@open-mercato/core 0.10.1-develop.7717.1.2befe9c634 → 0.10.1-develop.7721.1.b5c4a00a68

package/src/helpers/integration/communicationChannelsFixtures.ts

@@ -265,8 +265,9 @@ export async function seedInboundMessage(
 }
 
 /**
- * Best-effort hard delete of the rows one {@link seedInboundMessage} call created
- * (thread mapping, channel link, conversation and message). Run it before
+ * Best-effort hard delete of the rows one seeded or test-ingested inbound message
+ * created (thread mapping, channel link, external message, conversation and
+ * platform message). Run it before
  * {@link deleteChannelIfExists}: the purge is authorized against the live channel,
  * and disconnecting a channel deliberately retains its conversations and messages.
  * Safe to call with null ids in `finally`.
@@ -341,6 +342,63 @@ export async function ingestInboundChatMessage(
   };
 }
 
+/**
+ * Ingest an inbound email through the real `ingest_inbound_message` command on a
+ * channel connected with the default `email` flavor. The stub adapter turns the
+ * frame into an email-shaped inbound message whose sender is `senderAddress`, so
+ * the hub derives `externalEmail` from it and composes the platform message via
+ * `messages.messages.compose` exactly as a real IMAP/Gmail/Graph adapter would.
+ *
+ * Use this — not {@link seedInboundMessage}, which bypasses compose — for any
+ * assertion about what the hub does with an inbound email after ingest (for
+ * example that it is not echoed back to its sender, #6089). Prefix the supplied
+ * external conversation id with `inbound-seed:` when the test will use
+ * {@link purgeSeededInboundMessage} for teardown.
+ */
+export async function ingestInboundEmailMessage(
+  request: APIRequestContext,
+  token: string,
+  input: {
+    channelId: string;
+    senderAddress: string;
+    senderDisplayName?: string;
+    subject?: string;
+    body?: string;
+    externalMessageId: string;
+    externalConversationId: string;
+  },
+): Promise<{
+  status: string;
+  messageId: string | null;
+  conversationId: string | null;
+  channelLinkId: string | null;
+  channelType: string | null;
+}> {
+  const { senderAddress, ...rest } = input;
+  const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {
+    token,
+    data: { action: 'ingest-inbound', senderIdentifier: senderAddress, ...rest },
+  });
+  expect(
+    response.status(),
+    'POST /api/communication_channels/test-seed (ingest-inbound, email) should return 201',
+  ).toBe(201);
+  const body = await readJsonSafe<{
+    status?: string;
+    messageId?: string | null;
+    conversationId?: string | null;
+    channelLinkId?: string | null;
+    channelType?: string | null;
+  }>(response);
+  return {
+    status: body?.status ?? 'unknown',
+    messageId: body?.messageId ?? null,
+    conversationId: body?.conversationId ?? null,
+    channelLinkId: body?.channelLinkId ?? null,
+    channelType: body?.channelType ?? null,
+  };
+}
+
 export type InspectedMessageLinks = {
   links: Array<{
     id: string;

package/src/modules/catalog/api/bulk-delete/route.ts

@@ -2,6 +2,7 @@ import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import type { ProgressService } from '../../../progress/lib/progressService'
 import {
@@ -52,6 +53,15 @@ export async function POST(req: Request) {
   const ids = Array.from(new Set(parsed.data.ids))
   const container = await createRequestContainer()
   const progressService = container.resolve('progressService') as ProgressService
+  const orgScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
+  if (orgScope?.selectionRejected) {
+    return NextResponse.json(responseSchema.parse({
+      ok: false,
+      progressJobId: null,
+      message: 'Your selected organization is no longer available. Please re-select an organization and try again.',
+    }), { status: 422 })
+  }
+  const organizationId = orgScope?.selectedId ?? auth.orgId
 
   const progressJob = await progressService.createJob(
     {
@@ -69,7 +79,7 @@ export async function POST(req: Request) {
     },
     {
       tenantId: auth.tenantId,
-      organizationId: auth.orgId,
+      organizationId,
       userId: auth.sub,
     },
   )
@@ -79,7 +89,7 @@ export async function POST(req: Request) {
     progressJobId: progressJob.id,
     ids,
     scope: {
-      organizationId: auth.orgId,
+      organizationId,
       tenantId: auth.tenantId,
       userId: auth.sub,
     },

