@consilioweb/payload-support 3.0.0 → 4.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consilioweb/payload-support",
-  "version": "3.0.0",
+  "version": "4.0.0",
   "description": "Payload CMS plugin — professional support & ticketing system with AI, SLA, time tracking, live chat, and more",
   "type": "module",
   "main": "./dist/index.cjs",

package/src/collections/ChatMessages.ts

@@ -1,5 +1,56 @@
-import type { CollectionConfig } from 'payload'
+import { APIError } from 'payload'
+import type { CollectionBeforeChangeHook, CollectionConfig } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
+import { dbFind } from '../utils/db'
+
+/**
+ * Cross-tenant write guard for support-clients.
+ *
+ * `access.create` used to be `!!req.user`, which any principal of ANY auth
+ * collection satisfies — including a front-office member of the host app. With
+ * no hook validating the row, an attacker could POST a message attributed to
+ * someone else's `client` and flagged `senderType: 'agent'` with an arbitrary
+ * `agent` relation: the agent console and the targeted client both render it as
+ * a genuine conversation (phishing over a trusted channel).
+ *
+ * Mirrors `createRestrictClientTicketTarget` on ticket-messages: the client's
+ * own identity is FORCED onto the row instead of being trusted from the body.
+ * Internal writers (endpoints/chat.ts, endpoints/admin-chat.ts,
+ * collections/TicketMessages.ts) all write with `overrideAccess: true` and carry
+ * no support-client user, so they are untouched.
+ */
+function createRestrictClientChatWrite(slugs: CollectionSlugs): CollectionBeforeChangeHook {
+  return async ({ data, req }) => {
+    if (req.user?.collection !== slugs.supportClients) return data
+    data.client = req.user.id
+    data.senderType = 'client'
+    delete data.agent
+
+    // …and the SESSION has to be theirs too. Forcing `client` alone still let a
+    // client drop a line INTO someone else's conversation: the agent console
+    // loads a thread by session id with `overrideAccess: true`
+    // (endpoints/admin-chat.ts), so the injected message surfaces in the target's
+    // thread even though `access.read` hides it from the target themselves.
+    // Session ids are 16 random bytes, so this is depth rather than a reachable
+    // hole — and it costs one indexed lookup on a path no internal writer takes
+    // (chat.ts / admin-chat.ts write without a support-client `req`).
+    const session = typeof data.session === 'string' ? data.session : null
+    if (!session) return data
+
+    const existing = await dbFind(req.payload, slugs.chatMessages, {
+      where: { session: { equals: session } },
+      limit: 1,
+      depth: 0,
+      overrideAccess: true,
+    })
+    const owner = existing.docs[0]?.client
+    const ownerId = owner && typeof owner === 'object' ? (owner as { id?: unknown }).id : owner
+    if (ownerId !== undefined && ownerId !== null && String(ownerId) !== String(req.user.id)) {
+      throw new APIError('Session inaccessible.', 403)
+    }
+    return data
+  }
+}
 
 // ─── Collection factory ──────────────────────────────────
 
@@ -24,7 +75,10 @@ export function createChatMessagesCollection(slugs: CollectionSlugs): Collection
         }
         return false
       },
-      create: ({ req }) => !!req.user,
+      // Staff and support-clients only — NOT "any authenticated principal":
+      // a user of any other auth collection of the host app satisfied `!!req.user`.
+      create: ({ req }) =>
+        req.user?.collection === slugs.users || req.user?.collection === slugs.supportClients,
       update: ({ req }) => req.user?.collection === slugs.users,
       delete: ({ req }) => req.user?.collection === slugs.users,
     },
@@ -93,6 +147,9 @@ export function createChatMessagesCollection(slugs: CollectionSlugs): Collection
         },
       },
     ],
+    hooks: {
+      beforeChange: [createRestrictClientChatWrite(slugs)],
+    },
     timestamps: true,
   }
 }

