payload, slugs) {
-  try {
-    const { docs: endpoints } = await dbFind(payload, slugs.webhookEndpoints, {
-      where: {
-        and: [
-          { active: { equals: true } },
-          { events: { contains: event } }
-        ]
-      },
-      limit: 50,
-      depth: 0,
-      overrideAccess: true
-    });
-    if (endpoints.length === 0) return;
-    const body = JSON.stringify({ event, data, timestamp: (/* @__PURE__ */ new Date()).toISOString() });
-    for (const endpoint of endpoints) {
-      void _sendToEndpoint(endpoint, body, payload, slugs);
-    }
-  } catch (err) {
-    console.error(`[webhook] Failed to fetch endpoints for event ${event}:`, err);
-  }
-}
-async function _sendToEndpoint(endpoint, body, payload, slugs) {
-  try {
-    const headers = {
-      "Content-Type": "application/json",
-      "User-Agent": "PayloadSupport-Webhook/1.0"
-    };
-    if (endpoint.secret) {
-      const signature = crypto3.createHmac("sha256", endpoint.secret).update(body).digest("hex");
-      headers["X-Webhook-Signature"] = signature;
-    }
-    const response = await fetch(endpoint.url, {
-      method: "POST",
-      headers,
-      body,
-      signal: AbortSignal.timeout(1e4)
-      // 10s timeout
-    });
-    await dbUpdate(payload, slugs.webhookEndpoints, {
-      id: endpoint.id,
-      data: {
-        lastTriggeredAt: (/* @__PURE__ */ new Date()).toISOString(),
-        lastStatus: response.status
-      },
-      overrideAccess: true
-    });
-    if (!response.ok) {
-      console.warn(`[webhook] ${endpoint.name || endpoint.url} returned ${response.status}`);
-    }
-  } catch (err) {
-    console.error(`[webhook] Failed to call ${endpoint.name || endpoint.url}:`, err);
-    try {
-      await dbUpdate(payload, slugs.webhookEndpoints, {
-        id: endpoint.id,
-        data: {
-          lastTriggeredAt: (/* @__PURE__ */ new Date()).toISOString(),
-          lastStatus: 0
-        },
-        overrideAccess: true
-      });
-    } catch {
-    }
-  }
-}
 
 // src/hooks/ticketStatusEmail.ts
 var STATUS_LABELS = {
@@ -7553,12 +7981,28 @@ function createAssignTicketNumber(slugs, options) {
 }
 function createAssignClientOnCreate(slugs) {
   return async ({ data, operation, req }) => {
-    if (operation === "create" && req.user?.collection === slugs.supportClients && !data.client) {
+    if (operation === "create" && req.user?.collection === slugs.supportClients) {
       data.client = req.user.id;
     }
     return data;
   };
 }
+var CLIENT_CREATABLE_TICKET_FIELDS = ["subject", "category", "priority", "project"];
+function createRestrictClientCreate(slugs) {
+  return async ({ data, operation, req }) => {
+    if (operation !== "create") return data;
+    if (req.user?.collection !== slugs.supportClients) return data;
+    const incoming = data ?? {};
+    const sanitized = {};
+    for (const field2 of CLIENT_CREATABLE_TICKET_FIELDS) {
+      if (incoming[field2] !== void 0) sanitized[field2] = incoming[field2];
+    }
+    sanitized.status = "open";
+    sanitized.client = req.user.id;
+    sanitized.source = "portal";
+    return sanitized;
+  };
+}
 var autoPaidAt = async ({ data, operation, originalDoc }) => {
   if (operation !== "update") return data;
   if (data.paymentStatus === "paid" && originalDoc?.paymentStatus !== "paid" && !data.paidAt) {
@@ -7584,16 +8028,8 @@ function createAutoAssignAdmin(slugs) {
       const { payload } = req;
       let roundRobinEnabled = false;
       try {
-        const prefs = await payload.find({
-          collection: "payload-preferences",
-          where: { key: { equals: "support-round-robin" } },
-          limit: 1,
-          depth: 0,
-          overrideAccess: true
-        });
-        if (prefs.docs.length > 0) {
-          roundRobinEnabled = prefs.docs[0].value?.enabled === true;
-        }
+        const settings = await readSupportSettings(payload);
+        roundRobinEnabled = settings.features.roundRobin === true;
       } catch (err) {
         console.warn("[support] Failed to read round-robin preferences:", err);
       }
@@ -7802,54 +8238,6 @@ function createNotifyClientOnResolve(slugs) {
     return doc;
   };
 }
-function createFireTicketWebhooks(slugs) {
-  return async ({ doc, previousDoc, operation, req }) => {
-    const { payload } = req;
-    if (operation === "create") {
-      fireWebhooks(payload, slugs, "ticket_created", {
-        id: doc.id,
-        ticketNumber: doc.ticketNumber,
-        subject: doc.subject,
-        status: doc.status,
-        priority: doc.priority,
-        category: doc.category
