feat(templates): support checked CRM template handoff #30

2026-10-19T14:31:07Z

KofTwentyTwo commented

2026-10-19 14:31:07 +00:00

(Migrated from github.com)

CRM needs to select and send shared email templates without duplicating rendering or granting users email administration. Add caller-visible template APIs, narrowly scoped host template permissions, and email-owned compatibility rendering for migrated CRM templates.

templateVariableNames and typed renderTemplate enforce permissions and record locks. Native kinds retain category, override and PHI restrictions.
sendTemplateOnce returns the actual queued subject (including real message.id) only after checking template/version, normalized single-recipient envelope, category, sender and linked record on both new sends and replay. Existing public callers and metadata-only lookups remain compatible.
CRM_LEGACY preserves historical CRM substitutions, body preference and overrides; no PHI approval or record bindings. Template edit permissions remain additive to optional host grants.
CHANGELOG and UPGRADE document adoption, compatibility, replay reconciliation and release order. No host migration or production change is included.

Validation: Java 21, UTC, ./mvnw.cmd -B verify pmd:check. All required verify phases passed: 335 tests, zero failures/errors/skips, Checkstyle, and JaCoCo gates (94.86% instructions, 100% classes). Coverage includes permission revocation, record locks, native category/PHI policy, literal substitution, real outbox provenance, exact stored subjects and mismatched replay denial.

The additional, unconfigured pmd:check goal failed with 952 findings, so the compound command exited unsuccessfully. PMD is not a repository-required gate: AGENTS.md:16 requires verify; AGENTS.md:52 explicitly requires parenthesized returns, while 934 findings are UselessParentheses. The non-parenthesis findings in touched files were already present in the base (EmailApi SimplifiedTernary and EmailTemplateRenderer unused import). No PMD rule or required gate was relaxed; this limitation remains visible.

Adoption prerequisite: publish this email artifact before the CRM consumer pins it. Host opt-in, populated-data migration/rollback and tenant compatibility are separate changes. Verification-only LOCAL artifacts are not public dependency pins.

Supports KofTwentyTwo/Website-Backend#270. AI-assisted implementation and review by Codex, with bounded local-model review.

CRM needs to select and send shared email templates without duplicating rendering or granting users email administration. Add caller-visible template APIs, narrowly scoped host template permissions, and email-owned compatibility rendering for migrated CRM templates. - `templateVariableNames` and typed `renderTemplate` enforce permissions and record locks. Native kinds retain category, override and PHI restrictions. - `sendTemplateOnce` returns the actual queued subject (including real `message.id`) only after checking template/version, normalized single-recipient envelope, category, sender and linked record on both new sends and replay. Existing public callers and metadata-only lookups remain compatible. - `CRM_LEGACY` preserves historical CRM substitutions, body preference and overrides; no PHI approval or record bindings. Template edit permissions remain additive to optional host grants. - CHANGELOG and UPGRADE document adoption, compatibility, replay reconciliation and release order. No host migration or production change is included. Validation: Java 21, UTC, `./mvnw.cmd -B verify pmd:check`. All required `verify` phases passed: **335 tests, zero failures/errors/skips**, Checkstyle, and JaCoCo gates (94.86% instructions, 100% classes). Coverage includes permission revocation, record locks, native category/PHI policy, literal substitution, real outbox provenance, exact stored subjects and mismatched replay denial. The additional, unconfigured `pmd:check` goal failed with **952 findings**, so the compound command exited unsuccessfully. PMD is not a repository-required gate: AGENTS.md:16 requires verify; AGENTS.md:52 explicitly requires parenthesized returns, while 934 findings are UselessParentheses. The non-parenthesis findings in touched files were already present in the base (EmailApi SimplifiedTernary and EmailTemplateRenderer unused import). No PMD rule or required gate was relaxed; this limitation remains visible. Adoption prerequisite: publish this email artifact before the CRM consumer pins it. Host opt-in, populated-data migration/rollback and tenant compatibility are separate changes. Verification-only LOCAL artifacts are not public dependency pins. Supports KofTwentyTwo/Website-Backend#270. AI-assisted implementation and review by Codex, with bounded local-model review.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-email#30