@consilioweb/payload-support 4.0.0 → 5.0.0

package/README.md

@@ -4,7 +4,7 @@
 
 [![npm](https://img.shields.io/npm/v/@consilioweb/payload-support.svg)](https://www.npmjs.com/package/@consilioweb/payload-support)
 [![license](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
-[![payload](https://img.shields.io/badge/payload-%5E3.37-blue.svg)](https://payloadcms.com)
+[![payload](https://img.shields.io/badge/payload-%5E3.79.1-blue.svg)](https://payloadcms.com)
 
 ## About
 
@@ -81,12 +81,18 @@ pnpm add @consilioweb/payload-support
 **Peer dependencies** — all six are required, none is optional:
 
 ```bash
-pnpm add payload@^3.37.0 @payloadcms/next@^3.37.0 next@^15.2.9 react@^19 react-dom@^19 lucide-react@">=0.300.0"
+pnpm add payload@^3.79.1 @payloadcms/next@^3.79.1 next@^15.2.9 react@^19 react-dom@^19 lucide-react@">=0.300.0"
 ```
 
-- `payload@^3.37.0` — the Google OAuth endpoint imports `jwtSign` from the `payload` barrel, which
-  only exists from 3.37.0 on. Below that, the missing named export fails the whole
-  `payload.config.ts`, not just that endpoint.
+- `payload@^3.79.1` — the floor is a security floor, and it is stated as such rather than
+  dressed up as an API constraint. Below 3.79.1 Payload is vulnerable to a pre-authentication
+  account takeover (GHSA-hp5w-3hxx-vmwf) and to a SQL injection, so a range that admitted those
+  versions — the previous `^3.37.0` did — let an install satisfy this plugin's requirements while
+  remaining exploitable. The API surface allows lower: the Google OAuth endpoint imports `jwtSign`
+  and `getFieldsToSign` from the `payload` barrel, and a missing named export fails the whole
+  `payload.config.ts` rather than just that endpoint, but both have been exported since 3.37 and
+  every symbol this package imports was verified present in 3.79.1. CI builds and tests against
+  the 3.88 line; 3.79.1 to 3.87 are permitted on that verification, not on a test run.
 - `@payloadcms/next` and `next` — the 13 admin views are registered unless you pass
   `skipViews: true`, and each imports `DefaultTemplate` from `@payloadcms/next/templates` plus
   `next/navigation` / `next/link` statically. Both are already present in any Payload 3 admin app.
@@ -407,7 +413,7 @@ to stay enabled for the endpoint to be registered.
 |---|---|---|---|---|
 | `GET` | `/support/search` | staff | — | Global search over tickets, messages, clients and the knowledge base. |
 | `GET` | `/support/kb/search` | public | — | Knowledge-base search (used by the portal and the chatbot). |
-| `GET` | `/support/statuses` | authenticated | `customStatuses` | Ticket statuses, sorted. |
+| `GET` | `/support/statuses` | staff or support-client | `customStatuses` | Ticket statuses, sorted. Mirrors `ticket-statuses.access.read`: a principal from any other auth collection of your app gets 403, not the taxonomy. |
 | `POST` | `/support/bulk-action` | staff | `bulkActions` | Apply one action to many tickets. |
 | `POST` | `/support/merge-tickets` | staff | `merge` | Merge a source ticket into a target. |
 | `POST` | `/support/split-ticket` | staff | `splitTicket` | Extract a message into a new ticket. |
@@ -430,7 +436,7 @@ to stay enabled for the endpoint to be registered.
 | Method | Path | Access | Purpose |
 |---|---|---|---|
 | `POST` | `/support/login` | public, rate-limited | Portal password login. Sets an `HttpOnly` cookie; the JWT is never returned in JSON. |
-| `POST` | `/support/2fa` | public, rate-limited | Email second factor. `action: 'send'` requires the short-lived `challenge` returned by `/support/login` (or by the Google callback) alongside `requires2FA` — without it an anonymous caller could burn a victim's send quota and lock them out. `action: 'verify'` takes the code. |
+| `POST` | `/support/2fa` | public, rate-limited | Email second factor. **Both** `action: 'send'` and `action: 'verify'` require the short-lived `challenge` returned by `/support/login` (or by the Google callback) alongside `requires2FA`; without it, an anonymous caller who merely knew an address could burn the victim's send quota *or* their 5 verification attempts and lock them out of the only route that clears the 2FA gate. Every accepted `send` returns a refreshed `challenge` — keep the latest one and pass it to `verify` along with the code. |
 | `POST` | `/support/oauth/google` | public | Google sign-in, optionally restricted by `allowedEmailDomains`. |
 | `GET` | `/support/email-stats` | **staff**, rate-limited | Email pipeline aggregate. Was reachable by any authenticated session before 3.0.1. |
 | `GET` | `/support/export-data` | client | GDPR data export. |
@@ -495,7 +501,7 @@ await fetch('/api/support/ai-agent', {
 | `GET`/`POST` | `/support/settings` | staff | — | Read and write the support settings, including the runtime feature flags. |
 | `GET`/`POST` | `/support/round-robin-config` | staff | `roundRobin` | Read and toggle round-robin assignment. |
 | `GET` | `/support/push/vapid-public-key` | public | — | VAPID public key for the browser subscription. |
-| `POST` | `/support/push/subscribe` | staff | — | Register an agent's push subscription. |
+| `POST` | `/support/push/subscribe` | staff | — | Register an agent's push subscription. The `endpoint` must be an `https://` URL on a public host — private, loopback and link-local targets are refused with 400 (SSRF), at write time and again at send time. |
 | `GET` | `/support/auto-close` | `x-cron-secret` | `autoClose` | Remind, then close, inactive tickets. |
 | `POST` | `/support/process-snooze` | `x-cron-secret` | `snooze` | Wake snoozed tickets. |
 | `POST` | `/support/process-scheduled` | `x-cron-secret` | `scheduledReplies` | Release scheduled replies. |
@@ -614,16 +620,18 @@ import type { SupportPluginConfig, SupportFeatures } from '@consilioweb/payload-
 | Requirement | Range | Source |
 |---|---|---|
 | Node.js | `>=20.9.0` | `engines.node` |
-| Payload | `^3.37.0` | `peerDependencies.payload` |
-| `@payloadcms/next` | `^3.37.0` | `peerDependencies` |
+| Payload | `^3.79.1` | `peerDependencies.payload` |
+| `@payloadcms/next` | `^3.79.1` | `peerDependencies` |
 | Next.js | `^15.2.9 \|\| ^16.0.0` | `peerDependencies` |
 | React / React DOM | `^19.0.0` | `peerDependencies` |
 | `lucide-react` | `>=0.300.0` | `peerDependencies` |
 | `@anthropic-ai/sdk` | any recent version | Runtime-only, install it yourself if you use the AI features |
 | `@payloadcms/richtext-lexical` | any 3.x | Only if you mount the portal FAQ page |
 
