@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/src/modules/communication_channels/data/enrichers.ts

@@ -40,6 +40,8 @@ import {
  *   - Enriched fields are namespaced with `_channel*` / `_reactions` prefixes.
  *   - Enrichers are read-only; no writes via the EntityManager.
  *   - Each enricher is feature-gated by `communication_channels.view`.
+ *   - Each enricher only enriches messages the caller sent or receives
+ *     (`loadParticipantMessageIds`); every other record gets the fallback shape.
  */
 
 type MessageRecord = Record<string, unknown> & {
@@ -99,6 +101,38 @@ function sanitizeEmailPayloadHtml(
   return sanitizeChannelHtml(html)
 }
 
+/**
+ * Return the subset of `messageIds` the authenticated user may see channel data
+ * for: messages they sent or are a non-deleted recipient of, scoped to the
+ * caller's tenant/organization. Every enricher on `messages.message` gates its
+ * output on this set so privacy does not depend on how the host route scopes its
+ * rows (#3872, #3834). Fails closed (empty set) without an authenticated user.
+ */
+async function loadParticipantMessageIds(
+  em: EntityManager,
+  messageIds: string[],
+  ctx: EnricherContext,
+): Promise<Set<string>> {
+  const userId = typeof ctx.userId === 'string' && ctx.userId.length > 0 ? ctx.userId : null
+  if (!userId || messageIds.length === 0) return new Set()
+  const organizationId = ctx.organizationId ?? null
+
+  const db = em.getKysely<MessagesParticipantScopeDatabase>()
+  let participantQuery = applyMessageParticipantScope(db.selectFrom('messages as m'), userId)
+    .select('m.id')
+    .distinct()
+    .where('m.id', 'in', messageIds)
+    .where('m.tenant_id', '=', ctx.tenantId as string)
+    .where('m.deleted_at', 'is', null)
+
+  participantQuery = organizationId !== null
+    ? participantQuery.where('m.organization_id', '=', organizationId)
+    : participantQuery.where('m.organization_id', 'is', null)
+
+  const participantRows = await participantQuery.execute()
+  return new Set(participantRows.map((row) => row.id))
+}
+
 // ── _channel + _channelPayload + _channelContact ──────────────────────────────
 
 const messageChannelEnricher: ResponseEnricher<
@@ -130,8 +164,8 @@ const messageChannelEnricher: ResponseEnricher<
     const organizationId = ctx.organizationId ?? null
     const dscope = { tenantId, organizationId }
 
-    const userId = typeof ctx.userId === 'string' ? ctx.userId : null
-    if (!userId) {
+    const participantMessageIdSet = await loadParticipantMessageIds(em, messageIds, ctx)
+    if (participantMessageIdSet.size === 0) {
       return records.map((record) => ({
         ...record,
         _channel: null,
@@ -139,22 +173,7 @@ const messageChannelEnricher: ResponseEnricher<
         _channelContact: null,
       }))
     }
-
-    const db = em.getKysely<MessagesParticipantScopeDatabase>()
-    let participantQuery = applyMessageParticipantScope(db.selectFrom('messages as m'), userId)
-      .select('m.id')
-      .distinct()
-      .where('m.id', 'in', messageIds)
-      .where('m.tenant_id', '=', tenantId)
-      .where('m.deleted_at', 'is', null)
-
-    participantQuery = organizationId !== null
-      ? participantQuery.where('m.organization_id', '=', organizationId)
-      : participantQuery.where('m.organization_id', 'is', null)
-
-    const participantRows = await participantQuery.execute()
-    const participantMessageIds = participantRows.map((row) => row.id)
-    const participantMessageIdSet = new Set(participantMessageIds)
+    const participantMessageIds = Array.from(participantMessageIdSet)
 
     // 1) MessageChannelLink — one bounded `$in` query for the whole page, shared by
     // all three enrichments (channel metadata, channel payload, conversation
@@ -301,12 +320,16 @@ const messageReactionsEnricher: ResponseEnricher<
     if (records.length === 0) return records
     const messageIds = records.map((r) => r.id)
     const em = ctxEm(ctx)
+    const participantMessageIdSet = await loadParticipantMessageIds(em, messageIds, ctx)
+    if (participantMessageIdSet.size === 0) {
+      return records.map((r) => ({ ...r, _reactions: [] }))
+    }
     const dscope = { tenantId: ctx.tenantId, organizationId: ctx.organizationId ?? null }
     const reactions = await findWithDecryption(
       em,
       MessageReaction,
       {
-        messageId: { $in: messageIds },
+        messageId: { $in: Array.from(participantMessageIdSet) },
         tenantId: ctx.tenantId,
         organizationId: ctx.organizationId ?? null,
       },

