@open-mercato/core 0.6.8-develop.6983.1.e4f794099e → 0.6.8-develop.6985.1.fb93574faa

package/src/modules/communication_channels/commands/admin-delete-channel.ts

@@ -0,0 +1,203 @@
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { CommandHandler } from '@open-mercato/shared/lib/commands'
+import { registerCommand } from '@open-mercato/shared/lib/commands'
+import { extractUndoPayload as extractSharedUndoPayload } from '@open-mercato/shared/lib/commands/undo'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { CommunicationChannel } from '../data/entities'
+import { channelOrgScopeWhere } from '../lib/access-control'
+import { pushUnregister } from './push-unregister'
+import { emitCommunicationChannelsEvent } from '../events'
+
+const logger = createLogger('communication_channels')
+
+const adminDeleteChannelSchema = z.object({
+  channelId: z.string().uuid(),
+  scope: z.object({
+    tenantId: z.string().uuid(),
+    organizationId: z.string().uuid().nullable(),
+  }),
+})
+
+export type AdminDeleteChannelInput = z.infer<typeof adminDeleteChannelSchema>
+
+export type AdminDeleteChannelResult =
+  | { status: 'deleted'; channelId: string; undo: AdminDeleteChannelUndoSnapshot }
+  | { status: 'noop'; reason: string }
+  | { status: 'not_tenant_wide'; reason: string }
+
+export interface AdminDeleteChannelUndoSnapshot {
+  channelId: string
+  // Optional only for back-compat with any pre-existing log entries; new
+  // snapshots always set it so the undo lookup stays tenant-scoped.
+  tenantId?: string
+}
+
+export const COMMUNICATION_CHANNELS_ADMIN_DELETE_CHANNEL_COMMAND_ID =
+  'communication_channels.channel.admin_delete'
+
+/**
+ * Admin soft-delete for a TENANT-WIDE channel (`user_id IS NULL`) — the
+ * companion to `delete-channel.ts` (owner-only, per-user path). Tenant-wide
+ * channels (shared inboxes and the push providers FCM/APNs/Expo) have no owner,
+ * so the owner path rejects them as `not_owner`; this path deletes them under
+ * the `communication_channels.admin` feature.
+ *
+ * The channel is loaded org-agnostically (tenant-wide push channels store
+ * `organization_id IS NULL`, but shared inboxes may pin an org) via
+ * `channelOrgScopeWhere`, so it resolves from any session org in the tenant.
+ * Per-user channels are refused with `not_tenant_wide` — they MUST go through
+ * the owner path so personal-mailbox privacy holds.
+ *
+ * Provider-side push delivery is torn down best-effort BEFORE the soft-delete,
+ * keyed on the CHANNEL's own org (`channel.organizationId ?? tenantId`) so
+ * credentials resolve where they were written (see push-register.ts /
+ * connect-credential-channel.ts). Mirrors `delete-channel`'s teardown.
+ *
+ * Undoable: undo clears `deleted_at` to restore the row. Parity with
+ * `delete-channel` — same event, payload, buildLog, and undo shape.
+ */
+const adminDeleteChannelCommand: CommandHandler<
+  AdminDeleteChannelInput,
+  AdminDeleteChannelResult
+> = {
+  id: COMMUNICATION_CHANNELS_ADMIN_DELETE_CHANNEL_COMMAND_ID,
+  // Explicitly undoable (the bus also infers this from `undo` below, but
+  // declaring it keeps undoability from silently dropping under a refactor).
+  isUndoable: true,
+  async execute(rawInput, ctx) {
+    const input = adminDeleteChannelSchema.parse(rawInput) as AdminDeleteChannelInput
+    const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const dscope = {
+      tenantId: input.scope.tenantId,
+      organizationId: input.scope.organizationId ?? null,
+    }
+
+    const channel = await findOneWithDecryption(
+      em,
+      CommunicationChannel,
+      {
+        id: input.channelId,
+        tenantId: input.scope.tenantId,
+        ...channelOrgScopeWhere(input.scope.organizationId),
+        deletedAt: null,
+      },
+      undefined,
+      dscope,
+    )
+    if (!channel) {
+      return { status: 'noop', reason: 'channel not found' }
+    }
+    if (channel.userId != null) {
+      return {
+        status: 'not_tenant_wide',
+        reason: 'channel is a per-user channel; use the owner delete path',
+      }
+    }
+
+    // Tear down provider-side push delivery before the soft-delete, while
