@open-mercato/core 0.6.4-develop.4371.1.8f3030407e → 0.6.4

package/src/modules/integrations/lib/credentials-service.ts

@@ -39,6 +39,34 @@ function normalizeCredentialsRecord(value: unknown): Record<string, unknown> {
   return isRecordValue(parsed) ? parsed : {}
 }
 
+/**
+ * Build the where-filter for credential lookups.
+ *
+ * Per-user scoping (added 2026-05-26): when `scope.userId` is set, the filter
+ * matches the row owned by that user — different users on the same tenant get
+ * their OWN row for the same provider. When `scope.userId` is `undefined` /
+ * `null`, the filter matches tenant-wide credentials (existing behaviour,
+ * e.g. shared Stripe/Akeneo API keys).
+ *
+ * The partial unique index `integration_credentials_user_lookup_idx` enforces
+ * uniqueness across `(integration_id, organization_id, tenant_id, user_id)`
+ * when `user_id IS NOT NULL`.
+ */
+export function buildCredentialsFilter(integrationId: string, scope: IntegrationScope) {
+  const base = {
+    integrationId,
+    organizationId: scope.organizationId,
+    tenantId: scope.tenantId,
+    deletedAt: null,
+  } as Record<string, unknown>
+  if (scope.userId) {
+    base.userId = scope.userId
+  } else {
+    base.userId = null
+  }
+  return base
+}
+
 export function createCredentialsService(em: EntityManager) {
   const credentialsEncryptionSpec = [{ field: 'credentials' }]
 
@@ -118,18 +146,30 @@ export function createCredentialsService(em: EntityManager) {
 
   return {
     async getRaw(integrationId: string, scope: IntegrationScope): Promise<Record<string, unknown> | null> {
-      const row = await findOneWithDecryption(
+      let row = await findOneWithDecryption(
         em,
         IntegrationCredentials,
-        {
-          integrationId,
-          organizationId: scope.organizationId,
-          tenantId: scope.tenantId,
-          deletedAt: null,
-        },
+        buildCredentialsFilter(integrationId, scope),
         undefined,
         scope,
       )
+      // Spec 2026-05-21 (email-integration-foundation) "Hub credentials store":
+      // per-user secrets resolve as `WHERE user_id = currentUser.id OR user_id IS NULL`.
+      // A user-scoped read of a TENANT-WIDE integration (sync_excel, Stripe, Akeneo,
+      // S3, the channel OAuth *client* config) MUST still find the shared
+      // `user_id = NULL` row — the per-user row takes precedence, and we only fall
+      // back to the tenant-wide row when the user has none of their own. Writes stay
+      // strict (`save` uses the unmodified filter) so a per-user save never clobbers
+      // the shared credential.
+      if (!row && scope.userId) {
+        row = await findOneWithDecryption(
+          em,
+          IntegrationCredentials,
+          buildCredentialsFilter(integrationId, { ...scope, userId: null }),
+          undefined,
+          scope,
+        )
+      }
       if (!row) return null
       return decryptCredentialsBlob(row.credentials, scope)
     },
@@ -150,12 +190,7 @@ export function createCredentialsService(em: EntityManager) {
       const row = await findOneWithDecryption(
         em,
         IntegrationCredentials,
-        {
-          integrationId,
-          organizationId: scope.organizationId,
-          tenantId: scope.tenantId,
-          deletedAt: null,
-        },
+        buildCredentialsFilter(integrationId, scope),
         undefined,
         scope,
       )
@@ -171,6 +206,7 @@ export function createCredentialsService(em: EntityManager) {
         credentials: encryptedCredentials,
         organizationId: scope.organizationId,
         tenantId: scope.tenantId,
+        ...(scope.userId ? { userId: scope.userId } : {}),
       })
       await em.persist(created).flush()
     },