-      });
-      return doc;
-    }
-    if (operation === "update" && previousDoc) {
-      if (previousDoc.status !== doc.status && doc.status === "resolved") {
-        fireWebhooks(payload, slugs, "ticket_resolved", {
-          id: doc.id,
-          ticketNumber: doc.ticketNumber,
-          subject: doc.subject,
-          previousStatus: previousDoc.status
-        });
-        const clientId = typeof doc.client === "object" ? doc.client?.id : doc.client;
-        if (clientId) {
-          payload.update({
-            collection: "client-summaries",
-            where: { client: { equals: clientId } },
-            data: { generatedAt: (/* @__PURE__ */ new Date(0)).toISOString() },
-            // Force cache expiry
-            overrideAccess: true
-          }).catch(() => {
-          });
-        }
-      }
-      const oldAssigned = typeof previousDoc.assignedTo === "object" ? previousDoc.assignedTo?.id : previousDoc.assignedTo;
-      const newAssigned = typeof doc.assignedTo === "object" ? doc.assignedTo?.id : doc.assignedTo;
-      if (newAssigned && oldAssigned !== newAssigned) {
-        fireWebhooks(payload, slugs, "ticket_assigned", {
-          id: doc.id,
-          ticketNumber: doc.ticketNumber,
-          subject: doc.subject,
-          assignedTo: newAssigned
-        });
-      }
-    }
-    return doc;
-  };
-}
 function createNotifyAdminOnNewTicket(slugs, notificationSlug) {
   return async ({ doc, operation, req }) => {
     if (operation !== "create") return doc;
@@ -7870,21 +8258,66 @@ function createNotifyAdminOnNewTicket(slugs, notificationSlug) {
 }
 function createDispatchWebhookOnTicket(slugs) {
   return async ({ doc, previousDoc, operation, req }) => {
+    const { payload } = req;
     if (operation === "create") {
       dispatchWebhook(
-        { ticketId: doc.id, ticketNumber: doc.ticketNumber, subject: doc.subject },
+        {
+          ticketId: doc.id,
+          id: doc.id,
+          ticketNumber: doc.ticketNumber,
+          subject: doc.subject,
+          status: doc.status,
+          priority: doc.priority,
+          category: doc.category
+        },
         "ticket_created",
-        req.payload,
+        payload,
         slugs
       );
+      return doc;
     }
-    if (operation === "update" && previousDoc?.status !== doc.status && doc.status === "resolved") {
-      dispatchWebhook(
-        { ticketId: doc.id, ticketNumber: doc.ticketNumber, subject: doc.subject },
-        "ticket_resolved",
-        req.payload,
-        slugs
-      );
+    if (operation === "update" && previousDoc) {
+      if (previousDoc.status !== doc.status && doc.status === "resolved") {
+        dispatchWebhook(
+          {
+            ticketId: doc.id,
+            id: doc.id,
+            ticketNumber: doc.ticketNumber,
+            subject: doc.subject,
+            previousStatus: previousDoc.status
+          },
+          "ticket_resolved",
+          payload,
+          slugs
+        );
+        const clientId = typeof doc.client === "object" ? doc.client?.id : doc.client;
+        if (clientId) {
+          payload.update({
+            collection: "client-summaries",
+            where: { client: { equals: clientId } },
+            data: { generatedAt: (/* @__PURE__ */ new Date(0)).toISOString() },
+            // Force cache expiry
+            overrideAccess: true
+          }).catch(() => {
+          });
+        }
+      }
+      const oldAssigned = typeof previousDoc.assignedTo === "object" ? previousDoc.assignedTo?.id : previousDoc.assignedTo;
+      const newAssigned = typeof doc.assignedTo === "object" ? doc.assignedTo?.id : doc.assignedTo;
+      if (newAssigned && oldAssigned !== newAssigned) {
+        dispatchWebhook(
+          {
+            ticketId: doc.id,
+            id: doc.id,
+            ticketNumber: doc.ticketNumber,
+            subject: doc.subject,
+            assignedTo: newAssigned
+          },
+          "ticket_assigned",
+          payload,
+          slugs
+        );
+      }
     }
     return doc;
   };
@@ -8010,7 +8443,10 @@ function createTicketsCollection(slugs, options) {
             { label: "Paiement partiel", value: "partial" },
             { label: "Pay\xE9", value: "paid" }
           ],
-          access: { update: ({ req }) => req.user?.collection === "users" },
+          // `slugs.users`, not the literal 'users': the users collection slug is
+          // configurable, and a hard-coded one silently opens this field to everybody
+          // on a host that renamed it.