+    // credentials are still resolvable. Keyed on the channel's OWN org (push
+    // channels store credentials at `organization_id = tenantId`; shared inboxes
+    // at their pinned org). Best-effort — failures are logged inside
+    // pushUnregister and never re-raised.
+    if (channel.credentialsRef) {
+      const channelOrganizationId = channel.organizationId ?? input.scope.tenantId
+      try {
+        await pushUnregister({
+          container: ctx.container,
+          scope: {
+            tenantId: input.scope.tenantId,
+            organizationId: channelOrganizationId,
+            userId: channel.userId ?? null,
+          },
+          input: { channelId: channel.id },
+        })
+      } catch (err) {
+        logger.warn('admin-delete-channel push unregister failed', { channelId: channel.id, err })
+      }
+    }
+
+    channel.deletedAt = new Date()
+    channel.isPrimary = false
+    await em.flush()
+
+    // Emit AFTER flush so subscribers observe the committed soft-delete. Same
+    // event/payload shape as delete-channel so workflows/audit observe the full
+    // channel lifecycle. Persistent so the delivery can retry on failure.
+    await emitCommunicationChannelsEvent(
+      'communication_channels.channel.deleted',
+      {
+        channelId: channel.id,
+        userId: channel.userId ?? null,
+        providerKey: channel.providerKey,
+        channelType: channel.channelType,
+        tenantId: input.scope.tenantId,
+        organizationId: channel.organizationId ?? null,
+      },
+      { persistent: true },
+    )
+
+    return {
+      status: 'deleted',
+      channelId: channel.id,
+      undo: { channelId: channel.id, tenantId: channel.tenantId },
+    }
+  },
+  // Persist the undo snapshot into the action log. Without this, the command bus
+  // mints an undo token (so the UI offers "Undo") but the snapshot returned from
+  // execute() is never stored, and undo() (which clears deleted_at) would no-op.
+  async buildLog({ input, result }) {
+    if (result.status !== 'deleted') return null
+    return {
+      resourceKind: 'communication_channels.channel',
+      resourceId: result.channelId,
+      tenantId: result.undo.tenantId ?? input.scope.tenantId,
+      organizationId: input.scope.organizationId ?? null,
+      payload: { undo: result.undo },
+    }
+  },
+  async undo({ ctx, logEntry }) {
+    const snapshot = extractSnapshotFromLog(logEntry)
+    if (!snapshot || !snapshot.tenantId) return
+    const em = (ctx.container.resolve('em') as EntityManager).fork()
+    // Re-find WITHOUT the `deletedAt: null` filter — the row we are restoring is
+    // soft-deleted. Tenant-scoped to avoid cross-tenant resolution by bare id.
+    const channel = await findOneWithDecryption(
+      em,
+      CommunicationChannel,
+      { id: snapshot.channelId, tenantId: snapshot.tenantId },
+      undefined,
+      { tenantId: snapshot.tenantId, organizationId: null },
+    )
+    if (!channel) return
+    channel.deletedAt = null
+    await em.flush()
+  },
+}
+
+/**
+ * Defensive shape-validator for the delete snapshot — mirrors the helper in
+ * `delete-channel.ts` so tests can construct snapshots directly.
+ */
+export function extractUndoPayload(value: unknown): AdminDeleteChannelUndoSnapshot | null {
+  if (!value || typeof value !== 'object') return null
+  const candidate = (value as { undo?: unknown; channelId?: unknown }).undo ?? value
+  if (!candidate || typeof candidate !== 'object') return null
+  const obj = candidate as Record<string, unknown>
+  if (typeof obj.channelId !== 'string') return null
+  return {
+    channelId: obj.channelId,
+    tenantId: typeof obj.tenantId === 'string' ? obj.tenantId : undefined,
+  }
+}
+
+function extractSnapshotFromLog(logEntry: unknown): AdminDeleteChannelUndoSnapshot | null {
+  const undo = extractSharedUndoPayload<AdminDeleteChannelUndoSnapshot>((logEntry ?? null) as never)
+  if (undo) return extractUndoPayload(undo)
+  return extractUndoPayload(logEntry)
+}
+
+registerCommand(adminDeleteChannelCommand)
+
+export default adminDeleteChannelCommand

