@consilioweb/payload-support 3.0.0 → 5.0.0

package/src/endpoints/email-stats.ts

@@ -1,12 +1,23 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
+import { handleAuthError, requireAdmin } from '../utils/auth'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbFind } from '../utils/db'
 
 /**
  * GET /api/support/email-stats?days=7
  * Aggregates EmailLogs data for the tracking dashboard. Admin-only.
+ *
+ * The guard used to be `!!req.user`, which ANY authenticated principal
+ * satisfies — a support-client, or a member of any other auth collection of the
+ * host app. That leaked the operational aggregate of `email-logs` (volume,
+ * failure rate, per-day and per-action breakdown) even though the collection's
+ * own `read` is staff-only, because the pages below are fetched with
+ * `overrideAccess: true`. It also handed any account an amplification primitive:
+ * up to 25 000 rows read and materialised per call, with no rate limit.
  */
-export function createEmailStatsEndpoint(slugs: CollectionSlugs): Endpoint {
+export function createEmailStatsEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
+  const statsLimiter = new RateLimiter(60_000, 20, store, 'email-stats')
   return {
     path: '/support/email-stats',
     method: 'get',
@@ -14,8 +25,11 @@ export function createEmailStatsEndpoint(slugs: CollectionSlugs): Endpoint {
       try {
         const payload = req.payload
 
-        if (!req.user) {
-          return Response.json({ error: 'Unauthorized' }, { status: 401 })
+        requireAdmin(req, slugs)
+
+        // Keyed on the authenticated user id, not on a spoofable header.
+        if (await statsLimiter.check(principalRateKey(req.user), req)) {
+          return Response.json({ error: 'Too many requests.' }, { status: 429 })
         }
 
         const url = new URL(req.url!)
@@ -101,6 +115,8 @@ export function createEmailStatsEndpoint(slugs: CollectionSlugs): Endpoint {
           actions: Object.fromEntries(actionMap),
         })
       } catch (err) {
+        const authResponse = handleAuthError(err)
+        if (authResponse) return authResponse
         console.error('[email-stats] Error:', err)
         return Response.json({ error: 'Internal server error' }, { status: 500 })
       }

package/src/endpoints/import-conversation.ts

@@ -1,6 +1,6 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { clientIpRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { readSupportSettings } from '../utils/readSettings'
 import { dbFind, dbCreate } from '../utils/db'
 import { verifySecret } from '../utils/webhookSecurity'
@@ -132,7 +132,7 @@ ONLY JSON, nothing else.`,
  * Import a conversation from markdown into the ticket system.
  */
 export function createImportConversationEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const importLimiter = new RateLimiter(3_600_000, 10, store)
+  const importLimiter = new RateLimiter(3_600_000, 10, store, 'import-conversation')
   return {
     path: '/support/import-conversation',
     method: 'post',
@@ -154,7 +154,7 @@ export function createImportConversationEndpoint(slugs: CollectionSlugs, store?:
           return Response.json({ error: 'Unauthorized' }, { status: 401 })
         }
 
-        const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || 'unknown'
+        const ip = clientIpRateKey(req)
         if (await importLimiter.check(ip, req)) {
           return Response.json({ error: 'Rate limit exceeded. Maximum 10 imports per hour.' }, { status: 429 })
         }

package/src/endpoints/index.ts

@@ -199,7 +199,7 @@ export function createSupportEndpoints(slugs: CollectionSlugs, options?: Support
   }
   if (!f || f.satisfaction !== false) endpoints.push(createSatisfactionEndpoint(slugs))
   if (!f || f.emailTracking !== false) {
-    endpoints.push(createEmailStatsEndpoint(slugs), createTrackOpenEndpoint(slugs))
+    endpoints.push(createEmailStatsEndpoint(slugs, rateLimitStore), createTrackOpenEndpoint(slugs))
   }
   if (!f || f.pendingEmails !== false) endpoints.push(createPendingEmailsProcessEndpoint(slugs))
   if (!f || f.scheduledReplies !== false) endpoints.push(createProcessScheduledEndpoint(slugs))

package/src/endpoints/invite-collaborator.ts

@@ -4,7 +4,7 @@ import { handleAuthError, AuthError } from '../utils/auth'
 import { escapeHtml, emailWrapper, emailButton, emailParagraph } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
 import { randomBytes } from 'crypto'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbFindByID, dbFind, dbCreate, dbUpdate, dbCount } from '../utils/db'
 
 const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
@@ -13,6 +13,21 @@ const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
 // email, so cap both the volume per user and the collaborators per ticket.
 const MAX_COLLABORATORS_PER_TICKET = 20
 
