Matthew Meszaros ac3c11bf9a feat: seal outbound email content with the organization DEK ...

The send pipeline (publisher subject/body encryption, the S3 emsg blob,
and the worker-side decrypt) now keys off models.SendEmail.OrgID
instead of UserID. EmailMessage loses its UserID field entirely:
emailSender.Send derives the cipher identity from the email account's
OrganizationID and refuses to send for an account without one.

This also fixes two latent bugs. Emails sent through user_email_task
never set UserID, so they were silently encrypted under the zero-UUID
platform key. campaign_task's discarded Encrypt() pair is replaced with
an explicit DEK warm that fails fast when KMS is unavailable.

2026-06-10 17:16:42 +02:00

..

publisher.go

feat: seal outbound email content with the organization DEK

2026-06-10 17:16:42 +02:00

schemas.go

ci: drop unused/unconvert/gosimple + shadow/nilness, run gofmt

2026-05-23 16:54:12 +00:00