-Installing on Node 18, React 18, Next 14 or Payload < 3.37 warns, and fails outright under
-`engine-strict` or a strict peer resolver.
+Installing on Node 18, React 18, Next 14 or Payload < 3.79.1 warns, and fails outright under
+`engine-strict` or a strict peer resolver. Payload below 3.79.1 is additionally vulnerable to a
+pre-authentication account takeover (GHSA-hp5w-3hxx-vmwf) and to a SQL injection: upgrade rather
+than force the install.
 
 ## Security
 
@@ -657,7 +665,9 @@ Installing on Node 18, React 18, Next 14 or Payload < 3.37 warns, and fails outr
 - **Bounded inbound email** payloads and attachments.
 - **Bounded outbound mail** — ticket transfers and collaborator invitations are capped per user over
   a long window, not only per ticket (a client can create tickets at will).
-- **SSRF-guarded outbound webhooks** — scheme, literal host, resolved address and every redirect hop.
+- **SSRF-guarded outbound requests** — scheme, literal host, resolved address and every redirect hop
+  for webhooks; scheme, literal host and resolved address for Web Push subscription endpoints, which
+  `web-push` would otherwise hand host and port straight to `https.request`.
 - **2FA also enforced on the Google OAuth path**, which mints its session outside `payload.login`
   and therefore outside the `beforeLogin` hook.
 
