@open-mercato/core 0.8.1-develop.7297.1.67605e74f9 → 0.9.0

package/src/modules/communication_channels/lib/credential-refresh.ts

@@ -37,6 +37,13 @@ export type RefreshCredentialsIfNeededInput = {
   refreshWindowMs?: number
   /** Force a refresh regardless of expiry — used after a 401 response from the provider. */
   force?: boolean
+  /**
+   * How long a pending refresh for this channel is handed to later callers.
+   * Past this deadline later callers stop waiting on it and continue with their
+   * stored credentials; no second refresh starts while it is unsettled.
+   * Defaults to 2 minutes; `Infinity` waits on the pending refresh indefinitely.
+   */
+  inFlightTtlMs?: number
 }
 
 export type RefreshCredentialsIfNeededResult = {
@@ -46,6 +53,7 @@ export type RefreshCredentialsIfNeededResult = {
 }
 
 const DEFAULT_REFRESH_WINDOW_MS = 60_000
+const DEFAULT_IN_FLIGHT_TTL_MS = 120_000
 
 /**
  * In-process single-flight for credential refresh, keyed by `channelId`. The
@@ -56,8 +64,14 @@ const DEFAULT_REFRESH_WINDOW_MS = 60_000
  * flaps the channel to `requires_reauth`. Coalescing concurrent refreshes for
  * the same channel onto one in-flight promise prevents that race for the common
  * single-process case. Entries are deleted in `finally` once settled.
+ *
+ * A refresh that never settles (e.g. a token exchange whose response body is
+ * never closed) would otherwise be handed to every later caller forever, so an
+ * entry older than `inFlightTtlMs` is no longer shared: later callers proceed
+ * with their stored credentials instead of hanging on it.
  */
-const inFlightRefreshes = new Map<string, Promise<RefreshCredentialsIfNeededResult>>()
+type InFlightRefresh = { promise: Promise<RefreshCredentialsIfNeededResult>; startedAt: number }
+const inFlightRefreshes = new Map<string, InFlightRefresh>()
 
 /**
  * Refresh OAuth credentials when an access token is near expiry, or when the
@@ -88,13 +102,21 @@ export async function refreshCredentialsIfNeeded(
   // Coalesce concurrent refreshes for the same channel onto one in-flight
   // promise so rotating refresh tokens are not exchanged twice in parallel.
   const existing = inFlightRefreshes.get(input.channelId)
-  if (existing) return existing
+  if (existing) {
+    const inFlightTtl = input.inFlightTtlMs ?? DEFAULT_IN_FLIGHT_TTL_MS
+    if (Date.now() - existing.startedAt <= inFlightTtl) return existing.promise
+    log(
+      '[communication_channels] credential refresh still pending past its deadline; continuing with stored credentials for channel',
+      input.channelId,
+    )
+    return { refreshed: false, credentials: input.credentials }
+  }
 
   const refreshCredentials = input.adapter.refreshCredentials.bind(input.adapter)
   const refreshPromise = runRefresh(input, refreshCredentials, deps, log).finally(() => {
     inFlightRefreshes.delete(input.channelId)
   })
-  inFlightRefreshes.set(input.channelId, refreshPromise)
+  inFlightRefreshes.set(input.channelId, { promise: refreshPromise, startedAt: Date.now() })
   return refreshPromise
 }
 
@@ -176,8 +198,8 @@ function parseExpiresAt(raw: unknown): Date | null {
 /**
  * Parse a raw `channel_<provider>` client-credential row into the
  * `OAuthClientConfig` shape adapters expect. Returns `undefined` when the row is
- * missing or malformed — adapters then fall back to the deprecated
- * `credentials._client` read path (one minor-release deprecation per Spec A).
+ * missing or malformed — the Gmail adapter then fails refresh (legacy
+ * `credentials._client` fallback was removed — see #3828 / UPGRADE_NOTES).
  */
 function safeParseOAuthClient(raw: unknown): OAuthClientConfig | undefined {
   if (!raw || typeof raw !== 'object') return undefined

