@open-mercato/core 0.6.5-develop.4384.1.ce2ec6eaaa → 0.6.5-develop.4393.1.de282b5dfd

package/src/modules/integrations/data/entities.ts

@@ -45,8 +45,13 @@ export class SyncExternalIdMapping {
 
 @Entity({ tableName: 'integration_credentials' })
 @Index({ properties: ['integrationId', 'organizationId', 'tenantId'] })
+@Index({
+  name: 'integration_credentials_user_lookup_idx',
+  expression:
+    `create unique index "integration_credentials_user_lookup_idx" on "integration_credentials" ("integration_id", "organization_id", "tenant_id", "user_id") where "user_id" is not null and "deleted_at" is null`,
+})
 export class IntegrationCredentials {
-  [OptionalProps]?: 'createdAt' | 'updatedAt' | 'deletedAt'
+  [OptionalProps]?: 'createdAt' | 'updatedAt' | 'deletedAt' | 'userId'
   @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })
   id!: string
 
@@ -62,6 +67,21 @@ export class IntegrationCredentials {
   @Property({ name: 'tenant_id', type: 'uuid' })
   tenantId!: string
 
+  /**
+   * Per-user secret scoping (additive — added by the email integration spec).
+   *
+   * NULL = tenant-wide secret (existing behaviour, e.g. shared WhatsApp Business token).
+   * Set  = per-user secret (e.g. Jane's personal Gmail OAuth refresh token).
+   *
+   * Cross-module link to `auth:user` is declared in
+   * `packages/core/src/modules/communication_channels/data/extensions.ts` via
+   * `EntityExtension` — no raw FOREIGN KEY constraint (root `AGENTS.md` rule:
+   * "No direct ORM relationships between modules"). App-layer query callers
+   * MUST scope by `user_id` on every per-user credential read.
+   */
+  @Property({ name: 'user_id', type: 'uuid', nullable: true })
+  userId?: string | null
+
   @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })
   createdAt: Date = new Date()
 

package/src/modules/integrations/lib/credentials-service.ts

@@ -39,6 +39,34 @@ function normalizeCredentialsRecord(value: unknown): Record<string, unknown> {
   return isRecordValue(parsed) ? parsed : {}
 }
 
+/**
+ * Build the where-filter for credential lookups.
+ *
+ * Per-user scoping (added 2026-05-26): when `scope.userId` is set, the filter
+ * matches the row owned by that user — different users on the same tenant get
+ * their OWN row for the same provider. When `scope.userId` is `undefined` /
+ * `null`, the filter matches tenant-wide credentials (existing behaviour,
+ * e.g. shared Stripe/Akeneo API keys).
+ *
+ * The partial unique index `integration_credentials_user_lookup_idx` enforces
+ * uniqueness across `(integration_id, organization_id, tenant_id, user_id)`
+ * when `user_id IS NOT NULL`.
+ */
+export function buildCredentialsFilter(integrationId: string, scope: IntegrationScope) {
+  const base = {
+    integrationId,
+    organizationId: scope.organizationId,
+    tenantId: scope.tenantId,
+    deletedAt: null,
+  } as Record<string, unknown>
+  if (scope.userId) {
+    base.userId = scope.userId
+  } else {
+    base.userId = null
+  }
+  return base
+}
+
 export function createCredentialsService(em: EntityManager) {
   const credentialsEncryptionSpec = [{ field: 'credentials' }]
 
@@ -118,18 +146,30 @@ export function createCredentialsService(em: EntityManager) {
 
