@consilioweb/payload-support 3.0.0 → 4.0.0

package/src/endpoints/login.ts

@@ -2,6 +2,7 @@ import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbCreate } from '../utils/db'
+import { issueTwoFactorChallenge } from '../utils/twoFactorChallenge'
 
 
 /**
@@ -9,7 +10,7 @@ import { dbCreate } from '../utils/db'
  * Client login endpoint.
  */
 export function createLoginEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const loginLimiter = new RateLimiter(15 * 60_000, 10, store)
+  const loginLimiter = new RateLimiter(15 * 60_000, 10, store, 'login')
   return {
     path: '/support/login',
     method: 'post',
@@ -75,8 +76,20 @@ export function createLoginEndpoint(slugs: CollectionSlugs, store?: RateLimitSto
 
         // 2FA gate: password was correct but a fresh 2FA verification is required.
         // No session/cookie is issued (Payload rolled it back on the throw).
+        //
+        // The password check just succeeded, so this is where the short-lived
+        // proof for `POST /support/2fa {action:'send'}` is minted: without it,
+        // that endpoint would keep letting an anonymous caller burn a victim's
+        // send quota and lock them out of their own account.
         if (errorMessage.includes('2FA_REQUIRED')) {
-          return Response.json({ requires2FA: true }, { status: 200 })
+          let challenge: string | undefined
+          try {
+            challenge = issueTwoFactorChallenge(email)
+          } catch {
+            // PAYLOAD_SECRET missing: 2FA cannot operate at all (codes are
+            // hashed with it). Answer without a challenge — fail closed.
+          }
+          return Response.json({ requires2FA: true, ...(challenge ? { challenge } : {}) }, { status: 200 })
         }
 
         let errorReason = 'Identifiants incorrects'

package/src/endpoints/oauth-google.ts

@@ -3,16 +3,74 @@ import { getFieldsToSign, jwtSign } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import crypto from 'crypto'
 import { dbFind, dbUpdate, dbCreate, dbFindByID } from '../utils/db'
+import { issueTwoFactorChallenge } from '../utils/twoFactorChallenge'
 
 /**
  * POST /api/support/oauth/google
  * Google OAuth — handles both login redirect and callback.
- * Body: { action: 'login' } or { code: string, state: string, cookieState: string }
+ * Body: { action: 'login' } or { code: string, state: string }
+ *
+ * The CSRF state is NOT taken from the body: `action: 'login'` issues it as an
+ * HttpOnly cookie and the callback reads it back from the `Cookie` header.
  */
 export interface OAuthGoogleOptions {
   allowedEmailDomains?: string[]
 }
 
+/** Name of the HttpOnly cookie carrying the CSRF state between the two steps. */
+export const OAUTH_STATE_COOKIE = 'support-oauth-state'
+
+/** Same window as the Google authorization code: 10 minutes is plenty. */
+const OAUTH_STATE_MAX_AGE = 600
+
+/**
+ * A successful `/support/2fa` verify stamps `twoFactorVerifiedAt`; the marker is
+ * valid for this window then consumed. Mirrors `TWO_FA_WINDOW_MS` in
+ * `collections/SupportClients.ts` — the two MUST stay in sync.
+ */
+const TWO_FA_WINDOW_MS = 5 * 60 * 1000
+
+/**
+ * Read one cookie from the request's own `Cookie` header.
+ *
+ * The callback used to compare `state` against a `cookieState` ALSO taken from
+ * the JSON body: two values from the same attacker-controlled place, so the CSRF
+ * check was a no-op for any non-browser caller (send the same string twice). The
+ * state is now issued as an HttpOnly cookie at the `login` step and read back
+ * here, server-side — the only place a browser cannot forge it from script.
+ */
+export function readCookie(header: string | null | undefined, name: string): string | null {
+  if (!header) return null
+  for (const part of header.split(';')) {
+    const eq = part.indexOf('=')
+    if (eq === -1) continue
+    if (part.slice(0, eq).trim() !== name) continue
+    try {
+      return decodeURIComponent(part.slice(eq + 1).trim())
+    } catch {
+      return part.slice(eq + 1).trim()
+    }
+  }
+  return null
+}
+
+/**
+ * Expire the state cookie: it is single-use, and leaving it live for the rest of
+ * its 10 minutes keeps a consumed CSRF token replayable for no benefit.
+ */
+export function clearedStateCookie(): string {
+  const secure = process.env.NODE_ENV === 'production'
+  return `${OAUTH_STATE_COOKIE}=; HttpOnly; ${secure ? 'Secure; ' : ''}SameSite=Lax; Path=/; Max-Age=0`
+}
+
+/** Constant-time comparison — the state is a secret for the length of the flow. */
+function statesMatch(a: string | null | undefined, b: string | null | undefined): boolean {
+  if (!a || !b) return false
+  const left = crypto.createHash('sha256').update(a).digest()
+  const right = crypto.createHash('sha256').update(b).digest()
+  return crypto.timingSafeEqual(left, right)
+}
+
 export function createOAuthGoogleEndpoint(slugs: CollectionSlugs, options?: OAuthGoogleOptions): Endpoint {
   return {
     path: '/support/oauth/google',
@@ -31,7 +89,7 @@ export function createOAuthGoogleEndpoint(slugs: CollectionSlugs, options?: OAut
 
