@consilioweb/payload-support 4.0.0 → 6.0.0

package/dist/views/shared/viewAccess.js

@@ -0,0 +1,24 @@
+import { formatAdminURL } from 'payload/shared';
+import { SUPPORT_STAFF_SLUG_CONFIG_KEY } from '../../utils/readSettings.js';
+
+function supportViewRedirectTarget(initPageResult) {
+  const req = initPageResult?.req;
+  const config = req?.payload?.config;
+  const adminRoute = config?.routes?.admin ?? "/admin";
+  const routes = config?.admin?.routes;
+  const to = (route, fallback) => formatAdminURL({ adminRoute, path: route ?? fallback });
+  if (!req?.user) return to(routes?.login, "/login");
+  if (initPageResult?.permissions?.canAccessAdmin === false) {
+    return to(routes?.unauthorized, "/unauthorized");
+  }
+  const custom = config?.custom;
+  const registered = custom?.[SUPPORT_STAFF_SLUG_CONFIG_KEY];
+  const staffSlug = typeof registered === "string" && registered || config?.admin?.user || null;
+  const collection = req.user.collection;
+  if (!staffSlug || !collection || collection !== staffSlug) {
+    return to(routes?.unauthorized, "/unauthorized");
+  }
+  return null;
+}
+
+export { supportViewRedirectTarget };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consilioweb/payload-support",
-  "version": "4.0.0",
+  "version": "6.0.0",
   "description": "Payload CMS plugin — professional support & ticketing system with AI, SLA, time tracking, live chat, and more",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -40,12 +40,17 @@
       }
     }
   },
+  "bin": {
+    "support-uninstall": "./scripts/uninstall.mjs"
+  },
   "files": [
     "dist",
     "src",
     "!src/__tests__",
     "!src/**/*.test.ts",
     "!src/**/*.test.tsx",
+    "scripts/uninstall.mjs",
+    "scripts/uninstall-data.mjs",
     "README.md",
     "LICENSE"
   ],
@@ -85,12 +90,12 @@
   "author": "ConsilioWEB <contact@consilioweb.fr> (https://consilioweb.fr)",
   "license": "MIT",
   "peerDependencies": {
-    "@payloadcms/next": "^3.37.0",
-    "lucide-react": ">=0.300.0",
+    "@payloadcms/next": "^3.79.1",
     "next": "^15.2.9 || ^16.0.0",
-    "payload": "^3.37.0",
+    "payload": "^3.79.1",
     "react": "^19.0.0",
-    "react-dom": "^19.0.0"
+    "react-dom": "^19.0.0",
+    "@payloadcms/richtext-lexical": "^3.79.1"
   },
   "engines": {
     "node": ">=20.9.0"
@@ -100,32 +105,37 @@
     "provenance": true
   },
   "devDependencies": {
-    "@payloadcms/db-sqlite": "^3.86.0",
-    "@payloadcms/graphql": "^3.86.0",
-    "@payloadcms/next": "^3.86.0",
-    "@payloadcms/richtext-lexical": "^3.86.0",
-    "@payloadcms/translations": "^3.86.0",
-    "@payloadcms/ui": "^3.86.0",
-    "@playwright/test": "^1.49.0",
+    "@payloadcms/db-sqlite": "^3.88.0",
+    "@payloadcms/graphql": "^3.88.0",
+    "@payloadcms/next": "^3.88.0",
+    "@payloadcms/richtext-lexical": "^3.88.0",
+    "@payloadcms/translations": "^3.88.0",
+    "@payloadcms/ui": "^3.88.0",
+    "@playwright/test": "^1.63.0",
     "@types/pdfkit": "^0.17.6",
-    "@types/react": "^19.0.0",
+    "@types/react": "^19.2.18",
     "@types/sanitize-html": "^2.16.1",
     "@types/web-push": "^3.6.4",
     "esbuild-sass-plugin": "^3.7.0",
-    "next": "^16.2.9",
-    "payload": "^3.86.0",
-    "react": "^19.2.7",
-    "react-dom": "^19.2.7",
+    "next": "^16.3.4",
+    "payload": "^3.88.0",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
     "sharp": "0.34.5",
-    "tsup": "^8.0.0",
-    "typescript": "^5.5.0",
-    "vitest": "^4.1.9"
+    "tsup": "^8.5.1",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.11"
   },
   "dependencies": {
     "pdfkit": "^0.19.1",
-    "sanitize-html": "^2.17.5",
+    "sanitize-html": "^2.17.7",
     "web-push": "^3.6.7"
   },
+  "peerDependenciesMeta": {
+    "@payloadcms/richtext-lexical": {
+      "optional": true
+    }
+  },
   "scripts": {
     "build": "tsup && tsc -p tsconfig.types.json && node scripts/copy-subpath-types.mjs",
     "typecheck": "tsc --noEmit",

