@consilioweb/payload-support 4.0.0 → 5.0.0

package/dist/index.js

@@ -75,12 +75,43 @@ var DEFAULT_SLUGS = {
 function resolveSlugs(overrides) {
   return { ...DEFAULT_SLUGS, ...overrides };
 }
+var MAX_MEMORY_RATE_LIMIT_KEYS = 1e4;
 var MemoryRateLimitStore = class {
+  constructor(maxKeys = MAX_MEMORY_RATE_LIMIT_KEYS) {
+    this.maxKeys = maxKeys;
+  }
+  maxKeys;
   entries = /* @__PURE__ */ new Map();
+  /** Distinct keys currently held. Exposed so the ceiling can be asserted. */
+  get size() {
+    return this.entries.size;
+  }
+  /** Reclaims every window that has already closed. */
+  sweepExpired(now) {
+    for (const [key, entry] of this.entries) {
+      if (now > entry.resetAt) this.entries.delete(key);
+    }
+  }
+  /** Soonest-closing window first, so the ceiling drops the least useful entry. */
+  evictOldest() {
+    let oldestKey = null;
+    let oldestResetAt = Infinity;
+    for (const [key, entry] of this.entries) {
+      if (entry.resetAt < oldestResetAt) {
+        oldestResetAt = entry.resetAt;
+        oldestKey = key;
+      }
+    }
+    if (oldestKey !== null) this.entries.delete(oldestKey);
+  }
   async increment(key, windowMs) {
     const now = Date.now();
     const current = this.entries.get(key);
     const next = !current || now > current.resetAt ? { count: 1, resetAt: now + windowMs } : { ...current, count: current.count + 1 };
+    if (!current && this.entries.size >= this.maxKeys) {
+      this.sweepExpired(now);
+      if (this.entries.size >= this.maxKeys) this.evictOldest();
+    }
     this.entries.set(key, next);
     return next;
   }
@@ -164,6 +195,23 @@ function principalRateKey(user) {
   const collection = typeof user.collection === "string" && user.collection ? user.collection : "unknown";
   return `${collection}:${String(user.id)}`;
 }
+var MAX_IP_KEY_LENGTH = 45;
+var IPV4_PATTERN = /^(?:\d{1,3}\.){3}\d{1,3}$/;
+var IPV6_PATTERN = /^[0-9a-fA-F:.%]+$/;
+function clientIpRateKey(req) {
+  const candidate = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || req.headers.get("x-real-ip")?.trim() || "";
+  return normalizeIpKey(candidate);
+}
+function normalizeIpKey(candidate) {
+  if (!candidate || candidate.length > MAX_IP_KEY_LENGTH) return "unknown";
+  const host = candidate.startsWith("[") && candidate.endsWith("]") ? candidate.slice(1, -1) : candidate;
+  if (!host) return "unknown";
+  if (IPV4_PATTERN.test(host)) {
+    return host.split(".").every((octet) => Number(octet) <= 255) ? host : "unknown";
+  }
+  if (host.includes(":") && IPV6_PATTERN.test(host)) return host.toLowerCase();
+  return "unknown";
+}
 var RateLimiter = class {
   /**
    * @param namespace  Endpoint-scoped prefix for every key this limiter writes.
@@ -243,7 +291,7 @@ function createInboundEmailEndpoint(capability, store) {
       if (!verifySecret(req.headers.get(secretHeader), capability.secret)) {
         return Response.json({ error: "Unauthorized" }, { status: 401 });
       }
-      const ip = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || req.headers.get("x-real-ip") || "unknown";
+      const ip = clientIpRateKey(req);
       if (await limiter.check(ip, req)) {
         return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
       }
@@ -2800,6 +2848,10 @@ function createStatusesEndpoint(slugs) {
         if (!req.user) {
           return Response.json({ error: "Unauthorized" }, { status: 401 });
         }
+        const collection = req.user.collection;
+        if (collection !== slugs.users && collection !== slugs.supportClients) {
+          return Response.json({ error: "Forbidden" }, { status: 403 });
+        }
         const { docs } = await dbFind(payload, slugs.ticketStatuses, {
           sort: "sortOrder",
           limit: 100,
@@ -2990,7 +3042,7 @@ function createChatbotEndpoint(slugs, store, maxPerHour) {
     method: "post",
     handler: async (req) => {
       try {
-        const ip = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || req.headers.get("x-real-ip") || "unknown";
+        const ip = clientIpRateKey(req);
         if (await chatbotLimiter.check(ip, req)) {
           return Response.json({ error: "Too many requests. Please wait a moment." }, { status: 429 });
         }
@@ -5196,13 +5248,14 @@ function verifyTwoFactorChallenge(email, token, now = Date.now()) {
 }
 