   return {
     async getRaw(integrationId: string, scope: IntegrationScope): Promise<Record<string, unknown> | null> {
-      const row = await findOneWithDecryption(
+      let row = await findOneWithDecryption(
         em,
         IntegrationCredentials,
-        {
-          integrationId,
-          organizationId: scope.organizationId,
-          tenantId: scope.tenantId,
-          deletedAt: null,
-        },
+        buildCredentialsFilter(integrationId, scope),
         undefined,
         scope,
       )
+      // Spec 2026-05-21 (email-integration-foundation) "Hub credentials store":
+      // per-user secrets resolve as `WHERE user_id = currentUser.id OR user_id IS NULL`.
+      // A user-scoped read of a TENANT-WIDE integration (sync_excel, Stripe, Akeneo,
+      // S3, the channel OAuth *client* config) MUST still find the shared
+      // `user_id = NULL` row — the per-user row takes precedence, and we only fall
+      // back to the tenant-wide row when the user has none of their own. Writes stay
+      // strict (`save` uses the unmodified filter) so a per-user save never clobbers
+      // the shared credential.
+      if (!row && scope.userId) {
+        row = await findOneWithDecryption(
+          em,
+          IntegrationCredentials,
+          buildCredentialsFilter(integrationId, { ...scope, userId: null }),
+          undefined,
+          scope,
+        )
+      }
       if (!row) return null
       return decryptCredentialsBlob(row.credentials, scope)
     },
@@ -150,12 +190,7 @@ export function createCredentialsService(em: EntityManager) {
       const row = await findOneWithDecryption(
         em,
         IntegrationCredentials,
-        {
-          integrationId,
-          organizationId: scope.organizationId,
-          tenantId: scope.tenantId,
-          deletedAt: null,
-        },
+        buildCredentialsFilter(integrationId, scope),
         undefined,
         scope,
       )
@@ -171,6 +206,7 @@ export function createCredentialsService(em: EntityManager) {
         credentials: encryptedCredentials,
         organizationId: scope.organizationId,
         tenantId: scope.tenantId,
+        ...(scope.userId ? { userId: scope.userId } : {}),
       })
       await em.persist(created).flush()
     },

package/src/modules/integrations/migrations/.snapshot-open-mercato.json

@@ -135,6 +135,22 @@
           "comment": null,
           "enumItems": [],
           "mappedType": "datetime"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "enumItems": [],
+          "mappedType": "uuid"
         }
       },
       "indexes": [
@@ -159,6 +175,15 @@
           "keyName": "integration_credentials_pkey",
           "primary": true,
           "unique": true
+        },
+        {
+          "columnNames": [],
+          "composite": false,
+          "constraint": false,
+          "keyName": "integration_credentials_user_lookup_idx",
+          "primary": false,
+          "unique": true,
+          "expression": "create unique index \"integration_credentials_user_lookup_idx\" on \"integration_credentials\" (\"integration_id\", \"organization_id\", \"tenant_id\", \"user_id\") where \"user_id\" is not null and \"deleted_at\" is null"
         }
       ],
       "checks": [],
@@ -901,4 +926,4 @@
   ],
   "views": [],
   "nativeEnums": {}
-}
+}

package/src/modules/integrations/migrations/Migration20260526154136_integrations.ts

@@ -0,0 +1,15 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260526154136_integrations extends Migration {
+
+  override up(): void | Promise<void> {
+    this.addSql(`alter table "integration_credentials" add "user_id" uuid null;`);
+    this.addSql(`create unique index "integration_credentials_user_lookup_idx" on "integration_credentials" ("integration_id", "organization_id", "tenant_id", "user_id") where "user_id" is not null and "deleted_at" is null;`);
+  }
+
+  override down(): void | Promise<void> {
+    this.addSql(`drop index "integration_credentials_user_lookup_idx";`);
+    this.addSql(`alter table "integration_credentials" drop column "user_id";`);
+  }
+
+}

package/src/modules/messages/commands/messages.ts

@@ -125,6 +125,10 @@ const composeCommandSchema = composeMessageSchema.safeExtend({
   tenantId: scopeSchema.shape.tenantId,
   organizationId: scopeSchema.shape.organizationId,
   userId: scopeSchema.shape.userId,
+  // Optional dedup key (inbound email ingest sets it; other callers leave it
+  // undefined). When set, a re-issued compose returns the first message instead
+  // of creating a duplicate.
+  idempotencyKey: z.string().min(1).max(255).optional(),
 })
 
 const updateDraftCommandSchema = updateDraftSchema.safeExtend({
@@ -207,7 +211,49 @@ async function requireMessageById(
   return message
 }
 
