@consilioweb/payload-support 3.0.0 → 5.0.0

package/src/collections/ChatMessages.ts

@@ -1,5 +1,56 @@
-import type { CollectionConfig } from 'payload'
+import { APIError } from 'payload'
+import type { CollectionBeforeChangeHook, CollectionConfig } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
+import { dbFind } from '../utils/db'
+
+/**
+ * Cross-tenant write guard for support-clients.
+ *
+ * `access.create` used to be `!!req.user`, which any principal of ANY auth
+ * collection satisfies — including a front-office member of the host app. With
+ * no hook validating the row, an attacker could POST a message attributed to
+ * someone else's `client` and flagged `senderType: 'agent'` with an arbitrary
+ * `agent` relation: the agent console and the targeted client both render it as
+ * a genuine conversation (phishing over a trusted channel).
+ *
+ * Mirrors `createRestrictClientTicketTarget` on ticket-messages: the client's
+ * own identity is FORCED onto the row instead of being trusted from the body.
+ * Internal writers (endpoints/chat.ts, endpoints/admin-chat.ts,
+ * collections/TicketMessages.ts) all write with `overrideAccess: true` and carry
+ * no support-client user, so they are untouched.
+ */
+function createRestrictClientChatWrite(slugs: CollectionSlugs): CollectionBeforeChangeHook {
+  return async ({ data, req }) => {
+    if (req.user?.collection !== slugs.supportClients) return data
+    data.client = req.user.id
+    data.senderType = 'client'
+    delete data.agent
+
+    // …and the SESSION has to be theirs too. Forcing `client` alone still let a
+    // client drop a line INTO someone else's conversation: the agent console
+    // loads a thread by session id with `overrideAccess: true`
+    // (endpoints/admin-chat.ts), so the injected message surfaces in the target's
+    // thread even though `access.read` hides it from the target themselves.
+    // Session ids are 16 random bytes, so this is depth rather than a reachable
+    // hole — and it costs one indexed lookup on a path no internal writer takes
+    // (chat.ts / admin-chat.ts write without a support-client `req`).
+    const session = typeof data.session === 'string' ? data.session : null
+    if (!session) return data
+
+    const existing = await dbFind(req.payload, slugs.chatMessages, {
+      where: { session: { equals: session } },
+      limit: 1,
+      depth: 0,
+      overrideAccess: true,
+    })
+    const owner = existing.docs[0]?.client
+    const ownerId = owner && typeof owner === 'object' ? (owner as { id?: unknown }).id : owner
+    if (ownerId !== undefined && ownerId !== null && String(ownerId) !== String(req.user.id)) {
+      throw new APIError('Session inaccessible.', 403)
+    }
+    return data
+  }
+}
 
 // ─── Collection factory ──────────────────────────────────
 
@@ -24,7 +75,10 @@ export function createChatMessagesCollection(slugs: CollectionSlugs): Collection
         }
         return false
       },
-      create: ({ req }) => !!req.user,
+      // Staff and support-clients only — NOT "any authenticated principal":
+      // a user of any other auth collection of the host app satisfied `!!req.user`.
+      create: ({ req }) =>
+        req.user?.collection === slugs.users || req.user?.collection === slugs.supportClients,
       update: ({ req }) => req.user?.collection === slugs.users,
       delete: ({ req }) => req.user?.collection === slugs.users,
     },
@@ -93,6 +147,9 @@ export function createChatMessagesCollection(slugs: CollectionSlugs): Collection
         },
       },
     ],
+    hooks: {
+      beforeChange: [createRestrictClientChatWrite(slugs)],
+    },
     timestamps: true,
   }
 }