 // src/endpoints/login.ts
+var MAX_LOGGED_USER_AGENT = 256;
 function createLoginEndpoint(slugs, store) {
   const loginLimiter = new RateLimiter(15 * 6e4, 10, store, "login");
   return {
     path: "/support/login",
     method: "post",
     handler: async (req) => {
-      const ip = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || req.headers.get("x-real-ip") || "unknown";
+      const ip = clientIpRateKey(req);
       if (await loginLimiter.check(ip, req)) {
         return Response.json(
           { error: "Trop de tentatives. R\xE9essayez dans quelques minutes." },
@@ -5217,7 +5270,7 @@ function createLoginEndpoint(slugs, store) {
         return Response.json({ error: "Invalid JSON body" }, { status: 400 });
       }
       const { email, password } = body;
-      const userAgent = req.headers.get("user-agent") || "";
+      const userAgent = (req.headers.get("user-agent") || "").slice(0, MAX_LOGGED_USER_AGENT);
       if (!email || !password) {
         return Response.json({ error: "Email et mot de passe requis." }, { status: 400 });
       }
@@ -5305,7 +5358,19 @@ function createAuth2faEndpoint(slugs, store) {
         if (!action || !email) {
           return Response.json({ error: "Param\xE8tres manquants" }, { status: 400 });
         }
-        const genericSendResponse = { success: true, message: "Si un compte existe, un code a \xE9t\xE9 envoy\xE9." };
+        const limiterKey = normalizeEmail(email);
+        const sendResponse = () => {
+          let refreshed;
+          try {
+            refreshed = issueTwoFactorChallenge(email);
+          } catch {
+          }
+          return Response.json({
+            success: true,
+            message: "Si un compte existe, un code a \xE9t\xE9 envoy\xE9.",
+            ...refreshed ? { challenge: refreshed } : {}
+          });
+        };
         if (action === "send") {
           if (!verifyTwoFactorChallenge(email, challenge)) {
             return Response.json(
@@ -5313,8 +5378,8 @@ function createAuth2faEndpoint(slugs, store) {
               { status: 401 }
             );
           }
-          if (await sendLimiter.check(email, req)) {
-            return Response.json(genericSendResponse);
+          if (await sendLimiter.check(limiterKey, req)) {
+            return sendResponse();
           }
           const clients = await dbFind(payload, slugs.supportClients, {
             where: { email: { equals: email } },
@@ -5323,7 +5388,7 @@ function createAuth2faEndpoint(slugs, store) {
             overrideAccess: true
           });
           if (clients.docs.length === 0) {
-            return Response.json(genericSendResponse);
+            return sendResponse();
           }
           const client = clients.docs[0];
           const plainCode = generateSecureCode();
@@ -5348,13 +5413,19 @@ function createAuth2faEndpoint(slugs, store) {
               <p style="font-size: 13px; color: #6b7280;">Ce code est valable 10 minutes.</p>
             </div>`
           });
-          return Response.json(genericSendResponse);
+          return sendResponse();
         }
         if (action === "verify") {
+          if (!verifyTwoFactorChallenge(email, challenge)) {
+            return Response.json(
+              { error: "Authentification requise avant la v\xE9rification d'un code." },
+              { status: 401 }
+            );
+          }
           if (!code) {
             return Response.json({ error: "Code manquant" }, { status: 400 });
           }
-          if (await verifyLimiter.check(email, req)) {
+          if (await verifyLimiter.check(limiterKey, req)) {
             return Response.json(
               { error: "Trop de tentatives. R\xE9essayez dans 15 minutes." },
               { status: 429 }
