@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/src/modules/customers/api/companies/[id]/route.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import {
   CustomerEntity,
@@ -38,6 +39,7 @@ import {
 import { resolveCustomerInteractionFeatureFlags } from '../../../lib/interactionFeatureFlags'
 import { hydrateCanonicalInteractions } from '../../../lib/interactionReadModel'
 import { buildEmailVisibilityMikroFilter } from '../../../lib/visibilityFilter'
+import { listGrantsForViewer, listSharedChannelIds } from '../../../lib/conversationShares'
 import { resolveCustomerDetailTenantScope } from '../../../lib/detailTenantScope'
 import type { QueryEngine } from '@open-mercato/shared/lib/query/types'
 import type { EntityId } from '@open-mercato/shared/modules/entities'
@@ -453,7 +455,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
     { populate: ['companyProfile'] },
     {
       tenantId: auth.tenantId ?? null,
-      organizationId: scope?.selectedId ?? auth.orgId ?? null,
+      organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
     },
   )
   if (!company) return notFound('Company not found')
@@ -471,7 +473,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
 
   const companyScope = {
     tenantId: company.tenantId ?? auth.tenantId ?? null,
-    organizationId: company.organizationId ?? scope?.selectedId ?? auth.orgId ?? null,
+    organizationId: company.organizationId ?? resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
   }
 
   // Per-user email privacy (CRM email integration): exclude private email
@@ -483,9 +485,21 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
   // Mirrors the people detail route. API-key callers resolve to null
   // (no author match — shared/non-email rows only).
   const viewerUserId = auth.isApiKey ? null : (auth.sub ?? null)
+  // Company detail spans many Persons, so it uses the capped tenant-wide grant
+  // list rather than a per-Person lookup.
+  const companyEmailScope = {
+    tenantId: companyScope.tenantId,
+    organizationId: companyScope.organizationId,
+  }
+  const [companyShareGrants, companySharedChannelIds] = await Promise.all([
+    listGrantsForViewer(em, companyEmailScope, viewerUserId),
+    listSharedChannelIds(em, companyEmailScope, viewerUserId),
+  ])
   const emailVisibilityFilter = buildEmailVisibilityMikroFilter({
     currentUserId: viewerUserId,
     userFeatures: undefined,
+    sharedConversations: companyShareGrants,
+    sharedChannelIds: companySharedChannelIds,
   })
 
   // Opt-in cache (#3664): the company existence + org read-access checks above
@@ -499,7 +513,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
         tenantId: cacheTenantId,
         organizationId: companyScope.organizationId,
         companyId: company.id,
-        selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+        selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
         filterIds: scope?.filterIds ?? null,
         allowedIds: scope?.allowedIds ?? null,
         isSuperAdmin: auth.isSuperAdmin === true,
@@ -619,7 +633,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
         em,
         container,
         auth,
-        selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+        selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
         interactions: canonicalActiveInteractions,
         enrich: includeInteractions,
       })
@@ -656,7 +670,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
         em,
         container,
         auth,
-        selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+        selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
         interactions: plannedPreviewRows,
         enrich: true,
       })
@@ -805,7 +819,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
 
   const peopleUnionScope = {
     tenantId: company.tenantId ?? auth.tenantId ?? null,
-    organizationId: company.organizationId ?? scope?.selectedId ?? auth.orgId ?? null,
+    organizationId: company.organizationId ?? resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
   }
   let relatedPeople: CompanyPersonUnionEntry[] = []
   if (includePeople) {

package/src/modules/customers/api/deals/[id]/companies/route.ts

@@ -5,6 +5,7 @@ import { CrudHttpError, isCrudHttpError, notFound } from '@open-mercato/shared/l
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
@@ -87,7 +88,7 @@ export async function GET(req: Request, ctx: { params?: { id?: string } }) {
     const em = (container.resolve('em') as EntityManager).fork()
     const decryptionScope = {
       tenantId: auth.tenantId,
-      organizationId: scope?.selectedId ?? auth.orgId ?? null,
+      organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
     }
 
