@consilioweb/payload-support 4.0.0 → 5.0.0

package/src/utils/rateLimiter.ts

@@ -8,13 +8,59 @@ export interface RateLimitStore {
   reset(key: string, context?: unknown): Promise<void>
 }
 
+/**
+ * Hard ceiling on the number of distinct keys held at once, all endpoints
+ * combined. Sized for a busy install (thousands of client IPs inside one
+ * 15-minute window) while capping the map at a few hundred kilobytes.
+ */
+export const MAX_MEMORY_RATE_LIMIT_KEYS = 10_000
+
 /**
  * Process-local fallback store. Applications running more than one process
  * should provide a persistent RateLimitStore through the plugin options.
+ *
+ * BOUNDED, because the keys come from anonymous HTTP traffic: `/support/login`
+ * and `/support/chatbot` key their limiter on the client IP, and the IP is read
+ * from `x-forwarded-for`. A caller rotating that header wrote one PERMANENT
+ * entry per value into a map that had no ceiling, no expiry sweep and no
+ * eviction — only `reset()` ever removed anything, and the login path never
+ * calls it. Worse, every fresh key opened a fresh window, so the limiter did
+ * not even slow down the flood that was exhausting it.
+ *
+ * Two independent bounds, the same pair `endpoints/typing.ts` already applies
+ * to its own module-level map: `clientIpRateKey` caps the SIZE of a key, the
+ * ceiling below caps their NUMBER.
  */
 export class MemoryRateLimitStore implements RateLimitStore {
   private readonly entries = new Map<string, RateLimitEntry>()
 
+  constructor(private readonly maxKeys: number = MAX_MEMORY_RATE_LIMIT_KEYS) {}
+
+  /** Distinct keys currently held. Exposed so the ceiling can be asserted. */
+  get size(): number {
+    return this.entries.size
+  }
+
+  /** Reclaims every window that has already closed. */
+  private sweepExpired(now: number): void {
+    for (const [key, entry] of this.entries) {
+      if (now > entry.resetAt) this.entries.delete(key)
+    }
+  }
+
+  /** Soonest-closing window first, so the ceiling drops the least useful entry. */
+  private evictOldest(): void {
+    let oldestKey: string | null = null
+    let oldestResetAt = Infinity
+    for (const [key, entry] of this.entries) {
+      if (entry.resetAt < oldestResetAt) {
+        oldestResetAt = entry.resetAt
+        oldestKey = key
+      }
+    }
+    if (oldestKey !== null) this.entries.delete(oldestKey)
+  }
+
   async increment(key: string, windowMs: number): Promise<RateLimitEntry> {
     const now = Date.now()
     const current = this.entries.get(key)
@@ -22,6 +68,12 @@ export class MemoryRateLimitStore implements RateLimitStore {
       ? { count: 1, resetAt: now + windowMs }
       : { ...current, count: current.count + 1 }
 
+    // Only a key that is not already held can grow the map.
+    if (!current && this.entries.size >= this.maxKeys) {
+      this.sweepExpired(now)
+      if (this.entries.size >= this.maxKeys) this.evictOldest()
+    }
+
     this.entries.set(key, next)
     return next
   }
@@ -134,6 +186,52 @@ export function principalRateKey(
   return `${collection}:${String(user.id)}`
 }
 