package/src/modules/communication_channels/lib/inbound-message-origin.ts

@@ -0,0 +1,62 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { resolveCommunicationChannelsSystemUserId } from './system-user'
+
+/**
+ * Entity type a channel-backed conversation is exposed under on a message's
+ * `sourceEntityType`. Written by `commands/ingest-inbound-message.ts` and
+ * inherited by every operator message composed on the same conversation.
+ */
+export const EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE = 'communication_channels.external_conversation'
+
+/**
+ * Dedup key `ingest-inbound-message` stamps on the platform message it composes,
+ * so a retried ingest reuses the first attempt's message instead of duplicating
+ * it. The `cc:` prefix also identifies the message as ingest-authored — see
+ * {@link isIngestedInboundMessage}.
+ */
+export function buildInboundIdempotencyKey(channelId: string, externalMessageId: string): string {
+  return `cc:${channelId}:${externalMessageId}`
+}
+
+type InboundMessageOriginInput = {
+  message: {
+    senderUserId: string
+    sourceEntityType?: string | null
+    idempotencyKey?: string | null
+  }
+  /** The `MessageChannelLink` already loaded for this message, if any. */
+  existingLink: { direction: 'inbound' | 'outbound' } | null | undefined
+  tenantId: string
+}
+
+/**
+ * Whether a platform message in a channel-linked thread is the one
+ * `ingest-inbound-message` composed for an incoming message — as opposed to a
+ * message an operator wrote in the same conversation.
+ *
+ * The distinction matters because the messages module emits
+ * `messages.message.sent` for both, and only the operator's message may be
+ * delivered outbound. Before #5535 the discriminator was `sourceEntityType`
+ * alone, which every operator reply inherits from the message it answers — so
+ * operator replies were silently dropped along with the ingested messages.
+ *
+ * Three signals, checked cheapest-first, because the ingested message's inbound
+ * `MessageChannelLink` is written *after* the compose command emits its event
+ * and is therefore not guaranteed to be visible yet:
+ *
+ *   1. an inbound `MessageChannelLink` for this message — authoritative;
+ *   2. the `cc:` ingest dedup key ({@link buildInboundIdempotencyKey}) — set
+ *      whenever the provider supplied an external message id;
+ *   3. the tenant's channel system user as the sender — the ingest attribution
+ *      when the conversation has no assigned user.
+ */
+export async function isIngestedInboundMessage(
+  em: EntityManager,
+  { message, existingLink, tenantId }: InboundMessageOriginInput,
+): Promise<boolean> {
+  if (message.sourceEntityType !== EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE) return false
+  if (existingLink?.direction === 'inbound') return true
+  if (typeof message.idempotencyKey === 'string' && message.idempotencyKey.startsWith('cc:')) return true
+  const systemUserId = await resolveCommunicationChannelsSystemUserId(em, tenantId)
+  return message.senderUserId === systemUserId
+}

package/src/modules/communication_channels/lib/oauth-state.ts

@@ -1,4 +1,7 @@
 import crypto from 'node:crypto'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const oauthStateLogger = createLogger('communication_channels').child({ component: 'oauth-state' })
 
 /**
  * OAuth state-cookie helper for the communication_channels hub.
@@ -16,6 +19,13 @@ import crypto from 'node:crypto'
  *   - 5-minute TTL — short window to bound replay surface.
  *   - Payload binds the initiating `userId` so the callback rejects state cookies
  *     used by a different session.
+ *   - Single-use consume-on-read via a short-TTL cache marker keyed by
+ *     `tenantId:state` (see {@link consumeOAuthStateOnce}) so a captured cookie
+ *     cannot re-drive the callback within the TTL. **This guarantee only holds
+ *     across all replicas when `CACHE_STRATEGY=redis`.** With
+ *     `CACHE_STRATEGY=memory` (the default) the marker is process-local — a
+ *     replayed callback that reaches a different replica succeeds within the TTL.
+ *     Multi-replica deployments MUST use a shared cache (`CACHE_STRATEGY=redis`).
  *
  * The output is a base64url string that we set on an HttpOnly + SameSite=Lax cookie.
  * Forgery requires the encryption key (KMS-managed in production).
@@ -33,6 +43,10 @@ export const COMMUNICATION_CHANNELS_OAUTH_STATE_COOKIE_NAME =
 
 export const DEFAULT_OAUTH_RETURN_URL = '/backend/profile/communication-channels'
 