package/src/modules/communication_channels/api/post/test-seed/route.ts

@@ -13,6 +13,7 @@ import {
   ChannelThreadMapping,
   CommunicationChannel,
   ExternalConversation,
+  ExternalMessage,
   MessageChannelLink,
 } from '../../../data/entities'
 import { ChannelAccessDeniedError, assertCanManageChannel } from '../../../lib/access-control'
@@ -64,8 +65,8 @@ import {
  *     the inbound auto-link tests (TC-CRM-EMAIL-002..005). NOTE: this action
  *     deliberately bypasses `messages.messages.compose` — it can never prove that
  *     the hub accepts a message, only that downstream subscribers fire.
- *   - `purge-inbound`: hard-delete the rows one `emit-inbound` call seeded, for
- *     integration teardown.
+ *   - `purge-inbound`: hard-delete the rows one test-seeded or test-ingested
+ *     inbound message created, for integration teardown.
  */
 type RbacServiceLike = {
   loadAcl: (
@@ -137,9 +138,15 @@ const connectChannelSchema = z.object({
 const ingestInboundSchema = z.object({
   action: z.literal('ingest-inbound'),
   channelId: z.string().uuid(),
-  /** Opaque sender handle — a Discord snowflake, a Slack member id, etc. */
+  /**
+   * Opaque sender handle — a Discord snowflake, a Slack member id, etc. For a
+   * channel connected with the default `email` flavor this is the sender's
+   * address, and the email stub normalizes it into an email-shaped frame.
+   */
   senderIdentifier: z.string().min(1).max(255),
   senderDisplayName: z.string().max(255).optional(),
+  /** Honored by the email stub only; chat frames carry no subject. */
+  subject: z.string().max(500).optional(),
   body: z.string().max(50_000).optional(),
   externalMessageId: z.string().min(1).max(255),
   externalConversationId: z.string().min(1).max(255),
@@ -197,11 +204,11 @@ const emitInboundSchema = z.object({
 })
 
 /**
- * Teardown for `emit-inbound`: hard-delete the rows one seed created (thread
- * mapping, channel link, synthetic conversation and the `messages` row), scoped
- * to the caller's channel. Disconnecting a channel deliberately retains its
- * conversations and messages, so without this every seed leaks into the shared
- * integration database.
+ * Teardown for test-seeded or test-ingested inbound records: hard-delete the
+ * thread mapping, channel link, external message, synthetic conversation and
+ * platform message, scoped to the caller's channel. Disconnecting a channel
+ * deliberately retains these records, so without this every test leaks into the
+ * shared integration database.
  */
 const purgeInboundSchema = z.object({
   action: z.literal('purge-inbound'),
@@ -529,8 +536,8 @@ export async function POST(req: Request): Promise<Response> {
 