package/src/modules/communication_channels/data/entities.ts

@@ -85,6 +85,7 @@ export class CommunicationChannel {
     | 'organizationId'
     | 'userId'
     | 'isPrimary'
+    | 'visibility'
     | 'pollIntervalSeconds'
     | 'lastPolledAt'
     | 'status'
@@ -132,6 +133,26 @@ export class CommunicationChannel {
   @Property({ name: 'is_primary', type: 'boolean', default: false })
   isPrimary: boolean = false
 
+  /**
+   * Who may read the CRM email this channel ingests.
+   *
+   *   `private` — only the owner (`userId`). The default, and the only state a
+   *               personal mailbox has ever had.
+   *   `shared`  — every user with CRM access to the linked record: a team mailbox.
+   *
+   * Made explicit rather than inferred from `userId` so a PERSONAL mailbox can be
+   * team-visible without surrendering owner-only management. Tenant-scoped rows
+   * (`userId IS NULL`) are `shared` — the migration sets that in the same
+   * statement as the column addition, otherwise every existing FCM/APNs/Expo push
+   * channel would be silently un-shared on deploy.
+   *
+   * Enforcement is READ-TIME: flipping this never rewrites
+   * `customer_interactions.visibility`, so flipping back is instant and lossless.
+   * Stored as open text to match the sibling per-email `visibility` column.
+   */
+  @Property({ name: 'visibility', type: 'text', default: 'private' })
+  visibility: string = 'private'
+
   /**
    * Polling cadence in seconds. NULL means "this channel does not poll" — i.e. it
    * is push-only (webhook) or its provider opted out via

package/src/modules/communication_channels/di.ts

@@ -14,6 +14,7 @@ import { ensureTestSeedAdapterRegistered } from './lib/test-seed'
 import { sendAsUser } from './lib/send-as-user'
 import { isSystemEmailTransportConfigured, sendSystemEmail } from './lib/system-email'
 import { resolveChannelTypeSafely } from './lib/resolve-channel-type'
+import { resolveChannelThreadAccessSafely } from './lib/channel-thread-access'
 
 export function register(container: AppContainer) {
   // Test-only: register the network-free stub channel adapter when
@@ -51,5 +52,13 @@ export function register(container: AppContainer) {
     // (#4975); absent module or failed lookup reads as "unknown", which the
     // messages validator handles fail-closed.
     communicationChannelsResolveChannelType: asValue(resolveChannelTypeSafely),
+
+    // Cross-module channel-thread authorization. An inbound channel message has
+    // no platform sender and no recipients, so the messages module's
+    // sender-or-recipient reply guard denies every operator (#5535); it resolves
+    // this facade to fall back on the channel's own access rule for threads this
+    // module owns. Absent module or failed lookup reads as "internal thread",
+    // which leaves the participant rule in force.
+    communicationChannelsResolveChannelThreadAccess: asValue(resolveChannelThreadAccessSafely),
   })
 }

package/src/modules/communication_channels/events.ts

@@ -70,6 +70,13 @@ const events = [
     category: 'lifecycle',
     clientBroadcast: true,
   },
+  {
+    id: 'communication_channels.channel.visibility_changed',
+    label: 'Channel Visibility Changed',
+    entity: 'communication_channel',
+    category: 'lifecycle',
+    clientBroadcast: true,
+  },
   // ── Reaction events ──────────────────────────────────────
   {
     id: 'communication_channels.reaction.added',

