@consilioweb/payload-support 4.0.0 → 6.0.0

package/dist/index.cjs

@@ -81,15 +81,51 @@ var DEFAULT_SLUGS = {
   users: "users",
   media: "media"
 };
+var FIXED_SLUGS = {
+  clientSummaries: "client-summaries",
+  ticketCollaborators: "ticket-collaborators",
+  ticketFeedback: "ticket-feedback"
+};
 function resolveSlugs(overrides) {
   return { ...DEFAULT_SLUGS, ...overrides };
 }
+var MAX_MEMORY_RATE_LIMIT_KEYS = 1e4;
 var MemoryRateLimitStore = class {
+  constructor(maxKeys = MAX_MEMORY_RATE_LIMIT_KEYS) {
+    this.maxKeys = maxKeys;
+  }
+  maxKeys;
   entries = /* @__PURE__ */ new Map();
+  /** Distinct keys currently held. Exposed so the ceiling can be asserted. */
+  get size() {
+    return this.entries.size;
+  }
+  /** Reclaims every window that has already closed. */
+  sweepExpired(now) {
+    for (const [key, entry] of this.entries) {
+      if (now > entry.resetAt) this.entries.delete(key);
+    }
+  }
+  /** Soonest-closing window first, so the ceiling drops the least useful entry. */
+  evictOldest() {
+    let oldestKey = null;
+    let oldestResetAt = Infinity;
+    for (const [key, entry] of this.entries) {
+      if (entry.resetAt < oldestResetAt) {
+        oldestResetAt = entry.resetAt;
+        oldestKey = key;
+      }
+    }
+    if (oldestKey !== null) this.entries.delete(oldestKey);
+  }
   async increment(key, windowMs) {
     const now = Date.now();
     const current = this.entries.get(key);
     const next = !current || now > current.resetAt ? { count: 1, resetAt: now + windowMs } : { ...current, count: current.count + 1 };
+    if (!current && this.entries.size >= this.maxKeys) {
+      this.sweepExpired(now);
+      if (this.entries.size >= this.maxKeys) this.evictOldest();
+    }
     this.entries.set(key, next);
     return next;
   }
@@ -173,6 +209,23 @@ function principalRateKey(user) {
   const collection = typeof user.collection === "string" && user.collection ? user.collection : "unknown";
   return `${collection}:${String(user.id)}`;
 }
+var MAX_IP_KEY_LENGTH = 45;
+var IPV4_PATTERN = /^(?:\d{1,3}\.){3}\d{1,3}$/;
+var IPV6_PATTERN = /^[0-9a-fA-F:.%]+$/;
+function clientIpRateKey(req) {
+  const candidate = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || req.headers.get("x-real-ip")?.trim() || "";
+  return normalizeIpKey(candidate);
+}
+function normalizeIpKey(candidate) {
+  if (!candidate || candidate.length > MAX_IP_KEY_LENGTH) return "unknown";
+  const host = candidate.startsWith("[") && candidate.endsWith("]") ? candidate.slice(1, -1) : candidate;
+  if (!host) return "unknown";
+  if (IPV4_PATTERN.test(host)) {
+    return host.split(".").every((octet) => Number(octet) <= 255) ? host : "unknown";
+  }
+  if (host.includes(":") && IPV6_PATTERN.test(host)) return host.toLowerCase();
+  return "unknown";
+}
 var RateLimiter = class {
   /**
    * @param namespace  Endpoint-scoped prefix for every key this limiter writes.
