@consilioweb/payload-support 4.0.0 → 5.0.0

package/dist/views/TicketInboxView/index.js

@@ -1,12 +1,14 @@
 import { jsx } from 'react/jsx-runtime';
 import { DefaultTemplate } from '@payloadcms/next/templates';
 import { redirect } from 'next/navigation';
+import { supportViewRedirectTarget } from '../shared/viewAccess.js';
 import { AdminErrorBoundary } from '../shared/ErrorBoundary.js';
 import { TicketInboxClient } from './client.js';
 
 const TicketInboxView = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult;
-  if (!req.user) redirect("/admin/login");
+  const redirectTo = supportViewRedirectTarget(initPageResult);
+  if (redirectTo) redirect(redirectTo);
   return /* @__PURE__ */ jsx(
     DefaultTemplate,
     {
@@ -16,7 +18,7 @@ const TicketInboxView = ({ initPageResult }) => {
       payload: req.payload,
       permissions: initPageResult.permissions,
       searchParams: {},
-      user: req.user,
+      user: req.user ?? void 0,
       visibleEntities,
       children: /* @__PURE__ */ jsx(AdminErrorBoundary, { viewName: "TicketInboxView", children: /* @__PURE__ */ jsx(TicketInboxClient, {}) })
     }

package/dist/views/TicketingSettingsView/index.js

@@ -1,14 +1,14 @@
 import { jsx } from 'react/jsx-runtime';
 import { DefaultTemplate } from '@payloadcms/next/templates';
 import { redirect } from 'next/navigation';
+import { supportViewRedirectTarget } from '../shared/viewAccess.js';
 import { AdminErrorBoundary } from '../shared/ErrorBoundary.js';
 import { TicketingSettingsClient } from './client.js';
 
 const TicketingSettingsView = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult;
-  if (!req.user) {
-    redirect("/admin/login");
-  }
+  const redirectTo = supportViewRedirectTarget(initPageResult);
+  if (redirectTo) redirect(redirectTo);
   return /* @__PURE__ */ jsx(
     DefaultTemplate,
     {
@@ -18,7 +18,7 @@ const TicketingSettingsView = ({ initPageResult }) => {
       payload: req.payload,
       permissions: initPageResult.permissions,
       searchParams: {},
-      user: req.user,
+      user: req.user ?? void 0,
       visibleEntities,
       children: /* @__PURE__ */ jsx(AdminErrorBoundary, { viewName: "TicketingSettingsView", children: /* @__PURE__ */ jsx(TicketingSettingsClient, {}) })
     }

package/dist/views/TimeDashboardView/index.js

@@ -1,14 +1,14 @@
 import { jsx } from 'react/jsx-runtime';
 import { DefaultTemplate } from '@payloadcms/next/templates';
 import { redirect } from 'next/navigation';
+import { supportViewRedirectTarget } from '../shared/viewAccess.js';
 import { AdminErrorBoundary } from '../shared/ErrorBoundary.js';
 import { TimeDashboardClient } from './client.js';
 
 const TimeDashboardView = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult;
-  if (!req.user) {
-    redirect("/admin/login");
-  }
+  const redirectTo = supportViewRedirectTarget(initPageResult);
+  if (redirectTo) redirect(redirectTo);
   return /* @__PURE__ */ jsx(
     DefaultTemplate,
     {
@@ -18,7 +18,7 @@ const TimeDashboardView = ({ initPageResult }) => {
       payload: req.payload,
       permissions: initPageResult.permissions,
       searchParams: {},
-      user: req.user,
+      user: req.user ?? void 0,
       visibleEntities,
       children: /* @__PURE__ */ jsx(AdminErrorBoundary, { viewName: "TimeDashboardView", children: /* @__PURE__ */ jsx(TimeDashboardClient, {}) })
     }