       try {
         const body = await req.json!()
-        const { action, code, state: queryState, cookieState } = body
+        const { action, code, state: queryState } = body
 
         // Step 1: Generate OAuth URL
         if (action === 'login') {
@@ -46,16 +104,30 @@ export function createOAuthGoogleEndpoint(slugs: CollectionSlugs, options?: OAut
             prompt: 'select_account',
           })
 
-          return Response.json({
-            url: `https://accounts.google.com/o/oauth2/v2/auth?${params}`,
-            state: oauthState,
-          })
+          const secure = process.env.NODE_ENV === 'production'
+          const loginHeaders = new Headers({ 'Content-Type': 'application/json' })
+          loginHeaders.append(
+            'Set-Cookie',
+            `${OAUTH_STATE_COOKIE}=${oauthState}; HttpOnly; ${secure ? 'Secure; ' : ''}SameSite=Lax; Path=/; Max-Age=${OAUTH_STATE_MAX_AGE}`,
+          )
+
+          return new Response(
+            JSON.stringify({
+              url: `https://accounts.google.com/o/oauth2/v2/auth?${params}`,
+              // Kept for callers that echo it back in the redirect URL; the
+              // server no longer trusts anything the caller returns.
+              state: oauthState,
+            }),
+            { status: 200, headers: loginHeaders },
+          )
         }
 
         // Step 2: Handle callback (code exchange)
         if (code) {
-          // Validate state
-          if (!cookieState || !queryState || cookieState !== queryState) {
+          // Validate state against the HttpOnly cookie set at the `login` step —
+          // NOT against a second copy taken from the request body.
+          const issuedState = readCookie(req.headers.get('cookie'), OAUTH_STATE_COOKIE)
+          if (!statesMatch(issuedState, queryState)) {
             return Response.json({ error: 'state_mismatch' }, { status: 400 })
           }
 
@@ -158,6 +230,54 @@ export function createOAuthGoogleEndpoint(slugs: CollectionSlugs, options?: OAut
             }) as { id: number | string; email: string }
           }
 