@@ -5395,7 +5466,7 @@ function createAuth2faEndpoint(slugs, store) {
             data: { twoFactorCode: "", twoFactorExpiry: "", twoFactorVerifiedAt: (/* @__PURE__ */ new Date()).toISOString() },
             overrideAccess: true
           });
-          verifyLimiter.reset(email);
+          await verifyLimiter.reset(limiterKey, req);
           return Response.json({ success: true, verified: true });
         }
         return Response.json({ error: "Action invalide" }, { status: 400 });
@@ -5957,7 +6028,7 @@ function createImportConversationEndpoint(slugs, store) {
         if (!isAuthed) {
           return Response.json({ error: "Unauthorized" }, { status: 401 });
         }
-        const ip = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || "unknown";
+        const ip = clientIpRateKey(req);
         if (await importLimiter.check(ip, req)) {
           return Response.json({ error: "Rate limit exceeded. Maximum 10 imports per hour." }, { status: 429 });
         }
@@ -6165,6 +6236,21 @@ var WEBHOOK_URL_MESSAGES = {
   scheme_not_allowed: "Seules les URL https:// sont accept\xE9es.",
   private_host: "Les adresses priv\xE9es, loopback et link-local sont interdites (SSRF)."
 };
+var MAX_PUSH_ENDPOINT_LENGTH = 2048;
+function validatePushEndpoint(raw) {
+  if (typeof raw !== "string" || !raw.trim() || raw.length > MAX_PUSH_ENDPOINT_LENGTH) {
+    return { ok: false, reason: "invalid_url" };
+  }
+  let url;
+  try {
+    url = new URL(raw.trim());
+  } catch {
+    return { ok: false, reason: "invalid_url" };
+  }
+  if (url.protocol !== "https:") return { ok: false, reason: "scheme_not_allowed" };
+  if (isBlockedHost(url.hostname)) return { ok: false, reason: "private_host" };
+  return { ok: true, url };
+}
 var LOOKUP_TIMEOUT_MS = 5e3;
 var LOOKUP_TIMED_OUT = /* @__PURE__ */ Symbol("lookup-timed-out");
 var NONEXISTENT_HOST_CODES = /* @__PURE__ */ new Set(["ENOTFOUND", "ENODATA", "NOTFOUND"]);
@@ -6620,6 +6706,15 @@ async function sendPushToUser(payload, slugs, userId, notification) {
     for (const s of subs.docs) {
       const row = s;
       if (!row.endpoint || !row.p256dh || !row.auth) continue;
+      const check = validatePushEndpoint(row.endpoint);
+      if (!check.ok || !check.url) {
+        console.warn("[support] Push endpoint refused (unsafe URL):", check.reason);
+        continue;
+      }
+      if (!await assertPublicHost(check.url.hostname)) {
+        console.warn("[support] Push endpoint refused (host resolves to a private address)");
+        continue;
+      }
       try {
         await webpush.sendNotification(
           { endpoint: row.endpoint, keys: { p256dh: row.p256dh, auth: row.auth } },
@@ -6670,7 +6765,14 @@ function createPushSubscribeEndpoint(slugs) {
         if (!endpoint || !p256dh || !auth) {
           return Response.json({ error: "subscription invalide (endpoint + keys requis)." }, { status: 400 });
         }
-        const data = { user: req.user.id, endpoint, p256dh, auth, userAgent: req.headers.get("user-agent") || "" };
+        const endpointCheck = validatePushEndpoint(endpoint);
+        if (!endpointCheck.ok) {
+          return Response.json(
+            { error: WEBHOOK_URL_MESSAGES[endpointCheck.reason || "invalid_url"] },
+            { status: 400 }
+          );
+        }
+        const data = { user: req.user.id, endpoint, p256dh, auth, userAgent: (req.headers.get("user-agent") || "").slice(0, 256) };
         const existing = await dbFind(req.payload, slugs.pushSubscriptions, { where: { endpoint: { equals: endpoint } }, limit: 1, depth: 0, overrideAccess: true });
         if (existing.docs.length > 0) {
           await dbUpdate(req.payload, slugs.pushSubscriptions, { id: existing.docs[0].id, data, overrideAccess: true });