package/dist/views/shared/viewAccess.d.ts

@@ -0,0 +1,29 @@
+import type { AdminViewServerProps } from 'payload';
+/**
+ * Where a custom admin view must send a caller it refuses, or `null` to render.
+ *
+ * Payload does NOT gate custom admin views. `RootPage` skips its own
+ * `canAccessAdmin` redirect as soon as `isCustomAdminView()` matches, and that
+ * helper only compares the request path against the registered `view.path` —
+ * it reads no visibility flag, despite what its docblock claims. Authorising a
+ * custom view is therefore the view's own job, and every view registered by
+ * this plugin sits at a custom path (`/support/inbox`, `/support/ticket`, …).
+ *
+ * `!req.user` alone is not that check. A single `payload-token` cookie serves
+ * every auth collection of the host app, so an ordinary front-office account —
+ * a `customers`, `members` or `subscribers` signup — carries one on `/admin`
+ * routes too. Such a caller reached `DefaultTemplate` and received the admin
+ * chrome together with the client config Payload builds for any authenticated
+ * request: the field schema of every collection and global, `admin.hidden`
+ * ones included, plus an unfiltered `visibleEntities`.
+ *
+ * The ticket data itself never travelled — the client components fetch through
+ * `/api/support/*`, which `requireAdmin` has guarded all along — but the shape
+ * of the whole CMS did.
+ *
+ * The gate mirrors `requireAdmin` (utils/auth.ts): membership of the staff
+ * collection. It additionally honours `canAccessAdmin`, so an account the host
+ * disabled through its own `access.admin` is refused here too, and it fails
+ * closed on anything it cannot resolve.
+ */
+export declare function supportViewRedirectTarget(initPageResult: AdminViewServerProps['initPageResult']): string | null;

package/dist/views/shared/viewAccess.js

@@ -0,0 +1,24 @@
+import { formatAdminURL } from 'payload/shared';
+import { SUPPORT_STAFF_SLUG_CONFIG_KEY } from '../../utils/readSettings.js';
+
+function supportViewRedirectTarget(initPageResult) {
+  const req = initPageResult?.req;
+  const config = req?.payload?.config;
+  const adminRoute = config?.routes?.admin ?? "/admin";
+  const routes = config?.admin?.routes;
+  const to = (route, fallback) => formatAdminURL({ adminRoute, path: route ?? fallback });
+  if (!req?.user) return to(routes?.login, "/login");
+  if (initPageResult?.permissions?.canAccessAdmin === false) {
+    return to(routes?.unauthorized, "/unauthorized");
+  }
+  const custom = config?.custom;
+  const registered = custom?.[SUPPORT_STAFF_SLUG_CONFIG_KEY];
+  const staffSlug = typeof registered === "string" && registered || config?.admin?.user || null;
+  const collection = req.user.collection;
+  if (!staffSlug || !collection || collection !== staffSlug) {
+    return to(routes?.unauthorized, "/unauthorized");
+  }
+  return null;
+}
+
+export { supportViewRedirectTarget };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consilioweb/payload-support",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "Payload CMS plugin — professional support & ticketing system with AI, SLA, time tracking, live chat, and more",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -85,12 +85,13 @@
   "author": "ConsilioWEB <contact@consilioweb.fr> (https://consilioweb.fr)",
   "license": "MIT",
   "peerDependencies": {
-    "@payloadcms/next": "^3.37.0",
+    "@payloadcms/next": "^3.79.1",
     "lucide-react": ">=0.300.0",
     "next": "^15.2.9 || ^16.0.0",
-    "payload": "^3.37.0",
+    "payload": "^3.79.1",
     "react": "^19.0.0",
-    "react-dom": "^19.0.0"
+    "react-dom": "^19.0.0",
+    "@payloadcms/richtext-lexical": "^3.79.1"
   },
   "engines": {
     "node": ">=20.9.0"
@@ -100,32 +101,37 @@
     "provenance": true
   },
   "devDependencies": {
-    "@payloadcms/db-sqlite": "^3.86.0",
-    "@payloadcms/graphql": "^3.86.0",
-    "@payloadcms/next": "^3.86.0",
-    "@payloadcms/richtext-lexical": "^3.86.0",
-    "@payloadcms/translations": "^3.86.0",
-    "@payloadcms/ui": "^3.86.0",
-    "@playwright/test": "^1.49.0",
+    "@payloadcms/db-sqlite": "^3.88.0",
+    "@payloadcms/graphql": "^3.88.0",
+    "@payloadcms/next": "^3.88.0",
+    "@payloadcms/richtext-lexical": "^3.88.0",
+    "@payloadcms/translations": "^3.88.0",
+    "@payloadcms/ui": "^3.88.0",
+    "@playwright/test": "^1.63.0",
     "@types/pdfkit": "^0.17.6",
-    "@types/react": "^19.0.0",
+    "@types/react": "^19.2.18",
     "@types/sanitize-html": "^2.16.1",
     "@types/web-push": "^3.6.4",
     "esbuild-sass-plugin": "^3.7.0",
-    "next": "^16.2.9",
-    "payload": "^3.86.0",
-    "react": "^19.2.7",
-    "react-dom": "^19.2.7",
+    "next": "^16.3.4",
+    "payload": "^3.88.0",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
     "sharp": "0.34.5",
-    "tsup": "^8.0.0",
-    "typescript": "^5.5.0",
-    "vitest": "^4.1.9"
+    "tsup": "^8.5.1",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.11"
   },
   "dependencies": {
     "pdfkit": "^0.19.1",
-    "sanitize-html": "^2.17.5",
+    "sanitize-html": "^2.17.7",
     "web-push": "^3.6.7"
   },
+  "peerDependenciesMeta": {
+    "@payloadcms/richtext-lexical": {
+      "optional": true
+    }
+  },
   "scripts": {
     "build": "tsup && tsc -p tsconfig.types.json && node scripts/copy-subpath-types.mjs",
     "typecheck": "tsc --noEmit",

