@consilioweb/payload-support 4.0.0 → 6.0.0

package/src/endpoints/delete-account.ts

@@ -1,13 +1,37 @@
 import type { Endpoint } from 'payload'
+import { commitTransaction, initTransaction, killTransaction } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
+import { FIXED_SLUGS } from '../utils/slugs'
 import { requireClient, handleAuthError } from '../utils/auth'
 import { dbFind, dbDelete } from '../utils/db'
 
+interface AttachmentRow {
+  file?: number | string | { id?: number | string } | null
+}
+
+/** Collect the media ids referenced by an `attachments` array field. */
+function collectAttachmentIds(
+  docs: Array<{ attachments?: AttachmentRow[] | null }>,
+  into: Set<number | string>,
+): void {
+  for (const doc of docs) {
+    for (const attachment of doc.attachments ?? []) {
+      const file = attachment?.file
+      const id = file != null && typeof file === 'object' ? file.id : file
+      if (id != null) into.add(id)
+    }
+  }
+}
+
 /**
  * POST /api/support/delete-account
  * RGPD — Right to erasure (Article 17).
- * Allows a support client to request permanent deletion of their account.
- * Uses batch deletes via `where` clauses instead of sequential per-document deletion.
+ *
+ * Erases every row the plugin holds about the caller, and the uploaded files
+ * those rows point at. The whole sequence runs inside a single Payload
+ * transaction: a failure halfway through must not leave a half-deleted
+ * account, which would be worse than not deleting at all — the person would
+ * believe their data is gone while some of it is still readable.
  */
 export function createDeleteAccountEndpoint(slugs: CollectionSlugs): Endpoint {
   return {
@@ -29,7 +53,8 @@ export function createDeleteAccountEndpoint(slugs: CollectionSlugs): Endpoint {
           )
         }
 
-        // Verify password
+        // Verify password. Deliberately outside the transaction: it is a read,
+        // and `payload.login` writes nothing we would want to roll back.
         try {
           await payload.login({
             collection: slugs.supportClients as any,
@@ -43,59 +68,178 @@ export function createDeleteAccountEndpoint(slugs: CollectionSlugs): Endpoint {
         }
 
         const clientId = req.user.id
+        const clientEmail = req.user.email
 
-        // 1. Find all ticket IDs for this client
-        const tickets = await dbFind(payload, slugs.tickets, {
-          where: { client: { equals: clientId } },
-          limit: 10000,
-          depth: 0,
-          overrideAccess: true,
-          select: { id: true },
-        })
-
-        const ticketIds = tickets.docs.map((t) => t.id)
-
-        // 2. Batch delete related data using where clauses
-        if (ticketIds.length > 0) {
-          await dbDelete(payload, slugs.ticketMessages, {
-            where: { ticket: { in: ticketIds } },
-            overrideAccess: true,
-          })
+        // Several of the collections below only exist when the matching
+        // feature flag is on (chat, pendingEmails, ai, timeTracking,
+        // authLogs, emailTracking). Addressing one that was never registered
+        // throws, and inside a transaction that would roll the whole erasure
+        // back — so an install with chat disabled could never delete an
+        // account at all.
+        const isRegistered = (slug: string): boolean =>
+          Boolean((payload.collections as Record<string, unknown> | undefined)?.[slug])
 
-          await dbDelete(payload, slugs.ticketActivityLog, {
-            where: { ticket: { in: ticketIds } },
-            overrideAccess: true,
-          })
+        // No-op on adapters that do not expose `beginTransaction` — the SQLite
+        // adapter only does when the host passes `transactionOptions`. The
+        // sequence then runs unwrapped, exactly as it did before.
+        const startedTransaction = await initTransaction(req)
 
-          await dbDelete(payload, slugs.timeEntries, {
-            where: { ticket: { in: ticketIds } },
+        try {
+          // 1. Tickets owned by the client.
+          const tickets = await dbFind(payload, slugs.tickets, {
+            where: { client: { equals: clientId } },
+            limit: 10000,
+            depth: 0,
             overrideAccess: true,
+            select: { id: true },
+            req,
           })
 