@@ -252,7 +305,7 @@ function createInboundEmailEndpoint(capability, store) {
       if (!verifySecret(req.headers.get(secretHeader), capability.secret)) {
         return Response.json({ error: "Unauthorized" }, { status: 401 });
       }
-      const ip = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || req.headers.get("x-real-ip") || "unknown";
+      const ip = clientIpRateKey(req);
       if (await limiter.check(ip, req)) {
         return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
       }
@@ -2809,6 +2862,10 @@ function createStatusesEndpoint(slugs) {
         if (!req.user) {
           return Response.json({ error: "Unauthorized" }, { status: 401 });
         }
+        const collection = req.user.collection;
+        if (collection !== slugs.users && collection !== slugs.supportClients) {
+          return Response.json({ error: "Forbidden" }, { status: 403 });
+        }
         const { docs } = await dbFind(payload, slugs.ticketStatuses, {
           sort: "sortOrder",
           limit: 100,
@@ -2945,6 +3002,51 @@ function createApplyMacroEndpoint(slugs) {
   };
 }
 
+// src/utils/retention.ts
+var DEFAULT_RETENTION = {
+  authLogsDays: 180,
+  emailLogsDays: 365,
+  cron: "0 30 3 * * *",
+  queue: "default"
+};
+var PURGE_LOGS_TASK_SLUG = "support-purge-logs";
+function purgeableCollections(slugs) {
+  return {
+    "email-logs": slugs.emailLogs,
+    "auth-logs": slugs.authLogs
+  };
+}
+async function purgeOlderThan(payload, slug, days, req) {
+  const cutoff = days > 0 ? new Date(Date.now() - days * 864e5).toISOString() : null;
+  const result = await dbDelete(payload, slug, {
+    where: cutoff ? { createdAt: { less_than: cutoff } } : { id: { exists: true } },
+    overrideAccess: true,
+    ...req ? { req } : {}
+  });
+  return Array.isArray(result?.docs) ? result.docs.length : 0;
+}
+async function runScheduledPurge(payload, slugs, retention, req) {
+  if (retention === false) return { purged: {}, skipped: ["auth-logs", "email-logs"] };
+  const plan = [
+    ["auth-logs", slugs.authLogs, retention?.authLogsDays ?? DEFAULT_RETENTION.authLogsDays],
+    ["email-logs", slugs.emailLogs, retention?.emailLogsDays ?? DEFAULT_RETENTION.emailLogsDays]
+  ];
+  const purged = {};
+  const skipped = [];
+  for (const [name, slug, days] of plan) {
+    if (!Number.isFinite(days) || days <= 0) {
+      skipped.push(name);
+      continue;
+    }
+    if (!payload.collections?.[slug]) {
+      skipped.push(name);
+      continue;
+    }
+    purged[name] = await purgeOlderThan(payload, slug, days, req);
+  }
+  return { purged, skipped };
+}
+
 // src/endpoints/purge-logs.ts
 function createPurgeLogsEndpoint(slugs) {
   return {
@@ -2957,19 +3059,11 @@ function createPurgeLogsEndpoint(slugs) {
         const url = new URL(req.url);
         const collection = url.searchParams.get("collection");
         const days = Number(url.searchParams.get("days") || "0");
-        const allowedCollections = {
-          "email-logs": slugs.emailLogs,
-          "auth-logs": slugs.authLogs
-        };
+        const allowedCollections = purgeableCollections(slugs);
         if (!collection || !allowedCollections[collection]) {
           return Response.json({ error: "Invalid collection. Use email-logs or auth-logs." }, { status: 400 });
         }
-        const cutoff = days > 0 ? new Date(Date.now() - days * 864e5).toISOString() : null;
-        const result = await dbDelete(payload, allowedCollections[collection], {
-          where: cutoff ? { createdAt: { less_than: cutoff } } : { id: { exists: true } },
-          overrideAccess: true
-        });
-        const count = Array.isArray(result.docs) ? result.docs.length : 0;
+        const count = await purgeOlderThan(payload, allowedCollections[collection], days, req);
         return Response.json({
           purged: count,
           collection,
@@ -2999,7 +3093,7 @@ function createChatbotEndpoint(slugs, store, maxPerHour) {
     method: "post",
     handler: async (req) => {
       try {
-        const ip = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || req.headers.get("x-real-ip") || "unknown";
+        const ip = clientIpRateKey(req);
         if (await chatbotLimiter.check(ip, req)) {
