@consilioweb/payload-support 3.0.0 → 5.0.0

package/dist/index.js

@@ -1,6 +1,7 @@
 import { initTransaction, commitTransaction, killTransaction, getFieldsToSign, jwtSign, APIError } from 'payload';
 import crypto3, { createHash, timingSafeEqual, createHmac, randomBytes } from 'crypto';
 import PDFDocument from 'pdfkit';
+import { lookup } from 'dns/promises';
 import webpush from 'web-push';
 import sanitizeHtml from 'sanitize-html';
 
@@ -74,12 +75,43 @@ var DEFAULT_SLUGS = {
 function resolveSlugs(overrides) {
   return { ...DEFAULT_SLUGS, ...overrides };
 }
+var MAX_MEMORY_RATE_LIMIT_KEYS = 1e4;
 var MemoryRateLimitStore = class {
+  constructor(maxKeys = MAX_MEMORY_RATE_LIMIT_KEYS) {
+    this.maxKeys = maxKeys;
+  }
+  maxKeys;
   entries = /* @__PURE__ */ new Map();
+  /** Distinct keys currently held. Exposed so the ceiling can be asserted. */
+  get size() {
+    return this.entries.size;
+  }
+  /** Reclaims every window that has already closed. */
+  sweepExpired(now) {
+    for (const [key, entry] of this.entries) {
+      if (now > entry.resetAt) this.entries.delete(key);
+    }
+  }
+  /** Soonest-closing window first, so the ceiling drops the least useful entry. */
+  evictOldest() {
+    let oldestKey = null;
+    let oldestResetAt = Infinity;
+    for (const [key, entry] of this.entries) {
+      if (entry.resetAt < oldestResetAt) {
+        oldestResetAt = entry.resetAt;
+        oldestKey = key;
+      }
+    }
+    if (oldestKey !== null) this.entries.delete(oldestKey);
+  }
   async increment(key, windowMs) {
     const now = Date.now();
     const current = this.entries.get(key);
     const next = !current || now > current.resetAt ? { count: 1, resetAt: now + windowMs } : { ...current, count: current.count + 1 };
+    if (!current && this.entries.size >= this.maxKeys) {
+      this.sweepExpired(now);
+      if (this.entries.size >= this.maxKeys) this.evictOldest();
+    }
     this.entries.set(key, next);
     return next;
   }
@@ -158,22 +190,61 @@ var PayloadRateLimitStore = class {
     return { payload: context };
   }
 };
+function principalRateKey(user) {
+  if (!user || user.id === void 0 || user.id === null) return "anonymous";
+  const collection = typeof user.collection === "string" && user.collection ? user.collection : "unknown";
+  return `${collection}:${String(user.id)}`;
+}
+var MAX_IP_KEY_LENGTH = 45;
+var IPV4_PATTERN = /^(?:\d{1,3}\.){3}\d{1,3}$/;
+var IPV6_PATTERN = /^[0-9a-fA-F:.%]+$/;
+function clientIpRateKey(req) {
+  const candidate = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || req.headers.get("x-real-ip")?.trim() || "";
+  return normalizeIpKey(candidate);
+}
+function normalizeIpKey(candidate) {
+  if (!candidate || candidate.length > MAX_IP_KEY_LENGTH) return "unknown";
+  const host = candidate.startsWith("[") && candidate.endsWith("]") ? candidate.slice(1, -1) : candidate;
+  if (!host) return "unknown";
+  if (IPV4_PATTERN.test(host)) {
+    return host.split(".").every((octet) => Number(octet) <= 255) ? host : "unknown";
+  }
+  if (host.includes(":") && IPV6_PATTERN.test(host)) return host.toLowerCase();
+  return "unknown";
+}
 var RateLimiter = class {
-  constructor(windowMs, maxRequests, store) {
+  /**
+   * @param namespace  Endpoint-scoped prefix for every key this limiter writes.
+   *   The store is SHARED (`rateLimitStore: 'payload'` builds one instance for
+   *   all endpoints), and the raw keys collide across endpoints: `ip` was used
+   *   by both the login and the chatbot limiter — 10 forged chatbot requests
+   *   locked a victim out of the portal for 15 minutes — and `String(user.id)`
+   *   by five different endpoints. Always pass one; it is optional only because
+   *   `RateLimiter` is part of the published API surface.
+   */
+  constructor(windowMs, maxRequests, store, namespace) {
     this.windowMs = windowMs;
     this.maxRequests = maxRequests;
     this.store = store ?? new MemoryRateLimitStore();
+    this.prefix = namespace ? `${namespace}:` : "";
   }
   windowMs;
   maxRequests;
   store;
+  prefix;
+  /** The key actually written to the store. Exposed for assertions in tests. */
+  scopedKey(key) {
+    return `${this.prefix}${key}`;
+  }
   async check(key, context) {
-    const entry = context === void 0 ? await this.store.increment(key, this.windowMs) : await this.store.increment(key, this.windowMs, context);
+    const scoped = this.scopedKey(key);
+    const entry = context === void 0 ? await this.store.increment(scoped, this.windowMs) : await this.store.increment(scoped, this.windowMs, context);
     return entry.count > this.maxRequests;
   }
   async reset(key, context) {
-    if (context === void 0) await this.store.reset(key);
-    else await this.store.reset(key, context);
+    const scoped = this.scopedKey(key);
+    if (context === void 0) await this.store.reset(scoped);
+    else await this.store.reset(scoped, context);
   }
 };
 var DEFAULT_INBOUND_EMAIL_LIMITS = {
@@ -211,7 +282,7 @@ function validateInboundEmailPayload(input, contentLength, limits = DEFAULT_INBO
 
 // src/endpoints/capabilities.ts
 function createInboundEmailEndpoint(capability, store) {
-  const limiter = new RateLimiter(6e4, 60, store);
+  const limiter = new RateLimiter(6e4, 60, store, "inbound-email");
   return {
     path: "/support-webhook/inbound-email",
     method: "post",
@@ -220,7 +291,7 @@ function createInboundEmailEndpoint(capability, store) {
       if (!verifySecret(req.headers.get(secretHeader), capability.secret)) {
         return Response.json({ error: "Unauthorized" }, { status: 401 });
       }
-      const ip = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || req.headers.get("x-real-ip") || "unknown";
+      const ip = clientIpRateKey(req);
       if (await limiter.check(ip, req)) {
         return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
       }
@@ -242,7 +313,7 @@ function createInboundEmailEndpoint(capability, store) {
   };
 }
 function createProjectSuggestionsEndpoint(slugs, capability, store) {
-  const limiter = new RateLimiter(6e4, 20, store);
+  const limiter = new RateLimiter(6e4, 20, store, "suggest-projects");
   return {
     path: "/support/suggest-projects",
     method: "post",
@@ -250,7 +321,7 @@ function createProjectSuggestionsEndpoint(slugs, capability, store) {
       if (!req.user || req.user.collection !== slugs.users) {
         return Response.json({ error: "Unauthorized" }, { status: 401 });
       }
-      const key = req.user?.id ? String(req.user.id) : "anonymous";
+      const key = principalRateKey(req.user);
       if (await limiter.check(key, req)) {
         return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
       }
@@ -259,7 +330,7 @@ function createProjectSuggestionsEndpoint(slugs, capability, store) {
   };
 }
 function createTicketTitleEndpoint(slugs, capability, store) {
-  const limiter = new RateLimiter(6e4, 20, store);
+  const limiter = new RateLimiter(6e4, 20, store, "ticket-title");
   return {
     path: "/support/ticket-title",
     method: "post",
@@ -281,7 +352,7 @@ function createTicketTitleEndpoint(slugs, capability, store) {
   };
 }
 function createGenerateMissingTitlesEndpoint(slugs, capability, store) {
-  const limiter = new RateLimiter(6e4, 5, store);
+  const limiter = new RateLimiter(6e4, 5, store, "generate-missing-titles");
   return {
     path: "/support/generate-missing-titles",
     method: "post",
@@ -437,6 +508,14 @@ var SUPPORT_SETTINGS_PREF_KEY = "support-settings";
 var PREF_KEY = SUPPORT_SETTINGS_PREF_KEY;
 var USER_PREFS_KEY_PREFIX = "support-user-prefs";
 var LEGACY_ROUND_ROBIN_KEY = "support-round-robin";
+var SUPPORT_STAFF_SLUG_CONFIG_KEY = "supportStaffCollection";
+function resolveStaffPrefSlug(payload, staffSlug) {
+  if (staffSlug) return staffSlug;
+  const config = payload.config;
+  const registered = config?.custom?.[SUPPORT_STAFF_SLUG_CONFIG_KEY];
+  if (typeof registered === "string" && registered) return registered;