package/scripts/uninstall-data.mjs

@@ -0,0 +1,178 @@
+#!/usr/bin/env node
+
+/**
+ * Data half of `support-uninstall`. It is NOT meant to be run directly: it is
+ * spawned by `scripts/uninstall.mjs` through `payload run`, which is what puts
+ * the TypeScript loader and the environment in place so the host's
+ * `payload.config.ts` can be imported.
+ *
+ * Everything here goes through the Payload local API rather than a `sqlite3`
+ * binary. The plugin accepts custom collection slugs and runs on SQLite,
+ * PostgreSQL and MongoDB; raw SQL against hardcoded table names would only
+ * work on one of the three, and silently do nothing on the other two.
+ */
+
+import { getPayload } from 'payload'
+import { findConfig } from 'payload/node'
+import { pathToFileURL } from 'node:url'
+
+/**
+ * Deletion order matters: a child row whose `ticket` / `client` relationship is
+ * `required` blocks the delete of its parent (NOT NULL on the foreign key).
+ *
+ * These are the DEFAULT slugs. They are duplicated from `src/utils/slugs.ts`
+ * on purpose — importing `dist/index.js` here would pull pdfkit, web-push and
+ * sanitize-html into a script that only deletes rows. `src/__tests__/
+ * uninstallScript.test.ts` fails if the two lists ever drift apart.
+ */
+const ORDERED_SLUGS = [
+  // 1. Rows pointing at a ticket.
+  'ticket-collaborators',
+  'ticket-feedback',
+  'satisfaction-surveys',
+  'ticket-activity-log',
+  'ticket-messages',
+  'time-entries',
+  // 2. The tickets themselves.
+  'tickets',
+  // 3. Rows pointing at a client, or at nothing.
+  'chat-messages',
+  'pending-emails',
+  'client-summaries',
+  'notification-queue',
+  'push-subscriptions',
+  'canned-responses',
+  'knowledge-base',
+  'macros',
+  'automation-rules',
+  'ticket-statuses',
+  'webhook-endpoints',
+  'sla-policies',
+  'support-teams',
+  'auth-logs',
+  'email-logs',
+  'support-counters',
+  'support-rate-limits',
+  // 4. The portal accounts.
+  'support-clients',
+]
+
+/** `payload-preferences` keys the plugin writes. */
+const PREFERENCE_KEYS = {
+  exact: ['support-settings', 'support-round-robin'],
+  prefix: ['support-user-prefs'],
+}
+
+function parseArgs(argv) {
+  const confirm = argv.includes('--confirm')
+  const keepData = argv.includes('--keep-data')
+  const extra = argv.find((a) => a.startsWith('--extra-slugs='))
+  return {
+    confirm,
+    keepData,
+    extraSlugs: extra ? extra.slice('--extra-slugs='.length).split(',').map((s) => s.trim()).filter(Boolean) : [],
+  }
+}
+
+async function main() {
+  const { confirm, keepData, extraSlugs } = parseArgs(process.argv.slice(2))
+
+  const configPath = findConfig()
+  const imported = await import(pathToFileURL(configPath).toString())
+  const config = await (imported.default ?? imported)
+  const payload = await getPayload({ config })
+
+  const candidates = [...ORDERED_SLUGS, ...extraSlugs]
+  const present = candidates.filter((slug) => Boolean(payload.collections?.[slug]))
+  const absent = candidates.filter((slug) => !payload.collections?.[slug])
+
+  console.log('')
+  console.log(`  Config: ${configPath}`)
+  console.log(`  Mode:   ${confirm ? 'DELETE' : 'DRY RUN (nothing is written)'}`)
+  console.log('')
+
+  if (!keepData) {
+    console.log('  Collections found in this app:')
+    for (const slug of present) {
+      const { totalDocs } = await payload.count({ collection: slug, overrideAccess: true })
+      console.log(`    ${String(totalDocs).padStart(7)}  ${slug}`)
+    }
+    if (present.length === 0) {
+      console.log('    (none — nothing of this plugin is registered in this config)')
+    }
+    if (absent.length > 0) {
+      console.log('')
+      console.log(`  Not registered here, skipped: ${absent.join(', ')}`)
+      console.log('  If you renamed any of them through `collectionSlugs`, re-run with')
+      console.log('  --extra-slugs=your-slug,another-slug — this script cannot guess them.')
+    }
+  } else {
+    console.log('  --keep-data: no collection row will be deleted.')
+  }
+
+  console.log('')
+  console.log('  payload-preferences keys:')
+  for (const key of PREFERENCE_KEYS.exact) console.log(`    ${key}`)
+  for (const key of PREFERENCE_KEYS.prefix) console.log(`    ${key}* (one row per agent)`)
+
+  if (!confirm) {
+    console.log('')
+    console.log('  Nothing was deleted. Re-run with --confirm to apply.')
+    console.log('')
+    process.exit(0)
+  }
+
+  if (!keepData) {
+    console.log('')
+    for (const slug of present) {
+      const result = await payload.delete({
+        collection: slug,
+        where: { id: { exists: true } },
+        overrideAccess: true,
+      })
+      const deleted = Array.isArray(result?.docs) ? result.docs.length : 0
+      const failed = Array.isArray(result?.errors) ? result.errors.length : 0
+      console.log(`  deleted ${String(deleted).padStart(7)}  ${slug}${failed ? `  (${failed} failed)` : ''}`)
+      if (failed) {
+        console.log(`     ${JSON.stringify(result.errors.slice(0, 3))}`)
+      }
+    }
+  }
+
+  console.log('')
+  for (const key of PREFERENCE_KEYS.exact) {
+    const result = await payload.delete({
+      collection: 'payload-preferences',
+      where: { key: { equals: key } },
+      overrideAccess: true,
+    })
+    console.log(`  deleted ${String(result?.docs?.length ?? 0).padStart(7)}  payload-preferences/${key}`)
+  }
+  for (const key of PREFERENCE_KEYS.prefix) {
+    const result = await payload.delete({
+      collection: 'payload-preferences',
+      where: { key: { like: key } },
+      overrideAccess: true,
+    })
+    console.log(`  deleted ${String(result?.docs?.length ?? 0).padStart(7)}  payload-preferences/${key}*`)
+  }
+
+  console.log('')
+  console.log('  Left untouched, on purpose:')
+  console.log('    - your `media` collection. Attachments uploaded through the support')
+  console.log('      desk are ordinary uploads once their messages are gone, and this')
+  console.log('      script has no way to tell them apart from the rest of your media.')
+  console.log('      Review them yourself before deleting anything there.')
+  console.log('    - the tables. Rows are gone; run `payload migrate:create` and apply')
+  console.log('      the migration to drop the now-unused tables.')
+  console.log('')
+
+  process.exit(0)
+}
+
+main().catch((err) => {
+  console.error('')
+  console.error('  Uninstall failed:', err)
+  console.error('')
+  process.exit(1)
+})