+/** Cache tag for OAuth-state consume markers (invalidation / diagnostics). */
+export const COMMUNICATION_CHANNELS_OAUTH_STATE_CACHE_TAG =
+  'communication_channels:oauth-state'
+
 /** Errors thrown by the helpers. Stable for tests + route mapping. */
 export class OAuthStateError extends Error {
   override name = 'OAuthStateError'
@@ -43,7 +57,8 @@ export class OAuthStateError extends Error {
       | 'invalid_cookie'
       | 'expired'
       | 'user_mismatch'
-      | 'decrypt_failed',
+      | 'decrypt_failed'
+      | 'replay',
   ) {
     super(message)
   }
@@ -75,6 +90,20 @@ export interface OAuthStatePayload {
   extra?: Record<string, unknown>
 }
 
+/**
+ * Minimal cache surface used by {@link consumeOAuthStateOnce}. Matches the
+ * `has` / `set` subset of `@open-mercato/cache`'s `CacheStrategy` so callers
+ * can pass `container.resolve('cache')` directly.
+ */
+export type OAuthStateConsumeStore = {
+  has(key: string): Promise<boolean>
+  set(
+    key: string,
+    value: unknown,
+    options?: { ttl?: number; tags?: string[] },
+  ): Promise<void>
+}
+
 export function isSafeOAuthReturnUrl(value: string | null | undefined): value is string {
   if (typeof value !== 'string') return false
   if (value.length === 0 || value.length > 2048) return false
@@ -121,6 +150,11 @@ function getSecret(): string {
   return fallback
 }
 
+/** Cache key for a consumed OAuth `state` nonce. Exported for tests. */
+export function oauthStateConsumedCacheKey(tenantId: string, state: string): string {
+  return `communication_channels:oauth-state:used:${tenantId}:${state}`
+}
+
 /** Encrypt + sign a state payload. Output is a base64url string suitable for a cookie. */
 export function encryptOAuthState(payload: OAuthStatePayload): string {
   const key = deriveKey(getSecret())
@@ -166,6 +200,9 @@ export function decryptOAuthState(cookie: string): OAuthStatePayload | null {
  * Throws an {@link OAuthStateError} with a stable `code` field on any check
  * failure so route handlers can map to consistent HTTP responses + redirect
  * flash codes.
+ *
+ * Crypto + binding checks only — callers MUST also call
+ * {@link consumeOAuthStateOnce} so the state cannot be replayed within the TTL.
  */
 export function verifyOAuthState(input: {
   cookie: string | null | undefined
@@ -197,6 +234,37 @@ export function verifyOAuthState(input: {
   return payload
 }
 