package/src/modules/communication_channels/i18n/de.json

@@ -62,12 +62,10 @@
   "communication_channels.profile.actions.setPrimaryFailed": "Festlegen als primär fehlgeschlagen",
   "communication_channels.profile.actions.setPrimarySuccess": "Als primär markiert.",
   "communication_channels.profile.alerts.requiresReauth": "{count} Kanäle müssen erneut verbunden werden. Klicken Sie unten beim betroffenen Kanal auf \"Erneut verbinden\".",
-  "communication_channels.profile.columns.disconnect": "Verbindung",
-  "communication_channels.profile.columns.importHistory": "Verlauf",
   "communication_channels.profile.columns.lastPolled": "Zuletzt synchronisiert",
-  "communication_channels.profile.columns.pollNow": "Synchronisieren",
   "communication_channels.profile.columns.primary": "Primär",
   "communication_channels.profile.columns.push": "Push",
+  "communication_channels.profile.columns.sharing": "Teamzugriff",
   "communication_channels.profile.connect.blocked": "Verbindung durch Validierung blockiert",
   "communication_channels.profile.connect.cancel": "Abbrechen",
   "communication_channels.profile.connect.connected": "Kanal verbunden.",
@@ -106,6 +104,8 @@
   "communication_channels.profile.flash.connectedWithProvider": "Kanal verbunden ({provider}).",
   "communication_channels.profile.flash.error": "Kanal konnte nicht verbunden werden.",
   "communication_channels.profile.flash.errorWithCode": "Kanal konnte nicht verbunden werden — {code}.",
+  "communication_channels.profile.flash.replayedState": "Dieser Verbindungslink wurde bereits verwendet — bitte starten Sie die Verbindung erneut.",
+  "communication_channels.profile.flash.stateStoreUnavailable": "Ein Serverfehler hat die Verbindung verhindert. Bitte versuchen Sie es in Kürze erneut.",
   "communication_channels.profile.group": "Profil",
   "communication_channels.profile.importHistory.cancel": "Abbrechen",
   "communication_channels.profile.importHistory.description": "Ältere Nachrichten abrufen, die dieser Kanal beim Verbinden noch nicht gesehen hat. Filter schränken die Suche serverseitig ein.",
@@ -123,6 +123,16 @@
   "communication_channels.profile.importHistory.submitting": "Wird eingereiht…",
   "communication_channels.profile.importHistory.title": "Kanalverlauf importieren",
   "communication_channels.profile.primary": "Primär",
+  "communication_channels.profile.share.confirm.cta": "Mit Team teilen",
+  "communication_channels.profile.share.confirm.text": "Kollegen können dann die CRM-E-Mails dieses Postfachs lesen, einschließlich bereits empfangener Nachrichten. Die Verbindung verwalten weiterhin nur Sie, und Sie können die Freigabe jederzeit beenden.",
+  "communication_channels.profile.share.confirm.title": "Dieses Postfach mit Ihrem Team teilen?",
+  "communication_channels.profile.share.failed": "Freigabe konnte nicht aktualisiert werden",
+  "communication_channels.profile.share.makePrivate": "Privat machen",
+  "communication_channels.profile.share.private": "Nur Sie",
+  "communication_channels.profile.share.privateSuccess": "Postfach ist wieder privat.",
+  "communication_channels.profile.share.shareCta": "Mit Team teilen",
+  "communication_channels.profile.share.shared": "Geteilt",
+  "communication_channels.profile.share.sharedSuccess": "Postfach mit Ihrem Team geteilt.",
   "communication_channels.profile.subtitle": "Verbinden Sie Ihre Kommunikationskanäle, damit ausgehende Nachrichten von Ihrem eigenen Konto stammen und eingehende Nachrichten in Ihrem einheitlichen Posteingang landen.",
   "communication_channels.profile.tableTitle": "Ihre Kanäle",
   "communication_channels.profile.title": "Meine Kommunikationskanäle",