package/src/collections/ClientSummaries.ts

@@ -122,11 +122,17 @@ export function createClientSummariesCollection(slugs: CollectionSlugs): Collect
         admin: { readOnly: true },
       },
     ],
+    // Staff-only, on the SAME source of truth as every other collection and as
+    // `requireAdmin`: `slugs.users`. The literal `'users'` this used to compare
+    // against is the DEFAULT slug, not the configured one — on a host app whose
+    // staff collection is renamed (`collectionSlugs.users: 'admins'`) it named
+    // the front-office collection instead, opening read/create/update/delete on
+    // AI-generated client intelligence to it while locking the real agents out.
     access: {
-      create: ({ req }) => req.user?.collection === 'users',
-      read: ({ req }) => req.user?.collection === 'users',
-      update: ({ req }) => req.user?.collection === 'users',
-      delete: ({ req }) => req.user?.collection === 'users',
+      create: ({ req }) => req.user?.collection === slugs.users,
+      read: ({ req }) => req.user?.collection === slugs.users,
+      update: ({ req }) => req.user?.collection === slugs.users,
+      delete: ({ req }) => req.user?.collection === slugs.users,
     },
     timestamps: true,
   }

package/src/collections/TicketMessages.ts

@@ -37,7 +37,10 @@ function createRestrictClientTicketTarget(slugs: CollectionSlugs): CollectionBef
       throw new APIError('Ticket cible requis.', 400)
     }
 
-    const accessible = await resolveAccessibleTicketIds(req.payload, slugs, req.user.id)
+    // 'write' scope: a collaborator invited as `viewer` may READ the thread but
+    // must not post into it — the invitation email promises exactly that, and a
+    // message from a viewer would fan out the whole notification chain.
+    const accessible = await resolveAccessibleTicketIds(req.payload, slugs, req.user.id, 'write')
     if (!accessible.some((id) => String(id) === String(targetId))) {
       throw new APIError('Ticket inaccessible.', 403)
     }

package/src/collections/WebhookEndpoints.ts

@@ -1,5 +1,41 @@
-import type { CollectionConfig } from 'payload'
+import { APIError } from 'payload'
+import type { CollectionBeforeValidateHook, CollectionConfig } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
+import { WEBHOOK_URL_MESSAGES, validateWebhookUrl } from '../utils/urlSafety'
+
+/**
+ * First SSRF layer: the value is fetched by the SERVER on every ticket event, so
+ * a loopback / private / link-local target (or a non-https scheme) must never be
+ * SAVED. The send path re-checks the resolved address and every redirect hop —
+ * see `utils/urlSafety.ts`.
+ *
+ * Why a collection hook rather than a field `validate`: Payload re-validates the
+ * MERGED document on every write, so a field-level guard also fires on partial
+ * updates that never mention `url`. A row saved before this guard existed (or
+ * seeded through `payload.db`, which runs no hooks) then became totally
+ * immutable — impossible to rename, to re-scope its events, even to set
+ * `active: false` — and the dispatcher's own bookkeeping write (`lastStatus: 0`,
+ * issued inside a `catch` that swallows errors) failed silently, leaving a dead
+ * endpoint looking healthy in the admin.
+ *
+ * So only a URL actually being SET or CHANGED is checked. Leaving an existing
+ * bad value alone costs nothing: the send path refuses to call it anyway.
+ */
+function createValidateWebhookUrl(): CollectionBeforeValidateHook {
+  return ({ data, operation, originalDoc }) => {
+    const incoming = (data as { url?: unknown } | undefined)?.url
+    if (incoming === undefined || incoming === null) return data
+
+    const previous = (originalDoc as { url?: unknown } | undefined)?.url
+    if (operation === 'update' && incoming === previous) return data
+
+    const result = validateWebhookUrl(incoming)
+    if (!result.ok) {
+      throw new APIError(WEBHOOK_URL_MESSAGES[result.reason || 'invalid_url'], 400)
+    }
+    return data
+  }
+}
 
 // ─── Collection factory ──────────────────────────────────
 
@@ -36,8 +72,11 @@ export function createWebhookEndpointsCollection(slugs: CollectionSlugs): Collec
         type: 'text',
         required: true,
         label: 'URL',
+        // The SSRF check lives in the collection `beforeValidate` above, NOT in a
+        // field `validate`: the latter re-runs on the merged document and would
+        // freeze every pre-existing row on any unrelated edit.
         admin: {
-          description: 'URL du webhook à appeler (POST)',
+          description: 'URL https:// du webhook à appeler (POST). Les adresses privées et loopback sont refusées.',
         },
       },
       {
@@ -91,6 +130,9 @@ export function createWebhookEndpointsCollection(slugs: CollectionSlugs): Collec
         },
       },
     ],
+    hooks: {
+      beforeValidate: [createValidateWebhookUrl()],
+    },
     timestamps: true,
   }
 }

package/src/endpoints/admin-chat.ts

@@ -1,7 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { Where } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { dbFind, dbCreate, dbUpdate } from '../utils/db'
 