package/src/collections/ClientSummaries.ts

@@ -122,11 +122,17 @@ export function createClientSummariesCollection(slugs: CollectionSlugs): Collect
         admin: { readOnly: true },
       },
     ],
+    // Staff-only, on the SAME source of truth as every other collection and as
+    // `requireAdmin`: `slugs.users`. The literal `'users'` this used to compare
+    // against is the DEFAULT slug, not the configured one — on a host app whose
+    // staff collection is renamed (`collectionSlugs.users: 'admins'`) it named
+    // the front-office collection instead, opening read/create/update/delete on
+    // AI-generated client intelligence to it while locking the real agents out.
     access: {
-      create: ({ req }) => req.user?.collection === 'users',
-      read: ({ req }) => req.user?.collection === 'users',
-      update: ({ req }) => req.user?.collection === 'users',
-      delete: ({ req }) => req.user?.collection === 'users',
+      create: ({ req }) => req.user?.collection === slugs.users,
+      read: ({ req }) => req.user?.collection === slugs.users,
+      update: ({ req }) => req.user?.collection === slugs.users,
+      delete: ({ req }) => req.user?.collection === slugs.users,
     },
     timestamps: true,
   }

package/src/collections/TicketMessages.ts

@@ -37,7 +37,10 @@ function createRestrictClientTicketTarget(slugs: CollectionSlugs): CollectionBef
       throw new APIError('Ticket cible requis.', 400)
     }
 
-    const accessible = await resolveAccessibleTicketIds(req.payload, slugs, req.user.id)
+    // 'write' scope: a collaborator invited as `viewer` may READ the thread but
+    // must not post into it — the invitation email promises exactly that, and a
+    // message from a viewer would fan out the whole notification chain.
+    const accessible = await resolveAccessibleTicketIds(req.payload, slugs, req.user.id, 'write')
     if (!accessible.some((id) => String(id) === String(targetId))) {
       throw new APIError('Ticket inaccessible.', 403)
     }

package/src/collections/WebhookEndpoints.ts

@@ -1,5 +1,41 @@
-import type { CollectionConfig } from 'payload'
+import { APIError } from 'payload'
+import type { CollectionBeforeValidateHook, CollectionConfig } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
+import { WEBHOOK_URL_MESSAGES, validateWebhookUrl } from '../utils/urlSafety'
+
+/**
+ * First SSRF layer: the value is fetched by the SERVER on every ticket event, so
+ * a loopback / private / link-local target (or a non-https scheme) must never be
+ * SAVED. The send path re-checks the resolved address and every redirect hop —
+ * see `utils/urlSafety.ts`.
+ *
+ * Why a collection hook rather than a field `validate`: Payload re-validates the
+ * MERGED document on every write, so a field-level guard also fires on partial
+ * updates that never mention `url`. A row saved before this guard existed (or
+ * seeded through `payload.db`, which runs no hooks) then became totally
+ * immutable — impossible to rename, to re-scope its events, even to set
+ * `active: false` — and the dispatcher's own bookkeeping write (`lastStatus: 0`,
+ * issued inside a `catch` that swallows errors) failed silently, leaving a dead
+ * endpoint looking healthy in the admin.
+ *
+ * So only a URL actually being SET or CHANGED is checked. Leaving an existing
+ * bad value alone costs nothing: the send path refuses to call it anyway.
+ */
+function createValidateWebhookUrl(): CollectionBeforeValidateHook {
+  return ({ data, operation, originalDoc }) => {
+    const incoming = (data as { url?: unknown } | undefined)?.url
+    if (incoming === undefined || incoming === null) return data
+
+    const previous = (originalDoc as { url?: unknown } | undefined)?.url
+    if (operation === 'update' && incoming === previous) return data
+
+    const result = validateWebhookUrl(incoming)
+    if (!result.ok) {
+      throw new APIError(WEBHOOK_URL_MESSAGES[result.reason || 'invalid_url'], 400)
+    }
+    return data
+  }
+}
 
