@open-mercato/core 0.4.5-develop-754ef4d2f0 → 0.4.5-develop-9f9549ebc8

package/src/modules/dashboards/i18n/es.json

@@ -102,5 +102,9 @@
   "dashboards.widgets.loading": "Cargando opciones de widgets…",
   "dashboards.widgets.mode.hint": "Este usuario hereda los widgets de sus roles asignados. Cambia a sobrescribir para personalizar.",
   "dashboards.widgets.mode.inherit": "Heredar de los roles",
-  "dashboards.widgets.mode.override": "Sobrescribir para este usuario"
+  "dashboards.widgets.mode.override": "Sobrescribir para este usuario",
+  "dashboards.widgets.effective": "Widgets efectivos:",
+  "dashboards.widgets.reset": "Restablecer",
+  "dashboards.widgets.save": "Guardar widgets",
+  "dashboards.widgets.saving": "Guardando…"
 }

package/src/modules/dashboards/i18n/pl.json

@@ -102,5 +102,9 @@
   "dashboards.widgets.loading": "Ładowanie opcji widżetów…",
   "dashboards.widgets.mode.hint": "Ten użytkownik dziedziczy widżety z przypisanych ról. Wybierz nadpisanie, aby je dostosować.",
   "dashboards.widgets.mode.inherit": "Dziedzicz po rolach",
-  "dashboards.widgets.mode.override": "Nadpisz dla tego użytkownika"
+  "dashboards.widgets.mode.override": "Nadpisz dla tego użytkownika",
+  "dashboards.widgets.effective": "Aktywne widżety:",
+  "dashboards.widgets.reset": "Resetuj",
+  "dashboards.widgets.save": "Zapisz widżety",
+  "dashboards.widgets.saving": "Zapisywanie…"
 }

package/src/modules/dictionaries/i18n/de.json

@@ -91,10 +91,23 @@
   "dictionaries.entries.update": "Wörterbucheintrag aktualisieren",
   "dictionaries.errors.currency_protected": "Das Währungswörterbuch ist erforderlich und kann nicht geändert oder gelöscht werden.",
   "dictionaries.errors.duplicate": "Ein Wörterbuch mit diesem Schlüssel existiert bereits",
+  "dictionaries.errors.entry_create_failed": "Wörterbucheintrag konnte nicht erstellt werden.",
   "dictionaries.errors.entry_duplicate": "Ein Eintrag mit diesem Wert existiert bereits",
   "dictionaries.errors.entry_not_found": "Wörterbucheintrag nicht gefunden",
   "dictionaries.errors.entry_required": "Wert ist erforderlich",
+  "dictionaries.errors.entry_update_failed": "Wörterbucheintrag konnte nicht aktualisiert werden.",
   "dictionaries.errors.not_found": "Wörterbuch nicht gefunden",
   "dictionaries.errors.organization_required": "Organisationskontext ist erforderlich",
-  "dictionaries.errors.unauthorized": "Nicht autorisiert"
+  "dictionaries.errors.unauthorized": "Nicht autorisiert",
+  "dictionaries.form.colorClear": "Farbe entfernen",
+  "dictionaries.form.colorHelp": "Hervorhebungsfarbe für diesen Eintrag wählen.",
+  "dictionaries.form.colorLabel": "Farbe",
+  "dictionaries.form.iconClearLabel": "Symbol entfernen",
+  "dictionaries.form.iconLabel": "Symbol",
+  "dictionaries.form.iconPickerTriggerLabel": "Symbole durchsuchen",
+  "dictionaries.form.iconPlaceholder": "Emoji oder Symbolname eingeben",
+  "dictionaries.form.iconSearchEmptyLabel": "Keine Symbole entsprechen Ihrer Suche",
+  "dictionaries.form.iconSearchPlaceholder": "Symbole oder Emojis suchen…",
+  "dictionaries.form.iconSuggestionsLabel": "Vorschläge",
+  "dictionaries.form.previewEmptyLabel": "Keine Darstellung ausgewählt"
 }