-          // Delete all tickets
-          await dbDelete(payload, slugs.tickets, {
-            where: { client: { equals: clientId } },
+          const ticketIds = tickets.docs.map((t) => t.id)
+
+          // 2. Uploaded files. They live in the HOST's media collection, so
+          // their ids have to be gathered before the rows that reference them
+          // are gone.
+          const attachmentIds = new Set<number | string>()
+
+          if (ticketIds.length > 0) {
+            const messages = await dbFind<{ attachments?: AttachmentRow[] | null }>(
+              payload,
+              slugs.ticketMessages,
+              {
+                where: { ticket: { in: ticketIds } },
+                limit: 10000,
+                depth: 0,
+                overrideAccess: true,
+                req,
+              },
+            )
+            collectAttachmentIds(messages.docs, attachmentIds)
+          }
+
+          if (isRegistered(slugs.pendingEmails)) {
+            const pendingEmails = await dbFind<{ attachments?: AttachmentRow[] | null }>(
+              payload,
+              slugs.pendingEmails,
+              {
+                where: { client: { equals: clientId } },
+                limit: 10000,
+                depth: 0,
+                overrideAccess: true,
+                req,
+              },
+            )
+            collectAttachmentIds(pendingEmails.docs, attachmentIds)
+          }
+
+          // 3. Rows that point at one of those tickets. They must go BEFORE
+          // the tickets themselves: their `ticket` relationship is required,
+          // so the FK would fail on the ticket delete — and Payload's
+          // delete-many collects per-document errors instead of throwing, so
+          // the failure would be silent and the account would survive.
+          if (ticketIds.length > 0) {
+            for (const slug of [FIXED_SLUGS.ticketFeedback, FIXED_SLUGS.ticketCollaborators]) {
+              if (!isRegistered(slug)) continue
+              await dbDelete(payload, slug, {
+                where: {
+                  or: [
+                    { ticket: { in: ticketIds } },
+                    { client: { equals: clientId } },
+                  ],
+                },
+                overrideAccess: true,
+                req,
+              })
+            }
+          }
+
+          // 4. The tickets. Their own beforeDelete cascade takes the messages,
+          // the activity log, the time entries and the surveys with them.
+          if (ticketIds.length > 0) {
+            await dbDelete(payload, slugs.tickets, {
+              where: { client: { equals: clientId } },
+              overrideAccess: true,
+              req,
+            })
+          }
+
+          // 5. Rows keyed on the client id, whatever ticket they belong to.
+          for (const slug of [
+            slugs.satisfactionSurveys,
+            slugs.chatMessages,
+            slugs.notificationQueue,
+            slugs.pendingEmails,
+            FIXED_SLUGS.clientSummaries,
+            FIXED_SLUGS.ticketFeedback,
+          ]) {
+            if (!isRegistered(slug)) continue
+            await dbDelete(payload, slug, {
+              where: { client: { equals: clientId } },
+              overrideAccess: true,
+              req,
+            })
+          }
+
+          // Collaborator invitations can predate the account they point at, so
+          // they are also matched on the address alone.
+          if (isRegistered(FIXED_SLUGS.ticketCollaborators)) {
+            await dbDelete(payload, FIXED_SLUGS.ticketCollaborators, {
+              where: {
+                or: [
+                  { client: { equals: clientId } },
+                  ...(clientEmail ? [{ email: { equals: clientEmail } }] : []),
+                ],
+              },
+              overrideAccess: true,
+              req,
+            })
+          }
+
+          // 6. Journals, keyed on the address only.
+          if (clientEmail) {
+            if (isRegistered(slugs.authLogs)) {
+              await dbDelete(payload, slugs.authLogs, {
+                where: { email: { equals: clientEmail } },
+                overrideAccess: true,
+                req,
+              })
+            }
+
+            if (isRegistered(slugs.emailLogs)) {
+              await dbDelete(payload, slugs.emailLogs, {
+                where: {
+                  or: [
+                    { senderEmail: { equals: clientEmail } },
+                    { recipientEmail: { equals: clientEmail } },
+                  ],
+                },
+                overrideAccess: true,
+                req,
+              })
+            }
+          }
+
+          // 7. The uploaded files themselves.
+          for (const id of isRegistered(slugs.media) ? attachmentIds : []) {
+            await dbDelete(payload, slugs.media, {
+              id,
+              overrideAccess: true,
+              req,
+            })
+          }
+
+          // 8. The account.
+          await dbDelete(payload, slugs.supportClients, {
+            id: clientId,
             overrideAccess: true,
+            req,
           })
-        }
 