 // ─── Collection factory ──────────────────────────────────
 
@@ -36,8 +72,11 @@ export function createWebhookEndpointsCollection(slugs: CollectionSlugs): Collec
         type: 'text',
         required: true,
         label: 'URL',
+        // The SSRF check lives in the collection `beforeValidate` above, NOT in a
+        // field `validate`: the latter re-runs on the merged document and would
+        // freeze every pre-existing row on any unrelated edit.
         admin: {
-          description: 'URL du webhook à appeler (POST)',
+          description: 'URL https:// du webhook à appeler (POST). Les adresses privées et loopback sont refusées.',
         },
       },
       {
@@ -91,6 +130,9 @@ export function createWebhookEndpointsCollection(slugs: CollectionSlugs): Collec
         },
       },
     ],
+    hooks: {
+      beforeValidate: [createValidateWebhookUrl()],
+    },
     timestamps: true,
   }
 }

package/src/endpoints/admin-chat.ts

@@ -1,7 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { Where } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { dbFind, dbCreate, dbUpdate } from '../utils/db'
 
@@ -111,7 +111,7 @@ export function createAdminChatGetEndpoint(slugs: CollectionSlugs): Endpoint {
  * Admin sends a message or closes a session.
  */
 export function createAdminChatPostEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const adminChatLimiter = new RateLimiter(60_000, 30, store)
+  const adminChatLimiter = new RateLimiter(60_000, 30, store, 'admin-chat')
   return {
     path: '/support/admin-chat',
     method: 'post',
@@ -150,7 +150,7 @@ export function createAdminChatPostEndpoint(slugs: CollectionSlugs, store?: Rate
 
         // Agent sends a message
         if (action === 'send' && message) {
-          if (await adminChatLimiter.check(String(req.user.id), req)) {
+          if (await adminChatLimiter.check(principalRateKey(req.user), req)) {
             return Response.json({ error: 'Rate limit atteint.' }, { status: 429 })
           }
 

package/src/endpoints/ai-agent.ts

@@ -2,7 +2,7 @@ import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { runAiAgent } from '../utils/aiAgent'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 
 /**
  * POST /api/support/ai-agent   body: { ticketId, confidenceThreshold? }
@@ -11,14 +11,14 @@ import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
  * (when confident) or escalates to a human with an internal note. Admin-only.
  */
 export function createAiAgentEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const limiter = new RateLimiter(60_000, 10, store)
+  const limiter = new RateLimiter(60_000, 10, store, 'ai-agent')
   return {
     path: '/support/ai-agent',
     method: 'post',
     handler: async (req) => {
       try {
         requireAdmin(req, slugs)
-        if (await limiter.check(String(req.user!.id), req)) {
+        if (await limiter.check(principalRateKey(req.user), req)) {
           return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
         }
         let body: { ticketId?: number | string; confidenceThreshold?: number } = {}

package/src/endpoints/ai.ts

@@ -2,7 +2,7 @@ import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { readSupportSettings, type SupportSettings } from '../utils/readSettings'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { resolveOllamaBaseUrl } from '../utils/aiProvider'
 
 async function getClient(aiSettings: SupportSettings['ai']) {
@@ -26,7 +26,7 @@ type AiAction = 'sentiment' | 'synthesis' | 'suggest_reply' | 'rewrite'
  * Admin-only endpoint for AI features in support.
  */
 export function createAiEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const limiter = new RateLimiter(60_000, 30, store)
+  const limiter = new RateLimiter(60_000, 30, store, 'ai')
   return {
     path: '/support/ai',
     method: 'post',
@@ -35,7 +35,7 @@ export function createAiEndpoint(slugs: CollectionSlugs, store?: RateLimitStore)
         const payload = req.payload
 
         requireAdmin(req, slugs)
-        if (await limiter.check(String(req.user!.id), req)) {
+        if (await limiter.check(principalRateKey(req.user), req)) {
           return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
         }
 