package/src/modules/integrations/migrations/.snapshot-open-mercato.json

@@ -135,6 +135,22 @@
           "comment": null,
           "enumItems": [],
           "mappedType": "datetime"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "enumItems": [],
+          "mappedType": "uuid"
         }
       },
       "indexes": [
@@ -159,6 +175,15 @@
           "keyName": "integration_credentials_pkey",
           "primary": true,
           "unique": true
+        },
+        {
+          "columnNames": [],
+          "composite": false,
+          "constraint": false,
+          "keyName": "integration_credentials_user_lookup_idx",
+          "primary": false,
+          "unique": true,
+          "expression": "create unique index \"integration_credentials_user_lookup_idx\" on \"integration_credentials\" (\"integration_id\", \"organization_id\", \"tenant_id\", \"user_id\") where \"user_id\" is not null and \"deleted_at\" is null"
         }
       ],
       "checks": [],
@@ -901,4 +926,4 @@
   ],
   "views": [],
   "nativeEnums": {}
-}
+}

package/src/modules/integrations/migrations/Migration20260526154136_integrations.ts

@@ -0,0 +1,15 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260526154136_integrations extends Migration {
+
+  override up(): void | Promise<void> {
+    this.addSql(`alter table "integration_credentials" add "user_id" uuid null;`);
+    this.addSql(`create unique index "integration_credentials_user_lookup_idx" on "integration_credentials" ("integration_id", "organization_id", "tenant_id", "user_id") where "user_id" is not null and "deleted_at" is null;`);
+  }
+
+  override down(): void | Promise<void> {
+    this.addSql(`drop index "integration_credentials_user_lookup_idx";`);
+    this.addSql(`alter table "integration_credentials" drop column "user_id";`);
+  }
+
+}

package/src/modules/messages/api/route.ts

@@ -4,7 +4,7 @@ import { type Kysely, sql } from 'kysely'
 import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'
+import { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
 import { User } from '../../auth/data/entities'
 import { Message, MessageObject } from '../data/entities'
 import { composeMessageSchema, listMessagesSchema } from '../data/validators'
@@ -136,7 +136,7 @@ export async function GET(req: Request) {
     if (input.visibility) q = q.where('m.visibility', '=', input.visibility)
     if (input.sourceEntityType) q = q.where('m.source_entity_type', '=', input.sourceEntityType)
     if (input.sourceEntityId) q = q.where('m.source_entity_id', '=', input.sourceEntityId)
-    if (input.externalEmail) q = q.where('m.external_email_hash', '=', hashForLookup(input.externalEmail))
+    if (input.externalEmail) q = q.where('m.external_email_hash', 'in', lookupHashCandidates(input.externalEmail))
     if (input.senderId) q = q.where('m.sender_user_id', '=', input.senderId)
 
     if (input.search) {

package/src/modules/messages/api/token/[token]/route.ts

@@ -37,9 +37,7 @@ function responseForTokenError(error: unknown): Response | null {
 
 async function resolveTokenAccess(em: EntityManager, token: string): Promise<TokenAccess> {
   const hashedToken = hashAuthToken(token)
-  const accessToken =
-    (await findOneWithDecryption(em, MessageAccessToken, { token: hashedToken })) ??
-    (await findOneWithDecryption(em, MessageAccessToken, { token }))
+  const accessToken = await findOneWithDecryption(em, MessageAccessToken, { token: hashedToken })
   if (!accessToken) {
     throw new Error('Invalid or expired link')
   }

package/src/modules/messages/commands/actions.ts

@@ -266,13 +266,15 @@ const executeActionCommand: CommandHandler<
         throw new Error('Action failed')
       }
     } else if (action.href) {
-      result = {
-        redirect: resolveActionHref(action, message, {
-          tenantId: input.tenantId,
-          organizationId: input.organizationId,
-          userId: input.userId,
-        }) ?? action.href,
+      const safeRedirect = resolveActionHref(action, message, {
+        tenantId: input.tenantId,
+        organizationId: input.organizationId,
+        userId: input.userId,
+      })
+      if (!safeRedirect) {
+        throw new Error('Action has an unsafe redirect target')
       }
+      result = { redirect: safeRedirect }
     } else {
       throw new Error('Action has no executable target')
     }

