@consilioweb/payload-support 3.0.0 → 5.0.0

package/src/utils/rateLimiter.ts

@@ -8,13 +8,59 @@ export interface RateLimitStore {
   reset(key: string, context?: unknown): Promise<void>
 }
 
+/**
+ * Hard ceiling on the number of distinct keys held at once, all endpoints
+ * combined. Sized for a busy install (thousands of client IPs inside one
+ * 15-minute window) while capping the map at a few hundred kilobytes.
+ */
+export const MAX_MEMORY_RATE_LIMIT_KEYS = 10_000
+
 /**
  * Process-local fallback store. Applications running more than one process
  * should provide a persistent RateLimitStore through the plugin options.
+ *
+ * BOUNDED, because the keys come from anonymous HTTP traffic: `/support/login`
+ * and `/support/chatbot` key their limiter on the client IP, and the IP is read
+ * from `x-forwarded-for`. A caller rotating that header wrote one PERMANENT
+ * entry per value into a map that had no ceiling, no expiry sweep and no
+ * eviction — only `reset()` ever removed anything, and the login path never
+ * calls it. Worse, every fresh key opened a fresh window, so the limiter did
+ * not even slow down the flood that was exhausting it.
+ *
+ * Two independent bounds, the same pair `endpoints/typing.ts` already applies
+ * to its own module-level map: `clientIpRateKey` caps the SIZE of a key, the
+ * ceiling below caps their NUMBER.
  */
 export class MemoryRateLimitStore implements RateLimitStore {
   private readonly entries = new Map<string, RateLimitEntry>()
 
+  constructor(private readonly maxKeys: number = MAX_MEMORY_RATE_LIMIT_KEYS) {}
+
+  /** Distinct keys currently held. Exposed so the ceiling can be asserted. */
+  get size(): number {
+    return this.entries.size
+  }
+
+  /** Reclaims every window that has already closed. */
+  private sweepExpired(now: number): void {
+    for (const [key, entry] of this.entries) {
+      if (now > entry.resetAt) this.entries.delete(key)
+    }
+  }
+
+  /** Soonest-closing window first, so the ceiling drops the least useful entry. */
+  private evictOldest(): void {
+    let oldestKey: string | null = null
+    let oldestResetAt = Infinity
+    for (const [key, entry] of this.entries) {
+      if (entry.resetAt < oldestResetAt) {
+        oldestResetAt = entry.resetAt
+        oldestKey = key
+      }
+    }
+    if (oldestKey !== null) this.entries.delete(oldestKey)
+  }
+
   async increment(key: string, windowMs: number): Promise<RateLimitEntry> {
     const now = Date.now()
     const current = this.entries.get(key)
@@ -22,6 +68,12 @@ export class MemoryRateLimitStore implements RateLimitStore {
       ? { count: 1, resetAt: now + windowMs }
       : { ...current, count: current.count + 1 }
 
+    // Only a key that is not already held can grow the map.
+    if (!current && this.entries.size >= this.maxKeys) {
+      this.sweepExpired(now)
+      if (this.entries.size >= this.maxKeys) this.evictOldest()
+    }
+
     this.entries.set(key, next)
     return next
   }
@@ -119,27 +171,107 @@ export class PayloadRateLimitStore implements RateLimitStore {
   }
 }
 