+  return config?.admin?.user || "users";
+}
 var DEFAULT_SETTINGS = {
   email: { fromAddress: "", fromName: "Support", replyToAddress: "" },
   ai: { provider: "anthropic", model: "claude-haiku-4-5-20251001", enableSentiment: true, enableSynthesis: true, enableSuggestion: true, enableRewrite: true },
@@ -448,10 +527,13 @@ var DEFAULT_USER_PREFS = {
   locale: "fr",
   signature: ""
 };
-var settingsCache = null;
+var settingsCache = /* @__PURE__ */ new Map();
 var SETTINGS_TTL_MS = 6e4;
+var SETTINGS_CACHE_MAX = 8;
+var warnedForeignSettingsRow = /* @__PURE__ */ new Set();
 function invalidateSupportSettingsCache() {
-  settingsCache = null;
+  settingsCache.clear();
+  warnedForeignSettingsRow.clear();
 }
 function mergeSupportSettings(stored, base = DEFAULT_SETTINGS) {
   const autoClose = { ...base.autoClose, ...stored?.autoClose };
@@ -468,9 +550,11 @@ function mergeSupportSettings(stored, base = DEFAULT_SETTINGS) {
     )
   };
 }
-async function readSupportSettingsState(payload) {
-  if (settingsCache && Date.now() - settingsCache.ts < SETTINGS_TTL_MS) {
-    return settingsCache.value;
+async function readSupportSettingsState(payload, staffSlug) {
+  const staff = resolveStaffPrefSlug(payload, staffSlug);
+  const cached = settingsCache.get(staff);
+  if (cached && Date.now() - cached.ts < SETTINGS_TTL_MS) {
+    return cached.value;
   }
   let value = {
     settings: mergeSupportSettings(null),
@@ -478,7 +562,10 @@ async function readSupportSettingsState(payload) {
   };
   try {
     const prefs = await dbFind(payload, "payload-preferences", {
-      where: { key: { equals: PREF_KEY } },
+      // Sibling keys are AND-ed by Payload. The `user.relationTo` clause is the
+      // security boundary: without it any authenticated principal can plant a
+      // `support-settings` row and own the plugin's server settings.
+      where: { key: { equals: PREF_KEY }, "user.relationTo": { equals: staff } },
       // The upsert is scoped per admin user, so several rows can share the key.
       // Sorting makes "last write wins" deterministic instead of arbitrary.
       sort: "-updatedAt",
@@ -491,22 +578,43 @@ async function readSupportSettingsState(payload) {
       const featuresConfigured = !!stored.features && typeof stored.features === "object";
       const settings = mergeSupportSettings(stored);
       if (!featuresConfigured) {
-        settings.features.roundRobin = await readLegacyRoundRobin(payload);
+        settings.features.roundRobin = await readLegacyRoundRobin(payload, staff);
       }
       value = { settings, featuresConfigured };
+    } else {
+      await warnOnForeignSettingsRow(payload, staff);
     }
   } catch {
   }
-  settingsCache = { value, ts: Date.now() };
+  if (settingsCache.size >= SETTINGS_CACHE_MAX && !settingsCache.has(staff)) settingsCache.clear();
+  settingsCache.set(staff, { value, ts: Date.now() });
   return value;
 }
-async function readSupportSettings(payload) {
-  return (await readSupportSettingsState(payload)).settings;
+async function warnOnForeignSettingsRow(payload, staff) {
+  if (warnedForeignSettingsRow.has(staff)) return;
+  try {
+    const any = await dbFind(payload, "payload-preferences", {
+      where: { key: { equals: PREF_KEY } },
+      limit: 1,
+      depth: 0,
+      overrideAccess: true
+    });
+    if (any.docs.length === 0) return;
+    if (warnedForeignSettingsRow.size >= SETTINGS_CACHE_MAX) warnedForeignSettingsRow.clear();
+    warnedForeignSettingsRow.add(staff);
+    console.warn(
+      `[support] A "${PREF_KEY}" preference row exists but none is owned by the "${staff}" collection: the plugin is running on its DEFAULT settings. Either the staff auth collection differs from \`admin.user\`, or the row was written by a principal that is not staff \u2014 in which case it is ignored on purpose.`
+    );
+  } catch {
+  }
 }
-async function readLegacyRoundRobin(payload) {
+async function readSupportSettings(payload, staffSlug) {
+  return (await readSupportSettingsState(payload, staffSlug)).settings;
+}
+async function readLegacyRoundRobin(payload, staff) {
   try {
     const prefs = await dbFind(payload, "payload-preferences", {
-      where: { key: { equals: LEGACY_ROUND_ROBIN_KEY } },
+      where: { key: { equals: LEGACY_ROUND_ROBIN_KEY }, "user.relationTo": { equals: staff } },
       limit: 1,
       depth: 0,
       overrideAccess: true
@@ -518,11 +626,14 @@ async function readLegacyRoundRobin(payload) {
   }
   return DEFAULT_TICKETING_FEATURES.roundRobin;
 }
-async function readUserPrefs(payload, userId) {
+async function readUserPrefs(payload, userId, staffSlug) {
   try {
     const key = `${USER_PREFS_KEY_PREFIX}-${userId}`;
     const prefs = await dbFind(payload, "payload-preferences", {
-      where: { key: { equals: key } },
+      where: {
+        key: { equals: key },
+        "user.relationTo": { equals: resolveStaffPrefSlug(payload, staffSlug) }
+      },
       limit: 1,
       depth: 0,
       overrideAccess: true
@@ -560,7 +671,7 @@ function getModel(aiSettings) {
   return aiSettings.model || "claude-haiku-4-5-20251001";
 }
 function createAiEndpoint(slugs, store) {
-  const limiter = new RateLimiter(6e4, 30, store);
+  const limiter = new RateLimiter(6e4, 30, store, "ai");
   return {
     path: "/support/ai",
     method: "post",
@@ -568,7 +679,7 @@ function createAiEndpoint(slugs, store) {
       try {
         const payload = req.payload;
         requireAdmin(req, slugs);
-        if (await limiter.check(String(req.user.id), req)) {
+        if (await limiter.check(principalRateKey(req.user), req)) {
           return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
         }
         const settings = await readSupportSettings(payload);
@@ -813,14 +924,14 @@ ${kbText || "(vide)"}`;
 
 // src/endpoints/ai-agent.ts
 function createAiAgentEndpoint(slugs, store) {
-  const limiter = new RateLimiter(6e4, 10, store);
+  const limiter = new RateLimiter(6e4, 10, store, "ai-agent");
   return {
     path: "/support/ai-agent",
     method: "post",
     handler: async (req) => {
       try {
         requireAdmin(req, slugs);
-        if (await limiter.check(String(req.user.id), req)) {
+        if (await limiter.check(principalRateKey(req.user), req)) {
           return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
         }
         let body = {};
@@ -860,11 +971,11 @@ function getModel2(aiSettings) {
 }
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 function createClientIntelligenceEndpoint(slugs, store) {
-  const limiter = new RateLimiter(6e4, 20, store);
+  const limiter = new RateLimiter(6e4, 20, store, "client-intelligence");
   const getHandler = async (req) => {
     try {
       requireAdmin(req, slugs);
-      if (await limiter.check(String(req.user.id), req)) {
+      if (await limiter.check(principalRateKey(req.user), req)) {
         return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
       }
       const payload = req.payload;
@@ -896,7 +1007,7 @@ function createClientIntelligenceEndpoint(slugs, store) {
   const postHandler = async (req) => {
     try {
       requireAdmin(req, slugs);
-      if (await limiter.check(String(req.user.id), req)) {
+      if (await limiter.check(principalRateKey(req.user), req)) {
         return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
       }
       const payload = req.payload;
@@ -1525,6 +1636,14 @@ function createSplitTicketEndpoint(slugs) {
 // src/endpoints/typing.ts
 var typingState = /* @__PURE__ */ new Map();
 var TYPING_TTL = 5e3;
+var MAX_TYPING_KEYS = 500;
+var TICKET_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+function normalizeTicketId(raw) {
+  if (typeof raw === "number") return Number.isInteger(raw) && raw > 0 ? String(raw) : null;
+  if (typeof raw !== "string") return null;
+  const value = raw.trim();
+  return TICKET_ID_PATTERN.test(value) ? value : null;
+}