package/src/modules/dictionaries/i18n/en.json

@@ -91,10 +91,23 @@
   "dictionaries.entries.update": "Update dictionary entry",
   "dictionaries.errors.currency_protected": "The currency dictionary is required and cannot be modified or deleted.",
   "dictionaries.errors.duplicate": "A dictionary with this key already exists",
+  "dictionaries.errors.entry_create_failed": "Failed to create dictionary entry.",
   "dictionaries.errors.entry_duplicate": "An entry with this value already exists",
   "dictionaries.errors.entry_not_found": "Dictionary entry not found",
   "dictionaries.errors.entry_required": "Value is required",
+  "dictionaries.errors.entry_update_failed": "Failed to update dictionary entry.",
   "dictionaries.errors.not_found": "Dictionary not found",
   "dictionaries.errors.organization_required": "Organization context is required",
-  "dictionaries.errors.unauthorized": "Unauthorized"
+  "dictionaries.errors.unauthorized": "Unauthorized",
+  "dictionaries.form.colorClear": "Clear color",
+  "dictionaries.form.colorHelp": "Pick a highlight color for this entry.",
+  "dictionaries.form.colorLabel": "Color",
+  "dictionaries.form.iconClearLabel": "Clear icon",
+  "dictionaries.form.iconLabel": "Icon",
+  "dictionaries.form.iconPickerTriggerLabel": "Browse icons",
+  "dictionaries.form.iconPlaceholder": "Type an emoji or icon name",
+  "dictionaries.form.iconSearchEmptyLabel": "No icons match your search",
+  "dictionaries.form.iconSearchPlaceholder": "Search icons or emojis…",
+  "dictionaries.form.iconSuggestionsLabel": "Suggestions",
+  "dictionaries.form.previewEmptyLabel": "No appearance selected"
 }

package/src/modules/dictionaries/i18n/es.json

@@ -91,10 +91,23 @@
   "dictionaries.entries.update": "Actualizar entrada de diccionario",
   "dictionaries.errors.currency_protected": "El diccionario de monedas es obligatorio y no puede modificarse ni eliminarse.",
   "dictionaries.errors.duplicate": "Ya existe un diccionario con esta clave",
+  "dictionaries.errors.entry_create_failed": "Error al crear la entrada de diccionario.",
   "dictionaries.errors.entry_duplicate": "Ya existe una entrada con este valor",
   "dictionaries.errors.entry_not_found": "Entrada de diccionario no encontrada",
   "dictionaries.errors.entry_required": "El valor es obligatorio",
+  "dictionaries.errors.entry_update_failed": "Error al actualizar la entrada de diccionario.",
   "dictionaries.errors.not_found": "Diccionario no encontrado",
   "dictionaries.errors.organization_required": "Se requiere un contexto de organización",
-  "dictionaries.errors.unauthorized": "No autorizado"
+  "dictionaries.errors.unauthorized": "No autorizado",
+  "dictionaries.form.colorClear": "Limpiar color",
+  "dictionaries.form.colorHelp": "Seleccione un color de resaltado para esta entrada.",
+  "dictionaries.form.colorLabel": "Color",
+  "dictionaries.form.iconClearLabel": "Limpiar icono",
+  "dictionaries.form.iconLabel": "Icono",
+  "dictionaries.form.iconPickerTriggerLabel": "Explorar iconos",
+  "dictionaries.form.iconPlaceholder": "Escriba un emoji o nombre de icono",
+  "dictionaries.form.iconSearchEmptyLabel": "Ningún icono coincide con su búsqueda",
+  "dictionaries.form.iconSearchPlaceholder": "Buscar iconos o emojis…",
+  "dictionaries.form.iconSuggestionsLabel": "Sugerencias",
+  "dictionaries.form.previewEmptyLabel": "No se ha seleccionado apariencia"
 }