package/src/endpoints/auth-2fa.ts

@@ -4,7 +4,7 @@ import crypto, { createHmac } from 'crypto'
 import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { escapeHtml } from '../utils/emailTemplate'
 import { dbFind, dbUpdate } from '../utils/db'
-import { verifyTwoFactorChallenge } from '../utils/twoFactorChallenge'
+import { issueTwoFactorChallenge, normalizeEmail, verifyTwoFactorChallenge } from '../utils/twoFactorChallenge'
 
 function generateSecureCode(): string {
   const buf = crypto.randomBytes(4)
@@ -46,7 +46,35 @@ export function createAuth2faEndpoint(slugs: CollectionSlugs, store?: RateLimitS
           return Response.json({ error: 'Paramètres manquants' }, { status: 400 })
         }
 
-        const genericSendResponse = { success: true, message: 'Si un compte existe, un code a été envoyé.' }
+        // Both limiters are keyed on the SAME normalized address the challenge is
+        // signed over. Keyed on the raw input, one challenge bought one budget per
+        // casing variant of the address it was minted for.
+        const limiterKey = normalizeEmail(email)
+
+        /**
+         * A challenge is a 10-minute proof that the password step succeeded. It
+         * is refreshed on every accepted `send` so it outlives exactly as long as
+         * the code that send just minted: without this, a resend late in the
+         * window produced a code whose challenge expired before the user could
+         * type it, and `verify` answered 401 on a perfectly valid code.
+         *
+         * Returned on EVERY `send` reply, including the throttled and the
+         * unknown-address ones, so the response shape never tells the caller
+         * whether the account exists.
+         */
+        const sendResponse = (): Response => {
+          let refreshed: string | undefined
+          try {
+            refreshed = issueTwoFactorChallenge(email)
+          } catch {
+            // PAYLOAD_SECRET vanished mid-flight: answer without a challenge.
+          }
+          return Response.json({
+            success: true,
+            message: 'Si un compte existe, un code a été envoyé.',
+            ...(refreshed ? { challenge: refreshed } : {}),
+          })
+        }
 
         if (action === 'send') {
           // The challenge is checked BEFORE the limiter on purpose: the limiter
@@ -60,8 +88,8 @@ export function createAuth2faEndpoint(slugs: CollectionSlugs, store?: RateLimitS
             )
           }
 
-          if (await sendLimiter.check(email, req)) {
-            return Response.json(genericSendResponse)
+          if (await sendLimiter.check(limiterKey, req)) {
+            return sendResponse()
           }
 
           const clients = await dbFind(payload, slugs.supportClients, {
@@ -72,7 +100,7 @@ export function createAuth2faEndpoint(slugs: CollectionSlugs, store?: RateLimitS
           })
 
           if (clients.docs.length === 0) {
-            return Response.json(genericSendResponse)
+            return sendResponse()
           }
 
           const client = clients.docs[0] as any
@@ -101,15 +129,29 @@ export function createAuth2faEndpoint(slugs: CollectionSlugs, store?: RateLimitS
             </div>`,
           })
 