-        // 3. Batch delete satisfaction surveys
-        await dbDelete(payload, slugs.satisfactionSurveys, {
-          where: { client: { equals: clientId } },
-          overrideAccess: true,
-        })
-
-        // 4. Batch delete chat messages
-        await dbDelete(payload, slugs.chatMessages, {
-          where: { client: { equals: clientId } },
-          overrideAccess: true,
-        })
-
-        // 5. Delete the client account
-        await dbDelete(payload, slugs.supportClients, {
-          id: clientId,
-          overrideAccess: true,
-        })
+          if (startedTransaction) await commitTransaction(req)
+        } catch (err) {
+          if (startedTransaction) await killTransaction(req)
+          throw err
+        }
 
         const headers = new Headers({ 'Content-Type': 'application/json' })
         const secure = process.env.NODE_ENV === 'production'

package/src/endpoints/export-data.ts

@@ -1,11 +1,21 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
+import { FIXED_SLUGS } from '../utils/slugs'
 import { requireClient, handleAuthError } from '../utils/auth'
 import { dbFind, dbFindByID } from '../utils/db'
 
+const EMPTY = { docs: [] as any[] }
+
 /**
  * GET /api/support/export-data
  * RGPD Data Export — allows support clients to download all their personal data.
+ *
+ * The payload is split in two. `providedByYou` is what article 20
+ * (portability) covers: what the person or their correspondents typed.
+ * `derivedData` is what the plugin computed ABOUT them — the AI client
+ * summary. Article 20 does not cover derived data; article 15 (access) does,
+ * and article 17 (erasure) does too, which is why `delete-account` removes
+ * `client-summaries` as well. Merging the two sections would blur that.
  */
 export function createExportDataEndpoint(slugs: CollectionSlugs): Endpoint {
   return {
@@ -17,7 +27,20 @@ export function createExportDataEndpoint(slugs: CollectionSlugs): Endpoint {
 
         requireClient(req, slugs)
 
-        const [clientData, ticketsResult, messagesResult, surveysResult] = await Promise.all([
+        // Feature-flagged collections are not registered when their flag is
+        // off; addressing one that does not exist throws.
+        const isRegistered = (slug: string): boolean =>
+          Boolean((payload.collections as Record<string, unknown> | undefined)?.[slug])
+
+        const [
+          clientData,
+          ticketsResult,
+          messagesResult,
+          surveysResult,
+          chatResult,
+          feedbackResult,
+          summariesResult,
+        ] = await Promise.all([
           dbFindByID(payload, slugs.supportClients, {
             id: req.user.id,
             depth: 0,
@@ -44,12 +67,46 @@ export function createExportDataEndpoint(slugs: CollectionSlugs): Endpoint {
             depth: 0,
             overrideAccess: true,
           }),
+          isRegistered(slugs.chatMessages)
+            ? dbFind(payload, slugs.chatMessages, {
+              where: { client: { equals: req.user.id } },
+              limit: 5000,
+              depth: 0,
+              overrideAccess: true,
+            })
+            : EMPTY,
+          isRegistered(FIXED_SLUGS.ticketFeedback)
+            ? dbFind(payload, FIXED_SLUGS.ticketFeedback, {
+              where: { client: { equals: req.user.id } },
+              limit: 500,
+              depth: 0,
+              overrideAccess: true,
+            })
+            : EMPTY,
+          isRegistered(FIXED_SLUGS.clientSummaries)
+            ? dbFind(payload, FIXED_SLUGS.clientSummaries, {
+              where: { client: { equals: req.user.id } },
+              limit: 100,
+              depth: 0,
+              overrideAccess: true,
+            })
+            : EMPTY,
         ])
 