+          access: { update: ({ req }) => req.user?.collection === slugs.users },
           admin: { width: "50%", condition: (data) => !!data?.invoice }
         },
         {
@@ -8292,6 +8728,7 @@ function createTicketsCollection(slugs, options) {
       { name: "totalTimeMinutes", type: "number", defaultValue: 0, label: "Temps total (minutes)", admin: { readOnly: true, position: "sidebar" } }
     ],
     hooks: {
+      beforeValidate: [createRestrictClientCreate(slugs)],
       beforeChange: [
         createAssignTicketNumber(slugs, options?.ticketNumber),
         createAssignClientOnCreate(slugs),
@@ -8312,7 +8749,6 @@ function createTicketsCollection(slugs, options) {
         createNotifyClientOnResolve(slugs),
         createTicketStatusEmail(slugs),
         createNotifyAdminOnNewTicket(slugs, notificationSlug),
-        createFireTicketWebhooks(slugs),
         createDispatchWebhookOnTicket(slugs),
         createApplyAutomationRules(slugs)
       ],
@@ -8374,7 +8810,7 @@ function createTicketsCollection(slugs, options) {
 }
 
 // src/utils/ticketAccess.ts
-async function resolveAccessibleTicketIds(payload, slugs, clientId) {
+async function resolveAccessibleTicketIds(payload, slugs, clientId, mode = "read") {
   const ids = /* @__PURE__ */ new Set();
   try {
     const owned = await dbFind(payload, slugs.tickets, {
@@ -8395,6 +8831,7 @@ async function resolveAccessibleTicketIds(payload, slugs, clientId) {
     });
     for (const r of collab.docs) {
       const row = r;
+      if (mode === "write" && row.role !== "collaborator") continue;
       const tid = typeof row.ticket === "object" ? row.ticket?.id : row.ticket;
       if (tid !== void 0 && tid !== null) ids.add(tid);
     }
@@ -8493,6 +8930,21 @@ async function queueClientNotification(payload, slugs, item) {
 }
 
 // src/collections/TicketMessages.ts
+function createRestrictClientTicketTarget(slugs) {
+  return async ({ data, operation, req, originalDoc }) => {
+    if (req.user?.collection !== slugs.supportClients) return data;
+    const raw = data.ticket ?? (operation === "update" ? originalDoc?.ticket : void 0);
+    const targetId = raw && typeof raw === "object" ? raw.id : raw;
+    if (targetId === void 0 || targetId === null || targetId === "") {
+      throw new APIError("Ticket cible requis.", 400);
+    }
+    const accessible = await resolveAccessibleTicketIds(req.payload, slugs, req.user.id, "write");
+    if (!accessible.some((id) => String(id) === String(targetId))) {
+      throw new APIError("Ticket inaccessible.", 403);
+    }
+    return data;
+  };
+}
 function createAssignAuthor(slugs) {
   return async ({ data, operation, req }) => {
     if (operation === "create" && req.user?.collection === slugs.supportClients) {
@@ -8727,21 +9179,6 @@ function createNotifyAdminOnClientMessage(slugs, notificationSlug) {
     return doc;
   };
 }
-function createFireMessageWebhooks(slugs) {
-  return async ({ doc, operation, req }) => {
-    if (operation !== "create") return doc;
-    if (doc.scheduledAt && !doc.scheduledSent) return doc;
-    if (doc.isInternal) return doc;
-    const ticketId = typeof doc.ticket === "object" ? doc.ticket.id : doc.ticket;
-    fireWebhooks(req.payload, slugs, "ticket_replied", {
-      ticketId,
-      messageId: doc.id,
-      authorType: doc.authorType,
-      body: doc.body?.length > 500 ? doc.body.slice(0, 500) + "..." : doc.body
-    });
-    return doc;
-  };
-}
 function createDispatchWebhookOnReply(slugs) {
   return async ({ doc, operation, req }) => {
     if (operation !== "create") return doc;
@@ -8749,7 +9186,12 @@ function createDispatchWebhookOnReply(slugs) {
     if (doc.scheduledAt && !doc.scheduledSent) return doc;
     const ticketId = typeof doc.ticket === "object" ? doc.ticket.id : doc.ticket;
     dispatchWebhook(
-      { ticketId, messageId: doc.id, authorType: doc.authorType },
