@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/src/modules/integrations/di.ts

@@ -8,16 +8,20 @@ import { createIntegrationLogService } from './lib/log-service'
 import { createHealthService } from './lib/health-service'
 import type { IntegrationStateService } from './lib/state-service'
 import type { IntegrationLogService } from './lib/log-service'
+import type { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'
 
 type Cradle = {
   em: EntityManager
   integrationStateService: IntegrationStateService
   integrationLogService: IntegrationLogService
+  tenantEncryptionService: TenantDataEncryptionService
 }
 
 export function register(container: AppContainer) {
   container.register({
-    integrationCredentialsService: asFunction(({ em }: Cradle) => createCredentialsService(em)).scoped().proxy(),
+    integrationCredentialsService: asFunction(({ em, tenantEncryptionService }: Cradle) =>
+      createCredentialsService(em, tenantEncryptionService),
+    ).scoped().proxy(),
     integrationStateService: asFunction(({ em }: Cradle) => createIntegrationStateService(em)).scoped().proxy(),
     integrationLogService: asFunction(({ em }: Cradle) => createIntegrationLogService(em)).scoped().proxy(),
     integrationHealthService: asFunction(({ integrationStateService, integrationLogService }: Cradle) =>

package/src/modules/integrations/lib/credentials-service.ts

@@ -1,15 +1,19 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { decryptWithAesGcm, encryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'
+import { resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { createKmsService, resolveEncryptionMode } from '@open-mercato/shared/lib/encryption/kms'
-import { parseDecryptedFieldValue } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'
+import {
+  parseDecryptedFieldValue,
+  type TenantDataEncryptionService,
+} from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'
 import {
   getBundle,
   getIntegration,
   resolveIntegrationCredentialsSchema,
   type IntegrationScope,
 } from '@open-mercato/shared/modules/integrations/types'
-import { EncryptionMap } from '../../entities/data/entities'
+import { upsertCanonicalEncryptionMap } from '../../entities/lib/encryption-maps'
 import { IntegrationCredentials } from '../data/entities'
 
 const ENCRYPTED_CREDENTIALS_BLOB_KEY = '__om_encrypted_credentials_blob_v1'
@@ -102,40 +106,39 @@ export function buildCredentialsFilter(integrationId: string, scope: Integration
   return base
 }
 
-export function createCredentialsService(em: EntityManager) {
-  const credentialsEncryptionSpec = [{ field: 'credentials' }]
+type EncryptionMapCacheInvalidator = Pick<TenantDataEncryptionService, 'invalidateMap'>
 
-  async function ensureCredentialsEncryptionMap(scope: IntegrationScope): Promise<void> {
-    const existing = await findOneWithDecryption(
-      em,
-      EncryptionMap,
-      {
-        entityId: 'integrations:integration_credentials',
-        tenantId: scope.tenantId,
-        organizationId: scope.organizationId,
-        deletedAt: null,
-      },
-      undefined,
-      scope,
-    )
+export type CredentialsWriteOptions = {
+  deferAfterCommit?: (callback: () => void | Promise<void>) => void
+}
 
-    if (!existing) {
-      const created = em.create(EncryptionMap, {
-        entityId: 'integrations:integration_credentials',
-        tenantId: scope.tenantId,
-        organizationId: scope.organizationId,
-        fieldsJson: credentialsEncryptionSpec,
-        isActive: true,
-        createdAt: new Date(),
-        updatedAt: new Date(),
-      })
-      em.persist(created)
-      return
-    }
+export async function ensureCredentialsEncryptionMap(
+  em: EntityManager,
+  scope: IntegrationScope,
+  encryptionService?: EncryptionMapCacheInvalidator | null,
+  options?: CredentialsWriteOptions,
+): Promise<void> {
+  const credentialsEncryptionSpec = [{ field: 'credentials' }]
+  await upsertCanonicalEncryptionMap(em, {
+    entityId: 'integrations:integration_credentials',
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    fields: credentialsEncryptionSpec,
+    isActive: true,
+  })
+  const invalidator = encryptionService ?? resolveTenantEncryptionService(em)
+  if (!invalidator) return
+  const invalidate = () => invalidator.invalidateMap(
+    'integrations:integration_credentials', scope.tenantId, scope.organizationId,
+  )
+  if (options?.deferAfterCommit) options.deferAfterCommit(invalidate)
+  else await invalidate()
+}
 