package/src/modules/communication_channels/commands/connect-credential-channel.ts

@@ -15,7 +15,12 @@ const connectCredentialChannelSchema = z.object({
   credentials: z.record(z.string(), z.unknown()),
   /** Optional polling interval (seconds) — set when adapter is polling-based. */
   pollIntervalSeconds: z.number().int().positive().max(86_400).optional(),
-  userId: z.string().uuid(),
+  /**
+   * Connecting user. `null` for tenant-wide (admin-connected) channels whose
+   * provider declares `channelScope: 'tenant'` (push: FCM/APNs/Expo) — the
+   * resulting channel + credentials are stored with `user_id = NULL`.
+   */
+  userId: z.string().uuid().nullable(),
   scope: z.object({
     tenantId: z.string().uuid(),
     organizationId: z.string().uuid().nullable(),
@@ -26,9 +31,10 @@ export type ConnectCredentialChannelInput = z.infer<typeof connectCredentialChan
 
 export type ConnectCredentialChannelResult =
   | { status: 'connected'; channelId: string; externalIdentifier: string | null }
-  | { status: 'validation_failed'; errors: Record<string, string> }
+  | { status: 'validation_failed'; errors: Record<string, string>; errorCodes?: Record<string, string> }
   | { status: 'no_adapter'; reason: string }
   | { status: 'duplicate_mailbox'; externalIdentifier: string; existingProviderKey: string }
+  | { status: 'wrong_scope_for_route'; providerKey: string }
 
 export const COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID =
   'communication_channels.channel.connect_credential'
@@ -42,21 +48,26 @@ type CredentialsServiceLike = {
 }
 
 /**
- * Connect a per-user credential-based channel (IMAP, and future basic-auth providers).
+ * Connect a credential-based channel (IMAP, push providers, and future basic-auth
+ * providers).
  *
  * Flow:
  *   1. Resolve the adapter for `providerKey`.
- *   2. Call `adapter.validateCredentials?` — adapters that don't implement it
+ *   2. Decide scope: `adapter.channelScope === 'tenant'` → the channel + credentials
+ *      are stored with `user_id = NULL` (one shared channel per tenant, e.g. push
+ *      FCM/APNs/Expo); otherwise they are stored under the connecting `userId`.
+ *   3. Call `adapter.validateCredentials?` — adapters that don't implement it
  *      are accepted optimistically (the hub trusts the adapter to fail on first
  *      use). Adapters with the method return field-level errors via Zod-like
  *      `{ ok: false, errors: { fieldName: 'message' } }`; we forward those to
  *      the caller for `createCrudFormError`.
- *   3. Persist the credentials encrypted via `integrationCredentialsService.save?` if available.
- *   4. Create the `CommunicationChannel` row with `userId = currentUser.id`,
+ *   4. Persist the credentials encrypted via `integrationCredentialsService.save?` if available.
+ *   5. Create the `CommunicationChannel` row with the effective `userId`,
  *      `status = 'connected'`, and the adapter's declared capabilities snapshot.
  *
- * The route handler binds the `userId` field from the authenticated session;
- * the command refuses inputs whose `userId` doesn't pass UUID validation.
+ * The per-user route binds `userId` from the authenticated session; the tenant
+ * route passes `userId: null`. Either way the command re-derives the effective
+ * scope from the adapter, so a tenant provider is never stamped per-user.
  */
 const connectCredentialChannelCommand: CommandHandler<
   ConnectCredentialChannelInput,
@@ -75,6 +86,23 @@ const connectCredentialChannelCommand: CommandHandler<
       }
     }
 