     const deal = await findOneWithDecryption(

package/src/modules/customers/api/deals/[id]/people/route.ts

@@ -5,11 +5,17 @@ import { CrudHttpError, isCrudHttpError, notFound } from '@open-mercato/shared/l
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'
-import { CustomerDeal, CustomerDealPersonLink, CustomerEntity } from '../../../../data/entities'
+import {
+  CustomerDeal,
+  CustomerDealPersonLink,
+  CustomerEntity,
+  CustomerPersonProfile,
+} from '../../../../data/entities'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('customers')
@@ -40,12 +46,36 @@ type DealPersonItem = {
   kind: 'person'
   linkedAt: string
   isPrimary: boolean
+  // Added for the shared linked-people card, which renders the same shape the company
+  // endpoint already returns. Purely additive: every key above keeps its meaning, so
+  // `DealLinkedEntitiesTab` and any third-party consumer are unaffected.
+  displayName: string
+  primaryEmail: string | null
+  primaryPhone: string | null
+  status: string | null
+  lifecycleStage: string | null
+  jobTitle: string | null
+  department: string | null
+  createdAt: string
+  organizationId: string
+  temperature: string | null
+  source: string | null
 }
 
 function matchesSearch(item: DealPersonItem, query: string): boolean {
   const normalized = query.trim().toLowerCase()
   if (!normalized.length) return true
-  return [item.label, item.subtitle]
+  return [
+    item.label,
+    item.subtitle,
+    item.primaryEmail,
+    item.primaryPhone,
+    item.jobTitle,
+    item.department,
+    item.status,
+    item.lifecycleStage,
+    item.source,
+  ]
     .filter((value): value is string => typeof value === 'string' && value.length > 0)
     .some((value) => value.toLowerCase().includes(normalized))
 }
@@ -88,7 +118,7 @@ export async function GET(req: Request, ctx: { params?: { id?: string } }) {
     const em = (container.resolve('em') as EntityManager).fork()
     const decryptionScope = {
       tenantId: auth.tenantId,
-      organizationId: scope?.selectedId ?? auth.orgId ?? null,
+      organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
     }
 
     const deal = await findOneWithDecryption(
@@ -118,17 +148,56 @@ export async function GET(req: Request, ctx: { params?: { id?: string } }) {
       entityScope,
     )
 
+    // One batched read for the profile-only columns, keyed by every linked person — not one
+    // query per row. The handler filters, sorts and paginates in memory below, so the batch
+    // covers the whole link set rather than the page; that is fine at the expected scale of
+    // tens of contacts per deal, and the in-memory pipeline is what to revisit first if it
+    // ever is not.
+    const personIds = links
+      .map((link) => (link.person as CustomerEntity | null)?.id)
+      .filter((personId): personId is string => typeof personId === 'string' && personId.length > 0)
+
+    const profiles = personIds.length > 0
+      ? await findWithDecryption(
+          em,
+          CustomerPersonProfile,
+          {
+            entity: { $in: personIds },
+            tenantId: deal.tenantId,
+            organizationId: deal.organizationId,
+          },
+          {},
+          entityScope,
+        )
+      : []
+    const profileByPersonId = new Map(
+      profiles.map((profile) => [(profile.entity as { id: string }).id, profile]),
+    )
+
     const items = links
       .map((link) => {
         const person = link.person as CustomerEntity | null
         if (!person?.id) return null
+        const profile = profileByPersonId.get(person.id) ?? null
+        const displayName = person.displayName ?? person.primaryEmail ?? person.id
         return {
           id: person.id,
-          label: person.displayName ?? person.primaryEmail ?? person.id,
+          label: displayName,
           subtitle: person.primaryEmail ?? person.primaryPhone ?? null,
           kind: 'person',
           linkedAt: link.createdAt.toISOString(),
           isPrimary: link.isPrimary === true,
+          displayName,
+          primaryEmail: person.primaryEmail ?? null,
+          primaryPhone: person.primaryPhone ?? null,
+          status: person.status ?? null,
+          lifecycleStage: person.lifecycleStage ?? null,
+          jobTitle: profile?.jobTitle ?? null,
+          department: profile?.department ?? null,
+          createdAt: person.createdAt.toISOString(),
+          organizationId: person.organizationId,
+          temperature: person.temperature ?? null,
+          source: person.source ?? null,
         } satisfies DealPersonItem
       })
       .filter((item): item is DealPersonItem => item !== null)
@@ -175,6 +244,17 @@ export const openApi: OpenApiRouteDoc = {
                 kind: z.literal('person'),
                 linkedAt: z.string(),
                 isPrimary: z.boolean(),
+                displayName: z.string(),
+                primaryEmail: z.string().nullable(),
+                primaryPhone: z.string().nullable(),
+                status: z.string().nullable(),
+                lifecycleStage: z.string().nullable(),
+                jobTitle: z.string().nullable(),
+                department: z.string().nullable(),
+                createdAt: z.string(),
+                organizationId: z.string().uuid().nullable(),
+                temperature: z.string().nullable(),
+                source: z.string().nullable(),
               }),
             ),
             total: z.number().int().nonnegative(),

