@consilioweb/payload-support 4.0.0 → 6.0.0

package/src/styles/SupportDashboard.module.scss

@@ -26,7 +26,7 @@ $radius-md: 12px;
 
 .subtitle {
   font-size: 13px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   margin: 0;
 }
 
@@ -75,7 +75,7 @@ $radius-md: 12px;
   font-weight: 700;
   text-transform: uppercase;
   letter-spacing: 0.6px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   margin-bottom: 8px;
 }
 
@@ -148,7 +148,7 @@ $radius-md: 12px;
   font-weight: 700;
   text-transform: uppercase;
   letter-spacing: 0.5px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   margin: 0 0 16px;
 }
 
@@ -207,7 +207,7 @@ $radius-md: 12px;
   font-weight: 600;
   font-variant-numeric: tabular-nums;
   font-size: 12px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   white-space: nowrap;
 }
 
@@ -219,9 +219,25 @@ $radius-md: 12px;
   font-weight: 500;
 }
 
+// The whole row looks clickable, but only this link actually is — it is what
+// carries the ticket into the keyboard tab order.
+.ticketLink {
+  display: block;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  color: inherit;
+  text-decoration: none;
+
+  &:hover,
+  &:focus-visible {
+    text-decoration: underline;
+  }
+}
+
 .ticketClient {
   font-size: 12px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   max-width: 120px;
   overflow: hidden;
   text-overflow: ellipsis;
@@ -430,7 +446,7 @@ $radius-md: 12px;
   font-weight: 700;
   text-transform: uppercase;
   letter-spacing: 0.5px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   margin: 0 0 16px;
 }
 
@@ -582,7 +598,7 @@ $radius-md: 12px;
   font-size: 12px;
   font-weight: 600;
   font-variant-numeric: tabular-nums;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   white-space: nowrap;
   flex-shrink: 0;
 }
@@ -637,7 +653,7 @@ $radius-md: 12px;
 .errorState {
   text-align: center;
   padding: 60px 24px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   font-size: 14px;
 
   strong {

package/src/styles/TicketDetail.module.scss

@@ -52,7 +52,7 @@
   font-family: ui-monospace, 'SF Mono', 'JetBrains Mono', Menlo, Consolas, monospace;
   font-size: 12px;
   font-weight: 400;
-  color: var(--theme-text-tertiary, var(--theme-elevation-500));
+  color: var(--theme-text-tertiary, var(--theme-elevation-650));
   display: inline-flex;
   align-items: center;
   gap: 8px;
@@ -64,7 +64,7 @@
 
   > .ticketNumberCat,
   > .ticketNumberSource {
-    color: var(--theme-text-tertiary, var(--theme-elevation-500));
+    color: var(--theme-text-tertiary, var(--theme-elevation-650));
     display: inline-flex;
     align-items: center;
     gap: 4px;
@@ -194,7 +194,7 @@
   text-transform: uppercase;
   letter-spacing: 0.08em;
   line-height: 1.3;
-  color: var(--theme-text-tertiary, var(--theme-elevation-500));
+  color: var(--theme-text-tertiary, var(--theme-elevation-650));
   margin: 0 0 12px;
   display: flex;
   justify-content: space-between;
@@ -353,7 +353,7 @@
   font-size: 11px;
   font-weight: 500;
   line-height: 1.3;
-  color: var(--theme-text-tertiary, var(--theme-elevation-500));
+  color: var(--theme-text-tertiary, var(--theme-elevation-650));
   white-space: nowrap;
   text-transform: uppercase;
   letter-spacing: 0.08em;
@@ -450,7 +450,7 @@
   font-size: 11px;
   font-weight: 500;
   line-height: 1.3;
-  color: var(--theme-text-tertiary, var(--theme-elevation-500));
+  color: var(--theme-text-tertiary, var(--theme-elevation-650));
 }
 