package/src/modules/dictionaries/i18n/pl.json

@@ -91,10 +91,23 @@
   "dictionaries.entries.update": "Zaktualizuj wpis słownika",
   "dictionaries.errors.currency_protected": "Słownik walut jest wymagany i nie może być modyfikowany ani usuwany.",
   "dictionaries.errors.duplicate": "Słownik o tym kluczu już istnieje",
+  "dictionaries.errors.entry_create_failed": "Nie udało się utworzyć wpisu słownikowego.",
   "dictionaries.errors.entry_duplicate": "Wpis o tej wartości już istnieje",
   "dictionaries.errors.entry_not_found": "Nie znaleziono wpisu słownika",
   "dictionaries.errors.entry_required": "Wartość jest wymagana",
+  "dictionaries.errors.entry_update_failed": "Nie udało się zaktualizować wpisu słownikowego.",
   "dictionaries.errors.not_found": "Nie znaleziono słownika",
   "dictionaries.errors.organization_required": "Wymagany jest kontekst organizacji",
-  "dictionaries.errors.unauthorized": "Brak autoryzacji"
+  "dictionaries.errors.unauthorized": "Brak autoryzacji",
+  "dictionaries.form.colorClear": "Wyczyść kolor",
+  "dictionaries.form.colorHelp": "Wybierz kolor wyróżnienia dla tego wpisu.",
+  "dictionaries.form.colorLabel": "Kolor",
+  "dictionaries.form.iconClearLabel": "Wyczyść ikonę",
+  "dictionaries.form.iconLabel": "Ikona",
+  "dictionaries.form.iconPickerTriggerLabel": "Przeglądaj ikony",
+  "dictionaries.form.iconPlaceholder": "Wpisz emoji lub nazwę ikony",
+  "dictionaries.form.iconSearchEmptyLabel": "Żadne ikony nie pasują do wyszukiwania",
+  "dictionaries.form.iconSearchPlaceholder": "Szukaj ikon lub emoji…",
+  "dictionaries.form.iconSuggestionsLabel": "Sugestie",
+  "dictionaries.form.previewEmptyLabel": "Nie wybrano wyglądu"
 }

package/src/modules/feature_toggles/i18n/de.json

@@ -11,6 +11,7 @@
   "feature_toggles.detail.fields.failMode": "Fehlermodus",
   "feature_toggles.detail.fields.identifier": "Kennung",
   "feature_toggles.detail.fields.name": "Name",
+  "feature_toggles.form.action.save": "Speichern",
   "feature_toggles.form.errors.load": "Feature-Schalter-Überschreibungen konnten nicht geladen werden",
   "feature_toggles.form.fields.category.label": "Kategorie",
   "feature_toggles.form.fields.defaultState.disabled": "Deaktiviert",
@@ -30,6 +31,8 @@
   "feature_toggles.form.groups.basic": "Grundinformationen",
   "feature_toggles.form.groups.defaultValue": "Standardwert",
   "feature_toggles.form.groups.type": "Typkonfiguration",
+  "feature_toggles.form.loading": "Wird geladen…",
+  "feature_toggles.form.title.edit": "Feature-Toggle bearbeiten",
   "feature_toggles.global.help.title": "Feature-Schalter",
   "feature_toggles.list.confirmDelete": "Feature-Schalter \"{identifier}\" löschen?",
   "feature_toggles.list.error.load": "Feature-Schalter konnten nicht geladen werden",

package/src/modules/feature_toggles/i18n/en.json

@@ -11,6 +11,7 @@
   "feature_toggles.detail.fields.failMode": "Fail Mode",
   "feature_toggles.detail.fields.identifier": "Identifier",
   "feature_toggles.detail.fields.name": "Name",
+  "feature_toggles.form.action.save": "Save",
   "feature_toggles.form.errors.load": "Failed to load feature toggle overrides",
   "feature_toggles.form.fields.category.label": "Category",
   "feature_toggles.form.fields.defaultState.disabled": "Disabled",
@@ -30,6 +31,8 @@
   "feature_toggles.form.groups.basic": "Basic Information",
   "feature_toggles.form.groups.defaultValue": "Default Value",
   "feature_toggles.form.groups.type": "Type Configuration",
+  "feature_toggles.form.loading": "Loading…",
+  "feature_toggles.form.title.edit": "Edit Feature Toggle",
   "feature_toggles.global.help.title": "Feature Toggles",
   "feature_toggles.list.confirmDelete": "Delete feature toggle \"{identifier}\"?",
   "feature_toggles.list.error.load": "Failed to load feature toggles",