package/src/modules/communication_channels/i18n/en.json

@@ -62,12 +62,10 @@
   "communication_channels.profile.actions.setPrimaryFailed": "Failed to set as primary",
   "communication_channels.profile.actions.setPrimarySuccess": "Marked as primary.",
   "communication_channels.profile.alerts.requiresReauth": "{count} channel(s) need reconnection. Click \"Reconnect\" on the affected channel below.",
-  "communication_channels.profile.columns.disconnect": "Connection",
-  "communication_channels.profile.columns.importHistory": "History",
   "communication_channels.profile.columns.lastPolled": "Last synced",
-  "communication_channels.profile.columns.pollNow": "Sync",
   "communication_channels.profile.columns.primary": "Primary",
   "communication_channels.profile.columns.push": "Push",
+  "communication_channels.profile.columns.sharing": "Team access",
   "communication_channels.profile.connect.blocked": "Connection blocked by validation",
   "communication_channels.profile.connect.cancel": "Cancel",
   "communication_channels.profile.connect.connected": "Channel connected.",
@@ -106,6 +104,8 @@
   "communication_channels.profile.flash.connectedWithProvider": "Channel connected ({provider}).",
   "communication_channels.profile.flash.error": "Failed to connect channel.",
   "communication_channels.profile.flash.errorWithCode": "Failed to connect channel — {code}.",
+  "communication_channels.profile.flash.replayedState": "This connection link was already used — please start the connection again.",
+  "communication_channels.profile.flash.stateStoreUnavailable": "A server error prevented completing the connection. Please try again in a moment.",
   "communication_channels.profile.group": "Profile",
   "communication_channels.profile.importHistory.cancel": "Cancel",
   "communication_channels.profile.importHistory.description": "Pull older messages this channel never observed at connect-time. Filters narrow the search server-side.",
@@ -123,6 +123,16 @@
   "communication_channels.profile.importHistory.submitting": "Queueing…",
   "communication_channels.profile.importHistory.title": "Import channel history",
   "communication_channels.profile.primary": "Primary",
+  "communication_channels.profile.share.confirm.cta": "Share with team",
+  "communication_channels.profile.share.confirm.text": "Colleagues will be able to read the CRM email this mailbox handles, including messages already received. You stay the only person who can manage the connection, and you can stop sharing at any time.",
+  "communication_channels.profile.share.confirm.title": "Share this mailbox with your team?",
+  "communication_channels.profile.share.failed": "Failed to update sharing",
+  "communication_channels.profile.share.makePrivate": "Make private",
+  "communication_channels.profile.share.private": "Only you",
+  "communication_channels.profile.share.privateSuccess": "Mailbox is private again.",
+  "communication_channels.profile.share.shareCta": "Share with team",
+  "communication_channels.profile.share.shared": "Shared",
+  "communication_channels.profile.share.sharedSuccess": "Mailbox shared with your team.",
   "communication_channels.profile.subtitle": "Connect your communication channels so outbound messages come from your own account and inbound messages land in your unified inbox.",
   "communication_channels.profile.tableTitle": "Your channels",
   "communication_channels.profile.title": "My communication channels",

package/src/modules/communication_channels/i18n/es.json

@@ -62,12 +62,10 @@
   "communication_channels.profile.actions.setPrimaryFailed": "No se pudo establecer como principal",
   "communication_channels.profile.actions.setPrimarySuccess": "Marcado como principal.",
   "communication_channels.profile.alerts.requiresReauth": "{count} canal(es) necesitan volver a conectarse. Haz clic en \"Volver a conectar\" en el canal afectado a continuación.",
-  "communication_channels.profile.columns.disconnect": "Conexión",
-  "communication_channels.profile.columns.importHistory": "Historial",
   "communication_channels.profile.columns.lastPolled": "Última sincronización",
-  "communication_channels.profile.columns.pollNow": "Sincronizar",
   "communication_channels.profile.columns.primary": "Principal",
   "communication_channels.profile.columns.push": "Push",
+  "communication_channels.profile.columns.sharing": "Acceso del equipo",
   "communication_channels.profile.connect.blocked": "Conexión bloqueada por la validación",
   "communication_channels.profile.connect.cancel": "Cancelar",
   "communication_channels.profile.connect.connected": "Canal conectado.",
@@ -106,6 +104,8 @@
   "communication_channels.profile.flash.connectedWithProvider": "Canal conectado ({provider}).",
   "communication_channels.profile.flash.error": "No se pudo conectar el canal.",
   "communication_channels.profile.flash.errorWithCode": "No se pudo conectar el canal — {code}.",
+  "communication_channels.profile.flash.replayedState": "Este enlace de conexión ya se utilizó — inicia la conexión de nuevo.",
+  "communication_channels.profile.flash.stateStoreUnavailable": "Un error del servidor impidió completar la conexión. Inténtalo de nuevo en un momento.",
   "communication_channels.profile.group": "Perfil",
   "communication_channels.profile.importHistory.cancel": "Cancelar",
   "communication_channels.profile.importHistory.description": "Recupera mensajes anteriores que este canal no vio al conectarse. Los filtros restringen la búsqueda en el servidor.",
@@ -123,6 +123,16 @@
   "communication_channels.profile.importHistory.submitting": "Encolando…",
   "communication_channels.profile.importHistory.title": "Importar historial del canal",
   "communication_channels.profile.primary": "Principal",
+  "communication_channels.profile.share.confirm.cta": "Compartir con el equipo",
+  "communication_channels.profile.share.confirm.text": "Tus colegas podrán leer el correo de CRM que gestiona este buzón, incluidos los mensajes ya recibidos. Sigues siendo la única persona que gestiona la conexión y puedes dejar de compartir en cualquier momento.",
+  "communication_channels.profile.share.confirm.title": "¿Compartir este buzón con tu equipo?",
+  "communication_channels.profile.share.failed": "No se pudo actualizar el uso compartido",
+  "communication_channels.profile.share.makePrivate": "Hacer privado",
+  "communication_channels.profile.share.private": "Solo tú",
+  "communication_channels.profile.share.privateSuccess": "El buzón es privado de nuevo.",
+  "communication_channels.profile.share.shareCta": "Compartir con el equipo",
+  "communication_channels.profile.share.shared": "Compartido",
+  "communication_channels.profile.share.sharedSuccess": "Buzón compartido con tu equipo.",
   "communication_channels.profile.subtitle": "Conecta tus canales de comunicación para que los mensajes salientes provengan de tu propia cuenta y los mensajes entrantes lleguen a tu bandeja de entrada unificada.",
   "communication_channels.profile.tableTitle": "Tus canales",
   "communication_channels.profile.title": "Mis canales de comunicación",