package/src/modules/messages/commands/messages.ts

@@ -125,6 +125,10 @@ const composeCommandSchema = composeMessageSchema.safeExtend({
   tenantId: scopeSchema.shape.tenantId,
   organizationId: scopeSchema.shape.organizationId,
   userId: scopeSchema.shape.userId,
+  // Optional dedup key (inbound email ingest sets it; other callers leave it
+  // undefined). When set, a re-issued compose returns the first message instead
+  // of creating a duplicate.
+  idempotencyKey: z.string().min(1).max(255).optional(),
 })
 
 const updateDraftCommandSchema = updateDraftSchema.safeExtend({
@@ -207,7 +211,49 @@ async function requireMessageById(
   return message
 }
 
-const composeMessageCommand: CommandHandler<unknown, { id: string; threadId: string | null; externalEmail: string | null; isDraft: boolean; recipientUserIds: string[] }> = {
+function isUniqueViolation(err: unknown): boolean {
+  if (!err || typeof err !== 'object') return false
+  const code = (err as { code?: string }).code
+  if (code === '23505') return true
+  const message = (err as { message?: string }).message
+  return typeof message === 'string' && /duplicate key value|unique constraint/i.test(message)
+}
+
+type ComposeMessageResult = {
+  id: string
+  threadId: string | null
+  externalEmail: string | null
+  isDraft: boolean
+  recipientUserIds: string[]
+  /**
+   * True when this was an idempotent replay — an existing message was returned
+   * and nothing was written. Signals `buildLog` to skip the audit/undo entry.
+   */
+  deduplicated?: boolean
+}
+
+async function buildComposeResultFromExisting(
+  em: EntityManager,
+  message: Message,
+): Promise<ComposeMessageResult> {
+  const recipients = await findWithDecryption(
+    em,
+    MessageRecipient,
+    { messageId: message.id, deletedAt: null },
+    undefined,
+    { tenantId: message.tenantId, organizationId: message.organizationId ?? null },
+  )
+  return {
+    id: message.id,
+    threadId: message.threadId ?? null,
+    externalEmail: message.externalEmail ?? null,
+    isDraft: message.isDraft,
+    recipientUserIds: recipients.map((recipient) => recipient.recipientUserId),
+    deduplicated: true,
+  }
+}
+
+const composeMessageCommand: CommandHandler<unknown, { id: string; threadId: string | null; externalEmail: string | null; isDraft: boolean; recipientUserIds: string[]; deduplicated?: boolean }> = {
   id: 'messages.messages.compose',
   async execute(rawInput, ctx) {
     const input = composeCommandSchema.parse(rawInput)
@@ -217,19 +263,42 @@ const composeMessageCommand: CommandHandler<unknown, { id: string; threadId: str
     }
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const scope = { tenantId: input.tenantId, organizationId: input.organizationId }
+
+    // Idempotency fast-path: a retried inbound-email ingest re-issues compose
+    // for the same source message (the first attempt committed the message but a
+    // downstream transient failure rolled the ingest back). Return that message
+    // so the retry cannot create a duplicate.
+    if (input.idempotencyKey) {
+      const existing = await findOneWithDecryption(
+        em,
+        Message,
+        { tenantId: input.tenantId, idempotencyKey: input.idempotencyKey },
+        undefined,
+        scope,
+      )
+      if (existing) return buildComposeResultFromExisting(em, existing)
+    }
+
     let messageId = ''
     let responseThreadId: string | null = null
     let responseExternalEmail: string | null = null
 