+        const ticketIds = ticketsResult.docs.map((t: any) => t.id)
+
+        // Time entries hang off the tickets, not off the client.
+        const timeResult = ticketIds.length > 0 && isRegistered(slugs.timeEntries)
+          ? await dbFind(payload, slugs.timeEntries, {
+            where: { ticket: { in: ticketIds } },
+            limit: 5000,
+            depth: 0,
+            overrideAccess: true,
+          })
+          : EMPTY
+
         const c = clientData as any
-        const exportData = {
-          exportDate: new Date().toISOString(),
-          exportType: 'RGPD - Export des données personnelles',
+        const providedByYou = {
           profile: {
             email: c.email,
             firstName: c.firstName,
@@ -79,6 +136,49 @@ export function createExportDataEndpoint(slugs: CollectionSlugs): Endpoint {
             comment: s.comment,
             createdAt: s.createdAt,
           })),
+          feedback: feedbackResult.docs.map((f: any) => ({
+            ticketId: f.ticket,
+            rating: f.rating,
+            comment: f.comment,
+            submittedFrom: f.submittedFrom,
+            createdAt: f.createdAt,
+          })),
+          chatMessages: chatResult.docs.map((m: any) => ({
+            session: m.session,
+            senderType: m.senderType,
+            message: m.message,
+            createdAt: m.createdAt,
+          })),
+          timeEntries: timeResult.docs.map((e: any) => ({
+            ticketId: e.ticket,
+            duration: e.duration,
+            date: e.date,
+            description: e.description,
+            billable: e.billable,
+          })),
+        }
+
+        const exportData = {
+          exportDate: new Date().toISOString(),
+          exportType: 'RGPD - Export des données personnelles',
+          providedByYou: {
+            legalBasis: 'Art. 20 RGPD - droit à la portabilité',
+            ...providedByYou,
+          },
+          derivedData: {
+            legalBasis: 'Art. 15 RGPD - droit d\'accès (données dérivées, hors portabilité)',
+            clientSummaries: summariesResult.docs.map((s: any) => ({
+              summary: s.summary,
+              recurringTopics: s.recurringTopics,
+              patterns: s.patterns,
+              keyFacts: s.keyFacts,
+              ticketCount: s.ticketCount,
+              messageCount: s.messageCount,
+              averageSatisfaction: s.averageSatisfaction,
+              generatedAt: s.generatedAt,
+              aiModel: s.aiModel,
+            })),
+          },
         }
 
         const json = JSON.stringify(exportData, null, 2)

package/src/endpoints/import-conversation.ts

@@ -1,6 +1,6 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { clientIpRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { readSupportSettings } from '../utils/readSettings'
 import { dbFind, dbCreate } from '../utils/db'
 import { verifySecret } from '../utils/webhookSecurity'
@@ -154,7 +154,7 @@ export function createImportConversationEndpoint(slugs: CollectionSlugs, store?:
           return Response.json({ error: 'Unauthorized' }, { status: 401 })
         }
 
-        const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || 'unknown'
+        const ip = clientIpRateKey(req)
         if (await importLimiter.check(ip, req)) {
           return Response.json({ error: 'Rate limit exceeded. Maximum 10 imports per hour.' }, { status: 429 })
         }

package/src/endpoints/login.ts

@@ -1,10 +1,13 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
-import { RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
+import { clientIpRateKey, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
 import { dbCreate } from '../utils/db'
 import { issueTwoFactorChallenge } from '../utils/twoFactorChallenge'
 