package/src/modules/communication_channels/i18n/ko.json

@@ -62,12 +62,10 @@
   "communication_channels.profile.actions.setPrimaryFailed": "기본으로 설정하지 못했습니다",
   "communication_channels.profile.actions.setPrimarySuccess": "기본으로 표시되었습니다.",
   "communication_channels.profile.alerts.requiresReauth": "{count}개 채널을 다시 연결해야 합니다. 아래 해당 채널에서 \"다시 연결\"을 클릭하세요.",
-  "communication_channels.profile.columns.disconnect": "연결",
-  "communication_channels.profile.columns.importHistory": "기록",
   "communication_channels.profile.columns.lastPolled": "마지막 동기화",
-  "communication_channels.profile.columns.pollNow": "동기화",
   "communication_channels.profile.columns.primary": "기본",
   "communication_channels.profile.columns.push": "푸시",
+  "communication_channels.profile.columns.sharing": "팀 접근",
   "communication_channels.profile.connect.blocked": "유효성 검사로 인해 연결이 차단되었습니다",
   "communication_channels.profile.connect.cancel": "취소",
   "communication_channels.profile.connect.connected": "채널이 연결되었습니다.",
@@ -106,6 +104,8 @@
   "communication_channels.profile.flash.connectedWithProvider": "채널이 연결되었습니다 ({provider}).",
   "communication_channels.profile.flash.error": "채널 연결에 실패했습니다.",
   "communication_channels.profile.flash.errorWithCode": "채널 연결에 실패했습니다 — {code}.",
+  "communication_channels.profile.flash.replayedState": "이 연결 링크는 이미 사용되었습니다. 연결을 다시 시작해 주세요.",
+  "communication_channels.profile.flash.stateStoreUnavailable": "서버 오류로 연결을 완료할 수 없습니다. 잠시 후 다시 시도해 주세요.",
   "communication_channels.profile.group": "프로필",
   "communication_channels.profile.importHistory.cancel": "취소",
   "communication_channels.profile.importHistory.description": "연결 시점에 확인되지 않았던 이전 메시지를 가져옵니다. 필터는 서버 측에서 검색 범위를 좁힙니다.",
@@ -123,6 +123,16 @@
   "communication_channels.profile.importHistory.submitting": "대기열에 추가하는 중…",
   "communication_channels.profile.importHistory.title": "채널 기록 가져오기",
   "communication_channels.profile.primary": "기본",
+  "communication_channels.profile.share.confirm.cta": "팀과 공유",
+  "communication_channels.profile.share.confirm.text": "동료가 이미 받은 메시지를 포함해 이 메일함이 처리하는 CRM 이메일을 읽을 수 있게 됩니다. 연결 관리는 계속 나만 할 수 있으며 언제든지 공유를 중단할 수 있습니다.",
+  "communication_channels.profile.share.confirm.title": "이 메일함을 팀과 공유하시겠습니까?",
+  "communication_channels.profile.share.failed": "공유 설정을 변경할 수 없습니다",
+  "communication_channels.profile.share.makePrivate": "비공개로 전환",
+  "communication_channels.profile.share.private": "나만",
+  "communication_channels.profile.share.privateSuccess": "메일함이 다시 비공개로 설정되었습니다.",
+  "communication_channels.profile.share.shareCta": "팀과 공유",
+  "communication_channels.profile.share.shared": "공유됨",
+  "communication_channels.profile.share.sharedSuccess": "메일함을 팀과 공유했습니다.",
   "communication_channels.profile.subtitle": "커뮤니케이션 채널을 연결하면 발신 메시지가 회원님의 계정에서 전송되고 수신 메시지가 통합 받은편지함에 도착합니다.",
   "communication_channels.profile.tableTitle": "내 채널",
   "communication_channels.profile.title": "내 통신 채널",