+      {
+        ticketId,
+        messageId: doc.id,
+        authorType: doc.authorType,
+        body: doc.body?.length > 500 ? doc.body.slice(0, 500) + "..." : doc.body
+      },
       "ticket_replied",
       req.payload,
       slugs
@@ -8932,7 +9374,7 @@ function createTicketMessagesCollection(slugs, options) {
       ] : []
     ],
     hooks: {
-      beforeChange: [createSanitizeMessageHtml(), createResolveMentions(slugs), createAssignAuthor(slugs)],
+      beforeChange: [createRestrictClientTicketTarget(slugs), createSanitizeMessageHtml(), createResolveMentions(slugs), createAssignAuthor(slugs)],
       afterChange: [
         ...options?.capabilities?.sms ? [createSmsNotification(slugs, options.capabilities.sms)] : [],
         createAutoUpdateStatus(slugs),
@@ -8941,7 +9383,6 @@ function createTicketMessagesCollection(slugs, options) {
         createCheckSlaOnReply(slugs, notificationSlug),
         createSyncTicketReplyToChat(slugs),
         createNotifyAdminOnClientMessage(slugs, notificationSlug),
-        createFireMessageWebhooks(slugs),
         createDispatchWebhookOnReply(slugs),
         createNotifyMentions(slugs),
         ...options?.capabilities?.threadCleanup ? [createThreadCleanup(options.capabilities.threadCleanup)] : []
@@ -9014,13 +9455,13 @@ function createSendInvitationOnCreate(slugs) {
     return doc;
   };
 }
-var TWO_FA_WINDOW_MS = 5 * 60 * 1e3;
+var TWO_FA_WINDOW_MS2 = 5 * 60 * 1e3;
 function createEnforce2FA(slugs) {
   return async ({ req, user }) => {
     if (!user?.twoFactorEnabled) return user;
     const raw = user.twoFactorVerifiedAt;
     const verifiedAt = raw ? new Date(raw).getTime() : 0;
-    if (!(verifiedAt > Date.now() - TWO_FA_WINDOW_MS)) {
+    if (!(verifiedAt > Date.now() - TWO_FA_WINDOW_MS2)) {
       throw new APIError("2FA_REQUIRED", 401);
     }
     await req.payload.update({
@@ -9034,7 +9475,11 @@ function createEnforce2FA(slugs) {
     return user;
   };
 }
+function createAdminOnlyFieldUpdate(slugs) {
+  return ({ req }) => req.user?.collection === slugs.users;
+}
 function createSupportClientsCollection(slugs, options) {
+  const adminOnlyFieldUpdate = createAdminOnlyFieldUpdate(slugs);
   return {
     slug: slugs.supportClients,
     labels: {
@@ -9164,7 +9609,8 @@ function createSupportClientsCollection(slugs, options) {
         label: "Opportunites commerciales",
         access: {
           // Admin-only: never serialize commercial notes onto the client's own doc.
-          read: ({ req }) => req.user?.collection === slugs.users
+          read: ({ req }) => req.user?.collection === slugs.users,
+          update: adminOnlyFieldUpdate
         },
         admin: {
           description: "Notes commerciales (visible uniquement par les admins)"
@@ -9174,6 +9620,7 @@ function createSupportClientsCollection(slugs, options) {
         name: "tier",
         type: "select",
         label: "Plan",
+        access: { update: adminOnlyFieldUpdate },
         options: [
           { label: "Free", value: "free" },
           { label: "Basic", value: "basic" },
@@ -9187,6 +9634,7 @@ function createSupportClientsCollection(slugs, options) {
         type: "relationship",
         relationTo: slugs.users,
         label: "Agent referent",
+        access: { update: adminOnlyFieldUpdate },
         admin: { position: "sidebar" }
       },
       {
@@ -9202,17 +9650,20 @@ function createSupportClientsCollection(slugs, options) {
       {
         name: "twoFactorCode",
         type: "text",
+        access: { update: adminOnlyFieldUpdate },
         admin: { hidden: true }
       },
       {
         name: "twoFactorExpiry",
         type: "date",
+        access: { update: adminOnlyFieldUpdate },
         admin: { hidden: true }
       },
       {
         // Set by /support/2fa "verify"; gates login via the beforeLogin hook.