package/src/endpoints/auth-2fa.ts

@@ -4,6 +4,7 @@ import crypto, { createHmac } from 'crypto'
 import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { escapeHtml } from '../utils/emailTemplate'
 import { dbFind, dbUpdate } from '../utils/db'
+import { issueTwoFactorChallenge, normalizeEmail, verifyTwoFactorChallenge } from '../utils/twoFactorChallenge'
 
 function generateSecureCode(): string {
   const buf = crypto.randomBytes(4)
@@ -25,31 +26,70 @@ function hashCode(code: string): string {
  * Send or verify a 2FA code.
  */
 export function createAuth2faEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const sendLimiter = new RateLimiter(60 * 60 * 1000, 3, store)
-  const verifyLimiter = new RateLimiter(15 * 60 * 1000, 5, store)
+  const sendLimiter = new RateLimiter(60 * 60 * 1000, 3, store, '2fa:send')
+  const verifyLimiter = new RateLimiter(15 * 60 * 1000, 5, store, '2fa:verify')
   return {
     path: '/support/2fa',
     method: 'post',
     handler: async (req) => {
       try {
         const payload = req.payload
-        let body: { action?: string; email?: string; code?: string }
+        let body: { action?: string; email?: string; code?: string; challenge?: string }
         try {
           body = await req.json!()
         } catch {
           return Response.json({ error: 'Invalid JSON body' }, { status: 400 })
         }
-        const { action, email, code } = body
+        const { action, email, code, challenge } = body
 
         if (!action || !email) {
           return Response.json({ error: 'Paramètres manquants' }, { status: 400 })
         }
 
-        const genericSendResponse = { success: true, message: 'Si un compte existe, un code a été envoyé.' }
+        // Both limiters are keyed on the SAME normalized address the challenge is
+        // signed over. Keyed on the raw input, one challenge bought one budget per
+        // casing variant of the address it was minted for.
+        const limiterKey = normalizeEmail(email)
+
+        /**
+         * A challenge is a 10-minute proof that the password step succeeded. It
+         * is refreshed on every accepted `send` so it outlives exactly as long as
+         * the code that send just minted: without this, a resend late in the
+         * window produced a code whose challenge expired before the user could
+         * type it, and `verify` answered 401 on a perfectly valid code.
+         *
+         * Returned on EVERY `send` reply, including the throttled and the
+         * unknown-address ones, so the response shape never tells the caller
+         * whether the account exists.
+         */
+        const sendResponse = (): Response => {
+          let refreshed: string | undefined
+          try {
+            refreshed = issueTwoFactorChallenge(email)
+          } catch {
+            // PAYLOAD_SECRET vanished mid-flight: answer without a challenge.
+          }
+          return Response.json({
+            success: true,
+            message: 'Si un compte existe, un code a été envoyé.',
+            ...(refreshed ? { challenge: refreshed } : {}),
+          })
+        }
 
         if (action === 'send') {
-          if (await sendLimiter.check(email, req)) {
-            return Response.json(genericSendResponse)
+          // The challenge is checked BEFORE the limiter on purpose: the limiter
+          // is keyed on the VICTIM's email, so letting an unauthenticated caller
+          // reach it is what made the lockout possible. No challenge, no budget
+          // consumed, no mail sent, no code overwritten.
+          if (!verifyTwoFactorChallenge(email, challenge)) {
+            return Response.json(
+              { error: 'Authentification requise avant l\'envoi d\'un code.' },
+              { status: 401 },
+            )
+          }
+
+          if (await sendLimiter.check(limiterKey, req)) {
+            return sendResponse()
           }
 
           const clients = await dbFind(payload, slugs.supportClients, {
@@ -60,7 +100,7 @@ export function createAuth2faEndpoint(slugs: CollectionSlugs, store?: RateLimitS
           })
 
           if (clients.docs.length === 0) {
-            return Response.json(genericSendResponse)
+            return sendResponse()
           }
 
           const client = clients.docs[0] as any
@@ -89,15 +129,29 @@ export function createAuth2faEndpoint(slugs: CollectionSlugs, store?: RateLimitS
             </div>`,
           })
 
