@open-mercato/core 0.9.1-develop.7515.1.e2712c8b00 → 0.9.1-develop.7516.1.176184247d

package/src/modules/customers/i18n/en.json

@@ -1691,6 +1691,7 @@
   "customers.email.conversationShare.sharedByTeammate": "Shared by a teammate",
   "customers.email.errors.deliveryFailed": "Delivery failed — not sent",
   "customers.email.errors.flipFailed": "Visibility update failed",
+  "customers.email.errors.parentMessageNotFound": "The email you are replying to was not found",
   "customers.email.errors.sendFailed": "Send failed",
   "customers.email.sync.button": "Sync",
   "customers.email.sync.failed": "Failed to sync mailbox",

package/src/modules/customers/i18n/es.json

@@ -1691,6 +1691,7 @@
   "customers.email.conversationShare.sharedByTeammate": "Compartido por un compañero",
   "customers.email.errors.deliveryFailed": "Error de entrega: no enviado",
   "customers.email.errors.flipFailed": "Error al actualizar la visibilidad",
+  "customers.email.errors.parentMessageNotFound": "No se encontró el correo al que está respondiendo",
   "customers.email.errors.sendFailed": "Error al enviar",
   "customers.email.sync.button": "Sincronizar",
   "customers.email.sync.failed": "No se pudo sincronizar el buzón",

package/src/modules/customers/i18n/ko.json

@@ -1691,6 +1691,7 @@
   "customers.email.conversationShare.sharedByTeammate": "동료가 공유",
   "customers.email.errors.deliveryFailed": "전송 실패 — 발송되지 않음",
   "customers.email.errors.flipFailed": "공개 범위 업데이트 실패",
+  "customers.email.errors.parentMessageNotFound": "답장하려는 이메일을 찾을 수 없습니다",
   "customers.email.errors.sendFailed": "전송 실패",
   "customers.email.sync.button": "동기화",
   "customers.email.sync.failed": "메일함 동기화에 실패했습니다",

package/src/modules/customers/i18n/pl.json

@@ -1691,6 +1691,7 @@
   "customers.email.conversationShare.sharedByTeammate": "Udostępnione przez współpracownika",
   "customers.email.errors.deliveryFailed": "Dostarczanie nie powiodło się – nie wysłano",
   "customers.email.errors.flipFailed": "Aktualizacja widoczności nieudana",
+  "customers.email.errors.parentMessageNotFound": "Nie znaleziono e-maila, na który odpowiadasz",
   "customers.email.errors.sendFailed": "Wysyłanie nieudane",
   "customers.email.sync.button": "Synchronizuj",
   "customers.email.sync.failed": "Nie udało się zsynchronizować skrzynki",

package/src/modules/customers/lib/personEmailThreads.ts

@@ -378,3 +378,64 @@ export async function buildPersonEmailThreads(
   threads.sort((a, b) => b.lastMessageAt.localeCompare(a.lastMessageAt))
   return threads.slice(0, maxThreads)
 }
+
+export type PersonEmailMessageAccessOptions = Pick<
+  BuildPersonEmailThreadsOptions,
+  'personId' | 'tenantId' | 'organizationId' | 'viewerUserId' | 'userFeatures' | 'sharedConversations' | 'sharedChannelIds'
+> & {
+  /** Open Mercato `messages.message` id the caller wants to reply to. */
+  messageId: string
+}
+
+/**
+ * Whether `messageId` is on this Person's email history as the viewer sees it —
+ * i.e. whether {@link buildPersonEmailThreads} would show it to them.
+ *
+ * Walks the same anchor (email `CustomerInteraction` → `MessageChannelLink` →
+ * message) with the same scope and the same visibility predicate, so a reply
+ * from the Person page can only name a parent the Emails tab could have shown:
+ * the viewer's own mail, shared or legacy mail, a conversation shared for THIS
+ * Person, or a shared team mailbox. Callers remain responsible for resolving the
+ * Person in scope first.
+ */
+export async function isMessageOnPersonEmailHistory(
+  em: EntityManager,
+  opts: PersonEmailMessageAccessOptions,
+): Promise<boolean> {
+  const { personId, tenantId, organizationId, messageId } = opts
+  const dscope = { tenantId, organizationId: organizationId ?? null }
+
+  const linkWhere: JsonRecord = { messageId, tenantId }
+  if (organizationId) linkWhere.organizationId = organizationId
+  const links = (await findWithDecryption(
+    em,
+    'MessageChannelLink' as never,
+    linkWhere as never,
+    undefined,
+    dscope,
+  )) as JsonRecord[]
+  const linkIds = links
+    .map((link) => (typeof link.id === 'string' ? (link.id as string) : null))
+    .filter((value): value is string => !!value)
+  if (linkIds.length === 0) return false
+
+  const interactionWhere: JsonRecord = {
+    entity: personId,
+    interactionType: 'email',
+    deletedAt: null,
+    tenantId,
+    externalMessageId: { $in: linkIds },
+  }
+  if (organizationId) interactionWhere.organizationId = organizationId
+  Object.assign(
+    interactionWhere,
+    buildEmailVisibilityMikroFilter({
+      currentUserId: opts.viewerUserId,
+      userFeatures: opts.userFeatures,
+      sharedConversations: opts.sharedConversations,
+      sharedChannelIds: opts.sharedChannelIds,
+    }),
+  )
+  const visible = await em.count(CustomerInteraction, interactionWhere as never)
+  return visible > 0
+}