@@ -111,7 +111,7 @@ export function createAdminChatGetEndpoint(slugs: CollectionSlugs): Endpoint {
  * Admin sends a message or closes a session.
  */
 export function createAdminChatPostEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const adminChatLimiter = new RateLimiter(60_000, 30, store)
+  const adminChatLimiter = new RateLimiter(60_000, 30, store, 'admin-chat')
   return {
     path: '/support/admin-chat',
     method: 'post',
@@ -150,7 +150,7 @@ export function createAdminChatPostEndpoint(slugs: CollectionSlugs, store?: Rate
 
         // Agent sends a message
         if (action === 'send' && message) {
-          if (await adminChatLimiter.check(String(req.user.id), req)) {
+          if (await adminChatLimiter.check(principalRateKey(req.user), req)) {
             return Response.json({ error: 'Rate limit atteint.' }, { status: 429 })
           }
 

package/src/endpoints/ai-agent.ts

@@ -2,7 +2,7 @@ import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { runAiAgent } from '../utils/aiAgent'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 
 /**
  * POST /api/support/ai-agent   body: { ticketId, confidenceThreshold? }
@@ -11,14 +11,14 @@ import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
  * (when confident) or escalates to a human with an internal note. Admin-only.
  */
 export function createAiAgentEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const limiter = new RateLimiter(60_000, 10, store)
+  const limiter = new RateLimiter(60_000, 10, store, 'ai-agent')
   return {
     path: '/support/ai-agent',
     method: 'post',
     handler: async (req) => {
       try {
         requireAdmin(req, slugs)
-        if (await limiter.check(String(req.user!.id), req)) {
+        if (await limiter.check(principalRateKey(req.user), req)) {
           return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
         }
         let body: { ticketId?: number | string; confidenceThreshold?: number } = {}

package/src/endpoints/ai.ts

@@ -2,7 +2,7 @@ import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { readSupportSettings, type SupportSettings } from '../utils/readSettings'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { resolveOllamaBaseUrl } from '../utils/aiProvider'
 
 async function getClient(aiSettings: SupportSettings['ai']) {
@@ -26,7 +26,7 @@ type AiAction = 'sentiment' | 'synthesis' | 'suggest_reply' | 'rewrite'
  * Admin-only endpoint for AI features in support.
  */
 export function createAiEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const limiter = new RateLimiter(60_000, 30, store)
+  const limiter = new RateLimiter(60_000, 30, store, 'ai')
   return {
     path: '/support/ai',
     method: 'post',
@@ -35,7 +35,7 @@ export function createAiEndpoint(slugs: CollectionSlugs, store?: RateLimitStore)
         const payload = req.payload
 
         requireAdmin(req, slugs)
-        if (await limiter.check(String(req.user!.id), req)) {
+        if (await limiter.check(principalRateKey(req.user), req)) {
           return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
         }
 

package/src/endpoints/auth-2fa.ts

@@ -4,6 +4,7 @@ import crypto, { createHmac } from 'crypto'
 import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { escapeHtml } from '../utils/emailTemplate'
 import { dbFind, dbUpdate } from '../utils/db'
+import { verifyTwoFactorChallenge } from '../utils/twoFactorChallenge'
 
 function generateSecureCode(): string {
   const buf = crypto.randomBytes(4)
@@ -25,21 +26,21 @@ function hashCode(code: string): string {
  * Send or verify a 2FA code.
  */
 export function createAuth2faEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const sendLimiter = new RateLimiter(60 * 60 * 1000, 3, store)
-  const verifyLimiter = new RateLimiter(15 * 60 * 1000, 5, store)
+  const sendLimiter = new RateLimiter(60 * 60 * 1000, 3, store, '2fa:send')
+  const verifyLimiter = new RateLimiter(15 * 60 * 1000, 5, store, '2fa:verify')
   return {
     path: '/support/2fa',
     method: 'post',
     handler: async (req) => {
       try {
         const payload = req.payload
-        let body: { action?: string; email?: string; code?: string }
+        let body: { action?: string; email?: string; code?: string; challenge?: string }
         try {
           body = await req.json!()
         } catch {
           return Response.json({ error: 'Invalid JSON body' }, { status: 400 })
         }
-        const { action, email, code } = body
+        const { action, email, code, challenge } = body
 