package/src/modules/feature_toggles/i18n/es.json

@@ -11,6 +11,7 @@
   "feature_toggles.detail.fields.failMode": "Modo de Fallo",
   "feature_toggles.detail.fields.identifier": "Identificador",
   "feature_toggles.detail.fields.name": "Nombre",
+  "feature_toggles.form.action.save": "Guardar",
   "feature_toggles.form.errors.load": "Error al cargar las anulaciones de interruptores de funciones",
   "feature_toggles.form.fields.category.label": "Categoría",
   "feature_toggles.form.fields.defaultState.disabled": "Deshabilitado",
@@ -30,6 +31,8 @@
   "feature_toggles.form.groups.basic": "Información Básica",
   "feature_toggles.form.groups.defaultValue": "Valor Predeterminado",
   "feature_toggles.form.groups.type": "Configuración de Tipo",
+  "feature_toggles.form.loading": "Cargando…",
+  "feature_toggles.form.title.edit": "Editar alternancia de característica",
   "feature_toggles.global.help.title": "Interruptores de Funciones",
   "feature_toggles.list.confirmDelete": "¿Eliminar interruptor de función \"{identifier}\"?",
   "feature_toggles.list.error.load": "Error al cargar los interruptores de funciones",

package/src/modules/feature_toggles/i18n/pl.json

@@ -11,6 +11,7 @@
   "feature_toggles.detail.fields.failMode": "Tryb Awaryjny",
   "feature_toggles.detail.fields.identifier": "Identyfikator",
   "feature_toggles.detail.fields.name": "Nazwa",
+  "feature_toggles.form.action.save": "Zapisz",
   "feature_toggles.form.errors.load": "Nie udało się załadować nadpisań przełącznika funkcji",
   "feature_toggles.form.fields.category.label": "Kategoria",
   "feature_toggles.form.fields.defaultState.disabled": "Wyłączony",
@@ -30,6 +31,8 @@
   "feature_toggles.form.groups.basic": "Informacje podstawowe",
   "feature_toggles.form.groups.defaultValue": "Wartość domyślna",
   "feature_toggles.form.groups.type": "Konfiguracja typu",
+  "feature_toggles.form.loading": "Ładowanie…",
+  "feature_toggles.form.title.edit": "Edytuj przełącznik funkcji",
   "feature_toggles.global.help.title": "Przełączniki funkcji",
   "feature_toggles.list.confirmDelete": "Usunąć przełącznik funkcji \"{identifier}\"?",
   "feature_toggles.list.error.load": "Nie udało się załadować przełączników funkcji",

package/src/modules/messages/acl.ts

@@ -0,0 +1,11 @@
+export const features = [
+  'messages.view',
+  'messages.compose',
+  'messages.attach',
+  'messages.attach_files',
+  'messages.email',
+  'messages.actions',
+  'messages.manage',
+]
+
+export default features