   if (body.action === 'purge-inbound') {
     const rowScope = { tenantId, organizationId }
-    // Only rows hanging off a conversation `emit-inbound` minted are purgeable,
-    // so a caller cannot use this action to hard-delete real channel traffic.
+    // Only rows hanging off a test-prefixed conversation are purgeable, so a
+    // caller cannot use this action to hard-delete real channel traffic.
     const seededConversation = await findOneWithDecryption(
       em,
       ExternalConversation,
@@ -556,6 +563,11 @@ export async function POST(req: Request): Promise<Response> {
       externalConversationId: body.conversationId,
       ...rowScope,
     })
+    await em.nativeDelete(ExternalMessage, {
+      conversationId: body.conversationId,
+      channelId: body.channelId,
+      ...rowScope,
+    })
     await em.nativeDelete(ExternalConversation, {
       id: body.conversationId,
       channelId: body.channelId,
@@ -564,6 +576,7 @@ export async function POST(req: Request): Promise<Response> {
     await deleteTestSeedPlatformMessage(em, {
       messageId: body.messageId,
       channelId: body.channelId,
+      conversationId: body.conversationId,
       ...rowScope,
     })
     return NextResponse.json({ ok: true })
@@ -579,11 +592,14 @@ export async function POST(req: Request): Promise<Response> {
     // check that `providerKey` matches the channel it names, so passing a
     // different one would silently stamp the wrong provider onto the link.
     const channelProviderKey = ownedChannel.providerKey
-    if (channelProviderKey !== TEST_SEED_CHAT_PROVIDER_KEY) {
+    if (
+      channelProviderKey !== TEST_SEED_CHAT_PROVIDER_KEY
+      && channelProviderKey !== TEST_SEED_PROVIDER_KEY
+    ) {
       return NextResponse.json(
         {
           error:
-            'ingest-inbound requires a channel connected with providerFlavor: "chat"; ' +
+            'ingest-inbound requires a channel connected through the test-seed stub; ' +
             `channel ${body.channelId} is '${channelProviderKey}'`,
         },
         { status: 422 },
@@ -610,6 +626,7 @@ export async function POST(req: Request): Promise<Response> {
           externalConversationId: body.externalConversationId,
           senderIdentifier: body.senderIdentifier,
           senderDisplayName: body.senderDisplayName,
+          ...(body.subject !== undefined ? { subject: body.subject } : {}),
           body: body.body ?? '',
         },
         eventType: 'message',

package/src/modules/communication_channels/lib/test-seed.ts

@@ -143,15 +143,16 @@ export async function createTestSeedPlatformMessage(
 }
 
 /**
- * Hard-delete a `messages` row seeded by {@link createTestSeedPlatformMessage}.
- * Matches only rows stamped as test-seed inbound for the given channel and
- * scope, so integration teardown can never remove a real message.
+ * Hard-delete a platform message created by the test-seed harness. Matches only
+ * the direct seed stamp or a test-prefixed conversation already verified by the
+ * test-seed route, so integration teardown cannot remove real traffic.
  */
 export async function deleteTestSeedPlatformMessage(
   em: EntityManager,
   input: {
     messageId: string
     channelId: string
+    conversationId: string
     tenantId: string
     organizationId: string | null
   },
@@ -159,11 +160,20 @@ export async function deleteTestSeedPlatformMessage(
   await em.getConnection().execute(
     `DELETE FROM messages
      WHERE id = ?
-       AND source_entity_type = 'communication_channels.test_seed_inbound'
-       AND source_entity_id = ?
+       AND (
+         (source_entity_type = 'communication_channels.test_seed_inbound' AND source_entity_id = ?)
+         OR
+         (source_entity_type = 'communication_channels.external_conversation' AND source_entity_id = ?)
+       )
        AND tenant_id = ?
        AND organization_id IS NOT DISTINCT FROM ?`,
-    [input.messageId, input.channelId, input.tenantId, input.organizationId],
+    [
+      input.messageId,
+      input.channelId,
+      input.conversationId,
+      input.tenantId,
+      input.organizationId,
+    ],
   )
 }
 
@@ -341,10 +351,39 @@ class TestSeedChannelAdapter implements ChannelAdapter {
     }
   }
 