         if (!action || !email) {
           return Response.json({ error: 'Paramètres manquants' }, { status: 400 })
@@ -48,6 +49,17 @@ export function createAuth2faEndpoint(slugs: CollectionSlugs, store?: RateLimitS
         const genericSendResponse = { success: true, message: 'Si un compte existe, un code a été envoyé.' }
 
         if (action === 'send') {
+          // The challenge is checked BEFORE the limiter on purpose: the limiter
+          // is keyed on the VICTIM's email, so letting an unauthenticated caller
+          // reach it is what made the lockout possible. No challenge, no budget
+          // consumed, no mail sent, no code overwritten.
+          if (!verifyTwoFactorChallenge(email, challenge)) {
+            return Response.json(
+              { error: 'Authentification requise avant l\'envoi d\'un code.' },
+              { status: 401 },
+            )
+          }
+
           if (await sendLimiter.check(email, req)) {
             return Response.json(genericSendResponse)
           }

package/src/endpoints/capabilities.ts

@@ -1,7 +1,7 @@
 import type { Endpoint, Where } from 'payload'
 import type { SupportCapabilities } from '../types'
 import type { CollectionSlugs } from '../utils/slugs'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import {
   validateInboundEmailPayload,
   verifySecret,
@@ -12,7 +12,7 @@ export function createInboundEmailEndpoint(
   capability: NonNullable<SupportCapabilities['inboundEmail']>,
   store?: RateLimitStore,
 ): Endpoint {
-  const limiter = new RateLimiter(60_000, 60, store)
+  const limiter = new RateLimiter(60_000, 60, store, 'inbound-email')
   return {
     path: '/support-webhook/inbound-email',
     method: 'post',
@@ -51,7 +51,7 @@ export function createProjectSuggestionsEndpoint(
   capability: NonNullable<SupportCapabilities['projectSuggestions']>,
   store?: RateLimitStore,
 ): Endpoint {
-  const limiter = new RateLimiter(60_000, 20, store)
+  const limiter = new RateLimiter(60_000, 20, store, 'suggest-projects')
   return {
     path: '/support/suggest-projects',
     method: 'post',
@@ -59,7 +59,7 @@ export function createProjectSuggestionsEndpoint(
       if (!req.user || req.user.collection !== slugs.users) {
         return Response.json({ error: 'Unauthorized' }, { status: 401 })
       }
-      const key = req.user?.id ? String(req.user.id) : 'anonymous'
+      const key = principalRateKey(req.user)
       if (await limiter.check(key, req)) {
         return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
       }
@@ -73,7 +73,7 @@ export function createTicketTitleEndpoint(
   capability: NonNullable<SupportCapabilities['aiTitles']>,
   store?: RateLimitStore,
 ): Endpoint {
-  const limiter = new RateLimiter(60_000, 20, store)
+  const limiter = new RateLimiter(60_000, 20, store, 'ticket-title')
   return {
     path: '/support/ticket-title',
     method: 'post',
@@ -100,7 +100,7 @@ export function createGenerateMissingTitlesEndpoint(
   capability: NonNullable<SupportCapabilities['aiTitles']>,
   store?: RateLimitStore,
 ): Endpoint {
-  const limiter = new RateLimiter(60_000, 5, store)
+  const limiter = new RateLimiter(60_000, 5, store, 'generate-missing-titles')
   return {
     path: '/support/generate-missing-titles',
     method: 'post',

package/src/endpoints/chat.ts

@@ -2,7 +2,7 @@ import type { Endpoint } from 'payload'
 import type { Where } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import crypto from 'crypto'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { requireClient, handleAuthError } from '../utils/auth'
 import { dbFind, dbCreate } from '../utils/db'
 