+          // Replay the 2FA rule BEFORE minting anything.
+          //
+          // This path never calls `payload.login`, so the `beforeLogin` hook
+          // `createEnforce2FA` (collections/SupportClients.ts) never runs: a
+          // client who turned 2FA on from the portal profile page could skip it
+          // entirely by clicking "Sign in with Google". Same contract as
+          // `endpoints/login.ts`: no token, `{ requires2FA: true }`, and the
+          // verified marker is single-use.
+          const twoFactorDoc = (await dbFindByID(payload, slugs.supportClients, {
+            id: clientDoc.id,
+            depth: 0,
+            overrideAccess: true,
+            showHiddenFields: true,
+          })) as { twoFactorEnabled?: boolean; twoFactorVerifiedAt?: string | null }
+
+          if (twoFactorDoc?.twoFactorEnabled) {
+            const raw = twoFactorDoc.twoFactorVerifiedAt
+            const verifiedAt = raw ? new Date(raw).getTime() : 0
+            if (!(verifiedAt > Date.now() - TWO_FA_WINDOW_MS)) {
+              // The authorization code is spent: the client has to restart the
+              // whole flow after verifying, so the state goes with it.
+              //
+              // Google just proved this identity, so the client is entitled to
+              // request a code: hand out the same short-lived challenge
+              // `endpoints/login.ts` mints, or `POST /support/2fa` would refuse
+              // to send one.
+              let challenge: string | undefined
+              try {
+                challenge = issueTwoFactorChallenge(clientDoc.email)
+              } catch {
+                // PAYLOAD_SECRET missing — 2FA is inoperable anyway; fail closed.
+              }
+              return new Response(JSON.stringify({ requires2FA: true, ...(challenge ? { challenge } : {}) }), {
+                status: 200,
+                headers: new Headers({
+                  'Content-Type': 'application/json',
+                  'Set-Cookie': clearedStateCookie(),
+                }),
+              })
+            }
+            // Consume the marker so the verified window cannot be replayed.
+            await dbUpdate(payload, slugs.supportClients, {
+              id: clientDoc.id,
+              data: { twoFactorVerifiedAt: null },
+              overrideAccess: true,
+            })
+          }
+
           // Mint a Payload session WITHOUT touching the user's password.
           // Uses Payload's own jwtSign/getFieldsToSign so the token format matches
           // exactly, and replicates addSessionToUser for the sessions array.
@@ -209,6 +329,8 @@ export function createOAuthGoogleEndpoint(slugs: CollectionSlugs, options?: OAut
             'Set-Cookie',
             `payload-token=${token}; HttpOnly; ${cookieSecure ? 'Secure; ' : ''}SameSite=Lax; Path=/; Max-Age=${tokenExpiration}`,
           )
+          // The state has done its job — do not leave it replayable.
+          headers.append('Set-Cookie', clearedStateCookie())
 
           return new Response(JSON.stringify({ user: clientDoc, exp }), {
             status: 200,

package/src/endpoints/resend-notification.ts

@@ -1,7 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { escapeHtml } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
 import { dbFindByID } from '../utils/db'
@@ -12,7 +12,7 @@ import { dbFindByID } from '../utils/db'
  * Resend the email notification for a specific ticket message. Admin-only.
  */
 export function createResendNotificationEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const resendLimiter = new RateLimiter(60 * 60 * 1000, 10, store)
+  const resendLimiter = new RateLimiter(60 * 60 * 1000, 10, store, 'resend-notification')
   return {
     path: '/support/resend-notification',
     method: 'post',
@@ -22,7 +22,7 @@ export function createResendNotificationEndpoint(slugs: CollectionSlugs, store?:
 
         requireAdmin(req, slugs)
 
-        if (await resendLimiter.check(String(req.user.id), req)) {
+        if (await resendLimiter.check(principalRateKey(req.user), req)) {
           return Response.json(
             { error: 'Trop de renvois. Réessayez dans une heure.' },
             { status: 429 },

package/src/endpoints/send-reminder.ts

@@ -1,7 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { escapeHtml, emailWrapper, emailParagraph, emailButton } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
 import { dbFindByID, dbFind, dbCreate, dbUpdate } from '../utils/db'
@@ -38,7 +38,7 @@ function formatFr(date: Date, withTime: boolean): string {
  * Admin-only, rate-limited.
  */
 export function createSendReminderEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const reminderLimiter = new RateLimiter(60 * 60 * 1000, 30, store)
+  const reminderLimiter = new RateLimiter(60 * 60 * 1000, 30, store, 'send-reminder')
   return {
     path: '/support/send-reminder',
     method: 'post',
@@ -48,7 +48,7 @@ export function createSendReminderEndpoint(slugs: CollectionSlugs, store?: RateL
 
         requireAdmin(req, slugs)
 