-    existing.fieldsJson = credentialsEncryptionSpec
-    existing.isActive = true
-  }
+export function createCredentialsService(
+  em: EntityManager,
+  encryptionService?: EncryptionMapCacheInvalidator | null,
+) {
 
   /**
    * Resolve the DEK this tenant's credentials blob is sealed with, or `null` when the operator
@@ -274,9 +277,14 @@ export function createCredentialsService(em: EntityManager) {
       return this.getRaw(definition.bundleId, scope)
     },
 
-    async save(integrationId: string, credentials: Record<string, unknown>, scope: IntegrationScope): Promise<void> {
+    async save(
+      integrationId: string,
+      credentials: Record<string, unknown>,
+      scope: IntegrationScope,
+      options?: CredentialsWriteOptions,
+    ): Promise<void> {
       const encryptedCredentials = await encryptCredentialsBlob(credentials, scope)
-      await ensureCredentialsEncryptionMap(scope)
+      await ensureCredentialsEncryptionMap(em, scope, encryptionService, options)
 
       const row = await findOneWithDecryption(
         em,
@@ -307,10 +315,11 @@ export function createCredentialsService(em: EntityManager) {
       fieldKey: string,
       value: unknown,
       scope: IntegrationScope,
+      options?: CredentialsWriteOptions,
     ): Promise<Record<string, unknown>> {
       const current = (await this.getRaw(integrationId, scope)) ?? {}
       const updated = { ...current, [fieldKey]: value }
-      await this.save(integrationId, updated, scope)
+      await this.save(integrationId, updated, scope, options)
       return updated
     },
 

package/src/modules/messages/api/[id]/attachments/route.ts

@@ -6,7 +6,7 @@ import { Message, MessageRecipient } from '../../../data/entities'
 import { attachmentIdsPayloadSchema, unlinkAttachmentPayloadSchema } from '../../../data/validators'
 import { getMessageAttachments, linkAttachmentsToMessage } from '../../../lib/attachments'
 import { attachOperationMetadataHeader } from '../../../lib/operationMetadata'
-import { resolveMessageContext } from '../../../lib/routeHelpers'
+import { hasChannelThreadReadAccess, resolveMessageContext } from '../../../lib/routeHelpers'
 import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from '../../guards'
 import {
   attachmentIdsPayloadSchema as attachmentIdsOpenApiSchema,
@@ -53,8 +53,17 @@ export async function GET(req: Request, { params }: { params: { id: string } })
     deletedAt: null,
   })
 
-  if (message.senderUserId !== scope.userId && !recipient) {
-    return Response.json({ error: 'Access denied' }, { status: 403 })
+  // Same widening as the detail read (#6354): an operator who may open an
+  // inbound channel message must also see what it carries. Only an explicitly
+  // public message is opened this way, so another operator's internal note on
+  // the same thread stays participant-only.
+  const isParticipant = message.senderUserId === scope.userId || Boolean(recipient)
+  if (!isParticipant) {
+    const mayReadViaChannel = message.visibility === 'public'
+      && await hasChannelThreadReadAccess(ctx, scope, message)
+    if (!mayReadViaChannel) {
+      return Response.json({ error: 'Access denied' }, { status: 403 })
+    }
   }
 
   const attachments = await getMessageAttachments(

package/src/modules/messages/api/[id]/forward-preview/route.ts

@@ -3,7 +3,7 @@ import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { Message, MessageRecipient } from '../../../data/entities'
 import { buildForwardPreview } from '../../../lib/forwarding'
-import { hasOrganizationAccess, resolveMessageContext } from '../../../lib/routeHelpers'
+import { hasChannelThreadReadAccess, hasOrganizationAccess, resolveMessageContext } from '../../../lib/routeHelpers'
 import {
   errorResponseSchema,
   forwardPreviewResponseSchema,
@@ -45,7 +45,13 @@ export async function GET(req: Request, { params }: { params: { id: string } })
 
   const isSender = message.senderUserId === scope.userId
   const isRecipient = Boolean(recipient)
-  if (!isSender && !isRecipient) {
+  // Mirrors `messages.messages.forward` (#6355): an operator working a channel
+  // thread may forward its public messages, and the preview must show the same
+  // conversation the forward will carry.
+  const viaChannelThread = !isSender && !isRecipient
+    && message.visibility === 'public'
+    && await hasChannelThreadReadAccess(ctx, scope, message)
+  if (!isSender && !isRecipient && !viaChannelThread) {
     return Response.json({ error: 'Access denied' }, { status: 403 })
   }
 