 // Pills "Interne" / "Solution" — pill style, 22px height
@@ -499,7 +499,7 @@
   margin-top: 4px;
   font-size: 11px;
   font-weight: 500;
-  color: var(--theme-text-tertiary, var(--theme-elevation-500));
+  color: var(--theme-text-tertiary, var(--theme-elevation-650));
   opacity: 0;
   transition: opacity 80ms ease;
 }
@@ -514,7 +514,7 @@
   font-size: 11px;
   font-weight: 500;
   line-height: 1.3;
-  color: var(--theme-text-tertiary, var(--theme-elevation-500));
+  color: var(--theme-text-tertiary, var(--theme-elevation-650));
   display: inline-flex;
   align-items: center;
   height: auto;
@@ -749,7 +749,7 @@
   display: inline-flex;
   align-items: center;
   gap: 4px;
-  color: var(--theme-text-tertiary, var(--theme-elevation-500));
+  color: var(--theme-text-tertiary, var(--theme-elevation-650));
   font-size: 11px;
   font-weight: 500;
   margin-left: auto;
@@ -910,7 +910,7 @@
   background: none;
   border: none;
   cursor: pointer;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   font-size: 13px;
   font-weight: 600;
   padding: 0;
@@ -941,7 +941,7 @@
 
 .activityContent { flex: 1; min-width: 0; }
 .activityText { font-weight: 500; color: var(--theme-text); font-size: 12px; }
-.activityTime { font-size: 11px; color: var(--theme-elevation-500); margin-top: 1px; }
+.activityTime { font-size: 11px; color: var(--theme-elevation-650); margin-top: 1px; }
 
 // ─── DROPDOWN ───
 .dropdown { position: relative; display: inline-block; }
@@ -1055,7 +1055,7 @@
 
 .splitPreview {
   font-size: 12px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   margin: 0 0 16px;
   line-height: 1.5;
   max-height: 80px;
@@ -1092,7 +1092,7 @@
   background: none;
   font-size: 13px;
   font-weight: 600;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   cursor: pointer;
   &:hover { background: var(--theme-elevation-100); }
 }
@@ -1145,7 +1145,7 @@
   cursor: pointer;
   font-size: 11px;
   line-height: 1;
-  color: var(--theme-text-tertiary, var(--theme-elevation-500));
+  color: var(--theme-text-tertiary, var(--theme-elevation-650));
   padding: 0;
   display: inline-flex;
   align-items: center;
@@ -1166,7 +1166,7 @@
   font-size: 11px;
   font-weight: 500;
   line-height: 1;
-  color: var(--theme-text-tertiary, var(--theme-elevation-500));
+  color: var(--theme-text-tertiary, var(--theme-elevation-650));
   cursor: pointer;
   transition: border-color 80ms ease, color 80ms ease;
   &:hover {
@@ -1607,7 +1607,7 @@
   align-items: center;
   gap: 6px;
   font-size: 10px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
 }
 
 .previousTicketsStatus {
@@ -1755,7 +1755,7 @@
   text-transform: uppercase;
   letter-spacing: 0.08em;
   line-height: 1.3;
-  color: var(--theme-text-tertiary, var(--theme-elevation-500));
+  color: var(--theme-text-tertiary, var(--theme-elevation-650));
   margin: 12px 0 8px;
 }
 .aiCardNextActions {
@@ -1805,13 +1805,13 @@
 }
 .aiCardNextLabelDone {
   text-decoration: line-through;
-  color: var(--theme-text-tertiary, var(--theme-elevation-500));
+  color: var(--theme-text-tertiary, var(--theme-elevation-650));
 }
 .aiCardNextWhen {
   font-size: 11px;
   font-weight: 500;
   line-height: 1.3;
-  color: var(--theme-text-tertiary, var(--theme-elevation-500));
+  color: var(--theme-text-tertiary, var(--theme-elevation-650));
   flex-shrink: 0;
 }
 
@@ -1856,12 +1856,12 @@
   margin: 0 2px;
 }
 .ticketNumberCat {
-  color: var(--theme-text-tertiary, var(--theme-elevation-500));
+  color: var(--theme-text-tertiary, var(--theme-elevation-650));
   font-family: ui-sans-serif, system-ui, -apple-system, sans-serif;
   font-weight: 400;
 }
 .ticketNumberSource {
-  color: var(--theme-text-tertiary, var(--theme-elevation-500));
+  color: var(--theme-text-tertiary, var(--theme-elevation-650));
   font-family: ui-sans-serif, system-ui, -apple-system, sans-serif;
   display: inline-flex;
   align-items: center;

package/src/styles/TicketInbox.module.scss

@@ -26,7 +26,7 @@
 
 .subtitle {
   font-size: 13px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   margin: 2px 0 0;
 }
 
