@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/modules/integrations/lib/credentials-service.js

@@ -1,13 +1,16 @@
 import { decryptWithAesGcm, encryptWithAesGcm } from "@open-mercato/shared/lib/encryption/aes";
+import { resolveTenantEncryptionService } from "@open-mercato/shared/lib/encryption/customFieldValues";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { createKmsService, resolveEncryptionMode } from "@open-mercato/shared/lib/encryption/kms";
-import { parseDecryptedFieldValue } from "@open-mercato/shared/lib/encryption/tenantDataEncryptionService";
+import {
+  parseDecryptedFieldValue
+} from "@open-mercato/shared/lib/encryption/tenantDataEncryptionService";
 import {
   getBundle,
   getIntegration,
   resolveIntegrationCredentialsSchema
 } from "@open-mercato/shared/modules/integrations/types";
-import { EncryptionMap } from "../../entities/data/entities.js";
+import { upsertCanonicalEncryptionMap } from "../../entities/lib/encryption-maps.js";
 import { IntegrationCredentials } from "../data/entities.js";
 const ENCRYPTED_CREDENTIALS_BLOB_KEY = "__om_encrypted_credentials_blob_v1";
 const CREDENTIALS_ENCRYPTION_REMEDY = {
@@ -53,37 +56,26 @@ function buildCredentialsFilter(integrationId, scope) {
   }
   return base;
 }
-function createCredentialsService(em) {
+async function ensureCredentialsEncryptionMap(em, scope, encryptionService, options) {
   const credentialsEncryptionSpec = [{ field: "credentials" }];
-  async function ensureCredentialsEncryptionMap(scope) {
-    const existing = await findOneWithDecryption(
-      em,
-      EncryptionMap,
-      {
-        entityId: "integrations:integration_credentials",
-        tenantId: scope.tenantId,
-        organizationId: scope.organizationId,
-        deletedAt: null
-      },
-      void 0,
-      scope
-    );
-    if (!existing) {
-      const created = em.create(EncryptionMap, {
-        entityId: "integrations:integration_credentials",
-        tenantId: scope.tenantId,
-        organizationId: scope.organizationId,
-        fieldsJson: credentialsEncryptionSpec,
-        isActive: true,
-        createdAt: /* @__PURE__ */ new Date(),
-        updatedAt: /* @__PURE__ */ new Date()
-      });
-      em.persist(created);
-      return;
-    }
-    existing.fieldsJson = credentialsEncryptionSpec;
-    existing.isActive = true;
-  }
+  await upsertCanonicalEncryptionMap(em, {
+    entityId: "integrations:integration_credentials",
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    fields: credentialsEncryptionSpec,
+    isActive: true
+  });
+  const invalidator = encryptionService ?? resolveTenantEncryptionService(em);
+  if (!invalidator) return;
+  const invalidate = () => invalidator.invalidateMap(
+    "integrations:integration_credentials",
+    scope.tenantId,
+    scope.organizationId
+  );
+  if (options?.deferAfterCommit) options.deferAfterCommit(invalidate);
+  else await invalidate();
+}
+function createCredentialsService(em, encryptionService) {
   async function resolveCredentialsDek(scope) {
     const kms = createKmsService();
     if (resolveEncryptionMode(kms) === "disabled") return null;
@@ -174,9 +166,9 @@ function createCredentialsService(em) {
       if (!definition?.bundleId) return null;
       return this.getRaw(definition.bundleId, scope);
     },
-    async save(integrationId, credentials, scope) {
+    async save(integrationId, credentials, scope, options) {
       const encryptedCredentials = await encryptCredentialsBlob(credentials, scope);
-      await ensureCredentialsEncryptionMap(scope);
+      await ensureCredentialsEncryptionMap(em, scope, encryptionService, options);
       const row = await findOneWithDecryption(
         em,
         IntegrationCredentials,
@@ -198,10 +190,10 @@ function createCredentialsService(em) {
       });
       await em.persist(created).flush();
     },
-    async saveField(integrationId, fieldKey, value, scope) {
+    async saveField(integrationId, fieldKey, value, scope, options) {
       const current = await this.getRaw(integrationId, scope) ?? {};
       const updated = { ...current, [fieldKey]: value };
-      await this.save(integrationId, updated, scope);
+      await this.save(integrationId, updated, scope, options);
       return updated;
     },
     getSchema(integrationId) {
@@ -219,6 +211,7 @@ export {
   CredentialsEncryptionUnavailableError,
   buildCredentialsFilter,
   createCredentialsService,
+  ensureCredentialsEncryptionMap,
   isCredentialsEncryptionUnavailableError,
   isCredentialsSealedWhileDisabledError
 };

package/dist/modules/integrations/lib/credentials-service.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/integrations/lib/credentials-service.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { decryptWithAesGcm, encryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createKmsService, resolveEncryptionMode } from '@open-mercato/shared/lib/encryption/kms'\nimport { parseDecryptedFieldValue } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport {\n  getBundle,\n  getIntegration,\n  resolveIntegrationCredentialsSchema,\n  type IntegrationScope,\n} from '@open-mercato/shared/modules/integrations/types'\nimport { EncryptionMap } from '../../entities/data/entities'\nimport { IntegrationCredentials } from '../data/entities'\n\nconst ENCRYPTED_CREDENTIALS_BLOB_KEY = '__om_encrypted_credentials_blob_v1'\n\n/**\n * Raised when integration credentials cannot be encrypted or decrypted because\n * no tenant DEK is available \u2014 typically a production deployment with neither\n * Vault nor `TENANT_DATA_ENCRYPTION_FALLBACK_KEY` (or equivalent env vars)\n * configured. The credentials path deliberately fails closed instead of using\n * a hardcoded fallback secret; see security tracker finding #7.\n */\nexport type CredentialsEncryptionUnavailableReason = 'no-dek' | 'sealed-while-disabled'\n\nconst CREDENTIALS_ENCRYPTION_REMEDY: Record<CredentialsEncryptionUnavailableReason, string> = {\n  'no-dek':\n    'no tenant DEK is available. Configure Vault (VAULT_ADDR/VAULT_TOKEN) or ' +\n    'set TENANT_DATA_ENCRYPTION_FALLBACK_KEY in the environment.',\n  'sealed-while-disabled':\n    'they were sealed while TENANT_DATA_ENCRYPTION was on and it is now off, so no key can open ' +\n    'them. Re-enable TENANT_DATA_ENCRYPTION to read them again, or re-enter the credentials \u2014 ' +\n    'saving them while the toggle is off stores them in the clear. Note that ' +\n    '`mercato entities decrypt-database` does not reach this blob: it decrypts the columns an ' +\n    'encryption map covers, and this envelope sits inside the decrypted value.',\n}\n\nexport class CredentialsEncryptionUnavailableError extends Error {\n  readonly code = 'CREDENTIALS_ENCRYPTION_UNAVAILABLE'\n  readonly reason: CredentialsEncryptionUnavailableReason\n  constructor(tenantId: string, reason: CredentialsEncryptionUnavailableReason = 'no-dek') {\n    super(\n      `Cannot encrypt or decrypt integration credentials for tenant ${tenantId}: ` +\n        CREDENTIALS_ENCRYPTION_REMEDY[reason],\n    )\n    this.name = 'CredentialsEncryptionUnavailableError'\n    this.reason = reason\n  }\n}\n\nexport function isCredentialsEncryptionUnavailableError(error: unknown): error is CredentialsEncryptionUnavailableError {\n  return error instanceof CredentialsEncryptionUnavailableError\n}\n\n/**\n * The one unavailable-reason an operator can act on without restoring a key: the blob predates\n * `TENANT_DATA_ENCRYPTION=no` and no key exists to open it, so re-entering the credentials is the\n * only way forward. The admin credentials route degrades to an empty form on this so that the\n * re-entry is possible at all; `no-dek` (encryption on, KMS unreachable) still fails closed.\n */\nexport function isCredentialsSealedWhileDisabledError(error: unknown): boolean {\n  return isCredentialsEncryptionUnavailableError(error) && error.reason === 'sealed-while-disabled'\n}\n\nfunction isRecordValue(value: unknown): value is Record<string, unknown> {\n  return !!value && typeof value === 'object' && !Array.isArray(value)\n}\n\nfunction normalizeCredentialsRecord(value: unknown): Record<string, unknown> {\n  if (isRecordValue(value)) return value\n  if (typeof value !== 'string') return {}\n\n  const parsed = parseDecryptedFieldValue(value)\n  return isRecordValue(parsed) ? parsed : {}\n}\n\n/**\n * Build the where-filter for credential lookups.\n *\n * Per-user scoping (added 2026-05-26): when `scope.userId` is set, the filter\n * matches the row owned by that user \u2014 different users on the same tenant get\n * their OWN row for the same provider. When `scope.userId` is `undefined` /\n * `null`, the filter matches tenant-wide credentials (existing behaviour,\n * e.g. shared Stripe/Akeneo API keys).\n *\n * The partial unique index `integration_credentials_user_lookup_idx` enforces\n * uniqueness across `(integration_id, organization_id, tenant_id, user_id)`\n * when `user_id IS NOT NULL`.