-const composeMessageCommand: CommandHandler<unknown, { id: string; threadId: string | null; externalEmail: string | null; isDraft: boolean; recipientUserIds: string[] }> = {
+function isUniqueViolation(err: unknown): boolean {
+  if (!err || typeof err !== 'object') return false
+  const code = (err as { code?: string }).code
+  if (code === '23505') return true
+  const message = (err as { message?: string }).message
+  return typeof message === 'string' && /duplicate key value|unique constraint/i.test(message)
+}
+
+type ComposeMessageResult = {
+  id: string
+  threadId: string | null
+  externalEmail: string | null
+  isDraft: boolean
+  recipientUserIds: string[]
+  /**
+   * True when this was an idempotent replay — an existing message was returned
+   * and nothing was written. Signals `buildLog` to skip the audit/undo entry.
+   */
+  deduplicated?: boolean
+}
+
+async function buildComposeResultFromExisting(
+  em: EntityManager,
+  message: Message,
+): Promise<ComposeMessageResult> {
+  const recipients = await findWithDecryption(
+    em,
+    MessageRecipient,
+    { messageId: message.id, deletedAt: null },
+    undefined,
+    { tenantId: message.tenantId, organizationId: message.organizationId ?? null },
+  )
+  return {
+    id: message.id,
+    threadId: message.threadId ?? null,
+    externalEmail: message.externalEmail ?? null,
+    isDraft: message.isDraft,
+    recipientUserIds: recipients.map((recipient) => recipient.recipientUserId),
+    deduplicated: true,
+  }
+}
+
+const composeMessageCommand: CommandHandler<unknown, { id: string; threadId: string | null; externalEmail: string | null; isDraft: boolean; recipientUserIds: string[]; deduplicated?: boolean }> = {
   id: 'messages.messages.compose',
   async execute(rawInput, ctx) {
     const input = composeCommandSchema.parse(rawInput)
@@ -217,19 +263,42 @@ const composeMessageCommand: CommandHandler<unknown, { id: string; threadId: str
     }
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const scope = { tenantId: input.tenantId, organizationId: input.organizationId }
+
+    // Idempotency fast-path: a retried inbound-email ingest re-issues compose
+    // for the same source message (the first attempt committed the message but a
+    // downstream transient failure rolled the ingest back). Return that message
+    // so the retry cannot create a duplicate.
+    if (input.idempotencyKey) {
+      const existing = await findOneWithDecryption(
+        em,
+        Message,
+        { tenantId: input.tenantId, idempotencyKey: input.idempotencyKey },
+        undefined,
+        scope,
+      )
+      if (existing) return buildComposeResultFromExisting(em, existing)
+    }
+
     let messageId = ''
     let responseThreadId: string | null = null
     let responseExternalEmail: string | null = null
 
-    await em.transactional(async (trx) => {
+    const composeTx = em.transactional(async (trx) => {
       const threadId = input.parentMessageId
         ? (
-          await trx.findOne(Message, {
-            id: input.parentMessageId,
-            tenantId: input.tenantId,
-            organizationId: input.organizationId,
-            deletedAt: null,
-          })
+          await findOneWithDecryption(
+            trx,
+            Message,
+            {
+              id: input.parentMessageId,
+              tenantId: input.tenantId,
+              organizationId: input.organizationId,
+              deletedAt: null,
+            },
+            undefined,
+            scope,
+          )
         )?.threadId ?? input.parentMessageId
         : undefined
 