@@ -125,7 +125,7 @@
   padding: 0 12px;
   font-size: 13px;
   font-weight: 500;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   background: none;
   border: none;
   border-radius: 6px;
@@ -155,7 +155,7 @@
   padding: 0 6px;
   font-size: 11px;
   font-weight: 600;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   background: var(--theme-elevation-200);
   border-radius: 999px;
 }
@@ -179,7 +179,7 @@
 .sortSelect {
   font-size: 12px;
   font-weight: 600;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   background: none;
   border: none;
   cursor: pointer;
@@ -268,7 +268,7 @@
 
 .client {
   font-size: 12px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   overflow: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
@@ -333,7 +333,7 @@
   box-shadow: 0 2px 8px rgba(0, 0, 0, 0.06);
   font-size: 11px;
   font-weight: 500;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   display: flex;
   gap: 12px;
   z-index: 10;

package/src/styles/TicketingSettings.module.scss

@@ -15,7 +15,7 @@ $green: #16a34a;
 
 .intro {
   font-size: 13px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   margin: 0 0 24px;
   line-height: 1.6;
 }
@@ -59,7 +59,7 @@ $green: #16a34a;
 
 .sectionChevron {
   font-size: 16px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   transition: transform 150ms;
 
   &.open {
@@ -73,7 +73,7 @@ $green: #16a34a;
 
 .sectionDescription {
   font-size: 12px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   margin: 0 0 16px;
   line-height: 1.5;
 }
@@ -97,7 +97,7 @@ $green: #16a34a;
 
 .fieldDescription {
   font-size: 11px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   font-weight: 400;
   margin-top: 2px;
 }
@@ -131,7 +131,7 @@ $green: #16a34a;
   border-radius: 6px;
   border: 1px solid var(--theme-elevation-300);
   font-size: 13px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   background-color: var(--theme-elevation-100);
   width: 100%;
   max-width: 400px;
@@ -179,7 +179,7 @@ $green: #16a34a;
 
 .inlineDesc {
   font-size: 12px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
 }
 
 // ─── BADGE ───
@@ -251,7 +251,7 @@ $green: #16a34a;
 
 .featureDesc {
   font-size: 12px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   line-height: 1.4;
 }
 
@@ -271,7 +271,7 @@ $green: #16a34a;
 
 .aiToggleDesc {
   font-size: 12px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   margin-left: 8px;
 }
 
@@ -290,7 +290,7 @@ $green: #16a34a;
   background-color: transparent;
   cursor: pointer;
   font-size: 12px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   white-space: nowrap;
 }
 
@@ -303,7 +303,7 @@ $green: #16a34a;
 
 .slaHint {
   font-size: 12px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
 }
 
 // ─── AI SUB FEATURES LABEL ───

package/src/styles/TimeDashboard.module.scss

@@ -28,7 +28,7 @@
 }
 
 .subtitle {
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   margin: 4px 0 0;
   font-size: 14px;
 }
@@ -80,7 +80,7 @@
 .label {
   font-size: 11px;
   font-weight: 700;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   margin-bottom: 3px;
 }
 
@@ -146,7 +146,7 @@
   font-size: 10px;
   font-weight: 700;
   text-transform: uppercase;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
 }
 
 .kpiValue {
@@ -201,7 +201,7 @@
   border: 1px solid var(--theme-elevation-300);
   border-radius: 8px;
   background: var(--theme-elevation-100);
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   font-size: 14px;
 }
 
@@ -257,13 +257,13 @@
 
 .tdSubject {
   padding: 6px 8px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   font-size: 12px;
 }
 
 .tdDescription {
   padding: 6px 8px;
-  color: var(--theme-elevation-500);
+  color: var(--theme-elevation-650);
   font-size: 12px;
 }
 

package/src/styles/_tokens.scss

@@ -1,6 +1,8 @@
 // Design tokens — based on Payload CMS CSS variables
 $text: var(--theme-text);
-$text-secondary: var(--theme-elevation-500);
+// elevation-650, not 500: Payload's dark theme skips the 500 step, leaving it
+// at rgb(128,128,128) — 3.62:1 light / 4.03:1 dark, below WCAG AA in both.
+$text-secondary: var(--theme-elevation-650);
 $text-muted: var(--theme-elevation-400);
 $bg: var(--theme-elevation-50);
 $bg-card: var(--theme-elevation-100);

package/src/types.ts

@@ -1,4 +1,5 @@
 import type { RateLimitStore } from './utils/rateLimiter'
+import type { RetentionConfig } from './utils/retention'
 import type { InboundEmailInput } from './utils/webhookSecurity'
 import type { Payload, PayloadRequest } from 'payload'
 