+/**
+ * Identity part of a rate-limit key for an authenticated caller.
+ *
+ * Ids are per-collection sequences: support-client #7 and agent #7 are different
+ * people with the same `id`. Keying a limiter on `String(user.id)` alone let one
+ * consume the other's budget, so the auth collection travels with the id.
+ */
+export function principalRateKey(
+  user: { id?: unknown; collection?: unknown } | null | undefined,
+): string {
+  if (!user || user.id === undefined || user.id === null) return 'anonymous'
+  const collection = typeof user.collection === 'string' && user.collection ? user.collection : 'unknown'
+  return `${collection}:${String(user.id)}`
+}
+
+/**
+ * Longest textual IPv6 address, `xxxx:` * 7 + an embedded IPv4 literal.
+ * Nothing legitimate is longer; the cap is what makes the key bounded.
+ */
+const MAX_IP_KEY_LENGTH = 45
+/** Dotted-quad, or the hex/`::`/zone alphabet of an IPv6 literal. Shape only. */
+const IPV4_PATTERN = /^(?:\d{1,3}\.){3}\d{1,3}$/
+const IPV6_PATTERN = /^[0-9a-fA-F:.%]+$/
+
+/**
+ * Identity part of a rate-limit key for an ANONYMOUS caller.
+ *
+ * `x-forwarded-for` is attacker-controlled — the note in `endpoints/login.ts`
+ * has always said so, and Payload's account lock is what actually stops a
+ * brute-force. But the header was also used RAW as the limiter key, and that is
+ * a second, distinct problem: a key is a stored object. A caller rotating the
+ * header minted one unbounded, never-reclaimed entry per value; a value can be
+ * most of Node's 16 KB header budget. This validates the SHAPE and caps the
+ * LENGTH, so a forged header can still pick a bucket but can no longer invent
+ * an unbounded number of them, nor make any single one large.
+ *
+ * Anything that is not an IP literal falls back to the shared `unknown` bucket.
+ * That is the fail-closed direction: an install with no proxy already puts
+ * every caller there, and one behind a proxy never lands there legitimately.
+ */
+export function clientIpRateKey(req: { headers: { get(name: string): string | null } }): string {
+  const candidate = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim()
+    || req.headers.get('x-real-ip')?.trim()
+    || ''
+  return normalizeIpKey(candidate)
+}
+
+/** Exposed separately so a caller holding an already-extracted address can reuse it. */
+export function normalizeIpKey(candidate: string): string {
+  if (!candidate || candidate.length > MAX_IP_KEY_LENGTH) return 'unknown'
+  const host = candidate.startsWith('[') && candidate.endsWith(']')
+    ? candidate.slice(1, -1)
+    : candidate
+  if (!host) return 'unknown'
+  if (IPV4_PATTERN.test(host)) {
+    return host.split('.').every((octet) => Number(octet) <= 255) ? host : 'unknown'
+  }
+  if (host.includes(':') && IPV6_PATTERN.test(host)) return host.toLowerCase()
+  return 'unknown'
+}
+
 export class RateLimiter {
   private readonly store: RateLimitStore
+  private readonly prefix: string
 
+  /**
+   * @param namespace  Endpoint-scoped prefix for every key this limiter writes.
+   *   The store is SHARED (`rateLimitStore: 'payload'` builds one instance for
+   *   all endpoints), and the raw keys collide across endpoints: `ip` was used
+   *   by both the login and the chatbot limiter — 10 forged chatbot requests
+   *   locked a victim out of the portal for 15 minutes — and `String(user.id)`
+   *   by five different endpoints. Always pass one; it is optional only because
+   *   `RateLimiter` is part of the published API surface.
+   */
   constructor(
     private readonly windowMs: number,
     private readonly maxRequests: number,
     store?: RateLimitStore,
+    namespace?: string,
   ) {
     this.store = store ?? new MemoryRateLimitStore()
+    this.prefix = namespace ? `${namespace}:` : ''
+  }
+
+  /** The key actually written to the store. Exposed for assertions in tests. */
+  scopedKey(key: string): string {
+    return `${this.prefix}${key}`
   }
 
   async check(key: string, context?: unknown): Promise<boolean> {
+    const scoped = this.scopedKey(key)
     const entry = context === undefined
-      ? await this.store.increment(key, this.windowMs)
-      : await this.store.increment(key, this.windowMs, context)
+      ? await this.store.increment(scoped, this.windowMs)
+      : await this.store.increment(scoped, this.windowMs, context)
     return entry.count > this.maxRequests
   }
 
   async reset(key: string, context?: unknown): Promise<void> {
-    if (context === undefined) await this.store.reset(key)
-    else await this.store.reset(key, context)
+    const scoped = this.scopedKey(key)
+    if (context === undefined) await this.store.reset(scoped)
+    else await this.store.reset(scoped, context)
   }
 }
 import { commitTransaction, initTransaction, killTransaction, type PayloadRequest } from 'payload'

package/src/utils/readSettings.ts

@@ -13,6 +13,50 @@ const USER_PREFS_KEY_PREFIX = 'support-user-prefs'
 /** Pre-2.1 standalone round-robin row — read as a fallback, then folded into `features`. */
 const LEGACY_ROUND_ROBIN_KEY = 'support-round-robin'
 