-          return Response.json(genericSendResponse)
+          return sendResponse()
         }
 
         if (action === 'verify') {
+          // Same proof, same reason, same position as `send` above: the limiter
+          // below is keyed on the VICTIM's email, so an unauthenticated caller
+          // able to reach it could burn the 5 attempts and leave the victim —
+          // holding the right password AND the right code — locked out of the
+          // only route that clears the 2FA gate, renewably, every 15 minutes.
+          // Only `send` got this guard in the previous pass; `verify` is the
+          // other half of the same door.
+          if (!verifyTwoFactorChallenge(email, challenge)) {
+            return Response.json(
+              { error: 'Authentification requise avant la vérification d\'un code.' },
+              { status: 401 },
+            )
+          }
+
           if (!code) {
             return Response.json({ error: 'Code manquant' }, { status: 400 })
           }
 
-          if (await verifyLimiter.check(email, req)) {
+          if (await verifyLimiter.check(limiterKey, req)) {
             return Response.json(
               { error: 'Trop de tentatives. Réessayez dans 15 minutes.' },
               { status: 429 },
@@ -159,7 +201,10 @@ export function createAuth2faEndpoint(slugs: CollectionSlugs, store?: RateLimitS
             overrideAccess: true,
           })
 
-          verifyLimiter.reset(email)
+          // `req` is REQUIRED here: PayloadRateLimitStore throws without it, and
+          // this reset runs after the marker was written — a throw turned a
+          // successful verification into a 500 for the caller.
+          await verifyLimiter.reset(limiterKey, req)
 
           return Response.json({ success: true, verified: true })
         }

package/src/endpoints/capabilities.ts

@@ -1,7 +1,7 @@
 import type { Endpoint, Where } from 'payload'
 import type { SupportCapabilities } from '../types'
 import type { CollectionSlugs } from '../utils/slugs'
-import { principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { clientIpRateKey, principalRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import {
   validateInboundEmailPayload,
   verifySecret,
@@ -21,9 +21,7 @@ export function createInboundEmailEndpoint(
       if (!verifySecret(req.headers.get(secretHeader), capability.secret)) {
         return Response.json({ error: 'Unauthorized' }, { status: 401 })
       }
-      const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim()
-        || req.headers.get('x-real-ip')
-        || 'unknown'
+      const ip = clientIpRateKey(req)
       if (await limiter.check(ip, req)) {
         return Response.json({ error: 'Rate limit exceeded' }, { status: 429 })
       }

package/src/endpoints/chatbot.ts

@@ -1,6 +1,6 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { clientIpRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbFind } from '../utils/db'
 
 
@@ -41,7 +41,7 @@ export function createChatbotEndpoint(
     method: 'post',
     handler: async (req) => {
       try {
-        const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || req.headers.get('x-real-ip') || 'unknown'
+        const ip = clientIpRateKey(req)
         if (await chatbotLimiter.check(ip, req)) {
           return Response.json({ error: 'Too many requests. Please wait a moment.' }, { status: 429 })
         }

package/src/endpoints/import-conversation.ts

@@ -1,6 +1,6 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { clientIpRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { readSupportSettings } from '../utils/readSettings'
 import { dbFind, dbCreate } from '../utils/db'
 import { verifySecret } from '../utils/webhookSecurity'
@@ -154,7 +154,7 @@ export function createImportConversationEndpoint(slugs: CollectionSlugs, store?:
           return Response.json({ error: 'Unauthorized' }, { status: 401 })
         }
 
-        const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || 'unknown'
+        const ip = clientIpRateKey(req)
         if (await importLimiter.check(ip, req)) {
           return Response.json({ error: 'Rate limit exceeded. Maximum 10 imports per hour.' }, { status: 429 })
         }

package/src/endpoints/login.ts

@@ -1,10 +1,13 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { clientIpRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbCreate } from '../utils/db'
 import { issueTwoFactorChallenge } from '../utils/twoFactorChallenge'
 
 
+/** Enough to identify a browser, short enough that a flood cannot fill the disk. */
+const MAX_LOGGED_USER_AGENT = 256
+
 /**
  * POST /api/support/login
  * Client login endpoint.
@@ -18,7 +21,12 @@ export function createLoginEndpoint(slugs: CollectionSlugs, store?: RateLimitSto
       // NOTE: x-forwarded-for is spoofable unless this app sits strictly behind a
       // trusted proxy that rewrites it. This IP rate-limit is a SECONDARY defense;
       // the primary brute-force control is Payload's account lock (maxLoginAttempts).
-      const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || req.headers.get('x-real-ip') || 'unknown'
+      //
+      // `clientIpRateKey` is what keeps a spoofed header from being more than a
+      // bucket choice: the raw header used to become the limiter key AND the
+      // `ipAddress` column below, so rotating it minted unbounded map entries in
+      // memory and unbounded rows on disk.
+      const ip = clientIpRateKey(req)
 