+/**
+ * Longest textual IPv6 address, `xxxx:` * 7 + an embedded IPv4 literal.
+ * Nothing legitimate is longer; the cap is what makes the key bounded.
+ */
+const MAX_IP_KEY_LENGTH = 45
+/** Dotted-quad, or the hex/`::`/zone alphabet of an IPv6 literal. Shape only. */
+const IPV4_PATTERN = /^(?:\d{1,3}\.){3}\d{1,3}$/
+const IPV6_PATTERN = /^[0-9a-fA-F:.%]+$/
+
+/**
+ * Identity part of a rate-limit key for an ANONYMOUS caller.
+ *
+ * `x-forwarded-for` is attacker-controlled — the note in `endpoints/login.ts`
+ * has always said so, and Payload's account lock is what actually stops a
+ * brute-force. But the header was also used RAW as the limiter key, and that is
+ * a second, distinct problem: a key is a stored object. A caller rotating the
+ * header minted one unbounded, never-reclaimed entry per value; a value can be
+ * most of Node's 16 KB header budget. This validates the SHAPE and caps the
+ * LENGTH, so a forged header can still pick a bucket but can no longer invent
+ * an unbounded number of them, nor make any single one large.
+ *
+ * Anything that is not an IP literal falls back to the shared `unknown` bucket.
+ * That is the fail-closed direction: an install with no proxy already puts
+ * every caller there, and one behind a proxy never lands there legitimately.
+ */
+export function clientIpRateKey(req: { headers: { get(name: string): string | null } }): string {
+  const candidate = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim()
+    || req.headers.get('x-real-ip')?.trim()
+    || ''
+  return normalizeIpKey(candidate)
+}
+
+/** Exposed separately so a caller holding an already-extracted address can reuse it. */
+export function normalizeIpKey(candidate: string): string {
+  if (!candidate || candidate.length > MAX_IP_KEY_LENGTH) return 'unknown'
+  const host = candidate.startsWith('[') && candidate.endsWith(']')
+    ? candidate.slice(1, -1)
+    : candidate
+  if (!host) return 'unknown'
+  if (IPV4_PATTERN.test(host)) {
+    return host.split('.').every((octet) => Number(octet) <= 255) ? host : 'unknown'
+  }
+  if (host.includes(':') && IPV6_PATTERN.test(host)) return host.toLowerCase()
+  return 'unknown'
+}
+
 export class RateLimiter {
   private readonly store: RateLimitStore
   private readonly prefix: string

package/src/utils/twoFactorChallenge.ts

@@ -36,7 +36,12 @@ function challengeSecret(): string {
   return secret
 }
 
-function normalizeEmail(email: string): string {
+/**
+ * The address the challenge is signed over. Also the rate-limit key of both 2FA
+ * branches: signing over the normalized form while keying the limiter on the raw
+ * one would give a single challenge one budget PER CASING VARIANT.
+ */
+export function normalizeEmail(email: string): string {
   return String(email).trim().toLowerCase()
 }
 

package/src/utils/urlSafety.ts

@@ -2,7 +2,7 @@ import { lookup } from 'dns/promises'
 
 /**
  * SSRF guards for every URL the SERVER follows on behalf of a user-supplied
- * value (today: outbound webhook endpoints).
+ * value: outbound webhook endpoints, and Web Push subscription endpoints.
  *
  * `webhook-endpoints.url` is a plain `text` field with no validation, writable by
  * any member of the staff collection, and `_sendToEndpoint` used to `fetch()` it
@@ -144,6 +144,41 @@ export const WEBHOOK_URL_MESSAGES: Record<NonNullable<UrlValidationResult['reaso
   private_host: 'Les adresses privées, loopback et link-local sont interdites (SSRF).',
 }
 
+/**
+ * A `push-subscriptions.endpoint` is the same shape of hole as a webhook URL,
+ * from the same actor: `requireAdmin` only checks that the caller belongs to the
+ * staff collection, the field is plain `text` with no `validate`, no collection
+ * hook rewrites it, and `web-push` then hands the hostname and PORT straight to
+ * `https.request` with no allowlist of its own. Pointing it at an internal
+ * service turned every client reply into an outbound request of the attacker's
+ * choosing, with a 1-bit oracle: a 404/410 deletes the row, and staff can read
+ * `push-subscriptions` back.
+ *
+ * Stricter than `validateWebhookUrl` on two points, both because `web-push`
+ * behaves differently from `fetch`:
+ *  - https only, with NO `SUPPORT_ALLOW_INSECURE_WEBHOOKS` escape hatch —
+ *    `web-push` calls `https.request` whatever the scheme says, so an `http://`
+ *    endpoint is a broken subscription, not a dev convenience;
+ *  - an explicit length cap, because unlike a webhook URL this value arrives
+ *    from an HTTP body and is persisted verbatim.
+ */
+const MAX_PUSH_ENDPOINT_LENGTH = 2048
+
+export function validatePushEndpoint(raw: unknown): UrlValidationResult {
+  if (typeof raw !== 'string' || !raw.trim() || raw.length > MAX_PUSH_ENDPOINT_LENGTH) {
+    return { ok: false, reason: 'invalid_url' }
+  }
+  let url: URL
+  try {
+    url = new URL(raw.trim())
+  } catch {
+    return { ok: false, reason: 'invalid_url' }
+  }
+  if (url.protocol !== 'https:') return { ok: false, reason: 'scheme_not_allowed' }
+  if (isBlockedHost(url.hostname)) return { ok: false, reason: 'private_host' }
+  return { ok: true, url }
+}
+
 /**
  * Resolve the name and reject unless EVERY resolved address is public.
  *