-    await em.transactional(async (trx) => {
+    const composeTx = em.transactional(async (trx) => {
       const threadId = input.parentMessageId
         ? (
-          await trx.findOne(Message, {
-            id: input.parentMessageId,
-            tenantId: input.tenantId,
-            organizationId: input.organizationId,
-            deletedAt: null,
-          })
+          await findOneWithDecryption(
+            trx,
+            Message,
+            {
+              id: input.parentMessageId,
+              tenantId: input.tenantId,
+              organizationId: input.organizationId,
+              deletedAt: null,
+            },
+            undefined,
+            scope,
+          )
         )?.threadId ?? input.parentMessageId
         : undefined
 
@@ -254,6 +323,7 @@ const composeMessageCommand: CommandHandler<unknown, { id: string; threadId: str
         sentAt: input.isDraft ? null : new Date(),
         actionData: input.actionData as MessageActionData | undefined,
         sendViaEmail,
+        idempotencyKey: input.idempotencyKey ?? null,
         tenantId: input.tenantId,
         organizationId: input.organizationId,
       })
@@ -313,6 +383,24 @@ const composeMessageCommand: CommandHandler<unknown, { id: string; threadId: str
       responseThreadId = message.threadId ?? null
       responseExternalEmail = message.externalEmail ?? null
     })
+    try {
+      await composeTx
+    } catch (err) {
+      // Lost a concurrent race on the same idempotency key — return the message
+      // the winning compose created. A propagated 23505 would otherwise be
+      // classified permanent and dead-letter the inbound mail.
+      if (input.idempotencyKey && isUniqueViolation(err)) {
+        const existing = await findOneWithDecryption(
+          em.fork(),
+          Message,
+          { tenantId: input.tenantId, idempotencyKey: input.idempotencyKey },
+          undefined,
+          scope,
+        )
+        if (existing) return buildComposeResultFromExisting(em.fork(), existing)
+      }
+      throw err
+    }
 
     if (!input.isDraft) {
       await emitMessageSentEvent(ctx.container, {
@@ -345,6 +433,11 @@ const composeMessageCommand: CommandHandler<unknown, { id: string; threadId: str
     return loadMessageAggregateSnapshot(em, result.id)
   },
   buildLog: async ({ input, result, snapshots }) => {
+    // Idempotent replay: execute returned a pre-existing message without writing
+    // anything. Skip the audit entry entirely — logging it as a fresh "Compose
+    // message" would both misrepresent the dedup and expose an undo that
+    // soft-deletes a legitimately-received inbound message.
+    if (result.deduplicated) return { skipLog: true }
     const parsed = composeCommandSchema.parse(input)
     return {
       actionLabel: parsed.isDraft ? 'Create draft message' : 'Compose message',
@@ -433,7 +526,30 @@ const updateDraftCommand: CommandHandler<unknown, { ok: true; id: string }> = {
       }
     }
 
-    await withAtomicFlush(em, [async () => {
+    // Validate the send transition BEFORE the atomic-flush block so a rejected
+    // send never mutates or flushes anything (everything checked here is known
+    // from the parsed input + the loaded message).
+    if (isSending) {
+      const finalVisibility = input.visibility ?? message.visibility
+      const finalSubject = input.subject ?? message.subject
+      const finalBody = input.body ?? message.body
+      const finalRecipientCount = input.recipients
+        ? input.recipients.length
+        : (preloadedRecipients?.length ?? 0)
+      if (finalVisibility !== 'public' && finalRecipientCount === 0) {
+        throw new Error('at least one recipient is required')
+      }
+      if (!finalSubject?.trim()) throw new Error('subject is required')
+      if (!finalBody?.trim()) throw new Error('body is required')
+    }
+
+    // Phase 1 mutates the managed `message` scalars; the per-phase flush issues
+    // those changes before phase 2's interleaved reads run (e.g.
+    // `linkAttachmentsToMessage` issues an `em.find`). Under MikroORM v7 a read
+    // between a scalar mutation and the terminal flush on the same EntityManager
+    // silently drops the pending changeset, so keeping the scalar edits in their
+    // own phase guarantees subject/body/etc. are persisted (SPEC-018 Problem 1).
+    await withAtomicFlush(em, [() => {
       if (input.type !== undefined) message.type = input.type
       if (input.visibility !== undefined) message.visibility = input.visibility
       if (input.sourceEntityType !== undefined) message.sourceEntityType = input.sourceEntityType
@@ -446,7 +562,7 @@ const updateDraftCommand: CommandHandler<unknown, { ok: true; id: string }> = {
       if (input.priority !== undefined) message.priority = input.priority
       if (input.actionData !== undefined) message.actionData = input.actionData
       if (input.sendViaEmail !== undefined) message.sendViaEmail = input.sendViaEmail
-
+    }, async () => {
       if (input.recipients) {
         await em.nativeDelete(MessageRecipient, { messageId: message.id })
         for (const recipient of input.recipients) {
@@ -502,19 +618,8 @@ const updateDraftCommand: CommandHandler<unknown, { ok: true; id: string }> = {
       }
 