+/**
+ * Long-window ceiling on ACCOUNT CREATIONS per inviter.
+ *
+ * The two existing quotas are per hour (10 invites) and per ticket (20
+ * collaborators); neither bounds the total number of `support-clients` rows a
+ * single client can conjure, nor the total number of third parties it can mail,
+ * since a client can open as many tickets as it wants. This one is only consumed
+ * when the invited address has NO account yet — inviting an existing client
+ * (the normal case) never touches it.
+ *
+ * Applied to support-clients only: staff onboarding is a legitimate bulk flow.
+ */
+const MAX_NEW_ACCOUNTS_PER_INVITER = 30
+const NEW_ACCOUNT_WINDOW_MS = 7 * 24 * 60 * 60 * 1000
+
 /**
  * POST /api/support/tickets/:id/invite
  *
@@ -31,7 +46,8 @@ const MAX_COLLABORATORS_PER_TICKET = 20
  *  - Returns { ok, invitedTo, role }.
  */
 export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const inviteLimiter = new RateLimiter(60 * 60 * 1000, 10, store)
+  const inviteLimiter = new RateLimiter(60 * 60 * 1000, 10, store, 'invite-collaborator')
+  const newAccountLimiter = new RateLimiter(NEW_ACCOUNT_WINDOW_MS, MAX_NEW_ACCOUNTS_PER_INVITER, store, 'invite-collaborator:new-account')
   return {
     path: '/support/tickets/:id/invite',
     method: 'post',
@@ -75,7 +91,7 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs, store?:
         }
 
         // Anti-abuse: cap invite volume per user (in-memory, fail-closed).
-        if (await inviteLimiter.check(String(req.user.id), req)) {
+        if (await inviteLimiter.check(principalRateKey(req.user), req)) {
           return Response.json({ error: 'Trop d\'invitations. Réessayez plus tard.' }, { status: 429 })
         }
 
@@ -107,6 +123,16 @@ export function createInviteCollaboratorEndpoint(slugs: CollectionSlugs, store?:
         if (existing.docs.length > 0) {
           inviteeId = (existing.docs[0] as any).id
         } else {
+          // Creating an account for an address nobody vouched for — bounded over a
+          // long window so the endpoint cannot be used to mass-create ghost
+          // accounts and mail arbitrary third parties.
+          if (!isAdmin && await newAccountLimiter.check(principalRateKey(req.user), req)) {
+            return Response.json(
+              { error: 'Trop de nouveaux comptes invités. Réessayez plus tard.' },
+              { status: 429 },
+            )
+          }
+
           // Create a placeholder client; password is random — the invitee will reset
           // via the forgotPassword flow triggered by the SupportClients afterChange hook.
           const tempPassword = randomBytes(16).toString('hex')

package/src/endpoints/login.ts

@@ -1,15 +1,19 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { clientIpRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbCreate } from '../utils/db'
+import { issueTwoFactorChallenge } from '../utils/twoFactorChallenge'
 
 
+/** Enough to identify a browser, short enough that a flood cannot fill the disk. */
+const MAX_LOGGED_USER_AGENT = 256
+
 /**
  * POST /api/support/login
  * Client login endpoint.
  */
 export function createLoginEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const loginLimiter = new RateLimiter(15 * 60_000, 10, store)
+  const loginLimiter = new RateLimiter(15 * 60_000, 10, store, 'login')
   return {
     path: '/support/login',
     method: 'post',
@@ -17,7 +21,12 @@ export function createLoginEndpoint(slugs: CollectionSlugs, store?: RateLimitSto
       // NOTE: x-forwarded-for is spoofable unless this app sits strictly behind a
       // trusted proxy that rewrites it. This IP rate-limit is a SECONDARY defense;
       // the primary brute-force control is Payload's account lock (maxLoginAttempts).
-      const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || req.headers.get('x-real-ip') || 'unknown'
+      //
+      // `clientIpRateKey` is what keeps a spoofed header from being more than a
+      // bucket choice: the raw header used to become the limiter key AND the
+      // `ipAddress` column below, so rotating it minted unbounded map entries in
+      // memory and unbounded rows on disk.
+      const ip = clientIpRateKey(req)
 