package/src/modules/customers/api/deals/map/route.ts

@@ -4,6 +4,7 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import type { CrudCtx } from '@open-mercato/shared/lib/crud/factory'
 import { readQueryParamList } from '@open-mercato/shared/lib/crud/query-params'
 import { SortDir, type QueryEngine } from '@open-mercato/shared/lib/query/types'
@@ -231,20 +232,20 @@ export async function GET(req: Request) {
   const effectiveTenantId = scope.tenantId ?? auth.tenantId
   // `null` = unrestricted access (superadmin or an "all organizations" grant): aggregate tenant-wide,
   // exactly like the deals List route (`makeCrudRoute`) and the query_index status route. A populated
-  // array bounds the query to the caller's visible orgs; an empty array means no org visibility → 401.
+  // array bounds the query to the caller's visible orgs; an empty array means no org visibility and
+  // returns an empty page without touching any data source.
   // The previous guard hard-required `auth.orgId`, which is empty under the header "All organizations"
   // scope, so the map 401'd (and hung on the loading spinner) while List/Kanban aggregated fine (#3481).
-  const orgScopeIds: string[] | null =
-    scope.filterIds === null
-      ? null
-      : Array.isArray(scope.filterIds) && scope.filterIds.length > 0
-        ? Array.from(new Set(scope.filterIds.filter((id) => typeof id === 'string' && id.length > 0)))
-        : auth.orgId
-          ? [auth.orgId]
-          : []
-  if (!effectiveTenantId || (Array.isArray(orgScopeIds) && orgScopeIds.length === 0)) {
+  const { organizationIds } = resolveOrganizationScopeFilter(scope, auth)
+  const orgScopeIds = organizationIds === undefined
+    ? null
+    : Array.from(new Set(organizationIds.filter((id) => typeof id === 'string' && id.length > 0)))
+  if (!effectiveTenantId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
+  if (orgScopeIds?.length === 0) {
+    return emptyMapResponse(query.page, query.pageSize)
+  }
 
   // Bounded `$in` when the caller is org-restricted; omitted entirely under unrestricted access so
   // every query stays tenant-scoped only. `fallbackOrgId` is undefined when unrestricted.