-  async normalizeInbound(_raw: InboundMessage): Promise<NormalizedInboundMessage> {
-    // The test-seed inbound path seeds MessageChannelLink rows directly and emits
-    // the hub event, so this adapter never normalizes a raw inbound payload.
-    throw new Error('[internal] TestSeedChannelAdapter.normalizeInbound is not used by the seed harness')
+  async normalizeInbound(raw: InboundMessage): Promise<NormalizedInboundMessage> {
+    // Email-shaped frame for the test-seed `ingest-inbound` action: the sender is
+    // an address, so the message travels the REAL ingest path for an email
+    // channel — `ingest_inbound_message` derives `externalEmail` from it and
+    // composes through `messages.messages.compose` with `sendViaEmail: false`.
+    // That is the only way a test can prove the hub does not echo inbound mail
+    // back to its sender (#6089); `emit-inbound` bypasses compose entirely.
+    const frame = (raw.raw ?? {}) as Record<string, unknown>
+    const senderIdentifier = String(frame.senderIdentifier ?? '').trim()
+    if (!senderIdentifier.includes('@')) {
+      throw new Error('[internal] TestSeedChannelAdapter requires an email-shaped senderIdentifier')
+    }
+    const subject = typeof frame.subject === 'string' ? frame.subject : undefined
+    const body = typeof frame.body === 'string' ? frame.body : ''
+    const senderDisplayName =
+      typeof frame.senderDisplayName === 'string' ? frame.senderDisplayName : undefined
+    return {
+      externalMessageId: String(frame.externalMessageId ?? ''),
+      externalConversationId: String(frame.externalConversationId ?? ''),
+      senderIdentifier,
+      senderDisplayName,
+      subject,
+      body,
+      bodyFormat: 'text',
+      timestamp: new Date(),
+      channelPayload: {
+        from: { address: senderIdentifier, ...(senderDisplayName ? { name: senderDisplayName } : {}) },
+        ...(subject !== undefined ? { subject } : {}),
+        text: body,
+      },
+      channelContentType: 'text/plain',
+      channelMetadata: {},
+    }
   }
 
   async validateCredentials(_input: ValidateCredentialsInput): Promise<ValidateCredentialsResult> {

package/src/modules/messages/commands/messages.ts

@@ -322,14 +322,13 @@ const composeMessageCommand: CommandHandler<unknown, { id: string; threadId: str
         )?.threadId ?? input.parentMessageId
         : undefined
 
-      const isPublicVisibility = input.visibility === 'public'
-      // #6093: a channel-ingested message was RECEIVED, not sent. Ingest passes
-      // `sendViaEmail: false` on purpose; forcing it for public visibility would
-      // mail the assignee a copy and echo the message to its external sender
-      // (#6089) the moment the recipients waiver lets it compose. #6090 removes
-      // the forcing for every caller; until then it is skipped here for the
-      // ingest path only.
-      const sendViaEmail = isPublicVisibility && !input.inboundFromChannel ? true : input.sendViaEmail
+      // Honor the caller's explicit `sendViaEmail` (#6089, #6090). The messages API
+      // route forces email delivery for public messages a user composes; internal
+      // callers (communication_channels inbound ingest, send-as-user) compose
+      // `visibility: 'public'` with `sendViaEmail: false` on purpose. Forcing it
+      // here echoed every inbound email back to its sender through the tenant
+      // system email channel and made send-as-user deliver twice.
+      const sendViaEmail = input.sendViaEmail
       const message = trx.create(Message, {
         type: input.type,
         visibility: input.visibility ?? null,
@@ -435,8 +434,7 @@ const composeMessageCommand: CommandHandler<unknown, { id: string; threadId: str
         messageId,
         senderUserId: input.userId,
         recipientUserIds: input.recipients.map((recipient) => recipient.userId),
-        sendViaEmail:
-          input.visibility === 'public' && !input.inboundFromChannel ? true : input.sendViaEmail,
+        sendViaEmail: input.sendViaEmail,
         inboundFromChannel: input.inboundFromChannel === true,
         externalEmail: responseExternalEmail,
         tenantId: input.tenantId,

package/src/modules/portal/frontend/[orgSlug]/portal/dashboard/page.tsx

@@ -121,7 +121,7 @@ export default function PortalDashboardPage({ params }: Props) {
               const isHidden = hiddenWidgets.has(widget.metadata.id)
               return (
                 <Button key={widget.metadata.id} type="button" variant={isHidden ? 'outline' : 'default'} size="sm" className="rounded-lg text-sm" onClick={() => toggleWidget(widget.metadata.id)}>
-                  {widget.metadata.title || widget.metadata.id}
+                  {widget.metadata.title ? t(widget.metadata.title, widget.metadata.title) : widget.metadata.id}
                 </Button>
               )
             })}
@@ -136,7 +136,7 @@ export default function PortalDashboardPage({ params }: Props) {
             if (!WidgetComponent) return null
             return (
               <PortalCard key={widget.metadata.id}>
-                <PortalCardHeader title={widget.metadata.title || widget.metadata.id} />
+                <PortalCardHeader title={widget.metadata.title ? t(widget.metadata.title, widget.metadata.title) : widget.metadata.id} />
                 <WidgetComponent context={{ orgSlug: params.orgSlug, user, roles: auth.roles, resolvedFeatures: auth.resolvedFeatures }} />
               </PortalCard>
             )