+    // Tenant-wide providers (push: FCM/APNs/Expo) store one shared channel +
+    // credential row per tenant with `user_id = NULL`; per-user providers
+    // (Gmail/IMAP) keep the connecting user's id.
+    //
+    // SECURITY: a tenant-scoped provider must only be connected through the
+    // admin-gated tenant route (which passes `userId: null`). If it arrives with
+    // a non-null `userId` it came from the per-user route (feature
+    // `connect_user_channel`, granted to manager/employee) — refuse rather than
+    // silently minting a privileged tenant-wide channel that bypasses the
+    // admin-only `connect_tenant_channel` gate. The tenant route passes
+    // `userId: null`, so legitimate tenant connects still pass.
+    const tenantScoped = adapter.channelScope === 'tenant'
+    if (tenantScoped && input.userId !== null) {
+      return { status: 'wrong_scope_for_route', providerKey: input.providerKey }
+    }
+    const effectiveUserId = tenantScoped ? null : input.userId
+
     // Optional credential validation.
     if (typeof adapter.validateCredentials === 'function') {
       const validation = await adapter.validateCredentials({
@@ -89,6 +117,7 @@ const connectCredentialChannelCommand: CommandHandler<
         return {
           status: 'validation_failed',
           errors: validation.errors ?? { _form: 'Credential validation failed' },
+          errorCodes: validation.errorCodes,
         }
       }
     }
@@ -106,11 +135,24 @@ const connectCredentialChannelCommand: CommandHandler<
     //
     // `scope.userId` is set so the credentials service writes a per-user row.
     // Without this, two users on the same tenant share one credentials row
-    // (see review R2-C1 / N1, 2026-05-26).
+    // (see review R2-C1 / N1, 2026-05-26). Tenant-wide providers pass `null`
+    // here so the service writes/reads the shared `user_id = NULL` row (same
+    // pattern as Stripe/Akeneo tenant-wide credentials).
+    //
+    // `organizationId` for tenant scope is pinned to `tenantId` (not the
+    // connecting admin's selected org). The channel dedup/heal is org-agnostic
+    // (index + heal key ignore org) and the channel row is stored with
+    // `organization_id = NULL`, so push-delivery resolves credentials at
+    // `channel.organizationId ?? tenantId` = `tenantId`. Pinning the write to the
+    // same key keeps a cross-org reconnect (e.g. key rotation from another org)
+    // overwriting the one credential row the delivery path actually reads, rather
+    // than orphaning it under a per-org key.
     const credentialsScope = {
       tenantId: input.scope.tenantId,
-      organizationId: input.scope.organizationId ?? input.scope.tenantId,
-      userId: input.userId,
+      organizationId: tenantScoped
+        ? input.scope.tenantId
+        : input.scope.organizationId ?? input.scope.tenantId,
+      userId: effectiveUserId,
     }
     let credentialsRefId: string | null = null
     let credentialsPersisted = false
@@ -118,7 +160,7 @@ const connectCredentialChannelCommand: CommandHandler<
       try {
         await credentialsService.save(
           `channel_${input.providerKey}`,
-          { ...input.credentials, userId: input.userId },
+          { ...input.credentials, ...(effectiveUserId ? { userId: effectiveUserId } : {}) },
           credentialsScope,
         )
         credentialsPersisted = true
@@ -182,8 +224,14 @@ const connectCredentialChannelCommand: CommandHandler<
         displayName: input.displayName,
         externalIdentifier,
         credentialsRefId,
-        userId: input.userId,
-        scope: { tenantId: input.scope.tenantId, organizationId: input.scope.organizationId ?? null },
+        userId: effectiveUserId,
+        // Tenant-wide channels store `organization_id = NULL` (truly tenant-scoped,
+        // matching the entity's `user_id NULL` semantics) so the org-agnostic heal
+        // key stays stable across orgs and delivery reads creds at `?? tenantId`.
+        scope: {
+          tenantId: input.scope.tenantId,
+          organizationId: tenantScoped ? null : input.scope.organizationId ?? null,
+        },
         pollIntervalSeconds: input.pollIntervalSeconds,
       })
     } catch (err) {
@@ -205,7 +253,7 @@ const connectCredentialChannelCommand: CommandHandler<
     // covers the channel until the operator clicks "Re-register push".
     // Imported lazily to avoid a circular module load (push-register reads
     // the channel adapter registry, which is initialised after this module).
-    if (credentialsAvailable && input.providerKey === 'gmail') {
+    if (credentialsAvailable && input.providerKey === 'gmail' && input.userId) {
       const adapterSupportsPush =
         typeof adapter.registerPush === 'function' && typeof adapter.unregisterPush === 'function'
       const organizationId = input.scope.organizationId

package/src/modules/communication_channels/commands/deliver-outbound-message.ts

@@ -282,9 +282,17 @@ const deliverOutboundMessageCommand: CommandHandler<
     // Per-user credentials scope: pass `channel.userId` so the credentials
     // service returns this user's row, not whoever connected last. See
     // review R2-C1 / N1 (2026-05-26).
+    //
+    // Key the org on the CHANNEL's own org, not the message's org. Tenant-wide
+    // channels store `organization_id = NULL` and their credentials live at
+    // `organization_id = tenantId` (see connect-credential-channel.ts), so
+    // `channel.organizationId ?? tenantId` matches the write key for both
+    // org-scoped and tenant-wide channels. Keying on the message org would
+    // resolve `{}` the moment a tenant-wide provider delivers from a message
+    // that carries a non-null org.
     const credentialsScope = {
       tenantId: input.scope.tenantId,
-      organizationId: input.scope.organizationId ?? input.scope.tenantId,
+      organizationId: channel.organizationId ?? input.scope.tenantId,
       userId: channel.userId ?? null,
     }
     let credentials: Record<string, unknown> = {}
@@ -406,7 +414,7 @@ const deliverOutboundMessageCommand: CommandHandler<
         credentials,
         scope: {
           tenantId: input.scope.tenantId,
-          organizationId: input.scope.organizationId ?? input.scope.tenantId,
+          organizationId: channel.organizationId ?? input.scope.tenantId,
         },
         metadata: converted.metadata,
       })