@@ -254,6 +323,7 @@ const composeMessageCommand: CommandHandler<unknown, { id: string; threadId: str
         sentAt: input.isDraft ? null : new Date(),
         actionData: input.actionData as MessageActionData | undefined,
         sendViaEmail,
+        idempotencyKey: input.idempotencyKey ?? null,
         tenantId: input.tenantId,
         organizationId: input.organizationId,
       })
@@ -313,6 +383,24 @@ const composeMessageCommand: CommandHandler<unknown, { id: string; threadId: str
       responseThreadId = message.threadId ?? null
       responseExternalEmail = message.externalEmail ?? null
     })
+    try {
+      await composeTx
+    } catch (err) {
+      // Lost a concurrent race on the same idempotency key — return the message
+      // the winning compose created. A propagated 23505 would otherwise be
+      // classified permanent and dead-letter the inbound mail.
+      if (input.idempotencyKey && isUniqueViolation(err)) {
+        const existing = await findOneWithDecryption(
+          em.fork(),
+          Message,
+          { tenantId: input.tenantId, idempotencyKey: input.idempotencyKey },
+          undefined,
+          scope,
+        )
+        if (existing) return buildComposeResultFromExisting(em.fork(), existing)
+      }
+      throw err
+    }
 
     if (!input.isDraft) {
       await emitMessageSentEvent(ctx.container, {
@@ -345,6 +433,11 @@ const composeMessageCommand: CommandHandler<unknown, { id: string; threadId: str
     return loadMessageAggregateSnapshot(em, result.id)
   },
   buildLog: async ({ input, result, snapshots }) => {
+    // Idempotent replay: execute returned a pre-existing message without writing
+    // anything. Skip the audit entry entirely — logging it as a fresh "Compose
+    // message" would both misrepresent the dedup and expose an undo that
+    // soft-deletes a legitimately-received inbound message.
+    if (result.deduplicated) return { skipLog: true }
     const parsed = composeCommandSchema.parse(input)
     return {
       actionLabel: parsed.isDraft ? 'Create draft message' : 'Compose message',

package/src/modules/messages/components/ComposeMessagePageClient.tsx

@@ -2,12 +2,29 @@
 
 import { useRouter } from 'next/navigation'
 import { MessageComposer } from '@open-mercato/ui/backend/messages'
+// UMES extension surface — compose page injection spot (SPEC-045d §9.3a).
+// Channel provider packages inject "composer capabilities" widgets here
+// (character limit warnings, channel format selector, attachment scoping, etc.).
+import { InjectionSpot } from '@open-mercato/ui/backend/injection/InjectionSpot'
 
 export function ComposeMessagePageClient() {
   const router = useRouter()
 
   return (
     <div className="space-y-4">
+      {/*
+        Standalone widget mount above the composer — NOT CrudForm field
+        resolution. This page is not a CrudForm, so the `crud-form:*:fields`
+        field-event pipeline (onFieldChange, value transformers, etc.) does
+        not apply here. Provider packages render composer-capability widgets
+        (character-limit warnings, channel format selectors, attachment
+        scoping) into this spot purely as additional UI siblings.
+      */}
+      <InjectionSpot
+        spotId="crud-form:messages:message:fields"
+        context={{ form: 'compose' }}
+        data={{}}
+      />
       <MessageComposer
         inline
         variant="compose"

package/src/modules/messages/components/MessageDetailPageClient.tsx

@@ -2,9 +2,12 @@
 
 import * as React from 'react'
 import { MessageComposer } from '@open-mercato/ui/backend/messages'
+import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { LoadingMessage, ErrorMessage } from '@open-mercato/ui/backend/detail'
+// UMES extension surface — message detail injection spots (SPEC-045d §9.3a)
+import { InjectionSpot } from '@open-mercato/ui/backend/injection/InjectionSpot'
 import {
   getMessageUiComponentRegistry,
 } from './utils/typeUiRegistry'
@@ -29,6 +32,7 @@ function MessageConversationDetailItem({
   onToggle,
   onReply,
   onForward,
+  userFeatures,
 }: {
   messageId: string
   isCollapsible: boolean
@@ -36,6 +40,7 @@ function MessageConversationDetailItem({
   onToggle: () => void
   onReply: (messageId: string) => void
   onForward: (messageId: string) => void
+  userFeatures: string[]
 }) {
   const state = useMessageDetails(messageId)
   const messageUiRegistry = React.useMemo(() => getMessageUiComponentRegistry(), [])
@@ -87,7 +92,23 @@ function MessageConversationDetailItem({
             ContentComponent={ContentComponent}
           />
 