package/src/views/BillingView/index.tsx

@@ -1,6 +1,7 @@
 import type { AdminViewServerProps } from 'payload'
 import { DefaultTemplate } from '@payloadcms/next/templates'
 import { redirect } from 'next/navigation'
+import { supportViewRedirectTarget } from '../shared/viewAccess.js'
 import React from 'react'
 import { AdminErrorBoundary } from '../shared/ErrorBoundary'
 import { BillingClient } from './client'
@@ -8,9 +9,8 @@ import { BillingClient } from './client'
 export const BillingView: React.FC<AdminViewServerProps> = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult
 
-  if (!req.user) {
-    redirect('/admin/login')
-  }
+  const redirectTo = supportViewRedirectTarget(initPageResult)
+  if (redirectTo) redirect(redirectTo)
 
   return (
     <DefaultTemplate
@@ -20,7 +20,7 @@ export const BillingView: React.FC<AdminViewServerProps> = ({ initPageResult })
       payload={req.payload}
       permissions={initPageResult.permissions}
       searchParams={{}}
-      user={req.user}
+      user={req.user ?? undefined}
       visibleEntities={visibleEntities}
     >
       <AdminErrorBoundary viewName="BillingView">

package/src/views/ChatView/index.tsx

@@ -1,6 +1,7 @@
 import type { AdminViewServerProps } from 'payload'
 import { DefaultTemplate } from '@payloadcms/next/templates'
 import { redirect } from 'next/navigation'
+import { supportViewRedirectTarget } from '../shared/viewAccess.js'
 import React from 'react'
 import { AdminErrorBoundary } from '../shared/ErrorBoundary'
 import { ChatViewClient } from './client'
@@ -8,9 +9,8 @@ import { ChatViewClient } from './client'
 export const ChatView: React.FC<AdminViewServerProps> = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult
 
-  if (!req.user) {
-    redirect('/admin/login')
-  }
+  const redirectTo = supportViewRedirectTarget(initPageResult)
+  if (redirectTo) redirect(redirectTo)
 
   return (
     <DefaultTemplate
@@ -20,7 +20,7 @@ export const ChatView: React.FC<AdminViewServerProps> = ({ initPageResult }) =>
       payload={req.payload}
       permissions={initPageResult.permissions}
       searchParams={{}}
-      user={req.user}
+      user={req.user ?? undefined}
       visibleEntities={visibleEntities}
     >
       <AdminErrorBoundary viewName="ChatView">

package/src/views/CrmView/index.tsx

@@ -1,6 +1,7 @@
 import type { AdminViewServerProps } from 'payload'
 import { DefaultTemplate } from '@payloadcms/next/templates'
 import { redirect } from 'next/navigation'
+import { supportViewRedirectTarget } from '../shared/viewAccess.js'
 import React from 'react'
 import { AdminErrorBoundary } from '../shared/ErrorBoundary'
 import { CrmClient } from './client'
@@ -8,9 +9,8 @@ import { CrmClient } from './client'
 export const CrmView: React.FC<AdminViewServerProps> = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult
 