+/**
+ * Mark a verified OAuth `state` as consumed in a short-TTL store.
+ *
+ * First successful call records a used-marker until `expiresAt` (or 1s minimum).
+ * A second call with the same `state` throws {@link OAuthStateError} `replay`.
+ *
+ * Call immediately after {@link verifyOAuthState} on the callback path so a
+ * captured valid cookie cannot re-drive the flow within the cookie TTL.
+ *
+ * Note: the `has`→`set` pattern is not atomic. Two concurrent callbacks racing
+ * on the same `state` both pass the `has` check and both proceed — the
+ * single-use guarantee requires an atomic `setNx` which `CacheStrategy` does
+ * not currently expose. The race window is milliseconds; document it rather
+ * than silently claiming it is closed.
+ */
+export async function consumeOAuthStateOnce(
+  store: OAuthStateConsumeStore,
+  payload: Pick<OAuthStatePayload, 'state' | 'expiresAt' | 'tenantId'>,
+  now: number = Date.now(),
+): Promise<void> {
+  const key = oauthStateConsumedCacheKey(payload.tenantId, payload.state)
+  if (await store.has(key)) {
+    throw new OAuthStateError('State cookie already used', 'replay')
+  }
+  const ttl = Math.max(payload.expiresAt - now, 1_000)
+  await store.set(key, 1, {
+    ttl,
+    tags: [`${COMMUNICATION_CHANNELS_OAUTH_STATE_CACHE_TAG}:${payload.tenantId}`],
+  })
+}
+
 /**
  * Create a fresh state payload + matching `state` query parameter. PKCE
  * verifiers are NOT generated here — the provider adapter decides whether it
@@ -226,3 +294,30 @@ export function createOAuthState(params: {
   const cookie = encryptOAuthState(payload)
   return { payload, cookie, stateParam: state }
 }
+
+let memoryCacheStartupWarningEmitted = false
+
+/**
+ * Emit a one-time startup warning unless the cache strategy is redis. Every other
+ * strategy (memory, sqlite, jsonfile) keeps replay markers per process or per node,
+ * so the single-use guarantee only holds across replicas on redis.
+ */
+export function emitOAuthStateMemoryCacheStartupWarningIfNeeded(
+  env: NodeJS.ProcessEnv = process.env,
+): void {
+  if (memoryCacheStartupWarningEmitted) return
+  const strategy = (env.CACHE_STRATEGY ?? 'memory').trim().toLowerCase()
+  if (strategy === 'redis') return
+  memoryCacheStartupWarningEmitted = true
+  oauthStateLogger.warn(
+    `OAuth state single-use protection needs a store shared across replicas. CACHE_STRATEGY=${strategy} is per-process or per-node; multi-replica deployments MUST set CACHE_STRATEGY=redis.`,
+    { context: 'startup', startup: true, cacheStrategy: strategy },
+  )
+}
+
+/** Test helper — reset the one-time startup warning latch. */
+export function resetOAuthStateMemoryCacheStartupWarningForTests(): void {
+  memoryCacheStartupWarningEmitted = false
+}
+
+emitOAuthStateMemoryCacheStartupWarningIfNeeded()

package/src/modules/communication_channels/lib/outbound-delivery-intent.ts

@@ -0,0 +1,57 @@
+type OutboundDeliveryIntentInput = {
+  message: {
+    visibility?: 'public' | 'internal' | null
+  }
+  /**
+   * `forwardedFrom` as carried by the `messages.message.sent` payload — the id of
+   * the message a `messages.messages.forward` was built from, absent on every
+   * other compose path.
+   */
+  forwardedFromMessageId?: string | null
+}
+
+/**
+ * Whether a platform message in a channel-linked thread was meant to leave the
+ * platform, i.e. to be delivered to the external correspondent.
+ *
+ * The outbound bridge's origin test (`isIngestedInboundMessage`) answers a
+ * narrower question — "did the ingest command compose this?" — and every
+ * *internal* message sharing the channel thread falls between the two. This
+ * predicate is the intent half, and it fails closed: only a message that is
+ * explicitly public and not a forward is delivered.
+ *
+ * Two signals:
+ *
+ *   1. **`visibility !== 'public'`** — an internal note, or an internal compose
+ *      filed against the conversation with an explicit `parentMessageId`.
+ *      `api/route.ts` deliberately leaves such a compose on its own thread, and
+ *      it must not be delivered either. The test is "not explicitly public"
+ *      rather than "explicitly internal" because the messages module treats an
+ *      **absent** visibility as internal — `data/validators.ts` refines a
+ *      compose under `value.visibility ?? 'internal'`, `composeMessageCommand`
+ *      persists `input.visibility ?? null`, and `lib/composeSourceChannelType.ts`
+ *      asks `raw.visibility !== 'public'`. A caller that omits the field
+ *      therefore stores `null` on a channel-linked thread, and reading that as
+ *      public would deliver an internal note to the correspondent.
+ *   2. **`forwardedFromMessageId`** — a forward. `forwardMessageCommand` files a
+ *      forward on a channel thread as internal, which also keeps every reply
+ *      under it internal (#6431). This signal is the backstop for the forward
+ *      row itself if it ever reaches the bridge public; it cannot see replies
+ *      under such a forward, which carry no `forwardedFrom`.
+ *
+ * Signal 2 reads the event payload rather than the `messages` row on purpose:
+ * nothing persisted distinguishes a forward from a reply — both set
+ * `parentMessageId` to the message they answer, and a `replyAll` reply carries
+ * platform recipient rows just like a forward does — so the recorded intent in
+ * the `messages.message.sent` payload is the only precise discriminator. Its
+ * absence reads as "not a forward", which is why signal 1 is checked
+ * independently rather than as a fallback.
+ */
+export function isOutboundDeliveryIntended({
+  message,
+  forwardedFromMessageId,
+}: OutboundDeliveryIntentInput): boolean {
+  if (message.visibility !== 'public') return false
+  if (typeof forwardedFromMessageId === 'string' && forwardedFromMessageId.length > 0) return false
+  return true
+}