package/src/modules/messages/api/[id]/route.ts

@@ -16,9 +16,9 @@ import { getMessageTypeOrDefault } from '../../lib/message-types-registry'
 import { attachOperationMetadataHeader } from '../../lib/operationMetadata'
 import {
   canPostToChannelThread,
-  hasChannelThreadReadAccess,
   hasOrganizationAccess,
   resolveMessageContext,
+  resolveMessageReadAccess,
 } from '../../lib/routeHelpers'
 import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from '../guards'
 import {
@@ -103,13 +103,7 @@ export async function GET(req: Request, { params }: { params: { id: string } })
     return Response.json({ error: 'Access denied' }, { status: 403 })
   }
 
-  const recipient = await em.findOne(MessageRecipient, {
-    messageId: params.id,
-    recipientUserId: scope.userId,
-    deletedAt: null,
-  })
-
-  const isSender = message.senderUserId === scope.userId
+  const { recipient, isSender, hasChannelThreadAccess } = await resolveMessageReadAccess(ctx, scope, message)
   const isRecipient = Boolean(recipient)
 
   // #5535: a message that arrived over a communication channel has the channel
@@ -126,7 +120,6 @@ export async function GET(req: Request, { params }: { params: { id: string } })
   // `requireAuth` only so that a participant can always read their own message.
   // The gate goes through RBAC, not through `ctx.auth.features` — the session JWT
   // carries no `features` claim at all, so reading it would deny everyone.
-  const hasChannelThreadAccess = await hasChannelThreadReadAccess(ctx, scope, message)
 
   if (!isSender && !isRecipient && !hasChannelThreadAccess) {
     return Response.json({ error: 'Access denied' }, { status: 403 })

package/src/modules/messages/api/route.ts

@@ -12,7 +12,7 @@ import {
   resolveCrudCache,
 } from '@open-mercato/shared/lib/crud/cache'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
-import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
 import { User } from '../../auth/data/entities'
 import { Message, MessageObject } from '../data/entities'
@@ -36,6 +36,7 @@ import { attachOperationMetadataHeader } from '../lib/operationMetadata'
 import {
   canPostToChannelThread,
   canUseChannelThreadFallback,
+  resolveReplyParentMessage,
   canUseMessageEmailFeature,
   resolveMessageContext,
 } from '../lib/routeHelpers'
@@ -46,6 +47,7 @@ import { MessageCommandExecuteResult } from '../commands/shared'
 import {
   composeMessageRequestSchema as composeSchema,
   composeResponseSchema,
+  errorResponseSchema,
   listMessagesSchema as listSchema,
   messageListItemSchema,
 } from './openapi'
@@ -510,6 +512,35 @@ export async function POST(req: Request) {
     }
   }
 