           return Response.json({ error: "Too many requests. Please wait a moment." }, { status: 429 });
         }
@@ -4692,6 +4786,7 @@ function createExportCsvEndpoint(slugs) {
 }
 
 // src/endpoints/export-data.ts
+var EMPTY = { docs: [] };
 function createExportDataEndpoint(slugs) {
   return {
     path: "/support/export-data",
@@ -4700,7 +4795,16 @@ function createExportDataEndpoint(slugs) {
       try {
         const payload = req.payload;
         requireClient(req, slugs);
-        const [clientData, ticketsResult, messagesResult, surveysResult] = await Promise.all([
+        const isRegistered = (slug) => Boolean(payload.collections?.[slug]);
+        const [
+          clientData,
+          ticketsResult,
+          messagesResult,
+          surveysResult,
+          chatResult,
+          feedbackResult,
+          summariesResult
+        ] = await Promise.all([
           dbFindByID(payload, slugs.supportClients, {
             id: req.user.id,
             depth: 0,
@@ -4726,12 +4830,35 @@ function createExportDataEndpoint(slugs) {
             limit: 500,
             depth: 0,
             overrideAccess: true
-          })
+          }),
+          isRegistered(slugs.chatMessages) ? dbFind(payload, slugs.chatMessages, {
+            where: { client: { equals: req.user.id } },
+            limit: 5e3,
+            depth: 0,
+            overrideAccess: true
+          }) : EMPTY,
+          isRegistered(FIXED_SLUGS.ticketFeedback) ? dbFind(payload, FIXED_SLUGS.ticketFeedback, {
+            where: { client: { equals: req.user.id } },
+            limit: 500,
+            depth: 0,
+            overrideAccess: true
+          }) : EMPTY,
+          isRegistered(FIXED_SLUGS.clientSummaries) ? dbFind(payload, FIXED_SLUGS.clientSummaries, {
+            where: { client: { equals: req.user.id } },
+            limit: 100,
+            depth: 0,
+            overrideAccess: true
+          }) : EMPTY
         ]);
+        const ticketIds = ticketsResult.docs.map((t) => t.id);
+        const timeResult = ticketIds.length > 0 && isRegistered(slugs.timeEntries) ? await dbFind(payload, slugs.timeEntries, {
+          where: { ticket: { in: ticketIds } },
+          limit: 5e3,
+          depth: 0,
+          overrideAccess: true
+        }) : EMPTY;
         const c = clientData;
-        const exportData = {
-          exportDate: (/* @__PURE__ */ new Date()).toISOString(),
-          exportType: "RGPD - Export des donn\xE9es personnelles",
+        const providedByYou = {
           profile: {
             email: c.email,
             firstName: c.firstName,
@@ -4760,8 +4887,50 @@ function createExportDataEndpoint(slugs) {
             rating: s.rating,
             comment: s.comment,
             createdAt: s.createdAt
+          })),
+          feedback: feedbackResult.docs.map((f) => ({
+            ticketId: f.ticket,
+            rating: f.rating,
+            comment: f.comment,
+            submittedFrom: f.submittedFrom,
+            createdAt: f.createdAt
+          })),
+          chatMessages: chatResult.docs.map((m) => ({
+            session: m.session,
+            senderType: m.senderType,
+            message: m.message,
+            createdAt: m.createdAt
+          })),
+          timeEntries: timeResult.docs.map((e) => ({
+            ticketId: e.ticket,
+            duration: e.duration,
+            date: e.date,
+            description: e.description,
+            billable: e.billable
           }))
         };
+        const exportData = {
+          exportDate: (/* @__PURE__ */ new Date()).toISOString(),
+          exportType: "RGPD - Export des donn\xE9es personnelles",
+          providedByYou: {
+            legalBasis: "Art. 20 RGPD - droit \xE0 la portabilit\xE9",
+            ...providedByYou
+          },
+          derivedData: {
+            legalBasis: "Art. 15 RGPD - droit d'acc\xE8s (donn\xE9es d\xE9riv\xE9es, hors portabilit\xE9)",
+            clientSummaries: summariesResult.docs.map((s) => ({
+              summary: s.summary,
+              recurringTopics: s.recurringTopics,
+              patterns: s.patterns,
+              keyFacts: s.keyFacts,
+              ticketCount: s.ticketCount,