package/src/modules/staff/AGENTS.md

@@ -407,7 +407,8 @@ Pinned by `lib/time-tracking-ui/__tests__/TimeEntryDialog.test.tsx` →
 | `staff.time_task.board:column-header` | `lib/time-tracking-ui/KanbanColumn.tsx` | `{ statusId, statusName, isDone, total, loggedMinutes }` |
 | `staff.time_task.board:{card-badges,card-footer}` | `lib/time-tracking-ui/KanbanCard.tsx` | `{ entityId, recordId, taskId, timeProjectId, taskStatusId, timerRunning }` |
 | `staff.my_work:{before-sections,after-sections}` | `backend/staff/time-tracking/page.tsx` | `{ staffMemberId, today, projectIds, retryLastMutation }` |
-| `staff.time_tracking.settings:sections` | `backend/staff/time-tracking/settings/page.tsx` | `{ moduleId, canManage }` |
+| `staff.time_tracking.settings:sections` | `backend/staff/time-tracking/settings/page.tsx` | `{ moduleId, canManage, keys, values, setValue }` |
+| `staff.time_tracking.settings:tabs` | `backend/staff/time-tracking/settings/page.tsx` | `{ moduleId, canManage, settings, onSettingsSaved }` — `placement: { kind: 'tab' }`; a tab owns its saves (writes built from `context.settings`, reported via `onSettingsSaved`) |
 | `staff.timesheets.timer-bar:actions` | `lib/timesheets-ui/TimerBar.tsx` | `{ staffMemberId, retryLastMutation }` |
 
 No context carries a rate, cost or amount; contributions that need money must ask for it
@@ -646,9 +647,10 @@ columns time tracking already carried:
 the query engine only ever looks a link up by `base`. **These are strings, never
 imports.** Staff is slated for extraction into a standalone package, so
 `data/extensions.ts` may not import a `customers` or `sales` symbol and
-`requires: ['planner', 'resources']` in [`index.ts`](./index.ts) must not grow;
-`__tests__/entityExtensions.test.ts` fails if either happens, and pins every table and
-column against the migration snapshots.
+`requires` in [`index.ts`](./index.ts) (`['planner', 'resources', 'dictionaries']`;
+`dictionaries` backs the support-ticket categories) must never gain `customers`, `sales` or
+`customer_accounts`; `__tests__/entityExtensions.test.ts` fails if either happens, and pins
+every table and column against the migration snapshots.
 
 **Declaration-only, exactly as in `apps/mercato/src/modules/example/data/extensions.ts`.**
 Nothing in the platform passes `includeExtensions` to a query, the basic engine's
@@ -820,6 +822,20 @@ The CLI enqueues onto the same queue with the same `ProgressJob` the settings
 screen uses; it does not do the work in process. An unknown `--hook` id refuses to
 start rather than silently doing nothing.
 