       if (isSending) {
-        const finalVisibility = input.visibility ?? message.visibility
-        const finalSubject = input.subject ?? message.subject
-        const finalBody = input.body ?? message.body
-        const finalRecipientCount = input.recipients
-          ? input.recipients.length
-          : (preloadedRecipients?.length ?? 0)
-
-        if (finalVisibility !== 'public' && finalRecipientCount === 0) {
-          throw new Error('at least one recipient is required')
-        }
-        if (!finalSubject?.trim()) throw new Error('subject is required')
-        if (!finalBody?.trim()) throw new Error('body is required')
-
+        // Send transition was validated before the block; just apply the
+        // status mutations here (persisted by this phase's boundary flush).
         message.isDraft = false
         message.status = 'sent'
         message.sentAt = new Date()

package/src/modules/messages/commands/tokens.ts

@@ -19,9 +19,7 @@ const consumeTokenCommand: CommandHandler<unknown, { messageId: string; recipien
     const em = (ctx.container.resolve('em') as EntityManager).fork()
 
     const hashedToken = hashAuthToken(input.token)
-    const accessToken =
-      (await em.findOne(MessageAccessToken, { token: hashedToken })) ??
-      (await em.findOne(MessageAccessToken, { token: input.token }))
+    const accessToken = await em.findOne(MessageAccessToken, { token: hashedToken })
     if (!accessToken) {
       throw new Error('Invalid or expired link')
     }

package/src/modules/messages/components/ComposeMessagePageClient.tsx

@@ -2,12 +2,29 @@
 
 import { useRouter } from 'next/navigation'
 import { MessageComposer } from '@open-mercato/ui/backend/messages'
+// UMES extension surface — compose page injection spot (SPEC-045d §9.3a).
+// Channel provider packages inject "composer capabilities" widgets here
+// (character limit warnings, channel format selector, attachment scoping, etc.).
+import { InjectionSpot } from '@open-mercato/ui/backend/injection/InjectionSpot'
 
 export function ComposeMessagePageClient() {
   const router = useRouter()
 
   return (
     <div className="space-y-4">
+      {/*
+        Standalone widget mount above the composer — NOT CrudForm field
+        resolution. This page is not a CrudForm, so the `crud-form:*:fields`
+        field-event pipeline (onFieldChange, value transformers, etc.) does
+        not apply here. Provider packages render composer-capability widgets
+        (character-limit warnings, channel format selectors, attachment
+        scoping) into this spot purely as additional UI siblings.
+      */}
+      <InjectionSpot
+        spotId="crud-form:messages:message:fields"
+        context={{ form: 'compose' }}
+        data={{}}
+      />
       <MessageComposer
         inline
         variant="compose"