+              messageCount: s.messageCount,
+              averageSatisfaction: s.averageSatisfaction,
+              generatedAt: s.generatedAt,
+              aiModel: s.aiModel
+            }))
+          }
+        };
         const json = JSON.stringify(exportData, null, 2);
         return new Response(json, {
           status: 200,
@@ -5205,13 +5374,14 @@ function verifyTwoFactorChallenge(email, token, now = Date.now()) {
 }
 
 // src/endpoints/login.ts
+var MAX_LOGGED_USER_AGENT = 256;
 function createLoginEndpoint(slugs, store) {
   const loginLimiter = new RateLimiter(15 * 6e4, 10, store, "login");
   return {
     path: "/support/login",
     method: "post",
     handler: async (req) => {
-      const ip = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || req.headers.get("x-real-ip") || "unknown";
+      const ip = clientIpRateKey(req);
       if (await loginLimiter.check(ip, req)) {
         return Response.json(
           { error: "Trop de tentatives. R\xE9essayez dans quelques minutes." },
@@ -5226,7 +5396,7 @@ function createLoginEndpoint(slugs, store) {
         return Response.json({ error: "Invalid JSON body" }, { status: 400 });
       }
       const { email, password } = body;
-      const userAgent = req.headers.get("user-agent") || "";
+      const userAgent = (req.headers.get("user-agent") || "").slice(0, MAX_LOGGED_USER_AGENT);
       if (!email || !password) {
         return Response.json({ error: "Email et mot de passe requis." }, { status: 400 });
       }
@@ -5314,7 +5484,19 @@ function createAuth2faEndpoint(slugs, store) {
         if (!action || !email) {
           return Response.json({ error: "Param\xE8tres manquants" }, { status: 400 });
         }
-        const genericSendResponse = { success: true, message: "Si un compte existe, un code a \xE9t\xE9 envoy\xE9." };
+        const limiterKey = normalizeEmail(email);
+        const sendResponse = () => {
+          let refreshed;
+          try {
+            refreshed = issueTwoFactorChallenge(email);
+          } catch {
+          }
+          return Response.json({
+            success: true,
+            message: "Si un compte existe, un code a \xE9t\xE9 envoy\xE9.",
+            ...refreshed ? { challenge: refreshed } : {}
+          });
+        };
         if (action === "send") {
           if (!verifyTwoFactorChallenge(email, challenge)) {
             return Response.json(
@@ -5322,8 +5504,8 @@ function createAuth2faEndpoint(slugs, store) {
               { status: 401 }
             );
           }
-          if (await sendLimiter.check(email, req)) {
-            return Response.json(genericSendResponse);
+          if (await sendLimiter.check(limiterKey, req)) {
+            return sendResponse();
           }
           const clients = await dbFind(payload, slugs.supportClients, {
             where: { email: { equals: email } },
@@ -5332,7 +5514,7 @@ function createAuth2faEndpoint(slugs, store) {
             overrideAccess: true
           });
           if (clients.docs.length === 0) {
-            return Response.json(genericSendResponse);
+            return sendResponse();
           }
           const client = clients.docs[0];
           const plainCode = generateSecureCode();
@@ -5357,13 +5539,19 @@ function createAuth2faEndpoint(slugs, store) {
               <p style="font-size: 13px; color: #6b7280;">Ce code est valable 10 minutes.</p>
             </div>`
           });
-          return Response.json(genericSendResponse);
+          return sendResponse();
         }
         if (action === "verify") {
+          if (!verifyTwoFactorChallenge(email, challenge)) {
+            return Response.json(
+              { error: "Authentification requise avant la v\xE9rification d'un code." },
+              { status: 401 }
+            );
+          }
           if (!code) {
             return Response.json({ error: "Code manquant" }, { status: 400 });
           }
-          if (await verifyLimiter.check(email, req)) {
+          if (await verifyLimiter.check(limiterKey, req)) {
             return Response.json(
               { error: "Trop de tentatives. R\xE9essayez dans 15 minutes." },
               { status: 429 }