+  // A parent decides which conversation the new message joins, so it is held to
+  // the same rule as reading it: knowing a message id is not enough to thread
+  // onto someone else's conversation. Checked on the parent the client sent, for
+  // drafts and every visibility, before any guard, delegation or write runs.
+  let replyParent: Message | null = null
+  if (input.parentMessageId) {
+    const resolution = await resolveReplyParentMessage(
+      ctx,
+      { tenantId: scope.tenantId, organizationId: scope.organizationId ?? null, userId: scope.userId },
+      input.parentMessageId,
+    )
+    if (resolution.status === 'not_found') {
+      const { translate } = await resolveTranslations()
+      return Response.json(
+        {
+          error: translate(
+            'messages.errors.parentMessageNotFound',
+            'The message you are replying to was not found',
+          ),
+        },
+        { status: 404 },
+      )
+    }
+    if (resolution.status === 'forbidden') {
+      return Response.json({ error: 'Access denied' }, { status: 403 })
+    }
+    replyParent = resolution.message
+  }
+
   // #5535: composing on a channel conversation without naming a parent message
   // used to open a brand-new thread. A fresh thread has no `ChannelThreadMapping`,
   // so the outbound bridge had nothing to route on and the operator got a 201 for
@@ -555,27 +586,14 @@ export async function POST(req: Request) {
   // derives the thread from that parent alone — so a public, non-draft message
   // could be threaded onto a channel-linked conversation and delivered to the
   // external correspondent without any channel-access check. A tenant-wide
-  // channel accepts delivery from any sender, so `messages.compose` plus a known
-  // message id was enough. Apply the same check to the thread the command will
-  // actually derive. An internal thread, a thread outside the caller's scope,
-  // and an absent hub all resolve to `null` and keep the pre-existing rule.
+  // channel accepts delivery from any sender, so reading a message is not
+  // enough to post onto its thread. Apply the same check to the thread the
+  // command will actually derive. An internal thread and an absent hub resolve
+  // to `null` and keep the pre-existing rule.
   // Both channel branches also require `messages.view`, like reply and forward:
   // the hub grants every shared channel regardless of features (#6432).
-  if (isPublicVisibility && !input.isDraft && input.parentMessageId) {
-    const em = ctx.container.resolve('em') as EntityManager
-    const parentMessage = await findOneWithDecryption(
-      em,
-      Message,
-      {
-        id: input.parentMessageId,
-        tenantId: scope.tenantId,
-        organizationId: scope.organizationId,
-        deletedAt: null,
-      },
-      undefined,
-      { tenantId: scope.tenantId, organizationId: scope.organizationId },
-    )
-    const parentThreadId = parentMessage?.threadId ?? input.parentMessageId
+  if (isPublicVisibility && !input.isDraft && replyParent) {
+    const parentThreadId = replyParent.threadId ?? replyParent.id
     if (!(await canPostToChannelThread(ctx, scope, parentThreadId))) {
       return Response.json({ error: 'Access denied' }, { status: 403 })
     }
@@ -711,6 +729,10 @@ export const openApi: OpenApiRouteDoc = {
           schema: composeResponseSchema,
         },
       ],
+      errors: [
+        { status: 403, description: 'Access denied, including a parentMessageId the caller cannot read', schema: errorResponseSchema },
+        { status: 404, description: 'parentMessageId is unknown, deleted, or outside the caller organization', schema: errorResponseSchema },
+      ],
     },
   },
 }

package/src/modules/messages/commands/messages.ts

@@ -266,6 +266,13 @@ async function buildComposeResultFromExisting(
   }
 }
 
+/**
+ * `parentMessageId` is trusted: the thread is derived from it without a read
+ * check, because the acting `userId` is itself an input and server-side callers
+ * (channel ingest) pass parents the actor is not a participant of. Every surface
+ * that accepts a parent from a caller MUST resolve it against its own read rule
+ * first (`resolveReplyParentMessage` for the messages API).
+ */
 const composeMessageCommand: CommandHandler<unknown, { id: string; threadId: string | null; externalEmail: string | null; isDraft: boolean; recipientUserIds: string[]; deduplicated?: boolean }> = {
   id: 'messages.messages.compose',
   async execute(rawInput, ctx) {