 function cleanExpired(ticketId) {
   const state = typingState.get(ticketId);
   if (!state) return;
@@ -1539,6 +1658,36 @@ function cleanExpired(ticketId) {
   }
   if (!state.admin && !state.client) typingState.delete(ticketId);
 }
+function sweepExpired() {
+  for (const key of Array.from(typingState.keys())) cleanExpired(key);
+}
+function evictOldest() {
+  let oldestKey = null;
+  let oldestTs = Infinity;
+  for (const [key, state] of typingState) {
+    const ts = Math.max(state.admin || 0, state.client || 0);
+    if (ts < oldestTs) {
+      oldestTs = ts;
+      oldestKey = key;
+    }
+  }
+  if (oldestKey !== null) typingState.delete(oldestKey);
+}
+async function mayAccessTicket(req, slugs, ticketId) {
+  const collection = req.user?.collection;
+  if (collection !== slugs.users && collection !== slugs.supportClients) return false;
+  try {
+    const doc = await dbFindByID(req.payload, slugs.tickets, {
+      id: ticketId,
+      depth: 0,
+      overrideAccess: false,
+      user: req.user
+    });
+    return !!doc;
+  } catch {
+    return false;
+  }
+}
 function createTypingPostEndpoint(slugs) {
   return {
     path: "/support/typing",
@@ -1549,11 +1698,18 @@ function createTypingPostEndpoint(slugs) {
           return Response.json({ error: "Unauthorized" }, { status: 401 });
         }
         const { ticketId } = await req.json();
-        if (!ticketId) {
+        const key = normalizeTicketId(ticketId);
+        if (!key) {
           return Response.json({ error: "ticketId required" }, { status: 400 });
         }
-        const key = String(ticketId);
+        if (!await mayAccessTicket(req, slugs, key)) {
+          return Response.json({ error: "Forbidden" }, { status: 403 });
+        }
         const state = typingState.get(key) || {};
+        if (!typingState.has(key) && typingState.size >= MAX_TYPING_KEYS) {
+          sweepExpired();
+          if (typingState.size >= MAX_TYPING_KEYS) evictOldest();
+        }
         if (req.user.collection === slugs.users) {
           state.admin = Date.now();
           state.adminName = req.user.firstName || "Support";
@@ -1574,30 +1730,33 @@ function createTypingGetEndpoint(slugs) {
     path: "/support/typing",
     method: "get",
     handler: async (req) => {
+      const idle = { typing: false, name: null };
       try {
         if (!req.user) {
           return Response.json({ error: "Unauthorized" }, { status: 401 });
         }
         const url = new URL(req.url);
-        const ticketId = url.searchParams.get("ticketId");
-        if (!ticketId) {
+        const key = normalizeTicketId(url.searchParams.get("ticketId"));
+        if (!key) {
           return Response.json({ error: "ticketId required" }, { status: 400 });
         }
-        cleanExpired(ticketId);
-        const state = typingState.get(ticketId);
+        cleanExpired(key);
+        const state = typingState.get(key);
+        if (!state) return Response.json(idle);
+        if (!await mayAccessTicket(req, slugs, key)) return Response.json(idle);
         if (req.user.collection === slugs.users) {
           return Response.json({
-            typing: !!state?.client,
-            name: state?.clientName || null
+            typing: !!state.client,
+            name: state.clientName || null
           });
         } else {
           return Response.json({
-            typing: !!state?.admin,
-            name: state?.adminName || null
+            typing: !!state.admin,
+            name: state.adminName || null
           });
         }
       } catch {
-        return Response.json({ typing: false, name: null });
+        return Response.json(idle);
       }
     }
   };
@@ -1760,7 +1919,14 @@ function createSignatureGetEndpoint(slugs) {
         const payload = req.payload;
         requireAdmin(req, slugs);
         const prefs = await dbFind(payload, "payload-preferences", {
-          where: { key: { equals: `${PREF_KEY2}-${req.user.id}` } },
+          // Scope to the staff auth collection: `payload-preferences` accepts a
+          // write from ANY authenticated principal, and ids collide between auth
+          // collections — a support-client with the same id would otherwise own
+          // the `email-signature-<id>` row read back for the agent.
+          where: {
+            key: { equals: `${PREF_KEY2}-${req.user.id}` },
+            "user.relationTo": { equals: slugs.users }
+          },
           limit: 1,
           depth: 0,
           overrideAccess: true
@@ -1787,7 +1953,7 @@ function createSignaturePostEndpoint(slugs) {
         const { signature } = await req.json();
         const key = `${PREF_KEY2}-${req.user.id}`;
         const existing = await dbFind(payload, "payload-preferences", {
-          where: { key: { equals: key } },
+          where: { key: { equals: key }, "user.relationTo": { equals: slugs.users } },
           limit: 1,
           depth: 0,
           overrideAccess: true
@@ -2548,7 +2714,7 @@ function formatFr(date, withTime) {
   });
 }
 function createSendReminderEndpoint(slugs, store) {
-  const reminderLimiter = new RateLimiter(60 * 60 * 1e3, 30, store);
+  const reminderLimiter = new RateLimiter(60 * 60 * 1e3, 30, store, "send-reminder");
   return {
     path: "/support/send-reminder",
     method: "post",
@@ -2556,7 +2722,7 @@ function createSendReminderEndpoint(slugs, store) {
       try {
         const payload = req.payload;
         requireAdmin(req, slugs);
-        if (await reminderLimiter.check(String(req.user.id), req)) {
+        if (await reminderLimiter.check(principalRateKey(req.user), req)) {
           return Response.json(
             { error: "Trop de relances. R\xE9essayez dans une heure." },
             { status: 429 }
@@ -2682,6 +2848,10 @@ function createStatusesEndpoint(slugs) {
         if (!req.user) {
           return Response.json({ error: "Unauthorized" }, { status: 401 });
         }
+        const collection = req.user.collection;
+        if (collection !== slugs.users && collection !== slugs.supportClients) {
+          return Response.json({ error: "Forbidden" }, { status: 403 });
+        }
         const { docs } = await dbFind(payload, slugs.ticketStatuses, {
           sort: "sortOrder",
           limit: 100,
@@ -2859,14 +3029,20 @@ function createPurgeLogsEndpoint(slugs) {
 }
 
 // src/endpoints/chatbot.ts
-function createChatbotEndpoint(slugs, store) {
-  const chatbotLimiter = new RateLimiter(6e4, 10, store);
+var DEFAULT_CHATBOT_MAX_PER_HOUR = 200;
+function resolveMaxPerHour(explicit) {
+  const fromEnv = Number(process.env.SUPPORT_CHATBOT_MAX_PER_HOUR);
+  return Number.isFinite(fromEnv) && fromEnv > 0 ? fromEnv : DEFAULT_CHATBOT_MAX_PER_HOUR;
+}
+function createChatbotEndpoint(slugs, store, maxPerHour) {
+  const chatbotLimiter = new RateLimiter(6e4, 10, store, "chatbot:ip");
+  const globalLimiter = new RateLimiter(60 * 6e4, resolveMaxPerHour(), store, "chatbot:global");
   return {
     path: "/support/chatbot",
     method: "post",
     handler: async (req) => {
       try {
-        const ip = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || req.headers.get("x-real-ip") || "unknown";
+        const ip = clientIpRateKey(req);
         if (await chatbotLimiter.check(ip, req)) {
           return Response.json({ error: "Too many requests. Please wait a moment." }, { status: 429 });
         }
@@ -2880,6 +3056,15 @@ function createChatbotEndpoint(slugs, store) {
         if (!question?.trim() || question.trim().length < 5) {
           return Response.json({ error: "Question too short" }, { status: 400 });
         }
+        if (await globalLimiter.check("all", req)) {
+          return Response.json({
+            answer: null,
+            confidence: 0,
+            suggestion: "create_ticket",
+            aiUnavailable: true,
+            message: "L'assistant est momentan\xE9ment indisponible. Cr\xE9ez un ticket, un agent vous r\xE9pondra."