+/**
+ * Key under which `plugin.ts` publishes the resolved staff collection slug on
+ * `config.custom`. It is the ONE source of truth shared by the read path (here)
+ * and the write path (`requireAdmin` → `slugs.users`).
+ */
+export const SUPPORT_STAFF_SLUG_CONFIG_KEY = 'supportStaffCollection'
+
+/**
+ * Owner scope for every `payload-preferences` row this plugin reads back.
+ *
+ * `payload-preferences` is writable by ANY authenticated principal, whatever its
+ * auth collection: Payload's `POST /api/payload-preferences/:key` handler only
+ * checks `!!req.user` before upserting the row. Reading a plugin-wide row by key
+ * alone therefore lets a front-office user (or a support-client) plant their own
+ * row and have the whole plugin read it — replyTo addresses, SLA escalation
+ * address, AI provider, feature flags.
+ *
+ * Every read below is constrained to `user.relationTo = <staff collection>`, the
+ * same scope the WRITE path already uses (endpoints/settings.ts, signature.ts,
+ * user-prefs.ts all upsert with `req.user.collection`, and all three are guarded
+ * by `requireAdmin`, which compares against `slugs.users`).
+ *
+ * TWO SOURCES OF TRUTH WERE THE BUG: this used to resolve the scope from
+ * `config.admin.user`, which Payload defaults to the FIRST auth collection of
+ * the app when the integrator did not declare it (config/sanitize.js). On a host
+ * whose first auth collection is the front office and whose staff collection is
+ * declared through `collectionSlugs.users`, the read scope named the front
+ * office while the write scope named the staff — and the poisoning this scope
+ * was added to defeat was open again. So the plugin now PUBLISHES the resolved
+ * `slugs.users` on `config.custom` (see plugin.ts) and reads it back here.
+ * `config.admin.user` remains a last-resort fallback for callers using these
+ * helpers outside of a plugin-built config; there is no plugin deployment in
+ * which it is consulted.
+ */
+export function resolveStaffPrefSlug(payload: Payload, staffSlug?: string): string {
+  if (staffSlug) return staffSlug
+  const config = (payload as unknown as {
+    config?: { admin?: { user?: string }; custom?: Record<string, unknown> }
+  }).config
+  const registered = config?.custom?.[SUPPORT_STAFF_SLUG_CONFIG_KEY]
+  if (typeof registered === 'string' && registered) return registered
+  return config?.admin?.user || 'users'
+}
+
 export interface SupportSettings {
   email: { fromAddress: string; fromName: string; replyToAddress: string }
   ai: { provider: string; model: string; enableSentiment: boolean; enableSynthesis: boolean; enableSuggestion: boolean; enableRewrite: boolean }
@@ -44,8 +88,17 @@ export const DEFAULT_USER_PREFS: UserPrefs = {
 // (the afterChange hook chain). The settings doc changes rarely, so a short TTL
 // + explicit invalidation on save (endpoints/settings.ts) avoids redundant DB
 // reads of the same `payload-preferences` row.
-let settingsCache: { value: SupportSettingsState; ts: number } | null = null
+// Keyed by the STAFF SLUG the read was scoped to: a single shared slot would
+// serve one install's (or one test's) settings to another whose scope differs.
+// Bounded — the key comes from config, never from a request — but capped anyway
+// so an integrator calling the exported helper with arbitrary slugs cannot grow
+// it without limit.
+const settingsCache = new Map<string, { value: SupportSettingsState; ts: number }>()
 const SETTINGS_TTL_MS = 60_000
+const SETTINGS_CACHE_MAX = 8
+
+/** Rate-limits the "settings row exists but is not staff-owned" warning, per scope. */
+const warnedForeignSettingsRow = new Set<string>()
 
 export interface SupportSettingsState {
   settings: SupportSettings
@@ -59,7 +112,8 @@ export interface SupportSettingsState {
 