package/src/modules/messages/components/MessageDetailPageClient.tsx

@@ -2,9 +2,12 @@
 
 import * as React from 'react'
 import { MessageComposer } from '@open-mercato/ui/backend/messages'
+import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { LoadingMessage, ErrorMessage } from '@open-mercato/ui/backend/detail'
+// UMES extension surface — message detail injection spots (SPEC-045d §9.3a)
+import { InjectionSpot } from '@open-mercato/ui/backend/injection/InjectionSpot'
 import {
   getMessageUiComponentRegistry,
 } from './utils/typeUiRegistry'
@@ -29,6 +32,7 @@ function MessageConversationDetailItem({
   onToggle,
   onReply,
   onForward,
+  userFeatures,
 }: {
   messageId: string
   isCollapsible: boolean
@@ -36,6 +40,7 @@ function MessageConversationDetailItem({
   onToggle: () => void
   onReply: (messageId: string) => void
   onForward: (messageId: string) => void
+  userFeatures: string[]
 }) {
   const state = useMessageDetails(messageId)
   const messageUiRegistry = React.useMemo(() => getMessageUiComponentRegistry(), [])
@@ -87,7 +92,23 @@ function MessageConversationDetailItem({
             ContentComponent={ContentComponent}
           />
 
+          {/* UMES — channel payload renderer mounts here (channel-linked emails, Slack blocks, etc.). */}
+          <InjectionSpot
+            spotId="detail:messages:message:body:after"
+            context={{ messageId }}
+            data={state.detail}
+          />
+
           <MessageDetailMetaSection detail={state.detail} />
+
+          {/* UMES — channel sidebar widgets (channel info panel, contact preview, delivery status).
+              `userFeatures` lets feature-gated widgets (e.g. the channel reassignment editor,
+              gated on `communication_channels.assign`) render their controls for permitted users. */}
+          <InjectionSpot
+            spotId="detail:messages:message:sidebar"
+            context={{ messageId, userFeatures }}
+            data={state.detail}
+          />
         </section>
 
         <MessageDetailActionsSection
@@ -138,6 +159,27 @@ function MessageConversationDetailItem({
 
 export function MessageDetailPageClient({ id }: { id: string }) {
   const state = useMessageDetails(id)
+  // Resolve the viewer's feature grants once and forward them into the sidebar
+  // injection spot so feature-gated widgets (channel reassignment editor) can
+  // render their controls. Without this, hub widgets that gate on
+  // `context.userFeatures` (e.g. `communication_channels.assign`) stay read-only.
+  const [userFeatures, setUserFeatures] = React.useState<string[]>([])
+  React.useEffect(() => {
+    let cancelled = false
+    void (async () => {
+      const res = await apiCall<{ ok: boolean; granted?: string[] }>('/api/auth/feature-check', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ features: ['communication_channels.assign'] }),
+      }).catch(() => null)
+      if (!cancelled && res?.ok && Array.isArray(res.result?.granted)) {
+        setUserFeatures(res.result.granted)
+      }
+    })()
+    return () => {
+      cancelled = true
+    }
+  }, [])
   const [activeInlineComposer, setActiveInlineComposer] = React.useState<{
     variant: 'reply' | 'forward'
     messageId: string
@@ -234,6 +276,7 @@ export function MessageDetailPageClient({ id }: { id: string }) {
               <MessageConversationDetailItem
                 key={item.id}
                 messageId={item.id}
+                userFeatures={userFeatures}
                 isCollapsible={!isForcedExpanded}
                 isExpanded
                 onToggle={() => state.toggleConversationItem(item.id)}

package/src/modules/messages/components/MessagesInboxPageClient.tsx

@@ -8,6 +8,7 @@ import type { ColumnDef } from '@tanstack/react-table'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
 import { DataTable } from '@open-mercato/ui/backend/DataTable'
+import { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'
 import type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
@@ -362,6 +363,10 @@ export function MessagesInboxPageClient() {
     <div className="space-y-4">
       <DataTable
         title={t('messages.title', 'Messages')}
+        // UMES extension surface — opt into widget injection at:
+        //   data-table:messages:columns / :row-actions / :bulk-actions / :filters / :toolbar / :search-trailing
+        // (SPEC-045d §9.3a — communication_channels hub renders channel badge + delivery status here)
+        extensionTableId="messages"
         columns={columns}
         data={rows}
         bulkActions={bulkActions}
@@ -447,6 +452,13 @@ export function MessagesInboxPageClient() {
         onRowClick={(row) => {
           router.push(`/backend/messages/${row.id}`)
         }}
+        emptyState={(
+          <ListEmptyState
+            entityName={t('messages.title', 'Messages')}
+            createHref="/backend/messages/compose"
+            createLabel={t('messages.compose', 'Compose message')}
+          />
+        )}
         embedded
       />
       {ConfirmDialogElement}

package/src/modules/messages/components/message-detail/hooks/useMessageDetailsActions.ts