+          });
+        }
         const payload = req.payload;
         const articles = await dbFind(payload, slugs.knowledgeBase, {
           where: { published: { equals: true } },
@@ -2992,8 +3177,8 @@ function createChatGetEndpoint(slugs) {
   };
 }
 function createChatPostEndpoint(slugs, store) {
-  const chatSessionLimiter = new RateLimiter(36e5, 5, store);
-  const chatMessageLimiter = new RateLimiter(6e4, 15, store);
+  const chatSessionLimiter = new RateLimiter(36e5, 5, store, "chat:session");
+  const chatMessageLimiter = new RateLimiter(6e4, 15, store, "chat:message");
   return {
     path: "/support/chat",
     method: "post",
@@ -3009,8 +3194,9 @@ function createChatPostEndpoint(slugs, store) {
         }
         const { action, session, message } = body;
         const userId = String(req.user.id);
+        const rateKey = principalRateKey(req.user);
         if (action === "start") {
-          if (await chatSessionLimiter.check(userId, req)) {
+          if (await chatSessionLimiter.check(rateKey, req)) {
             return Response.json({ error: "Trop de sessions cr\xE9\xE9es. R\xE9essayez plus tard." }, { status: 429 });
           }
           const sessionId = `chat_${crypto3.randomBytes(16).toString("hex")}`;
@@ -3027,7 +3213,7 @@ function createChatPostEndpoint(slugs, store) {
           return Response.json({ session: sessionId, messages: [systemMsg] });
         }
         if (action === "send" && session && message) {
-          if (await chatMessageLimiter.check(userId, req)) {
+          if (await chatMessageLimiter.check(rateKey, req)) {
             return Response.json({ error: "Trop de messages. Attendez un moment." }, { status: 429 });
           }
           const trimmedMessage = String(message).trim();
@@ -3267,7 +3453,7 @@ function createAdminChatGetEndpoint(slugs) {
   };
 }
 function createAdminChatPostEndpoint(slugs, store) {
-  const adminChatLimiter = new RateLimiter(6e4, 30, store);
+  const adminChatLimiter = new RateLimiter(6e4, 30, store, "admin-chat");
   return {
     path: "/support/admin-chat",
     method: "post",
@@ -3296,7 +3482,7 @@ function createAdminChatPostEndpoint(slugs, store) {
         }
         const clientId = typeof sessionMsg.docs[0].client === "object" ? sessionMsg.docs[0].client.id : sessionMsg.docs[0].client;
         if (action === "send" && message) {
-          if (await adminChatLimiter.check(String(req.user.id), req)) {
+          if (await adminChatLimiter.check(principalRateKey(req.user), req)) {
             return Response.json({ error: "Rate limit atteint." }, { status: 429 });
           }
           const trimmedMessage = String(message).trim();
@@ -4251,14 +4437,14 @@ Reponds UNIQUEMENT avec la liste de puces, rien d'autre.`;
 
 // src/endpoints/ticket-synthesis.ts
 function createTicketSynthesisEndpoint(slugs, generator, store) {
-  const limiter = new RateLimiter(6e4, 20, store);
+  const limiter = new RateLimiter(6e4, 20, store, "ticket-synthesis");
   return {
     path: "/support/ticket-synthesis",
     method: "post",
     handler: async (req) => {
       try {
         requireAdmin(req, slugs);
-        if (await limiter.check(String(req.user.id), req)) {
+        if (await limiter.check(principalRateKey(req.user), req)) {
           return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
         }
         const payload = req.payload;
@@ -4302,15 +4488,17 @@ function createTicketSynthesisEndpoint(slugs, generator, store) {
 }
 
 // src/endpoints/email-stats.ts
-function createEmailStatsEndpoint(slugs) {
+function createEmailStatsEndpoint(slugs, store) {
+  const statsLimiter = new RateLimiter(6e4, 20, store, "email-stats");
   return {
     path: "/support/email-stats",
     method: "get",
     handler: async (req) => {
       try {
         const payload = req.payload;
-        if (!req.user) {
-          return Response.json({ error: "Unauthorized" }, { status: 401 });
+        requireAdmin(req, slugs);
+        if (await statsLimiter.check(principalRateKey(req.user), req)) {
+          return Response.json({ error: "Too many requests." }, { status: 429 });
         }
         const url = new URL(req.url);
         const days = Math.min(Number(url.searchParams.get("days")) || 7, 365);
@@ -4377,6 +4565,8 @@ function createEmailStatsEndpoint(slugs) {
           actions: Object.fromEntries(actionMap)
         });
       } catch (err) {
+        const authResponse = handleAuthError(err);
+        if (authResponse) return authResponse;
         console.error("[email-stats] Error:", err);
         return Response.json({ error: "Internal server error" }, { status: 500 });
       }
@@ -4809,7 +4999,7 @@ function createPendingEmailsProcessEndpoint(slugs) {
 
 // src/endpoints/resend-notification.ts
 function createResendNotificationEndpoint(slugs, store) {
-  const resendLimiter = new RateLimiter(60 * 60 * 1e3, 10, store);
+  const resendLimiter = new RateLimiter(60 * 60 * 1e3, 10, store, "resend-notification");
   return {
     path: "/support/resend-notification",
     method: "post",
@@ -4817,7 +5007,7 @@ function createResendNotificationEndpoint(slugs, store) {
       try {
         const payload = req.payload;
         requireAdmin(req, slugs);
-        if (await resendLimiter.check(String(req.user.id), req)) {
+        if (await resendLimiter.check(principalRateKey(req.user), req)) {
           return Response.json(
             { error: "Trop de renvois. R\xE9essayez dans une heure." },
             { status: 429 }
@@ -5018,15 +5208,54 @@ function createSeedKbEndpoint(slugs) {
     }
   };
 }
+var TWO_FACTOR_CHALLENGE_TTL_MS = 10 * 60 * 1e3;
+function challengeSecret() {
+  const secret = process.env.PAYLOAD_SECRET;
+  if (!secret) {
+    throw new Error(
+      "[support][2fa] PAYLOAD_SECRET is not set \u2014 refusing to issue a 2FA challenge with an insecure fallback secret"
+    );
+  }
+  return secret;
+}
+function normalizeEmail(email) {
+  return String(email).trim().toLowerCase();
+}
+function sign(email, expiresAt) {
+  return createHmac("sha256", challengeSecret()).update(`2fa-challenge:${normalizeEmail(email)}:${expiresAt}`).digest("hex");
+}
+function issueTwoFactorChallenge(email, now = Date.now()) {
+  const expiresAt = now + TWO_FACTOR_CHALLENGE_TTL_MS;
+  return `${expiresAt}.${sign(email, expiresAt)}`;
+}
+function verifyTwoFactorChallenge(email, token, now = Date.now()) {
+  if (typeof email !== "string" || !email || typeof token !== "string") return false;
+  const separator = token.indexOf(".");
+  if (separator <= 0) return false;
+  const expiresAt = Number(token.slice(0, separator));
+  if (!Number.isSafeInteger(expiresAt) || expiresAt <= now) return false;
+  const received = token.slice(separator + 1);
+  if (!/^[0-9a-f]{64}$/i.test(received)) return false;
+  let expected;
+  try {
+    expected = sign(email, expiresAt);
+  } catch {
+    return false;
+  }
+  const a = Buffer.from(expected, "hex");
+  const b = Buffer.from(received.toLowerCase(), "hex");
+  return a.length === b.length && timingSafeEqual(a, b);
+}
 
 // src/endpoints/login.ts
+var MAX_LOGGED_USER_AGENT = 256;
 function createLoginEndpoint(slugs, store) {
-  const loginLimiter = new RateLimiter(15 * 6e4, 10, store);
+  const loginLimiter = new RateLimiter(15 * 6e4, 10, store, "login");
   return {
     path: "/support/login",
     method: "post",
     handler: async (req) => {
-      const ip = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || req.headers.get("x-real-ip") || "unknown";
+      const ip = clientIpRateKey(req);
       if (await loginLimiter.check(ip, req)) {
         return Response.json(
           { error: "Trop de tentatives. R\xE9essayez dans quelques minutes." },