\n */\nexport function buildCredentialsFilter(integrationId: string, scope: IntegrationScope) {\n  const base = {\n    integrationId,\n    organizationId: scope.organizationId,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  } as Record<string, unknown>\n  if (scope.userId) {\n    base.userId = scope.userId\n  } else {\n    base.userId = null\n  }\n  return base\n}\n\nexport function createCredentialsService(em: EntityManager) {\n  const credentialsEncryptionSpec = [{ field: 'credentials' }]\n\n  async function ensureCredentialsEncryptionMap(scope: IntegrationScope): Promise<void> {\n    const existing = await findOneWithDecryption(\n      em,\n      EncryptionMap,\n      {\n        entityId: 'integrations:integration_credentials',\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        deletedAt: null,\n      },\n      undefined,\n      scope,\n    )\n\n    if (!existing) {\n      const created = em.create(EncryptionMap, {\n        entityId: 'integrations:integration_credentials',\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        fieldsJson: credentialsEncryptionSpec,\n        isActive: true,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      em.persist(created)\n      return\n    }\n\n    existing.fieldsJson = credentialsEncryptionSpec\n    existing.isActive = true\n  }\n\n  /**\n   * Resolve the DEK this tenant's credentials blob is sealed with, or `null` when the operator\n   * has switched tenant data encryption off.\n   *\n   * The `null` is the whole point of going through {@link resolveEncryptionMode} rather than\n   * asking the KMS directly. Under `TENANT_DATA_ENCRYPTION=no` the KMS is a noop and hands back\n   * nothing, which is indistinguishable \u2014 to `getTenantDek` alone \u2014 from Vault being down. Those\n   * two need opposite answers: an operator who turned encryption off expects plaintext, whereas a\n   * Vault outage must not silently downgrade a secret that is supposed to be sealed. So only\n   * `unavailable` throws.\n   */\n  async function resolveCredentialsDek(scope: IntegrationScope): Promise<string | null> {\n    const kms = createKmsService()\n    if (resolveEncryptionMode(kms) === 'disabled') return null\n\n    const existing = await kms.getTenantDek(scope.tenantId)\n    if (existing?.key) return existing.key\n\n    const created = await kms.createTenantDek(scope.tenantId)\n    if (created?.key) return created.key\n\n    throw new CredentialsEncryptionUnavailableError(scope.tenantId)\n  }\n\n  async function encryptCredentialsBlob(\n    credentials: Record<string, unknown>,\n    scope: IntegrationScope,\n  ): Promise<Record<string, unknown>> {\n    const dek = await resolveCredentialsDek(scope)\n    if (!dek) return credentials\n    const payload = encryptWithAesGcm(JSON.stringify(credentials), dek)\n    return { [ENCRYPTED_CREDENTIALS_BLOB_KEY]: payload.value }\n  }\n\n  async function decryptCredentialsBlob(\n    credentialsInput: unknown,\n    scope: IntegrationScope,\n  ): Promise<Record<string, unknown>> {\n    const credentials = normalizeCredentialsRecord(credentialsInput)\n    const encrypted = credentials[ENCRYPTED_CREDENTIALS_BLOB_KEY]\n    if (typeof encrypted !== 'string' || !encrypted) return credentials\n\n    // A sealed blob written before encryption was switched off. There is no key to open it with,\n    // and returning the envelope as if it were the credentials would hand an adapter a garbage\n    // secret, so this stays an error even in `disabled` mode rather than a silent empty credential\n    // set. The remedy is re-entering the credentials (see the reason's message); the admin route\n    // catches this specific reason so the form can load empty and accept them.\n    const dek = await resolveCredentialsDek(scope)\n    if (!dek) throw new CredentialsEncryptionUnavailableError(scope.tenantId, 'sealed-while-disabled')\n\n    const decryptedRaw = decryptWithAesGcm(encrypted, dek)\n    if (!decryptedRaw) return {}\n\n    try {\n      const parsed = JSON.parse(decryptedRaw) as unknown\n      return parsed && typeof parsed === 'object' && !Array.isArray(parsed)\n        ? (parsed as Record<string, unknown>)\n        : {}\n    } catch {\n      return {}\n    }\n  }\n\n  return {\n    async getRaw(integrationId: string, scope: IntegrationScope): Promise<Record<string, unknown> | null> {\n      let row = await findOneWithDecryption(\n        em,\n        IntegrationCredentials,\n        buildCredentialsFilter(integrationId, scope),\n        undefined,\n        scope,\n      )\n      // Spec 2026-05-21 (email-integration-foundation) \"Hub credentials store\":\n      // per-user secrets resolve as `WHERE user_id = currentUser.id OR user_id IS NULL`.\n      // A user-scoped read of a TENANT-WIDE integration (sync_excel, Stripe, Akeneo,\n      // S3, the channel OAuth *client* config) MUST still find the shared\n      // `user_id = NULL` row \u2014 the per-user row takes precedence, and we only fall\n      // back to the tenant-wide row when the user has none of their own. Writes stay\n      // strict (`save` uses the unmodified filter) so a per-user save never clobbers\n      // the shared credential.\n      if (!row && scope.userId) {\n        row = await findOneWithDecryption(\n          em,\n          IntegrationCredentials,\n          buildCredentialsFilter(integrationId, { ...scope, userId: null }),\n          undefined,\n          scope,\n        )\n      }\n      if (!row) return null\n      return decryptCredentialsBlob(row.credentials, scope)\n    },\n\n    async getRowUpdatedAt(integrationId: string, scope: IntegrationScope): Promise<Date | null> {\n      let row = await findOneWithDecryption(\n        em,\n        IntegrationCredentials,\n        buildCredentialsFilter(integrationId, scope),\n        undefined,\n        scope,\n      )\n      if (!row && scope.userId) {\n        row = await findOneWithDecryption(\n          em,\n          IntegrationCredentials,\n          buildCredentialsFilter(integrationId, { ...scope, userId: null }),\n          undefined,\n          scope,\n        )\n      }\n      return row?.updatedAt ?? null\n    },\n\n    /**\n     * Resolve the persisted `updated_at` version for the credentials a caller\n     * would read via {@link resolve} (direct row first, then the bundle\n     * fallthrough). Returns `null` when no credentials row exists yet \u2014 the\n     * optimistic-lock guard treats a missing current version as \"no conflict\".\n     */\n    async resolveUpdatedAt(integrationId: string, scope: IntegrationScope): Promise<Date | null> {\n      const direct = await this.getRowUpdatedAt(integrationId, scope)\n      if (direct) return direct\n\n      const definition = getIntegration(integrationId)\n      if (!definition?.bundleId) return null\n      return this.getRowUpdatedAt(definition.bundleId, scope)\n    },\n\n    async resolve(integrationId: string, scope: IntegrationScope): Promise<Record<string, unknown> | null> {\n      const direct = await this.getRaw(integrationId, scope)\n      if (direct) return direct\n\n      const definition = getIntegration(integrationId)\n      if (!definition?.bundleId) return null\n      return this.getRaw(definition.bundleId, scope)\n    },\n\n    async save(integrationId: string, credentials: Record<string, unknown>, scope: IntegrationScope): Promise<void> {\n      const encryptedCredentials = await encryptCredentialsBlob(credentials, scope)\n      await ensureCredentialsEncryptionMap(scope)\n\n      const row = await findOneWithDecryption(\n        em,\n        IntegrationCredentials,\n        buildCredentialsFilter(integrationId, scope),\n        undefined,\n        scope,\n      )\n\n      if (row) {\n        row.credentials = encryptedCredentials\n        await em.flush()\n        return\n      }\n\n      const created = em.create(IntegrationCredentials, {\n        integrationId,\n        credentials: encryptedCredentials,\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n        ...(scope.userId ? { userId: scope.userId } : {}),\n      })\n      await em.persist(created).flush()\n    },\n\n    async saveField(\n      integrationId: string,\n      fieldKey: string,\n      value: unknown,\n      scope: IntegrationScope,\n    ): Promise<Record<string, unknown>> {\n      const current = (await this.getRaw(integrationId, scope)) ?? {}\n      const updated = { ...current, [fieldKey]: value }\n      await this.save(integrationId, updated, scope)\n      return updated\n    },\n\n    getSchema(integrationId: string) {\n      const definition = getIntegration(integrationId)\n      if (!definition) return undefined\n\n      if (definition.bundleId) {\n        const bundle = getBundle(definition.bundleId)\n        return bundle?.credentials ?? resolveIntegrationCredentialsSchema(integrationId)\n      }\n\n      return definition.credentials ?? resolveIntegrationCredentialsSchema(integrationId)\n    },\n  }\n}\n\nexport type CredentialsService = ReturnType<typeof createCredentialsService>\n"],