         name: "twoFactorVerifiedAt",
         type: "date",
+        access: { update: adminOnlyFieldUpdate },
         admin: { hidden: true }
       },
       {
@@ -9220,6 +9671,7 @@ function createSupportClientsCollection(slugs, options) {
         name: "googleId",
         type: "text",
         index: true,
+        access: { update: adminOnlyFieldUpdate },
         admin: { hidden: true }
       },
       {
@@ -9290,7 +9742,8 @@ function createSupportClientsCollection(slugs, options) {
         label: "Notes internes",
         access: {
           // Admin-only: never serialize internal notes onto the client's own doc.
-          read: ({ req }) => req.user?.collection === slugs.users
+          read: ({ req }) => req.user?.collection === slugs.users,
+          update: adminOnlyFieldUpdate
         },
         admin: {
           description: "Visible uniquement par les admins",
@@ -9363,36 +9816,49 @@ function createSupportClientsCollection(slugs, options) {
 }
 
 // src/collections/TimeEntries.ts
+async function recalculateTicketTime(payload, slugs, ticketId) {
+  let totalMinutes = 0;
+  let page = 1;
+  let hasMore = true;
+  while (hasMore) {
+    const entries = await payload.find({
+      collection: slugs.timeEntries,
+      where: { ticket: { equals: ticketId } },
+      limit: 100,
+      page,
+      depth: 0,
+      overrideAccess: true,
+      select: { duration: true }
+    });
+    for (const entry of entries.docs) {
+      totalMinutes += entry.duration || 0;
+    }
+    hasMore = entries.hasNextPage ?? false;
+    page++;
+  }
+  await payload.update({
+    collection: slugs.tickets,
+    id: ticketId,
+    data: { totalTimeMinutes: totalMinutes },
+    overrideAccess: true
+  });
+}
 function createRecalculateTicketTime(slugs) {
   return async ({ doc, req }) => {
     if (!doc.ticket) return;
-    const { payload } = req;
     const ticketId = typeof doc.ticket === "object" ? doc.ticket.id : doc.ticket;
-    let totalMinutes = 0;
-    let page = 1;
-    let hasMore = true;
-    while (hasMore) {
-      const entries = await payload.find({
-        collection: slugs.timeEntries,
-        where: { ticket: { equals: ticketId } },
-        limit: 100,
-        page,
-        depth: 0,
-        overrideAccess: true,
-        select: { duration: true }
-      });
-      for (const entry of entries.docs) {
-        totalMinutes += entry.duration || 0;
-      }
-      hasMore = entries.hasNextPage ?? false;
-      page++;
+    await recalculateTicketTime(req.payload, slugs, ticketId);
+  };
+}
+function createRecalculateTicketTimeOnDelete(slugs) {
+  return async ({ doc, req }) => {
+    if (!doc?.ticket) return;
+    const ticketId = typeof doc.ticket === "object" ? doc.ticket.id : doc.ticket;
+    try {
+      await recalculateTicketTime(req.payload, slugs, ticketId);
+    } catch (err) {
+      console.error("[support] Failed to recalculate ticket time after delete:", err);
     }
-    await payload.update({
-      collection: slugs.tickets,
-      id: ticketId,
-      data: { totalTimeMinutes: totalMinutes },
-      overrideAccess: true
-    });
   };
 }
 function createTimeEntriesCollection(slugs) {
@@ -9454,7 +9920,8 @@ function createTimeEntriesCollection(slugs) {
       }
     ],
     hooks: {
-      afterChange: [createRecalculateTicketTime(slugs)]
+      afterChange: [createRecalculateTicketTime(slugs)],
+      afterDelete: [createRecalculateTicketTimeOnDelete(slugs)]
     },
     access: {
       create: ({ req }) => req.user?.collection === slugs.users,
@@ -9835,8 +10302,28 @@ function createKnowledgeBaseCollection(slugs) {
     timestamps: true
   };
 }
-
-// src/collections/ChatMessages.ts
+function createRestrictClientChatWrite(slugs) {
+  return async ({ data, req }) => {
+    if (req.user?.collection !== slugs.supportClients) return data;
+    data.client = req.user.id;
+    data.senderType = "client";
+    delete data.agent;
+    const session = typeof data.session === "string" ? data.session : null;
+    if (!session) return data;
+    const existing = await dbFind(req.payload, slugs.chatMessages, {
+      where: { session: { equals: session } },
+      limit: 1,
+      depth: 0,
+      overrideAccess: true
+    });
+    const owner = existing.docs[0]?.client;
+    const ownerId = owner && typeof owner === "object" ? owner.id : owner;
+    if (ownerId !== void 0 && ownerId !== null && String(ownerId) !== String(req.user.id)) {
+      throw new APIError("Session inaccessible.", 403);
+    }
+    return data;
+  };
+}
 function createChatMessagesCollection(slugs) {
   return {
     slug: slugs.chatMessages,
@@ -9858,7 +10345,9 @@ function createChatMessagesCollection(slugs) {
         }
         return false;
       },
-      create: ({ req }) => !!req.user,
+      // Staff and support-clients only — NOT "any authenticated principal":
+      // a user of any other auth collection of the host app satisfied `!!req.user`.