@@ -741,7 +751,7 @@ auto-migrated: generate and push it before deploying. See [Troubleshooting](#tro
    recomputing it — so a stale total keeps over-billing until something touches a time entry on that
    ticket.
 5. **Import `./views` and `./components/TicketConversation` with ESM** — their CJS builds are gone.
-6. Check your platform: Node 20.9+, React 19, Next 15.2.9+, Payload 3.37+, and install
+6. Check your platform: Node 20.9+, React 19, Next 15.2.9+, Payload 3.79.1+, and install
    `lucide-react` explicitly if you were relying on it being optional.
 
 ### 1.x → 2.0

package/dist/index.cjs

@@ -84,12 +84,43 @@ var DEFAULT_SLUGS = {
 function resolveSlugs(overrides) {
   return { ...DEFAULT_SLUGS, ...overrides };
 }
+var MAX_MEMORY_RATE_LIMIT_KEYS = 1e4;
 var MemoryRateLimitStore = class {
+  constructor(maxKeys = MAX_MEMORY_RATE_LIMIT_KEYS) {
+    this.maxKeys = maxKeys;
+  }
+  maxKeys;
   entries = /* @__PURE__ */ new Map();
+  /** Distinct keys currently held. Exposed so the ceiling can be asserted. */
+  get size() {
+    return this.entries.size;
+  }
+  /** Reclaims every window that has already closed. */
+  sweepExpired(now) {
+    for (const [key, entry] of this.entries) {
+      if (now > entry.resetAt) this.entries.delete(key);
+    }
+  }
+  /** Soonest-closing window first, so the ceiling drops the least useful entry. */
+  evictOldest() {
+    let oldestKey = null;
+    let oldestResetAt = Infinity;
+    for (const [key, entry] of this.entries) {
+      if (entry.resetAt < oldestResetAt) {
+        oldestResetAt = entry.resetAt;
+        oldestKey = key;
+      }
+    }
+    if (oldestKey !== null) this.entries.delete(oldestKey);
+  }
   async increment(key, windowMs) {
     const now = Date.now();
     const current = this.entries.get(key);
     const next = !current || now > current.resetAt ? { count: 1, resetAt: now + windowMs } : { ...current, count: current.count + 1 };
+    if (!current && this.entries.size >= this.maxKeys) {
+      this.sweepExpired(now);
+      if (this.entries.size >= this.maxKeys) this.evictOldest();
+    }
     this.entries.set(key, next);
     return next;
   }
@@ -173,6 +204,23 @@ function principalRateKey(user) {
   const collection = typeof user.collection === "string" && user.collection ? user.collection : "unknown";
   return `${collection}:${String(user.id)}`;
 }
+var MAX_IP_KEY_LENGTH = 45;
+var IPV4_PATTERN = /^(?:\d{1,3}\.){3}\d{1,3}$/;
+var IPV6_PATTERN = /^[0-9a-fA-F:.%]+$/;
+function clientIpRateKey(req) {
+  const candidate = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || req.headers.get("x-real-ip")?.trim() || "";
+  return normalizeIpKey(candidate);
+}
+function normalizeIpKey(candidate) {
+  if (!candidate || candidate.length > MAX_IP_KEY_LENGTH) return "unknown";
+  const host = candidate.startsWith("[") && candidate.endsWith("]") ? candidate.slice(1, -1) : candidate;
+  if (!host) return "unknown";
+  if (IPV4_PATTERN.test(host)) {
+    return host.split(".").every((octet) => Number(octet) <= 255) ? host : "unknown";
+  }
+  if (host.includes(":") && IPV6_PATTERN.test(host)) return host.toLowerCase();
+  return "unknown";
+}
 var RateLimiter = class {
   /**
    * @param namespace  Endpoint-scoped prefix for every key this limiter writes.
@@ -252,7 +300,7 @@ function createInboundEmailEndpoint(capability, store) {
       if (!verifySecret(req.headers.get(secretHeader), capability.secret)) {
         return Response.json({ error: "Unauthorized" }, { status: 401 });
       }
-      const ip = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || req.headers.get("x-real-ip") || "unknown";
+      const ip = clientIpRateKey(req);
       if (await limiter.check(ip, req)) {
         return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
       }
@@ -2809,6 +2857,10 @@ function createStatusesEndpoint(slugs) {
         if (!req.user) {
           return Response.json({ error: "Unauthorized" }, { status: 401 });
         }
+        const collection = req.user.collection;
+        if (collection !== slugs.users && collection !== slugs.supportClients) {
+          return Response.json({ error: "Forbidden" }, { status: 403 });
+        }
         const { docs } = await dbFind(payload, slugs.ticketStatuses, {
           sort: "sortOrder",
           limit: 100,
@@ -2999,7 +3051,7 @@ function createChatbotEndpoint(slugs, store, maxPerHour) {
     method: "post",
     handler: async (req) => {
       try {
-        const ip = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || req.headers.get("x-real-ip") || "unknown";
+        const ip = clientIpRateKey(req);
         if (await chatbotLimiter.check(ip, req)) {
           return Response.json({ error: "Too many requests. Please wait a moment." }, { status: 429 });
         }
@@ -5205,13 +5257,14 @@ function verifyTwoFactorChallenge(email, token, now = Date.now()) {
 }
 