package/src/modules/communication_channels/commands/push-register.ts

@@ -113,9 +113,15 @@ export async function pushRegister(params: {
   } catch {
     credentialsService = null
   }
+  // Resolve credentials at the channel's OWN org, not the caller's scope org.
+  // Tenant-wide channels store `organization_id = NULL` and their credentials
+  // live at `organization_id = tenantId` (see connect-credential-channel.ts).
+  // Keying on `channel.organizationId ?? tenantId` matches the write key for
+  // both org-scoped (per-user) and tenant-wide channels; keying on the caller's
+  // scope org would silently resolve `{}` for a tenant-wide channel.
   const credentialsScope = {
     tenantId: scope.tenantId,
-    organizationId: scope.organizationId,
+    organizationId: channel.organizationId ?? scope.tenantId,
     userId: channel.userId ?? null,
   }
   let credentials: Record<string, unknown> = {}

package/src/modules/communication_channels/commands/push-unregister.ts

@@ -3,6 +3,7 @@ import type { AwilixContainer } from 'awilix'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { CommunicationChannel } from '../data/entities'
+import { channelOrgScopeWhere } from '../lib/access-control'
 import { getChannelAdapterRegistry } from '../lib/adapter-registry-singleton'
 import { refreshCredentialsIfNeeded } from '../lib/credential-refresh'
 import { POLLING_ONLY_DEFAULT_INTERVAL_SECONDS } from '../lib/connect-channel'
@@ -64,7 +65,14 @@ export async function pushUnregister(params: {
   const { container, scope } = params
 
   const em = (container.resolve('em') as EntityManager).fork()
-  const dscope = { tenantId: scope.tenantId, organizationId: scope.organizationId }
+  // The channel ROW and the credentials store use DIFFERENT orgs. A tenant-wide push channel is
+  // stored with `organization_id = NULL` (its encrypted columns are keyed at org=null) even though
+  // its credentials are pinned at `organization_id = tenantId`. `scope.organizationId` here is the
+  // credentials/delivery org (tenantId for tenant-wide) — so it must NOT be used as an exact row
+  // filter (it would never match a null-org row) nor as the row decryption org. Look the row up
+  // null-aware and decrypt at the row's own org (null column ⇒ null fallback); credential resolution
+  // below keeps using the credentials org.
+  const dscope = { tenantId: scope.tenantId, organizationId: null }
 
   const channel = await findOneWithDecryption(
     em,
@@ -72,7 +80,7 @@ export async function pushUnregister(params: {
     {
       id: input.channelId,
       tenantId: scope.tenantId,
-      organizationId: scope.organizationId,
+      ...channelOrgScopeWhere(scope.organizationId),
     },
     undefined,
     dscope,
@@ -98,9 +106,12 @@ export async function pushUnregister(params: {
   } catch {
     credentialsService = null
   }
+  // Resolve credentials at the channel's OWN org (tenant-wide channels store
+  // their credentials at `organization_id = tenantId`; see push-register.ts /
+  // connect-credential-channel.ts), never the caller's scope org.
   const credentialsScope = {
     tenantId: scope.tenantId,
-    organizationId: scope.organizationId,
+    organizationId: channel.organizationId ?? scope.tenantId,
     userId: channel.userId ?? null,
   }
   let credentials: Record<string, unknown> = {}

package/src/modules/communication_channels/data/entities.ts

@@ -63,6 +63,16 @@ export type CommunicationChannelStatus =
   expression:
     `create unique index "communication_channels_user_provider_external_uq" on "communication_channels" ("tenant_id", "user_id", "provider_key", "external_identifier") where "deleted_at" is null and "user_id" is not null and "external_identifier" is not null`,
 })
+// One tenant-wide push channel per (tenant, provider): push providers (FCM/APNs/
+// Expo) have no `external_identifier` and `user_id IS NULL`, so the mailbox
+// unique index above does not cover them. This keeps an admin reconnect healing
+// the single shared row (see `createConnectedChannelRow`) instead of inserting
+// duplicates the fan-out would silently ignore.
+@Index({
+  name: 'communication_channels_tenant_push_provider_uq',
+  expression:
+    `create unique index "communication_channels_tenant_push_provider_uq" on "communication_channels" ("tenant_id", "provider_key") where "channel_type" = 'push' and "user_id" is null and "deleted_at" is null`,
+})
 export class CommunicationChannel {
   [OptionalProps]?:
     | 'createdAt'