       if (await loginLimiter.check(ip, req)) {
         return Response.json(
@@ -34,7 +43,9 @@ export function createLoginEndpoint(slugs: CollectionSlugs, store?: RateLimitSto
         return Response.json({ error: 'Invalid JSON body' }, { status: 400 })
       }
       const { email, password } = body
-      const userAgent = req.headers.get('user-agent') || ''
+      // Persisted on every failed attempt, from an anonymous request: bounded so
+      // a flood cannot write tens of kilobytes per row into `auth-logs`.
+      const userAgent = (req.headers.get('user-agent') || '').slice(0, MAX_LOGGED_USER_AGENT)
 
       if (!email || !password) {
         return Response.json({ error: 'Email et mot de passe requis.' }, { status: 400 })
@@ -75,8 +86,20 @@ export function createLoginEndpoint(slugs: CollectionSlugs, store?: RateLimitSto
 
         // 2FA gate: password was correct but a fresh 2FA verification is required.
         // No session/cookie is issued (Payload rolled it back on the throw).
+        //
+        // The password check just succeeded, so this is where the short-lived
+        // proof for `POST /support/2fa {action:'send'}` is minted: without it,
+        // that endpoint would keep letting an anonymous caller burn a victim's
+        // send quota and lock them out of their own account.
         if (errorMessage.includes('2FA_REQUIRED')) {
-          return Response.json({ requires2FA: true }, { status: 200 })
+          let challenge: string | undefined
+          try {
+            challenge = issueTwoFactorChallenge(email)
+          } catch {
+            // PAYLOAD_SECRET missing: 2FA cannot operate at all (codes are
+            // hashed with it). Answer without a challenge — fail closed.
+          }
+          return Response.json({ requires2FA: true, ...(challenge ? { challenge } : {}) }, { status: 200 })
         }
 
         let errorReason = 'Identifiants incorrects'

package/src/endpoints/oauth-google.ts

@@ -3,16 +3,74 @@ import { getFieldsToSign, jwtSign } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import crypto from 'crypto'
 import { dbFind, dbUpdate, dbCreate, dbFindByID } from '../utils/db'
+import { issueTwoFactorChallenge } from '../utils/twoFactorChallenge'
 
 /**
  * POST /api/support/oauth/google
  * Google OAuth — handles both login redirect and callback.
- * Body: { action: 'login' } or { code: string, state: string, cookieState: string }
+ * Body: { action: 'login' } or { code: string, state: string }
+ *
+ * The CSRF state is NOT taken from the body: `action: 'login'` issues it as an
+ * HttpOnly cookie and the callback reads it back from the `Cookie` header.
  */
 export interface OAuthGoogleOptions {
   allowedEmailDomains?: string[]
 }
 
+/** Name of the HttpOnly cookie carrying the CSRF state between the two steps. */
+export const OAUTH_STATE_COOKIE = 'support-oauth-state'
+
+/** Same window as the Google authorization code: 10 minutes is plenty. */
+const OAUTH_STATE_MAX_AGE = 600
+
+/**
+ * A successful `/support/2fa` verify stamps `twoFactorVerifiedAt`; the marker is
+ * valid for this window then consumed. Mirrors `TWO_FA_WINDOW_MS` in
+ * `collections/SupportClients.ts` — the two MUST stay in sync.
+ */
+const TWO_FA_WINDOW_MS = 5 * 60 * 1000
+
+/**
+ * Read one cookie from the request's own `Cookie` header.
+ *
+ * The callback used to compare `state` against a `cookieState` ALSO taken from
+ * the JSON body: two values from the same attacker-controlled place, so the CSRF
+ * check was a no-op for any non-browser caller (send the same string twice). The
+ * state is now issued as an HttpOnly cookie at the `login` step and read back
+ * here, server-side — the only place a browser cannot forge it from script.
+ */
+export function readCookie(header: string | null | undefined, name: string): string | null {
+  if (!header) return null
+  for (const part of header.split(';')) {
+    const eq = part.indexOf('=')
+    if (eq === -1) continue
+    if (part.slice(0, eq).trim() !== name) continue
+    try {
+      return decodeURIComponent(part.slice(eq + 1).trim())
+    } catch {
+      return part.slice(eq + 1).trim()
+    }
+  }
+  return null
+}
+
+/**
+ * Expire the state cookie: it is single-use, and leaving it live for the rest of
+ * its 10 minutes keeps a consumed CSRF token replayable for no benefit.
+ */
+export function clearedStateCookie(): string {
+  const secure = process.env.NODE_ENV === 'production'
+  return `${OAUTH_STATE_COOKIE}=; HttpOnly; ${secure ? 'Secure; ' : ''}SameSite=Lax; Path=/; Max-Age=0`
+}
+
+/** Constant-time comparison — the state is a secret for the length of the flow. */
+function statesMatch(a: string | null | undefined, b: string | null | undefined): boolean {
+  if (!a || !b) return false
+  const left = crypto.createHash('sha256').update(a).digest()
+  const right = crypto.createHash('sha256').update(b).digest()
+  return crypto.timingSafeEqual(left, right)
+}
+
 export function createOAuthGoogleEndpoint(slugs: CollectionSlugs, options?: OAuthGoogleOptions): Endpoint {
   return {
     path: '/support/oauth/google',
@@ -31,7 +89,7 @@ export function createOAuthGoogleEndpoint(slugs: CollectionSlugs, options?: OAut
 
