@consilioweb/payload-support 3.0.0 → 5.0.0

package/README.md

@@ -4,7 +4,7 @@
 
 [![npm](https://img.shields.io/npm/v/@consilioweb/payload-support.svg)](https://www.npmjs.com/package/@consilioweb/payload-support)
 [![license](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
-[![payload](https://img.shields.io/badge/payload-%5E3.37-blue.svg)](https://payloadcms.com)
+[![payload](https://img.shields.io/badge/payload-%5E3.79.1-blue.svg)](https://payloadcms.com)
 
 ## About
 
@@ -81,12 +81,18 @@ pnpm add @consilioweb/payload-support
 **Peer dependencies** — all six are required, none is optional:
 
 ```bash
-pnpm add payload@^3.37.0 @payloadcms/next@^3.37.0 next@^15.2.9 react@^19 react-dom@^19 lucide-react@">=0.300.0"
+pnpm add payload@^3.79.1 @payloadcms/next@^3.79.1 next@^15.2.9 react@^19 react-dom@^19 lucide-react@">=0.300.0"
 ```
 
-- `payload@^3.37.0` — the Google OAuth endpoint imports `jwtSign` from the `payload` barrel, which
-  only exists from 3.37.0 on. Below that, the missing named export fails the whole
-  `payload.config.ts`, not just that endpoint.
+- `payload@^3.79.1` — the floor is a security floor, and it is stated as such rather than
+  dressed up as an API constraint. Below 3.79.1 Payload is vulnerable to a pre-authentication
+  account takeover (GHSA-hp5w-3hxx-vmwf) and to a SQL injection, so a range that admitted those
+  versions — the previous `^3.37.0` did — let an install satisfy this plugin's requirements while
+  remaining exploitable. The API surface allows lower: the Google OAuth endpoint imports `jwtSign`
+  and `getFieldsToSign` from the `payload` barrel, and a missing named export fails the whole
+  `payload.config.ts` rather than just that endpoint, but both have been exported since 3.37 and
+  every symbol this package imports was verified present in 3.79.1. CI builds and tests against
+  the 3.88 line; 3.79.1 to 3.87 are permitted on that verification, not on a test run.
 - `@payloadcms/next` and `next` — the 13 admin views are registered unless you pass
   `skipViews: true`, and each imports `DefaultTemplate` from `@payloadcms/next/templates` plus
   `next/navigation` / `next/link` statically. Both are already present in any Payload 3 admin app.
@@ -328,6 +334,8 @@ Two flags are projections, deliberately not stored twice: `features.autoClose` m
 | `NEXT_PUBLIC_SUPPORT_PHONE` | for the portal ticket page | Support phone number shown on the portal ticket detail page. Set it: the fallback is the placeholder `01 23 45 67 89`. |
 | `NEXT_PUBLIC_SUPPORT_SEND_ALIASES` | optional | Comma-separated "send as" identities offered in the agent composer. Empty by default, and then the composer offers only the agent themselves. |
 | `NEXT_PUBLIC_SMTP_HOST` / `NEXT_PUBLIC_SMTP_PORT` | optional | Shown read-only in the Settings view. Informational only — mail is sent through `payload.sendEmail`, so these change nothing about delivery. |
+| `SUPPORT_CHATBOT_MAX_PER_HOUR` | optional | Global hourly ceiling on `POST /api/support/chatbot`, all callers combined (default `200`). The per-IP window is keyed on `X-Forwarded-For`, which an anonymous caller can rotate at will; this unkeyed ceiling is what bounds the Anthropic bill. Trade-off to accept knowingly: being unkeyed, it turns a cost abuse into an availability one — one anonymous caller burning the quota mutes the chatbot for every visitor until the next window. On a high-traffic public portal, raise it and enforce the per-IP limit at the reverse proxy, where the real client address is known. |
+| `SUPPORT_ALLOW_INSECURE_WEBHOOKS` | local dev only | `1` allows `http://` webhook endpoint URLs. Without it only `https://` is accepted, at save time and at delivery time. |
 