-  "mappings": "AACA,SAAS,mBAAmB,yBAAyB;AACrD,SAAS,6BAA6B;AACtC,SAAS,kBAAkB,6BAA6B;AACxD,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,qBAAqB;AAC9B,SAAS,8BAA8B;AAEvC,MAAM,iCAAiC;AAWvC,MAAM,gCAAwF;AAAA,EAC5F,UACE;AAAA,EAEF,yBACE;AAKJ;AAEO,MAAM,8CAA8C,MAAM;AAAA,EAG/D,YAAY,UAAkB,SAAiD,UAAU;AACvF;AAAA,MACE,gEAAgE,QAAQ,OACtE,8BAA8B,MAAM;AAAA,IACxC;AANF,SAAS,OAAO;AAOd,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAEO,SAAS,wCAAwC,OAAgE;AACtH,SAAO,iBAAiB;AAC1B;AAQO,SAAS,sCAAsC,OAAyB;AAC7E,SAAO,wCAAwC,KAAK,KAAK,MAAM,WAAW;AAC5E;AAEA,SAAS,cAAc,OAAkD;AACvE,SAAO,CAAC,CAAC,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AACrE;AAEA,SAAS,2BAA2B,OAAyC;AAC3E,MAAI,cAAc,KAAK,EAAG,QAAO;AACjC,MAAI,OAAO,UAAU,SAAU,QAAO,CAAC;AAEvC,QAAM,SAAS,yBAAyB,KAAK;AAC7C,SAAO,cAAc,MAAM,IAAI,SAAS,CAAC;AAC3C;AAeO,SAAS,uBAAuB,eAAuB,OAAyB;AACrF,QAAM,OAAO;AAAA,IACX;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb;AACA,MAAI,MAAM,QAAQ;AAChB,SAAK,SAAS,MAAM;AAAA,EACtB,OAAO;AACL,SAAK,SAAS;AAAA,EAChB;AACA,SAAO;AACT;AAEO,SAAS,yBAAyB,IAAmB;AAC1D,QAAM,4BAA4B,CAAC,EAAE,OAAO,cAAc,CAAC;AAE3D,iBAAe,+BAA+B,OAAwC;AACpF,UAAM,WAAW,MAAM;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,QACE,UAAU;AAAA,QACV,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,UAAU;AACb,YAAM,UAAU,GAAG,OAAO,eAAe;AAAA,QACvC,UAAU;AAAA,QACV,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,SAAG,QAAQ,OAAO;AAClB;AAAA,IACF;AAEA,aAAS,aAAa;AACtB,aAAS,WAAW;AAAA,EACtB;AAaA,iBAAe,sBAAsB,OAAiD;AACpF,UAAM,MAAM,iBAAiB;AAC7B,QAAI,sBAAsB,GAAG,MAAM,WAAY,QAAO;AAEtD,UAAM,WAAW,MAAM,IAAI,aAAa,MAAM,QAAQ;AACtD,QAAI,UAAU,IAAK,QAAO,SAAS;AAEnC,UAAM,UAAU,MAAM,IAAI,gBAAgB,MAAM,QAAQ;AACxD,QAAI,SAAS,IAAK,QAAO,QAAQ;AAEjC,UAAM,IAAI,sCAAsC,MAAM,QAAQ;AAAA,EAChE;AAEA,iBAAe,uBACb,aACA,OACkC;AAClC,UAAM,MAAM,MAAM,sBAAsB,KAAK;AAC7C,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,UAAU,kBAAkB,KAAK,UAAU,WAAW,GAAG,GAAG;AAClE,WAAO,EAAE,CAAC,8BAA8B,GAAG,QAAQ,MAAM;AAAA,EAC3D;AAEA,iBAAe,uBACb,kBACA,OACkC;AAClC,UAAM,cAAc,2BAA2B,gBAAgB;AAC/D,UAAM,YAAY,YAAY,8BAA8B;AAC5D,QAAI,OAAO,cAAc,YAAY,CAAC,UAAW,QAAO;AAOxD,UAAM,MAAM,MAAM,sBAAsB,KAAK;AAC7C,QAAI,CAAC,IAAK,OAAM,IAAI,sCAAsC,MAAM,UAAU,uBAAuB;AAEjG,UAAM,eAAe,kBAAkB,WAAW,GAAG;AACrD,QAAI,CAAC,aAAc,QAAO,CAAC;AAE3B,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,YAAY;AACtC,aAAO,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,IAC/D,SACD,CAAC;AAAA,IACP,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,OAAO,eAAuB,OAAkE;AACpG,UAAI,MAAM,MAAM;AAAA,QACd;AAAA,QACA;AAAA,QACA,uBAAuB,eAAe,KAAK;AAAA,QAC3C;AAAA,QACA;AAAA,MACF;AASA,UAAI,CAAC,OAAO,MAAM,QAAQ;AACxB,cAAM,MAAM;AAAA,UACV;AAAA,UACA;AAAA,UACA,uBAAuB,eAAe,EAAE,GAAG,OAAO,QAAQ,KAAK,CAAC;AAAA,UAChE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,CAAC,IAAK,QAAO;AACjB,aAAO,uBAAuB,IAAI,aAAa,KAAK;AAAA,IACtD;AAAA,IAEA,MAAM,gBAAgB,eAAuB,OAA+C;AAC1F,UAAI,MAAM,MAAM;AAAA,QACd;AAAA,QACA;AAAA,QACA,uBAAuB,eAAe,KAAK;AAAA,QAC3C;AAAA,QACA;AAAA,MACF;AACA,UAAI,CAAC,OAAO,MAAM,QAAQ;AACxB,cAAM,MAAM;AAAA,UACV;AAAA,UACA;AAAA,UACA,uBAAuB,eAAe,EAAE,GAAG,OAAO,QAAQ,KAAK,CAAC;AAAA,UAChE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO,KAAK,aAAa;AAAA,IAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,MAAM,iBAAiB,eAAuB,OAA+C;AAC3F,YAAM,SAAS,MAAM,KAAK,gBAAgB,eAAe,KAAK;AAC9D,UAAI,OAAQ,QAAO;AAEnB,YAAM,aAAa,eAAe,aAAa;AAC/C,UAAI,CAAC,YAAY,SAAU,QAAO;AAClC,aAAO,KAAK,gBAAgB,WAAW,UAAU,KAAK;AAAA,IACxD;AAAA,IAEA,MAAM,QAAQ,eAAuB,OAAkE;AACrG,YAAM,SAAS,MAAM,KAAK,OAAO,eAAe,KAAK;AACrD,UAAI,OAAQ,QAAO;AAEnB,YAAM,aAAa,eAAe,aAAa;AAC/C,UAAI,CAAC,YAAY,SAAU,QAAO;AAClC,aAAO,KAAK,OAAO,WAAW,UAAU,KAAK;AAAA,IAC/C;AAAA,IAEA,MAAM,KAAK,eAAuB,aAAsC,OAAwC;AAC9G,YAAM,uBAAuB,MAAM,uBAAuB,aAAa,KAAK;AAC5E,YAAM,+BAA+B,KAAK;AAE1C,YAAM,MAAM,MAAM;AAAA,QAChB;AAAA,QACA;AAAA,QACA,uBAAuB,eAAe,KAAK;AAAA,QAC3C;AAAA,QACA;AAAA,MACF;AAEA,UAAI,KAAK;AACP,YAAI,cAAc;AAClB,cAAM,GAAG,MAAM;AACf;AAAA,MACF;AAEA,YAAM,UAAU,GAAG,OAAO,wBAAwB;AAAA,QAChD;AAAA,QACA,aAAa;AAAA,QACb,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,MACjD,CAAC;AACD,YAAM,GAAG,QAAQ,OAAO,EAAE,MAAM;AAAA,IAClC;AAAA,IAEA,MAAM,UACJ,eACA,UACA,OACA,OACkC;AAClC,YAAM,UAAW,MAAM,KAAK,OAAO,eAAe,KAAK,KAAM,CAAC;AAC9D,YAAM,UAAU,EAAE,GAAG,SAAS,CAAC,QAAQ,GAAG,MAAM;AAChD,YAAM,KAAK,KAAK,eAAe,SAAS,KAAK;AAC7C,aAAO;AAAA,IACT;AAAA,IAEA,UAAU,eAAuB;AAC/B,YAAM,aAAa,eAAe,aAAa;AAC/C,UAAI,CAAC,WAAY,QAAO;AAExB,UAAI,WAAW,UAAU;AACvB,cAAM,SAAS,UAAU,WAAW,QAAQ;AAC5C,eAAO,QAAQ,eAAe,oCAAoC,aAAa;AAAA,MACjF;AAEA,aAAO,WAAW,eAAe,oCAAoC,aAAa;AAAA,IACpF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { decryptWithAesGcm, encryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'\nimport { resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createKmsService, resolveEncryptionMode } from '@open-mercato/shared/lib/encryption/kms'\nimport {\n  parseDecryptedFieldValue,\n  type TenantDataEncryptionService,\n} from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport {\n  getBundle,\n  getIntegration,\n  resolveIntegrationCredentialsSchema,\n  type IntegrationScope,\n} from '@open-mercato/shared/modules/integrations/types'\nimport { upsertCanonicalEncryptionMap } from '../../entities/lib/encryption-maps'\nimport { IntegrationCredentials } from '../data/entities'\n\nconst ENCRYPTED_CREDENTIALS_BLOB_KEY = '__om_encrypted_credentials_blob_v1'\n\n/**\n * Raised when integration credentials cannot be encrypted or decrypted because\n * no tenant DEK is available \u2014 typically a production deployment with neither\n * Vault nor `TENANT_DATA_ENCRYPTION_FALLBACK_KEY` (or equivalent env vars)\n * configured. The credentials path deliberately fails closed instead of using\n * a hardcoded fallback secret; see security tracker finding #7.\n */\nexport type CredentialsEncryptionUnavailableReason = 'no-dek' | 'sealed-while-disabled'\n\nconst CREDENTIALS_ENCRYPTION_REMEDY: Record<CredentialsEncryptionUnavailableReason, string> = {\n  'no-dek':\n    'no tenant DEK is available. Configure Vault (VAULT_ADDR/VAULT_TOKEN) or ' +\n    'set TENANT_DATA_ENCRYPTION_FALLBACK_KEY in the environment.',\n  'sealed-while-disabled':\n    'they were sealed while TENANT_DATA_ENCRYPTION was on and it is now off, so no key can open ' +\n    'them. Re-enable TENANT_DATA_ENCRYPTION to read them again, or re-enter the credentials \u2014 ' +\n    'saving them while the toggle is off stores them in the clear. Note that ' +\n    '`mercato entities decrypt-database` does not reach this blob: it decrypts the columns an ' +\n    'encryption map covers, and this envelope sits inside the decrypted value.',\n}\n\nexport class CredentialsEncryptionUnavailableError extends Error {\n  readonly code = 'CREDENTIALS_ENCRYPTION_UNAVAILABLE'\n  readonly reason: CredentialsEncryptionUnavailableReason\n  constructor(tenantId: string, reason: CredentialsEncryptionUnavailableReason = 'no-dek') {\n    super(\n      `Cannot encrypt or decrypt integration credentials for tenant ${tenantId}: ` +\n        CREDENTIALS_ENCRYPTION_REMEDY[reason],\n    )\n    this.name = 'CredentialsEncryptionUnavailableError'\n    this.reason = reason\n  }\n}\n\nexport function isCredentialsEncryptionUnavailableError(error: unknown): error is CredentialsEncryptionUnavailableError {\n  return error instanceof CredentialsEncryptionUnavailableError\n}\n\n/**\n * The one unavailable-reason an operator can act on without restoring a key: the blob predates\n * `TENANT_DATA_ENCRYPTION=no` and no key exists to open it, so re-entering the credentials is the\n * only way forward. The admin credentials route degrades to an empty form on this so that the\n * re-entry is possible at all; `no-dek` (encryption on, KMS unreachable) still fails closed.\n */\nexport function isCredentialsSealedWhileDisabledError(error: unknown): boolean {\n  return isCredentialsEncryptionUnavailableError(error) && error.reason === 'sealed-while-disabled'\n}\n\nfunction isRecordValue(value: unknown): value is Record<string, unknown> {\n  return !!value && typeof value === 'object' && !Array.isArray(value)\n}\n\nfunction normalizeCredentialsRecord(value: unknown): Record<string, unknown> {\n  if (isRecordValue(value)) return value\n  if (typeof value !== 'string') return {}\n\n  const parsed = parseDecryptedFieldValue(value)\n  return isRecordValue(parsed) ? parsed : {}\n}\n\n/**\n * Build the where-filter for credential lookups.\n *\n * Per-user scoping (added 2026-05-26): when `scope.userId` is set, the filter\n * matches the row owned by that user \u2014 different users on the same tenant get\n * their OWN row for the same provider. When `scope.userId` is `undefined` /\n * `null`, the filter matches tenant-wide credentials (existing behaviour,\n * e.g. shared Stripe/Akeneo API keys).\n *\n * The partial unique index `integration_credentials_user_lookup_idx` enforces\n * uniqueness across `(integration_id, organization_id, tenant_id, user_id)`\n * when `user_id IS NOT NULL`.