-        if (await reminderLimiter.check(String(req.user.id), req)) {
+        if (await reminderLimiter.check(principalRateKey(req.user), req)) {
           return Response.json(
             { error: 'Trop de relances. Réessayez dans une heure.' },
             { status: 429 },

package/src/endpoints/signature.ts

@@ -19,7 +19,14 @@ export function createSignatureGetEndpoint(slugs: CollectionSlugs): Endpoint {
         requireAdmin(req, slugs)
 
         const prefs = await dbFind(payload, 'payload-preferences', {
-          where: { key: { equals: `${PREF_KEY}-${req.user.id}` } },
+          // Scope to the staff auth collection: `payload-preferences` accepts a
+          // write from ANY authenticated principal, and ids collide between auth
+          // collections — a support-client with the same id would otherwise own
+          // the `email-signature-<id>` row read back for the agent.
+          where: {
+            key: { equals: `${PREF_KEY}-${req.user.id}` },
+            'user.relationTo': { equals: slugs.users },
+          },
           limit: 1,
           depth: 0,
           overrideAccess: true,
@@ -57,7 +64,7 @@ export function createSignaturePostEndpoint(slugs: CollectionSlugs): Endpoint {
         const key = `${PREF_KEY}-${req.user.id}`
 
         const existing = await dbFind(payload, 'payload-preferences', {
-          where: { key: { equals: key } },
+          where: { key: { equals: key }, 'user.relationTo': { equals: slugs.users } },
           limit: 1,
           depth: 0,
           overrideAccess: true,

package/src/endpoints/ticket-synthesis.ts

@@ -4,7 +4,7 @@ import { requireAdmin, handleAuthError } from '../utils/auth'
 import { generateTicketSynthesis } from '../utils/generateTicketSynthesis'
 import { dbFindByID } from '../utils/db'
 import type { SupportCapabilities } from '../types'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 
 /**
  * POST /api/support/ticket-synthesis?ticketId=X[&force=true]
@@ -23,14 +23,14 @@ export function createTicketSynthesisEndpoint(
   generator?: SupportCapabilities['aiSummaries'],
   store?: RateLimitStore,
 ): Endpoint {
-  const limiter = new RateLimiter(60_000, 20, store)
+  const limiter = new RateLimiter(60_000, 20, store, 'ticket-synthesis')
   return {
     path: '/support/ticket-synthesis',
     method: 'post',
     handler: async (req) => {
       try {
         requireAdmin(req, slugs)
-        if (await limiter.check(String(req.user!.id), req)) {
+        if (await limiter.check(principalRateKey(req.user), req)) {
           return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
         }
         const payload = req.payload

package/src/endpoints/transfer-ticket.ts

@@ -3,7 +3,7 @@ import type { CollectionSlugs } from '../utils/slugs'
 import { handleAuthError, AuthError } from '../utils/auth'
 import { escapeHtml, emailWrapper, emailButton, emailParagraph } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbFindByID, dbFind, dbCreate, dbCount } from '../utils/db'
 
 // Simple RFC-5322 style sanity check — same level of strictness as the
@@ -13,6 +13,21 @@ const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
 
 const MAX_TRANSFERS_PER_DAY = 5
 
+/**
+ * Per-USER ceiling, ticket-independent.
+ *
+ * Both existing quotas (the in-memory limiter keyed `<user>:<ticket>` and the
+ * `email-logs` count) are per TICKET, and a support-client can open as many
+ * tickets as they want — so "5 transfers / 24 h" resets on every new ticket and
+ * the endpoint is an unbounded outbound mailer: the operator's From address, a
+ * "Récapitulatif support" subject, and 1 000 characters chosen by the caller,
+ * to any mailbox. This second quota is what actually bounds the volume.
+ *
+ * Applied to support-clients only: staff already hold the whole mailing surface
+ * of the admin panel, and capping them here would break legitimate bulk recaps.
+ */
+const MAX_TRANSFERS_PER_USER_PER_DAY = 15
+
 // In-memory fail-closed rate limiter — enforced even when the persistent
 // emailLogs-based check is unavailable (collection disabled). Prevents the
 // endpoint from becoming an unbounded outbound mailer.
@@ -33,7 +48,8 @@ const MAX_TRANSFERS_PER_DAY = 5
  *  - Rate-limited to 5 transfers per ticket per 24h
  */
 export function createTransferTicketEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const transferLimiter = new RateLimiter(24 * 60 * 60 * 1000, MAX_TRANSFERS_PER_DAY, store)
+  const transferLimiter = new RateLimiter(24 * 60 * 60 * 1000, MAX_TRANSFERS_PER_DAY, store, 'transfer:ticket')
+  const transferUserLimiter = new RateLimiter(24 * 60 * 60 * 1000, MAX_TRANSFERS_PER_USER_PER_DAY, store, 'transfer:user')
   return {
     path: '/support/tickets/:id/transfer',
     method: 'post',
@@ -82,13 +98,22 @@ export function createTransferTicketEndpoint(slugs: CollectionSlugs, store?: Rat
 