-  if (!req.user) {
-    redirect('/admin/login')
-  }
+  const redirectTo = supportViewRedirectTarget(initPageResult)
+  if (redirectTo) redirect(redirectTo)
 
   return (
     <DefaultTemplate
@@ -20,7 +20,7 @@ export const CrmView: React.FC<AdminViewServerProps> = ({ initPageResult }) => {
       payload={req.payload}
       permissions={initPageResult.permissions}
       searchParams={{}}
-      user={req.user}
+      user={req.user ?? undefined}
       visibleEntities={visibleEntities}
     >
       <AdminErrorBoundary viewName="CrmView">

package/src/views/EmailTrackingView/index.tsx

@@ -1,6 +1,7 @@
 import type { AdminViewServerProps } from 'payload'
 import { DefaultTemplate } from '@payloadcms/next/templates'
 import { redirect } from 'next/navigation'
+import { supportViewRedirectTarget } from '../shared/viewAccess.js'
 import React from 'react'
 import { AdminErrorBoundary } from '../shared/ErrorBoundary'
 import { EmailTrackingClient } from './client'
@@ -8,9 +9,8 @@ import { EmailTrackingClient } from './client'
 export const EmailTrackingView: React.FC<AdminViewServerProps> = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult
 
-  if (!req.user) {
-    redirect('/admin/login')
-  }
+  const redirectTo = supportViewRedirectTarget(initPageResult)
+  if (redirectTo) redirect(redirectTo)
 
   return (
     <DefaultTemplate
@@ -20,7 +20,7 @@ export const EmailTrackingView: React.FC<AdminViewServerProps> = ({ initPageResu
       payload={req.payload}
       permissions={initPageResult.permissions}
       searchParams={{}}
-      user={req.user}
+      user={req.user ?? undefined}
       visibleEntities={visibleEntities}
     >
       <AdminErrorBoundary viewName="EmailTrackingView">

package/src/views/ImportConversationView/index.tsx

@@ -1,6 +1,7 @@
 import type { AdminViewServerProps } from 'payload'
 import { DefaultTemplate } from '@payloadcms/next/templates'
 import { redirect } from 'next/navigation'
+import { supportViewRedirectTarget } from '../shared/viewAccess.js'
 import React from 'react'
 import { AdminErrorBoundary } from '../shared/ErrorBoundary'
 import { ImportConversationClient } from './client'
@@ -8,9 +9,8 @@ import { ImportConversationClient } from './client'
 export const ImportConversationView: React.FC<AdminViewServerProps> = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult
 
-  if (!req.user) {
-    redirect('/admin/login')
-  }
+  const redirectTo = supportViewRedirectTarget(initPageResult)
+  if (redirectTo) redirect(redirectTo)
 
   return (
     <DefaultTemplate
@@ -20,7 +20,7 @@ export const ImportConversationView: React.FC<AdminViewServerProps> = ({ initPag
       payload={req.payload}
       permissions={initPageResult.permissions}
       searchParams={{}}
-      user={req.user}
+      user={req.user ?? undefined}
       visibleEntities={visibleEntities}
     >
       <AdminErrorBoundary viewName="ImportConversationView">

package/src/views/LogsView/index.tsx

@@ -1,13 +1,15 @@
 import type { AdminViewServerProps } from 'payload'
 import { DefaultTemplate } from '@payloadcms/next/templates'
 import { redirect } from 'next/navigation'
+import { supportViewRedirectTarget } from '../shared/viewAccess.js'
 import React from 'react'
 import { AdminErrorBoundary } from '../shared/ErrorBoundary'
 import { LogsClient } from './client'
 
 export const LogsView: React.FC<AdminViewServerProps> = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult
-  if (!req.user) redirect('/admin/login')
+  const redirectTo = supportViewRedirectTarget(initPageResult)
+  if (redirectTo) redirect(redirectTo)
 
   return (
     <DefaultTemplate
@@ -17,7 +19,7 @@ export const LogsView: React.FC<AdminViewServerProps> = ({ initPageResult }) =>
       payload={req.payload}
       permissions={initPageResult.permissions}
       searchParams={{}}
-      user={req.user}
+      user={req.user ?? undefined}
       visibleEntities={visibleEntities}
     >
       <AdminErrorBoundary viewName="LogsView">