package/src/modules/customers/api/dictionaries/context.ts

@@ -3,6 +3,7 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import { createRequestContainer, type AppContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { Organization } from '@open-mercato/core/modules/directory/data/entities'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
@@ -114,7 +115,7 @@ export async function resolveDictionaryRouteContext(
   })
   const em = (container.resolve('em') as EntityManager)
   const tenantId = scope?.tenantId ?? auth.tenantId
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null
 
   const normalizeId = (value: unknown): string | null => {
     if (typeof value !== 'string') return null

package/src/modules/customers/api/entity-roles-factory.ts

@@ -8,6 +8,7 @@ import { CrudHttpError, isCrudHttpError, notFound } from '@open-mercato/shared/l
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { User } from '@open-mercato/core/modules/auth/data/entities'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import { CustomerEntity, CustomerEntityRole } from '../data/entities'
@@ -131,7 +132,7 @@ async function resolveEntityRouteScope(
     CustomerEntity,
     { id: entityId, kind: entityType, tenantId: auth.tenantId, deletedAt: null },
     undefined,
-    { tenantId: auth.tenantId, organizationId: scope?.selectedId ?? auth.orgId ?? null },
+    { tenantId: auth.tenantId, organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null },
   )
   if (!entity || entity.tenantId !== auth.tenantId) {
     throw notFound(translate('customers.errors.customer_not_found', 'Customer not found'))
@@ -158,7 +159,7 @@ async function resolveRoleRouteScope(
     CustomerEntityRole,
     { id: roleId, tenantId: auth.tenantId, entityType, entityId, deletedAt: null },
     undefined,
-    { tenantId: auth.tenantId, organizationId: scope?.selectedId ?? auth.orgId ?? null },
+    { tenantId: auth.tenantId, organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null },
   )
   if (
     !role ||

package/src/modules/customers/api/interactions/[id]/visibility/route.ts

@@ -11,6 +11,7 @@ import {
   runCrudMutationGuardAfterSuccess,
 } from '@open-mercato/shared/lib/crud/mutation-guard'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { CustomerInteraction } from '../../../../data/entities'
 import type { InteractionUpdateInput } from '../../../../data/validators'
 import { resolveAuthActorId } from '../../../../lib/interactionRequestContext'
@@ -68,7 +69,7 @@ export async function PATCH(req: Request, context: RouteContext): Promise<Respon
       interactionType: 'email',
     } as any,
     undefined,
-    { tenantId: auth.tenantId as string, organizationId: scope?.selectedId ?? (auth as { orgId?: string | null }).orgId ?? null },
+    { tenantId: auth.tenantId as string, organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null },
   )) as { id: string; organizationId?: string | null; authorUserId?: string | null; visibility?: string | null } | null
 
   if (!interaction) {

package/src/modules/customers/api/interactions/cancel/route.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'
 import { interactionCancelSchema, type InteractionCancelInput } from '../../../data/validators'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
@@ -37,7 +38,7 @@ export async function POST(req: Request) {
       container,
       auth,
       organizationScope: scope,
-      selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+      selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
       organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
       request: req,
     }

package/src/modules/customers/api/interactions/complete/route.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'
 import { interactionCompleteSchema, type InteractionCompleteInput } from '../../../data/validators'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
@@ -37,7 +38,7 @@ export async function POST(req: Request) {
       container,
       auth,
       organizationScope: scope,
-      selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+      selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
       organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
       request: req,
     }

package/src/modules/customers/api/interactions/conflicts/route.ts

@@ -6,6 +6,7 @@ import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/er
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -77,11 +78,7 @@ export async function GET(req: Request) {
     }
 