         // Fail-closed in-memory rate limit (per user + ticket): enforced even
         // when the persistent emailLogs check below cannot run.
-        if (await transferLimiter.check(`${req.user.id}:${ticketId}`, req)) {
+        if (await transferLimiter.check(`${principalRateKey(req.user)}:${ticketId}`, req)) {
           return Response.json(
             { error: `Limite atteinte (${MAX_TRANSFERS_PER_DAY} transferts par 24h sur ce ticket)` },
             { status: 429 },
           )
         }
 
+        // Ticket-independent quota — the per-ticket ones above reset on every
+        // newly created ticket, which a client can do at will.
+        if (!isAdmin && await transferUserLimiter.check(principalRateKey(req.user), req)) {
+          return Response.json(
+            { error: `Limite atteinte (${MAX_TRANSFERS_PER_USER_PER_DAY} transferts par 24h)` },
+            { status: 429 },
+          )
+        }
+
         // Rate limit: count transfers in last 24h for this ticket
         try {
           const since = new Date(Date.now() - 24 * 60 * 60 * 1000).toISOString()

package/src/endpoints/typing.ts

@@ -1,10 +1,36 @@
-import type { Endpoint } from 'payload'
+import type { Endpoint, PayloadRequest } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
+import { dbFindByID } from '../utils/db'
 
-// In-memory typing state (ticketId -> { admin?: timestamp, client?: timestamp })
+/**
+ * Ephemeral "someone is typing" state, process-local.
+ *
+ * Three properties this map MUST keep, because it is fed by an HTTP endpoint:
+ *  - keys are shaped like ticket ids, never a caller-supplied blob;
+ *  - a key is only created by a principal that can actually READ that ticket;
+ *  - the map is bounded, and expired entries are reclaimed without depending on
+ *    a matching GET (`cleanExpired` used to run only on the read path, for the
+ *    single id being read — nothing ever swept the rest).
+ */
 const typingState = new Map<string, { admin?: number; client?: number; adminName?: string; clientName?: string }>()
 
 const TYPING_TTL = 5000 // 5 seconds
+/** Hard ceiling on distinct ticket ids held at once — the state lives 5s. */
+const MAX_TYPING_KEYS = 500
+
+/**
+ * Ids are integers on SQL adapters and hex ObjectIds on Mongo, so the shape is
+ * validated rather than the type: printable id characters, bounded length. This
+ * caps the key SIZE; the access check below caps their NUMBER.
+ */
+const TICKET_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/
+
+function normalizeTicketId(raw: unknown): string | null {
+  if (typeof raw === 'number') return Number.isInteger(raw) && raw > 0 ? String(raw) : null
+  if (typeof raw !== 'string') return null
+  const value = raw.trim()
+  return TICKET_ID_PATTERN.test(value) ? value : null
+}
 
 function cleanExpired(ticketId: string) {
   const state = typingState.get(ticketId)
@@ -21,6 +47,53 @@ function cleanExpired(ticketId: string) {
   if (!state.admin && !state.client) typingState.delete(ticketId)
 }
 