-          return Response.json(genericSendResponse)
+          return sendResponse()
         }
 
         if (action === 'verify') {
+          // Same proof, same reason, same position as `send` above: the limiter
+          // below is keyed on the VICTIM's email, so an unauthenticated caller
+          // able to reach it could burn the 5 attempts and leave the victim —
+          // holding the right password AND the right code — locked out of the
+          // only route that clears the 2FA gate, renewably, every 15 minutes.
+          // Only `send` got this guard in the previous pass; `verify` is the
+          // other half of the same door.
+          if (!verifyTwoFactorChallenge(email, challenge)) {
+            return Response.json(
+              { error: 'Authentification requise avant la vérification d\'un code.' },
+              { status: 401 },
+            )
+          }
+
           if (!code) {
             return Response.json({ error: 'Code manquant' }, { status: 400 })
           }
 
-          if (await verifyLimiter.check(email, req)) {
+          if (await verifyLimiter.check(limiterKey, req)) {
             return Response.json(
               { error: 'Trop de tentatives. Réessayez dans 15 minutes.' },
               { status: 429 },
@@ -147,7 +201,10 @@ export function createAuth2faEndpoint(slugs: CollectionSlugs, store?: RateLimitS
             overrideAccess: true,
           })
 
-          verifyLimiter.reset(email)
+          // `req` is REQUIRED here: PayloadRateLimitStore throws without it, and
+          // this reset runs after the marker was written — a throw turned a
+          // successful verification into a 500 for the caller.
+          await verifyLimiter.reset(limiterKey, req)
 
           return Response.json({ success: true, verified: true })
         }

package/src/endpoints/capabilities.ts

@@ -1,7 +1,7 @@
 import type { Endpoint, Where } from 'payload'
 import type { SupportCapabilities } from '../types'
 import type { CollectionSlugs } from '../utils/slugs'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { clientIpRateKey, principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import {
   validateInboundEmailPayload,
   verifySecret,
@@ -12,7 +12,7 @@ export function createInboundEmailEndpoint(
   capability: NonNullable<SupportCapabilities['inboundEmail']>,
   store?: RateLimitStore,
 ): Endpoint {
-  const limiter = new RateLimiter(60_000, 60, store)
+  const limiter = new RateLimiter(60_000, 60, store, 'inbound-email')
   return {
     path: '/support-webhook/inbound-email',
     method: 'post',
@@ -21,9 +21,7 @@ export function createInboundEmailEndpoint(
       if (!verifySecret(req.headers.get(secretHeader), capability.secret)) {
         return Response.json({ error: 'Unauthorized' }, { status: 401 })
       }
-      const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim()
-        || req.headers.get('x-real-ip')
-        || 'unknown'
+      const ip = clientIpRateKey(req)
       if (await limiter.check(ip, req)) {
         return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
       }
@@ -51,7 +49,7 @@ export function createProjectSuggestionsEndpoint(
   capability: NonNullable<SupportCapabilities['projectSuggestions']>,
   store?: RateLimitStore,
 ): Endpoint {
-  const limiter = new RateLimiter(60_000, 20, store)
+  const limiter = new RateLimiter(60_000, 20, store, 'suggest-projects')
   return {
     path: '/support/suggest-projects',
     method: 'post',
@@ -59,7 +57,7 @@ export function createProjectSuggestionsEndpoint(
       if (!req.user || req.user.collection !== slugs.users) {
         return Response.json({ error: 'Unauthorized' }, { status: 401 })
       }
-      const key = req.user?.id ? String(req.user.id) : 'anonymous'
+      const key = principalRateKey(req.user)
       if (await limiter.check(key, req)) {
         return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
       }
@@ -73,7 +71,7 @@ export function createTicketTitleEndpoint(
   capability: NonNullable<SupportCapabilities['aiTitles']>,
   store?: RateLimitStore,
 ): Endpoint {
-  const limiter = new RateLimiter(60_000, 20, store)
+  const limiter = new RateLimiter(60_000, 20, store, 'ticket-title')
   return {
     path: '/support/ticket-title',
     method: 'post',
@@ -100,7 +98,7 @@ export function createGenerateMissingTitlesEndpoint(
   capability: NonNullable<SupportCapabilities['aiTitles']>,
   store?: RateLimitStore,
 ): Endpoint {
-  const limiter = new RateLimiter(60_000, 5, store)
+  const limiter = new RateLimiter(60_000, 5, store, 'generate-missing-titles')
   return {
     path: '/support/generate-missing-titles',
     method: 'post',