 
+/** Enough to identify a browser, short enough that a flood cannot fill the disk. */
+const MAX_LOGGED_USER_AGENT = 256
+
 /**
  * POST /api/support/login
  * Client login endpoint.
@@ -18,7 +21,12 @@ export function createLoginEndpoint(slugs: CollectionSlugs, store?: RateLimitSto
       // NOTE: x-forwarded-for is spoofable unless this app sits strictly behind a
       // trusted proxy that rewrites it. This IP rate-limit is a SECONDARY defense;
       // the primary brute-force control is Payload's account lock (maxLoginAttempts).
-      const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || req.headers.get('x-real-ip') || 'unknown'
+      //
+      // `clientIpRateKey` is what keeps a spoofed header from being more than a
+      // bucket choice: the raw header used to become the limiter key AND the
+      // `ipAddress` column below, so rotating it minted unbounded map entries in
+      // memory and unbounded rows on disk.
+      const ip = clientIpRateKey(req)
 
       if (await loginLimiter.check(ip, req)) {
         return Response.json(
@@ -35,7 +43,9 @@ export function createLoginEndpoint(slugs: CollectionSlugs, store?: RateLimitSto
         return Response.json({ error: 'Invalid JSON body' }, { status: 400 })
       }
       const { email, password } = body
-      const userAgent = req.headers.get('user-agent') || ''
+      // Persisted on every failed attempt, from an anonymous request: bounded so
+      // a flood cannot write tens of kilobytes per row into `auth-logs`.
+      const userAgent = (req.headers.get('user-agent') || '').slice(0, MAX_LOGGED_USER_AGENT)
 
       if (!email || !password) {
         return Response.json({ error: 'Email et mot de passe requis.' }, { status: 400 })

package/src/endpoints/purge-logs.ts

@@ -1,7 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
-import { dbDelete } from '../utils/db'
+import { purgeOlderThan, purgeableCollections } from '../utils/retention'
 
 /**
  * DELETE /api/support/purge-logs?collection=email-logs&days=30
@@ -22,25 +22,16 @@ export function createPurgeLogsEndpoint(slugs: CollectionSlugs): Endpoint {
         const days = Number(url.searchParams.get('days') || '0')
 
         // Map collection param to slug
-        const allowedCollections: Record<string, string> = {
-          'email-logs': slugs.emailLogs,
-          'auth-logs': slugs.authLogs,
-        }
+        const allowedCollections = purgeableCollections(slugs)
 
         if (!collection || !allowedCollections[collection]) {
           return Response.json({ error: 'Invalid collection. Use email-logs or auth-logs.' }, { status: 400 })
         }
 
-        const cutoff = days > 0 ? new Date(Date.now() - days * 86400000).toISOString() : null
-
-        const result = await dbDelete(payload, allowedCollections[collection], {
-          where: cutoff
-            ? { createdAt: { less_than: cutoff } }
-            : { id: { exists: true } },
-          overrideAccess: true,
-        })
-
-        const count = Array.isArray(result.docs) ? result.docs.length : 0
+        // `days=0` wipes the journal entirely. It stays available here — an
+        // explicit, admin-only, one-off action — and is refused by the
+        // scheduled task, which must never be able to do it by accident.
+        const count = await purgeOlderThan(payload, allowedCollections[collection], days, req)
 
         return Response.json({
           purged: count,

package/src/endpoints/push.ts

@@ -3,6 +3,7 @@ import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
 import { dbFind, dbCreate, dbUpdate } from '../utils/db'
 import { getVapidPublicKey } from '../utils/push'
+import { validatePushEndpoint, WEBHOOK_URL_MESSAGES } from '../utils/urlSafety'
 
