Merge pull request #147 from Happybello365/feature/support-center-faq-captcha

feat: support center — FAQ accordion, CAPTCHA-protected contact form,…

Author: jhayniffy

backend/.env.example

@@ -61,3 +61,13 @@ LOG_LEVEL=info
 
 # Cache
 CACHE_TTL_SECONDS=60
+
+# CAPTCHA (Turnstile or hCaptcha)
+# Provider: turnstile | hcaptcha
+CAPTCHA_PROVIDER=turnstile
+# Set to 'dev-skip' to bypass verification in development
+CAPTCHA_SECRET_KEY=dev-skip
+CAPTCHA_SITE_KEY=
+
+# Support
+IP_HASH_SALT=change-me-in-production

backend/prisma/schema.prisma

@@ -175,3 +175,36 @@ model AllowedAsset {
 
   @@map("allowed_assets")
 }
+
+/// Support ticket submitted via the /support contact form.
+model SupportTicket {
+  id        String   @id @default(uuid())
+  email     String
+  subject   String
+  message   String
+  /// One-way hash of submitter IP for spam detection (no raw IP stored).
+  ipHash    String?
+  status    TicketStatus @default(OPEN)
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  @@index([status])
+  @@index([createdAt])
+  @@map("support_tickets")
+}
+
+/// Privacy-safe FAQ expansion counters.
+model FaqStat {
+  faqId      String   @id
+  expansions Int      @default(0)
+  updatedAt  DateTime @updatedAt
+
+  @@map("faq_stats")
+}
+
+enum TicketStatus {
+  OPEN
+  IN_PROGRESS
+  RESOLVED
+  CLOSED
+}

backend/src/config/env.validation.ts

@@ -43,5 +43,11 @@ export const validationSchema = Joi.object({
     .valid('error', 'warn', 'log', 'verbose', 'debug'),
   // Cache
   CACHE_TTL_SECONDS: Joi.number().default(60).description('Cache TTL in seconds'),
+  // CAPTCHA (Turnstile or hCaptcha)
+  CAPTCHA_PROVIDER: Joi.string().valid('turnstile', 'hcaptcha').default('turnstile'),
+  CAPTCHA_SECRET_KEY: Joi.string().allow('').default('dev-skip').description('Server-side CAPTCHA secret'),
+  CAPTCHA_SITE_KEY: Joi.string().allow('').description('Client-side CAPTCHA site key (exposed to frontend)'),
+  // Support
+  IP_HASH_SALT: Joi.string().allow('').default('niff-salt').description('Salt for IP hashing'),
 });
 

backend/src/support/captcha.service.ts

@@ -0,0 +1,46 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import axios from 'axios';
+
+@Injectable()
+export class CaptchaService {
+  private readonly logger = new Logger(CaptchaService.name);
+
+  constructor(private readonly config: ConfigService) {}
+
+  async verify(token: string, remoteIp?: string): Promise<boolean> {
+    const secret = this.config.get<string>('CAPTCHA_SECRET_KEY');
+
+    // In development/test with no secret configured, skip verification
+    if (!secret || secret === 'dev-skip') {
+      this.logger.warn('CAPTCHA verification skipped (no secret configured)');
+      return true;
+    }
+
+    const provider = this.config.get<string>('CAPTCHA_PROVIDER', 'turnstile');
+
+    try {
+      const url =
+        provider === 'hcaptcha'
+          ? 'https://hcaptcha.com/siteverify'
+          : 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
+
+      const body: Record<string, string> = { secret, response: token };
+      if (remoteIp) body['remoteip'] = remoteIp;
+
+      // Encode as application/x-www-form-urlencoded without relying on URLSearchParams
+      const encoded = Object.entries(body)
+        .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)
+        .join('&');
+
+      const { data } = await axios.post(url, encoded, {
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      });
+
+      return data.success === true;
+    } catch (err) {
+      this.logger.error('CAPTCHA verification error', err);
+      return false;
+    }
+  }
+}