\n */\nexport function buildCredentialsFilter(integrationId: string, scope: IntegrationScope) {\n  const base = {\n    integrationId,\n    organizationId: scope.organizationId,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  } as Record<string, unknown>\n  if (scope.userId) {\n    base.userId = scope.userId\n  } else {\n    base.userId = null\n  }\n  return base\n}\n\ntype EncryptionMapCacheInvalidator = Pick<TenantDataEncryptionService, 'invalidateMap'>\n\nexport type CredentialsWriteOptions = {\n  deferAfterCommit?: (callback: () => void | Promise<void>) => void\n}\n\nexport async function ensureCredentialsEncryptionMap(\n  em: EntityManager,\n  scope: IntegrationScope,\n  encryptionService?: EncryptionMapCacheInvalidator | null,\n  options?: CredentialsWriteOptions,\n): Promise<void> {\n  const credentialsEncryptionSpec = [{ field: 'credentials' }]\n  await upsertCanonicalEncryptionMap(em, {\n    entityId: 'integrations:integration_credentials',\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    fields: credentialsEncryptionSpec,\n    isActive: true,\n  })\n  const invalidator = encryptionService ?? resolveTenantEncryptionService(em)\n  if (!invalidator) return\n  const invalidate = () => invalidator.invalidateMap(\n    'integrations:integration_credentials', scope.tenantId, scope.organizationId,\n  )\n  if (options?.deferAfterCommit) options.deferAfterCommit(invalidate)\n  else await invalidate()\n}\n\nexport function createCredentialsService(\n  em: EntityManager,\n  encryptionService?: EncryptionMapCacheInvalidator | null,\n) {\n\n  /**\n   * Resolve the DEK this tenant's credentials blob is sealed with, or `null` when the operator\n   * has switched tenant data encryption off.\n   *\n   * The `null` is the whole point of going through {@link resolveEncryptionMode} rather than\n   * asking the KMS directly. Under `TENANT_DATA_ENCRYPTION=no` the KMS is a noop and hands back\n   * nothing, which is indistinguishable \u2014 to `getTenantDek` alone \u2014 from Vault being down. Those\n   * two need opposite answers: an operator who turned encryption off expects plaintext, whereas a\n   * Vault outage must not silently downgrade a secret that is supposed to be sealed. So only\n   * `unavailable` throws.\n   */\n  async function resolveCredentialsDek(scope: IntegrationScope): Promise<string | null> {\n    const kms = createKmsService()\n    if (resolveEncryptionMode(kms) === 'disabled') return null\n\n    const existing = await kms.getTenantDek(scope.tenantId)\n    if (existing?.key) return existing.key\n\n    const created = await kms.createTenantDek(scope.tenantId)\n    if (created?.key) return created.key\n\n    throw new CredentialsEncryptionUnavailableError(scope.tenantId)\n  }\n\n  async function encryptCredentialsBlob(\n    credentials: Record<string, unknown>,\n    scope: IntegrationScope,\n  ): Promise<Record<string, unknown>> {\n    const dek = await resolveCredentialsDek(scope)\n    if (!dek) return credentials\n    const payload = encryptWithAesGcm(JSON.stringify(credentials), dek)\n    return { [ENCRYPTED_CREDENTIALS_BLOB_KEY]: payload.value }\n  }\n\n  async function decryptCredentialsBlob(\n    credentialsInput: unknown,\n    scope: IntegrationScope,\n  ): Promise<Record<string, unknown>> {\n    const credentials = normalizeCredentialsRecord(credentialsInput)\n    const encrypted = credentials[ENCRYPTED_CREDENTIALS_BLOB_KEY]\n    if (typeof encrypted !== 'string' || !encrypted) return credentials\n\n    // A sealed blob written before encryption was switched off. There is no key to open it with,\n    // and returning the envelope as if it were the credentials would hand an adapter a garbage\n    // secret, so this stays an error even in `disabled` mode rather than a silent empty credential\n    // set. The remedy is re-entering the credentials (see the reason's message); the admin route\n    // catches this specific reason so the form can load empty and accept them.\n    const dek = await resolveCredentialsDek(scope)\n    if (!dek) throw new CredentialsEncryptionUnavailableError(scope.tenantId, 'sealed-while-disabled')\n\n    const decryptedRaw = decryptWithAesGcm(encrypted, dek)\n    if (!decryptedRaw) return {}\n\n    try {\n      const parsed = JSON.parse(decryptedRaw) as unknown\n      return parsed && typeof parsed === 'object' && !Array.isArray(parsed)\n        ? (parsed as Record<string, unknown>)\n        : {}\n    } catch {\n      return {}\n    }\n  }\n\n  return {\n    async getRaw(integrationId: string, scope: IntegrationScope): Promise<Record<string, unknown> | null> {\n      let row = await findOneWithDecryption(\n        em,\n        IntegrationCredentials,\n        buildCredentialsFilter(integrationId, scope),\n        undefined,\n        scope,\n      )\n      // Spec 2026-05-21 (email-integration-foundation) \"Hub credentials store\":\n      // per-user secrets resolve as `WHERE user_id = currentUser.id OR user_id IS NULL`.\n      // A user-scoped read of a TENANT-WIDE integration (sync_excel, Stripe, Akeneo,\n      // S3, the channel OAuth *client* config) MUST still find the shared\n      // `user_id = NULL` row \u2014 the per-user row takes precedence, and we only fall\n      // back to the tenant-wide row when the user has none of their own. Writes stay\n      // strict (`save` uses the unmodified filter) so a per-user save never clobbers\n      // the shared credential.\n      if (!row && scope.userId) {\n        row = await findOneWithDecryption(\n          em,\n          IntegrationCredentials,\n          buildCredentialsFilter(integrationId, { ...scope, userId: null }),\n          undefined,\n          scope,\n        )\n      }\n      if (!row) return null\n      return decryptCredentialsBlob(row.credentials, scope)\n    },\n\n    async getRowUpdatedAt(integrationId: string, scope: IntegrationScope): Promise<Date | null> {\n      let row = await findOneWithDecryption(\n        em,\n        IntegrationCredentials,\n        buildCredentialsFilter(integrationId, scope),\n        undefined,\n        scope,\n      )\n      if (!row && scope.userId) {\n        row = await findOneWithDecryption(\n          em,\n          IntegrationCredentials,\n          buildCredentialsFilter(integrationId, { ...scope, userId: null }),\n          undefined,\n          scope,\n        )\n      }\n      return row?.updatedAt ?? null\n    },\n\n    /**\n     * Resolve the persisted `updated_at` version for the credentials a caller\n     * would read via {@link resolve} (direct row first, then the bundle\n     * fallthrough). Returns `null` when no credentials row exists yet \u2014 the\n     * optimistic-lock guard treats a missing current version as \"no conflict\".\n     */\n    async resolveUpdatedAt(integrationId: string, scope: IntegrationScope): Promise<Date | null> {\n      const direct = await this.getRowUpdatedAt(integrationId, scope)\n      if (direct) return direct\n\n      const definition = getIntegration(integrationId)\n      if (!definition?.bundleId) return null\n      return this.getRowUpdatedAt(definition.bundleId, scope)\n    },\n\n    async resolve(integrationId: string, scope: IntegrationScope): Promise<Record<string, unknown> | null> {\n      const direct = await this.getRaw(integrationId, scope)\n      if (direct) return direct\n\n      const definition = getIntegration(integrationId)\n      if (!definition?.bundleId) return null\n      return this.getRaw(definition.bundleId, scope)\n    },\n\n    async save(\n      integrationId: string,\n      credentials: Record<string, unknown>,\n      scope: IntegrationScope,\n      options?: CredentialsWriteOptions,\n    ): Promise<void> {\n      const encryptedCredentials = await encryptCredentialsBlob(credentials, scope)\n      await ensureCredentialsEncryptionMap(em, scope, encryptionService, options)\n\n      const row = await findOneWithDecryption(\n        em,\n        IntegrationCredentials,\n        buildCredentialsFilter(integrationId, scope),\n        undefined,\n        scope,\n      )\n\n      if (row) {\n        row.credentials = encryptedCredentials\n        await em.flush()\n        return\n      }\n\n      const created = em.create(IntegrationCredentials, {\n        integrationId,\n        credentials: encryptedCredentials,\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n        ...(scope.userId ? { userId: scope.userId } : {}),\n      })\n      await em.persist(created).flush()\n    },\n\n    async saveField(\n      integrationId: string,\n      fieldKey: string,\n      value: unknown,\n      scope: IntegrationScope,\n      options?: CredentialsWriteOptions,\n    ): Promise<Record<string, unknown>> {\n      const current = (await this.getRaw(integrationId, scope)) ?? {}\n      const updated = { ...current, [fieldKey]: value }\n      await this.save(integrationId, updated, scope, options)\n      return updated\n    },\n\n    getSchema(integrationId: string) {\n      const definition = getIntegration(integrationId)\n      if (!definition) return undefined\n\n      if (definition.bundleId) {\n        const bundle = getBundle(definition.bundleId)\n        return bundle?.credentials ?? resolveIntegrationCredentialsSchema(integrationId)\n      }\n\n      return definition.credentials ?? resolveIntegrationCredentialsSchema(integrationId)\n    },\n  }\n}\n\nexport type CredentialsService = ReturnType<typeof createCredentialsService>\n"],