package/src/modules/messages/api/[id]/actions/[actionId]/route.ts

@@ -0,0 +1,103 @@
+import { z } from 'zod'
+import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
+import { attachOperationMetadataHeader, type OperationLogEntryLike } from '../../../../lib/operationMetadata'
+import { resolveMessageContext } from '../../../../lib/routeHelpers'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { actionResultResponseSchema } from '../../../openapi'
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['messages.actions'] },
+}
+
+export async function POST(
+  req: Request,
+  { params }: { params: { id: string; actionId: string } }
+) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+
+  const rawBody = await req.json().catch(() => ({}))
+  const body = (typeof rawBody === 'object' && rawBody && !Array.isArray(rawBody)
+    ? rawBody
+    : {}) as Record<string, unknown>
+  try {
+    const commandResult = await commandBus.execute('messages.actions.execute', {
+      input: {
+        messageId: params.id,
+        actionId: params.actionId,
+        payload: body,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        userId: scope.userId,
+      },
+      ctx: {
+        container: ctx.container,
+        auth: ctx.auth ?? null,
+        organizationScope: null,
+        selectedOrganizationId: scope.organizationId,
+        organizationIds: scope.organizationId ? [scope.organizationId] : null,
+        request: req,
+      },
+    })
+
+    const result = commandResult.result as {
+      ok: boolean
+      actionId: string
+      result: Record<string, unknown>
+      operationLogEntry?: OperationLogEntryLike | null
+    }
+    const response = Response.json({
+      ok: result.ok,
+      actionId: result.actionId,
+      result: result.result,
+    })
+    attachOperationMetadataHeader(response, result.operationLogEntry ?? null, {
+      resourceKind: 'messages.message',
+      resourceId: params.id,
+    })
+    return response
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === 'Message not found') {
+        return Response.json({ error: 'Message not found' }, { status: 404 })
+      }
+      if (error.message === 'Access denied') {
+        return Response.json({ error: 'Access denied' }, { status: 403 })
+      }
+      if (error.message === 'Action not found') {
+        return Response.json({ error: 'Action not found' }, { status: 404 })
+      }
+      if (error.message === 'Action already taken') {
+        const actionTaken = (error as Error & { actionTaken?: string }).actionTaken ?? null
+        return Response.json({ error: 'Action already taken', actionTaken }, { status: 409 })
+      }
+      if (error.message === 'Actions have expired') {
+        return Response.json({ error: 'Actions have expired' }, { status: 410 })
+      }
+      if (error.message === 'Action has no executable target') {
+        return Response.json({ error: 'Action has no executable target' }, { status: 409 })
+      }
+      if (error.message === 'Action failed') {
+        return Response.json({ error: 'Action failed' }, { status: 500 })
+      }
+    }
+    throw error
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    POST: {
+      summary: 'Execute message action',
+      requestBody: { schema: z.record(z.string(), z.unknown()).optional() },
+      responses: [
+        { status: 200, description: 'Action executed', schema: actionResultResponseSchema },
+        { status: 403, description: 'Access denied' },
+        { status: 404, description: 'Action not found' },
+        { status: 409, description: 'Action already taken' },
+        { status: 410, description: 'Action expired' },
+      ],
+    },
+  },
+}