package/dist/utils/db.d.ts

@@ -0,0 +1,34 @@
+import type { Payload } from 'payload';
+/**
+ * Thin typed wrappers around Payload data operations.
+ *
+ * Collection slugs are user-overridable config (`string`), not Payload's literal
+ * `CollectionSlug` union — so every call site otherwise needs `collection: X as any`.
+ * These helpers isolate that single unavoidable cast in ONE place, removing the
+ * ~200 scattered `as any` while staying an EXACT behavioral pass-through of options.
+ *
+ * Returns default to `any` (callers consume docs loosely, as before). Pass a type
+ * argument to opt into stronger typing: `dbFind<TicketData>(payload, slug, { ... })`.
+ */
+interface PaginatedResult<T> {
+    docs: T[];
+    totalDocs: number;
+    totalPages: number;
+    page?: number;
+    limit: number;
+    hasNextPage: boolean;
+    hasPrevPage: boolean;
+    nextPage?: number | null;
+    prevPage?: number | null;
+}
+export declare function dbFind<T = any>(payload: Payload, slug: string, options?: Record<string, unknown>): Promise<PaginatedResult<T>>;
+export declare function dbFindByID<T = any>(payload: Payload, slug: string, options: {
+    id: number | string;
+} & Record<string, unknown>): Promise<T>;
+export declare function dbCreate<T = any>(payload: Payload, slug: string, options: Record<string, unknown>): Promise<T>;
+export declare function dbUpdate<T = any>(payload: Payload, slug: string, options: Record<string, unknown>): Promise<T>;
+export declare function dbCount(payload: Payload, slug: string, options?: Record<string, unknown>): Promise<{
+    totalDocs: number;
+}>;
+export declare function dbDelete<T = any>(payload: Payload, slug: string, options: Record<string, unknown>): Promise<T>;
+export {};

package/dist/utils/readSettings.d.ts

@@ -0,0 +1,90 @@
+import type { Payload } from 'payload';
+import { type TicketingFeatures } from './features.js';
+export declare const SUPPORT_SETTINGS_PREF_KEY = "support-settings";
+/**
+ * Key under which `plugin.ts` publishes the resolved staff collection slug on
+ * `config.custom`. It is the ONE source of truth shared by the read path (here)
+ * and the write path (`requireAdmin` → `slugs.users`).
+ */
+export declare const SUPPORT_STAFF_SLUG_CONFIG_KEY = "supportStaffCollection";
+/**
+ * Owner scope for every `payload-preferences` row this plugin reads back.
+ *
+ * `payload-preferences` is writable by ANY authenticated principal, whatever its
+ * auth collection: Payload's `POST /api/payload-preferences/:key` handler only
+ * checks `!!req.user` before upserting the row. Reading a plugin-wide row by key
+ * alone therefore lets a front-office user (or a support-client) plant their own
+ * row and have the whole plugin read it — replyTo addresses, SLA escalation
+ * address, AI provider, feature flags.
+ *
+ * Every read below is constrained to `user.relationTo = <staff collection>`, the
+ * same scope the WRITE path already uses (endpoints/settings.ts, signature.ts,
+ * user-prefs.ts all upsert with `req.user.collection`, and all three are guarded
+ * by `requireAdmin`, which compares against `slugs.users`).
+ *
+ * TWO SOURCES OF TRUTH WERE THE BUG: this used to resolve the scope from
+ * `config.admin.user`, which Payload defaults to the FIRST auth collection of
+ * the app when the integrator did not declare it (config/sanitize.js). On a host
+ * whose first auth collection is the front office and whose staff collection is
+ * declared through `collectionSlugs.users`, the read scope named the front
+ * office while the write scope named the staff — and the poisoning this scope
+ * was added to defeat was open again. So the plugin now PUBLISHES the resolved
+ * `slugs.users` on `config.custom` (see plugin.ts) and reads it back here.
+ * `config.admin.user` remains a last-resort fallback for callers using these
+ * helpers outside of a plugin-built config; there is no plugin deployment in
+ * which it is consulted.
+ */
+export declare function resolveStaffPrefSlug(payload: Payload, staffSlug?: string): string;
+export interface SupportSettings {
+    email: {
+        fromAddress: string;
+        fromName: string;
+        replyToAddress: string;
+    };
+    ai: {
+        provider: string;
+        model: string;
+        enableSentiment: boolean;
+        enableSynthesis: boolean;
+        enableSuggestion: boolean;
+        enableRewrite: boolean;
+    };
+    sla: {
+        firstResponseMinutes: number;
+        resolutionMinutes: number;
+        businessHoursOnly: boolean;
+        escalationEmail: string;
+    };
+    autoClose: {
+        enabled: boolean;
+        daysBeforeClose: number;
+        reminderDaysBefore: number;
+    };
+    /** Ticketing feature flags — server-authoritative since 2.1 (used to be per-browser localStorage). */
+    features: TicketingFeatures;
+}
+export interface UserPrefs {
+    locale: 'fr' | 'en';
+    signature: string;
+}
+export declare const DEFAULT_SETTINGS: SupportSettings;
+export declare const DEFAULT_USER_PREFS: UserPrefs;
+export interface SupportSettingsState {
+    settings: SupportSettings;
+    /**
+     * False when the preference row carries no `features` object yet — a
+     * pre-2.1 install, or a fresh one. Clients use it to decide whether their
+     * legacy `localStorage` flags should seed the server.
+     */
+    featuresConfigured: boolean;
+}
+/** Invalidate the settings cache — call right after writing support settings. */
+export declare function invalidateSupportSettingsCache(): void;
+/**
+ * Merge a stored preference value onto the defaults.
+ * Exported for the settings endpoint, which must not re-implement the merge.
+ */
+export declare function mergeSupportSettings(stored: Partial<SupportSettings> | undefined | null, base?: SupportSettings): SupportSettings;
+export declare function readSupportSettingsState(payload: Payload, staffSlug?: string): Promise<SupportSettingsState>;
+export declare function readSupportSettings(payload: Payload, staffSlug?: string): Promise<SupportSettings>;
+export declare function readUserPrefs(payload: Payload, userId: string | number, staffSlug?: string): Promise<UserPrefs>;