package/src/modules/messages/i18n/de.json

@@ -130,6 +130,7 @@
   "messages.errors.noExternalEmail": "Bitte gib eine gültige externe E-Mail ein.",
   "messages.errors.noRecipients": "Füge mindestens einen Empfänger hinzu.",
   "messages.errors.noSubject": "Bitte Betreff eingeben.",
+  "messages.errors.parentMessageNotFound": "Die Nachricht, auf die Sie antworten, wurde nicht gefunden",
   "messages.errors.sendFailed": "Nachricht konnte nicht gesendet werden.",
   "messages.errors.senderDraftSendUnsupported": "Das Senden eines gespeicherten Entwurfs über ein verbundenes Postfach wird noch nicht unterstützt.",
   "messages.errors.senderPayloadUnsupported": "Der Versand aus dem eigenen Postfach unterstützt noch keine Anhänge oder verknüpften Datensätze.",

package/src/modules/messages/i18n/en.json

@@ -130,6 +130,7 @@
   "messages.errors.noExternalEmail": "Please enter a valid external email.",
   "messages.errors.noRecipients": "Please add at least one recipient.",
   "messages.errors.noSubject": "Please enter a subject.",
+  "messages.errors.parentMessageNotFound": "The message you are replying to was not found",
   "messages.errors.sendFailed": "Failed to send message.",
   "messages.errors.senderDraftSendUnsupported": "Sending a saved draft through a connected mailbox is not supported yet.",
   "messages.errors.senderPayloadUnsupported": "Sending from your own mailbox does not support attachments or linked records yet.",

package/src/modules/messages/i18n/es.json

@@ -130,6 +130,7 @@
   "messages.errors.noExternalEmail": "Introduce un correo externo válido.",
   "messages.errors.noRecipients": "Añade al menos un destinatario.",
   "messages.errors.noSubject": "Introduce un asunto.",
+  "messages.errors.parentMessageNotFound": "No se encontró el mensaje al que está respondiendo",
   "messages.errors.sendFailed": "No se pudo enviar el mensaje.",
   "messages.errors.senderDraftSendUnsupported": "Enviar un borrador guardado desde un buzón conectado todavía no es compatible.",
   "messages.errors.senderPayloadUnsupported": "El envío desde tu propio buzón todavía no admite adjuntos ni registros vinculados.",

package/src/modules/messages/i18n/ko.json

@@ -130,6 +130,7 @@
   "messages.errors.noExternalEmail": "유효한 외부 이메일을 입력하세요.",
   "messages.errors.noRecipients": "수신자를 하나 이상 추가하세요.",
   "messages.errors.noSubject": "제목을 입력하세요.",
+  "messages.errors.parentMessageNotFound": "답장하려는 메시지를 찾을 수 없습니다",
   "messages.errors.sendFailed": "메시지 전송에 실패했습니다.",
   "messages.errors.senderDraftSendUnsupported": "저장된 초안을 연결된 메일함으로 보내는 기능은 아직 지원되지 않습니다.",
   "messages.errors.senderPayloadUnsupported": "본인 메일함에서 보내기는 아직 첨부 파일이나 연결된 레코드를 지원하지 않습니다.",

package/src/modules/messages/i18n/pl.json

@@ -130,6 +130,7 @@
   "messages.errors.noExternalEmail": "Wpisz poprawny zewnętrzny adres e-mail.",
   "messages.errors.noRecipients": "Dodaj przynajmniej jednego odbiorcę.",
   "messages.errors.noSubject": "Wpisz temat.",
+  "messages.errors.parentMessageNotFound": "Nie znaleziono wiadomości, na którą odpowiadasz",
   "messages.errors.sendFailed": "Nie udało się wysłać wiadomości.",
   "messages.errors.senderDraftSendUnsupported": "Wysyłka zapisanego szkicu przez połączoną skrzynkę nie jest jeszcze obsługiwana.",
   "messages.errors.senderPayloadUnsupported": "Wysyłka z własnej skrzynki nie obsługuje jeszcze załączników ani powiązanych rekordów.",

package/src/modules/messages/lib/routeHelpers.ts

@@ -1,4 +1,7 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
 import { resolveRequestContext } from '@open-mercato/shared/lib/api/context'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { Message, MessageRecipient } from '../data/entities'
 import {
   CHANNEL_THREAD_FALLBACK_FEATURE,
   EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE,
@@ -16,6 +19,11 @@ export function hasOrganizationAccess(
   return messageOrganizationId == null
 }
 