@@ -5404,7 +5592,7 @@ function createAuth2faEndpoint(slugs, store) {
             data: { twoFactorCode: "", twoFactorExpiry: "", twoFactorVerifiedAt: (/* @__PURE__ */ new Date()).toISOString() },
             overrideAccess: true
           });
-          verifyLimiter.reset(email);
+          await verifyLimiter.reset(limiterKey, req);
           return Response.json({ success: true, verified: true });
         }
         return Response.json({ error: "Action invalide" }, { status: 400 });
@@ -5656,15 +5844,22 @@ function createOAuthGoogleEndpoint(slugs, options) {
     }
   };
 }
-
-// src/endpoints/delete-account.ts
+function collectAttachmentIds(docs, into) {
+  for (const doc of docs) {
+    for (const attachment of doc.attachments ?? []) {
+      const file = attachment?.file;
+      const id = file != null && typeof file === "object" ? file.id : file;
+      if (id != null) into.add(id);
+    }
+  }
+}
 function createDeleteAccountEndpoint(slugs) {
   return {
     path: "/support/delete-account",
     method: "post",
     handler: async (req) => {
       try {
-        const payload = req.payload;
+        const payload$1 = req.payload;
         requireClient(req, slugs);
         const body = await req.json();
         const { confirmPassword } = body;
@@ -5675,7 +5870,7 @@ function createDeleteAccountEndpoint(slugs) {
           );
         }
         try {
-          await payload.login({
+          await payload$1.login({
             collection: slugs.supportClients,
             data: { email: req.user.email, password: confirmPassword }
           });
@@ -5686,44 +5881,135 @@ function createDeleteAccountEndpoint(slugs) {
           );
         }
         const clientId = req.user.id;
-        const tickets = await dbFind(payload, slugs.tickets, {
-          where: { client: { equals: clientId } },
-          limit: 1e4,
-          depth: 0,
-          overrideAccess: true,
-          select: { id: true }
-        });
-        const ticketIds = tickets.docs.map((t) => t.id);
-        if (ticketIds.length > 0) {
-          await dbDelete(payload, slugs.ticketMessages, {
-            where: { ticket: { in: ticketIds } },
-            overrideAccess: true
-          });
-          await dbDelete(payload, slugs.ticketActivityLog, {
-            where: { ticket: { in: ticketIds } },
-            overrideAccess: true
-          });
-          await dbDelete(payload, slugs.timeEntries, {
-            where: { ticket: { in: ticketIds } },
-            overrideAccess: true
-          });
-          await dbDelete(payload, slugs.tickets, {
+        const clientEmail = req.user.email;
+        const isRegistered = (slug) => Boolean(payload$1.collections?.[slug]);
+        const startedTransaction = await payload.initTransaction(req);
+        try {
+          const tickets = await dbFind(payload$1, slugs.tickets, {
             where: { client: { equals: clientId } },
-            overrideAccess: true
+            limit: 1e4,
+            depth: 0,
+            overrideAccess: true,
+            select: { id: true },
+            req
           });
+          const ticketIds = tickets.docs.map((t) => t.id);
+          const attachmentIds = /* @__PURE__ */ new Set();
+          if (ticketIds.length > 0) {
+            const messages = await dbFind(
+              payload$1,
+              slugs.ticketMessages,
+              {
+                where: { ticket: { in: ticketIds } },
+                limit: 1e4,
+                depth: 0,
+                overrideAccess: true,
+                req
+              }
+            );
+            collectAttachmentIds(messages.docs, attachmentIds);
+          }
+          if (isRegistered(slugs.pendingEmails)) {
+            const pendingEmails = await dbFind(
+              payload$1,
+              slugs.pendingEmails,
+              {
+                where: { client: { equals: clientId } },
+                limit: 1e4,
+                depth: 0,
+                overrideAccess: true,
+                req
+              }
+            );
+            collectAttachmentIds(pendingEmails.docs, attachmentIds);
+          }
+          if (ticketIds.length > 0) {
+            for (const slug of [FIXED_SLUGS.ticketFeedback, FIXED_SLUGS.ticketCollaborators]) {