@@ -54,7 +60,7 @@ export async function GET(req: Request, { params }: { params: { id: string } })
       tenantId: scope.tenantId,
       organizationId: scope.organizationId,
       userId: scope.userId,
-    }, message)
+    }, message, { includePublicThreadMessages: viaChannelThread })
     return Response.json(preview)
   } catch (error) {
     if (error instanceof Error && error.message === 'Forward body exceeds maximum length') {

package/src/modules/messages/api/[id]/route.ts

@@ -5,6 +5,7 @@ import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { applyResponseEnricherToRecord } from '@open-mercato/shared/lib/crud/enricher-runner'
 import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { User } from '../../../auth/data/entities'
 import { Message, MessageObject, MessageRecipient } from '../../data/entities'
 import { updateDraftSchema } from '../../data/validators'
@@ -13,7 +14,12 @@ import { MESSAGE_OPTIMISTIC_LOCK_RESOURCE_KIND } from '../../lib/constants'
 import { getMessageObjectType } from '../../lib/message-objects-registry'
 import { getMessageTypeOrDefault } from '../../lib/message-types-registry'
 import { attachOperationMetadataHeader } from '../../lib/operationMetadata'
-import { hasOrganizationAccess, resolveMessageContext } from '../../lib/routeHelpers'
+import {
+  canPostToChannelThread,
+  hasChannelThreadReadAccess,
+  hasOrganizationAccess,
+  resolveMessageContext,
+} from '../../lib/routeHelpers'
 import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from '../guards'
 import {
   errorResponseSchema,
@@ -106,7 +112,38 @@ export async function GET(req: Request, { params }: { params: { id: string } })
   const isSender = message.senderUserId === scope.userId
   const isRecipient = Boolean(recipient)
 
-  if (!isSender && !isRecipient) {
+  // #5535: a message that arrived over a communication channel has the channel
+  // system user as its sender and, on an unassigned conversation, no recipient
+  // rows — so the participant test below denies every operator and the reply
+  // button is unreachable. For a thread the channels hub owns, that hub's access
+  // rule applies instead; an internal thread resolves to `null` and keeps the
+  // participant rule unchanged.
+  //
+  // `hasChannelThreadReadAccess` feature-gates the fallback before consulting the
+  // hub, because `assertCanAccessChannel` — the rule behind it — deliberately
+  // ignores features and returns for EVERY shared channel; its documented
+  // precondition is a caller the route already feature-gated, and this route is
+  // `requireAuth` only so that a participant can always read their own message.
+  // The gate goes through RBAC, not through `ctx.auth.features` — the session JWT
+  // carries no `features` claim at all, so reading it would deny everyone.
+  const hasChannelThreadAccess = await hasChannelThreadReadAccess(ctx, scope, message)
+
+  if (!isSender && !isRecipient && !hasChannelThreadAccess) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  // Channel access says "you may work this conversation", not "you may read what
+  // other operators kept off it". An internal note stays participant-only however
+  // the caller reached the thread.
+  //
+  // The test is "not explicitly public" rather than "explicitly internal":
+  // `data/validators.ts` refines a compose under `value.visibility ?? 'internal'`
+  // and `composeMessageCommand` persists `input.visibility ?? null`, so a caller
+  // that omits the field files a message the module itself validated as internal
+  // yet stored as `null`. `ingest-inbound-message.ts` stamps the inbound message
+  // `'public'` and the reply/forward commands copy it forward, so the journey
+  // this route exists for is unaffected.
+  if (!isSender && !isRecipient && message.visibility !== 'public') {
     return Response.json({ error: 'Access denied' }, { status: 403 })
   }
 