package/src/modules/communication_channels/data/validators.ts

@@ -74,6 +74,7 @@ export const validateCredentialsInputSchema = z.object({
 export const validateCredentialsResultSchema = z.object({
   ok: z.boolean(),
   errors: z.record(z.string(), z.string()).optional(),
+  errorCodes: z.record(z.string(), z.string()).optional(),
 })
 
 export const refreshCredentialsInputSchema = z.object({

package/src/modules/communication_channels/i18n/de.json

@@ -125,6 +125,39 @@
   "communication_channels.profile.tableTitle": "Ihre Kanäle",
   "communication_channels.profile.title": "Meine Kommunikationskanäle",
   "communication_channels.push.button.reregister": "Push neu registrieren",
+  "communication_channels.push.connect.blocked": "Verbindung durch Validierung blockiert",
+  "communication_channels.push.connect.button.apns": "APNs verbinden",
+  "communication_channels.push.connect.button.expo": "Expo verbinden",
+  "communication_channels.push.connect.button.fcm": "FCM verbinden",
+  "communication_channels.push.connect.cancel": "Abbrechen",
+  "communication_channels.push.connect.connected": "Push-Anbieter verbunden.",
+  "communication_channels.push.connect.connecting": "Verbinden…",
+  "communication_channels.push.connect.description": "Dies ist ein gemeinsamer, mandantenweiter Kanal — er bedient die Geräte aller Benutzer in diesem Arbeitsbereich.",
+  "communication_channels.push.connect.displayName": "Anzeigename",
+  "communication_channels.push.connect.errors.fields.invalid": "Dieser Wert ist ungültig.",
+  "communication_channels.push.connect.errors.fields.invalid_bundle_id": "Eine Bundle-ID sieht aus wie com.example.app.",
+  "communication_channels.push.connect.errors.fields.invalid_json": "Das ist kein gültiges JSON. Fügen Sie die Dienstkontodatei genau so ein, wie Firebase sie erzeugt hat.",
+  "communication_channels.push.connect.errors.fields.invalid_key_id": "Eine APNs-Key-ID besteht aus 10 alphanumerischen Zeichen.",
+  "communication_channels.push.connect.errors.fields.invalid_p8": "Das ist kein lesbarer APNs-.p8-Signaturschlüssel. Fügen Sie die vollständige Datei einschließlich der BEGIN- und END-Zeilen ein.",
+  "communication_channels.push.connect.errors.fields.invalid_team_id": "Eine Apple-Team-ID besteht aus 10 alphanumerischen Zeichen.",
+  "communication_channels.push.connect.errors.fields.missing_fields": "In der Dienstkonto-JSON fehlen erforderliche Felder (project_id, client_email, private_key).",
+  "communication_channels.push.connect.errors.fields.required": "Dieses Feld ist erforderlich.",
+  "communication_channels.push.connect.errors.mailbox_already_connected": "Dieser Kanal ist bereits über einen anderen Anbieter verbunden. Trennen Sie ihn dort, bevor Sie ihn erneut verbinden.",
+  "communication_channels.push.connect.errors.provider_not_tenant_scoped": "Dieser Anbieter verbindet benutzerspezifische Kanäle; verwenden Sie stattdessen den persönlichen Kanalverbindungsvorgang.",
+  "communication_channels.push.connect.errors.wrong_scope_for_route": "Unerwarteter Kanalbereich. Bitte versuchen Sie es erneut oder wenden Sie sich an den Support.",
+  "communication_channels.push.connect.failed": "Push-Anbieter konnte nicht verbunden werden.",
+  "communication_channels.push.connect.fields.apns.bundleId": "Bundle-ID",
+  "communication_channels.push.connect.fields.apns.keyId": "Key-ID",
+  "communication_channels.push.connect.fields.apns.p8Key": "APNs .p8-Schlüssel",
+  "communication_channels.push.connect.fields.apns.production": "Produktionsumgebung",
+  "communication_channels.push.connect.fields.apns.teamId": "Team-ID",
+  "communication_channels.push.connect.fields.expo.accessToken": "Zugriffstoken (optional)",
+  "communication_channels.push.connect.fields.fcm.appName": "App-Name (optional)",
+  "communication_channels.push.connect.fields.fcm.serviceAccountJson": "Dienstkonto-JSON",
+  "communication_channels.push.connect.save": "Verbinden",
+  "communication_channels.push.connect.title.apns": "Apple Push Notification service verbinden",
+  "communication_channels.push.connect.title.expo": "Expo Push verbinden",
+  "communication_channels.push.connect.title.fcm": "Firebase Cloud Messaging verbinden",
   "communication_channels.push.flash.registerFailed": "Push-Registrierung fehlgeschlagen",
   "communication_channels.push.status.active": "Push aktiv",
   "communication_channels.push.status.failed": "Push fehlgeschlagen — nutze Polling",
@@ -140,5 +173,6 @@
   "communication_channels.status.disconnected": "Getrennt",
   "communication_channels.status.error": "Fehler",
   "communication_channels.status.inactive": "Inaktiv",
-  "communication_channels.status.requiresReauth": "Erneutes Verbinden erforderlich"
+  "communication_channels.status.requiresReauth": "Erneutes Verbinden erforderlich",
+  "notifications.categories.communication_channels": "Kommunikation"
 }