package/src/modules/communication_channels/lib/send-as-user.ts

@@ -30,7 +30,7 @@ export type SendAsUserInput = {
   cc?: string[]
   bcc?: string[]
   subject: string
-  body: { plain?: string; html?: string }
+  body: { plain?: string; html?: string; bodyFormat?: 'text' | 'markdown' }
   inReplyTo?: string
   references?: string[]
   /**
@@ -136,7 +136,7 @@ export async function sendAsUser(
     recipients: [],
     subject: input.subject,
     body: messageBody,
-    bodyFormat: 'text' as const,
+    bodyFormat: input.body.bodyFormat === 'markdown' ? ('markdown' as const) : ('text' as const),
     priority: 'normal' as const,
     sendViaEmail: false,
     parentMessageId: input.parentMessageId,

package/src/modules/communication_channels/migrations/.snapshot-open-mercato.json

@@ -983,6 +983,23 @@
           "collation": null,
           "enumItems": [],
           "mappedType": "uuid"
+        },
+        "visibility": {
+          "name": "visibility",
+          "type": "text",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": false,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": "'private'",
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "text"
         }
       },
       "indexes": [
@@ -2148,4 +2165,4 @@
   ],
   "views": [],
   "nativeEnums": {}
-}
+}

package/src/modules/communication_channels/migrations/Migration20260825141000_communication_channels.ts

@@ -0,0 +1,22 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260825141000_communication_channels extends Migration {
+
+  override async up(): Promise<void> {
+    this.addSql(`alter table "communication_channels" add column "visibility" text not null default 'private';`);
+
+    // MUST run in the same migration as the column addition.
+    //
+    // Tenant-scoped channels (`user_id IS NULL`) are shared by definition — that
+    // is what "tenant-wide" has always meant, and it is how every existing
+    // FCM/APNs/Expo push channel is configured. Landing the column with a bare
+    // DEFAULT 'private' would silently un-share all of them on deploy, which is
+    // an availability regression, not just a privacy one.
+    this.addSql(`update "communication_channels" set "visibility" = 'shared' where "user_id" is null;`);
+  }
+
+  override async down(): Promise<void> {
+    this.addSql(`alter table "communication_channels" drop column if exists "visibility";`);
+  }
+
+}

package/src/modules/communication_channels/setup.ts

@@ -79,6 +79,7 @@ export const setup: ModuleSetupConfig = {
       'communication_channels.react',
       'communication_channels.assign',
       'communication_channels.connect_user_channel',
+      'communication_channels.share_own_channel',
       'communication_channels.connect_tenant_channel',
       'communication_channels.admin',
       'communication_channels.channel.import_history',
@@ -90,6 +91,7 @@ export const setup: ModuleSetupConfig = {
       'communication_channels.react',
       'communication_channels.assign',
       'communication_channels.connect_user_channel',
+      'communication_channels.share_own_channel',
       'communication_channels.connect_tenant_channel',
       'communication_channels.admin',
       'communication_channels.channel.import_history',
@@ -101,11 +103,13 @@ export const setup: ModuleSetupConfig = {
       'communication_channels.react',
       'communication_channels.assign',
       'communication_channels.connect_user_channel',
+      'communication_channels.share_own_channel',
     ],
     employee: [
       'communication_channels.view',
       'communication_channels.react',
       'communication_channels.connect_user_channel',
+      'communication_channels.share_own_channel',
     ],
   },
 