       try {
         const body = await req.json!()
-        const { action, code, state: queryState, cookieState } = body
+        const { action, code, state: queryState } = body
 
         // Step 1: Generate OAuth URL
         if (action === 'login') {
@@ -46,16 +104,30 @@ export function createOAuthGoogleEndpoint(slugs: CollectionSlugs, options?: OAut
             prompt: 'select_account',
           })
 
-          return Response.json({
-            url: `https://accounts.google.com/o/oauth2/v2/auth?${params}`,
-            state: oauthState,
-          })
+          const secure = process.env.NODE_ENV === 'production'
+          const loginHeaders = new Headers({ 'Content-Type': 'application/json' })
+          loginHeaders.append(
+            'Set-Cookie',
+            `${OAUTH_STATE_COOKIE}=${oauthState}; HttpOnly; ${secure ? 'Secure; ' : ''}SameSite=Lax; Path=/; Max-Age=${OAUTH_STATE_MAX_AGE}`,
+          )
+
+          return new Response(
+            JSON.stringify({
+              url: `https://accounts.google.com/o/oauth2/v2/auth?${params}`,
+              // Kept for callers that echo it back in the redirect URL; the
+              // server no longer trusts anything the caller returns.
+              state: oauthState,
+            }),
+            { status: 200, headers: loginHeaders },
+          )
         }
 
         // Step 2: Handle callback (code exchange)
         if (code) {
-          // Validate state
-          if (!cookieState || !queryState || cookieState !== queryState) {
+          // Validate state against the HttpOnly cookie set at the `login` step —
+          // NOT against a second copy taken from the request body.
+          const issuedState = readCookie(req.headers.get('cookie'), OAUTH_STATE_COOKIE)
+          if (!statesMatch(issuedState, queryState)) {
             return Response.json({ error: 'state_mismatch' }, { status: 400 })
           }
 
@@ -158,6 +230,54 @@ export function createOAuthGoogleEndpoint(slugs: CollectionSlugs, options?: OAut
             }) as { id: number | string; email: string }
           }
 