 ### Cron jobs
 
@@ -405,7 +413,7 @@ to stay enabled for the endpoint to be registered.
 |---|---|---|---|---|
 | `GET` | `/support/search` | staff | — | Global search over tickets, messages, clients and the knowledge base. |
 | `GET` | `/support/kb/search` | public | — | Knowledge-base search (used by the portal and the chatbot). |
-| `GET` | `/support/statuses` | authenticated | `customStatuses` | Ticket statuses, sorted. |
+| `GET` | `/support/statuses` | staff or support-client | `customStatuses` | Ticket statuses, sorted. Mirrors `ticket-statuses.access.read`: a principal from any other auth collection of your app gets 403, not the taxonomy. |
 | `POST` | `/support/bulk-action` | staff | `bulkActions` | Apply one action to many tickets. |
 | `POST` | `/support/merge-tickets` | staff | `merge` | Merge a source ticket into a target. |
 | `POST` | `/support/split-ticket` | staff | `splitTicket` | Extract a message into a new ticket. |
@@ -428,12 +436,22 @@ to stay enabled for the endpoint to be registered.
 | Method | Path | Access | Purpose |
 |---|---|---|---|
 | `POST` | `/support/login` | public, rate-limited | Portal password login. Sets an `HttpOnly` cookie; the JWT is never returned in JSON. |
-| `POST` | `/support/2fa` | public, rate-limited | Email second factor. |
+| `POST` | `/support/2fa` | public, rate-limited | Email second factor. **Both** `action: 'send'` and `action: 'verify'` require the short-lived `challenge` returned by `/support/login` (or by the Google callback) alongside `requires2FA`; without it, an anonymous caller who merely knew an address could burn the victim's send quota *or* their 5 verification attempts and lock them out of the only route that clears the 2FA gate. Every accepted `send` returns a refreshed `challenge` — keep the latest one and pass it to `verify` along with the code. |
 | `POST` | `/support/oauth/google` | public | Google sign-in, optionally restricted by `allowedEmailDomains`. |
+| `GET` | `/support/email-stats` | **staff**, rate-limited | Email pipeline aggregate. Was reachable by any authenticated session before 3.0.1. |
 | `GET` | `/support/export-data` | client | GDPR data export. |
 | `POST` | `/support/delete-account` | client | GDPR right to erasure. |
 | `POST` | `/support/merge-clients` | staff | Merge two client records. |
 
+**Google OAuth, CSRF state.** `{ "action": "login" }` now answers with a `Set-Cookie:
+support-oauth-state=…; HttpOnly; SameSite=Lax` alongside the `url` and `state` it already returned.
+The callback reads that cookie **server-side** and compares it, in constant time, with the `state`
+Google sends back — it no longer accepts a `cookieState` field in the request body, which any
+non-browser caller could simply send twice. If you wrote your own Google button, drop `cookieState`
+from the callback payload and let the browser carry the cookie (`credentials: 'include'` on a
+cross-origin fetch). The callback also enforces 2FA: an account with `twoFactorEnabled` gets
+`{ requires2FA: true }` and no token, exactly like `/support/login`.
+
 ### AI
 
 | Method | Path | Access | Flag | Purpose |
@@ -483,7 +501,7 @@ await fetch('/api/support/ai-agent', {
 | `GET`/`POST` | `/support/settings` | staff | — | Read and write the support settings, including the runtime feature flags. |
 | `GET`/`POST` | `/support/round-robin-config` | staff | `roundRobin` | Read and toggle round-robin assignment. |
 | `GET` | `/support/push/vapid-public-key` | public | — | VAPID public key for the browser subscription. |
-| `POST` | `/support/push/subscribe` | staff | — | Register an agent's push subscription. |
+| `POST` | `/support/push/subscribe` | staff | — | Register an agent's push subscription. The `endpoint` must be an `https://` URL on a public host — private, loopback and link-local targets are refused with 400 (SSRF), at write time and again at send time. |
 | `GET` | `/support/auto-close` | `x-cron-secret` | `autoClose` | Remind, then close, inactive tickets. |
 | `POST` | `/support/process-snooze` | `x-cron-secret` | `snooze` | Wake snoozed tickets. |
 | `POST` | `/support/process-scheduled` | `x-cron-secret` | `scheduledReplies` | Release scheduled replies. |
@@ -512,6 +530,15 @@ The signature header is only sent when the endpoint has a `secret`, so always se
 `X-Webhook-Secret` header any more — verify the HMAC signature instead. `lastTriggeredAt` and
 `lastStatus` are written back on the endpoint after every attempt. Requires `features.webhooks`.
 