 /** GET /api/support/push/vapid-public-key — public key the browser uses to subscribe. */
 export function createVapidKeyEndpoint(): Endpoint {
@@ -30,7 +31,19 @@ export function createPushSubscribeEndpoint(slugs: CollectionSlugs): Endpoint {
         if (!endpoint || !p256dh || !auth) {
           return Response.json({ error: 'subscription invalide (endpoint + keys requis).' }, { status: 400 })
         }
-        const data = { user: req.user!.id, endpoint, p256dh, auth, userAgent: req.headers.get('user-agent') || '' }
+        // WRITE-time SSRF guard. `requireAdmin` above only proves the caller
+        // belongs to the staff collection — the very actor `utils/urlSafety`
+        // already models as hostile for webhook URLs — and `web-push` hands this
+        // string's host and port straight to `https.request`. Same guard, same
+        // reason, on the second field that steers an outbound request.
+        const endpointCheck = validatePushEndpoint(endpoint)
+        if (!endpointCheck.ok) {
+          return Response.json(
+            { error: WEBHOOK_URL_MESSAGES[endpointCheck.reason || 'invalid_url'] },
+            { status: 400 },
+          )
+        }
+        const data = { user: req.user!.id, endpoint, p256dh, auth, userAgent: (req.headers.get('user-agent') || '').slice(0, 256) }
         const existing = await dbFind(req.payload, slugs.pushSubscriptions, { where: { endpoint: { equals: endpoint } }, limit: 1, depth: 0, overrideAccess: true })
         if (existing.docs.length > 0) {
           await dbUpdate(req.payload, slugs.pushSubscriptions, { id: (existing.docs[0] as { id: number | string }).id, data, overrideAccess: true })

package/src/endpoints/statuses.ts

@@ -5,6 +5,18 @@ import { dbFind } from '../utils/db'
 /**
  * GET /api/support/statuses
  * Returns all ticket statuses sorted by sortOrder.
+ *
+ * The guard used to be `!!req.user`, which ANY authenticated principal
+ * satisfies — including a member of an unrelated auth collection of the host
+ * app (customers, members, subscribers created by public sign-up). Because the
+ * rows below are read with `overrideAccess: true`, that handed them the whole
+ * support workflow taxonomy — internal status names, private states, pipeline
+ * order — which `ticket-statuses.access.read` explicitly refuses them.
+ *
+ * The check below MIRRORS that ACL rather than replacing it: staff and
+ * support-clients, nobody else. `overrideAccess` stays, because the endpoint
+ * legitimately serves the full list to both, and the projection it returns is
+ * narrower than the documents themselves.
  */
 export function createStatusesEndpoint(slugs: CollectionSlugs): Endpoint {
   return {
@@ -18,6 +30,11 @@ export function createStatusesEndpoint(slugs: CollectionSlugs): Endpoint {
           return Response.json({ error: 'Unauthorized' }, { status: 401 })
         }
 
+        const collection = (req.user as { collection?: string }).collection
+        if (collection !== slugs.users && collection !== slugs.supportClients) {
+          return Response.json({ error: 'Forbidden' }, { status: 403 })
+        }
+
         const { docs } = await dbFind(payload, slugs.ticketStatuses, {
           sort: 'sortOrder',
           limit: 100,

package/src/index.ts

@@ -28,6 +28,8 @@ export type { SupportSettings, SupportSettingsState, UserPrefs } from './utils/r
 export { DEFAULT_TICKETING_FEATURES, normalizeFeatures, projectAutoClose, stripProjectedFeatures } from './utils/features'
 export type { TicketingFeatures } from './utils/features'
 export { MemoryRateLimitStore, PayloadRateLimitStore, RateLimiter } from './utils/rateLimiter'
+export { DEFAULT_RETENTION, PURGE_LOGS_TASK_SLUG, purgeOlderThan, purgeableCollections, runScheduledPurge } from './utils/retention'
+export type { RetentionConfig, ScheduledPurgeResult } from './utils/retention'
 export type { RateLimitEntry, RateLimitStore } from './utils/rateLimiter'
 export { DEFAULT_INBOUND_EMAIL_LIMITS, validateInboundEmailPayload, verifySecret } from './utils/webhookSecurity'
 export type { InboundEmailInput, InboundEmailLimits, InboundEmailValidationError } from './utils/webhookSecurity'