package/scripts/uninstall.mjs

@@ -0,0 +1,184 @@
+#!/usr/bin/env node
+
+/**
+ * `support-uninstall` — removes this plugin from a host application.
+ *
+ * Contract, deliberately identical to the other ConsilioWEB plugins:
+ *   - DRY RUN by default. Nothing is written without `--confirm`.
+ *   - a detection gate: the destructive step refuses to run unless this project
+ *     really uses the plugin (a source file references it, or it is a declared
+ *     dependency). `--force-db` overrides it.
+ *   - `--keep-data` cleans the code and the preferences but keeps every row.
+ *
+ * Usage:
+ *   npx support-uninstall                       list what would be removed
+ *   npx support-uninstall --confirm             do it
+ *   npx support-uninstall --confirm --keep-data code only, rows kept
+ *   npx support-uninstall --confirm --force-db  delete rows even if undetected
+ *   npx support-uninstall --extra-slugs=a,b     add renamed collections
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { execSync, spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const HERE = path.dirname(fileURLToPath(import.meta.url))
+
+function readOwnPackageName() {
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(HERE, '..', 'package.json'), 'utf-8'))
+    if (typeof pkg.name === 'string' && pkg.name) return pkg.name
+  } catch {
+    // fall through
+  }
+  return '@consilioweb/payload-support'
+}
+
+const PACKAGE_NAME = readOwnPackageName()
+
+function detectPackageManager(dir) {
+  if (fs.existsSync(path.join(dir, 'pnpm-lock.yaml'))) return 'pnpm'
+  if (fs.existsSync(path.join(dir, 'yarn.lock'))) return 'yarn'
+  if (fs.existsSync(path.join(dir, 'bun.lockb')) || fs.existsSync(path.join(dir, 'bun.lock'))) return 'bun'
+  return 'npm'
+}
+
+function findSourceFiles(dir, acc = []) {
+  if (!fs.existsSync(dir)) return acc
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name)
+    if (entry.isDirectory()) {
+      if (entry.name === 'node_modules' || entry.name === '.next' || entry.name.startsWith('.')) continue
+      findSourceFiles(full, acc)
+    } else if (/\.(?:ts|tsx|js|jsx|mjs|cjs)$/.test(entry.name)) {
+      acc.push(full)
+    }
+  }
+  return acc
+}
+
+function isDeclaredDependency(projectDir) {
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(projectDir, 'package.json'), 'utf-8'))
+    return Boolean(
+      pkg.dependencies?.[PACKAGE_NAME]
+      || pkg.devDependencies?.[PACKAGE_NAME]
+      || pkg.peerDependencies?.[PACKAGE_NAME]
+      || pkg.optionalDependencies?.[PACKAGE_NAME],
+    )
+  } catch {
+    return false
+  }
+}
+
+function run(cmd, cwd) {
+  console.log(`  $ ${cmd}`)
+  try {
+    execSync(cmd, { cwd, stdio: 'inherit' })
+    return true
+  } catch {
+    return false
+  }
+}
+
+function main() {
+  const projectDir = process.env.INIT_CWD || process.cwd()
+  const argv = process.argv.slice(2)
+  const confirm = argv.includes('--confirm')
+  const keepData = argv.includes('--keep-data')
+  const forceDb = argv.includes('--force-db')
+  const extraSlugs = argv.find((a) => a.startsWith('--extra-slugs='))
+  const pm = detectPackageManager(projectDir)
+
+  console.log('')
+  console.log(`  ${PACKAGE_NAME} — uninstall`)
+  console.log('  ─────────────────────────────────────────────')
+  console.log(`  Project:         ${projectDir}`)
+  console.log(`  Package manager: ${pm}`)