 /** Invalidate the settings cache — call right after writing support settings. */
 export function invalidateSupportSettingsCache(): void {
-  settingsCache = null
+  settingsCache.clear()
+  warnedForeignSettingsRow.clear()
 }
 
 /**
@@ -85,9 +139,14 @@ export function mergeSupportSettings(
   }
 }
 
-export async function readSupportSettingsState(payload: Payload): Promise<SupportSettingsState> {
-  if (settingsCache && Date.now() - settingsCache.ts < SETTINGS_TTL_MS) {
-    return settingsCache.value
+export async function readSupportSettingsState(
+  payload: Payload,
+  staffSlug?: string,
+): Promise<SupportSettingsState> {
+  const staff = resolveStaffPrefSlug(payload, staffSlug)
+  const cached = settingsCache.get(staff)
+  if (cached && Date.now() - cached.ts < SETTINGS_TTL_MS) {
+    return cached.value
   }
   let value: SupportSettingsState = {
     settings: mergeSupportSettings(null),
@@ -95,7 +154,10 @@ export async function readSupportSettingsState(payload: Payload): Promise<Suppor
   }
   try {
     const prefs = await dbFind(payload, 'payload-preferences', {
-      where: { key: { equals: PREF_KEY } },
+      // Sibling keys are AND-ed by Payload. The `user.relationTo` clause is the
+      // security boundary: without it any authenticated principal can plant a
+      // `support-settings` row and own the plugin's server settings.
+      where: { key: { equals: PREF_KEY }, 'user.relationTo': { equals: staff } },
       // The upsert is scoped per admin user, so several rows can share the key.
       // Sorting makes "last write wins" deterministic instead of arbitrary.
       sort: '-updatedAt',
@@ -110,24 +172,63 @@ export async function readSupportSettingsState(payload: Payload): Promise<Suppor
       // Honour it until the first save writes `features` — after that the
       // legacy row is ignored, and both write paths land in `features`.
       if (!featuresConfigured) {
-        settings.features.roundRobin = await readLegacyRoundRobin(payload)
+        settings.features.roundRobin = await readLegacyRoundRobin(payload, staff)
       }
 
       value = { settings, featuresConfigured }
+    } else {
+      await warnOnForeignSettingsRow(payload, staff)
     }
   } catch { /* fallback to defaults */ }
-  settingsCache = { value, ts: Date.now() }
+  if (settingsCache.size >= SETTINGS_CACHE_MAX && !settingsCache.has(staff)) settingsCache.clear()
+  settingsCache.set(staff, { value, ts: Date.now() })
   return value
 }
 
-export async function readSupportSettings(payload: Payload): Promise<SupportSettings> {
-  return (await readSupportSettingsState(payload)).settings
+/**
+ * The scoped read came back empty. That is normal on a fresh install, but it is
+ * also what an operator sees when the settings row was written under another
+ * owner than the resolved staff collection: the row exists, is ignored,
+ * and the whole plugin silently runs on the defaults — a `try/catch` away from
+ * any signal. So: if a row with this key exists under ANOTHER owner, say so.
+ *
+ * Same message covers the other case, deliberately: a `support-settings` row
+ * owned by a non-staff principal is exactly the poisoning attempt this scope was
+ * added to defeat, and the operator should hear about it. Once per cache window
+ * at most (the extra query only runs when nothing was found).
+ */
+async function warnOnForeignSettingsRow(payload: Payload, staff: string): Promise<void> {
+  if (warnedForeignSettingsRow.has(staff)) return
+  try {
+    const any = await dbFind(payload, 'payload-preferences', {
+      where: { key: { equals: PREF_KEY } },
+      limit: 1, depth: 0, overrideAccess: true,
+    })
+    if (any.docs.length === 0) return // fresh install — nothing to report
+    if (warnedForeignSettingsRow.size >= SETTINGS_CACHE_MAX) warnedForeignSettingsRow.clear()
+    warnedForeignSettingsRow.add(staff)
+    console.warn(
+      `[support] A "${PREF_KEY}" preference row exists but none is owned by the "${staff}" collection: ` +
+        'the plugin is running on its DEFAULT settings. Either the staff auth collection differs from ' +
+        '`admin.user`, or the row was written by a principal that is not staff — in which case it is ' +
+        'ignored on purpose.',
+    )
+  } catch {
+    /* diagnostic only — never let it change the outcome */
+  }
+}
+
+export async function readSupportSettings(
+  payload: Payload,
+  staffSlug?: string,
+): Promise<SupportSettings> {
+  return (await readSupportSettingsState(payload, staffSlug)).settings
 }
 