 // src/endpoints/login.ts
+var MAX_LOGGED_USER_AGENT = 256;
 function createLoginEndpoint(slugs, store) {
   const loginLimiter = new RateLimiter(15 * 6e4, 10, store, "login");
   return {
     path: "/support/login",
     method: "post",
     handler: async (req) => {
-      const ip = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || req.headers.get("x-real-ip") || "unknown";
+      const ip = clientIpRateKey(req);
       if (await loginLimiter.check(ip, req)) {
         return Response.json(
           { error: "Trop de tentatives. R\xE9essayez dans quelques minutes." },
@@ -5226,7 +5279,7 @@ function createLoginEndpoint(slugs, store) {
         return Response.json({ error: "Invalid JSON body" }, { status: 400 });
       }
       const { email, password } = body;
-      const userAgent = req.headers.get("user-agent") || "";
+      const userAgent = (req.headers.get("user-agent") || "").slice(0, MAX_LOGGED_USER_AGENT);
       if (!email || !password) {
         return Response.json({ error: "Email et mot de passe requis." }, { status: 400 });
       }
@@ -5314,7 +5367,19 @@ function createAuth2faEndpoint(slugs, store) {
         if (!action || !email) {
           return Response.json({ error: "Param\xE8tres manquants" }, { status: 400 });
         }
-        const genericSendResponse = { success: true, message: "Si un compte existe, un code a \xE9t\xE9 envoy\xE9." };
+        const limiterKey = normalizeEmail(email);
+        const sendResponse = () => {
+          let refreshed;
+          try {
+            refreshed = issueTwoFactorChallenge(email);
+          } catch {
+          }
+          return Response.json({
+            success: true,
+            message: "Si un compte existe, un code a \xE9t\xE9 envoy\xE9.",
+            ...refreshed ? { challenge: refreshed } : {}
+          });
+        };
         if (action === "send") {
           if (!verifyTwoFactorChallenge(email, challenge)) {
             return Response.json(
@@ -5322,8 +5387,8 @@ function createAuth2faEndpoint(slugs, store) {
               { status: 401 }
             );
           }
-          if (await sendLimiter.check(email, req)) {
-            return Response.json(genericSendResponse);
+          if (await sendLimiter.check(limiterKey, req)) {
+            return sendResponse();
           }
           const clients = await dbFind(payload, slugs.supportClients, {
             where: { email: { equals: email } },
@@ -5332,7 +5397,7 @@ function createAuth2faEndpoint(slugs, store) {
             overrideAccess: true
           });
           if (clients.docs.length === 0) {
-            return Response.json(genericSendResponse);
+            return sendResponse();
           }
           const client = clients.docs[0];
           const plainCode = generateSecureCode();
@@ -5357,13 +5422,19 @@ function createAuth2faEndpoint(slugs, store) {
               <p style="font-size: 13px; color: #6b7280;">Ce code est valable 10 minutes.</p>
             </div>`
           });
-          return Response.json(genericSendResponse);
+          return sendResponse();
         }
         if (action === "verify") {
+          if (!verifyTwoFactorChallenge(email, challenge)) {
+            return Response.json(
+              { error: "Authentification requise avant la v\xE9rification d'un code." },
+              { status: 401 }
+            );
+          }
           if (!code) {
             return Response.json({ error: "Code manquant" }, { status: 400 });
           }
-          if (await verifyLimiter.check(email, req)) {
+          if (await verifyLimiter.check(limiterKey, req)) {
             return Response.json(
               { error: "Trop de tentatives. R\xE9essayez dans 15 minutes." },
               { status: 429 }