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
-    const organizationIds = Array.isArray(scope?.filterIds) && scope.filterIds.length > 0
-      ? scope.filterIds
-      : auth.orgId
-        ? [auth.orgId]
-        : []
+    const { organizationIds, rbacOrganizationId } = resolveOrganizationScopeFilter(scope, auth)
 
     const offsetMinutes = query.timezoneOffsetMinutes ?? 0
     const offsetSign = offsetMinutes >= 0 ? '+' : '-'
@@ -95,6 +92,9 @@ export async function GET(req: Request) {
     if (Number.isNaN(windowStart.getTime()) || Number.isNaN(windowEnd.getTime())) {
       throw new CrudHttpError(400, { error: translate('customers.errors.invalid_date_time', 'Invalid date/time') })
     }
+    if (organizationIds?.length === 0) {
+      return NextResponse.json({ ok: true, result: { hasConflicts: false, conflicts: [] } })
+    }
 
     const checkUserId = query.userId ?? auth.userId
     const em = (container.resolve('em') as EntityManager).fork()
@@ -108,9 +108,9 @@ export async function GET(req: Request) {
       .where('scheduled_at', 'is not', null)
       .where('deleted_at', 'is', null)
 
-    if (organizationIds.length === 1) {
+    if (organizationIds?.length === 1) {
       baseQuery = baseQuery.where('organization_id', '=', organizationIds[0])
-    } else if (organizationIds.length > 1) {
+    } else if (organizationIds && organizationIds.length > 1) {
       baseQuery = baseQuery.where('organization_id', 'in', organizationIds)
     }
 
@@ -149,7 +149,7 @@ export async function GET(req: Request) {
 
     const decryptionScope = {
       tenantId: auth.tenantId ?? null,
-      organizationId: auth.orgId ?? null,
+      organizationId: rbacOrganizationId,
     }
     const conflictIds = rows.map((row) => row.id)
     const interactionFilter: Record<string, unknown> = {
@@ -157,9 +157,9 @@ export async function GET(req: Request) {
       tenantId: auth.tenantId,
       deletedAt: null,
     }
-    if (organizationIds.length === 1) {
+    if (organizationIds?.length === 1) {
       interactionFilter.organizationId = organizationIds[0]
-    } else if (organizationIds.length > 1) {
+    } else if (organizationIds && organizationIds.length > 1) {
       interactionFilter.organizationId = { $in: organizationIds }
     }
     const decryptedInteractions = conflictIds.length > 0

package/src/modules/customers/api/interactions/counts/route.ts

@@ -6,9 +6,11 @@ import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/er
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { applyEmailVisibilityFilter } from '../../../lib/visibilityFilter'
+import { listGrantsForViewer, listSharedChannelIds } from '../../../lib/conversationShares'
 import { TERMINAL_INTERACTION_STATUS_LIST } from '../../../lib/interactionStatus'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
@@ -70,11 +72,13 @@ export async function GET(req: Request) {
     }
 
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
-    const organizationIds = Array.isArray(scope?.filterIds) && scope.filterIds.length > 0
-      ? scope.filterIds
-      : auth.orgId
-        ? [auth.orgId]
-        : []
+    const { organizationIds } = resolveOrganizationScopeFilter(scope, auth)
+    if (organizationIds?.length === 0) {
+      return NextResponse.json({
+        ok: true,
+        result: { call: 0, email: 0, meeting: 0, note: 0, task: 0, total: 0 },
+      })
+    }
     const em = (container.resolve('em') as EntityManager).fork()
     const kysely = em.getKysely<any>()
 
@@ -84,9 +88,9 @@ export async function GET(req: Request) {
       .where('tenant_id', '=', auth.tenantId)
       .where('deleted_at', 'is', null)
 
-    if (organizationIds.length === 1) {
+    if (organizationIds?.length === 1) {
       baseQuery = baseQuery.where('organization_id', '=', organizationIds[0])
-    } else if (organizationIds.length > 1) {
+    } else if (organizationIds && organizationIds.length > 1) {
       baseQuery = baseQuery.where('organization_id', 'in', organizationIds)
     }
 