@@ -151,6 +152,25 @@ export interface SupportPluginConfig {
   /** Shared rate-limit storage. Defaults to process-local memory. */
   rateLimitStore?: RateLimitStore | 'payload'
 
+  /**
+   * Automatic retention of the two journals the plugin writes.
+   *
+   * The plugin registers a daily Payload Jobs task that deletes rows older
+   * than the configured number of days. Set a value to 0 to keep that journal
+   * forever (the manual `DELETE /api/support/purge-logs` endpoint stays
+   * available either way).
+   *
+   * Defaults: auth-logs 180 days, email-logs 365 days, cron `0 30 3 * * *`.
+   *
+   * `false` registers no task at all. That is the ONLY value that changes the
+   * schema footprint: registering a task turns Payload's job queue on, which
+   * adds the `payload-jobs` collection and the `payload-jobs-stats` global to
+   * an app that had no jobs — two tables you would have to migrate. Pass
+   * `false` if you would rather purge from your own cron, calling
+   * `DELETE /api/support/purge-logs`.
+   */
+  retention?: RetentionConfig | false
+
   /** Sequential ticket number formatting. */
   ticketNumber?: { prefix?: string; padding?: number }
 

package/src/utils/push.ts

@@ -2,6 +2,7 @@ import type { Payload } from 'payload'
 import type { CollectionSlugs } from './slugs'
 import { dbFind, dbDelete } from './db'
 import webpush from 'web-push'
+import { assertPublicHost, validatePushEndpoint } from './urlSafety'
 
 let configured = false
 function ensureVapid(): boolean {
@@ -43,6 +44,27 @@ export async function sendPushToUser(
     for (const s of subs.docs) {
       const row = s as { id: number | string; endpoint?: string; p256dh?: string; auth?: string }
       if (!row.endpoint || !row.p256dh || !row.auth) continue
+
+      // SEND-time SSRF guard, the second of the two layers `utils/urlSafety`
+      // describes. It is not redundant with the write-time check: it also covers
+      // rows persisted BEFORE that check existed, and a name whose DNS record is
+      // flipped to a private address after the row was accepted. `web-push`
+      // builds its own `https.request`, so `safeFetch` cannot wrap it — this is
+      // the layer that stands in for it.
+      //
+      // A blocked row is SKIPPED, never deleted: `assertPublicHost` fails closed
+      // on a resolver timeout, and a hiccup must not purge a legitimate agent's
+      // subscription. Only a real 404/410 from the push service prunes below.
+      const check = validatePushEndpoint(row.endpoint)
+      if (!check.ok || !check.url) {
+        console.warn('[support] Push endpoint refused (unsafe URL):', check.reason)
+        continue
+      }
+      if (!(await assertPublicHost(check.url.hostname))) {
+        console.warn('[support] Push endpoint refused (host resolves to a private address)')
+        continue
+      }
+
       try {
         await webpush.sendNotification(
           { endpoint: row.endpoint, keys: { p256dh: row.p256dh, auth: row.auth } },

package/src/utils/rateLimiter.ts

@@ -8,13 +8,59 @@ export interface RateLimitStore {
   reset(key: string, context?: unknown): Promise<void>
 }
 
+/**
+ * Hard ceiling on the number of distinct keys held at once, all endpoints
+ * combined. Sized for a busy install (thousands of client IPs inside one
+ * 15-minute window) while capping the map at a few hundred kilobytes.
+ */
+export const MAX_MEMORY_RATE_LIMIT_KEYS = 10_000
+
 /**
  * Process-local fallback store. Applications running more than one process
  * should provide a persistent RateLimitStore through the plugin options.
+ *
+ * BOUNDED, because the keys come from anonymous HTTP traffic: `/support/login`
+ * and `/support/chatbot` key their limiter on the client IP, and the IP is read
+ * from `x-forwarded-for`. A caller rotating that header wrote one PERMANENT
+ * entry per value into a map that had no ceiling, no expiry sweep and no
+ * eviction — only `reset()` ever removed anything, and the login path never
+ * calls it. Worse, every fresh key opened a fresh window, so the limiter did
+ * not even slow down the flood that was exhausting it.
+ *
+ * Two independent bounds, the same pair `endpoints/typing.ts` already applies
+ * to its own module-level map: `clientIpRateKey` caps the SIZE of a key, the
+ * ceiling below caps their NUMBER.
  */
 export class MemoryRateLimitStore implements RateLimitStore {
   private readonly entries = new Map<string, RateLimitEntry>()
 