package/src/views/NewTicketView/index.tsx

@@ -1,13 +1,15 @@
 import type { AdminViewServerProps } from 'payload'
 import { DefaultTemplate } from '@payloadcms/next/templates'
 import { redirect } from 'next/navigation'
+import { supportViewRedirectTarget } from '../shared/viewAccess.js'
 import React from 'react'
 import { AdminErrorBoundary } from '../shared/ErrorBoundary'
 import { NewTicketClient } from './client'
 
 export const NewTicketView: React.FC<AdminViewServerProps> = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult
-  if (!req.user) redirect('/admin/login')
+  const redirectTo = supportViewRedirectTarget(initPageResult)
+  if (redirectTo) redirect(redirectTo)
 
   return (
     <DefaultTemplate
@@ -17,7 +19,7 @@ export const NewTicketView: React.FC<AdminViewServerProps> = ({ initPageResult }
       payload={req.payload}
       permissions={initPageResult.permissions}
       searchParams={{}}
-      user={req.user}
+      user={req.user ?? undefined}
       visibleEntities={visibleEntities}
     >
       <AdminErrorBoundary viewName="NewTicketView">

package/src/views/PendingEmailsView/index.tsx

@@ -1,6 +1,7 @@
 import type { AdminViewServerProps } from 'payload'
 import { DefaultTemplate } from '@payloadcms/next/templates'
 import { redirect } from 'next/navigation'
+import { supportViewRedirectTarget } from '../shared/viewAccess.js'
 import React from 'react'
 import { AdminErrorBoundary } from '../shared/ErrorBoundary'
 import { PendingEmailsClient } from './client'
@@ -8,9 +9,8 @@ import { PendingEmailsClient } from './client'
 export const PendingEmailsView: React.FC<AdminViewServerProps> = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult
 
-  if (!req.user) {
-    redirect('/admin/login')
-  }
+  const redirectTo = supportViewRedirectTarget(initPageResult)
+  if (redirectTo) redirect(redirectTo)
 
   return (
     <DefaultTemplate
@@ -20,7 +20,7 @@ export const PendingEmailsView: React.FC<AdminViewServerProps> = ({ initPageResu
       payload={req.payload}
       permissions={initPageResult.permissions}
       searchParams={{}}
-      user={req.user}
+      user={req.user ?? undefined}
       visibleEntities={visibleEntities}
     >
       <AdminErrorBoundary viewName="PendingEmailsView">

package/src/views/SupportDashboardView/index.tsx

@@ -1,6 +1,7 @@
 import type { AdminViewServerProps } from 'payload'
 import { DefaultTemplate } from '@payloadcms/next/templates'
 import { redirect } from 'next/navigation'
+import { supportViewRedirectTarget } from '../shared/viewAccess.js'
 import React from 'react'
 import { AdminErrorBoundary } from '../shared/ErrorBoundary'
 import { SupportDashboardClient } from './client'
@@ -8,9 +9,8 @@ import { SupportDashboardClient } from './client'
 export const SupportDashboardView: React.FC<AdminViewServerProps> = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult
 
-  if (!req.user) {
-    redirect('/admin/login')
-  }
+  const redirectTo = supportViewRedirectTarget(initPageResult)
+  if (redirectTo) redirect(redirectTo)
 
   return (
     <DefaultTemplate
@@ -20,7 +20,7 @@ export const SupportDashboardView: React.FC<AdminViewServerProps> = ({ initPageR
       payload={req.payload}
       permissions={initPageResult.permissions}
       searchParams={{}}
-      user={req.user}
+      user={req.user ?? undefined}
       visibleEntities={visibleEntities}
     >
       <AdminErrorBoundary viewName="SupportDashboardView">

package/src/views/TicketDetailView/index.tsx

@@ -1,6 +1,7 @@
 import type { AdminViewServerProps } from 'payload'
 import { DefaultTemplate } from '@payloadcms/next/templates'
 import { redirect } from 'next/navigation'
+import { supportViewRedirectTarget } from '../shared/viewAccess.js'
 import React from 'react'
 import { AdminErrorBoundary } from '../shared/ErrorBoundary'
 import { TicketDetailClient } from './client'
@@ -8,9 +9,8 @@ import { TicketDetailClient } from './client'
 export const TicketDetailView: React.FC<AdminViewServerProps> = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult
 