package/src/modules/communication_channels/i18n/en.json

@@ -125,6 +125,39 @@
   "communication_channels.profile.tableTitle": "Your channels",
   "communication_channels.profile.title": "My communication channels",
   "communication_channels.push.button.reregister": "Re-register push",
+  "communication_channels.push.connect.blocked": "Connection blocked by validation",
+  "communication_channels.push.connect.button.apns": "Connect APNs",
+  "communication_channels.push.connect.button.expo": "Connect Expo",
+  "communication_channels.push.connect.button.fcm": "Connect FCM",
+  "communication_channels.push.connect.cancel": "Cancel",
+  "communication_channels.push.connect.connected": "Push provider connected.",
+  "communication_channels.push.connect.connecting": "Connecting…",
+  "communication_channels.push.connect.description": "This is a shared, tenant-wide channel — every user's devices in this workspace are served by it.",
+  "communication_channels.push.connect.displayName": "Display name",
+  "communication_channels.push.connect.errors.fields.invalid": "This value is invalid.",
+  "communication_channels.push.connect.errors.fields.invalid_bundle_id": "A Bundle ID looks like com.example.app.",
+  "communication_channels.push.connect.errors.fields.invalid_json": "This is not valid JSON. Paste the service account file exactly as Firebase generated it.",
+  "communication_channels.push.connect.errors.fields.invalid_key_id": "An APNs Key ID is 10 alphanumeric characters.",
+  "communication_channels.push.connect.errors.fields.invalid_p8": "This is not a readable APNs .p8 signing key. Paste the whole file including the BEGIN and END lines.",
+  "communication_channels.push.connect.errors.fields.invalid_team_id": "An Apple Team ID is 10 alphanumeric characters.",
+  "communication_channels.push.connect.errors.fields.missing_fields": "The service account JSON is missing required fields (project_id, client_email, private_key).",
+  "communication_channels.push.connect.errors.fields.required": "This field is required.",
+  "communication_channels.push.connect.errors.mailbox_already_connected": "This channel is already connected via another provider. Disconnect it there before reconnecting.",
+  "communication_channels.push.connect.errors.provider_not_tenant_scoped": "This provider connects per-user channels; use the personal channel connect flow instead.",
+  "communication_channels.push.connect.errors.wrong_scope_for_route": "Unexpected channel scope. Please try again or contact support.",
+  "communication_channels.push.connect.failed": "Could not connect push provider.",
+  "communication_channels.push.connect.fields.apns.bundleId": "Bundle ID",
+  "communication_channels.push.connect.fields.apns.keyId": "Key ID",
+  "communication_channels.push.connect.fields.apns.p8Key": "APNs .p8 key",
+  "communication_channels.push.connect.fields.apns.production": "Production environment",
+  "communication_channels.push.connect.fields.apns.teamId": "Team ID",
+  "communication_channels.push.connect.fields.expo.accessToken": "Access token (optional)",
+  "communication_channels.push.connect.fields.fcm.appName": "App name (optional)",
+  "communication_channels.push.connect.fields.fcm.serviceAccountJson": "Service Account JSON",
+  "communication_channels.push.connect.save": "Connect",
+  "communication_channels.push.connect.title.apns": "Connect Apple Push Notification service",
+  "communication_channels.push.connect.title.expo": "Connect Expo Push",
+  "communication_channels.push.connect.title.fcm": "Connect Firebase Cloud Messaging",
   "communication_channels.push.flash.registerFailed": "Failed to register push",
   "communication_channels.push.status.active": "Push active",
   "communication_channels.push.status.failed": "Push failed — using polling",
@@ -140,5 +173,6 @@
   "communication_channels.status.disconnected": "Disconnected",
   "communication_channels.status.error": "Error",
   "communication_channels.status.inactive": "Inactive",
-  "communication_channels.status.requiresReauth": "Needs reconnection"
+  "communication_channels.status.requiresReauth": "Needs reconnection",
+  "notifications.categories.communication_channels": "Communication"
 }