+          // Replay the 2FA rule BEFORE minting anything.
+          //
+          // This path never calls `payload.login`, so the `beforeLogin` hook
+          // `createEnforce2FA` (collections/SupportClients.ts) never runs: a
+          // client who turned 2FA on from the portal profile page could skip it
+          // entirely by clicking "Sign in with Google". Same contract as
+          // `endpoints/login.ts`: no token, `{ requires2FA: true }`, and the
+          // verified marker is single-use.
+          const twoFactorDoc = (await dbFindByID(payload, slugs.supportClients, {
+            id: clientDoc.id,
+            depth: 0,
+            overrideAccess: true,
+            showHiddenFields: true,
+          })) as { twoFactorEnabled?: boolean; twoFactorVerifiedAt?: string | null }
+
+          if (twoFactorDoc?.twoFactorEnabled) {
+            const raw = twoFactorDoc.twoFactorVerifiedAt
+            const verifiedAt = raw ? new Date(raw).getTime() : 0
+            if (!(verifiedAt > Date.now() - TWO_FA_WINDOW_MS)) {
+              // The authorization code is spent: the client has to restart the
+              // whole flow after verifying, so the state goes with it.
+              //
+              // Google just proved this identity, so the client is entitled to
+              // request a code: hand out the same short-lived challenge
+              // `endpoints/login.ts` mints, or `POST /support/2fa` would refuse
+              // to send one.
+              let challenge: string | undefined
+              try {
+                challenge = issueTwoFactorChallenge(clientDoc.email)
+              } catch {
+                // PAYLOAD_SECRET missing — 2FA is inoperable anyway; fail closed.
+              }
+              return new Response(JSON.stringify({ requires2FA: true, ...(challenge ? { challenge } : {}) }), {
+                status: 200,
+                headers: new Headers({
+                  'Content-Type': 'application/json',
+                  'Set-Cookie': clearedStateCookie(),
+                }),
+              })
+            }
+            // Consume the marker so the verified window cannot be replayed.
+            await dbUpdate(payload, slugs.supportClients, {
+              id: clientDoc.id,
+              data: { twoFactorVerifiedAt: null },
+              overrideAccess: true,
+            })
+          }
+
           // Mint a Payload session WITHOUT touching the user's password.
           // Uses Payload's own jwtSign/getFieldsToSign so the token format matches
           // exactly, and replicates addSessionToUser for the sessions array.
@@ -209,6 +329,8 @@ export function createOAuthGoogleEndpoint(slugs: CollectionSlugs, options?: OAut
             'Set-Cookie',
             `payload-token=${token}; HttpOnly; ${cookieSecure ? 'Secure; ' : ''}SameSite=Lax; Path=/; Max-Age=${tokenExpiration}`,
           )
+          // The state has done its job — do not leave it replayable.
+          headers.append('Set-Cookie', clearedStateCookie())
 
           return new Response(JSON.stringify({ user: clientDoc, exp }), {
             status: 200,

package/src/endpoints/push.ts

@@ -3,6 +3,7 @@ import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { dbFind, dbCreate, dbUpdate } from '../utils/db'
 import { getVapidPublicKey } from '../utils/push'
+import { validatePushEndpoint, WEBHOOK_URL_MESSAGES } from '../utils/urlSafety'
 
 /** GET /api/support/push/vapid-public-key — public key the browser uses to subscribe. */
 export function createVapidKeyEndpoint(): Endpoint {
@@ -30,7 +31,19 @@ export function createPushSubscribeEndpoint(slugs: CollectionSlugs): Endpoint {
         if (!endpoint || !p256dh || !auth) {
           return Response.json({ error: 'subscription invalide (endpoint + keys requis).' }, { status: 400 })
         }
-        const data = { user: req.user!.id, endpoint, p256dh, auth, userAgent: req.headers.get('user-agent') || '' }
+        // WRITE-time SSRF guard. `requireAdmin` above only proves the caller
+        // belongs to the staff collection — the very actor `utils/urlSafety`
+        // already models as hostile for webhook URLs — and `web-push` hands this
+        // string's host and port straight to `https.request`. Same guard, same
+        // reason, on the second field that steers an outbound request.
+        const endpointCheck = validatePushEndpoint(endpoint)
+        if (!endpointCheck.ok) {
+          return Response.json(
+            { error: WEBHOOK_URL_MESSAGES[endpointCheck.reason || 'invalid_url'] },
+            { status: 400 },
+          )
+        }
+        const data = { user: req.user!.id, endpoint, p256dh, auth, userAgent: (req.headers.get('user-agent') || '').slice(0, 256) }
         const existing = await dbFind(req.payload, slugs.pushSubscriptions, { where: { endpoint: { equals: endpoint } }, limit: 1, depth: 0, overrideAccess: true })
         if (existing.docs.length > 0) {
           await dbUpdate(req.payload, slugs.pushSubscriptions, { id: (existing.docs[0] as { id: number | string }).id, data, overrideAccess: true })

package/src/endpoints/resend-notification.ts

@@ -1,7 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { escapeHtml } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
 import { dbFindByID } from '../utils/db'
@@ -12,7 +12,7 @@ import { dbFindByID } from '../utils/db'
  * Resend the email notification for a specific ticket message. Admin-only.
  */
 export function createResendNotificationEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const resendLimiter = new RateLimiter(60 * 60 * 1000, 10, store)
+  const resendLimiter = new RateLimiter(60 * 60 * 1000, 10, store, 'resend-notification')
   return {
     path: '/support/resend-notification',
     method: 'post',
@@ -22,7 +22,7 @@ export function createResendNotificationEndpoint(slugs: CollectionSlugs, store?:
 
         requireAdmin(req, slugs)
 