+  console.log(`  Mode:            ${confirm ? 'APPLY' : 'DRY RUN — nothing will be written'}`)
+  if (keepData) console.log('  --keep-data:     rows will be kept')
+  console.log('')
+
+  // ── 1. Where is the plugin referenced? ───────────────────
+  const sourceFiles = findSourceFiles(path.join(projectDir, 'src'))
+  const referencing = sourceFiles.filter((file) => {
+    try {
+      return fs.readFileSync(file, 'utf-8').includes(PACKAGE_NAME)
+    } catch {
+      return false
+    }
+  })
+
+  console.log('  [1/3] Source references')
+  if (referencing.length === 0) {
+    console.log('    none found under src/')
+  } else {
+    for (const file of referencing) console.log(`    ${path.relative(projectDir, file)}`)
+    console.log('')
+    console.log('    Remove the `supportPlugin(...)` call and its import yourself.')
+    console.log('    This script never rewrites your source: the plugin call carries')
+    console.log('    your configuration, and a regex that guesses where it ends is how')
+    console.log('    a config file gets silently corrupted.')
+  }
+  console.log('')
+
+  const declared = isDeclaredDependency(projectDir)
+  const detected = referencing.length > 0 || declared || forceDb
+
+  // ── 2. Data ──────────────────────────────────────────────
+  console.log('  [2/3] Data')
+  if (!detected) {
+    console.log(`    ${PACKAGE_NAME} was not found in this project`)
+    console.log('    (no source reference, not in package.json dependencies).')
+    console.log('    Skipping the data step. Force it with --force-db.')
+    console.log('')
+  } else {
+    // The Payload local API needs the host's TypeScript config loaded, which is
+    // exactly what `payload run` sets up. Spawning it beats reimplementing a
+    // TypeScript loader here.
+    const dataScript = path.join(HERE, 'uninstall-data.mjs')
+    const args = ['payload', 'run', dataScript]
+    if (confirm) args.push('--confirm')
+    if (keepData) args.push('--keep-data')
+    if (extraSlugs) args.push(extraSlugs)
+
+    const result = spawnSync('npx', args, { cwd: projectDir, stdio: 'inherit' })
+    if (result.status !== 0) {
+      console.log('')
+      console.log('    Could not run the data step through `npx payload run`.')
+      console.log('    Run it by hand from your project root:')
+      console.log(`      npx payload run ${dataScript} ${confirm ? '--confirm' : ''}`)
+      console.log('')
+    }
+  }
+
+  // ── 3. The package ───────────────────────────────────────
+  console.log('  [3/3] Package')
+  if (!confirm) {
+    const removeCmd = pm === 'npm' ? 'npm uninstall' : `${pm} remove`
+    console.log(`    would run: ${removeCmd} ${PACKAGE_NAME}`)
+    console.log(`    would run: ${pm === 'npm' ? 'npx' : pm} payload generate:importmap`)
+    console.log('')
+    console.log('  Dry run finished. Nothing was changed. Re-run with --confirm.')
+    console.log('')
+    return
+  }
+
+  if (referencing.length > 0) {
+    console.log('    Skipped: the plugin is still imported by the files listed above.')
+    console.log('    Remove those references first, then re-run.')
+    console.log('')
+    return
+  }
+
+  const removeCmd = pm === 'npm' ? 'npm uninstall' : `${pm} remove`
+  run(`${removeCmd} ${PACKAGE_NAME}`, projectDir)
+  run(`${pm === 'npm' ? 'npx' : pm} payload generate:importmap`, projectDir)
+
+  console.log('')
+  console.log('  Done.')
+  console.log('')
+}
+
+main()