package/src/modules/communication_channels/i18n/es.json

@@ -125,6 +125,39 @@
   "communication_channels.profile.tableTitle": "Tus canales",
   "communication_channels.profile.title": "Mis canales de comunicación",
   "communication_channels.push.button.reregister": "Re-registrar push",
+  "communication_channels.push.connect.blocked": "Conexión bloqueada por la validación",
+  "communication_channels.push.connect.button.apns": "Conectar APNs",
+  "communication_channels.push.connect.button.expo": "Conectar Expo",
+  "communication_channels.push.connect.button.fcm": "Conectar FCM",
+  "communication_channels.push.connect.cancel": "Cancelar",
+  "communication_channels.push.connect.connected": "Proveedor push conectado.",
+  "communication_channels.push.connect.connecting": "Conectando…",
+  "communication_channels.push.connect.description": "Este es un canal compartido para todo el inquilino: atiende los dispositivos de todos los usuarios de este espacio.",
+  "communication_channels.push.connect.displayName": "Nombre visible",
+  "communication_channels.push.connect.errors.fields.invalid": "Este valor no es válido.",
+  "communication_channels.push.connect.errors.fields.invalid_bundle_id": "Un Bundle ID se parece a com.example.app.",
+  "communication_channels.push.connect.errors.fields.invalid_json": "Esto no es JSON válido. Pega el archivo de la cuenta de servicio tal y como lo generó Firebase.",
+  "communication_channels.push.connect.errors.fields.invalid_key_id": "Un Key ID de APNs tiene 10 caracteres alfanuméricos.",
+  "communication_channels.push.connect.errors.fields.invalid_p8": "Esta no es una clave de firma .p8 de APNs legible. Pega el archivo completo, incluidas las líneas BEGIN y END.",
+  "communication_channels.push.connect.errors.fields.invalid_team_id": "Un Team ID de Apple tiene 10 caracteres alfanuméricos.",
+  "communication_channels.push.connect.errors.fields.missing_fields": "Al JSON de la cuenta de servicio le faltan campos obligatorios (project_id, client_email, private_key).",
+  "communication_channels.push.connect.errors.fields.required": "Este campo es obligatorio.",
+  "communication_channels.push.connect.errors.mailbox_already_connected": "Este canal ya está conectado a través de otro proveedor. Desconéctalo allí antes de volver a conectarlo.",
+  "communication_channels.push.connect.errors.provider_not_tenant_scoped": "Este proveedor conecta canales por usuario; utiliza en su lugar el flujo de conexión de canal personal.",
+  "communication_channels.push.connect.errors.wrong_scope_for_route": "Ámbito de canal inesperado. Vuelve a intentarlo o contacta con soporte.",
+  "communication_channels.push.connect.failed": "No se pudo conectar el proveedor push.",
+  "communication_channels.push.connect.fields.apns.bundleId": "Bundle ID",
+  "communication_channels.push.connect.fields.apns.keyId": "Key ID",
+  "communication_channels.push.connect.fields.apns.p8Key": "Clave .p8 de APNs",
+  "communication_channels.push.connect.fields.apns.production": "Entorno de producción",
+  "communication_channels.push.connect.fields.apns.teamId": "Team ID",
+  "communication_channels.push.connect.fields.expo.accessToken": "Token de acceso (opcional)",
+  "communication_channels.push.connect.fields.fcm.appName": "Nombre de la app (opcional)",
+  "communication_channels.push.connect.fields.fcm.serviceAccountJson": "JSON de cuenta de servicio",
+  "communication_channels.push.connect.save": "Conectar",
+  "communication_channels.push.connect.title.apns": "Conectar Apple Push Notification service",
+  "communication_channels.push.connect.title.expo": "Conectar Expo Push",
+  "communication_channels.push.connect.title.fcm": "Conectar Firebase Cloud Messaging",
   "communication_channels.push.flash.registerFailed": "No se pudo registrar push",
   "communication_channels.push.status.active": "Push activo",
   "communication_channels.push.status.failed": "Push fallido — usando sondeo",
@@ -140,5 +173,6 @@
   "communication_channels.status.disconnected": "Desconectado",
   "communication_channels.status.error": "Error",
   "communication_channels.status.inactive": "Inactivo",
-  "communication_channels.status.requiresReauth": "Necesita volver a conectarse"
+  "communication_channels.status.requiresReauth": "Necesita volver a conectarse",
+  "notifications.categories.communication_channels": "Comunicación"
 }