@@ -67,8 +67,8 @@ export function createChatGetEndpoint(slugs: CollectionSlugs): Endpoint {
  * Send a message or start a new chat session. Client-only.
  */
 export function createChatPostEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const chatSessionLimiter = new RateLimiter(3_600_000, 5, store)
-  const chatMessageLimiter = new RateLimiter(60_000, 15, store)
+  const chatSessionLimiter = new RateLimiter(3_600_000, 5, store, 'chat:session')
+  const chatMessageLimiter = new RateLimiter(60_000, 15, store, 'chat:message')
   return {
     path: '/support/chat',
     method: 'post',
@@ -86,10 +86,12 @@ export function createChatPostEndpoint(slugs: CollectionSlugs, store?: RateLimit
         }
         const { action, session, message } = body
         const userId = String(req.user.id)
+        // Collection-qualified: agent #7 and support-client #7 must not share a budget.
+        const rateKey = principalRateKey(req.user)
 
         // Start a new session
         if (action === 'start') {
-          if (await chatSessionLimiter.check(userId, req)) {
+          if (await chatSessionLimiter.check(rateKey, req)) {
             return Response.json({ error: 'Trop de sessions créées. Réessayez plus tard.' }, { status: 429 })
           }
 
@@ -111,7 +113,7 @@ export function createChatPostEndpoint(slugs: CollectionSlugs, store?: RateLimit
 
         // Send a message
         if (action === 'send' && session && message) {
-          if (await chatMessageLimiter.check(userId, req)) {
+          if (await chatMessageLimiter.check(rateKey, req)) {
             return Response.json({ error: 'Trop de messages. Attendez un moment.' }, { status: 429 })
           }
 

package/src/endpoints/chatbot.ts

@@ -4,13 +4,38 @@ import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbFind } from '../utils/db'
 
 
+/**
+ * Global hourly ceiling on chatbot calls, all callers combined.
+ *
+ * The per-IP window below is keyed on the FIRST hop of `X-Forwarded-For`, a
+ * value the caller sends itself: an anonymous client rotating that header gets a
+ * fresh window on every request. Unlike `login.ts` — where the account lock is
+ * the primary control — this endpoint has no second line of defence, and every
+ * accepted call ships ~50 KB of knowledge base to the Anthropic API on the
+ * operator's key. This unkeyed ceiling makes the bill bounded even when the
+ * per-IP key is bypassed. Raise it with `SUPPORT_CHATBOT_MAX_PER_HOUR` on a
+ * high-traffic portal, or pass `maxPerHour` when building the endpoint.
+ */
+export const DEFAULT_CHATBOT_MAX_PER_HOUR = 200
+
+function resolveMaxPerHour(explicit?: number): number {
+  if (typeof explicit === 'number' && explicit > 0) return explicit
+  const fromEnv = Number(process.env.SUPPORT_CHATBOT_MAX_PER_HOUR)
+  return Number.isFinite(fromEnv) && fromEnv > 0 ? fromEnv : DEFAULT_CHATBOT_MAX_PER_HOUR
+}
+
 /**
  * POST /api/support/chatbot
  * AI chatbot that answers from the knowledge base before creating a ticket.
  * Public endpoint (accessible from the support portal).
  */
-export function createChatbotEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const chatbotLimiter = new RateLimiter(60_000, 10, store)
+export function createChatbotEndpoint(
+  slugs: CollectionSlugs,
+  store?: RateLimitStore,
+  maxPerHour?: number,
+): Endpoint {
+  const chatbotLimiter = new RateLimiter(60_000, 10, store, 'chatbot:ip')
+  const globalLimiter = new RateLimiter(60 * 60_000, resolveMaxPerHour(maxPerHour), store, 'chatbot:global')
   return {
     path: '/support/chatbot',
     method: 'post',
@@ -33,6 +58,27 @@ export function createChatbotEndpoint(slugs: CollectionSlugs, store?: RateLimitS
           return Response.json({ error: 'Question too short' }, { status: 400 })
         }
 