package/src/modules/communication_channels/subscribers/outbound-bridge.ts

@@ -2,6 +2,9 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { ChannelThreadMapping, CommunicationChannel, MessageChannelLink } from '../data/entities'
 import { Message } from '../../messages/data/entities'
+import { SEND_AS_USER_SOURCE_ENTITY_TYPE } from '../../messages/lib/messageSourceEntityTypes'
+import { isIngestedInboundMessage } from '../lib/inbound-message-origin'
+import { isOutboundDeliveryIntended } from '../lib/outbound-delivery-intent'
 import { COMMUNICATION_CHANNELS_QUEUES, getCommunicationChannelsQueue } from '../lib/queue'
 import type { OutboundDeliveryPayload } from '../workers/outbound-delivery'
 
@@ -38,6 +41,12 @@ type MessageSentPayload = {
   recipientUserIds?: string[]
   sendViaEmail?: boolean
   externalEmail?: string | null
+  /**
+   * Set by `messages.messages.forward` to the message the forward was built
+   * from. The only place an operator's delivery intent is recorded — see
+   * `lib/outbound-delivery-intent`.
+   */
+  forwardedFrom?: string | null
   tenantId: string
   organizationId?: string | null
 }
@@ -85,17 +94,16 @@ export default async function handler(
     dscope,
   )
   if (!message) return
-  if (message.sourceEntityType === 'communication_channels.send_as_user') {
+  if (message.sourceEntityType === SEND_AS_USER_SOURCE_ENTITY_TYPE) {
     return
   }
-  // Inbound ingest path: when `ingest-inbound-message` composes a new platform
-  // Message for an incoming email, the messages module also emits
-  // `messages.message.sent` (the Message row is fresh and marked sent). Without
-  // this guard, we'd treat it as outbound and queue a redundant SMTP delivery —
-  // which fails because inbound MCLs carry recipient info in `channelPayload`,
-  // not `channelMetadata`, and the failure marker then leaks back onto the
-  // inbound link itself.
-  if (message.sourceEntityType === 'communication_channels.external_conversation') {
+  // (a1) Intent gate. The origin test at (c1) answers "did the ingest command
+  // compose this?"; this one answers "did an operator mean this to leave the
+  // platform?". Between them sits every internal message that shares the channel
+  // thread — most importantly a forward, whose body is the quoted conversation
+  // plus the operator's own commentary about the correspondent. Free (no query),
+  // so it runs before the mapping lookup.
+  if (!isOutboundDeliveryIntended({ message, forwardedFromMessageId: payload.forwardedFrom })) {
     return
   }
   if (!message.threadId) return // Internal-only; no channel routing.
@@ -126,6 +134,23 @@ export default async function handler(
     undefined,
     dscope,
   )
+  // (c1) Inbound ingest path: when `ingest-inbound-message` composes a platform
+  // Message for an incoming message, the messages module also emits
+  // `messages.message.sent` (the Message row is fresh and marked sent). Without
+  // this guard we'd treat it as outbound and queue a redundant delivery — which
+  // fails because inbound MCLs carry recipient info in `channelPayload`, not
+  // `channelMetadata`, and the failure marker then leaks back onto the inbound
+  // link itself.
+  //
+  // The guard used to be `sourceEntityType === external_conversation`, but an
+  // operator's reply inherits that value from the message it answers, so every
+  // operator message in a channel thread was dropped here — silently, which is
+  // the delivery half of #5535. `isIngestedInboundMessage` distinguishes the
+  // ingested message from an operator's own message in the same conversation.
+  if (await isIngestedInboundMessage(em, { message, existingLink, tenantId: payload.tenantId })) {
+    return
+  }
+
   if (
     existingLink &&
     (existingLink.deliveryStatus === 'queued' ||

package/src/modules/communication_channels/workers/gmail-history-sync.ts

@@ -126,7 +126,7 @@ export default async function handle(
   try {
     page = await adapter.applyPushNotification({
       credentials,
-      scope: { tenantId: scope.tenantId, organizationId: scope.organizationId ?? scope.tenantId },
+      scope: { tenantId: scope.tenantId, organizationId: channel.organizationId ?? null },
       channelState: (channel.channelState as Record<string, unknown> | null) ?? {},
       notification: job.payload.notification as unknown as Record<string, unknown>,
     })