@@ -5404,7 +5475,7 @@ function createAuth2faEndpoint(slugs, store) {
             data: { twoFactorCode: "", twoFactorExpiry: "", twoFactorVerifiedAt: (/* @__PURE__ */ new Date()).toISOString() },
             overrideAccess: true
           });
-          verifyLimiter.reset(email);
+          await verifyLimiter.reset(limiterKey, req);
           return Response.json({ success: true, verified: true });
         }
         return Response.json({ error: "Action invalide" }, { status: 400 });
@@ -5966,7 +6037,7 @@ function createImportConversationEndpoint(slugs, store) {
         if (!isAuthed) {
           return Response.json({ error: "Unauthorized" }, { status: 401 });
         }
-        const ip = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || "unknown";
+        const ip = clientIpRateKey(req);
         if (await importLimiter.check(ip, req)) {
           return Response.json({ error: "Rate limit exceeded. Maximum 10 imports per hour." }, { status: 429 });
         }
@@ -6174,6 +6245,21 @@ var WEBHOOK_URL_MESSAGES = {
   scheme_not_allowed: "Seules les URL https:// sont accept\xE9es.",
   private_host: "Les adresses priv\xE9es, loopback et link-local sont interdites (SSRF)."
 };
+var MAX_PUSH_ENDPOINT_LENGTH = 2048;
+function validatePushEndpoint(raw) {
+  if (typeof raw !== "string" || !raw.trim() || raw.length > MAX_PUSH_ENDPOINT_LENGTH) {
+    return { ok: false, reason: "invalid_url" };
+  }
+  let url;
+  try {
+    url = new URL(raw.trim());
+  } catch {
+    return { ok: false, reason: "invalid_url" };
+  }
+  if (url.protocol !== "https:") return { ok: false, reason: "scheme_not_allowed" };
+  if (isBlockedHost(url.hostname)) return { ok: false, reason: "private_host" };
+  return { ok: true, url };
+}
 var LOOKUP_TIMEOUT_MS = 5e3;
 var LOOKUP_TIMED_OUT = /* @__PURE__ */ Symbol("lookup-timed-out");
 var NONEXISTENT_HOST_CODES = /* @__PURE__ */ new Set(["ENOTFOUND", "ENODATA", "NOTFOUND"]);
@@ -6629,6 +6715,15 @@ async function sendPushToUser(payload, slugs, userId, notification) {
     for (const s of subs.docs) {
       const row = s;
       if (!row.endpoint || !row.p256dh || !row.auth) continue;
+      const check = validatePushEndpoint(row.endpoint);
+      if (!check.ok || !check.url) {
+        console.warn("[support] Push endpoint refused (unsafe URL):", check.reason);
+        continue;
+      }
+      if (!await assertPublicHost(check.url.hostname)) {
+        console.warn("[support] Push endpoint refused (host resolves to a private address)");
+        continue;
+      }
       try {
         await webpush__default.default.sendNotification(
           { endpoint: row.endpoint, keys: { p256dh: row.p256dh, auth: row.auth } },
@@ -6679,7 +6774,14 @@ function createPushSubscribeEndpoint(slugs) {
         if (!endpoint || !p256dh || !auth) {
           return Response.json({ error: "subscription invalide (endpoint + keys requis)." }, { status: 400 });
         }
-        const data = { user: req.user.id, endpoint, p256dh, auth, userAgent: req.headers.get("user-agent") || "" };
+        const endpointCheck = validatePushEndpoint(endpoint);
+        if (!endpointCheck.ok) {
+          return Response.json(
+            { error: WEBHOOK_URL_MESSAGES[endpointCheck.reason || "invalid_url"] },
+            { status: 400 }
+          );
+        }
+        const data = { user: req.user.id, endpoint, p256dh, auth, userAgent: (req.headers.get("user-agent") || "").slice(0, 256) };
         const existing = await dbFind(req.payload, slugs.pushSubscriptions, { where: { endpoint: { equals: endpoint } }, limit: 1, depth: 0, overrideAccess: true });
         if (existing.docs.length > 0) {
           await dbUpdate(req.payload, slugs.pushSubscriptions, { id: existing.docs[0].id, data, overrideAccess: true });