+              if (!isRegistered(slug)) continue;
+              await dbDelete(payload$1, slug, {
+                where: {
+                  or: [
+                    { ticket: { in: ticketIds } },
+                    { client: { equals: clientId } }
+                  ]
+                },
+                overrideAccess: true,
+                req
+              });
+            }
+          }
+          if (ticketIds.length > 0) {
+            await dbDelete(payload$1, slugs.tickets, {
+              where: { client: { equals: clientId } },
+              overrideAccess: true,
+              req
+            });
+          }
+          for (const slug of [
+            slugs.satisfactionSurveys,
+            slugs.chatMessages,
+            slugs.notificationQueue,
+            slugs.pendingEmails,
+            FIXED_SLUGS.clientSummaries,
+            FIXED_SLUGS.ticketFeedback
+          ]) {
+            if (!isRegistered(slug)) continue;
+            await dbDelete(payload$1, slug, {
+              where: { client: { equals: clientId } },
+              overrideAccess: true,
+              req
+            });
+          }
+          if (isRegistered(FIXED_SLUGS.ticketCollaborators)) {
+            await dbDelete(payload$1, FIXED_SLUGS.ticketCollaborators, {
+              where: {
+                or: [
+                  { client: { equals: clientId } },
+                  ...clientEmail ? [{ email: { equals: clientEmail } }] : []
+                ]
+              },
+              overrideAccess: true,
+              req
+            });
+          }
+          if (clientEmail) {
+            if (isRegistered(slugs.authLogs)) {
+              await dbDelete(payload$1, slugs.authLogs, {
+                where: { email: { equals: clientEmail } },
+                overrideAccess: true,
+                req
+              });
+            }
+            if (isRegistered(slugs.emailLogs)) {
+              await dbDelete(payload$1, slugs.emailLogs, {
+                where: {
+                  or: [
+                    { senderEmail: { equals: clientEmail } },
+                    { recipientEmail: { equals: clientEmail } }
+                  ]
+                },
+                overrideAccess: true,
+                req
+              });
+            }
+          }
+          for (const id of isRegistered(slugs.media) ? attachmentIds : []) {
+            await dbDelete(payload$1, slugs.media, {
+              id,
+              overrideAccess: true,
+              req
+            });
+          }
+          await dbDelete(payload$1, slugs.supportClients, {
+            id: clientId,
+            overrideAccess: true,
+            req
+          });
+          if (startedTransaction) await payload.commitTransaction(req);
+        } catch (err) {
+          if (startedTransaction) await payload.killTransaction(req);
+          throw err;
         }
-        await dbDelete(payload, slugs.satisfactionSurveys, {
-          where: { client: { equals: clientId } },
-          overrideAccess: true
-        });
-        await dbDelete(payload, slugs.chatMessages, {
-          where: { client: { equals: clientId } },
-          overrideAccess: true
-        });
-        await dbDelete(payload, slugs.supportClients, {
-          id: clientId,
-          overrideAccess: true
-        });
         const headers = new Headers({ "Content-Type": "application/json" });
         const secure = process.env.NODE_ENV === "production";
         headers.append(
@@ -5966,7 +6252,7 @@ function createImportConversationEndpoint(slugs, store) {
         if (!isAuthed) {
           return Response.json({ error: "Unauthorized" }, { status: 401 });
         }
-        const ip = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || "unknown";
+        const ip = clientIpRateKey(req);
         if (await importLimiter.check(ip, req)) {
           return Response.json({ error: "Rate limit exceeded. Maximum 10 imports per hour." }, { status: 429 });
         }
@@ -6174,6 +6460,21 @@ var WEBHOOK_URL_MESSAGES = {
   scheme_not_allowed: "Seules les URL https:// sont accept\xE9es.",
   private_host: "Les adresses priv\xE9es, loopback et link-local sont interdites (SSRF)."