@@ -13,7 +13,7 @@ import type {
   MessageDetail,
   PendingActionConfirmation,
 } from '../types'
-import { parseObjectActionId, toErrorMessage } from '../utils'
+import { isSafeNavigationHref, parseObjectActionId, toErrorMessage } from '../utils'
 
 type RequestAndRefreshOptions = {
   skipDetailAutoMarkRead?: boolean
@@ -213,7 +213,11 @@ export function useMessageDetailsActions({
       flash(t('messages.flash.actionSuccess', 'Action completed.'), 'success')
 
       const redirectTarget = call.result?.result?.redirect
-      if (typeof redirectTarget === 'string' && redirectTarget.trim().length > 0) {
+      if (
+        typeof redirectTarget === 'string'
+        && redirectTarget.trim().length > 0
+        && isSafeNavigationHref(redirectTarget)
+      ) {
         window.location.href = redirectTarget
         return
       }

package/src/modules/messages/components/message-detail/utils.ts

@@ -31,6 +31,24 @@ export function formatDateTime(value: string | null | undefined): string {
   return date.toLocaleString()
 }
 
+const SAFE_NAVIGATION_SCHEMES = new Set(['http:', 'https:', 'mailto:', 'tel:'])
+
+export function isSafeNavigationHref(value: string): boolean {
+  const trimmed = value.trim()
+  if (!trimmed) return false
+  if (trimmed.startsWith('//')) return false
+  if (trimmed.startsWith('/') || trimmed.startsWith('./') || trimmed.startsWith('../')) {
+    return true
+  }
+  const base = typeof window !== 'undefined' ? window.location.href : 'http://localhost'
+  try {
+    const parsed = new URL(trimmed, base)
+    return SAFE_NAVIGATION_SCHEMES.has(parsed.protocol)
+  } catch {
+    return false
+  }
+}
+
 export function parseObjectActionId(value: string): { objectId: string; actionId: string } | null {
   if (!value.startsWith('object:')) return null
   const [, objectId, ...rest] = value.split(':')

package/src/modules/messages/data/entities.ts

@@ -30,6 +30,11 @@ export type MessageActionData = {
 @Index({ name: 'messages_type_idx', properties: ['type', 'tenantId'] })
 @Index({ name: 'messages_tenant_idx', properties: ['tenantId', 'organizationId'] })
 @Index({ name: 'messages_external_email_hash_idx', properties: ['externalEmailHash'] })
+@Index({
+  name: 'messages_idempotency_key_uq',
+  expression:
+    'create unique index "messages_idempotency_key_uq" on "messages" ("tenant_id", "idempotency_key") where "idempotency_key" is not null',
+})
 export class Message {
   [OptionalProps]?: 'type' | 'status' | 'priority' | 'bodyFormat' | 'isDraft' | 'createdAt' | 'updatedAt'
 
@@ -117,6 +122,12 @@ export class Message {
   @Property({ name: 'external_email_hash', type: 'text', nullable: true })
   externalEmailHash?: string | null
 
+  // Stable per-source idempotency key (inbound email = channel + provider
+  // message id). Lets a retried `compose` return the message created by the
+  // first attempt instead of duplicating it. Partial-unique per tenant.
+  @Property({ name: 'idempotency_key', type: 'text', nullable: true })
+  idempotencyKey?: string | null
+
   @Property({ name: 'external_name', type: 'text', nullable: true })
   externalName?: string | null