package/src/modules/messages/api/[id]/archive/route.ts

@@ -0,0 +1,138 @@
+import type { EntityManager } from '@mikro-orm/core'
+import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { Message, MessageRecipient } from '../../../data/entities'
+import { attachOperationMetadataHeader } from '../../../lib/operationMetadata'
+import { hasOrganizationAccess, resolveMessageContext } from '../../../lib/routeHelpers'
+import type { MessageScope } from '../../../lib/routeHelpers'
+import { errorResponseSchema, okResponseSchema } from '../../openapi'
+
+export const metadata = {
+  PUT: { requireAuth: true, requireFeatures: ['messages.view'] },
+  DELETE: { requireAuth: true, requireFeatures: ['messages.view'] },
+}
+
+type ResolvedCtx = Awaited<ReturnType<typeof resolveMessageContext>>['ctx']
+
+async function resolveRecipientContext(
+  req: Request,
+  id: string,
+): Promise<
+  | { ctx: ResolvedCtx; scope: MessageScope; em: EntityManager; recipient: MessageRecipient }
+  | { response: Response }
+> {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const em = (ctx.container.resolve('em') as EntityManager).fork()
+
+  const message = await em.findOne(Message, {
+    id,
+    tenantId: scope.tenantId,
+    deletedAt: null,
+  })
+
+  if (!message) {
+    return { response: Response.json({ error: 'Message not found' }, { status: 404 }) }
+  }
+
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return { response: Response.json({ error: 'Access denied' }, { status: 403 }) }
+  }
+
+  const recipient = await em.findOne(MessageRecipient, {
+    messageId: id,
+    recipientUserId: scope.userId,
+    deletedAt: null,
+  })
+
+  if (!recipient) {
+    return { response: Response.json({ error: 'Access denied' }, { status: 403 }) }
+  }
+
+  return { ctx, scope, em, recipient }
+}
+
+export async function PUT(req: Request, { params }: { params: { id: string } }) {
+  const context = await resolveRecipientContext(req, params.id)
+  if ('response' in context) return context.response
+  const { ctx, scope } = context
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+  const { logEntry } = await commandBus.execute('messages.recipients.archive', {
+    input: {
+      messageId: params.id,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+    },
+    ctx: {
+      container: ctx.container,
+      auth: ctx.auth ?? null,
+      organizationScope: null,
+      selectedOrganizationId: scope.organizationId,
+      organizationIds: scope.organizationId ? [scope.organizationId] : null,
+      request: req,
+    },
+  })
+
+  const response = Response.json({ ok: true })
+  attachOperationMetadataHeader(response, logEntry, {
+    resourceKind: 'messages.message',
+    resourceId: params.id,
+  })
+  return response
+}
+
+export async function DELETE(req: Request, { params }: { params: { id: string } }) {
+  const context = await resolveRecipientContext(req, params.id)
+  if ('response' in context) return context.response
+  const { ctx, scope } = context
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+  const { logEntry } = await commandBus.execute('messages.recipients.unarchive', {
+    input: {
+      messageId: params.id,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+    },
+    ctx: {
+      container: ctx.container,
+      auth: ctx.auth ?? null,
+      organizationScope: null,
+      selectedOrganizationId: scope.organizationId,
+      organizationIds: scope.organizationId ? [scope.organizationId] : null,
+      request: req,
+    },
+  })
+
+  const response = Response.json({ ok: true })
+  attachOperationMetadataHeader(response, logEntry, {
+    resourceKind: 'messages.message',
+    resourceId: params.id,
+  })
+  return response
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    PUT: {
+      summary: 'Archive message',
+      responses: [
+        { status: 200, description: 'Message archived', schema: okResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+      ],
+    },
+    DELETE: {
+      summary: 'Unarchive message',
+      responses: [
+        { status: 200, description: 'Message unarchived', schema: okResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+      ],
+    },
+  },
+}