package/src/modules/communication_channels/workers/poll-channel.ts

@@ -186,7 +186,7 @@ export default async function handle(
       channelState: (channel.channelState as Record<string, unknown> | null) ?? undefined,
       scope: {
         tenantId: scope.tenantId,
-        organizationId: scope.organizationId ?? scope.tenantId,
+        organizationId: channel.organizationId ?? null,
       },
       // `contactFilter.sinceDays` is a hint to provider adapters about how far
       // back to look on first-poll bootstrap. For UID-incremental polls (every

package/src/modules/communication_channels/workers/reaction-processor.ts

@@ -203,7 +203,7 @@ async function callAdapterOutbound(
         credentials,
         scope: {
           tenantId: payload.scope.tenantId,
-          organizationId: payload.scope.organizationId ?? payload.scope.tenantId,
+          organizationId: channel.organizationId ?? null,
         },
       })
     } else {
@@ -218,7 +218,7 @@ async function callAdapterOutbound(
         credentials,
         scope: {
           tenantId: payload.scope.tenantId,
-          organizationId: payload.scope.organizationId ?? payload.scope.tenantId,
+          organizationId: channel.organizationId ?? null,
         },
       })
     }

package/src/modules/configs/api/upgrade-actions/route.ts

@@ -5,6 +5,7 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { resolveFeatureCheckContext } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { executeUpgradeAction, getCurrentVersion, isUpgradeActionsEnabled, listPendingUpgradeActions } from '../../services/upgradeActionsService'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import {
@@ -40,7 +41,7 @@ async function resolveScope(
   const container = await createRequestContainer()
   const featureContext = await resolveFeatureCheckContext({ container, auth, request: req })
   const tenantId = featureContext.scope.tenantId ?? auth.tenantId ?? null
-  const organizationId = featureContext.organizationId ?? featureContext.scope.selectedId ?? auth.orgId ?? null
+  const organizationId = featureContext.organizationId ?? resolveSingleOrganizationIdOrDeny(featureContext.scope, auth) ?? null
   if (!tenantId || !organizationId) {
     const message = translate(
       'upgrades.scopeRequired',

package/src/modules/configs/cli.ts

@@ -4,7 +4,7 @@ import { runWithCacheTenant, type CacheStrategy } from '@open-mercato/cache'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { ModuleConfigService } from './lib/module-config-service'
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
-import { DEFAULT_NOTIFICATION_DELIVERY_CONFIG, NOTIFICATIONS_DELIVERY_CONFIG_KEY } from '../notifications/lib/deliveryConfig'
+import { STORED_DEFAULT_NOTIFICATION_DELIVERY_CONFIG, NOTIFICATIONS_DELIVERY_CONFIG_KEY } from '../notifications/lib/deliveryConfig'
 import { Tenant } from '../directory/data/entities'
 import {
   collectCacheStats,
@@ -325,7 +325,7 @@ const restoreDefaults: ModuleCli = {
           {
             moduleId: 'notifications',
             name: NOTIFICATIONS_DELIVERY_CONFIG_KEY,
-            value: DEFAULT_NOTIFICATION_DELIVERY_CONFIG,
+            value: STORED_DEFAULT_NOTIFICATION_DELIVERY_CONFIG,
           },
         ],
         { force: true },

package/src/modules/configs/i18n/de.json

@@ -149,6 +149,8 @@
   "configs.systemStatus.variables.cacheStrategy.label": "Cache-Strategie",
   "configs.systemStatus.variables.cacheTtl.description": "Standard-Cache-Gültigkeitsdauer in Millisekunden.",
   "configs.systemStatus.variables.cacheTtl.label": "Cache-TTL",
+  "configs.systemStatus.variables.databaseUrl.description": "Datenbank-Verbindungs-URL mit maskierten Zugangsdaten.",
+  "configs.systemStatus.variables.databaseUrl.label": "Datenbank-URL",
   "configs.systemStatus.variables.enableCrudApiCache.description": "CRUD-API-Antwort-Cache-Schicht aktivieren.",
   "configs.systemStatus.variables.enableCrudApiCache.label": "CRUD-API-Cache",
   "configs.systemStatus.variables.entitiesBackcompatEav.description": "Benutzerdefinierte Entitätsschreibvorgänge in die Legacy-EAV-Tabellen spiegeln.",