package/dist/views/BillingView/index.js

@@ -1,14 +1,14 @@
 import { jsx } from 'react/jsx-runtime';
 import { DefaultTemplate } from '@payloadcms/next/templates';
 import { redirect } from 'next/navigation';
+import { supportViewRedirectTarget } from '../shared/viewAccess.js';
 import { AdminErrorBoundary } from '../shared/ErrorBoundary.js';
 import { BillingClient } from './client.js';
 
 const BillingView = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult;
-  if (!req.user) {
-    redirect("/admin/login");
-  }
+  const redirectTo = supportViewRedirectTarget(initPageResult);
+  if (redirectTo) redirect(redirectTo);
   return /* @__PURE__ */ jsx(
     DefaultTemplate,
     {
@@ -18,7 +18,7 @@ const BillingView = ({ initPageResult }) => {
       payload: req.payload,
       permissions: initPageResult.permissions,
       searchParams: {},
-      user: req.user,
+      user: req.user ?? void 0,
       visibleEntities,
       children: /* @__PURE__ */ jsx(AdminErrorBoundary, { viewName: "BillingView", children: /* @__PURE__ */ jsx(BillingClient, {}) })
     }

package/dist/views/ChatView/index.js

@@ -1,14 +1,14 @@
 import { jsx } from 'react/jsx-runtime';
 import { DefaultTemplate } from '@payloadcms/next/templates';
 import { redirect } from 'next/navigation';
+import { supportViewRedirectTarget } from '../shared/viewAccess.js';
 import { AdminErrorBoundary } from '../shared/ErrorBoundary.js';
 import { ChatViewClient } from './client.js';
 
 const ChatView = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult;
-  if (!req.user) {
-    redirect("/admin/login");
-  }
+  const redirectTo = supportViewRedirectTarget(initPageResult);
+  if (redirectTo) redirect(redirectTo);
   return /* @__PURE__ */ jsx(
     DefaultTemplate,
     {
@@ -18,7 +18,7 @@ const ChatView = ({ initPageResult }) => {
       payload: req.payload,
       permissions: initPageResult.permissions,
       searchParams: {},
-      user: req.user,
+      user: req.user ?? void 0,
       visibleEntities,
       children: /* @__PURE__ */ jsx(AdminErrorBoundary, { viewName: "ChatView", children: /* @__PURE__ */ jsx(ChatViewClient, {}) })
     }

package/dist/views/CrmView/index.js

@@ -1,14 +1,14 @@
 import { jsx } from 'react/jsx-runtime';
 import { DefaultTemplate } from '@payloadcms/next/templates';
 import { redirect } from 'next/navigation';
+import { supportViewRedirectTarget } from '../shared/viewAccess.js';
 import { AdminErrorBoundary } from '../shared/ErrorBoundary.js';
 import { CrmClient } from './client.js';
 
 const CrmView = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult;
-  if (!req.user) {
-    redirect("/admin/login");
-  }
+  const redirectTo = supportViewRedirectTarget(initPageResult);
+  if (redirectTo) redirect(redirectTo);
   return /* @__PURE__ */ jsx(
     DefaultTemplate,
     {
@@ -18,7 +18,7 @@ const CrmView = ({ initPageResult }) => {
       payload: req.payload,
       permissions: initPageResult.permissions,
       searchParams: {},
-      user: req.user,
+      user: req.user ?? void 0,
       visibleEntities,
       children: /* @__PURE__ */ jsx(AdminErrorBoundary, { viewName: "CrmView", children: /* @__PURE__ */ jsx(CrmClient, {}) })
     }