package/src/modules/messages/api/[id]/attachments/route.ts

@@ -0,0 +1,217 @@
+import type { EntityManager } from '@mikro-orm/core'
+import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { parseUnlinkAttachmentIds } from '../../../commands/attachments'
+import { Message, MessageRecipient } from '../../../data/entities'
+import { attachmentIdsPayloadSchema, unlinkAttachmentPayloadSchema } from '../../../data/validators'
+import { getMessageAttachments, linkAttachmentsToMessage } from '../../../lib/attachments'
+import { attachOperationMetadataHeader } from '../../../lib/operationMetadata'
+import { resolveMessageContext } from '../../../lib/routeHelpers'
+import {
+  attachmentIdsPayloadSchema as attachmentIdsOpenApiSchema,
+  errorResponseSchema,
+  messageAttachmentResponseSchema,
+  okResponseSchema,
+  unlinkAttachmentPayloadSchema as unlinkAttachmentOpenApiSchema,
+} from '../../openapi'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['messages.view'] },
+  POST: { requireAuth: true, requireFeatures: ['messages.attach_files'] },
+  DELETE: { requireAuth: true, requireFeatures: ['messages.attach_files'] },
+}
+
+function hasOrganizationAccess(scopeOrganizationId: string | null, messageOrganizationId: string | null | undefined): boolean {
+  if (scopeOrganizationId) {
+    return messageOrganizationId === scopeOrganizationId
+  }
+  return messageOrganizationId == null
+}
+
+export async function GET(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const em = ctx.container.resolve('em') as EntityManager
+
+  const message = await em.findOne(Message, {
+    id: params.id,
+    tenantId: scope.tenantId,
+    deletedAt: null,
+  })
+
+  if (!message) {
+    return Response.json({ error: 'Message not found' }, { status: 404 })
+  }
+
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  const recipient = await em.findOne(MessageRecipient, {
+    messageId: params.id,
+    recipientUserId: scope.userId,
+    deletedAt: null,
+  })
+
+  if (message.senderUserId !== scope.userId && !recipient) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  const attachments = await getMessageAttachments(
+    em,
+    params.id,
+    scope.organizationId,
+    scope.tenantId
+  )
+
+  return Response.json({ attachments })
+}
+
+export async function POST(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const em = (ctx.container.resolve('em') as EntityManager).fork()
+  const body = await req.json().catch(() => ({}))
+  const input = attachmentIdsPayloadSchema.parse(body)
+
+  const message = await em.findOne(Message, {
+    id: params.id,
+    tenantId: scope.tenantId,
+    deletedAt: null,
+  })
+
+  if (!message) {
+    return Response.json({ error: 'Message not found' }, { status: 404 })
+  }
+
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  if (message.senderUserId !== scope.userId) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  if (!message.isDraft) {
+    return Response.json({ error: 'Attachments can only be modified on drafts' }, { status: 409 })
+  }
+
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+  const { logEntry } = await commandBus.execute('messages.attachments.link_to_draft', {
+    input: {
+      messageId: message.id,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      attachmentIds: input.attachmentIds,
+    },
+    ctx: {
+      container: ctx.container,
+      auth: ctx.auth ?? null,
+      organizationScope: null,
+      selectedOrganizationId: scope.organizationId,
+      organizationIds: scope.organizationId ? [scope.organizationId] : null,
+      request: req,
+    },
+  })
+
+  const response = Response.json({ ok: true })
+  attachOperationMetadataHeader(response, logEntry, {
+    resourceKind: 'messages.message',
+    resourceId: params.id,
+  })
+  return response
+}
+
+export async function DELETE(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const em = (ctx.container.resolve('em') as EntityManager).fork()
+  const body = await req.json().catch(() => ({}))
+  const input = unlinkAttachmentPayloadSchema.parse(body)
+
+  const message = await em.findOne(Message, {
+    id: params.id,
+    tenantId: scope.tenantId,
+    deletedAt: null,
+  })
+
+  if (!message) {
+    return Response.json({ error: 'Message not found' }, { status: 404 })
+  }
+
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  if (message.senderUserId !== scope.userId) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  if (!message.isDraft) {
+    return Response.json({ error: 'Attachments can only be modified on drafts' }, { status: 409 })
+  }
+
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+  const { logEntry } = await commandBus.execute('messages.attachments.unlink_from_draft', {
+    input: {
+      messageId: message.id,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      attachmentIds: parseUnlinkAttachmentIds(input),
+    },
+    ctx: {
+      container: ctx.container,
+      auth: ctx.auth ?? null,
+      organizationScope: null,
+      selectedOrganizationId: scope.organizationId,
+      organizationIds: scope.organizationId ? [scope.organizationId] : null,
+      request: req,
+    },
+  })
+
+  const response = Response.json({ ok: true })
+  attachOperationMetadataHeader(response, logEntry, {
+    resourceKind: 'messages.message',
+    resourceId: params.id,
+  })
+  return response
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    GET: {
+      summary: 'List message attachments',
+      responses: [
+        { status: 200, description: 'Attachments', schema: messageAttachmentResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+      ],
+    },
+    POST: {
+      summary: 'Link attachments to draft message',
+      requestBody: { schema: attachmentIdsOpenApiSchema },
+      responses: [
+        { status: 200, description: 'Attachments linked', schema: okResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+        { status: 409, description: 'Only draft messages can be edited', schema: errorResponseSchema },
+      ],
+    },
+    DELETE: {
+      summary: 'Unlink attachments from draft message',
+      requestBody: { schema: unlinkAttachmentOpenApiSchema },
+      responses: [
+        { status: 200, description: 'Attachments unlinked', schema: okResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+        { status: 409, description: 'Only draft messages can be edited', schema: errorResponseSchema },
+      ],
+    },
+  },
+}