-  if (!req.user) {
-    redirect('/admin/login')
-  }
+  const redirectTo = supportViewRedirectTarget(initPageResult)
+  if (redirectTo) redirect(redirectTo)
 
   return (
     <DefaultTemplate
@@ -20,7 +20,7 @@ export const TicketDetailView: React.FC<AdminViewServerProps> = ({ initPageResul
       payload={req.payload}
       permissions={initPageResult.permissions}
       searchParams={{}}
-      user={req.user}
+      user={req.user ?? undefined}
       visibleEntities={visibleEntities}
     >
       <AdminErrorBoundary viewName="TicketDetailView">

package/src/views/TicketInboxView/index.tsx

@@ -1,13 +1,15 @@
 import type { AdminViewServerProps } from 'payload'
 import { DefaultTemplate } from '@payloadcms/next/templates'
 import { redirect } from 'next/navigation'
+import { supportViewRedirectTarget } from '../shared/viewAccess.js'
 import React from 'react'
 import { AdminErrorBoundary } from '../shared/ErrorBoundary'
 import { TicketInboxClient } from './client'
 
 export const TicketInboxView: React.FC<AdminViewServerProps> = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult
-  if (!req.user) redirect('/admin/login')
+  const redirectTo = supportViewRedirectTarget(initPageResult)
+  if (redirectTo) redirect(redirectTo)
 
   return (
     <DefaultTemplate
@@ -17,7 +19,7 @@ export const TicketInboxView: React.FC<AdminViewServerProps> = ({ initPageResult
       payload={req.payload}
       permissions={initPageResult.permissions}
       searchParams={{}}
-      user={req.user}
+      user={req.user ?? undefined}
       visibleEntities={visibleEntities}
     >
       <AdminErrorBoundary viewName="TicketInboxView">

package/src/views/TicketingSettingsView/index.tsx

@@ -1,6 +1,7 @@
 import type { AdminViewServerProps } from 'payload'
 import { DefaultTemplate } from '@payloadcms/next/templates'
 import { redirect } from 'next/navigation'
+import { supportViewRedirectTarget } from '../shared/viewAccess.js'
 import React from 'react'
 import { AdminErrorBoundary } from '../shared/ErrorBoundary'
 import { TicketingSettingsClient } from './client'
@@ -8,9 +9,8 @@ import { TicketingSettingsClient } from './client'
 export const TicketingSettingsView: React.FC<AdminViewServerProps> = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult
 
-  if (!req.user) {
-    redirect('/admin/login')
-  }
+  const redirectTo = supportViewRedirectTarget(initPageResult)
+  if (redirectTo) redirect(redirectTo)
 
   return (
     <DefaultTemplate
@@ -20,7 +20,7 @@ export const TicketingSettingsView: React.FC<AdminViewServerProps> = ({ initPage
       payload={req.payload}
       permissions={initPageResult.permissions}
       searchParams={{}}
-      user={req.user}
+      user={req.user ?? undefined}
       visibleEntities={visibleEntities}
     >
       <AdminErrorBoundary viewName="TicketingSettingsView">

package/src/views/TimeDashboardView/index.tsx

@@ -1,6 +1,7 @@
 import type { AdminViewServerProps } from 'payload'
 import { DefaultTemplate } from '@payloadcms/next/templates'
 import { redirect } from 'next/navigation'
+import { supportViewRedirectTarget } from '../shared/viewAccess.js'
 import React from 'react'
 import { AdminErrorBoundary } from '../shared/ErrorBoundary'
 import { TimeDashboardClient } from './client'
@@ -8,9 +9,8 @@ import { TimeDashboardClient } from './client'
 export const TimeDashboardView: React.FC<AdminViewServerProps> = ({ initPageResult }) => {
   const { req, visibleEntities } = initPageResult
 