       if (await loginLimiter.check(ip, req)) {
         return Response.json(
@@ -35,7 +43,9 @@ export function createLoginEndpoint(slugs: CollectionSlugs, store?: RateLimitSto
         return Response.json({ error: 'Invalid JSON body' }, { status: 400 })
       }
       const { email, password } = body
-      const userAgent = req.headers.get('user-agent') || ''
+      // Persisted on every failed attempt, from an anonymous request: bounded so
+      // a flood cannot write tens of kilobytes per row into `auth-logs`.
+      const userAgent = (req.headers.get('user-agent') || '').slice(0, MAX_LOGGED_USER_AGENT)
 
       if (!email || !password) {
         return Response.json({ error: 'Email et mot de passe requis.' }, { status: 400 })

package/src/endpoints/push.ts

@@ -3,6 +3,7 @@ import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { dbFind, dbCreate, dbUpdate } from '../utils/db'
 import { getVapidPublicKey } from '../utils/push'
+import { validatePushEndpoint, WEBHOOK_URL_MESSAGES } from '../utils/urlSafety'
 
 /** GET /api/support/push/vapid-public-key — public key the browser uses to subscribe. */
 export function createVapidKeyEndpoint(): Endpoint {
@@ -30,7 +31,19 @@ export function createPushSubscribeEndpoint(slugs: CollectionSlugs): Endpoint {
         if (!endpoint || !p256dh || !auth) {
           return Response.json({ error: 'subscription invalide (endpoint + keys requis).' }, { status: 400 })
         }
-        const data = { user: req.user!.id, endpoint, p256dh, auth, userAgent: req.headers.get('user-agent') || '' }
+        // WRITE-time SSRF guard. `requireAdmin` above only proves the caller
+        // belongs to the staff collection — the very actor `utils/urlSafety`
+        // already models as hostile for webhook URLs — and `web-push` hands this
+        // string's host and port straight to `https.request`. Same guard, same
+        // reason, on the second field that steers an outbound request.
+        const endpointCheck = validatePushEndpoint(endpoint)
+        if (!endpointCheck.ok) {
+          return Response.json(
+            { error: WEBHOOK_URL_MESSAGES[endpointCheck.reason || 'invalid_url'] },
+            { status: 400 },
+          )
+        }
+        const data = { user: req.user!.id, endpoint, p256dh, auth, userAgent: (req.headers.get('user-agent') || '').slice(0, 256) }
         const existing = await dbFind(req.payload, slugs.pushSubscriptions, { where: { endpoint: { equals: endpoint } }, limit: 1, depth: 0, overrideAccess: true })
         if (existing.docs.length > 0) {
           await dbUpdate(req.payload, slugs.pushSubscriptions, { id: (existing.docs[0] as { id: number | string }).id, data, overrideAccess: true })

package/src/endpoints/statuses.ts

@@ -5,6 +5,18 @@ import { dbFind } from '../utils/db'
 /**
  * GET /api/support/statuses
  * Returns all ticket statuses sorted by sortOrder.
+ *
+ * The guard used to be `!!req.user`, which ANY authenticated principal
+ * satisfies — including a member of an unrelated auth collection of the host
+ * app (customers, members, subscribers created by public sign-up). Because the
+ * rows below are read with `overrideAccess: true`, that handed them the whole
+ * support workflow taxonomy — internal status names, private states, pipeline
+ * order — which `ticket-statuses.access.read` explicitly refuses them.
+ *
+ * The check below MIRRORS that ACL rather than replacing it: staff and
+ * support-clients, nobody else. `overrideAccess` stays, because the endpoint
+ * legitimately serves the full list to both, and the projection it returns is
+ * narrower than the documents themselves.
  */
 export function createStatusesEndpoint(slugs: CollectionSlugs): Endpoint {
   return {
@@ -18,6 +30,11 @@ export function createStatusesEndpoint(slugs: CollectionSlugs): Endpoint {
           return Response.json({ error: 'Unauthorized' }, { status: 401 })
         }
 