package/src/modules/communication_channels/i18n/pl.json

@@ -62,12 +62,10 @@
   "communication_channels.profile.actions.setPrimaryFailed": "Nie udało się ustawić jako główny",
   "communication_channels.profile.actions.setPrimarySuccess": "Oznaczono jako główny.",
   "communication_channels.profile.alerts.requiresReauth": "Kanały wymagające ponownego połączenia: {count}. Kliknij \"Połącz ponownie\" przy odpowiednim kanale poniżej.",
-  "communication_channels.profile.columns.disconnect": "Połączenie",
-  "communication_channels.profile.columns.importHistory": "Historia",
   "communication_channels.profile.columns.lastPolled": "Ostatnia synchronizacja",
-  "communication_channels.profile.columns.pollNow": "Synchronizacja",
   "communication_channels.profile.columns.primary": "Główny",
   "communication_channels.profile.columns.push": "Push",
+  "communication_channels.profile.columns.sharing": "Dostęp zespołu",
   "communication_channels.profile.connect.blocked": "Połączenie zablokowane przez walidację",
   "communication_channels.profile.connect.cancel": "Anuluj",
   "communication_channels.profile.connect.connected": "Kanał połączony.",
@@ -106,6 +104,8 @@
   "communication_channels.profile.flash.connectedWithProvider": "Kanał połączony ({provider}).",
   "communication_channels.profile.flash.error": "Nie udało się połączyć kanału.",
   "communication_channels.profile.flash.errorWithCode": "Nie udało się połączyć kanału — {code}.",
+  "communication_channels.profile.flash.replayedState": "Ten link połączenia został już użyty — rozpocznij połączenie ponownie.",
+  "communication_channels.profile.flash.stateStoreUnavailable": "Błąd serwera uniemożliwił dokończenie połączenia. Spróbuj ponownie za chwilę.",
   "communication_channels.profile.group": "Profil",
   "communication_channels.profile.importHistory.cancel": "Anuluj",
   "communication_channels.profile.importHistory.description": "Pobierz starsze wiadomości, których kanał nie widział w momencie połączenia. Filtry zawężają wyszukiwanie po stronie serwera.",
@@ -123,6 +123,16 @@
   "communication_channels.profile.importHistory.submitting": "Kolejkowanie…",
   "communication_channels.profile.importHistory.title": "Importuj historię kanału",
   "communication_channels.profile.primary": "Główny",
+  "communication_channels.profile.share.confirm.cta": "Udostępnij zespołowi",
+  "communication_channels.profile.share.confirm.text": "Współpracownicy będą mogli czytać e-maile CRM obsługiwane przez tę skrzynkę, w tym wiadomości już otrzymane. Nadal tylko Ty zarządzasz połączeniem i możesz przerwać udostępnianie w dowolnym momencie.",
+  "communication_channels.profile.share.confirm.title": "Udostępnić tę skrzynkę zespołowi?",
+  "communication_channels.profile.share.failed": "Nie udało się zmienić udostępniania",
+  "communication_channels.profile.share.makePrivate": "Ustaw jako prywatną",
+  "communication_channels.profile.share.private": "Tylko Ty",
+  "communication_channels.profile.share.privateSuccess": "Skrzynka jest znowu prywatna.",
+  "communication_channels.profile.share.shareCta": "Udostępnij zespołowi",
+  "communication_channels.profile.share.shared": "Udostępniona",
+  "communication_channels.profile.share.sharedSuccess": "Skrzynka udostępniona zespołowi.",
   "communication_channels.profile.subtitle": "Połącz swoje kanały komunikacji, aby wysyłane wiadomości pochodziły z Twojego konta, a przychodzące trafiały do Twojej wspólnej skrzynki odbiorczej.",
   "communication_channels.profile.tableTitle": "Twoje kanały",
   "communication_channels.profile.title": "Moje kanały komunikacji",