+**The endpoint URL is validated as an SSRF target, not as free text.** Only `https://` is accepted
+(set `SUPPORT_ALLOW_INSECURE_WEBHOOKS=1` for local `http://`), literal loopback / private /
+link-local / IPv4-mapped-IPv6 hosts are rejected at save time, the hostname is re-resolved and
+re-checked immediately before the request (DNS rebinding), and redirects are followed **manually**
+so a `302` towards `127.0.0.1` or `169.254.169.254` cannot slip past the checks. An endpoint saved
+before 3.0 with an `http://` URL or an internal host stops delivering and must be re-pointed — but
+it stays editable: the check runs only on a URL you actually write, so such a row can still be
+renamed or deactivated, and `lastStatus: 0` is still recorded on it so a dead endpoint is visible.
+
 | Event | `data` |
 |---|---|
 | `ticket_created` | `ticketId`, `id`, `ticketNumber`, `subject`, `status`, `priority`, `category` |
@@ -593,16 +620,18 @@ import type { SupportPluginConfig, SupportFeatures } from '@consilioweb/payload-
 | Requirement | Range | Source |
 |---|---|---|
 | Node.js | `>=20.9.0` | `engines.node` |
-| Payload | `^3.37.0` | `peerDependencies.payload` |
-| `@payloadcms/next` | `^3.37.0` | `peerDependencies` |
+| Payload | `^3.79.1` | `peerDependencies.payload` |
+| `@payloadcms/next` | `^3.79.1` | `peerDependencies` |
 | Next.js | `^15.2.9 \|\| ^16.0.0` | `peerDependencies` |
 | React / React DOM | `^19.0.0` | `peerDependencies` |
 | `lucide-react` | `>=0.300.0` | `peerDependencies` |
 | `@anthropic-ai/sdk` | any recent version | Runtime-only, install it yourself if you use the AI features |
 | `@payloadcms/richtext-lexical` | any 3.x | Only if you mount the portal FAQ page |
 
-Installing on Node 18, React 18, Next 14 or Payload < 3.37 warns, and fails outright under
-`engine-strict` or a strict peer resolver.
+Installing on Node 18, React 18, Next 14 or Payload < 3.79.1 warns, and fails outright under
+`engine-strict` or a strict peer resolver. Payload below 3.79.1 is additionally vulnerable to a
+pre-authentication account takeover (GHSA-hp5w-3hxx-vmwf) and to a SQL injection: upgrade rather
+than force the install.
 
 ## Security
 
@@ -617,7 +646,15 @@ Installing on Node 18, React 18, Next 14 or Payload < 3.37 warns, and fails outr
   outside development. Login, OAuth and 2FA responses never return the token in JSON.
 - **2FA enforced server-side** (`beforeLogin`), and the endpoint refuses to run without
   `PAYLOAD_SECRET` rather than falling back to an insecure default. OAuth verifies the Google email.
-- **Stored-XSS protection** — message HTML is sanitized on write, not on render.
+- **Stored-XSS protection** — message HTML is sanitized on write, not on render, and the portal
+  renders plain-text bodies as JSX (no hand-rolled HTML escaping) so an inbound email cannot inject
+  an attribute into a link.
+- **Owner-scoped preferences** — the plugin's `payload-preferences` rows (settings, per-agent
+  signature and locale) are read back with a `user.relationTo` constraint on the staff collection.
+  `payload-preferences` accepts a write from *any* authenticated principal, so reading by key alone
+  let a client own the server settings.
+- **Auth-collection checks, not duck typing** — every guard compares `user.collection` to the
+  configured slug: a user of another auth collection of the host app is not a support client.
 - **HMAC everywhere it matters** — webhook deliveries and tracking pixels are signed and verified in
   constant time, with idempotent writes. Cron and webhook secrets are read from headers only; a
   query-string secret is rejected.
@@ -626,6 +663,13 @@ Installing on Node 18, React 18, Next 14 or Payload < 3.37 warns, and fails outr
 - **No silent third-party AI host** — the `ollama` provider fails loudly on a missing
   `OLLAMA_API_URL` instead of defaulting to someone else's server.
 - **Bounded inbound email** payloads and attachments.
+- **Bounded outbound mail** — ticket transfers and collaborator invitations are capped per user over
+  a long window, not only per ticket (a client can create tickets at will).
+- **SSRF-guarded outbound requests** — scheme, literal host, resolved address and every redirect hop
+  for webhooks; scheme, literal host and resolved address for Web Push subscription endpoints, which
+  `web-push` would otherwise hand host and port straight to `https.request`.
+- **2FA also enforced on the Google OAuth path**, which mints its session outside `payload.login`
+  and therefore outside the `beforeLogin` hook.
 
 ### Reporting security issues
 
@@ -707,7 +751,7 @@ auto-migrated: generate and push it before deploying. See [Troubleshooting](#tro
    recomputing it — so a stale total keeps over-billing until something touches a time entry on that
    ticket.
 5. **Import `./views` and `./components/TicketConversation` with ESM** — their CJS builds are gone.
-6. Check your platform: Node 20.9+, React 19, Next 15.2.9+, Payload 3.37+, and install
+6. Check your platform: Node 20.9+, React 19, Next 15.2.9+, Payload 3.79.1+, and install
    `lucide-react` explicitly if you were relying on it being optional.
 
 ### 1.x → 2.0