@@ -153,9 +190,24 @@ export async function GET(req: Request, { params }: { params: { id: string } })
     })
     : []
   const visibleRecipientMessageIds = new Set(visibleRecipientRows.map((item) => item.messageId))
-  const actorVisibleThreadMessages = threadMessages.filter((threadMessage) => (
+  // On a channel-linked thread the conversation IS the thread: the correspondent
+  // is not a platform user, so filtering by participation would hide the inbound
+  // messages and every other operator's answer, leaving the operator looking at
+  // half a conversation (#5535).
+  //
+  // Internal notes are the exception: they are addressed to platform
+  // participants, so they keep the participant rule even on a channel thread.
+  // Same polarity as the direct-read gate above — an absent visibility is
+  // internal by the messages module's own convention, so only an explicitly
+  // public message is shown to a non-participant.
+  const isThreadMessageParticipant = (threadMessage: { id: string; senderUserId?: string | null }) => (
     threadMessage.senderUserId === scope.userId || visibleRecipientMessageIds.has(threadMessage.id)
-  ))
+  )
+  const actorVisibleThreadMessages = hasChannelThreadAccess
+    ? threadMessages.filter((threadMessage) => (
+      threadMessage.visibility === 'public' || isThreadMessageParticipant(threadMessage)
+    ))
+    : threadMessages.filter(isThreadMessageParticipant)
 
   const actorRecipientStatusByMessageId = new Map<string, string>()
   for (const row of visibleRecipientRows) {
@@ -352,6 +404,33 @@ export async function PATCH(req: Request, { params }: { params: { id: string } }
     return Response.json({ error: 'Only draft messages can be edited' }, { status: 409 })
   }
 
+  // `sendAsUser` composes a fresh message rather than updating an existing
+  // one, so sending a saved draft through a connected mailbox is not
+  // implemented yet. Refuse explicitly instead of silently stripping the
+  // field and falling back to the platform sender.
+  if (input.senderChannelId) {
+    const { t } = await resolveTranslations()
+    const errorMessage = t(
+      'messages.errors.senderDraftSendUnsupported',
+      'Sending a saved draft through a connected mailbox is not supported yet.',
+    )
+    return Response.json(
+      { error: errorMessage, fieldErrors: { senderChannelId: errorMessage } },
+      { status: 422 },
+    )
+  }
+
+  // A draft is filed on its parent's thread and skips the compose route's
+  // channel gate, so sending it publicly must pass the same gate (#6432).
+  const finalVisibility = input.visibility !== undefined ? input.visibility : message.visibility
+  if (
+    input.isDraft === false &&
+    finalVisibility === 'public' &&
+    !(await canPostToChannelThread(ctx, scope, message.threadId ?? message.id))
+  ) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
   const guardResult = await runMessageMutationGuards(
     ctx.container,
     {

package/src/modules/messages/api/route.ts

@@ -12,7 +12,7 @@ import {
   resolveCrudCache,
 } from '@open-mercato/shared/lib/crud/cache'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
-import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
 import { User } from '../../auth/data/entities'
 import { Message, MessageObject } from '../data/entities'
@@ -22,12 +22,23 @@ import {
   composeSourceHintSchema,
   resolveComposeSourceChannelType,
 } from '../lib/composeSourceChannelType'
+import { delegateComposeToSender, requiresSenderDelegation } from '../lib/composeSenderDelegation'
+import {
+  EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE,
+  resolveMessageChannelThreadAccess,
+} from '../lib/channelThreadAccess'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { resolveMessageActionData } from '../lib/actions'
 import { MESSAGE_ATTACHMENT_ENTITY_ID } from '../lib/constants'
 import { getMessageType } from '../lib/message-types-registry'
 import { validateMessageObjectsForType } from '../lib/object-validation'
 import { attachOperationMetadataHeader } from '../lib/operationMetadata'
-import { canUseMessageEmailFeature, resolveMessageContext } from '../lib/routeHelpers'
+import {
+  canPostToChannelThread,
+  canUseChannelThreadFallback,
+  canUseMessageEmailFeature,
+  resolveMessageContext,
+} from '../lib/routeHelpers'
 import { applyMessageParticipantScope } from '../lib/participantScope'
 import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from './guards'
 import { findMessageIdsBySearchTokens } from '../lib/searchLookup'
@@ -499,6 +510,77 @@ export async function POST(req: Request) {
     }
   }
 