+  constructor(private readonly maxKeys: number = MAX_MEMORY_RATE_LIMIT_KEYS) {}
+
+  /** Distinct keys currently held. Exposed so the ceiling can be asserted. */
+  get size(): number {
+    return this.entries.size
+  }
+
+  /** Reclaims every window that has already closed. */
+  private sweepExpired(now: number): void {
+    for (const [key, entry] of this.entries) {
+      if (now > entry.resetAt) this.entries.delete(key)
+    }
+  }
+
+  /** Soonest-closing window first, so the ceiling drops the least useful entry. */
+  private evictOldest(): void {
+    let oldestKey: string | null = null
+    let oldestResetAt = Infinity
+    for (const [key, entry] of this.entries) {
+      if (entry.resetAt < oldestResetAt) {
+        oldestResetAt = entry.resetAt
+        oldestKey = key
+      }
+    }
+    if (oldestKey !== null) this.entries.delete(oldestKey)
+  }
+
   async increment(key: string, windowMs: number): Promise<RateLimitEntry> {
     const now = Date.now()
     const current = this.entries.get(key)
@@ -22,6 +68,12 @@ export class MemoryRateLimitStore implements RateLimitStore {
       ? { count: 1, resetAt: now + windowMs }
       : { ...current, count: current.count + 1 }
 
+    // Only a key that is not already held can grow the map.
+    if (!current && this.entries.size >= this.maxKeys) {
+      this.sweepExpired(now)
+      if (this.entries.size >= this.maxKeys) this.evictOldest()
+    }
+
     this.entries.set(key, next)
     return next
   }
@@ -134,6 +186,52 @@ export function principalRateKey(
   return `${collection}:${String(user.id)}`
 }
 
+/**
+ * Longest textual IPv6 address, `xxxx:` * 7 + an embedded IPv4 literal.
+ * Nothing legitimate is longer; the cap is what makes the key bounded.
+ */
+const MAX_IP_KEY_LENGTH = 45
+/** Dotted-quad, or the hex/`::`/zone alphabet of an IPv6 literal. Shape only. */
+const IPV4_PATTERN = /^(?:\d{1,3}\.){3}\d{1,3}$/
+const IPV6_PATTERN = /^[0-9a-fA-F:.%]+$/
+
+/**
+ * Identity part of a rate-limit key for an ANONYMOUS caller.
+ *
+ * `x-forwarded-for` is attacker-controlled — the note in `endpoints/login.ts`
+ * has always said so, and Payload's account lock is what actually stops a
+ * brute-force. But the header was also used RAW as the limiter key, and that is
+ * a second, distinct problem: a key is a stored object. A caller rotating the
+ * header minted one unbounded, never-reclaimed entry per value; a value can be
+ * most of Node's 16 KB header budget. This validates the SHAPE and caps the
+ * LENGTH, so a forged header can still pick a bucket but can no longer invent
+ * an unbounded number of them, nor make any single one large.
+ *
+ * Anything that is not an IP literal falls back to the shared `unknown` bucket.
+ * That is the fail-closed direction: an install with no proxy already puts
+ * every caller there, and one behind a proxy never lands there legitimately.
+ */
+export function clientIpRateKey(req: { headers: { get(name: string): string | null } }): string {
+  const candidate = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim()
+    || req.headers.get('x-real-ip')?.trim()
+    || ''
+  return normalizeIpKey(candidate)
+}
+
+/** Exposed separately so a caller holding an already-extracted address can reuse it. */
+export function normalizeIpKey(candidate: string): string {
+  if (!candidate || candidate.length > MAX_IP_KEY_LENGTH) return 'unknown'
+  const host = candidate.startsWith('[') && candidate.endsWith(']')
+    ? candidate.slice(1, -1)
+    : candidate
+  if (!host) return 'unknown'
+  if (IPV4_PATTERN.test(host)) {
+    return host.split('.').every((octet) => Number(octet) <= 255) ? host : 'unknown'
+  }
+  if (host.includes(':') && IPV6_PATTERN.test(host)) return host.toLowerCase()
+  return 'unknown'
+}
+
 export class RateLimiter {
   private readonly store: RateLimitStore
   private readonly prefix: string