-        if (await resendLimiter.check(String(req.user.id), req)) {
+        if (await resendLimiter.check(principalRateKey(req.user), req)) {
           return Response.json(
             { error: 'Trop de renvois. Réessayez dans une heure.' },
             { status: 429 },

package/src/endpoints/send-reminder.ts

@@ -1,7 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { escapeHtml, emailWrapper, emailParagraph, emailButton } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
 import { dbFindByID, dbFind, dbCreate, dbUpdate } from '../utils/db'
@@ -38,7 +38,7 @@ function formatFr(date: Date, withTime: boolean): string {
  * Admin-only, rate-limited.
  */
 export function createSendReminderEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const reminderLimiter = new RateLimiter(60 * 60 * 1000, 30, store)
+  const reminderLimiter = new RateLimiter(60 * 60 * 1000, 30, store, 'send-reminder')
   return {
     path: '/support/send-reminder',
     method: 'post',
@@ -48,7 +48,7 @@ export function createSendReminderEndpoint(slugs: CollectionSlugs, store?: RateL
 
         requireAdmin(req, slugs)
 
-        if (await reminderLimiter.check(String(req.user.id), req)) {
+        if (await reminderLimiter.check(principalRateKey(req.user), req)) {
           return Response.json(
             { error: 'Trop de relances. Réessayez dans une heure.' },
             { status: 429 },

package/src/endpoints/signature.ts

@@ -19,7 +19,14 @@ export function createSignatureGetEndpoint(slugs: CollectionSlugs): Endpoint {
         requireAdmin(req, slugs)
 
         const prefs = await dbFind(payload, 'payload-preferences', {
-          where: { key: { equals: `${PREF_KEY}-${req.user.id}` } },
+          // Scope to the staff auth collection: `payload-preferences` accepts a
+          // write from ANY authenticated principal, and ids collide between auth
+          // collections — a support-client with the same id would otherwise own
+          // the `email-signature-<id>` row read back for the agent.
+          where: {
+            key: { equals: `${PREF_KEY}-${req.user.id}` },
+            'user.relationTo': { equals: slugs.users },
+          },
           limit: 1,
           depth: 0,
           overrideAccess: true,
@@ -57,7 +64,7 @@ export function createSignaturePostEndpoint(slugs: CollectionSlugs): Endpoint {
         const key = `${PREF_KEY}-${req.user.id}`
 
         const existing = await dbFind(payload, 'payload-preferences', {
-          where: { key: { equals: key } },
+          where: { key: { equals: key }, 'user.relationTo': { equals: slugs.users } },
           limit: 1,
           depth: 0,
           overrideAccess: true,

package/src/endpoints/statuses.ts

@@ -5,6 +5,18 @@ import { dbFind } from '../utils/db'
 /**
  * GET /api/support/statuses
  * Returns all ticket statuses sorted by sortOrder.
+ *
+ * The guard used to be `!!req.user`, which ANY authenticated principal
+ * satisfies — including a member of an unrelated auth collection of the host
+ * app (customers, members, subscribers created by public sign-up). Because the
+ * rows below are read with `overrideAccess: true`, that handed them the whole
+ * support workflow taxonomy — internal status names, private states, pipeline
+ * order — which `ticket-statuses.access.read` explicitly refuses them.
+ *
+ * The check below MIRRORS that ACL rather than replacing it: staff and
+ * support-clients, nobody else. `overrideAccess` stays, because the endpoint
+ * legitimately serves the full list to both, and the projection it returns is
+ * narrower than the documents themselves.
  */
 export function createStatusesEndpoint(slugs: CollectionSlugs): Endpoint {
   return {
@@ -18,6 +30,11 @@ export function createStatusesEndpoint(slugs: CollectionSlugs): Endpoint {
           return Response.json({ error: 'Unauthorized' }, { status: 401 })
         }
 