+  // #5535: composing on a channel conversation without naming a parent message
+  // used to open a brand-new thread. A fresh thread has no `ChannelThreadMapping`,
+  // so the outbound bridge had nothing to route on and the operator got a 201 for
+  // a message that was never delivered — a silent failure worse than a refusal.
+  // Attach the message to the conversation's existing thread instead, and refuse
+  // outright when there is no such thread to attach it to. Only messages meant to
+  // leave the platform are affected: a draft, or an internal note filed against
+  // the same conversation, is never delivered anyway and stays untouched.
+  let composeParentMessageId = input.parentMessageId
+  if (
+    isPublicVisibility &&
+    !input.isDraft &&
+    !input.parentMessageId &&
+    input.sourceEntityType === EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE &&
+    input.sourceEntityId
+  ) {
+    const channelThread = await resolveMessageChannelThreadAccess(
+      ctx.container,
+      { tenantId: scope.tenantId, organizationId: scope.organizationId ?? null },
+      { externalConversationId: input.sourceEntityId },
+      { userId: scope.userId, features: resolveUserFeatures(ctx.auth) },
+    )
+    if (!channelThread) {
+      const { translate } = await resolveTranslations()
+      return Response.json(
+        {
+          error: translate(
+            'messages.errors.conversationHasNoChannelThread',
+            'Conversation has no channel thread to deliver into',
+          ),
+        },
+        { status: 409 },
+      )
+    }
+    if (!channelThread.canAccess || !(await canUseChannelThreadFallback(ctx, scope))) {
+      return Response.json({ error: 'Access denied' }, { status: 403 })
+    }
+    composeParentMessageId = channelThread.messageThreadId
+  }
+
+  // #5645 review: the gate above only runs when the client omits a parent. A
+  // caller-supplied `parentMessageId` reaches `messages.messages.compose`, which
+  // derives the thread from that parent alone — so a public, non-draft message
+  // could be threaded onto a channel-linked conversation and delivered to the
+  // external correspondent without any channel-access check. A tenant-wide
+  // channel accepts delivery from any sender, so `messages.compose` plus a known
+  // message id was enough. Apply the same check to the thread the command will
+  // actually derive. An internal thread, a thread outside the caller's scope,
+  // and an absent hub all resolve to `null` and keep the pre-existing rule.
+  // Both channel branches also require `messages.view`, like reply and forward:
+  // the hub grants every shared channel regardless of features (#6432).
+  if (isPublicVisibility && !input.isDraft && input.parentMessageId) {
+    const em = ctx.container.resolve('em') as EntityManager
+    const parentMessage = await findOneWithDecryption(
+      em,
+      Message,
+      {
+        id: input.parentMessageId,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        deletedAt: null,
+      },
+      undefined,
+      { tenantId: scope.tenantId, organizationId: scope.organizationId },
+    )
+    const parentThreadId = parentMessage?.threadId ?? input.parentMessageId
+    if (!(await canPostToChannelThread(ctx, scope, parentThreadId))) {
+      return Response.json({ error: 'Access denied' }, { status: 403 })
+    }
+  }
+
   const guardResult = await runMessageMutationGuards(
     ctx.container,
     {
@@ -521,9 +603,48 @@ export async function POST(req: Request) {
     )
   }
 