package/src/collections/Tickets.ts

@@ -525,9 +525,16 @@ function createCascadeDelete(slugs: CollectionSlugs): CollectionBeforeDeleteHook
   return async ({ id, req }) => {
     const collections = [slugs.ticketMessages, slugs.ticketActivityLog, slugs.timeEntries, slugs.satisfactionSurveys]
     for (const slug of collections) {
+      // `req` must be forwarded: it carries the ambient transaction. Without
+      // it these cascades open their own connection and, on SQLite, deadlock
+      // against the transaction that is deleting the ticket — the delete then
+      // fails silently (Payload collects per-document errors instead of
+      // throwing) and the children survive the parent.
+      if (!req.payload.collections?.[slug as never]) continue
       await dbDelete(req.payload, slug, {
         where: { ticket: { equals: id } },
         overrideAccess: true,
+        req,
       })
     }
   }

package/src/collections/TimeEntries.ts

@@ -1,13 +1,19 @@
-import type { CollectionConfig, CollectionAfterChangeHook, CollectionAfterDeleteHook } from 'payload'
+import type { CollectionConfig, CollectionAfterChangeHook, CollectionAfterDeleteHook, PayloadRequest } from 'payload'
 import type { Payload } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 
 // ─── Hooks ───────────────────────────────────────────────
 