+  "mappings": "AACA,SAAS,mBAAmB,yBAAyB;AACrD,SAAS,sCAAsC;AAC/C,SAAS,6BAA6B;AACtC,SAAS,kBAAkB,6BAA6B;AACxD;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,oCAAoC;AAC7C,SAAS,8BAA8B;AAEvC,MAAM,iCAAiC;AAWvC,MAAM,gCAAwF;AAAA,EAC5F,UACE;AAAA,EAEF,yBACE;AAKJ;AAEO,MAAM,8CAA8C,MAAM;AAAA,EAG/D,YAAY,UAAkB,SAAiD,UAAU;AACvF;AAAA,MACE,gEAAgE,QAAQ,OACtE,8BAA8B,MAAM;AAAA,IACxC;AANF,SAAS,OAAO;AAOd,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAEO,SAAS,wCAAwC,OAAgE;AACtH,SAAO,iBAAiB;AAC1B;AAQO,SAAS,sCAAsC,OAAyB;AAC7E,SAAO,wCAAwC,KAAK,KAAK,MAAM,WAAW;AAC5E;AAEA,SAAS,cAAc,OAAkD;AACvE,SAAO,CAAC,CAAC,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AACrE;AAEA,SAAS,2BAA2B,OAAyC;AAC3E,MAAI,cAAc,KAAK,EAAG,QAAO;AACjC,MAAI,OAAO,UAAU,SAAU,QAAO,CAAC;AAEvC,QAAM,SAAS,yBAAyB,KAAK;AAC7C,SAAO,cAAc,MAAM,IAAI,SAAS,CAAC;AAC3C;AAeO,SAAS,uBAAuB,eAAuB,OAAyB;AACrF,QAAM,OAAO;AAAA,IACX;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb;AACA,MAAI,MAAM,QAAQ;AAChB,SAAK,SAAS,MAAM;AAAA,EACtB,OAAO;AACL,SAAK,SAAS;AAAA,EAChB;AACA,SAAO;AACT;AAQA,eAAsB,+BACpB,IACA,OACA,mBACA,SACe;AACf,QAAM,4BAA4B,CAAC,EAAE,OAAO,cAAc,CAAC;AAC3D,QAAM,6BAA6B,IAAI;AAAA,IACrC,UAAU;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ,CAAC;AACD,QAAM,cAAc,qBAAqB,+BAA+B,EAAE;AAC1E,MAAI,CAAC,YAAa;AAClB,QAAM,aAAa,MAAM,YAAY;AAAA,IACnC;AAAA,IAAwC,MAAM;AAAA,IAAU,MAAM;AAAA,EAChE;AACA,MAAI,SAAS,iBAAkB,SAAQ,iBAAiB,UAAU;AAAA,MAC7D,OAAM,WAAW;AACxB;AAEO,SAAS,yBACd,IACA,mBACA;AAaA,iBAAe,sBAAsB,OAAiD;AACpF,UAAM,MAAM,iBAAiB;AAC7B,QAAI,sBAAsB,GAAG,MAAM,WAAY,QAAO;AAEtD,UAAM,WAAW,MAAM,IAAI,aAAa,MAAM,QAAQ;AACtD,QAAI,UAAU,IAAK,QAAO,SAAS;AAEnC,UAAM,UAAU,MAAM,IAAI,gBAAgB,MAAM,QAAQ;AACxD,QAAI,SAAS,IAAK,QAAO,QAAQ;AAEjC,UAAM,IAAI,sCAAsC,MAAM,QAAQ;AAAA,EAChE;AAEA,iBAAe,uBACb,aACA,OACkC;AAClC,UAAM,MAAM,MAAM,sBAAsB,KAAK;AAC7C,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,UAAU,kBAAkB,KAAK,UAAU,WAAW,GAAG,GAAG;AAClE,WAAO,EAAE,CAAC,8BAA8B,GAAG,QAAQ,MAAM;AAAA,EAC3D;AAEA,iBAAe,uBACb,kBACA,OACkC;AAClC,UAAM,cAAc,2BAA2B,gBAAgB;AAC/D,UAAM,YAAY,YAAY,8BAA8B;AAC5D,QAAI,OAAO,cAAc,YAAY,CAAC,UAAW,QAAO;AAOxD,UAAM,MAAM,MAAM,sBAAsB,KAAK;AAC7C,QAAI,CAAC,IAAK,OAAM,IAAI,sCAAsC,MAAM,UAAU,uBAAuB;AAEjG,UAAM,eAAe,kBAAkB,WAAW,GAAG;AACrD,QAAI,CAAC,aAAc,QAAO,CAAC;AAE3B,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,YAAY;AACtC,aAAO,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,IAC/D,SACD,CAAC;AAAA,IACP,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,OAAO,eAAuB,OAAkE;AACpG,UAAI,MAAM,MAAM;AAAA,QACd;AAAA,QACA;AAAA,QACA,uBAAuB,eAAe,KAAK;AAAA,QAC3C;AAAA,QACA;AAAA,MACF;AASA,UAAI,CAAC,OAAO,MAAM,QAAQ;AACxB,cAAM,MAAM;AAAA,UACV;AAAA,UACA;AAAA,UACA,uBAAuB,eAAe,EAAE,GAAG,OAAO,QAAQ,KAAK,CAAC;AAAA,UAChE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,CAAC,IAAK,QAAO;AACjB,aAAO,uBAAuB,IAAI,aAAa,KAAK;AAAA,IACtD;AAAA,IAEA,MAAM,gBAAgB,eAAuB,OAA+C;AAC1F,UAAI,MAAM,MAAM;AAAA,QACd;AAAA,QACA;AAAA,QACA,uBAAuB,eAAe,KAAK;AAAA,QAC3C;AAAA,QACA;AAAA,MACF;AACA,UAAI,CAAC,OAAO,MAAM,QAAQ;AACxB,cAAM,MAAM;AAAA,UACV;AAAA,UACA;AAAA,UACA,uBAAuB,eAAe,EAAE,GAAG,OAAO,QAAQ,KAAK,CAAC;AAAA,UAChE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO,KAAK,aAAa;AAAA,IAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,MAAM,iBAAiB,eAAuB,OAA+C;AAC3F,YAAM,SAAS,MAAM,KAAK,gBAAgB,eAAe,KAAK;AAC9D,UAAI,OAAQ,QAAO;AAEnB,YAAM,aAAa,eAAe,aAAa;AAC/C,UAAI,CAAC,YAAY,SAAU,QAAO;AAClC,aAAO,KAAK,gBAAgB,WAAW,UAAU,KAAK;AAAA,IACxD;AAAA,IAEA,MAAM,QAAQ,eAAuB,OAAkE;AACrG,YAAM,SAAS,MAAM,KAAK,OAAO,eAAe,KAAK;AACrD,UAAI,OAAQ,QAAO;AAEnB,YAAM,aAAa,eAAe,aAAa;AAC/C,UAAI,CAAC,YAAY,SAAU,QAAO;AAClC,aAAO,KAAK,OAAO,WAAW,UAAU,KAAK;AAAA,IAC/C;AAAA,IAEA,MAAM,KACJ,eACA,aACA,OACA,SACe;AACf,YAAM,uBAAuB,MAAM,uBAAuB,aAAa,KAAK;AAC5E,YAAM,+BAA+B,IAAI,OAAO,mBAAmB,OAAO;AAE1E,YAAM,MAAM,MAAM;AAAA,QAChB;AAAA,QACA;AAAA,QACA,uBAAuB,eAAe,KAAK;AAAA,QAC3C;AAAA,QACA;AAAA,MACF;AAEA,UAAI,KAAK;AACP,YAAI,cAAc;AAClB,cAAM,GAAG,MAAM;AACf;AAAA,MACF;AAEA,YAAM,UAAU,GAAG,OAAO,wBAAwB;AAAA,QAChD;AAAA,QACA,aAAa;AAAA,QACb,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,MACjD,CAAC;AACD,YAAM,GAAG,QAAQ,OAAO,EAAE,MAAM;AAAA,IAClC;AAAA,IAEA,MAAM,UACJ,eACA,UACA,OACA,OACA,SACkC;AAClC,YAAM,UAAW,MAAM,KAAK,OAAO,eAAe,KAAK,KAAM,CAAC;AAC9D,YAAM,UAAU,EAAE,GAAG,SAAS,CAAC,QAAQ,GAAG,MAAM;AAChD,YAAM,KAAK,KAAK,eAAe,SAAS,OAAO,OAAO;AACtD,aAAO;AAAA,IACT;AAAA,IAEA,UAAU,eAAuB;AAC/B,YAAM,aAAa,eAAe,aAAa;AAC/C,UAAI,CAAC,WAAY,QAAO;AAExB,UAAI,WAAW,UAAU;AACvB,cAAM,SAAS,UAAU,WAAW,QAAQ;AAC5C,eAAO,QAAQ,eAAe,oCAAoC,aAAa;AAAA,MACjF;AAEA,aAAO,WAAW,eAAe,oCAAoC,aAAa;AAAA,IACpF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/messages/api/[id]/attachments/route.js

@@ -3,7 +3,7 @@ import { Message, MessageRecipient } from "../../../data/entities.js";
 import { attachmentIdsPayloadSchema, unlinkAttachmentPayloadSchema } from "../../../data/validators.js";
 import { getMessageAttachments } from "../../../lib/attachments.js";
 import { attachOperationMetadataHeader } from "../../../lib/operationMetadata.js";
-import { resolveMessageContext } from "../../../lib/routeHelpers.js";
+import { hasChannelThreadReadAccess, resolveMessageContext } from "../../../lib/routeHelpers.js";
 import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from "../../guards.js";
 import {
   attachmentIdsPayloadSchema as attachmentIdsOpenApiSchema,
@@ -42,8 +42,12 @@ async function GET(req, { params }) {
     recipientUserId: scope.userId,
     deletedAt: null
   });
-  if (message.senderUserId !== scope.userId && !recipient) {
-    return Response.json({ error: "Access denied" }, { status: 403 });
+  const isParticipant = message.senderUserId === scope.userId || Boolean(recipient);
+  if (!isParticipant) {
+    const mayReadViaChannel = message.visibility === "public" && await hasChannelThreadReadAccess(ctx, scope, message);
+    if (!mayReadViaChannel) {
+      return Response.json({ error: "Access denied" }, { status: 403 });
+    }
   }
   const attachments = await getMessageAttachments(
     em,

package/dist/modules/messages/api/[id]/attachments/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/messages/api/%5Bid%5D/attachments/route.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { parseUnlinkAttachmentIds } from '../../../commands/attachments'\nimport { Message, MessageRecipient } from '../../../data/entities'\nimport { attachmentIdsPayloadSchema, unlinkAttachmentPayloadSchema } from '../../../data/validators'\nimport { getMessageAttachments, linkAttachmentsToMessage } from '../../../lib/attachments'\nimport { attachOperationMetadataHeader } from '../../../lib/operationMetadata'\nimport { resolveMessageContext } from '../../../lib/routeHelpers'\nimport { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from '../../guards'\nimport {\n  attachmentIdsPayloadSchema as attachmentIdsOpenApiSchema,\n  errorResponseSchema,\n  messageAttachmentResponseSchema,\n  okResponseSchema,\n  unlinkAttachmentPayloadSchema as unlinkAttachmentOpenApiSchema,\n} from '../../openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  POST: { requireAuth: true, requireFeatures: ['messages.attach_files'] },\n  DELETE: { requireAuth: true, requireFeatures: ['messages.attach_files'] },\n}\n\nfunction hasOrganizationAccess(scopeOrganizationId: string | null, messageOrganizationId: string | null | undefined): boolean {\n  if (scopeOrganizationId) {\n    return messageOrganizationId === scopeOrganizationId\n  }\n  return messageOrganizationId == null\n}\n\nexport async function GET(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = ctx.container.resolve('em') as EntityManager\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  const recipient = await em.findOne(MessageRecipient, {\n    messageId: params.id,\n    recipientUserId: scope.userId,\n    deletedAt: null,\n  })\n\n  if (message.senderUserId !== scope.userId && !recipient) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  const attachments = await getMessageAttachments(\n    em,\n    params.id,\n    scope.organizationId,\n    scope.tenantId\n  )\n\n  return Response.json({ attachments })\n}\n\nexport async function POST(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  const body = await req.json().catch(() => ({}))\n  const input = attachmentIdsPayloadSchema.parse(body)\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (message.senderUserId !== scope.userId) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (!message.isDraft) {\n    return Response.json({ error: 'Attachments can only be modified on drafts' }, { status: 409 })\n  }\n\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: message.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input as Record<string, unknown>,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n  const { logEntry } = await commandBus.execute('messages.attachments.link_to_draft', {\n    input: {\n      messageId: message.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      attachmentIds: input.attachmentIds,\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n\n  const response = Response.json({ ok: true })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n  })\n  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: scope.userId,\n    resourceKind: 'messages.message',\n    resourceId: message.