package/dist/views/EmailTrackingView/index.js

@@ -1,14 +1,14 @@
 import { jsx } from 'react/jsx-runtime';
 import { DefaultTemplate } from '@payloadcms/next/templates';
 import { redirect } from 'next/navigation';
+import { supportViewRedirectTarget } from '../shared/viewAccess.js';
 import { AdminErrorBoundary } from '../shared/ErrorBoundary.js';
 import { EmailTrackingClient } from './client.js';
 
 const EmailTrackingView = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult;
-  if (!req.user) {
-    redirect("/admin/login");
-  }
+  const redirectTo = supportViewRedirectTarget(initPageResult);
+  if (redirectTo) redirect(redirectTo);
   return /* @__PURE__ */ jsx(
     DefaultTemplate,
     {
@@ -18,7 +18,7 @@ const EmailTrackingView = ({ initPageResult }) => {
       payload: req.payload,
       permissions: initPageResult.permissions,
       searchParams: {},
-      user: req.user,
+      user: req.user ?? void 0,
       visibleEntities,
       children: /* @__PURE__ */ jsx(AdminErrorBoundary, { viewName: "EmailTrackingView", children: /* @__PURE__ */ jsx(EmailTrackingClient, {}) })
     }

package/dist/views/ImportConversationView/index.js

@@ -1,14 +1,14 @@
 import { jsx } from 'react/jsx-runtime';
 import { DefaultTemplate } from '@payloadcms/next/templates';
 import { redirect } from 'next/navigation';
+import { supportViewRedirectTarget } from '../shared/viewAccess.js';
 import { AdminErrorBoundary } from '../shared/ErrorBoundary.js';
 import { ImportConversationClient } from './client.js';
 
 const ImportConversationView = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult;
-  if (!req.user) {
-    redirect("/admin/login");
-  }
+  const redirectTo = supportViewRedirectTarget(initPageResult);
+  if (redirectTo) redirect(redirectTo);
   return /* @__PURE__ */ jsx(
     DefaultTemplate,
     {
@@ -18,7 +18,7 @@ const ImportConversationView = ({ initPageResult }) => {
       payload: req.payload,
       permissions: initPageResult.permissions,
       searchParams: {},
-      user: req.user,
+      user: req.user ?? void 0,
       visibleEntities,
       children: /* @__PURE__ */ jsx(AdminErrorBoundary, { viewName: "ImportConversationView", children: /* @__PURE__ */ jsx(ImportConversationClient, {}) })
     }

package/dist/views/LogsView/index.js

@@ -1,12 +1,14 @@
 import { jsx } from 'react/jsx-runtime';
 import { DefaultTemplate } from '@payloadcms/next/templates';
 import { redirect } from 'next/navigation';
+import { supportViewRedirectTarget } from '../shared/viewAccess.js';
 import { AdminErrorBoundary } from '../shared/ErrorBoundary.js';
 import { LogsClient } from './client.js';
 
 const LogsView = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult;
-  if (!req.user) redirect("/admin/login");
+  const redirectTo = supportViewRedirectTarget(initPageResult);
+  if (redirectTo) redirect(redirectTo);
   return /* @__PURE__ */ jsx(
     DefaultTemplate,
     {
@@ -16,7 +18,7 @@ const LogsView = ({ initPageResult }) => {
       payload: req.payload,
       permissions: initPageResult.permissions,
       searchParams: {},
-      user: req.user,
+      user: req.user ?? void 0,
       visibleEntities,
       children: /* @__PURE__ */ jsx(AdminErrorBoundary, { viewName: "LogsView", children: /* @__PURE__ */ jsx(LogsClient, {}) })
     }

package/dist/views/NewTicketView/index.js

@@ -1,12 +1,14 @@
 import { jsx } from 'react/jsx-runtime';
 import { DefaultTemplate } from '@payloadcms/next/templates';
 import { redirect } from 'next/navigation';
+import { supportViewRedirectTarget } from '../shared/viewAccess.js';
 import { AdminErrorBoundary } from '../shared/ErrorBoundary.js';
 import { NewTicketClient } from './client.js';
 