+/** Reclaims every expired entry — the map is at most MAX_TYPING_KEYS long. */
+function sweepExpired() {
+  for (const key of Array.from(typingState.keys())) cleanExpired(key)
+}
+
+/** Oldest signal first, so the ceiling evicts the least recently active ticket. */
+function evictOldest() {
+  let oldestKey: string | null = null
+  let oldestTs = Infinity
+  for (const [key, state] of typingState) {
+    const ts = Math.max(state.admin || 0, state.client || 0)
+    if (ts < oldestTs) {
+      oldestTs = ts
+      oldestKey = key
+    }
+  }
+  if (oldestKey !== null) typingState.delete(oldestKey)
+}
+
+/**
+ * Can this principal see this ticket? Delegates to the `tickets` collection
+ * access rules — the SAME source of truth the rest of the plugin reads through
+ * (owner, collaborator, team scoping), instead of a second implementation that
+ * would drift from it. Any other auth collection of the host app is refused
+ * outright: the endpoint only ever spoke for staff and support-clients.
+ */
+async function mayAccessTicket(
+  req: PayloadRequest,
+  slugs: CollectionSlugs,
+  ticketId: string,
+): Promise<boolean> {
+  const collection = (req.user as { collection?: string } | null)?.collection
+  if (collection !== slugs.users && collection !== slugs.supportClients) return false
+  try {
+    const doc = await dbFindByID(req.payload, slugs.tickets, {
+      id: ticketId,
+      depth: 0,
+      overrideAccess: false,
+      user: req.user,
+    })
+    return !!doc
+  } catch {
+    // Forbidden or NotFound — same answer either way, so no existence oracle.
+    return false
+  }
+}
+
 /**
  * POST /api/support/typing — Signal that user is typing
  */
@@ -34,14 +107,23 @@ export function createTypingPostEndpoint(slugs: CollectionSlugs): Endpoint {
           return Response.json({ error: 'Unauthorized' }, { status: 401 })
         }
 
-        const { ticketId } = (await req.json!()) as { ticketId: number }
-        if (!ticketId) {
+        const { ticketId } = (await req.json!()) as { ticketId?: unknown }
+        const key = normalizeTicketId(ticketId)
+        if (!key) {
           return Response.json({ error: 'ticketId required' }, { status: 400 })
         }
 
-        const key = String(ticketId)
+        if (!(await mayAccessTicket(req, slugs, key))) {
+          return Response.json({ error: 'Forbidden' }, { status: 403 })
+        }
+
         const state = typingState.get(key) || {}
 
+        if (!typingState.has(key) && typingState.size >= MAX_TYPING_KEYS) {
+          sweepExpired()
+          if (typingState.size >= MAX_TYPING_KEYS) evictOldest()
+        }
+
         if (req.user.collection === slugs.users) {
           state.admin = Date.now()
           state.adminName = (req.user as any).firstName || 'Support'
@@ -67,35 +149,56 @@ export function createTypingGetEndpoint(slugs: CollectionSlugs): Endpoint {
     path: '/support/typing',
     method: 'get',
     handler: async (req) => {
+      const idle = { typing: false, name: null }
       try {
         if (!req.user) {
           return Response.json({ error: 'Unauthorized' }, { status: 401 })
         }
 
         const url = new URL(req.url!)
-        const ticketId = url.searchParams.get('ticketId')
-        if (!ticketId) {
+        const key = normalizeTicketId(url.searchParams.get('ticketId'))
+        if (!key) {
           return Response.json({ error: 'ticketId required' }, { status: 400 })
         }
 
-        cleanExpired(ticketId)
-        const state = typingState.get(ticketId)
+        cleanExpired(key)
+        const state = typingState.get(key)
+
+        // Nothing to disclose: answer without touching the database. A caller
+        // with no right to the ticket gets this exact body too, so "idle" and
+        // "not yours" stay indistinguishable — and the 2s poll of every open
+        // ticket page costs no query in the common case.
+        if (!state) return Response.json(idle)
+
+        // There IS a name to hand out (the agent's first name, historically
+        // served to any authenticated caller for any ticket id) — check first.
+        if (!(await mayAccessTicket(req, slugs, key))) return Response.json(idle)
 