+          {/* UMES — channel payload renderer mounts here (channel-linked emails, Slack blocks, etc.). */}
+          <InjectionSpot
+            spotId="detail:messages:message:body:after"
+            context={{ messageId }}
+            data={state.detail}
+          />
+
           <MessageDetailMetaSection detail={state.detail} />
+
+          {/* UMES — channel sidebar widgets (channel info panel, contact preview, delivery status).
+              `userFeatures` lets feature-gated widgets (e.g. the channel reassignment editor,
+              gated on `communication_channels.assign`) render their controls for permitted users. */}
+          <InjectionSpot
+            spotId="detail:messages:message:sidebar"
+            context={{ messageId, userFeatures }}
+            data={state.detail}
+          />
         </section>
 
         <MessageDetailActionsSection
@@ -138,6 +159,27 @@ function MessageConversationDetailItem({
 
 export function MessageDetailPageClient({ id }: { id: string }) {
   const state = useMessageDetails(id)
+  // Resolve the viewer's feature grants once and forward them into the sidebar
+  // injection spot so feature-gated widgets (channel reassignment editor) can
+  // render their controls. Without this, hub widgets that gate on
+  // `context.userFeatures` (e.g. `communication_channels.assign`) stay read-only.
+  const [userFeatures, setUserFeatures] = React.useState<string[]>([])
+  React.useEffect(() => {
+    let cancelled = false
+    void (async () => {
+      const res = await apiCall<{ ok: boolean; granted?: string[] }>('/api/auth/feature-check', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ features: ['communication_channels.assign'] }),
+      }).catch(() => null)
+      if (!cancelled && res?.ok && Array.isArray(res.result?.granted)) {
+        setUserFeatures(res.result.granted)
+      }
+    })()
+    return () => {
+      cancelled = true
+    }
+  }, [])
   const [activeInlineComposer, setActiveInlineComposer] = React.useState<{
     variant: 'reply' | 'forward'
     messageId: string
@@ -234,6 +276,7 @@ export function MessageDetailPageClient({ id }: { id: string }) {
               <MessageConversationDetailItem
                 key={item.id}
                 messageId={item.id}
+                userFeatures={userFeatures}
                 isCollapsible={!isForcedExpanded}
                 isExpanded
                 onToggle={() => state.toggleConversationItem(item.id)}

package/src/modules/messages/components/MessagesInboxPageClient.tsx

@@ -362,6 +362,10 @@ export function MessagesInboxPageClient() {
     <div className="space-y-4">
       <DataTable
         title={t('messages.title', 'Messages')}
+        // UMES extension surface — opt into widget injection at:
+        //   data-table:messages:columns / :row-actions / :bulk-actions / :filters / :toolbar / :search-trailing
+        // (SPEC-045d §9.3a — communication_channels hub renders channel badge + delivery status here)
+        extensionTableId="messages"
         columns={columns}
         data={rows}
         bulkActions={bulkActions}

package/src/modules/messages/data/entities.ts

@@ -30,6 +30,11 @@ export type MessageActionData = {
 @Index({ name: 'messages_type_idx', properties: ['type', 'tenantId'] })
 @Index({ name: 'messages_tenant_idx', properties: ['tenantId', 'organizationId'] })
 @Index({ name: 'messages_external_email_hash_idx', properties: ['externalEmailHash'] })
+@Index({
+  name: 'messages_idempotency_key_uq',
+  expression:
+    'create unique index "messages_idempotency_key_uq" on "messages" ("tenant_id", "idempotency_key") where "idempotency_key" is not null',
+})
 export class Message {
   [OptionalProps]?: 'type' | 'status' | 'priority' | 'bodyFormat' | 'isDraft' | 'createdAt' | 'updatedAt'
 
@@ -117,6 +122,12 @@ export class Message {
   @Property({ name: 'external_email_hash', type: 'text', nullable: true })
   externalEmailHash?: string | null
 