@@ -5041,7 +5270,7 @@ function createLoginEndpoint(slugs, store) {
         return Response.json({ error: "Invalid JSON body" }, { status: 400 });
       }
       const { email, password } = body;
-      const userAgent = req.headers.get("user-agent") || "";
+      const userAgent = (req.headers.get("user-agent") || "").slice(0, MAX_LOGGED_USER_AGENT);
       if (!email || !password) {
         return Response.json({ error: "Email et mot de passe requis." }, { status: 400 });
       }
@@ -5074,7 +5303,12 @@ function createLoginEndpoint(slugs, store) {
       } catch (err) {
         const errorMessage = err instanceof Error ? err.message : "Erreur inconnue";
         if (errorMessage.includes("2FA_REQUIRED")) {
-          return Response.json({ requires2FA: true }, { status: 200 });
+          let challenge;
+          try {
+            challenge = issueTwoFactorChallenge(email);
+          } catch {
+          }
+          return Response.json({ requires2FA: true, ...challenge ? { challenge } : {} }, { status: 200 });
         }
         let errorReason = "Identifiants incorrects";
         if (errorMessage.includes("locked") || errorMessage.includes("verrouill\xE9") || errorMessage.includes("Too many")) {
@@ -5106,8 +5340,8 @@ function hashCode(code) {
   return createHmac("sha256", secret).update(code).digest("hex");
 }
 function createAuth2faEndpoint(slugs, store) {
-  const sendLimiter = new RateLimiter(60 * 60 * 1e3, 3, store);
-  const verifyLimiter = new RateLimiter(15 * 60 * 1e3, 5, store);
+  const sendLimiter = new RateLimiter(60 * 60 * 1e3, 3, store, "2fa:send");
+  const verifyLimiter = new RateLimiter(15 * 60 * 1e3, 5, store, "2fa:verify");
   return {
     path: "/support/2fa",
     method: "post",
@@ -5120,14 +5354,32 @@ function createAuth2faEndpoint(slugs, store) {
         } catch {
           return Response.json({ error: "Invalid JSON body" }, { status: 400 });
         }
-        const { action, email, code } = body;
+        const { action, email, code, challenge } = body;
         if (!action || !email) {
           return Response.json({ error: "Param\xE8tres manquants" }, { status: 400 });
         }
-        const genericSendResponse = { success: true, message: "Si un compte existe, un code a \xE9t\xE9 envoy\xE9." };
+        const limiterKey = normalizeEmail(email);
+        const sendResponse = () => {
+          let refreshed;
+          try {
+            refreshed = issueTwoFactorChallenge(email);
+          } catch {
+          }
+          return Response.json({
+            success: true,
+            message: "Si un compte existe, un code a \xE9t\xE9 envoy\xE9.",
+            ...refreshed ? { challenge: refreshed } : {}
+          });
+        };
         if (action === "send") {
-          if (await sendLimiter.check(email, req)) {
-            return Response.json(genericSendResponse);
+          if (!verifyTwoFactorChallenge(email, challenge)) {
+            return Response.json(
+              { error: "Authentification requise avant l'envoi d'un code." },
+              { status: 401 }
+            );
+          }
+          if (await sendLimiter.check(limiterKey, req)) {
+            return sendResponse();
           }
           const clients = await dbFind(payload, slugs.supportClients, {
             where: { email: { equals: email } },
@@ -5136,7 +5388,7 @@ function createAuth2faEndpoint(slugs, store) {
             overrideAccess: true
           });
           if (clients.docs.length === 0) {
-            return Response.json(genericSendResponse);
+            return sendResponse();
           }
           const client = clients.docs[0];
           const plainCode = generateSecureCode();
@@ -5161,13 +5413,19 @@ function createAuth2faEndpoint(slugs, store) {
               <p style="font-size: 13px; color: #6b7280;">Ce code est valable 10 minutes.</p>
             </div>`
           });
-          return Response.json(genericSendResponse);
+          return sendResponse();
         }
         if (action === "verify") {
+          if (!verifyTwoFactorChallenge(email, challenge)) {
+            return Response.json(
+              { error: "Authentification requise avant la v\xE9rification d'un code." },
+              { status: 401 }
+            );
+          }
           if (!code) {
             return Response.json({ error: "Code manquant" }, { status: 400 });
           }
-          if (await verifyLimiter.check(email, req)) {
+          if (await verifyLimiter.check(limiterKey, req)) {
             return Response.json(
               { error: "Trop de tentatives. R\xE9essayez dans 15 minutes." },
               { status: 429 }
@@ -5208,7 +5466,7 @@ function createAuth2faEndpoint(slugs, store) {
             data: { twoFactorCode: "", twoFactorExpiry: "", twoFactorVerifiedAt: (/* @__PURE__ */ new Date()).toISOString() },
             overrideAccess: true
           });
-          verifyLimiter.reset(email);
+          await verifyLimiter.reset(limiterKey, req);
           return Response.json({ success: true, verified: true });
         }
         return Response.json({ error: "Action invalide" }, { status: 400 });
@@ -5219,6 +5477,33 @@ function createAuth2faEndpoint(slugs, store) {
     }
   };
 }
+var OAUTH_STATE_COOKIE = "support-oauth-state";
+var OAUTH_STATE_MAX_AGE = 600;
+var TWO_FA_WINDOW_MS = 5 * 60 * 1e3;
+function readCookie(header, name) {
+  if (!header) return null;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    if (part.slice(0, eq).trim() !== name) continue;
+    try {
+      return decodeURIComponent(part.slice(eq + 1).trim());
+    } catch {
+      return part.slice(eq + 1).trim();
+    }
+  }
+  return null;
+}
+function clearedStateCookie() {
+  const secure = process.env.NODE_ENV === "production";
+  return `${OAUTH_STATE_COOKIE}=; HttpOnly; ${secure ? "Secure; " : ""}SameSite=Lax; Path=/; Max-Age=0`;
+}
+function statesMatch(a, b) {
+  if (!a || !b) return false;
+  const left = crypto3.createHash("sha256").update(a).digest();
+  const right = crypto3.createHash("sha256").update(b).digest();
+  return crypto3.timingSafeEqual(left, right);
+}
 function createOAuthGoogleEndpoint(slugs, options) {
   return {
     path: "/support/oauth/google",
@@ -5235,7 +5520,7 @@ function createOAuthGoogleEndpoint(slugs, options) {
       }
       try {
         const body = await req.json();
-        const { action, code, state: queryState, cookieState } = body;
+        const { action, code, state: queryState } = body;
         if (action === "login") {
           const oauthState = crypto3.randomBytes(32).toString("hex");
           const redirectUri = `${baseUrl}/api/support/oauth/google`;
@@ -5247,13 +5532,25 @@ function createOAuthGoogleEndpoint(slugs, options) {
             state: oauthState,
             prompt: "select_account"
           });
-          return Response.json({
-            url: `https://accounts.google.com/o/oauth2/v2/auth?${params}`,
-            state: oauthState
-          });
+          const secure = process.env.NODE_ENV === "production";
+          const loginHeaders = new Headers({ "Content-Type": "application/json" });
+          loginHeaders.append(
+            "Set-Cookie",
+            `${OAUTH_STATE_COOKIE}=${oauthState}; HttpOnly; ${secure ? "Secure; " : ""}SameSite=Lax; Path=/; Max-Age=${OAUTH_STATE_MAX_AGE}`
+          );
+          return new Response(
+            JSON.stringify({
+              url: `https://accounts.google.com/o/oauth2/v2/auth?${params}`,
+              // Kept for callers that echo it back in the redirect URL; the
+              // server no longer trusts anything the caller returns.