 };
+var MAX_PUSH_ENDPOINT_LENGTH = 2048;
+function validatePushEndpoint(raw) {
+  if (typeof raw !== "string" || !raw.trim() || raw.length > MAX_PUSH_ENDPOINT_LENGTH) {
+    return { ok: false, reason: "invalid_url" };
+  }
+  let url;
+  try {
+    url = new URL(raw.trim());
+  } catch {
+    return { ok: false, reason: "invalid_url" };
+  }
+  if (url.protocol !== "https:") return { ok: false, reason: "scheme_not_allowed" };
+  if (isBlockedHost(url.hostname)) return { ok: false, reason: "private_host" };
+  return { ok: true, url };
+}
 var LOOKUP_TIMEOUT_MS = 5e3;
 var LOOKUP_TIMED_OUT = /* @__PURE__ */ Symbol("lookup-timed-out");
 var NONEXISTENT_HOST_CODES = /* @__PURE__ */ new Set(["ENOTFOUND", "ENODATA", "NOTFOUND"]);
@@ -6629,6 +6930,15 @@ async function sendPushToUser(payload, slugs, userId, notification) {
     for (const s of subs.docs) {
       const row = s;
       if (!row.endpoint || !row.p256dh || !row.auth) continue;
+      const check = validatePushEndpoint(row.endpoint);
+      if (!check.ok || !check.url) {
+        console.warn("[support] Push endpoint refused (unsafe URL):", check.reason);
+        continue;
+      }
+      if (!await assertPublicHost(check.url.hostname)) {
+        console.warn("[support] Push endpoint refused (host resolves to a private address)");
+        continue;
+      }
       try {
         await webpush__default.default.sendNotification(
           { endpoint: row.endpoint, keys: { p256dh: row.p256dh, auth: row.auth } },
@@ -6679,7 +6989,14 @@ function createPushSubscribeEndpoint(slugs) {
         if (!endpoint || !p256dh || !auth) {
           return Response.json({ error: "subscription invalide (endpoint + keys requis)." }, { status: 400 });
         }
-        const data = { user: req.user.id, endpoint, p256dh, auth, userAgent: req.headers.get("user-agent") || "" };
+        const endpointCheck = validatePushEndpoint(endpoint);
+        if (!endpointCheck.ok) {
+          return Response.json(
+            { error: WEBHOOK_URL_MESSAGES[endpointCheck.reason || "invalid_url"] },
+            { status: 400 }
+          );
+        }
+        const data = { user: req.user.id, endpoint, p256dh, auth, userAgent: (req.headers.get("user-agent") || "").slice(0, 256) };
         const existing = await dbFind(req.payload, slugs.pushSubscriptions, { where: { endpoint: { equals: endpoint } }, limit: 1, depth: 0, overrideAccess: true });
         if (existing.docs.length > 0) {
           await dbUpdate(req.payload, slugs.pushSubscriptions, { id: existing.docs[0].id, data, overrideAccess: true });
@@ -8335,9 +8652,11 @@ function createCascadeDelete(slugs) {
   return async ({ id, req }) => {
     const collections = [slugs.ticketMessages, slugs.ticketActivityLog, slugs.timeEntries, slugs.satisfactionSurveys];
     for (const slug of collections) {
+      if (!req.payload.collections?.[slug]) continue;
       await dbDelete(req.payload, slug, {
         where: { ticket: { equals: id } },
-        overrideAccess: true
+        overrideAccess: true,
+        req
       });
     }
   };
@@ -9825,7 +10144,7 @@ function createSupportClientsCollection(slugs, options) {
 }
 
 // src/collections/TimeEntries.ts
-async function recalculateTicketTime(payload, slugs, ticketId) {
+async function recalculateTicketTime(payload, slugs, ticketId, req) {
   let totalMinutes = 0;
   let page = 1;
   let hasMore = true;
@@ -9837,7 +10156,8 @@ async function recalculateTicketTime(payload, slugs, ticketId) {
       page,
       depth: 0,
       overrideAccess: true,
-      select: { duration: true }
+      select: { duration: true },
+      req
     });
     for (const entry of entries.docs) {
       totalMinutes += entry.duration || 0;