+  // Stable per-source idempotency key (inbound email = channel + provider
+  // message id). Lets a retried `compose` return the message created by the
+  // first attempt instead of duplicating it. Partial-unique per tenant.
+  @Property({ name: 'idempotency_key', type: 'text', nullable: true })
+  idempotencyKey?: string | null
+
   @Property({ name: 'external_name', type: 'text', nullable: true })
   externalName?: string | null
 

package/src/modules/messages/migrations/.snapshot-open-mercato.json

@@ -270,6 +270,15 @@
           "nullable": true,
           "mappedType": "text"
         },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "mappedType": "text"
+        },
         "external_name": {
           "name": "external_name",
           "type": "text",
@@ -365,6 +374,15 @@
           "primary": false,
           "unique": false
         },
+        {
+          "columnNames": [],
+          "composite": false,
+          "constraint": false,
+          "keyName": "messages_idempotency_key_uq",
+          "primary": false,
+          "unique": false,
+          "expression": "create unique index \"messages_idempotency_key_uq\" on \"messages\" (\"tenant_id\", \"idempotency_key\") where \"idempotency_key\" is not null"
+        },
         {
           "keyName": "messages_pkey",
           "columnNames": [

package/src/modules/messages/migrations/Migration20260531130000.ts

@@ -0,0 +1,15 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260531130000 extends Migration {
+
+  override async up(): Promise<void> {
+    this.addSql(`alter table "messages" add column if not exists "idempotency_key" text null;`);
+    this.addSql(`create unique index if not exists "messages_idempotency_key_uq" on "messages" ("tenant_id", "idempotency_key") where "idempotency_key" is not null;`);
+  }
+
+  override async down(): Promise<void> {
+    this.addSql(`drop index if exists "messages_idempotency_key_uq";`);
+    this.addSql(`alter table "messages" drop column if exists "idempotency_key";`);
+  }
+
+}

package/src/modules/messages/widgets/injection-table.ts

@@ -0,0 +1,29 @@
+import type { ModuleInjectionTable } from '@open-mercato/shared/modules/widgets/injection'
+
+/**
+ * Messages module — widget injection table.
+ *
+ * The messages module currently does not register any widgets INTO other modules' spots.
+ * This file exists primarily to document the spots the messages module EXPOSES for other
+ * modules to inject into. The actual `<InjectionSpot>` placements live in the messages
+ * pages themselves (see `components/MessagesInboxPageClient.tsx`,
+ * `components/MessageDetailPageClient.tsx`, `components/ComposeMessagePageClient.tsx`).
+ *
+ * Exposed spot IDs (additive contract per BACKWARD_COMPATIBILITY.md §6):
+ *   - `data-table:messages:columns`              — auto-wired by `DataTable extensionTableId="messages"`
+ *   - `data-table:messages:row-actions`          — auto-wired by `DataTable extensionTableId="messages"`
+ *   - `data-table:messages:bulk-actions`         — auto-wired by `DataTable extensionTableId="messages"`
+ *   - `data-table:messages:filters`              — auto-wired by `DataTable extensionTableId="messages"`
+ *   - `data-table:messages:search-trailing`      — auto-wired by `DataTable extensionTableId="messages"`
+ *   - `data-table:messages:toolbar`              — auto-wired by `DataTable extensionTableId="messages"`
+ *   - `detail:messages:message:body:after`       — placed in `MessageDetailPageClient.tsx`
+ *   - `detail:messages:message:sidebar`          — placed in `MessageDetailPageClient.tsx`
+ *   - `crud-form:messages:message:fields`        — placed in `ComposeMessagePageClient.tsx` as a standalone widget mount above the composer (NOT CrudForm field resolution; the compose page is not a CrudForm)
+ *
+ * The `communication_channels` hub (SPEC-045d) is the primary consumer of these spots,
+ * injecting channel badges, channel payload renderers, reaction bars, channel info
+ * sidebars, and composer capability adapters.
+ */
+export const injectionTable: ModuleInjectionTable = {}
+
+export default injectionTable