-async function readLegacyRoundRobin(payload: Payload): Promise<boolean> {
+async function readLegacyRoundRobin(payload: Payload, staff: string): Promise<boolean> {
   try {
     const prefs = await dbFind(payload, 'payload-preferences', {
-      where: { key: { equals: LEGACY_ROUND_ROBIN_KEY } },
+      where: { key: { equals: LEGACY_ROUND_ROBIN_KEY }, 'user.relationTo': { equals: staff } },
       limit: 1, depth: 0, overrideAccess: true,
     })
     if (prefs.docs.length > 0) {
@@ -137,11 +238,20 @@ async function readLegacyRoundRobin(payload: Payload): Promise<boolean> {
   return DEFAULT_TICKETING_FEATURES.roundRobin
 }
 
-export async function readUserPrefs(payload: Payload, userId: string | number): Promise<UserPrefs> {
+export async function readUserPrefs(
+  payload: Payload,
+  userId: string | number,
+  staffSlug?: string,
+): Promise<UserPrefs> {
   try {
     const key = `${USER_PREFS_KEY_PREFIX}-${userId}`
+    // Ids collide across auth collections: a support-client with id 7 would
+    // otherwise own `support-user-prefs-7`, the row read back for agent 7.
     const prefs = await dbFind(payload, 'payload-preferences', {
-      where: { key: { equals: key } },
+      where: {
+        key: { equals: key },
+        'user.relationTo': { equals: resolveStaffPrefSlug(payload, staffSlug) },
+      },
       limit: 1, depth: 0, overrideAccess: true,
     })
     if (prefs.docs.length > 0) {

package/src/utils/ticketAccess.ts

@@ -13,11 +13,24 @@ import { dbFind } from './db'
  *
  * Returns an empty array when the client has no accessible tickets — callers MUST
  * treat that as "deny" (e.g. filter on a sentinel id) rather than "allow all".
+ *
+ * `mode` selects which of the two scopes is wanted:
+ *  - `'read'` (default) — owned tickets + every ticket collaborated on, whatever
+ *    the role. This is the historical behaviour and what `access.read` needs.
+ *  - `'write'` — owned tickets + collaborated tickets whose row carries
+ *    `role === 'collaborator'`. The invitation endpoint offers two roles and the
+ *    invitation email promises "lecteur (consultation)" for `viewer`, but nothing
+ *    ever read the field back: a viewer could post into the thread and trigger the
+ *    whole notification chain. Rows with no explicit role are treated as viewers
+ *    (the collection's own `defaultValue`), i.e. read-only — fail closed.
  */
+export type TicketAccessMode = 'read' | 'write'
+
 export async function resolveAccessibleTicketIds(
   payload: Payload,
   slugs: CollectionSlugs,
   clientId: number | string,
+  mode: TicketAccessMode = 'read',
 ): Promise<Array<number | string>> {
   const ids = new Set<number | string>()
 