@@ -9849,14 +10169,15 @@ async function recalculateTicketTime(payload, slugs, ticketId) {
     collection: slugs.tickets,
     id: ticketId,
     data: { totalTimeMinutes: totalMinutes },
-    overrideAccess: true
+    overrideAccess: true,
+    req
   });
 }
 function createRecalculateTicketTime(slugs) {
   return async ({ doc, req }) => {
     if (!doc.ticket) return;
     const ticketId = typeof doc.ticket === "object" ? doc.ticket.id : doc.ticket;
-    await recalculateTicketTime(req.payload, slugs, ticketId);
+    await recalculateTicketTime(req.payload, slugs, ticketId, req);
   };
 }
 function createRecalculateTicketTimeOnDelete(slugs) {
@@ -9864,7 +10185,7 @@ function createRecalculateTicketTimeOnDelete(slugs) {
     if (!doc?.ticket) return;
     const ticketId = typeof doc.ticket === "object" ? doc.ticket.id : doc.ticket;
     try {
-      await recalculateTicketTime(req.payload, slugs, ticketId);
+      await recalculateTicketTime(req.payload, slugs, ticketId, req);
     } catch (err) {
       console.error("[support] Failed to recalculate ticket time after delete:", err);
     }
@@ -11735,8 +12056,30 @@ function supportPlugin(config) {
       rateLimitStore,
       capabilities: config?.capabilities
     });
+    const retention = config?.retention === false ? void 0 : config?.retention;
+    const retentionEnabled = Boolean(retention);
+    const purgeTask = {
+      slug: PURGE_LOGS_TASK_SLUG,
+      label: "Support \u2014 purge des journaux",
+      schedule: [
+        {
+          cron: retention?.cron ?? DEFAULT_RETENTION.cron,
+          queue: retention?.queue ?? DEFAULT_RETENTION.queue
+        }
+      ],
+      handler: async ({ req }) => {
+        const result = await runScheduledPurge(req.payload, slugs, retention, req);
+        return { output: result };
+      }
+    };
+    const existingJobs = incomingConfig.jobs;
+    const jobs = retentionEnabled ? {
+      ...existingJobs,
+      tasks: [...existingJobs?.tasks ?? [], purgeTask]
+    } : existingJobs;
     return {
       ...incomingConfig,
+      jobs,
       // Publish the resolved staff collection so the server-side readers share
       // ONE source of truth with the writers. `requireAdmin` compares against
       // `slugs.users`; the `payload-preferences` reads used to scope themselves
@@ -11763,11 +12106,13 @@ function supportPlugin(config) {
 
 exports.DEFAULT_FEATURES = DEFAULT_FEATURES;
 exports.DEFAULT_INBOUND_EMAIL_LIMITS = DEFAULT_INBOUND_EMAIL_LIMITS;
+exports.DEFAULT_RETENTION = DEFAULT_RETENTION;
 exports.DEFAULT_SETTINGS = DEFAULT_SETTINGS;
 exports.DEFAULT_SLUGS = DEFAULT_SLUGS;
 exports.DEFAULT_TICKETING_FEATURES = DEFAULT_TICKETING_FEATURES;
 exports.DEFAULT_USER_PREFS = DEFAULT_USER_PREFS;
 exports.MemoryRateLimitStore = MemoryRateLimitStore;
+exports.PURGE_LOGS_TASK_SLUG = PURGE_LOGS_TASK_SLUG;
 exports.PayloadRateLimitStore = PayloadRateLimitStore;
 exports.RateLimiter = RateLimiter;
 exports.calculateBusinessHoursDeadline = calculateBusinessHoursDeadline;
@@ -11800,10 +12145,13 @@ exports.dispatchWebhook = dispatchWebhook;
 exports.generateTicketSynthesis = generateTicketSynthesis;
 exports.normalizeFeatures = normalizeFeatures;
 exports.projectAutoClose = projectAutoClose;
+exports.purgeOlderThan = purgeOlderThan;
+exports.purgeableCollections = purgeableCollections;
 exports.readSupportSettings = readSupportSettings;
 exports.readSupportSettingsState = readSupportSettingsState;
 exports.readUserPrefs = readUserPrefs;
 exports.resolveSlugs = resolveSlugs;
+exports.runScheduledPurge = runScheduledPurge;
 exports.stripProjectedFeatures = stripProjectedFeatures;
 exports.supportPlugin = supportPlugin;
 exports.validateInboundEmailPayload = validateInboundEmailPayload;