+              state: oauthState
+            }),
+            { status: 200, headers: loginHeaders }
+          );
         }
         if (code) {
-          if (!cookieState || !queryState || cookieState !== queryState) {
+          const issuedState = readCookie(req.headers.get("cookie"), OAUTH_STATE_COOKIE);
+          if (!statesMatch(issuedState, queryState)) {
             return Response.json({ error: "state_mismatch" }, { status: 400 });
           }
           const redirectUri = `${baseUrl}/api/support/oauth/google`;
@@ -5335,6 +5632,35 @@ function createOAuthGoogleEndpoint(slugs, options) {
               overrideAccess: true
             });
           }
+          const twoFactorDoc = await dbFindByID(payload, slugs.supportClients, {
+            id: clientDoc.id,
+            depth: 0,
+            overrideAccess: true,
+            showHiddenFields: true
+          });
+          if (twoFactorDoc?.twoFactorEnabled) {
+            const raw = twoFactorDoc.twoFactorVerifiedAt;
+            const verifiedAt = raw ? new Date(raw).getTime() : 0;
+            if (!(verifiedAt > Date.now() - TWO_FA_WINDOW_MS)) {
+              let challenge;
+              try {
+                challenge = issueTwoFactorChallenge(clientDoc.email);
+              } catch {
+              }
+              return new Response(JSON.stringify({ requires2FA: true, ...challenge ? { challenge } : {} }), {
+                status: 200,
+                headers: new Headers({
+                  "Content-Type": "application/json",
+                  "Set-Cookie": clearedStateCookie()
+                })
+              });
+            }
+            await dbUpdate(payload, slugs.supportClients, {
+              id: clientDoc.id,
+              data: { twoFactorVerifiedAt: null },
+              overrideAccess: true
+            });
+          }
           const secret = process.env.PAYLOAD_SECRET;
           if (!secret) {
             return Response.json({ error: "server_misconfigured" }, { status: 500 });
@@ -5378,6 +5704,7 @@ function createOAuthGoogleEndpoint(slugs, options) {
             "Set-Cookie",
             `payload-token=${token}; HttpOnly; ${cookieSecure ? "Secure; " : ""}SameSite=Lax; Path=/; Max-Age=${tokenExpiration}`
           );
+          headers.append("Set-Cookie", clearedStateCookie());
           return new Response(JSON.stringify({ user: clientDoc, exp }), {
             status: 200,
             headers
@@ -5684,7 +6011,7 @@ ONLY JSON, nothing else.`
   }
 }
 function createImportConversationEndpoint(slugs, store) {
-  const importLimiter = new RateLimiter(36e5, 10, store);
+  const importLimiter = new RateLimiter(36e5, 10, store, "import-conversation");
   return {
     path: "/support/import-conversation",
     method: "post",
@@ -5701,7 +6028,7 @@ function createImportConversationEndpoint(slugs, store) {
         if (!isAuthed) {
           return Response.json({ error: "Unauthorized" }, { status: 401 });
         }
-        const ip = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || "unknown";
+        const ip = clientIpRateKey(req);
         if (await importLimiter.check(ip, req)) {
           return Response.json({ error: "Rate limit exceeded. Maximum 10 imports per hour." }, { status: 429 });
         }
@@ -5827,6 +6154,152 @@ function createImportConversationEndpoint(slugs, store) {
     }
   };
 }
+function httpAllowed() {
+  return process.env.SUPPORT_ALLOW_INSECURE_WEBHOOKS === "1";
+}
+var BLOCKED_HOST_SUFFIXES = [".local", ".localhost", ".internal", ".home.arpa"];
+function parseIPv4(host) {
+  const parts = host.split(".");
+  if (parts.length !== 4) return null;
+  const octets = [];
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part)) return null;
+    const n = Number(part);
+    if (n > 255) return null;
+    octets.push(n);
+  }
+  return octets;
+}
+function isPrivateIPv4(octets) {
+  const [a, b] = octets;
+  if (a === 0) return true;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 192 && b === 0) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a >= 224) return true;
+  return false;
+}
+function isPrivateIPv6(host) {
+  const lower = host.toLowerCase();
+  if (lower === "::" || lower === "::1") return true;
+  if (lower.startsWith("fe8") || lower.startsWith("fe9") || lower.startsWith("fea") || lower.startsWith("feb")) return true;
+  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
+  if (lower.startsWith("ff")) return true;
+  const dotted = lower.match(/^::(?:ffff:)?(\d{1,3}(?:\.\d{1,3}){3})$/);
+  if (dotted) {
+    const octets = parseIPv4(dotted[1]);
+    return octets ? isPrivateIPv4(octets) : true;
+  }
+  const hex = lower.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+  if (hex) {
+    const high = parseInt(hex[1], 16);
+    const low = parseInt(hex[2], 16);
+    return isPrivateIPv4([high >> 8, high & 255, low >> 8, low & 255]);
+  }
+  return false;
+}
+function normalizeHost(hostname) {
+  const host = hostname.trim().toLowerCase();
+  return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+}
+function isBlockedHost(hostname) {
+  const host = normalizeHost(hostname);
+  if (!host) return true;
+  if (host === "localhost") return true;
+  if (BLOCKED_HOST_SUFFIXES.some((suffix) => host.endsWith(suffix))) return true;
+  const v4 = parseIPv4(host);
+  if (v4) return isPrivateIPv4(v4);
+  if (host.includes(":")) return isPrivateIPv6(host);
+  return false;
+}
+function validateWebhookUrl(raw) {
+  if (typeof raw !== "string" || !raw.trim()) return { ok: false, reason: "invalid_url" };
+  let url;
+  try {
+    url = new URL(raw.trim());
+  } catch {
+    return { ok: false, reason: "invalid_url" };
+  }
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && httpAllowed())) {
+    return { ok: false, reason: "scheme_not_allowed" };
+  }
+  if (isBlockedHost(url.hostname)) return { ok: false, reason: "private_host" };
+  return { ok: true, url };
+}
+var WEBHOOK_URL_MESSAGES = {
+  invalid_url: "URL invalide.",
+  scheme_not_allowed: "Seules les URL https:// sont accept\xE9es.",
+  private_host: "Les adresses priv\xE9es, loopback et link-local sont interdites (SSRF)."