+      create: ({ req }) => req.user?.collection === slugs.users || req.user?.collection === slugs.supportClients,
       update: ({ req }) => req.user?.collection === slugs.users,
       delete: ({ req }) => req.user?.collection === slugs.users
     },
@@ -9927,6 +10416,9 @@ function createChatMessagesCollection(slugs) {
         }
       }
     ],
+    hooks: {
+      beforeChange: [createRestrictClientChatWrite(slugs)]
+    },
     timestamps: true
   };
 }
@@ -10204,8 +10696,19 @@ function createAuthLogsCollection(slugs) {
     timestamps: true
   };
 }
-
-// src/collections/WebhookEndpoints.ts
+function createValidateWebhookUrl() {
+  return ({ data, operation, originalDoc }) => {
+    const incoming = data?.url;
+    if (incoming === void 0 || incoming === null) return data;
+    const previous = originalDoc?.url;
+    if (operation === "update" && incoming === previous) return data;
+    const result = validateWebhookUrl(incoming);
+    if (!result.ok) {
+      throw new APIError(WEBHOOK_URL_MESSAGES[result.reason || "invalid_url"], 400);
+    }
+    return data;
+  };
+}
 function createWebhookEndpointsCollection(slugs) {
   return {
     slug: slugs.webhookEndpoints,
@@ -10239,8 +10742,11 @@ function createWebhookEndpointsCollection(slugs) {
         type: "text",
         required: true,
         label: "URL",
+        // The SSRF check lives in the collection `beforeValidate` above, NOT in a
+        // field `validate`: the latter re-runs on the merged document and would
+        // freeze every pre-existing row on any unrelated edit.
         admin: {
-          description: "URL du webhook \xE0 appeler (POST)"
+          description: "URL https:// du webhook \xE0 appeler (POST). Les adresses priv\xE9es et loopback sont refus\xE9es."
         }
       },
       {
@@ -10294,6 +10800,9 @@ function createWebhookEndpointsCollection(slugs) {
         }
       }
     ],
+    hooks: {
+      beforeValidate: [createValidateWebhookUrl()]
+    },
     timestamps: true
   };
 }
@@ -10745,11 +11254,17 @@ function createClientSummariesCollection(slugs) {
         admin: { readOnly: true }
       }
     ],
+    // Staff-only, on the SAME source of truth as every other collection and as
+    // `requireAdmin`: `slugs.users`. The literal `'users'` this used to compare
+    // against is the DEFAULT slug, not the configured one — on a host app whose
+    // staff collection is renamed (`collectionSlugs.users: 'admins'`) it named
+    // the front-office collection instead, opening read/create/update/delete on
+    // AI-generated client intelligence to it while locking the real agents out.
     access: {
-      create: ({ req }) => req.user?.collection === "users",
-      read: ({ req }) => req.user?.collection === "users",
-      update: ({ req }) => req.user?.collection === "users",
-      delete: ({ req }) => req.user?.collection === "users"
+      create: ({ req }) => req.user?.collection === slugs.users,
+      read: ({ req }) => req.user?.collection === slugs.users,
+      update: ({ req }) => req.user?.collection === slugs.users,
+      delete: ({ req }) => req.user?.collection === slugs.users
     },
     timestamps: true
   };
@@ -10880,7 +11395,12 @@ function createTicketCollaboratorsCollection(slugs) {
         }
         return false;
       },
-      create: ({ req }) => !!req.user,
+      // Staff only. This collection is the source of truth for
+      // resolveAccessibleTicketIds(), which widens `read` on tickets, messages
+      // and the activity log — so letting any authenticated principal POST here
+      // let a support client grant themselves access to any ticket by id.