+## Customer support tickets
+
+Design of record: [`.ai/specs/2026-10-06-staff-helpdesk-support-tickets.md`](../../../../../.ai/specs/2026-10-06-staff-helpdesk-support-tickets.md).
+
+- **A ticket is a task.** `staff_time_tasks.source = 'portal'` plus `customer_id` (the ticket owner — never the project's customer), and a 1:1 `staff_support_tickets` row (same-module FK `task_id`) holding every helpdesk-only field. The customer's original request lives in the encrypted `customer_request_snapshot`; the portal reads it and NEVER the staff-editable task title/description.
+- **Routing** (`lib/support/routing.ts`): per-category `staff_support_routing_rules` override the organization fallback rule (`category_value IS NULL`, exactly one, cannot be deleted or paused). Paused, unusable (completed/deleted/no `isDefault` status) or orphaned overrides fall back. Categories are the per-org dictionary `staff.support_ticket_category` (exact org, no ancestors). `seedDefaults` seeds categories, the "Customer support" project and the fallback rule; existing tenants run `mercato staff seed-support-defaults`.
+- **Settings UI**: categories, routing and the reference prefix are the "Support" tab (`widgets/injection/time-tracking-settings-support`) of `/backend/staff/time-tracking/settings`, mounted on the `staff.time_tracking.settings:tabs` spot. A tab saves on its own; when it writes the settings record it must build the body from `context.settings` and call `context.onSettingsSaved(response)` so the page's draft is rebased, not overwritten.
+- **Backoffice reads for agents**: `GET /api/staff/timesheets/support-tickets/options` (`staff.timesheets.tasks.view`) serves the Support Inbox filters (categories, project-scoped assignees); tasks carry `_staffAssignment: { canClaim, canRelease }`, computed with the claim command's predicate. Never derive claimability client-side.
+- **Portal routes** `/api/staff/portal/support-tickets/*` (options, list, create, detail, messages, attachments) resolve identity via dynamic import (no static `customer_accounts` edge) and load every row WITH `portalOwnedTaskWhere` (`lib/support/portalTickets.ts`). Features `portal.support_tickets.view|manage` are customer features granted via `defaultCustomerRoleFeatures`, not `acl.ts`. Attachments load the attachments module dynamically; customer uploads carry `customer-visible` + `customer-upload:<customerUserId>` tags and only the uploader may delete.
+- **Conversation**: comment `visibility` defaults to `internal`; `customer` is refused (422) on non-portal tasks; `author_kind = 'customer'` comments are immutable for staff, `manage_all` included. Comment CRUD events carry `portalVisible`.
+- **Events**: `staff.support_ticket.created|customer_replied` are server-side only (they name the customer); `activity_recorded` is the id-only client broadcast (also emitted with `kind: attachment_added|attachment_removed` plus the changed `attachmentId` — which keeps rapid uploads distinct for the browser bridge's 500 ms duplicate filter — by the portal attachments route via `lib/support/supportActivity.ts`, so an open TaskDrawer refetches "Ticket files", whose list is a drawer query invalidated with task/comments); `portal_updated` is emitted only by `lib/support/portalBroadcast.ts` with pinned `recipientUserIds` and never with an empty list. `staff.timesheets.time_task.assignee_changed` (client broadcast, ids only, `changeKind`) is emitted by claim/release/manual edits and the portal default assignee.
+- **Assigners and default assignee**: `staff_time_project_members.is_assigner` (requires a linked user) grants claim (`POST /api/staff/timesheets/tasks/{id}/claim`, conditional update, 409 on a lost race) and release. `staff_time_projects.default_assignee_staff_member_id` applies to portal tickets ONLY — staff task creation keeps US-C1 (omitted or `null` → creator).
+- **Notification chain** (`lib/time-tracking/workRecipients.ts`): type audience → active assigners → owner → `createForFeature('staff.timesheets.projects.manage', restrictRecipientsToOrganization: true)`. The actor is excluded in steps 1–3 only. A support notification that reaches nobody sets `staff_support_tickets.unnotified_at` (cleared on assignment).
+
 ## Internal-Only Surfaces (NOT public contract)
 
 These are subject to change without deprecation; do not import them from non-staff code:
@@ -836,9 +852,9 @@ If you need data from staff in another core module, the correct path is:
 
 ## Dependencies
 
-Staff currently declares `requires: ['planner', 'resources']` in [`index.ts`](./index.ts). The dependency direction is intentional and asymmetric:
+Staff currently declares `requires: ['planner', 'resources', 'dictionaries']` in [`index.ts`](./index.ts). The dependency direction is intentional and asymmetric:
 
-- Staff depends on planner + resources (hard requirement at load time).
+- Staff depends on planner + resources (hard requirement at load time), and on dictionaries for the support-ticket categories.
 - Planner soft-resolves `availabilityAccessResolver` via DI with `allowUnregistered: true` (graceful degradation when staff is absent).
 
 This asymmetry will be reconciled in the Phase 2/3 follow-up when staff becomes its own npm package; for now, planner is the only consumer that must work without staff registered.