+        const collection = (req.user as { collection?: string }).collection
+        if (collection !== slugs.users && collection !== slugs.supportClients) {
+          return Response.json({ error: 'Forbidden' }, { status: 403 })
+        }
+
         const { docs } = await dbFind(payload, slugs.ticketStatuses, {
           sort: 'sortOrder',
           limit: 100,

package/src/endpoints/ticket-synthesis.ts

@@ -4,7 +4,7 @@ import { requireAdmin, handleAuthError } from '../utils/auth'
 import { generateTicketSynthesis } from '../utils/generateTicketSynthesis'
 import { dbFindByID } from '../utils/db'
 import type { SupportCapabilities } from '../types'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 
 /**
  * POST /api/support/ticket-synthesis?ticketId=X[&force=true]
@@ -23,14 +23,14 @@ export function createTicketSynthesisEndpoint(
   generator?: SupportCapabilities['aiSummaries'],
   store?: RateLimitStore,
 ): Endpoint {
-  const limiter = new RateLimiter(60_000, 20, store)
+  const limiter = new RateLimiter(60_000, 20, store, 'ticket-synthesis')
   return {
     path: '/support/ticket-synthesis',
     method: 'post',
     handler: async (req) => {
       try {
         requireAdmin(req, slugs)
-        if (await limiter.check(String(req.user!.id), req)) {
+        if (await limiter.check(principalRateKey(req.user), req)) {
           return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
         }
         const payload = req.payload

package/src/endpoints/transfer-ticket.ts

@@ -3,7 +3,7 @@ import type { CollectionSlugs } from '../utils/slugs'
 import { handleAuthError, AuthError } from '../utils/auth'
 import { escapeHtml, emailWrapper, emailButton, emailParagraph } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbFindByID, dbFind, dbCreate, dbCount } from '../utils/db'
 
 // Simple RFC-5322 style sanity check — same level of strictness as the
@@ -13,6 +13,21 @@ const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
 
 const MAX_TRANSFERS_PER_DAY = 5
 
+/**
+ * Per-USER ceiling, ticket-independent.
+ *
+ * Both existing quotas (the in-memory limiter keyed `<user>:<ticket>` and the
+ * `email-logs` count) are per TICKET, and a support-client can open as many
+ * tickets as they want — so "5 transfers / 24 h" resets on every new ticket and
+ * the endpoint is an unbounded outbound mailer: the operator's From address, a
+ * "Récapitulatif support" subject, and 1 000 characters chosen by the caller,
+ * to any mailbox. This second quota is what actually bounds the volume.
+ *
+ * Applied to support-clients only: staff already hold the whole mailing surface
+ * of the admin panel, and capping them here would break legitimate bulk recaps.
+ */
+const MAX_TRANSFERS_PER_USER_PER_DAY = 15
+
 // In-memory fail-closed rate limiter — enforced even when the persistent
 // emailLogs-based check is unavailable (collection disabled). Prevents the
 // endpoint from becoming an unbounded outbound mailer.
@@ -33,7 +48,8 @@ const MAX_TRANSFERS_PER_DAY = 5
  *  - Rate-limited to 5 transfers per ticket per 24h
  */
 export function createTransferTicketEndpoint(slugs: CollectionSlugs, store?: RateLimitStore): Endpoint {
-  const transferLimiter = new RateLimiter(24 * 60 * 60 * 1000, MAX_TRANSFERS_PER_DAY, store)
+  const transferLimiter = new RateLimiter(24 * 60 * 60 * 1000, MAX_TRANSFERS_PER_DAY, store, 'transfer:ticket')
+  const transferUserLimiter = new RateLimiter(24 * 60 * 60 * 1000, MAX_TRANSFERS_PER_USER_PER_DAY, store, 'transfer:user')
   return {
     path: '/support/tickets/:id/transfer',
     method: 'post',
@@ -82,13 +98,22 @@ export function createTransferTicketEndpoint(slugs: CollectionSlugs, store?: Rat
 
         // Fail-closed in-memory rate limit (per user + ticket): enforced even
         // when the persistent emailLogs check below cannot run.
-        if (await transferLimiter.check(`${req.user.id}:${ticketId}`, req)) {
+        if (await transferLimiter.check(`${principalRateKey(req.user)}:${ticketId}`, req)) {
           return Response.json(
             { error: `Limite atteinte (${MAX_TRANSFERS_PER_DAY} transferts par 24h sur ce ticket)` },
             { status: 429 },
           )
         }
 
+        // Ticket-independent quota — the per-ticket ones above reset on every
+        // newly created ticket, which a client can do at will.
+        if (!isAdmin && await transferUserLimiter.check(principalRateKey(req.user), req)) {
+          return Response.json(
+            { error: `Limite atteinte (${MAX_TRANSFERS_PER_USER_PER_DAY} transferts par 24h)` },
+            { status: 429 },
+          )
+        }
+
         // Rate limit: count transfers in last 24h for this ticket
         try {
           const since = new Date(Date.now() - 24 * 60 * 60 * 1000).toISOString()