package/src/endpoints/chat.ts

@@ -2,7 +2,7 @@ import type { Endpoint } from 'payload'
 import type { Where } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import crypto from 'crypto'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { requireClient, handleAuthError } from '../utils/auth'
 import { dbFind, dbCreate } from '../utils/db'
 
@@ -67,8 +67,8 @@ export function createChatGetEndpoint(slugs: CollectionSlugs): Endpoint {
  * Send a message or start a new chat session. Client-only.
  */
 export function createChatPostEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const chatSessionLimiter = new RateLimiter(3_600_000, 5, store)
-  const chatMessageLimiter = new RateLimiter(60_000, 15, store)
+  const chatSessionLimiter = new RateLimiter(3_600_000, 5, store, 'chat:session')
+  const chatMessageLimiter = new RateLimiter(60_000, 15, store, 'chat:message')
   return {
     path: '/support/chat',
     method: 'post',
@@ -86,10 +86,12 @@ export function createChatPostEndpoint(slugs: CollectionSlugs, store?: RateLimit
         }
         const { action, session, message } = body
         const userId = String(req.user.id)
+        // Collection-qualified: agent #7 and support-client #7 must not share a budget.
+        const rateKey = principalRateKey(req.user)
 
         // Start a new session
         if (action === 'start') {
-          if (await chatSessionLimiter.check(userId, req)) {
+          if (await chatSessionLimiter.check(rateKey, req)) {
             return Response.json({ error: 'Trop de sessions créées. Réessayez plus tard.' }, { status: 429 })
           }
 
@@ -111,7 +113,7 @@ export function createChatPostEndpoint(slugs: CollectionSlugs, store?: RateLimit
 
         // Send a message
         if (action === 'send' && session && message) {
-          if (await chatMessageLimiter.check(userId, req)) {
+          if (await chatMessageLimiter.check(rateKey, req)) {
             return Response.json({ error: 'Trop de messages. Attendez un moment.' }, { status: 429 })
           }
 

package/src/endpoints/chatbot.ts

@@ -1,22 +1,47 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { clientIpRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbFind } from '../utils/db'
 