package/dist/index.d.cts

@@ -11,9 +11,29 @@ interface RateLimitStore {
 /**
  * Process-local fallback store. Applications running more than one process
  * should provide a persistent RateLimitStore through the plugin options.
+ *
+ * BOUNDED, because the keys come from anonymous HTTP traffic: `/support/login`
+ * and `/support/chatbot` key their limiter on the client IP, and the IP is read
+ * from `x-forwarded-for`. A caller rotating that header wrote one PERMANENT
+ * entry per value into a map that had no ceiling, no expiry sweep and no
+ * eviction — only `reset()` ever removed anything, and the login path never
+ * calls it. Worse, every fresh key opened a fresh window, so the limiter did
+ * not even slow down the flood that was exhausting it.
+ *
+ * Two independent bounds, the same pair `endpoints/typing.ts` already applies
+ * to its own module-level map: `clientIpRateKey` caps the SIZE of a key, the
+ * ceiling below caps their NUMBER.
  */
 declare class MemoryRateLimitStore implements RateLimitStore {
+    private readonly maxKeys;
     private readonly entries;
+    constructor(maxKeys?: number);
+    /** Distinct keys currently held. Exposed so the ceiling can be asserted. */
+    get size(): number;
+    /** Reclaims every window that has already closed. */
+    private sweepExpired;
+    /** Soonest-closing window first, so the ceiling drops the least useful entry. */
+    private evictOldest;
     increment(key: string, windowMs: number): Promise<RateLimitEntry>;
     reset(key: string): Promise<void>;
 }

package/dist/index.d.ts

@@ -11,9 +11,29 @@ interface RateLimitStore {
 /**
  * Process-local fallback store. Applications running more than one process
  * should provide a persistent RateLimitStore through the plugin options.
+ *
+ * BOUNDED, because the keys come from anonymous HTTP traffic: `/support/login`
+ * and `/support/chatbot` key their limiter on the client IP, and the IP is read
+ * from `x-forwarded-for`. A caller rotating that header wrote one PERMANENT
+ * entry per value into a map that had no ceiling, no expiry sweep and no
+ * eviction — only `reset()` ever removed anything, and the login path never
+ * calls it. Worse, every fresh key opened a fresh window, so the limiter did
+ * not even slow down the flood that was exhausting it.
+ *
+ * Two independent bounds, the same pair `endpoints/typing.ts` already applies
+ * to its own module-level map: `clientIpRateKey` caps the SIZE of a key, the
+ * ceiling below caps their NUMBER.
  */
 declare class MemoryRateLimitStore implements RateLimitStore {
+    private readonly maxKeys;
     private readonly entries;
+    constructor(maxKeys?: number);
+    /** Distinct keys currently held. Exposed so the ceiling can be asserted. */
+    get size(): number;
+    /** Reclaims every window that has already closed. */
+    private sweepExpired;
+    /** Soonest-closing window first, so the ceiling drops the least useful entry. */
+    private evictOldest;
     increment(key: string, windowMs: number): Promise<RateLimitEntry>;
     reset(key: string): Promise<void>;
 }