package/src/modules/communication_channels/index.ts

@@ -2,7 +2,7 @@ export const metadata = {
   id: 'communication_channels',
   title: 'Communication Channels',
   description:
-    'Unified hub bridging external chat/email channels (Slack, WhatsApp, Email) to the Messages module. Adapter contract, channel-native payload storage, reactions, and per-channel threading.',
+    'Unified hub bridging external chat/email channels (Slack, WhatsApp, Email) to the Messages module. Adapter contract, channel-native payload storage, reactions, and per-channel threading. OAuth state cookies are single-use via short-TTL cache markers (see lib/oauth-state.ts); multi-replica deployments MUST set CACHE_STRATEGY=redis so replay protection is shared across replicas.',
   requires: ['progress'],
 }
 

package/src/modules/communication_channels/lib/access-control.ts

@@ -50,12 +50,15 @@ export function channelOrgScopeWhere(
  * `undefined` when the caller is unrestricted (super-admin viewing all orgs).
  * An unrestricted caller sees every channel in the tenant, so the fragment is
  * empty; a restricted one gets their orgs plus the tenant-wide (`NULL`) rows.
+ * An explicitly empty organization list is deny-all, including tenant-wide
+ * rows, because it represents a resolved restricted scope with no visibility.
  */
 export function channelOrgScopeWhereFromFilter(
   filter: { organizationIds: string[] | undefined } | null | undefined,
 ): Record<string, unknown> {
   const organizationIds = filter?.organizationIds
-  if (!organizationIds || organizationIds.length === 0) return {}
+  if (organizationIds === undefined) return {}
+  if (organizationIds.length === 0) return { organizationId: { $in: [] } }
   return { $or: [{ organizationId: { $in: organizationIds } }, { organizationId: null }] }
 }
 

package/src/modules/communication_channels/lib/adapter.ts

@@ -11,6 +11,16 @@ export interface TenantScope {
   tenantId: string
 }
 
+/**
+ * The scope of a concrete channel row. `organizationId` is `null` for a
+ * tenant-wide channel (`communication_channels.organization_id IS NULL`); it is
+ * never replaced by the tenant id.
+ */
+export interface ChannelScope {
+  organizationId: string | null
+  tenantId: string
+}
+
 // ── Capabilities ──────────────────────────────────────────────
 
 export interface ChannelCapabilities {
@@ -226,7 +236,7 @@ export interface SendReactionInput {
   conversationId: string
   emoji: string
   credentials: Record<string, unknown>
-  scope: TenantScope
+  scope: ChannelScope
 }
 
 export interface RemoveReactionInput {
@@ -234,7 +244,7 @@ export interface RemoveReactionInput {
   conversationId: string
   emoji: string
   credentials: Record<string, unknown>
-  scope: TenantScope
+  scope: ChannelScope
 }
 
 // ── Edit / delete ─────────────────────────────────────────────
@@ -261,7 +271,7 @@ export interface FetchHistoryInput {
   credentials: Record<string, unknown>
   cursor?: string
   limit?: number
-  scope: TenantScope
+  scope: ChannelScope
   /**
    * Provider-specific resumption state opaque to the hub. Provider adapters
    * encode their own incremental cursor (Gmail historyId, IMAP
@@ -346,7 +356,7 @@ export interface UnregisterPushInput {
  */
 export interface ApplyPushNotificationInput {
   credentials: Record<string, unknown>
-  scope: TenantScope
+  scope: ChannelScope
   channelState: Record<string, unknown>
   /** Provider-shaped notification payload. */
   notification: Record<string, unknown>
@@ -496,8 +506,8 @@ export interface RefreshCredentialsInput {
    * - For OAuth providers (Gmail): MUST be present; the adapter uses
    *   `clientId` + `clientSecret` to call the provider's token endpoint.
    * - For static-credential providers (IMAP, WhatsApp): ignored.
-   * - When `undefined`: legacy `credentials._client` path is read by the
-   *   adapter (deprecated; will be removed in the next minor release).
+   * - When `undefined`: Gmail refresh fails with a clear error (legacy
+   *   `credentials._client` fallback was removed — see #3828 / UPGRADE_NOTES).
    */
   oauthClient?: OAuthClientConfig
 }