@@ -41,7 +54,9 @@ export async function resolveAccessibleTicketIds(
       overrideAccess: true,
     })
     for (const r of collab.docs) {
-      const row = r as { ticket?: number | string | { id?: number | string } }
+      const row = r as { ticket?: number | string | { id?: number | string }; role?: string }
+      // `viewer` (and any row without an explicit role) grants read only.
+      if (mode === 'write' && row.role !== 'collaborator') continue
       const tid = typeof row.ticket === 'object' ? row.ticket?.id : row.ticket
       if (tid !== undefined && tid !== null) ids.add(tid)
     }

package/src/utils/twoFactorChallenge.ts

@@ -0,0 +1,85 @@
+import { createHmac, timingSafeEqual } from 'crypto'
+
+/**
+ * Proof that the password step already succeeded for this email address.
+ *
+ * `POST /support/2fa {action:'send'}` used to accept an email and nothing else.
+ * Its only guard was a limiter keyed on that email — 3 sends per hour — so an
+ * ANONYMOUS caller who knew a victim's address (they circulate in ticket threads
+ * and email copies) could burn the quota in three requests and leave the victim
+ * unable to obtain the code their own login now demands. Since the OAuth path
+ * enforces 2FA as well, that was a complete, renewable account lockout, plus an
+ * outbound-email amplifier and a way to overwrite a code already in flight.
+ *
+ * The fix keys the consumable resource to something the ATTACKER cannot produce:
+ * a short-lived signature issued only by a successful password (or Google)
+ * authentication. Same HMAC-over-PAYLOAD_SECRET construction as the tracking
+ * pixel, no storage, no new dependency.
+ *
+ * Format: `<expiry-ms>.<hex hmac>`. The signature covers the email AND the
+ * expiry, so neither can be swapped without invalidating the token, and a token
+ * issued for one account is useless for another.
+ */
+
+/** Matches the 10-minute validity of the code the challenge lets you request. */
+export const TWO_FACTOR_CHALLENGE_TTL_MS = 10 * 60 * 1000
+
+function challengeSecret(): string {
+  const secret = process.env.PAYLOAD_SECRET
+  if (!secret) {
+    // Fail closed: the codes themselves are hashed with this secret, so 2FA is
+    // already inoperable without it — never fall back to a source-visible value.
+    throw new Error(
+      '[support][2fa] PAYLOAD_SECRET is not set — refusing to issue a 2FA challenge with an insecure fallback secret',
+    )
+  }
+  return secret
+}
+
+/**
+ * The address the challenge is signed over. Also the rate-limit key of both 2FA
+ * branches: signing over the normalized form while keying the limiter on the raw
+ * one would give a single challenge one budget PER CASING VARIANT.
+ */
+export function normalizeEmail(email: string): string {
+  return String(email).trim().toLowerCase()
+}
+
+function sign(email: string, expiresAt: number): string {
+  return createHmac('sha256', challengeSecret())
+    .update(`2fa-challenge:${normalizeEmail(email)}:${expiresAt}`)
+    .digest('hex')
+}
+
+/** Issued by the login endpoints once credentials have been verified. */
+export function issueTwoFactorChallenge(email: string, now: number = Date.now()): string {
+  const expiresAt = now + TWO_FACTOR_CHALLENGE_TTL_MS
+  return `${expiresAt}.${sign(email, expiresAt)}`
+}
+
+/** Constant-time; false on any malformed, expired or foreign token. */
+export function verifyTwoFactorChallenge(
+  email: unknown,
+  token: unknown,
+  now: number = Date.now(),
+): boolean {
+  if (typeof email !== 'string' || !email || typeof token !== 'string') return false
+  const separator = token.indexOf('.')
+  if (separator <= 0) return false
+
+  const expiresAt = Number(token.slice(0, separator))
+  if (!Number.isSafeInteger(expiresAt) || expiresAt <= now) return false
+
+  const received = token.slice(separator + 1)
+  if (!/^[0-9a-f]{64}$/i.test(received)) return false
+
+  let expected: string
+  try {
+    expected = sign(email, expiresAt)
+  } catch {
+    return false // no secret configured — fail closed
+  }
+  const a = Buffer.from(expected, 'hex')
+  const b = Buffer.from(received.toLowerCase(), 'hex')
+  return a.length === b.length && timingSafeEqual(a, b)
+}