backend/src/support/dto/create-ticket.dto.ts

@@ -0,0 +1,25 @@
+import { IsEmail, IsString, MaxLength, MinLength } from 'class-validator';
+import { ApiProperty } from '@nestjs/swagger';
+
+export class CreateTicketDto {
+  @ApiProperty({ example: 'user@example.com' })
+  @IsEmail()
+  email: string;
+
+  @ApiProperty({ example: 'Issue with my policy' })
+  @IsString()
+  @MinLength(5)
+  @MaxLength(120)
+  subject: string;
+
+  @ApiProperty({ example: 'I cannot find my policy document...' })
+  @IsString()
+  @MinLength(20)
+  @MaxLength(2000)
+  message: string;
+
+  @ApiProperty({ description: 'CAPTCHA token from Turnstile/hCaptcha' })
+  @IsString()
+  @MinLength(1)
+  captchaToken: string;
+}

backend/src/support/support.controller.ts

@@ -0,0 +1,47 @@
+import {
+  Body,
+  Controller,
+  HttpCode,
+  HttpStatus,
+  Ip,
+  Param,
+  Post,
+} from '@nestjs/common';
+import { ApiOperation, ApiResponse, ApiTags } from '@nestjs/swagger';
+import { Throttle } from '@nestjs/throttler';
+import { SupportService } from './support.service';
+import { CreateTicketDto } from './dto/create-ticket.dto';
+
+@ApiTags('Support')
+@Controller('support')
+export class SupportController {
+  constructor(private readonly supportService: SupportService) {}
+
+  /**
+   * POST /api/support/tickets
+   * Submit a support ticket. CAPTCHA token required.
+   * Rate-limited to 5 submissions per 10 minutes per IP.
+   */
+  @Post('tickets')
+  @HttpCode(HttpStatus.CREATED)
+  @Throttle({ default: { limit: 5, ttl: 600_000 } })
+  @ApiOperation({ summary: 'Submit a support ticket (CAPTCHA protected)' })
+  @ApiResponse({ status: 201, description: 'Ticket received' })
+  @ApiResponse({ status: 400, description: 'CAPTCHA failed or validation error' })
+  @ApiResponse({ status: 429, description: 'Rate limit exceeded' })
+  async submitTicket(@Body() dto: CreateTicketDto, @Ip() ip: string) {
+    return this.supportService.submitTicket(dto, ip);
+  }
+
+  /**
+   * POST /api/support/faq/:faqId/expand
+   * Privacy-safe FAQ expansion tracking.
+   */
+  @Post('faq/:faqId/expand')
+  @HttpCode(HttpStatus.NO_CONTENT)
+  @Throttle({ default: { limit: 60, ttl: 60_000 } })
+  @ApiOperation({ summary: 'Track FAQ entry expansion (privacy-safe)' })
+  async trackExpansion(@Param('faqId') faqId: string) {
+    await this.supportService.trackFaqExpansion(faqId);
+  }
+}

backend/src/support/support.module.ts

@@ -0,0 +1,12 @@
+import { Module } from '@nestjs/common';
+import { SupportController } from './support.controller';
+import { SupportService } from './support.service';
+import { CaptchaService } from './captcha.service';
+import { PrismaModule } from '../prisma/prisma.module';
+
+@Module({
+  imports: [PrismaModule],
+  controllers: [SupportController],
+  providers: [SupportService, CaptchaService],
+})
+export class SupportModule {}

backend/src/support/support.service.ts

@@ -0,0 +1,48 @@
+import { BadRequestException, Injectable, Logger } from '@nestjs/common';
+import { PrismaService } from '../prisma/prisma.service';
+import { CaptchaService } from './captcha.service';
+import { CreateTicketDto } from './dto/create-ticket.dto';
+
+@Injectable()
+export class SupportService {
+  private readonly logger = new Logger(SupportService.name);
+
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly captcha: CaptchaService,
+  ) {}
+
+  async submitTicket(dto: CreateTicketDto, remoteIp?: string) {
+    const valid = await this.captcha.verify(dto.captchaToken, remoteIp);
+    if (!valid) {
+      throw new BadRequestException('CAPTCHA verification failed');
+    }
+
+    const ticket = await this.prisma.supportTicket.create({
+      data: {
+        email: dto.email,
+        subject: dto.subject,
+        message: dto.message,
+        ipHash: remoteIp ? this.hashIp(remoteIp) : null,
+      },
+    });
+
+    this.logger.log(`Support ticket created: ${ticket.id}`);
+    return { id: ticket.id, status: 'received' };
+  }
+
+  async trackFaqExpansion(faqId: string) {
+    // Privacy-safe: only increment a counter, no user data stored
+    await this.prisma.faqStat.upsert({
+      where: { faqId },
+      update: { expansions: { increment: 1 } },
+      create: { faqId, expansions: 1 },
+    });
+  }
+
+  /** One-way hash so we can detect duplicate IPs without storing raw IPs */
+  private hashIp(ip: string): string {
+    const crypto = require('crypto');
+    return crypto.createHash('sha256').update(ip + process.env.IP_HASH_SALT ?? 'niff-salt').digest('hex');
+  }
+}