+  // #6258: an explicitly chosen mailbox routes the whole send through the
+  // communication-channels facade, which writes the conversation, thread mapping
+  // and outbound channel link the inbound thread matcher needs. Without the
+  // field this stays the platform-sender path, unchanged.
+  if (requiresSenderDelegation(input)) {
+    const delegated = await delegateComposeToSender(
+      ctx.container,
+      {
+        userId: scope.userId,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId ?? null,
+        auth: ctx.auth ?? null,
+      },
+      { ...input, parentMessageId: composeParentMessageId },
+    )
+    if (!delegated.ok) {
+      return Response.json(
+        { error: delegated.error, fieldErrors: delegated.fieldErrors },
+        { status: delegated.status },
+      )
+    }
+    const delegatedResponse = Response.json(
+      { id: delegated.messageId, threadId: delegated.threadId },
+      { status: 201 },
+    )
+    await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: 'messages.message',
+      resourceId: delegated.messageId,
+      operation: 'create',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+    })
+    return delegatedResponse
+  }
+
   const { result, logEntry } = await commandBus.execute('messages.messages.compose', {
     input: {
       ...input,
+      parentMessageId: composeParentMessageId,
       sendViaEmail,
       tenantId: scope.tenantId,
       organizationId: scope.organizationId,

package/src/modules/messages/commands/messages.ts

@@ -1,6 +1,6 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { z } from 'zod'
-import { registerCommand, type CommandHandler } from '@open-mercato/shared/lib/commands'
+import { registerCommand, type CommandHandler, type CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import { extractUndoPayload, type UndoPayload } from '@open-mercato/shared/lib/commands/undo'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
@@ -13,7 +13,13 @@ import {
   updateDraftSchema,
 } from '../data/validators'
 import { linkAttachmentsToMessage, linkLibraryAttachmentsToMessage, copyAttachmentsForForwardMessages } from '../lib/attachments'
+import {
+  EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE,
+  resolveActorFeatures,
+  resolveMessageChannelThreadAccess,
+} from '../lib/channelThreadAccess'
 import { MESSAGE_ATTACHMENT_ENTITY_ID, MESSAGE_ENTITY_ID } from '../lib/constants'
+import { canUseChannelThreadFallback } from '../lib/routeHelpers'
 import { getMessageTypeOrDefault } from '../lib/message-types-registry'
 import { validateMessageObjectsForType } from '../lib/object-validation'
 import { buildForwardBodyFromLegacyInput, buildForwardPreviewFromThreadSlice, buildForwardThreadSlice } from '../lib/forwarding'
@@ -704,6 +710,50 @@ const updateDraftCommand: CommandHandler<unknown, { ok: true; id: string }> = {
   },
 }
 
+/**
+ * The channel-thread fallback for a non-participant acting on `original`
+ * (#5535): the channels hub decides whether the caller may work the thread.
+ * An internal thread resolves to `null` and denies, leaving the participant
+ * rule in force. Only an explicitly public message qualifies — channel access
+ * never opens another operator's internal note, matching the detail read.
+ *
+ * The same `messages.view` gate as the read routes applies, because the hub
+ * grants every shared channel regardless of features: without it, a caller
+ * holding only `messages.compose` could forward a conversation it may not read
+ * to itself and read it as the recipient.
+ */
+async function canActOnChannelThreadMessage(
+  ctx: CommandRuntimeContext,
+  input: { tenantId: string; organizationId?: string | null; userId: string },
+  original: Message,
+): Promise<boolean> {
+  if (original.visibility !== 'public') return false
+  const scope = { tenantId: input.tenantId, organizationId: input.organizationId ?? null, userId: input.userId }
+  if (!(await canUseChannelThreadFallback(ctx, scope))) return false
+  const channelThread = await resolveMessageChannelThreadAccess(
+    ctx.container,
+    { tenantId: input.tenantId, organizationId: input.organizationId ?? null },
+    { messageThreadId: original.threadId ?? original.id },
+    { userId: input.userId, features: resolveActorFeatures(ctx.auth) },
+  )
+  return channelThread?.canAccess === true
+}
+
+async function isOnChannelThread(
+  ctx: CommandRuntimeContext,
+  input: { tenantId: string; organizationId?: string | null; userId: string },
+  original: Message,
+): Promise<boolean> {
+  if (original.sourceEntityType === EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE) return true
+  const channelThread = await resolveMessageChannelThreadAccess(
+    ctx.container,
+    { tenantId: input.tenantId, organizationId: input.organizationId ?? null },
+    { messageThreadId: original.threadId ?? original.id },
+    { userId: input.userId, features: resolveActorFeatures(ctx.auth) },
+  )
+  return channelThread !== null
+}
+
 const replyMessageCommand: CommandHandler<unknown, { id: string; externalEmail: string | null; recipientUserIds: string[] }> = {
   id: 'messages.messages.reply',
   async execute(rawInput, ctx) {
@@ -715,7 +765,16 @@ const replyMessageCommand: CommandHandler<unknown, { id: string; externalEmail:
       recipientUserId: input.userId,
       deletedAt: null,
     })
-    if (original.senderUserId !== input.userId && !ownRecipient) throw new Error('Access denied')
+    if (original.senderUserId !== input.userId && !ownRecipient) {
+      // A message that arrived over a communication channel has no platform
+      // participant to match: its sender is the channel system user and an
+      // unassigned conversation produces no recipient rows, so the
+      // sender-or-recipient test denies every operator — a tenant admin
+      // included (#5535). For a thread the channels hub owns, that hub's own
+      // access rule is the applicable one; an internal thread resolves to
+      // `null` here and keeps the participant rule unchanged.
+      if (!(await canActOnChannelThreadMessage(ctx, input, original))) throw new Error('Access denied')
+    }
 