 
+/**
+ * Global hourly ceiling on chatbot calls, all callers combined.
+ *
+ * The per-IP window below is keyed on the FIRST hop of `X-Forwarded-For`, a
+ * value the caller sends itself: an anonymous client rotating that header gets a
+ * fresh window on every request. Unlike `login.ts` — where the account lock is
+ * the primary control — this endpoint has no second line of defence, and every
+ * accepted call ships ~50 KB of knowledge base to the Anthropic API on the
+ * operator's key. This unkeyed ceiling makes the bill bounded even when the
+ * per-IP key is bypassed. Raise it with `SUPPORT_CHATBOT_MAX_PER_HOUR` on a
+ * high-traffic portal, or pass `maxPerHour` when building the endpoint.
+ */
+export const DEFAULT_CHATBOT_MAX_PER_HOUR = 200
+
+function resolveMaxPerHour(explicit?: number): number {
+  if (typeof explicit === 'number' && explicit > 0) return explicit
+  const fromEnv = Number(process.env.SUPPORT_CHATBOT_MAX_PER_HOUR)
+  return Number.isFinite(fromEnv) && fromEnv > 0 ? fromEnv : DEFAULT_CHATBOT_MAX_PER_HOUR
+}
+
 /**
  * POST /api/support/chatbot
  * AI chatbot that answers from the knowledge base before creating a ticket.
  * Public endpoint (accessible from the support portal).
  */
-export function createChatbotEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const chatbotLimiter = new RateLimiter(60_000, 10, store)
+export function createChatbotEndpoint(
+  slugs: CollectionSlugs,
+  store?: RateLimitStore,
+  maxPerHour?: number,
+): Endpoint {
+  const chatbotLimiter = new RateLimiter(60_000, 10, store, 'chatbot:ip')
+  const globalLimiter = new RateLimiter(60 * 60_000, resolveMaxPerHour(maxPerHour), store, 'chatbot:global')
   return {
     path: '/support/chatbot',
     method: 'post',
     handler: async (req) => {
       try {
-        const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || req.headers.get('x-real-ip') || 'unknown'
+        const ip = clientIpRateKey(req)
         if (await chatbotLimiter.check(ip, req)) {
           return Response.json({ error: 'Too many requests. Please wait a moment.' }, { status: 429 })
         }
@@ -33,6 +58,27 @@ export function createChatbotEndpoint(slugs: CollectionSlugs, store?: RateLimitS
           return Response.json({ error: 'Question too short' }, { status: 400 })
         }
 
+        // Not keyed on anything the caller controls — see the note above.
+        // Placed after validation so malformed requests do not eat the budget.
+        //
+        // Over budget, the answer DEGRADES, it does not fail: a shared counter
+        // that returns 429 hands an anonymous visitor a switch to turn the
+        // chatbot off for everybody (the per-IP key above is spoofable, so
+        // exhausting the ceiling costs nothing). The deflection path — "no
+        // answer here, open a ticket" — is the exact response this endpoint
+        // already returns when the knowledge base is empty or the API key is
+        // missing, so no caller learns a new shape, and the bill stays capped
+        // because the AI call below is never reached.
+        if (await globalLimiter.check('all', req)) {
+          return Response.json({
+            answer: null,
+            confidence: 0,
+            suggestion: 'create_ticket',
+            aiUnavailable: true,
+            message: 'L\'assistant est momentanément indisponible. Créez un ticket, un agent vous répondra.',
+          })
+        }
+
         const payload = req.payload
 
         const articles = await dbFind(payload, slugs.knowledgeBase, {

package/src/endpoints/client-intelligence.ts

@@ -2,7 +2,7 @@ import type { Endpoint, PayloadRequest } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { readSupportSettings, type SupportSettings } from '../utils/readSettings'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { resolveOllamaBaseUrl } from '../utils/aiProvider'
 
 async function getClient(aiSettings: SupportSettings['ai']) {
@@ -29,11 +29,11 @@ const CACHE_TTL_MS = 24 * 60 * 60 * 1000 // 24 hours
  * Force-refreshes the summary.
  */
 export function createClientIntelligenceEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint[] {
-  const limiter = new RateLimiter(60_000, 20, store)
+  const limiter = new RateLimiter(60_000, 20, store, 'client-intelligence')
   const getHandler = async (req: PayloadRequest) => {
     try {
       requireAdmin(req, slugs)
-      if (await limiter.check(String(req.user!.id), req)) {
+      if (await limiter.check(principalRateKey(req.user), req)) {
         return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
       }
       const payload = req.payload
@@ -71,7 +71,7 @@ export function createClientIntelligenceEndpoint(slugs: CollectionSlugs, store?:
   const postHandler = async (req: PayloadRequest) => {
     try {
       requireAdmin(req, slugs)
-      if (await limiter.check(String(req.user!.id), req)) {
+      if (await limiter.check(principalRateKey(req.user), req)) {
         return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
       }
       const payload = req.payload