package/src/plugin.ts

@@ -1,4 +1,4 @@
-import type { Config, Plugin, AdminViewConfig } from 'payload'
+import type { Config, Plugin, AdminViewConfig, PayloadRequest } from 'payload'
 import type { SupportPluginConfig, SupportFeatures } from './types'
 import { DEFAULT_FEATURES } from './types'
 import { resolveSlugs } from './utils/slugs'
@@ -31,6 +31,7 @@ import {
   createSupportCountersCollection,
 } from './collections'
 import { PayloadRateLimitStore } from './utils/rateLimiter'
+import { DEFAULT_RETENTION, PURGE_LOGS_TASK_SLUG, runScheduledPurge } from './utils/retention'
 import { SUPPORT_STAFF_SLUG_CONFIG_KEY } from './utils/readSettings'
 
 function viewConfig(component: string, path: string): AdminViewConfig {
@@ -168,8 +169,57 @@ export function supportPlugin(config?: SupportPluginConfig): Plugin {
       capabilities: config?.capabilities,
     })
 
+    // ─── Retention job ───────────────────────────────────
+    //
+    // `DELETE /api/support/purge-logs` existed but nothing ever called it, so
+    // the two journals grew forever — a retention policy nobody applies is not
+    // a retention policy. This registers a daily Payload Jobs task instead of
+    // a setInterval: an interval does not survive a serverless deploy and runs
+    // N times in parallel behind N instances.
+    // The task is OPT-IN: nothing is registered unless `retention` is set.
+    //
+    // Registering it by default was tempting — a retention policy nobody opts
+    // into is how the manual purge endpoint ended up never being called. But
+    // declaring a task turns Payload's job queue on, which adds `payload-jobs`
+    // and `payload-jobs-stats` to an app that had none: two tables, i.e. a
+    // schema change imposed on every consumer of a *support* plugin, by a minor
+    // release. And it would buy them nothing, because a scheduled task only
+    // fires when the host also runs a job runner (`payload jobs:run`, a cron,
+    // or `jobs.autoRun`). Defaulting it on therefore costs two tables and
+    // delivers no purge until the integrator does the other half of the work
+    // anyway — at which point they can just as well pass `retention`.
+    //
+    // The README states the trade-off where the option is documented, so the
+    // choice is visible rather than silent. `admin-ui-pro` made the same call
+    // for the same reason.
+    const retention = config?.retention === false ? undefined : config?.retention
+    const retentionEnabled = Boolean(retention)
+    const purgeTask = {
+      slug: PURGE_LOGS_TASK_SLUG,
+      label: 'Support — purge des journaux',
+      schedule: [
+        {
+          cron: retention?.cron ?? DEFAULT_RETENTION.cron,
+          queue: retention?.queue ?? DEFAULT_RETENTION.queue,
+        },
+      ],
+      handler: async ({ req }: { req: PayloadRequest }) => {
+        const result = await runScheduledPurge(req.payload, slugs, retention, req)
+        return { output: result }
+      },
+    }
+
+    const existingJobs = incomingConfig.jobs
+    const jobs = retentionEnabled
+      ? ({
+        ...existingJobs,
+        tasks: [...(existingJobs?.tasks ?? []), purgeTask],
+      } as Config['jobs'])
+      : existingJobs
+
     return {
       ...incomingConfig,
+      jobs,
       // Publish the resolved staff collection so the server-side readers share
       // ONE source of truth with the writers. `requireAdmin` compares against
       // `slugs.users`; the `payload-preferences` reads used to scope themselves

package/src/portal/LiveChat.tsx

@@ -1,7 +1,7 @@
 'use client'
 
 import React, { useState, useEffect, useRef, useCallback } from 'react'
-import { MessageCircle, Send, X, Minimize2, ArrowLeft } from 'lucide-react'
+import { MessageCircle, Send, X, Minimize2, ArrowLeft } from './icons'
 import type { ChatMessage, LiveChatSession, Screen } from './types'
 import { loadSession, saveSession, clearSession } from './helpers'