package/src/modules/configs/i18n/en.json

@@ -149,6 +149,8 @@
   "configs.systemStatus.variables.cacheStrategy.label": "Cache strategy",
   "configs.systemStatus.variables.cacheTtl.description": "Default cache time-to-live in milliseconds.",
   "configs.systemStatus.variables.cacheTtl.label": "Cache TTL",
+  "configs.systemStatus.variables.databaseUrl.description": "Database connection URL with credentials masked.",
+  "configs.systemStatus.variables.databaseUrl.label": "Database URL",
   "configs.systemStatus.variables.enableCrudApiCache.description": "Enable the CRUD API response cache layer.",
   "configs.systemStatus.variables.enableCrudApiCache.label": "CRUD API cache",
   "configs.systemStatus.variables.entitiesBackcompatEav.description": "Mirror custom entity writes into the legacy EAV tables.",

package/src/modules/configs/i18n/es.json

@@ -149,6 +149,8 @@
   "configs.systemStatus.variables.cacheStrategy.label": "Estrategia de caché",
   "configs.systemStatus.variables.cacheTtl.description": "Tiempo de vida predeterminado del caché en milisegundos.",
   "configs.systemStatus.variables.cacheTtl.label": "TTL del caché",
+  "configs.systemStatus.variables.databaseUrl.description": "URL de conexión a la base de datos con las credenciales ocultas.",
+  "configs.systemStatus.variables.databaseUrl.label": "URL de la base de datos",
   "configs.systemStatus.variables.enableCrudApiCache.description": "Habilitar la capa de caché de respuestas de la API CRUD.",
   "configs.systemStatus.variables.enableCrudApiCache.label": "Caché de API CRUD",
   "configs.systemStatus.variables.entitiesBackcompatEav.description": "Replicar escrituras de entidades personalizadas en las tablas EAV heredadas.",

package/src/modules/configs/i18n/ko.json

@@ -149,6 +149,8 @@
   "configs.systemStatus.variables.cacheStrategy.label": "캐시 전략",
   "configs.systemStatus.variables.cacheTtl.description": "기본 캐시 유효 시간(밀리초)입니다.",
   "configs.systemStatus.variables.cacheTtl.label": "캐시 TTL",
+  "configs.systemStatus.variables.databaseUrl.description": "자격 증명이 가려진 데이터베이스 연결 URL입니다.",
+  "configs.systemStatus.variables.databaseUrl.label": "데이터베이스 URL",
   "configs.systemStatus.variables.enableCrudApiCache.description": "CRUD API 응답 캐시 계층을 활성화합니다.",
   "configs.systemStatus.variables.enableCrudApiCache.label": "CRUD API 캐시",
   "configs.systemStatus.variables.entitiesBackcompatEav.description": "커스텀 엔터티 쓰기를 레거시 EAV 테이블에 미러링합니다.",

package/src/modules/configs/i18n/pl.json

@@ -149,6 +149,8 @@
   "configs.systemStatus.variables.cacheStrategy.label": "Strategia cache",
   "configs.systemStatus.variables.cacheTtl.description": "Domyślny czas życia cache w milisekundach.",
   "configs.systemStatus.variables.cacheTtl.label": "TTL cache",
+  "configs.systemStatus.variables.databaseUrl.description": "Adres URL połączenia z bazą danych z ukrytymi danymi uwierzytelniającymi.",
+  "configs.systemStatus.variables.databaseUrl.label": "Adres URL bazy danych",
   "configs.systemStatus.variables.enableCrudApiCache.description": "Włącza warstwę buforowania odpowiedzi API CRUD.",
   "configs.systemStatus.variables.enableCrudApiCache.label": "Cache API CRUD",
   "configs.systemStatus.variables.entitiesBackcompatEav.description": "Odbija zapisy niestandardowych encji do legacy tabel EAV.",