@@ -100,9 +104,23 @@ export async function GET(req: Request) {
     // per-type counts so the `email` total matches the visibility-filtered list.
     // v1 strict owner-only — no admin bypass (the filter ignores caller features).
     const viewerUserId = auth.isApiKey ? null : auth.sub ?? null
+    // Conversation shares must widen the counts too, or the `email` total would
+    // disagree with the visibility-filtered list it labels.
+    const emailShareScope = {
+      tenantId: auth.tenantId as string,
+      // Grants are org-scoped; with a multi-org scope fall back to tenant-wide
+      // (the predicate still matches on person + owner, never on org alone).
+      organizationId: organizationIds?.length === 1 ? organizationIds[0] : null,
+    }
+    const [emailShareGrants, emailSharedChannelIds] = await Promise.all([
+      listGrantsForViewer(em, emailShareScope, viewerUserId),
+      listSharedChannelIds(em, emailShareScope, viewerUserId),
+    ])
     baseQuery = applyEmailVisibilityFilter(baseQuery, {
       currentUserId: viewerUserId,
       userFeatures: undefined,
+      sharedConversations: emailShareGrants,
+      sharedChannelIds: emailSharedChannelIds,
     })
 
     // Raw SELECT: reads only unencrypted columns (id, interaction_type); title/notes are excluded to avoid ciphertext leakage.

package/src/modules/customers/api/interactions/route.ts

@@ -15,6 +15,7 @@ import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { CustomerDeal, CustomerInteraction } from '../../data/entities'
 import { User } from '@open-mercato/core/modules/auth/data/entities'
@@ -26,6 +27,7 @@ import {
 } from '../openapi'
 import { CUSTOMER_INTERACTION_ENTITY_ID } from '../../lib/interactionCompatibility'
 import { applyEmailVisibilityFilter } from '../../lib/visibilityFilter'
+import { listGrantsForViewer, listSharedChannelIds } from '../../lib/conversationShares'
 import { resolveEncryptedSortPage } from './encryptedSortPage'
 import { applyDecryptedFields } from './decryptedFields'
 import { resolveCanonicalActivityTargetId } from '../../lib/legacyActivityBridge'
@@ -185,6 +187,8 @@ type InteractionListRow = {
   participants: Array<{ userId?: string; name?: string; email?: string; status?: string }> | null
   reminder_minutes: number | null
   visibility: string | null
+  /** Denormalized channel — the shared-team-mailbox arm keys on this, not on the author. */
+  channel_id: string | null
   linked_entities: Array<{ id: string; type: string; label: string }> | null
   guest_permissions: { canInviteOthers?: boolean; canModify?: boolean; canSeeList?: boolean } | null
   pinned: boolean
@@ -318,6 +322,10 @@ const INTERACTION_LIST_COLUMNS = [
   'participants',
   'reminder_minutes',
   'visibility',
+  // Required by `interactionEmailCardEnricher`: without `channel_id` the
+  // shared-team-mailbox arm of `isEmailHiddenFrom` can never match, so a teammate
+  // silently loses the email-card actions on a mailbox they may legitimately read.
+  'channel_id',
   'linked_entities',
   'guest_permissions',
   'pinned',
@@ -333,12 +341,12 @@ function applyInteractionListFilters(
   baseQuery: any,
   params: {
     tenantId: string
-    organizationIds: string[]
+    organizationIds: string[] | undefined
     query: z.infer<typeof listSchema>
   },
 ): any {
   let q = baseQuery.where('deleted_at', 'is', null).where('tenant_id', '=', params.tenantId)
-  if (params.organizationIds.length > 0) q = q.where('organization_id', 'in', params.organizationIds)
+  if (params.organizationIds !== undefined) q = q.where('organization_id', 'in', params.organizationIds)
   const { query } = params
   if (query.entityId) q = q.where('entity_id', '=', query.entityId)
   if (query.dealId) q = q.where('deal_id', '=', query.dealId)
@@ -445,14 +453,7 @@ export async function GET(req: Request) {
     }
 