+      // The /invite endpoint is unaffected: it writes with overrideAccess: true.
+      create: ({ req }) => req.user?.collection === slugs.users,
       update: () => false,
       delete: ({ req }) => req.user?.collection === slugs.users
     },
@@ -11208,6 +11728,17 @@ function supportPlugin(config) {
     });
     return {
       ...incomingConfig,
+      // Publish the resolved staff collection so the server-side readers share
+      // ONE source of truth with the writers. `requireAdmin` compares against
+      // `slugs.users`; the `payload-preferences` reads used to scope themselves
+      // on `config.admin.user`, which Payload silently defaults to the first
+      // auth collection of the host app — a different collection on any app
+      // that declares `collectionSlugs.users`, and the settings-poisoning hole
+      // reopened right there.
+      custom: {
+        ...incomingConfig.custom,
+        [SUPPORT_STAFF_SLUG_CONFIG_KEY]: slugs.users
+      },
       collections: config?.skipCollections ? existingCollections : [...existingCollections, ...supportCollections],
       endpoints: config?.skipEndpoints ? existingEndpoints : [...existingEndpoints, ...supportEndpoints],
       admin: {
@@ -11221,4 +11752,4 @@ function supportPlugin(config) {
   };
 }
 
-export { DEFAULT_FEATURES, DEFAULT_INBOUND_EMAIL_LIMITS, DEFAULT_SETTINGS, DEFAULT_SLUGS, DEFAULT_USER_PREFS, MemoryRateLimitStore, PayloadRateLimitStore, RateLimiter, calculateBusinessHoursDeadline, createAdminNotification, createAssignSlaDeadlines, createAuthLogsCollection, createCannedResponsesCollection, createChatMessagesCollection, createCheckSlaOnReply, createCheckSlaOnResolve, createEmailLogsCollection, createKnowledgeBaseCollection, createLoginEndpoint, createMacrosCollection, createOAuthGoogleEndpoint, createPendingEmailsCollection, createSatisfactionSurveysCollection, createSlaPoliciesCollection, createSupportClientsCollection, createTicketActivityLogCollection, createTicketCollaboratorsCollection, createTicketMessagesCollection, createTicketStatusEmail, createTicketStatusesCollection, createTicketsCollection, createTimeEntriesCollection, createTrackOpenEndpoint, createWebhookEndpointsCollection, dispatchWebhook, generateTicketSynthesis, readSupportSettings, readUserPrefs, resolveSlugs, supportPlugin, validateInboundEmailPayload, verifySecret };
+export { DEFAULT_FEATURES, DEFAULT_INBOUND_EMAIL_LIMITS, DEFAULT_SETTINGS, DEFAULT_SLUGS, DEFAULT_TICKETING_FEATURES, DEFAULT_USER_PREFS, MemoryRateLimitStore, PayloadRateLimitStore, RateLimiter, calculateBusinessHoursDeadline, createAdminNotification, createAssignSlaDeadlines, createAuthLogsCollection, createCannedResponsesCollection, createChatMessagesCollection, createCheckSlaOnReply, createCheckSlaOnResolve, createEmailLogsCollection, createKnowledgeBaseCollection, createLoginEndpoint, createMacrosCollection, createOAuthGoogleEndpoint, createPendingEmailsCollection, createSatisfactionSurveysCollection, createSlaPoliciesCollection, createSupportClientsCollection, createTicketActivityLogCollection, createTicketCollaboratorsCollection, createTicketMessagesCollection, createTicketStatusEmail, createTicketStatusesCollection, createTicketsCollection, createTimeEntriesCollection, createTrackOpenEndpoint, createWebhookEndpointsCollection, dispatchWebhook, generateTicketSynthesis, normalizeFeatures, projectAutoClose, readSupportSettings, readSupportSettingsState, readUserPrefs, resolveSlugs, stripProjectedFeatures, supportPlugin, validateInboundEmailPayload, verifySecret };