         // Admin sees client typing, client sees admin typing
         if (req.user.collection === slugs.users) {
           return Response.json({
-            typing: !!state?.client,
-            name: state?.clientName || null,
+            typing: !!state.client,
+            name: state.clientName || null,
           })
         } else {
           return Response.json({
-            typing: !!state?.admin,
-            name: state?.adminName || null,
+            typing: !!state.admin,
+            name: state.adminName || null,
           })
         }
       } catch {
-        return Response.json({ typing: false, name: null })
+        return Response.json(idle)
       }
     },
   }
 }
+
+/** Test seam — the module-level map must not leak state across test cases. */
+export function __resetTypingStateForTests(): void {
+  typingState.clear()
+}
+
+/** Test seam — the ceiling is the point of the fix, so it must be observable. */
+export function __typingStateSizeForTests(): number {
+  return typingState.size
+}

package/src/endpoints/user-prefs.ts

@@ -30,8 +30,11 @@ export function createUserPrefsGetEndpoint(slugs: CollectionSlugs): Endpoint {
 
         const key = `${PREF_KEY_PREFIX}-${req.user!.id}`
 
+        // Scope to the staff auth collection: `payload-preferences` accepts a
+        // write from ANY authenticated principal, and ids collide between auth
+        // collections.
         const prefs = await dbFind(payload, 'payload-preferences', {
-          where: { key: { equals: key } },
+          where: { key: { equals: key }, 'user.relationTo': { equals: slugs.users } },
           limit: 1,
           depth: 0,
           overrideAccess: true,
@@ -75,7 +78,7 @@ export function createUserPrefsPostEndpoint(slugs: CollectionSlugs): Endpoint {
 
         // Read existing prefs to merge
         const existing = await dbFind(payload, 'payload-preferences', {
-          where: { key: { equals: key } },
+          where: { key: { equals: key }, 'user.relationTo': { equals: slugs.users } },
           limit: 1,
           depth: 0,
           overrideAccess: true,

package/src/plugin.ts

@@ -31,6 +31,7 @@ import {
   createSupportCountersCollection,
 } from './collections'
 import { PayloadRateLimitStore } from './utils/rateLimiter'
+import { SUPPORT_STAFF_SLUG_CONFIG_KEY } from './utils/readSettings'
 
 function viewConfig(component: string, path: string): AdminViewConfig {
   return { Component: component, path: path as `/${string}` }
@@ -169,6 +170,17 @@ export function supportPlugin(config?: SupportPluginConfig): Plugin {
 
     return {
       ...incomingConfig,
+      // Publish the resolved staff collection so the server-side readers share
+      // ONE source of truth with the writers. `requireAdmin` compares against
+      // `slugs.users`; the `payload-preferences` reads used to scope themselves
+      // on `config.admin.user`, which Payload silently defaults to the first
+      // auth collection of the host app — a different collection on any app
+      // that declares `collectionSlugs.users`, and the settings-poisoning hole
+      // reopened right there.
+      custom: {
+        ...incomingConfig.custom,
+        [SUPPORT_STAFF_SLUG_CONFIG_KEY]: slugs.users,
+      },
       collections: config?.skipCollections
         ? existingCollections
         : [...existingCollections, ...supportCollections],

package/src/portal/auth/layout.tsx

@@ -18,8 +18,26 @@ export type SupportUser = {
   collection: 'support-clients'
 }
 
+/**
+ * The ONLY reliable discriminant is the auth collection the session belongs to.
+ *
+ * This used to be a duck test on the presence of a `company` field, which any
+ * user of another auth collection of the host app (front-office members,
+ * subscribers — `company` is a very common field on such a document) satisfied:
+ * they entered the portal shell instead of being redirected to the login page.
+ *
+ * `'support-clients'` is hard-coded on purpose — every other portal file already
+ * hard-codes it (`/api/support-clients/login`, `/api/support-clients/me`, the
+ * `user.collection` tests in `tickets/detail/page.tsx`), because the portal is a
+ * copied template with no access to the plugin's resolved `collectionSlugs`. An
+ * integrator who renames the collection must adjust the whole template.
+ */
 function isSupportUser(user: unknown): user is SupportUser {
-  return typeof user === 'object' && user !== null && 'company' in user
+  return (
+    typeof user === 'object' &&
+    user !== null &&
+    (user as { collection?: unknown }).collection === 'support-clients'
+  )
 }
 
 async function getSupportUser(): Promise<SupportUser | null> {