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  return response\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  const body = await req.json().catch(() => ({}))\n  const input = unlinkAttachmentPayloadSchema.parse(body)\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (message.senderUserId !== scope.userId) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (!message.isDraft) {\n    return Response.json({ error: 'Attachments can only be modified on drafts' }, { status: 409 })\n  }\n\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: message.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input as Record<string, unknown>,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n  const { logEntry } = await commandBus.execute('messages.attachments.unlink_from_draft', {\n    input: {\n      messageId: message.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      attachmentIds: parseUnlinkAttachmentIds(input),\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n\n  const response = Response.json({ ok: true })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n  })\n  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: scope.userId,\n    resourceKind: 'messages.message',\n    resourceId: message.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  return response\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    GET: {\n      summary: 'List message attachments',\n      responses: [\n        { status: 200, description: 'Attachments', schema: messageAttachmentResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n    POST: {\n      summary: 'Link attachments to draft message',\n      requestBody: { schema: attachmentIdsOpenApiSchema },\n      responses: [\n        { status: 200, description: 'Attachments linked', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n        { status: 409, description: 'Only draft messages can be edited', schema: errorResponseSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Unlink attachments from draft message',\n      requestBody: { schema: unlinkAttachmentOpenApiSchema },\n      responses: [\n        { status: 200, description: 'Attachments unlinked', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n        { status: 409, description: 'Only draft messages can be edited', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAGA,SAAS,gCAAgC;AACzC,SAAS,SAAS,wBAAwB;AAC1C,SAAS,4BAA4B,qCAAqC;AAC1E,SAAS,6BAAuD;AAChE,SAAS,qCAAqC;AAC9C,SAAS,6BAA6B;AACtC,SAAS,qBAAqB,qCAAqC,gCAAgC;AACnG;AAAA,EACE,8BAA8B;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA,iCAAiC;AAAA,OAC5B;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAAA,EACtE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAC1E;AAEA,SAAS,sBAAsB,qBAAoC,uBAA2D;AAC5H,MAAI,qBAAqB;AACvB,WAAO,0BAA0B;AAAA,EACnC;AACA,SAAO,yBAAyB;AAClC;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AAErC,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,YAAY,MAAM,GAAG,QAAQ,kBAAkB;AAAA,IACnD,WAAW,OAAO;AAAA,IAClB,iBAAiB,MAAM;AAAA,IACvB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,QAAQ,iBAAiB,MAAM,UAAU,CAAC,WAAW;AACvD,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA,OAAO;AAAA,IACP,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AAEA,SAAO,SAAS,KAAK,EAAE,YAAY,CAAC;AACtC;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA+B;AAC/E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,QAAQ,2BAA2B,MAAM,IAAI;AAEnD,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,QAAQ,iBAAiB,MAAM,QAAQ;AACzC,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,CAAC,QAAQ,SAAS;AACpB,WAAO,SAAS,KAAK,EAAE,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/F;AAEA,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AACA,QAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,sCAAsC;AAAA,IAClF,OAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,eAAe,MAAM;AAAA,IACvB;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AAED,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,QAAM,oCAAoC,YAAY,uBAAuB;AAAA,IAC3E,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,MAAM;AAAA,IACd,cAAc;AAAA,IACd,YAAY,QAAQ;AAAA,IACpB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,SAAO;AACT;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,QAAQ,8BAA8B,MAAM,IAAI;AAEtD,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,QAAQ,iBAAiB,MAAM,QAAQ;AACzC,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,CAAC,QAAQ,SAAS;AACpB,WAAO,SAAS,KAAK,EAAE,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/F;AAEA,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AACA,QAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,0CAA0C;AAAA,IACtF,OAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,eAAe,yBAAyB,KAAK;AAAA,IAC/C;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AAED,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,QAAM,oCAAoC,YAAY,uBAAuB;AAAA,IAC3E,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,MAAM;AAAA,IACd,cAAc;AAAA,IACd,YAAY,QAAQ;AAAA,IACpB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,gCAAgC;AAAA,MACrF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,QAAQ,2BAA2B;AAAA,MAClD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,iBAAiB;AAAA,MAC7E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,oBAAoB;AAAA,MAC/F;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa,EAAE,QAAQ,8BAA8B;AAAA,MACrD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,iBAAiB;AAAA,MAC/E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,oBAAoB;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { parseUnlinkAttachmentIds } from '../../../commands/attachments'\nimport { Message, MessageRecipient } from '../../../data/entities'\nimport { attachmentIdsPayloadSchema, unlinkAttachmentPayloadSchema } from '../../../data/validators'\nimport { getMessageAttachments, linkAttachmentsToMessage } from '../../../lib/attachments'\nimport { attachOperationMetadataHeader } from '../../../lib/operationMetadata'\nimport { hasChannelThreadReadAccess, resolveMessageContext } from '../../../lib/routeHelpers'\nimport { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from '../../guards'\nimport {\n  attachmentIdsPayloadSchema as attachmentIdsOpenApiSchema,\n  errorResponseSchema,\n  messageAttachmentResponseSchema,\n  okResponseSchema,\n  unlinkAttachmentPayloadSchema as unlinkAttachmentOpenApiSchema,\n} from '../../openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  POST: { requireAuth: true, requireFeatures: ['messages.attach_files'] },\n  DELETE: { requireAuth: true, requireFeatures: ['messages.attach_files'] },\n}\n\nfunction hasOrganizationAccess(scopeOrganizationId: string | null, messageOrganizationId: string | null | undefined): boolean {\n  if (scopeOrganizationId) {\n    return messageOrganizationId === scopeOrganizationId\n  }\n  return messageOrganizationId == null\n}\n\nexport async function GET(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = ctx.container.resolve('em') as EntityManager\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  const recipient = await em.findOne(MessageRecipient, {\n    messageId: params.id,\n    recipientUserId: scope.userId,\n    deletedAt: null,\n  })\n\n  // Same widening as the detail read (#6354): an operator who may open an\n  // inbound channel message must also see what it carries. Only an explicitly\n  // public message is opened this way, so another operator's internal note on\n  // the same thread stays participant-only.\n  const isParticipant = message.senderUserId === scope.userId || Boolean(recipient)\n  if (!isParticipant) {\n    const mayReadViaChannel = message.visibility === 'public'\n      && await hasChannelThreadReadAccess(ctx, scope, message)\n    if (!mayReadViaChannel) {\n      return Response.json({ error: 'Access denied' }, { status: 403 })\n    }\n  }\n\n  const attachments = await getMessageAttachments(\n    em,\n    params.id,\n    scope.organizationId,\n    scope.tenantId\n  )\n\n  return Response.json({ attachments })\n}\n\nexport async function POST(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  const body = await req.json().catch(() => ({}))\n  const input = attachmentIdsPayloadSchema.parse(body)\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (message.senderUserId !== scope.userId) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (!message.isDraft) {\n    return Response.json({ error: 'Attachments can only be modified on drafts' }, { status: 409 })\n  }\n\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: message.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input as Record<string, unknown>,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n  const { logEntry } = await commandBus.execute('messages.attachments.link_to_draft', {\n    input: {\n      messageId: message.