+        // Not keyed on anything the caller controls — see the note above.
+        // Placed after validation so malformed requests do not eat the budget.
+        //
+        // Over budget, the answer DEGRADES, it does not fail: a shared counter
+        // that returns 429 hands an anonymous visitor a switch to turn the
+        // chatbot off for everybody (the per-IP key above is spoofable, so
+        // exhausting the ceiling costs nothing). The deflection path — "no
+        // answer here, open a ticket" — is the exact response this endpoint
+        // already returns when the knowledge base is empty or the API key is
+        // missing, so no caller learns a new shape, and the bill stays capped
+        // because the AI call below is never reached.
+        if (await globalLimiter.check('all', req)) {
+          return Response.json({
+            answer: null,
+            confidence: 0,
+            suggestion: 'create_ticket',
+            aiUnavailable: true,
+            message: 'L\'assistant est momentanément indisponible. Créez un ticket, un agent vous répondra.',
+          })
+        }
+
         const payload = req.payload
 
         const articles = await dbFind(payload, slugs.knowledgeBase, {

package/src/endpoints/client-intelligence.ts

@@ -2,7 +2,7 @@ import type { Endpoint, PayloadRequest } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { readSupportSettings, type SupportSettings } from '../utils/readSettings'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { resolveOllamaBaseUrl } from '../utils/aiProvider'
 
 async function getClient(aiSettings: SupportSettings['ai']) {
@@ -29,11 +29,11 @@ const CACHE_TTL_MS = 24 * 60 * 60 * 1000 // 24 hours
  * Force-refreshes the summary.
  */
 export function createClientIntelligenceEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint[] {
-  const limiter = new RateLimiter(60_000, 20, store)
+  const limiter = new RateLimiter(60_000, 20, store, 'client-intelligence')
   const getHandler = async (req: PayloadRequest) => {
     try {
       requireAdmin(req, slugs)
-      if (await limiter.check(String(req.user!.id), req)) {
+      if (await limiter.check(principalRateKey(req.user), req)) {
         return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
       }
       const payload = req.payload
@@ -71,7 +71,7 @@ export function createClientIntelligenceEndpoint(slugs: CollectionSlugs, store?:
   const postHandler = async (req: PayloadRequest) => {
     try {
       requireAdmin(req, slugs)
-      if (await limiter.check(String(req.user!.id), req)) {
+      if (await limiter.check(principalRateKey(req.user), req)) {
         return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
       }
       const payload = req.payload

package/src/endpoints/email-stats.ts

@@ -1,12 +1,23 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
+import { handleAuthError, requireAdmin } from '../utils/auth'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbFind } from '../utils/db'
 
 /**
  * GET /api/support/email-stats?days=7
  * Aggregates EmailLogs data for the tracking dashboard. Admin-only.
+ *
+ * The guard used to be `!!req.user`, which ANY authenticated principal
+ * satisfies — a support-client, or a member of any other auth collection of the
+ * host app. That leaked the operational aggregate of `email-logs` (volume,
+ * failure rate, per-day and per-action breakdown) even though the collection's
+ * own `read` is staff-only, because the pages below are fetched with
+ * `overrideAccess: true`. It also handed any account an amplification primitive:
+ * up to 25 000 rows read and materialised per call, with no rate limit.
  */
-export function createEmailStatsEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createEmailStatsEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
+  const statsLimiter = new RateLimiter(60_000, 20, store, 'email-stats')
   return {
     path: '/support/email-stats',
     method: 'get',
@@ -14,8 +25,11 @@ export function createEmailStatsEndpoint(slugs: CollectionSlugs): Endpoint {
       try {
         const payload = req.payload
 
-        if (!req.user) {
-          return Response.json({ error: 'Unauthorized' }, { status: 401 })
+        requireAdmin(req, slugs)
+
+        // Keyed on the authenticated user id, not on a spoofable header.
+        if (await statsLimiter.check(principalRateKey(req.user), req)) {
+          return Response.json({ error: 'Too many requests.' }, { status: 429 })
         }
 
         const url = new URL(req.url!)
@@ -101,6 +115,8 @@ export function createEmailStatsEndpoint(slugs: CollectionSlugs): Endpoint {
           actions: Object.fromEntries(actionMap),
         })
       } catch (err) {
+        const authResponse = handleAuthError(err)
+        if (authResponse) return authResponse
         console.error('[email-stats] Error:', err)
         return Response.json({ error: 'Internal server error' }, { status: 500 })
       }