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
-    const organizationIds = Array.isArray(scope?.filterIds) && scope.filterIds.length > 0
-      ? scope.filterIds
-      : auth.orgId
-        ? [auth.orgId]
-        : []
-    const selectedOrganizationId = scope?.selectedId ?? auth.orgId ?? organizationIds[0] ?? null
-    const em = (container.resolve('em') as EntityManager).fork()
-    const db = em.getKysely<any>() as any
+    const { organizationIds, rbacOrganizationId: selectedOrganizationId } = resolveOrganizationScopeFilter(scope, auth)
 
     const requestedSortField = query.sortField ?? 'scheduledAt'
     const sortConfig = interactionSortConfig[requestedSortField]
@@ -464,6 +465,12 @@ export async function GET(req: Request) {
         error: translate('customers.interactions.cursor.invalid', 'Invalid cursor'),
       })
     }
+    if (organizationIds?.length === 0) {
+      return NextResponse.json({ items: [] })
+    }
+
+    const em = (container.resolve('em') as EntityManager).fork()
+    const db = em.getKysely<any>() as any
 
     // ── Email visibility filter (2026-05-27) ──────────────────────────────
     // Non-email interactions pass through; email rows with visibility='private'
@@ -472,6 +479,16 @@ export async function GET(req: Request) {
     // viewer to null so they never gain the author bypass and only see shared
     // emails (fail-closed). Mirrors counts/people/activities routes.
     const viewerUserId = auth.isApiKey ? null : (auth.sub ?? null)
+    // Conversation shares that widen this caller's email access. Unscoped surface,
+    // so this is the capped variant (see SHARE_ARM_MAX).
+    const emailShareScope = {
+      tenantId: auth.tenantId as string,
+      organizationId: selectedOrganizationId,
+    }
+    const [emailShareGrants, emailSharedChannelIds] = await Promise.all([
+      listGrantsForViewer(em, emailShareScope, viewerUserId),
+      listSharedChannelIds(em, emailShareScope, viewerUserId),
+    ])
     const encryptionService = resolveTenantEncryptionService(em)
     // Encrypted sort columns can't use SQL keyset ordering on ciphertext, so an
     // encrypted sort field takes a bounded candidate-scan + in-memory-sort path
@@ -502,6 +519,8 @@ export async function GET(req: Request) {
       candidateQuery = applyEmailVisibilityFilter(candidateQuery as any, {
         currentUserId: viewerUserId,
         userFeatures: callerUserFeatures,
+        sharedConversations: emailShareGrants,
+        sharedChannelIds: emailSharedChannelIds,
       })
       const cap = resolveEncryptedSortMaxRows()
       if (cap !== null) {
@@ -547,6 +566,8 @@ export async function GET(req: Request) {
         pageQuery = applyEmailVisibilityFilter(pageQuery as any, {
           currentUserId: viewerUserId,
           userFeatures: callerUserFeatures,
+          sharedConversations: emailShareGrants,
+          sharedChannelIds: emailSharedChannelIds,
         })
         pageQuery = pageQuery.where('id', 'in', pageIds)
         const rawPageRows = await pageQuery.execute() as InteractionListRow[]
@@ -580,6 +601,8 @@ export async function GET(req: Request) {
       rowsQuery = applyEmailVisibilityFilter(rowsQuery as any, {
         currentUserId: viewerUserId,
         userFeatures: callerUserFeatures,
+        sharedConversations: emailShareGrants,
+        sharedChannelIds: emailSharedChannelIds,
       })
 
       rowsQuery = rowsQuery.orderBy(sql`${sql.raw(sortSql)} ${sql.raw(sortDir)}`).orderBy('id', sortDir)
@@ -697,6 +720,7 @@ export async function GET(req: Request) {
       participants: row.participants ?? null,
       reminderMinutes: row.reminder_minutes ?? null,
       visibility: row.visibility ?? null,
+      channelId: row.channel_id ?? null,
       linkedEntities: row.linked_entities ?? null,
       guestPermissions: row.guest_permissions ?? null,
       pinned: row.pinned ?? false,