+export type ChannelThreadCallerContext = {
+  container: { resolve: <T = unknown>(name: string) => T }
+  auth?: unknown
+}
+
 export type MessageScope = {
   tenantId: string
   organizationId: string | null
@@ -101,7 +109,7 @@ export async function canUseChannelThreadFallback(
  * message that is not explicitly public.
  */
 export async function hasChannelThreadReadAccess(
-  ctx: Awaited<ReturnType<typeof resolveRequestContext>>['ctx'],
+  ctx: ChannelThreadCallerContext,
   scope: MessageScope,
   message: { id: string; threadId?: string | null; sourceEntityType?: string | null },
 ): Promise<boolean> {
@@ -116,6 +124,81 @@ export async function hasChannelThreadReadAccess(
   return channelThread?.canAccess === true
 }
 
+export type MessageReadAccess = {
+  recipient: MessageRecipient | null
+  isSender: boolean
+  hasChannelThreadAccess: boolean
+  canRead: boolean
+}
+
+/**
+ * The read rule of `GET /api/messages/[id]`, for a message already loaded in the
+ * caller's scope: the sender, a recipient whose row is not deleted, or — for an
+ * explicitly public message only — a caller the channels hub lets work the
+ * channel thread. Channel access never opens an internal note.
+ *
+ * Shared by the detail read and by every write that names another message as its
+ * parent, so "may reference" can never be wider than "may read".
+ */
+export async function resolveMessageReadAccess(
+  ctx: ChannelThreadCallerContext,
+  scope: MessageScope,
+  message: Pick<Message, 'id' | 'senderUserId' | 'visibility' | 'threadId' | 'sourceEntityType'>,
+): Promise<MessageReadAccess> {
+  const em = ctx.container.resolve('em') as EntityManager
+  const recipient = await em.findOne(MessageRecipient, {
+    messageId: message.id,
+    recipientUserId: scope.userId,
+    deletedAt: null,
+  })
+  const isSender = message.senderUserId === scope.userId
+  const hasChannelThreadAccess = await hasChannelThreadReadAccess(ctx, scope, message)
+  const isParticipant = isSender || Boolean(recipient)
+  return {
+    recipient,
+    isSender,
+    hasChannelThreadAccess,
+    canRead: isParticipant || (hasChannelThreadAccess && message.visibility === 'public'),
+  }
+}
+
+export type ReplyParentResolution =
+  | { status: 'readable'; message: Message }
+  | { status: 'not_found' }
+  | { status: 'forbidden' }
+
+/**
+ * Resolve a caller-supplied parent message before a write threads onto it.
+ *
+ * The parent is looked up in exactly the scope the new message is written to —
+ * tenant, organization (null only matches null) and not deleted — so a parent
+ * that is unknown, deleted, or in another organization or tenant all answer
+ * `not_found`. A parent in scope that the caller may not read answers
+ * `forbidden`, the same distinction the detail read already makes.
+ */
+export async function resolveReplyParentMessage(
+  ctx: ChannelThreadCallerContext,
+  scope: MessageScope,
+  parentMessageId: string,
+): Promise<ReplyParentResolution> {
+  const em = ctx.container.resolve('em') as EntityManager
+  const parent = await findOneWithDecryption(
+    em,
+    Message,
+    {
+      id: parentMessageId,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      deletedAt: null,
+    },
+    undefined,
+    { tenantId: scope.tenantId, organizationId: scope.organizationId },
+  )
+  if (!parent) return { status: 'not_found' }
+  const access = await resolveMessageReadAccess(ctx, scope, parent)
+  return access.canRead ? { status: 'readable', message: parent } : { status: 'forbidden' }
+}
+
 /**
  * Whether the caller may post a message meant to leave the platform onto
  * `messageThreadId` (#5645 review, #6432).