-  if (!req.user) {
-    redirect('/admin/login')
-  }
+  const redirectTo = supportViewRedirectTarget(initPageResult)
+  if (redirectTo) redirect(redirectTo)
 
   return (
     <DefaultTemplate
@@ -20,7 +20,7 @@ export const TimeDashboardView: React.FC<AdminViewServerProps> = ({ initPageResu
       payload={req.payload}
       permissions={initPageResult.permissions}
       searchParams={{}}
-      user={req.user}
+      user={req.user ?? undefined}
       visibleEntities={visibleEntities}
     >
       <AdminErrorBoundary viewName="TimeDashboardView">

package/src/views/shared/viewAccess.ts

@@ -0,0 +1,73 @@
+import type { AdminViewServerProps } from 'payload'
+import { formatAdminURL } from 'payload/shared'
+import { SUPPORT_STAFF_SLUG_CONFIG_KEY } from '../../utils/readSettings.js'
+
+/**
+ * Where a custom admin view must send a caller it refuses, or `null` to render.
+ *
+ * Payload does NOT gate custom admin views. `RootPage` skips its own
+ * `canAccessAdmin` redirect as soon as `isCustomAdminView()` matches, and that
+ * helper only compares the request path against the registered `view.path` —
+ * it reads no visibility flag, despite what its docblock claims. Authorising a
+ * custom view is therefore the view's own job, and every view registered by
+ * this plugin sits at a custom path (`/support/inbox`, `/support/ticket`, …).
+ *
+ * `!req.user` alone is not that check. A single `payload-token` cookie serves
+ * every auth collection of the host app, so an ordinary front-office account —
+ * a `customers`, `members` or `subscribers` signup — carries one on `/admin`
+ * routes too. Such a caller reached `DefaultTemplate` and received the admin
+ * chrome together with the client config Payload builds for any authenticated
+ * request: the field schema of every collection and global, `admin.hidden`
+ * ones included, plus an unfiltered `visibleEntities`.
+ *
+ * The ticket data itself never travelled — the client components fetch through
+ * `/api/support/*`, which `requireAdmin` has guarded all along — but the shape
+ * of the whole CMS did.
+ *
+ * The gate mirrors `requireAdmin` (utils/auth.ts): membership of the staff
+ * collection. It additionally honours `canAccessAdmin`, so an account the host
+ * disabled through its own `access.admin` is refused here too, and it fails
+ * closed on anything it cannot resolve.
+ */
+export function supportViewRedirectTarget(
+  initPageResult: AdminViewServerProps['initPageResult'],
+): string | null {
+  const req = initPageResult?.req
+  const config = req?.payload?.config
+  const adminRoute = config?.routes?.admin ?? '/admin'
+  const routes = config?.admin?.routes
+
+  const to = (route: string | undefined, fallback: string) =>
+    formatAdminURL({ adminRoute, path: (route ?? fallback) as `/${string}` })
+
+  if (!req?.user) return to(routes?.login, '/login')
+
+  // `sanitizePermissions` deletes the key when it is false, so an explicit
+  // `false` is a denial while `undefined` simply means "not computed here".
+  if (initPageResult?.permissions?.canAccessAdmin === false) {
+    return to(routes?.unauthorized, '/unauthorized')
+  }
+
+  // Same source of truth as the write path: the slug `plugin.ts` publishes on
+  // `config.custom`, NOT `config.admin.user` — Payload defaults the latter to
+  // the app's first auth collection, which on a host declaring a front office
+  // first is precisely the collection we are trying to keep out.
+  //
+  // `resolveStaffPrefSlug` is deliberately NOT used here. Its last-resort
+  // fallback is the literal `'users'`, which is the right call on a read path
+  // (a wrong scope returns no settings) and the wrong one on an authorisation
+  // path: it would admit whoever happens to sit in a collection named `users`
+  // on a host where neither source resolved. A gate with nothing to compare
+  // against refuses.
+  const custom = config?.custom as Record<string, unknown> | undefined
+  const registered = custom?.[SUPPORT_STAFF_SLUG_CONFIG_KEY]
+  const staffSlug =
+    (typeof registered === 'string' && registered) || config?.admin?.user || null
+
+  const collection = (req.user as { collection?: string }).collection
+  if (!staffSlug || !collection || collection !== staffSlug) {
+    return to(routes?.unauthorized, '/unauthorized')
+  }
+
+  return null
+}