package/src/endpoints/import-conversation.ts

@@ -132,7 +132,7 @@ ONLY JSON, nothing else.`,
  * Import a conversation from markdown into the ticket system.
  */
 export function createImportConversationEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const importLimiter = new RateLimiter(3_600_000, 10, store)
+  const importLimiter = new RateLimiter(3_600_000, 10, store, 'import-conversation')
   return {
     path: '/support/import-conversation',
     method: 'post',

package/src/endpoints/index.ts

@@ -199,7 +199,7 @@ export function createSupportEndpoints(slugs: CollectionSlugs, options?: Support
   }
   if (!f || f.satisfaction !== false) endpoints.push(createSatisfactionEndpoint(slugs))
   if (!f || f.emailTracking !== false) {
-    endpoints.push(createEmailStatsEndpoint(slugs), createTrackOpenEndpoint(slugs))
+    endpoints.push(createEmailStatsEndpoint(slugs, rateLimitStore), createTrackOpenEndpoint(slugs))
   }
   if (!f || f.pendingEmails !== false) endpoints.push(createPendingEmailsProcessEndpoint(slugs))
   if (!f || f.scheduledReplies !== false) endpoints.push(createProcessScheduledEndpoint(slugs))

package/src/endpoints/invite-collaborator.ts

@@ -4,7 +4,7 @@ import { handleAuthError, AuthError } from '../utils/auth'
 import { escapeHtml, emailWrapper, emailButton, emailParagraph } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
 import { randomBytes } from 'crypto'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbFindByID, dbFind, dbCreate, dbUpdate, dbCount } from '../utils/db'
 
 const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
@@ -13,6 +13,21 @@ const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
 // email, so cap both the volume per user and the collaborators per ticket.
 const MAX_COLLABORATORS_PER_TICKET = 20
 
+/**
+ * Long-window ceiling on ACCOUNT CREATIONS per inviter.
+ *
+ * The two existing quotas are per hour (10 invites) and per ticket (20
+ * collaborators); neither bounds the total number of `support-clients` rows a
+ * single client can conjure, nor the total number of third parties it can mail,
+ * since a client can open as many tickets as it wants. This one is only consumed
+ * when the invited address has NO account yet — inviting an existing client
+ * (the normal case) never touches it.
+ *
+ * Applied to support-clients only: staff onboarding is a legitimate bulk flow.
+ */
+const MAX_NEW_ACCOUNTS_PER_INVITER = 30
+const NEW_ACCOUNT_WINDOW_MS = 7 * 24 * 60 * 60 * 1000
+
 /**
  * POST /api/support/tickets/:id/invite
  *
@@ -31,7 +46,8 @@ const MAX_COLLABORATORS_PER_TICKET = 20
  *  - Returns { ok, invitedTo, role }.
  */
 export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const inviteLimiter = new RateLimiter(60 * 60 * 1000, 10, store)
+  const inviteLimiter = new RateLimiter(60 * 60 * 1000, 10, store, 'invite-collaborator')
+  const newAccountLimiter = new RateLimiter(NEW_ACCOUNT_WINDOW_MS, MAX_NEW_ACCOUNTS_PER_INVITER, store, 'invite-collaborator:new-account')
   return {
     path: '/support/tickets/:id/invite',
     method: 'post',
@@ -75,7 +91,7 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs, store?:
         }
 
         // Anti-abuse: cap invite volume per user (in-memory, fail-closed).
-        if (await inviteLimiter.check(String(req.user.id), req)) {
+        if (await inviteLimiter.check(principalRateKey(req.user), req)) {
           return Response.json({ error: 'Trop d\'invitations. Réessayez plus tard.' }, { status: 429 })
         }
 
@@ -107,6 +123,16 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs, store?:
         if (existing.docs.length > 0) {
           inviteeId = (existing.docs[0] as any).id
         } else {
+          // Creating an account for an address nobody vouched for — bounded over a
+          // long window so the endpoint cannot be used to mass-create ghost
+          // accounts and mail arbitrary third parties.
+          if (!isAdmin && await newAccountLimiter.check(principalRateKey(req.user), req)) {
+            return Response.json(
+              { error: 'Trop de nouveaux comptes invités. Réessayez plus tard.' },
+              { status: 429 },
+            )
+          }
+
           // Create a placeholder client; password is random — the invitee will reset
           // via the forgotPassword flow triggered by the SupportClients afterChange hook.
           const tempPassword = randomBytes(16).toString('hex')