package/src/modules/communication_channels/lib/channel-thread-access.ts

@@ -0,0 +1,133 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { AppContainer } from '@open-mercato/shared/lib/di/container'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { assertCanAccessChannel, channelOrgScopeWhere } from './access-control'
+import { ChannelThreadMapping, CommunicationChannel } from '../data/entities'
+
+const logger = createLogger('communication_channels').child({ component: 'channel-thread-access' })
+
+export type ChannelThreadScope = {
+  tenantId: string
+  organizationId: string | null
+}
+
+export type ChannelThreadReference = {
+  /** `messages.message.thread_id` of the thread the caller is acting on. */
+  messageThreadId?: string | null
+  /** `ExternalConversation.id`, as carried by a message's `sourceEntityId`. */
+  externalConversationId?: string | null
+}
+
+export type ChannelThreadActor = {
+  userId: string | null
+  features: string[]
+}
+
+export type ChannelThreadAccess = {
+  messageThreadId: string
+  externalConversationId: string
+  channelId: string
+  channelType: string
+  /** Whether {@link ChannelThreadActor} may act on the channel behind this thread. */
+  canAccess: boolean
+}
+
+/**
+ * Resolve the channel behind a message thread and decide whether the caller may
+ * act on it (#5535).
+ *
+ * An inbound channel message has a synthetic sender (the channel system user)
+ * and, when the conversation is unassigned, no `message_recipients` row at all.
+ * The `messages` module's sender-or-recipient predicate therefore denies every
+ * operator on such a thread, including a tenant admin — the participant test
+ * asks a question that a thread whose correspondent is not a platform user
+ * cannot answer. For those threads the authorization that actually applies is
+ * this module's own channel access rule, so `messages` resolves this facade
+ * from DI (mirroring `communicationChannelsResolveChannelType`) instead of
+ * reaching into these entities.
+ *
+ * `canAccess` reuses {@link assertCanAccessChannel}: a personal mailbox stays
+ * owner-only, a tenant-wide / shared channel is open to any caller the route
+ * already feature-gated. Returns `null` when the thread is not channel-linked —
+ * an internal message keeps the participant rule untouched.
+ *
+ * Always tenant/organization scoped: a thread that does not resolve inside the
+ * caller's scope reads as not channel-linked rather than being looked up
+ * globally.
+ */
+export async function resolveChannelThreadAccess(
+  container: AppContainer,
+  scope: ChannelThreadScope,
+  reference: ChannelThreadReference,
+  actor: ChannelThreadActor,
+): Promise<ChannelThreadAccess | null> {
+  const messageThreadId = reference.messageThreadId ?? null
+  const externalConversationId = reference.externalConversationId ?? null
+  if (!messageThreadId && !externalConversationId) return null
+
+  const em = (container.resolve('em') as EntityManager).fork()
+  const dscope = { tenantId: scope.tenantId, organizationId: scope.organizationId ?? null }
+  const baseFilter = { tenantId: scope.tenantId, organizationId: scope.organizationId ?? null }
+
+  const mapping = await findOneWithDecryption(
+    em,
+    ChannelThreadMapping,
+    messageThreadId ? { messageThreadId, ...baseFilter } : { externalConversationId, ...baseFilter },
+    undefined,
+    dscope,
+  )
+  if (!mapping) return null
+
+  const channel = await findOneWithDecryption(
+    em,
+    CommunicationChannel,
+    {
+      id: mapping.channelId,
+      tenantId: scope.tenantId,
+      ...channelOrgScopeWhere(scope.organizationId),
+      deletedAt: null,
+    },
+    undefined,
+    dscope,
+  )
+  if (!channel) return null
+
+  let canAccess = true
+  try {
+    assertCanAccessChannel(channel, actor.userId, actor.features)
+  } catch {
+    canAccess = false
+  }
+
+  return {
+    messageThreadId: mapping.messageThreadId,
+    externalConversationId: mapping.externalConversationId,
+    channelId: mapping.channelId,
+    channelType: channel.channelType,
+    canAccess,
+  }
+}
+
+/**
+ * Same contract, but never throws: a lookup failure degrades to "not
+ * channel-linked", which leaves the caller on its pre-existing rule. For the
+ * reply guard that is the fail-closed answer — the participant test still
+ * applies and a transient database error cannot widen access.
+ */
+export async function resolveChannelThreadAccessSafely(
+  container: AppContainer,
+  scope: ChannelThreadScope,
+  reference: ChannelThreadReference,
+  actor: ChannelThreadActor,
+): Promise<ChannelThreadAccess | null> {
+  try {
+    return await resolveChannelThreadAccess(container, scope, reference, actor)
+  } catch (err) {
+    logger.warn('channel thread access resolution failed, treating the thread as internal', { err })
+    return null
+  }
+}
+
+/** DI service type for cross-module callers (resolve `communicationChannelsResolveChannelThreadAccess`). */
+export type ResolveChannelThreadAccessService = typeof resolveChannelThreadAccessSafely