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      attachmentIds: input.attachmentIds,\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n\n  const response = Response.json({ ok: true })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n  })\n  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: scope.userId,\n    resourceKind: 'messages.message',\n    resourceId: message.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  return response\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  const body = await req.json().catch(() => ({}))\n  const input = unlinkAttachmentPayloadSchema.parse(body)\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (message.senderUserId !== scope.userId) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (!message.isDraft) {\n    return Response.json({ error: 'Attachments can only be modified on drafts' }, { status: 409 })\n  }\n\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: message.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input as Record<string, unknown>,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n  const { logEntry } = await commandBus.execute('messages.attachments.unlink_from_draft', {\n    input: {\n      messageId: message.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      attachmentIds: parseUnlinkAttachmentIds(input),\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n\n  const response = Response.json({ ok: true })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n  })\n  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: scope.userId,\n    resourceKind: 'messages.message',\n    resourceId: message.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  return response\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    GET: {\n      summary: 'List message attachments',\n      responses: [\n        { status: 200, description: 'Attachments', schema: messageAttachmentResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n    POST: {\n      summary: 'Link attachments to draft message',\n      requestBody: { schema: attachmentIdsOpenApiSchema },\n      responses: [\n        { status: 200, description: 'Attachments linked', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n        { status: 409, description: 'Only draft messages can be edited', schema: errorResponseSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Unlink attachments from draft message',\n      requestBody: { schema: unlinkAttachmentOpenApiSchema },\n      responses: [\n        { status: 200, description: 'Attachments unlinked', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n        { status: 409, description: 'Only draft messages can be edited', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAGA,SAAS,gCAAgC;AACzC,SAAS,SAAS,wBAAwB;AAC1C,SAAS,4BAA4B,qCAAqC;AAC1E,SAAS,6BAAuD;AAChE,SAAS,qCAAqC;AAC9C,SAAS,4BAA4B,6BAA6B;AAClE,SAAS,qBAAqB,qCAAqC,gCAAgC;AACnG;AAAA,EACE,8BAA8B;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA,iCAAiC;AAAA,OAC5B;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAAA,EACtE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAC1E;AAEA,SAAS,sBAAsB,qBAAoC,uBAA2D;AAC5H,MAAI,qBAAqB;AACvB,WAAO,0BAA0B;AAAA,EACnC;AACA,SAAO,yBAAyB;AAClC;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AAErC,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,YAAY,MAAM,GAAG,QAAQ,kBAAkB;AAAA,IACnD,WAAW,OAAO;AAAA,IAClB,iBAAiB,MAAM;AAAA,IACvB,WAAW;AAAA,EACb,CAAC;AAMD,QAAM,gBAAgB,QAAQ,iBAAiB,MAAM,UAAU,QAAQ,SAAS;AAChF,MAAI,CAAC,eAAe;AAClB,UAAM,oBAAoB,QAAQ,eAAe,YAC5C,MAAM,2BAA2B,KAAK,OAAO,OAAO;AACzD,QAAI,CAAC,mBAAmB;AACtB,aAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClE;AAAA,EACF;AAEA,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA,OAAO;AAAA,IACP,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AAEA,SAAO,SAAS,KAAK,EAAE,YAAY,CAAC;AACtC;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA+B;AAC/E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,QAAQ,2BAA2B,MAAM,IAAI;AAEnD,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,QAAQ,iBAAiB,MAAM,QAAQ;AACzC,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,CAAC,QAAQ,SAAS;AACpB,WAAO,SAAS,KAAK,EAAE,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/F;AAEA,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AACA,QAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,sCAAsC;AAAA,IAClF,OAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,eAAe,MAAM;AAAA,IACvB;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AAED,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,QAAM,oCAAoC,YAAY,uBAAuB;AAAA,IAC3E,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,MAAM;AAAA,IACd,cAAc;AAAA,IACd,YAAY,QAAQ;AAAA,IACpB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,SAAO;AACT;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,QAAQ,8BAA8B,MAAM,IAAI;AAEtD,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,QAAQ,iBAAiB,MAAM,QAAQ;AACzC,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,CAAC,QAAQ,SAAS;AACpB,WAAO,SAAS,KAAK,EAAE,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/F;AAEA,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AACA,QAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,0CAA0C;AAAA,IACtF,OAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,eAAe,yBAAyB,KAAK;AAAA,IAC/C;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AAED,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,QAAM,oCAAoC,YAAY,uBAAuB;AAAA,IAC3E,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,MAAM;AAAA,IACd,cAAc;AAAA,IACd,YAAY,QAAQ;AAAA,IACpB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,gCAAgC;AAAA,MACrF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,QAAQ,2BAA2B;AAAA,MAClD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,iBAAiB;AAAA,MAC7E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,oBAAoB;AAAA,MAC/F;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa,EAAE,QAAQ,8BAA8B;AAAA,MACrD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,iBAAiB;AAAA,MAC/E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,oBAAoB;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/messages/api/[id]/forward-preview/route.js

@@ -1,7 +1,7 @@
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { Message, MessageRecipient } from "../../../data/entities.js";
 import { buildForwardPreview } from "../../../lib/forwarding.js";
-import { hasOrganizationAccess, resolveMessageContext } from "../../../lib/routeHelpers.js";
+import { hasChannelThreadReadAccess, hasOrganizationAccess, resolveMessageContext } from "../../../lib/routeHelpers.js";
 import {
   errorResponseSchema,
   forwardPreviewResponseSchema
@@ -36,7 +36,8 @@ async function GET(req, { params }) {
   });
   const isSender = message.senderUserId === scope.userId;
   const isRecipient = Boolean(recipient);
-  if (!isSender && !isRecipient) {
+  const viaChannelThread = !isSender && !isRecipient && message.visibility === "public" && await hasChannelThreadReadAccess(ctx, scope, message);
+  if (!isSender && !isRecipient && !viaChannelThread) {
     return Response.json({ error: "Access denied" }, { status: 403 });
   }
   try {
@@ -44,7 +45,7 @@ async function GET(req, { params }) {
       tenantId: scope.tenantId,
       organizationId: scope.organizationId,
       userId: scope.userId
-    }, message);
+    }, message, { includePublicThreadMessages: viaChannelThread });
     return Response.json(preview);
   } catch (error) {
     if (error instanceof Error && error.message === "Forward body exceeds maximum length") {

package/dist/modules/messages/api/[id]/forward-preview/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/messages/api/%5Bid%5D/forward-preview/route.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { Message, MessageRecipient } from '../../../data/entities'\nimport { buildForwardPreview } from '../../../lib/forwarding'\nimport { hasOrganizationAccess, resolveMessageContext } from '../../../lib/routeHelpers'\nimport {\n  errorResponseSchema,\n  forwardPreviewResponseSchema,\n} from '../../openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['messages.compose'] },\n}\n\nexport async function GET(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n\n  const message = await findOneWithDecryption(\n    em,\n    Message,\n    {\n      id: params.id,\n      tenantId: scope.tenantId,\n      deletedAt: null,\n    },\n    undefined,\n    { tenantId: scope.tenantId, organizationId: scope.organizationId },\n  )\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  const recipient = await em.findOne(MessageRecipient, {\n    messageId: params.id,\n    recipientUserId: scope.userId,\n    deletedAt: null,\n  })\n\n  const isSender = message.senderUserId === scope.userId\n  const isRecipient = Boolean(recipient)\n  if (!isSender && !isRecipient) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  try {\n    const preview = await buildForwardPreview(em, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n    }, message)\n    return Response.json(preview)\n  } catch (error) {\n    if (error instanceof Error && error.message === 'Forward body exceeds maximum length') {\n      return Response.json({ error: error.message }, { status: 