 const NewTicketView = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult;
-  if (!req.user) redirect("/admin/login");
+  const redirectTo = supportViewRedirectTarget(initPageResult);
+  if (redirectTo) redirect(redirectTo);
   return /* @__PURE__ */ jsx(
     DefaultTemplate,
     {
@@ -16,7 +18,7 @@ const NewTicketView = ({ initPageResult }) => {
       payload: req.payload,
       permissions: initPageResult.permissions,
       searchParams: {},
-      user: req.user,
+      user: req.user ?? void 0,
       visibleEntities,
       children: /* @__PURE__ */ jsx(AdminErrorBoundary, { viewName: "NewTicketView", children: /* @__PURE__ */ jsx(NewTicketClient, {}) })
     }

package/dist/views/PendingEmailsView/index.js

@@ -1,14 +1,14 @@
 import { jsx } from 'react/jsx-runtime';
 import { DefaultTemplate } from '@payloadcms/next/templates';
 import { redirect } from 'next/navigation';
+import { supportViewRedirectTarget } from '../shared/viewAccess.js';
 import { AdminErrorBoundary } from '../shared/ErrorBoundary.js';
 import { PendingEmailsClient } from './client.js';
 
 const PendingEmailsView = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult;
-  if (!req.user) {
-    redirect("/admin/login");
-  }
+  const redirectTo = supportViewRedirectTarget(initPageResult);
+  if (redirectTo) redirect(redirectTo);
   return /* @__PURE__ */ jsx(
     DefaultTemplate,
     {
@@ -18,7 +18,7 @@ const PendingEmailsView = ({ initPageResult }) => {
       payload: req.payload,
       permissions: initPageResult.permissions,
       searchParams: {},
-      user: req.user,
+      user: req.user ?? void 0,
       visibleEntities,
       children: /* @__PURE__ */ jsx(AdminErrorBoundary, { viewName: "PendingEmailsView", children: /* @__PURE__ */ jsx(PendingEmailsClient, {}) })
     }

package/dist/views/SupportDashboardView/index.js

@@ -1,14 +1,14 @@
 import { jsx } from 'react/jsx-runtime';
 import { DefaultTemplate } from '@payloadcms/next/templates';
 import { redirect } from 'next/navigation';
+import { supportViewRedirectTarget } from '../shared/viewAccess.js';
 import { AdminErrorBoundary } from '../shared/ErrorBoundary.js';
 import { SupportDashboardClient } from './client.js';
 
 const SupportDashboardView = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult;
-  if (!req.user) {
-    redirect("/admin/login");
-  }
+  const redirectTo = supportViewRedirectTarget(initPageResult);
+  if (redirectTo) redirect(redirectTo);
   return /* @__PURE__ */ jsx(
     DefaultTemplate,
     {
@@ -18,7 +18,7 @@ const SupportDashboardView = ({ initPageResult }) => {
       payload: req.payload,
       permissions: initPageResult.permissions,
       searchParams: {},
-      user: req.user,
+      user: req.user ?? void 0,
       visibleEntities,
       children: /* @__PURE__ */ jsx(AdminErrorBoundary, { viewName: "SupportDashboardView", children: /* @__PURE__ */ jsx(SupportDashboardClient, {}) })
     }

package/dist/views/TicketDetailView/index.js

@@ -1,14 +1,14 @@
 import { jsx } from 'react/jsx-runtime';
 import { DefaultTemplate } from '@payloadcms/next/templates';
 import { redirect } from 'next/navigation';
+import { supportViewRedirectTarget } from '../shared/viewAccess.js';
 import { AdminErrorBoundary } from '../shared/ErrorBoundary.js';
 import { TicketDetailClient } from './client.js';
 
 const TicketDetailView = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult;
-  if (!req.user) {
-    redirect("/admin/login");
-  }
+  const redirectTo = supportViewRedirectTarget(initPageResult);
+  if (redirectTo) redirect(redirectTo);
   return /* @__PURE__ */ jsx(
     DefaultTemplate,
     {
@@ -18,7 +18,7 @@ const TicketDetailView = ({ initPageResult }) => {
       payload: req.payload,
       permissions: initPageResult.permissions,
       searchParams: {},
-      user: req.user,
+      user: req.user ?? void 0,
       visibleEntities,
       children: /* @__PURE__ */ jsx(AdminErrorBoundary, { viewName: "TicketDetailView", children: /* @__PURE__ */ jsx(TicketDetailClient, {}) })
     }