- Shipped
- August 7, 2026 at 6:15 AM UTC
- Author
- Kamo
- Commit
- 8e73db6
A department's contact email was free text, so it could name an address the org does not own -- two of the three departments with one set today do exactly that. It now holds a pointer to one of the org's mailboxes, and Organization gains the same pointer beside its existing contactEmail, which is untouched. Assignment is a pointer and nothing more: it records which mailbox the department or org is reached at, and grants nobody access to it. Both columns are plain UUID with no FK to email_provider.mailboxes, deliberately. Mailboxes sync from external providers and can be removed provider-side, and the mailbox delete endpoint knows nothing about departments -- a real FK would turn both of those into failures. A stale pointer is the accepted cost and the UI surfaces it. Department.email stays, holding the address the assigned mailbox resolves to. Consumers want an address, not an id, and mailbox addresses are immutable (updateMailbox only accepts a display name and password), so the copy cannot drift. Assigning writes both; clearing nulls both. A mailbox from another organization is refused -- the picker only offers this org's, but the request can be made without it, and a cross-tenant pointer would put one org's address on another's outbound mail.