413 })\n    }\n    throw error\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    GET: {\n      summary: 'Get forward preview for a message',\n      responses: [\n        { status: 200, description: 'Forward preview generated', schema: forwardPreviewResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n        { status: 413, description: 'Forward body exceeds maximum length', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAEA,SAAS,6BAA6B;AACtC,SAAS,SAAS,wBAAwB;AAC1C,SAAS,2BAA2B;AACpC,SAAS,uBAAuB,6BAA6B;AAC7D;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AAClE;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE/D,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,OAAO;AAAA,MACX,UAAU,MAAM;AAAA,MAChB,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AAEA,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,YAAY,MAAM,GAAG,QAAQ,kBAAkB;AAAA,IACnD,WAAW,OAAO;AAAA,IAClB,iBAAiB,MAAM;AAAA,IACvB,WAAW;AAAA,EACb,CAAC;AAED,QAAM,WAAW,QAAQ,iBAAiB,MAAM;AAChD,QAAM,cAAc,QAAQ,SAAS;AACrC,MAAI,CAAC,YAAY,CAAC,aAAa;AAC7B,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI;AACF,UAAM,UAAU,MAAM,oBAAoB,IAAI;AAAA,MAC5C,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,IAChB,GAAG,OAAO;AACV,WAAO,SAAS,KAAK,OAAO;AAAA,EAC9B,SAAS,OAAO;AACd,QAAI,iBAAiB,SAAS,MAAM,YAAY,uCAAuC;AACrF,aAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChE;AACA,UAAM;AAAA,EACR;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,6BAA6B;AAAA,MAChG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,uCAAuC,QAAQ,oBAAoB;AAAA,MACjG;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { Message, MessageRecipient } from '../../../data/entities'\nimport { buildForwardPreview } from '../../../lib/forwarding'\nimport { hasChannelThreadReadAccess, hasOrganizationAccess, resolveMessageContext } from '../../../lib/routeHelpers'\nimport {\n  errorResponseSchema,\n  forwardPreviewResponseSchema,\n} from '../../openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['messages.compose'] },\n}\n\nexport async function GET(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n\n  const message = await findOneWithDecryption(\n    em,\n    Message,\n    {\n      id: params.id,\n      tenantId: scope.tenantId,\n      deletedAt: null,\n    },\n    undefined,\n    { tenantId: scope.tenantId, organizationId: scope.organizationId },\n  )\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  const recipient = await em.findOne(MessageRecipient, {\n    messageId: params.id,\n    recipientUserId: scope.userId,\n    deletedAt: null,\n  })\n\n  const isSender = message.senderUserId === scope.userId\n  const isRecipient = Boolean(recipient)\n  // Mirrors `messages.messages.forward` (#6355): an operator working a channel\n  // thread may forward its public messages, and the preview must show the same\n  // conversation the forward will carry.\n  const viaChannelThread = !isSender && !isRecipient\n    && message.visibility === 'public'\n    && await hasChannelThreadReadAccess(ctx, scope, message)\n  if (!isSender && !isRecipient && !viaChannelThread) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  try {\n    const preview = await buildForwardPreview(em, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n    }, message, { includePublicThreadMessages: viaChannelThread })\n    return Response.json(preview)\n  } catch (error) {\n    if (error instanceof Error && error.message === 'Forward body exceeds maximum length') {\n      return Response.json({ error: error.message }, { status: 413 })\n    }\n    throw error\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    GET: {\n      summary: 'Get forward preview for a message',\n      responses: [\n        { status: 200, description: 'Forward preview generated', schema: forwardPreviewResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n        { status: 413, description: 'Forward body exceeds maximum length', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAEA,SAAS,6BAA6B;AACtC,SAAS,SAAS,wBAAwB;AAC1C,SAAS,2BAA2B;AACpC,SAAS,4BAA4B,uBAAuB,6BAA6B;AACzF;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AAClE;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE/D,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,OAAO;AAAA,MACX,UAAU,MAAM;AAAA,MAChB,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AAEA,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,YAAY,MAAM,GAAG,QAAQ,kBAAkB;AAAA,IACnD,WAAW,OAAO;AAAA,IAClB,iBAAiB,MAAM;AAAA,IACvB,WAAW;AAAA,EACb,CAAC;AAED,QAAM,WAAW,QAAQ,iBAAiB,MAAM;AAChD,QAAM,cAAc,QAAQ,SAAS;AAIrC,QAAM,mBAAmB,CAAC,YAAY,CAAC,eAClC,QAAQ,eAAe,YACvB,MAAM,2BAA2B,KAAK,OAAO,OAAO;AACzD,MAAI,CAAC,YAAY,CAAC,eAAe,CAAC,kBAAkB;AAClD,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI;AACF,UAAM,UAAU,MAAM,oBAAoB,IAAI;AAAA,MAC5C,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,IAChB,GAAG,SAAS,EAAE,6BAA6B,iBAAiB,CAAC;AAC7D,WAAO,SAAS,KAAK,OAAO;AAAA,EAC9B,SAAS,OAAO;AACd,QAAI,iBAAiB,SAAS,MAAM,YAAY,uCAAuC;AACrF,aAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChE;AACA,UAAM;AAAA,EACR;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,6BAA6B;AAAA,MAChG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,uCAAuC,QAAQ,oBAAoB;AAAA,MACjG;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/messages/api/[id]/route.js

@@ -2,6 +2,7 @@ import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { applyResponseEnricherToRecord } from "@open-mercato/shared/lib/crud/enricher-runner";
 import { enforceCommandOptimisticLock } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
 import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { User } from "../../../auth/data/entities.js";
 import { Message, MessageObject, MessageRecipient } from "../../data/entities.js";
 import { updateDraftSchema } from "../../data/validators.js";
@@ -10,7 +11,12 @@ import { MESSAGE_OPTIMISTIC_LOCK_RESOURCE_KIND } from "../../lib/constants.js";
 import { getMessageObjectType } from "../../lib/message-objects-registry.js";
 import { getMessageTypeOrDefault } from "../../lib/message-types-registry.js";
 import { attachOperationMetadataHeader } from "../../lib/operationMetadata.js";
-import { hasOrganizationAccess, resolveMessageContext } from "../../lib/routeHelpers.js";
+import {
+  canPostToChannelThread,
+  hasChannelThreadReadAccess,
+  hasOrganizationAccess,
+  resolveMessageContext
+} from "../../lib/routeHelpers.js";
 import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from "../guards.js";
 import {
   errorResponseSchema,
@@ -68,7 +74,11 @@ async function GET(req, { params }) {
   });
   const isSender = message.senderUserId === scope.userId;
   const isRecipient = Boolean(recipient);
-  if (!isSender && !isRecipient) {
+  const hasChannelThreadAccess = await hasChannelThreadReadAccess(ctx, scope, message);
+  if (!isSender && !isRecipient && !hasChannelThreadAccess) {
+    return Response.json({ error: "Access denied" }, { status: 403 });
+  }
+  if (!isSender && !isRecipient && message.visibility !== "public") {
     return Response.json({ error: "Access denied" }, { status: 403 });
   }
   const autoMarkRead = !skipMarkRead && recipient?.status === "unread";
@@ -110,7 +120,8 @@ async function GET(req, { params }) {
     deletedAt: null
   }) : [];
   const visibleRecipientMessageIds = new Set(visibleRecipientRows.map((item) => item.messageId));
-  const actorVisibleThreadMessages = threadMessages.filter((threadMessage) => threadMessage.senderUserId === scope.userId || visibleRecipientMessageIds.has(threadMessage.id));
+  const isThreadMessageParticipant = (threadMessage) => threadMessage.senderUserId === scope.userId || visibleRecipientMessageIds.has(threadMessage.id);
+  const actorVisibleThreadMessages = hasChannelThreadAccess ? threadMessages.filter((threadMessage) => threadMessage.visibility === "public" || isThreadMessageParticipant(threadMessage)) : threadMessages.filter(isThreadMessageParticipant);
   const actorRecipientStatusByMessageId = /* @__PURE__ */ new Map();
   for (const row of visibleRecipientRows) {
     actorRecipientStatusByMessageId.set(row.messageId, row.status);
@@ -272,6 +283,21 @@ async function PATCH(req, { params }) {
   if (!message.isDraft) {
     return Response.json({ error: "Only draft messages can be edited" }, { status: 409 });
   }
+  if (input.senderChannelId) {
+    const { t } = await resolveTranslations();
+    const errorMessage = t(
+      "messages.errors.senderDraftSendUnsupported",
+      "Sending a saved draft through a connected mailbox is not supported yet."
+    );
+    return Response.json(
+      { error: errorMessage, fieldErrors: { senderChannelId: errorMessage } },
+      { status: 422 }
+    );
+  }
+  const finalVisibility = input.visibility !== void 0 ? input.visibility : message.visibility;
+  if (input.isDraft === false && finalVisibility === "public" && !await canPostToChannelThread(ctx, scope, message.threadId ?? message.id)) {
+    return Response.json({ error: "Access denied" }, { status: 403 });
+  }
   const guardResult = await runMessageMutationGuards(
     ctx.container,
     {