+/**
+ * `req` is forwarded to every operation so the rollup joins the caller's
+ * transaction. Reading or writing outside it would see a stale total and, on
+ * SQLite, contend with the very transaction that triggered the hook.
+ */
 async function recalculateTicketTime(
   payload: Payload,
   slugs: CollectionSlugs,
   ticketId: number | string,
+  req?: PayloadRequest,
 ): Promise<void> {
   // Sum all time entries for this ticket, paginating to avoid loading all at once
   let totalMinutes = 0
@@ -23,6 +29,7 @@ async function recalculateTicketTime(
       depth: 0,
       overrideAccess: true,
       select: { duration: true },
+      req,
     })
 
     for (const entry of entries.docs) {
@@ -38,6 +45,7 @@ async function recalculateTicketTime(
     id: ticketId,
     data: { totalTimeMinutes: totalMinutes },
     overrideAccess: true,
+    req,
   })
 }
 
@@ -45,7 +53,7 @@ function createRecalculateTicketTime(slugs: CollectionSlugs): CollectionAfterCha
   return async ({ doc, req }) => {
     if (!doc.ticket) return
     const ticketId = typeof doc.ticket === 'object' ? doc.ticket.id : doc.ticket
-    await recalculateTicketTime(req.payload, slugs, ticketId)
+    await recalculateTicketTime(req.payload, slugs, ticketId, req)
   }
 }
 
@@ -59,7 +67,7 @@ function createRecalculateTicketTimeOnDelete(slugs: CollectionSlugs): Collection
     if (!doc?.ticket) return
     const ticketId = typeof doc.ticket === 'object' ? doc.ticket.id : doc.ticket
     try {
-      await recalculateTicketTime(req.payload, slugs, ticketId)
+      await recalculateTicketTime(req.payload, slugs, ticketId, req)
     } catch (err) {
       // The entry is already gone; never fail the delete on the rollup refresh.
       console.error('[support] Failed to recalculate ticket time after delete:', err)

package/src/components/RichTextEditor/index.tsx

@@ -287,7 +287,6 @@ export const RichTextEditor = forwardRef<RichTextEditorHandle, Props>(function R
             fontSize: '14px',
             lineHeight: 1.6,
             color: '#1f2937',
-            outline: 'none',
             overflowY: 'auto',
           }}
         />
@@ -300,6 +299,7 @@ export const RichTextEditor = forwardRef<RichTextEditorHandle, Props>(function R
           type="file"
           accept="image/*"
           multiple
+          aria-label="Inserer une image"
           onChange={handleFileChange}
           style={{ display: 'none' }}
         />

package/src/components/TicketConversation/RewriteDropdown.tsx

@@ -76,7 +76,7 @@ export const RewriteDropdown: React.FC<{
               onMouseLeave={(e) => { (e.target as HTMLElement).style.background = 'transparent' }}
             >
               <span style={{ fontSize: 12, fontWeight: 600, color: 'var(--theme-text, #111)' }}>{style.label}</span>
-              <span style={{ fontSize: 10, color: 'var(--theme-elevation-500, #6b7280)' }}>{style.desc}</span>
+              <span style={{ fontSize: 10, color: 'var(--theme-elevation-650, #6b7280)' }}>{style.desc}</span>
             </button>
           ))}
         </div>

package/src/components/TicketConversation/components/AISummaryPanel.tsx

@@ -39,6 +39,7 @@ export function AISummaryPanel({
   return (
     <div style={{ marginBottom: '14px' }}>
       <button
+        type="button"
         onClick={() => { setShowAiSummary(!showAiSummary); if (!showAiSummary && !aiSummary) handleAiGenerate() }}
         style={{
           ...s.ghostBtn('#17807c', false),
@@ -61,6 +62,7 @@ export function AISummaryPanel({
             </h4>
             <div style={{ display: 'flex', gap: '6px' }}>
               <button
+                type="button"
                 onClick={handleAiGenerate}
                 disabled={aiGenerating}
                 style={{ ...s.outlineBtn('#17807c', aiGenerating), fontSize: '11px', padding: '4px 10px' }}
@@ -69,6 +71,7 @@ export function AISummaryPanel({
               </button>
               {aiSummary && !aiGenerating && (
                 <button
+                  type="button"
                   onClick={handleAiSave}
                   disabled={aiSaving || aiSaved}
                   style={{ ...s.btn(aiSaved ? '#16a34a' : '#2563eb', aiSaving), fontSize: '11px', padding: '4px 10px' }}