+};
+var MAX_PUSH_ENDPOINT_LENGTH = 2048;
+function validatePushEndpoint(raw) {
+  if (typeof raw !== "string" || !raw.trim() || raw.length > MAX_PUSH_ENDPOINT_LENGTH) {
+    return { ok: false, reason: "invalid_url" };
+  }
+  let url;
+  try {
+    url = new URL(raw.trim());
+  } catch {
+    return { ok: false, reason: "invalid_url" };
+  }
+  if (url.protocol !== "https:") return { ok: false, reason: "scheme_not_allowed" };
+  if (isBlockedHost(url.hostname)) return { ok: false, reason: "private_host" };
+  return { ok: true, url };
+}
+var LOOKUP_TIMEOUT_MS = 5e3;
+var LOOKUP_TIMED_OUT = /* @__PURE__ */ Symbol("lookup-timed-out");
+var NONEXISTENT_HOST_CODES = /* @__PURE__ */ new Set(["ENOTFOUND", "ENODATA", "NOTFOUND"]);
+async function assertPublicHost(hostname) {
+  const host = normalizeHost(hostname);
+  if (isBlockedHost(host)) return false;
+  if (parseIPv4(host) || host.includes(":")) return true;
+  try {
+    const addresses = await Promise.race([
+      lookup(host, { all: true }),
+      new Promise(
+        (resolve) => setTimeout(() => resolve(LOOKUP_TIMED_OUT), LOOKUP_TIMEOUT_MS).unref?.()
+      )
+    ]);
+    if (addresses === LOOKUP_TIMED_OUT) return false;
+    if (!Array.isArray(addresses) || addresses.length === 0) return false;
+    return addresses.every((entry) => !isBlockedHost(entry.address));
+  } catch (error) {
+    const code = error?.code;
+    return typeof code === "string" && NONEXISTENT_HOST_CODES.has(code);
+  }
+}
+var BlockedRequestError = class extends Error {
+  constructor(reason) {
+    super(`Blocked outbound request: ${reason}`);
+    this.reason = reason;
+    this.name = "BlockedRequestError";
+  }
+  reason;
+};
+var MAX_REDIRECTS = 3;
+async function safeFetch(rawUrl, init) {
+  let current = rawUrl;
+  let body = init.body;
+  for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+    const validation = validateWebhookUrl(current);
+    if (!validation.ok || !validation.url) throw new BlockedRequestError(validation.reason || "invalid_url");
+    if (!await assertPublicHost(validation.url.hostname)) throw new BlockedRequestError("private_host");
+    const response = await fetch(current, { ...init, body, redirect: "manual" });
+    if (response.status < 300 || response.status > 399) return response;
+    const location = response.headers.get("location");
+    if (!location) return response;
+    current = new URL(location, current).toString();
+    if (response.status === 303) body = void 0;
+  }
+  throw new BlockedRequestError("too_many_redirects");
+}
+
+// src/utils/webhookDispatcher.ts
 function dispatchWebhook(data, event, payload, slugs) {
   const done = _dispatch(data, event, payload, slugs);
   return done;
@@ -5863,7 +6336,7 @@ async function _sendToEndpoint(endpoint, body, payload, slugs) {
       const signature = crypto3.createHmac("sha256", endpoint.secret).update(body).digest("hex");
       headers["X-Webhook-Signature"] = signature;
     }
-    const response = await fetch(endpoint.url, {
+    const response = await safeFetch(endpoint.url, {
       method: "POST",
       headers,
       body,
@@ -6233,6 +6706,15 @@ async function sendPushToUser(payload, slugs, userId, notification) {
     for (const s of subs.docs) {
       const row = s;
       if (!row.endpoint || !row.p256dh || !row.auth) continue;
+      const check = validatePushEndpoint(row.endpoint);
+      if (!check.ok || !check.url) {
+        console.warn("[support] Push endpoint refused (unsafe URL):", check.reason);
+        continue;
+      }
+      if (!await assertPublicHost(check.url.hostname)) {
+        console.warn("[support] Push endpoint refused (host resolves to a private address)");
+        continue;
+      }
       try {
         await webpush.sendNotification(
           { endpoint: row.endpoint, keys: { p256dh: row.p256dh, auth: row.auth } },
@@ -6283,7 +6765,14 @@ function createPushSubscribeEndpoint(slugs) {
         if (!endpoint || !p256dh || !auth) {
           return Response.json({ error: "subscription invalide (endpoint + keys requis)." }, { status: 400 });
         }
-        const data = { user: req.user.id, endpoint, p256dh, auth, userAgent: req.headers.get("user-agent") || "" };
+        const endpointCheck = validatePushEndpoint(endpoint);
+        if (!endpointCheck.ok) {
+          return Response.json(
+            { error: WEBHOOK_URL_MESSAGES[endpointCheck.reason || "invalid_url"] },
+            { status: 400 }
+          );
+        }
+        const data = { user: req.user.id, endpoint, p256dh, auth, userAgent: (req.headers.get("user-agent") || "").slice(0, 256) };
         const existing = await dbFind(req.payload, slugs.pushSubscriptions, { where: { endpoint: { equals: endpoint } }, limit: 1, depth: 0, overrideAccess: true });
         if (existing.docs.length > 0) {
           await dbUpdate(req.payload, slugs.pushSubscriptions, { id: existing.docs[0].id, data, overrideAccess: true });
@@ -6317,7 +6806,7 @@ function createUserPrefsGetEndpoint(slugs) {
         requireAdmin(req, slugs);
         const key = `${PREF_KEY_PREFIX}-${req.user.id}`;
         const prefs = await dbFind(payload, "payload-preferences", {
-          where: { key: { equals: key } },
+          where: { key: { equals: key }, "user.relationTo": { equals: slugs.users } },
           limit: 1,
           depth: 0,
           overrideAccess: true
@@ -6351,7 +6840,7 @@ function createUserPrefsPostEndpoint(slugs) {
         const body = await req.json();
         const key = `${PREF_KEY_PREFIX}-${req.user.id}`;
         const existing = await dbFind(payload, "payload-preferences", {
-          where: { key: { equals: key } },
+          where: { key: { equals: key }, "user.relationTo": { equals: slugs.users } },
           limit: 1,
           depth: 0,
           overrideAccess: true
@@ -6507,8 +6996,10 @@ function createTicketFeedbackEndpoint(slugs) {
 // src/endpoints/transfer-ticket.ts
 var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 var MAX_TRANSFERS_PER_DAY = 5;
+var MAX_TRANSFERS_PER_USER_PER_DAY = 15;
 function createTransferTicketEndpoint(slugs, store) {
-  const transferLimiter = new RateLimiter(24 * 60 * 60 * 1e3, MAX_TRANSFERS_PER_DAY, store);
+  const transferLimiter = new RateLimiter(24 * 60 * 60 * 1e3, MAX_TRANSFERS_PER_DAY, store, "transfer:ticket");
+  const transferUserLimiter = new RateLimiter(24 * 60 * 60 * 1e3, MAX_TRANSFERS_PER_USER_PER_DAY, store, "transfer:user");
   return {
     path: "/support/tickets/:id/transfer",
     method: "post",
@@ -6543,12 +7034,18 @@ function createTransferTicketEndpoint(slugs, store) {
         if (!isAdmin && !isOwner) {
           return Response.json({ error: "Forbidden" }, { status: 403 });
         }
-        if (await transferLimiter.check(`${req.user.id}:${ticketId}`, req)) {
+        if (await transferLimiter.check(`${principalRateKey(req.user)}:${ticketId}`, req)) {
           return Response.json(
             { error: `Limite atteinte (${MAX_TRANSFERS_PER_DAY} transferts par 24h sur ce ticket)` },
             { status: 429 }
           );
         }
+        if (!isAdmin && await transferUserLimiter.check(principalRateKey(req.user), req)) {
+          return Response.json(
+            { error: `Limite atteinte (${MAX_TRANSFERS_PER_USER_PER_DAY} transferts par 24h)` },
+            { status: 429 }
+          );
+        }
         try {
           const since = new Date(Date.now() - 24 * 60 * 60 * 1e3).toISOString();
           const existing = await dbCount(payload, slugs.emailLogs, {
@@ -6690,8 +7187,11 @@ function statusToLabel(status) {
 }
 var EMAIL_RE2 = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 var MAX_COLLABORATORS_PER_TICKET = 20;
+var MAX_NEW_ACCOUNTS_PER_INVITER = 30;
+var NEW_ACCOUNT_WINDOW_MS = 7 * 24 * 60 * 60 * 1e3;
 function createInviteCollaboratorEndpoint(slugs, store) {
-  const inviteLimiter = new RateLimiter(60 * 60 * 1e3, 10, store);
+  const inviteLimiter = new RateLimiter(60 * 60 * 1e3, 10, store, "invite-collaborator");
+  const newAccountLimiter = new RateLimiter(NEW_ACCOUNT_WINDOW_MS, MAX_NEW_ACCOUNTS_PER_INVITER, store, "invite-collaborator:new-account");
   return {
     path: "/support/tickets/:id/invite",
     method: "post",
@@ -6726,7 +7226,7 @@ function createInviteCollaboratorEndpoint(slugs, store) {
         if (!isAdmin && !isOwner) {
           return Response.json({ error: "Forbidden" }, { status: 403 });
         }
-        if (await inviteLimiter.check(String(req.user.id), req)) {
+        if (await inviteLimiter.check(principalRateKey(req.user), req)) {
           return Response.json({ error: "Trop d'invitations. R\xE9essayez plus tard." }, { status: 429 });
         }