frontend/.env.example

@@ -0,0 +1,6 @@
+NEXT_PUBLIC_API_URL=http://localhost:3000
+# CAPTCHA site key (public, safe to expose)
+# Use Cloudflare Turnstile or hCaptcha site key
+NEXT_PUBLIC_CAPTCHA_SITE_KEY=
+# Provider: turnstile | hcaptcha
+NEXT_PUBLIC_CAPTCHA_PROVIDER=turnstile

frontend/src/app/support/page.tsx

@@ -0,0 +1,76 @@
+import { Metadata } from 'next';
+import { ExternalLink, MessageCircle, BookOpen } from 'lucide-react';
+import { Card, CardContent, CardHeader, CardTitle, CardDescription } from '@/components/ui/card';
+import { FaqAccordion } from '@/components/support/faq-accordion';
+import { ContactForm } from '@/components/support/contact-form';
+import { FAQ_ITEMS } from '@/lib/faq-data';
+
+export const metadata: Metadata = {
+  title: 'Support — NiffyInsur',
+  description: 'Get help with NiffyInsur. Browse FAQs or contact our support team.',
+};
+
+export default function SupportPage() {
+  return (
+    <main className="mx-auto max-w-3xl px-4 py-16 space-y-16">
+      {/* Header */}
+      <div className="text-center space-y-2">
+        <h1 className="text-3xl font-bold tracking-tight">Support Center</h1>
+        <p className="text-muted-foreground">
+          Find answers to common questions or reach out to our team.
+        </p>
+      </div>
+
+      {/* Quick links */}
+      <div className="grid grid-cols-1 sm:grid-cols-2 gap-4">
+        <a
+          href="https://discord.gg/niffyinsur"
+          target="_blank"
+          rel="noopener noreferrer"
+          className="flex items-center gap-3 rounded-lg border p-4 hover:bg-muted/50 transition-colors"
+        >
+          <MessageCircle className="h-5 w-5 text-primary shrink-0" />
+          <div>
+            <p className="font-medium text-sm">Discord Community</p>
+            <p className="text-xs text-muted-foreground">Chat with the community</p>
+          </div>
+          <ExternalLink className="ml-auto h-4 w-4 text-muted-foreground" />
+        </a>
+        <a
+          href="https://docs.niffyinsur.com"
+          target="_blank"
+          rel="noopener noreferrer"
+          className="flex items-center gap-3 rounded-lg border p-4 hover:bg-muted/50 transition-colors"
+        >
+          <BookOpen className="h-5 w-5 text-primary shrink-0" />
+          <div>
+            <p className="font-medium text-sm">Documentation</p>
+            <p className="text-xs text-muted-foreground">Guides and API reference</p>
+          </div>
+          <ExternalLink className="ml-auto h-4 w-4 text-muted-foreground" />
+        </a>
+      </div>
+
+      {/* FAQ */}
+      <section aria-labelledby="faq-heading">
+        <h2 id="faq-heading" className="text-xl font-semibold mb-4">Frequently Asked Questions</h2>
+        <FaqAccordion items={FAQ_ITEMS} />
+      </section>
+
+      {/* Contact form */}
+      <section aria-labelledby="contact-heading">
+        <Card>
+          <CardHeader>
+            <CardTitle id="contact-heading">Contact Support</CardTitle>
+            <CardDescription>
+              Can't find what you need? Send us a message and we'll respond within 1–2 business days.
+            </CardDescription>
+          </CardHeader>
+          <CardContent>
+            <ContactForm />
+          </CardContent>
+        </Card>
+      </section>
+    </main>
+  );
+}