     const messageType = getMessageTypeOrDefault(original.type)
     if (messageType.allowReply === false) throw new Error('Reply is not allowed for this message type')
@@ -880,7 +939,12 @@ const forwardMessageCommand: CommandHandler<unknown, { id: string; externalEmail
       recipientUserId: input.userId,
       deletedAt: null,
     })
-    if (original.senderUserId !== input.userId && !isRecipient) throw new Error('Access denied')
+    // Same fallback as the reply command (#6355): an operator who may answer an
+    // inbound channel message may also forward it internally.
+    const viaChannelThread = original.senderUserId !== input.userId && !isRecipient
+    if (viaChannelThread && !(await canActOnChannelThreadMessage(ctx, input, original))) {
+      throw new Error('Access denied')
+    }
 
     const messageType = getMessageTypeOrDefault(original.type)
     if (messageType.allowForward === false) throw new Error('Forward is not allowed for this message type')
@@ -890,7 +954,7 @@ const forwardMessageCommand: CommandHandler<unknown, { id: string; externalEmail
       tenantId: input.tenantId,
       organizationId: input.organizationId,
       userId: input.userId,
-    }, original)
+    }, original, { includePublicThreadMessages: viaChannelThread })
     const generatedPreview = await buildForwardPreviewFromThreadSlice(em, {
       tenantId: input.tenantId,
       organizationId: input.organizationId,
@@ -899,16 +963,26 @@ const forwardMessageCommand: CommandHandler<unknown, { id: string; externalEmail
     const forwardedBody = typeof input.body === 'string'
       ? input.body
       : buildForwardBodyFromLegacyInput(generatedPreview.body, input.additionalBody)
+    // A forward of a channel conversation is addressed to colleagues, never to
+    // the correspondent. The channels bridge already refuses `forwardedFrom`, but
+    // the messages email path would still mail `externalEmail` on
+    // `sendViaEmail` — so the customer's address is not carried onto it.
+    // It is also filed as internal: replies copy their parent's visibility and
+    // carry no `forwardedFrom`, so a public forward made every reply under it
+    // deliverable to the correspondent (#6431, #6428). The bridge routes on the
+    // thread, not the source, and some public messages on a channel thread
+    // carry no source type (an AI or parented compose), so the thread decides.
+    const keepsExternalCorrespondent = !(await isOnChannelThread(ctx, input, original))
     let newMessageId = ''
     let responseExternalEmail: string | null = null
     await em.transactional(async (trx) => {
       const newMessage = trx.create(Message, {
         type: original.type,
-        visibility: original.visibility ?? null,
+        visibility: keepsExternalCorrespondent ? original.visibility ?? null : 'internal',
         sourceEntityType: original.sourceEntityType,
         sourceEntityId: original.sourceEntityId,
-        externalEmail: original.externalEmail,
-        externalName: original.externalName,
+        externalEmail: keepsExternalCorrespondent ? original.externalEmail : null,
+        externalName: keepsExternalCorrespondent ? original.externalName : null,
         threadId: original.threadId ?? original.id,
         parentMessageId: original.id,
         senderUserId: input.userId,