         const collabCount = await dbCount(payload, "ticket-collaborators", { where: { ticket: { equals: ticketId } }, overrideAccess: true }).catch(() => ({ totalDocs: 0 }));
@@ -6750,6 +7250,12 @@ function createInviteCollaboratorEndpoint(slugs, store) {
         if (existing.docs.length > 0) {
           inviteeId = existing.docs[0].id;
         } else {
+          if (!isAdmin && await newAccountLimiter.check(principalRateKey(req.user), req)) {
+            return Response.json(
+              { error: "Trop de nouveaux comptes invit\xE9s. R\xE9essayez plus tard." },
+              { status: 429 }
+            );
+          }
           const tempPassword = randomBytes(16).toString("hex");
           const created = await dbCreate(payload, slugs.supportClients, {
             data: {
@@ -6921,7 +7427,7 @@ function createSupportEndpoints(slugs, options) {
   }
   if (!f || f.satisfaction !== false) endpoints.push(createSatisfactionEndpoint(slugs));
   if (!f || f.emailTracking !== false) {
-    endpoints.push(createEmailStatsEndpoint(slugs), createTrackOpenEndpoint(slugs));
+    endpoints.push(createEmailStatsEndpoint(slugs, rateLimitStore), createTrackOpenEndpoint(slugs));
   }
   if (!f || f.pendingEmails !== false) endpoints.push(createPendingEmailsProcessEndpoint(slugs));
   if (!f || f.scheduledReplies !== false) endpoints.push(createProcessScheduledEndpoint(slugs));
@@ -8406,7 +8912,7 @@ function createTicketsCollection(slugs, options) {
 }
 
 // src/utils/ticketAccess.ts
-async function resolveAccessibleTicketIds(payload, slugs, clientId) {
+async function resolveAccessibleTicketIds(payload, slugs, clientId, mode = "read") {
   const ids = /* @__PURE__ */ new Set();
   try {
     const owned = await dbFind(payload, slugs.tickets, {
@@ -8427,6 +8933,7 @@ async function resolveAccessibleTicketIds(payload, slugs, clientId) {
     });
     for (const r of collab.docs) {
       const row = r;
+      if (mode === "write" && row.role !== "collaborator") continue;
       const tid = typeof row.ticket === "object" ? row.ticket?.id : row.ticket;
       if (tid !== void 0 && tid !== null) ids.add(tid);
     }
@@ -8533,7 +9040,7 @@ function createRestrictClientTicketTarget(slugs) {
     if (targetId === void 0 || targetId === null || targetId === "") {
       throw new APIError("Ticket cible requis.", 400);
     }
-    const accessible = await resolveAccessibleTicketIds(req.payload, slugs, req.user.id);
+    const accessible = await resolveAccessibleTicketIds(req.payload, slugs, req.user.id, "write");
     if (!accessible.some((id) => String(id) === String(targetId))) {
       throw new APIError("Ticket inaccessible.", 403);
     }
@@ -9050,13 +9557,13 @@ function createSendInvitationOnCreate(slugs) {
     return doc;
   };
 }
-var TWO_FA_WINDOW_MS = 5 * 60 * 1e3;
+var TWO_FA_WINDOW_MS2 = 5 * 60 * 1e3;
 function createEnforce2FA(slugs) {
   return async ({ req, user }) => {
     if (!user?.twoFactorEnabled) return user;
     const raw = user.twoFactorVerifiedAt;
     const verifiedAt = raw ? new Date(raw).getTime() : 0;
-    if (!(verifiedAt > Date.now() - TWO_FA_WINDOW_MS)) {
+    if (!(verifiedAt > Date.now() - TWO_FA_WINDOW_MS2)) {
       throw new APIError("2FA_REQUIRED", 401);
     }
     await req.payload.update({
@@ -9897,8 +10404,28 @@ function createKnowledgeBaseCollection(slugs) {
     timestamps: true
   };
 }
-
-// src/collections/ChatMessages.ts
+function createRestrictClientChatWrite(slugs) {
+  return async ({ data, req }) => {
+    if (req.user?.collection !== slugs.supportClients) return data;
+    data.client = req.user.id;
+    data.senderType = "client";
+    delete data.agent;
+    const session = typeof data.session === "string" ? data.session : null;
+    if (!session) return data;
+    const existing = await dbFind(req.payload, slugs.chatMessages, {
+      where: { session: { equals: session } },
+      limit: 1,
+      depth: 0,
+      overrideAccess: true
+    });
+    const owner = existing.docs[0]?.client;
+    const ownerId = owner && typeof owner === "object" ? owner.id : owner;
+    if (ownerId !== void 0 && ownerId !== null && String(ownerId) !== String(req.user.id)) {
+      throw new APIError("Session inaccessible.", 403);
+    }
+    return data;
+  };
+}
 function createChatMessagesCollection(slugs) {
   return {
     slug: slugs.chatMessages,
@@ -9920,7 +10447,9 @@ function createChatMessagesCollection(slugs) {
         }
         return false;
       },
-      create: ({ req }) => !!req.user,
+      // Staff and support-clients only — NOT "any authenticated principal":
+      // a user of any other auth collection of the host app satisfied `!!req.user`.
+      create: ({ req }) => req.user?.collection === slugs.users || req.user?.collection === slugs.supportClients,
       update: ({ req }) => req.user?.collection === slugs.users,
       delete: ({ req }) => req.user?.collection === slugs.users
     },
@@ -9989,6 +10518,9 @@ function createChatMessagesCollection(slugs) {
         }
       }
     ],
+    hooks: {
+      beforeChange: [createRestrictClientChatWrite(slugs)]
+    },
     timestamps: true
   };
 }
@@ -10266,8 +10798,19 @@ function createAuthLogsCollection(slugs) {
     timestamps: true
   };
 }
-
-// src/collections/WebhookEndpoints.ts
+function createValidateWebhookUrl() {
+  return ({ data, operation, originalDoc }) => {
+    const incoming = data?.url;
+    if (incoming === void 0 || incoming === null) return data;
+    const previous = originalDoc?.url;
+    if (operation === "update" && incoming === previous) return data;
+    const result = validateWebhookUrl(incoming);
+    if (!result.ok) {
+      throw new APIError(WEBHOOK_URL_MESSAGES[result.reason || "invalid_url"], 400);
+    }
+    return data;
+  };
+}
 function createWebhookEndpointsCollection(slugs) {
   return {
     slug: slugs.webhookEndpoints,
@@ -10301,8 +10844,11 @@ function createWebhookEndpointsCollection(slugs) {
         type: "text",
         required: true,
         label: "URL",
+        // The SSRF check lives in the collection `beforeValidate` above, NOT in a
+        // field `validate`: the latter re-runs on the merged document and would
+        // freeze every pre-existing row on any unrelated edit.
         admin: {
-          description: "URL du webhook \xE0 appeler (POST)"
+          description: "URL https:// du webhook \xE0 appeler (POST). Les adresses priv\xE9es et loopback sont refus\xE9es."
         }
       },
       {
@@ -10356,6 +10902,9 @@ function createWebhookEndpointsCollection(slugs) {
         }
       }
     ],
+    hooks: {
+      beforeValidate: [createValidateWebhookUrl()]
+    },
     timestamps: true
   };
 }
@@ -10807,11 +11356,17 @@ function createClientSummariesCollection(slugs) {
         admin: { readOnly: true }
       }
     ],
+    // Staff-only, on the SAME source of truth as every other collection and as
+    // `requireAdmin`: `slugs.users`. The literal `'users'` this used to compare
+    // against is the DEFAULT slug, not the configured one — on a host app whose
+    // staff collection is renamed (`collectionSlugs.users: 'admins'`) it named
+    // the front-office collection instead, opening read/create/update/delete on
+    // AI-generated client intelligence to it while locking the real agents out.
     access: {
-      create: ({ req }) => req.user?.collection === "users",
-      read: ({ req }) => req.user?.collection === "users",
-      update: ({ req }) => req.user?.collection === "users",
-      delete: ({ req }) => req.user?.collection === "users"
+      create: ({ req }) => req.user?.collection === slugs.users,
+      read: ({ req }) => req.user?.collection === slugs.users,
+      update: ({ req }) => req.user?.collection === slugs.users,
+      delete: ({ req }) => req.user?.collection === slugs.users
     },
     timestamps: true
   };
@@ -11275,6 +11830,17 @@ function supportPlugin(config) {
     });
     return {
       ...incomingConfig,
+      // Publish the resolved staff collection so the server-side readers share
+      // ONE source of truth with the writers. `requireAdmin` compares against
+      // `slugs.users`; the `payload-preferences` reads used to scope themselves
+      // on `config.admin.user`, which Payload silently defaults to the first
+      // auth collection of the host app — a different collection on any app
+      // that declares `collectionSlugs.users`, and the settings-poisoning hole
+      // reopened right there.
+      custom: {
+        ...incomingConfig.custom,
+        [SUPPORT_STAFF_SLUG_CONFIG_KEY]: slugs.users
+      },
       collections: config?.skipCollections ? existingCollections : [...existingCollections, ...supportCollections],
       endpoints: config?.skipEndpoints ? existingEndpoints : [...existingEndpoints, ...supportEndpoints],
       admin: {