+        const collection = (req.user as { collection?: string }).collection
+        if (collection !== slugs.users && collection !== slugs.supportClients) {
+          return Response.json({ error: 'Forbidden' }, { status: 403 })
+        }
+
         const { docs } = await dbFind(payload, slugs.ticketStatuses, {
           sort: 'sortOrder',
           limit: 100,

package/src/portal/login/page.tsx

@@ -33,8 +33,11 @@ function SupportLoginContent() {
   // 2FA state
   const [needs2FA, setNeeds2FA] = useState(false)
   // Proof that the password step succeeded, minted by /support/login. Required
-  // by /support/2fa {action:'send'} — that endpoint no longer sends a code to
-  // anyone who merely knows the address.
+  // by BOTH branches of /support/2fa: `send` no longer mails a code to anyone
+  // who merely knows the address, and `verify` no longer lets such a caller
+  // burn the 5 verification attempts of the address they typed. Each accepted
+  // `send` returns a refreshed proof, so it stays valid as long as the code it
+  // just minted — keep the latest one.
   const [challenge, setChallenge] = useState('')
   const [twoFactorCode, setTwoFactorCode] = useState('')
   const [sending2FA, setSending2FA] = useState(false)
@@ -72,6 +75,8 @@ function SupportLoginContent() {
         })
 
         if (codeRes.ok) {
+          const codeData = await codeRes.json().catch(() => ({}))
+          if (codeData?.challenge) setChallenge(codeData.challenge)
           setNeeds2FA(true)
         } else {
           setError('Erreur lors de l\'envoi du code de vérification.')
@@ -98,13 +103,16 @@ function SupportLoginContent() {
       const verifyRes = await fetch('/api/support/2fa', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ action: 'verify', email, code: twoFactorCode }),
+        body: JSON.stringify({ action: 'verify', email, code: twoFactorCode, challenge }),
       })
 
       const verifyData = await verifyRes.json()
 
       if (!verifyRes.ok || !verifyData.verified) {
-        setError(verifyData.error || 'Code incorrect.')
+        // 401 = the proof of the password step expired (10 min), not a bad code.
+        setError(verifyRes.status === 401
+          ? 'Session expirée. Reconnectez-vous pour recevoir un nouveau code.'
+          : verifyData.error || 'Code incorrect.')
         return
       }
 
@@ -138,6 +146,8 @@ function SupportLoginContent() {
         body: JSON.stringify({ action: 'send', email, challenge }),
       })
       if (res.ok) {
+        const data = await res.json().catch(() => ({}))
+        if (data?.challenge) setChallenge(data.challenge)
         setError('')
       } else {
         // 401 = the challenge expired (10 min): the password must be re-entered.

package/src/utils/push.ts

@@ -2,6 +2,7 @@ import type { Payload } from 'payload'
 import type { CollectionSlugs } from './slugs'
 import { dbFind, dbDelete } from './db'
 import webpush from 'web-push'
+import { assertPublicHost, validatePushEndpoint } from './urlSafety'
 
 let configured = false
 function ensureVapid(): boolean {
@@ -43,6 +44,27 @@ export async function sendPushToUser(
     for (const s of subs.docs) {
       const row = s as { id: number | string; endpoint?: string; p256dh?: string; auth?: string }
       if (!row.endpoint || !row.p256dh || !row.auth) continue
+
+      // SEND-time SSRF guard, the second of the two layers `utils/urlSafety`
+      // describes. It is not redundant with the write-time check: it also covers
+      // rows persisted BEFORE that check existed, and a name whose DNS record is
+      // flipped to a private address after the row was accepted. `web-push`
+      // builds its own `https.request`, so `safeFetch` cannot wrap it — this is
+      // the layer that stands in for it.
+      //
+      // A blocked row is SKIPPED, never deleted: `assertPublicHost` fails closed
+      // on a resolver timeout, and a hiccup must not purge a legitimate agent's
+      // subscription. Only a real 404/410 from the push service prunes below.
+      const check = validatePushEndpoint(row.endpoint)
+      if (!check.ok || !check.url) {
+        console.warn('[support] Push endpoint refused (unsafe URL):', check.reason)
+        continue
+      }
+      if (!(await assertPublicHost(check.url.hostname))) {
+        console.warn('[support] Push endpoint refused (host resolves to a private address)')
+        continue
+      }
+
       try {
         await webpush.sendNotification(
           { endpoint: row.endpoint, keys: { p256dh: row.p256dh, auth: row.auth } },