8.4.2

* Get only active users in email address lookup

* fix isActive field name

.github/CONTRIBUTING.md

@@ -1,25 +1,28 @@
+## Issues
+
+When reporting a possible bug, provide detail steps so that we will be able
+to reproduce the issue. Steps to reproduce should be clear and unambiguous. Try not to use phrases like "very big bug",
+"huge issue", "useless feature", etc. No need to use exclamation marks as well.
+
+Note that we don't provide developer help or any kind of support on GitHub.
+For this, please use our [forum](https://forum.espocrm.com).
+
+If you are very new to EspoCRM, it's probable that an issue you ran into is not a bug.
+Consider creating a topic on our [forum](https://forum.espocrm.com/forum/general) instead.
+
+The issue tracker is for the benefit of the EspoCRM project. The project maintainers are going to handle issues in the project's best interest.
+The maintainers have right to close issues without explanation.
+
 ## Pull Requests
 
+We are open for contributions that are bug fixes and small improvements. If you would like to contribute something that is not a small fix, please reach out to maintainers before submitting your PR (by creating a GitHub issue).
+
 Before we can merge your pull request, you need to accept our CLA [here](https://github.com/espocrm/cla).
 
 It's desirable that one PR solves one specific problem. Do not include code style changes to PRs
 (unless the main purpose of the PR is a code style fix).
 
-If you would like to contribute something that is not a small fix, it's reasonable to create an issue first
-(a bug report or feature request).
-
 Branches:
 
 * *master* – the develop branch; new features should be pushed to here;
 * *fix* – the upcoming maintenance release; small fixes should be pushed to here.
-
-## Issues
-
-We'd appreciate if you prefer posting issues on weekdays rather than weekends.
-
-When reporting a possible bug, please provide detail steps so that we will be able
-to reproduce the issue. Please try not to use phrases like "very big bug",
-"huge issue", etc. No need to use exclamation marks as well.
-
-Note that we don't provide developer help or any kind of support on GitHub.
-For this, please use our [forum](https://forum.espocrm.com).

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,6 +1,6 @@
 ---
 name: Feature request
-about: Suggest an idea for EspoCRM. For high-level features, consider creating feature requests on the forum. For low-level (framework) – here on GitHub.
+about: For high-level features, create feature requests on our forum. For low-level (framework) – here on GitHub.
 title: ''
 labels: ''
 assignees: ''

.gitignore

@@ -5,6 +5,8 @@
 /data/.backup/*
 /data/config.php
 /data/config-internal.php
+/data/config-override.php
+/data/config-internal-override.php
 /data/tmp/*
 /build
 /node_modules

.idea/codeStyles/Project.xml

@@ -17,8 +17,6 @@
     <codeStyleSettings language="PHP">
       <option name="KEEP_FIRST_COLUMN_COMMENT" value="false" />
       <option name="KEEP_CONTROL_STATEMENT_IN_ONE_LINE" value="false" />
-      <option name="CATCH_ON_NEW_LINE" value="true" />
-      <option name="FINALLY_ON_NEW_LINE" value="true" />
       <option name="ALIGN_MULTILINE_PARAMETERS" value="false" />
       <option name="ALIGN_MULTILINE_FOR" value="false" />
       <option name="METHOD_PARAMETERS_RPAREN_ON_NEXT_LINE" value="true" />

.idea/inspectionProfiles/Project_Default.xml

@@ -3,6 +3,7 @@
     <option name="myName" value="Project Default" />
     <inspection_tool class="DuplicatedCode" enabled="false" level="WEAK WARNING" enabled_by_default="false" />
     <inspection_tool class="ES6ConvertLetToConst" enabled="true" level="WEAK WARNING" enabled_by_default="true" editorAttributes="INFO_ATTRIBUTES" />
+    <inspection_tool class="HtmlUnknownAnchorTarget" enabled="false" level="WARNING" enabled_by_default="false" />
     <inspection_tool class="JSIgnoredPromiseFromCall" enabled="false" level="WEAK WARNING" enabled_by_default="false" />
     <inspection_tool class="PhpDocMissingThrowsInspection" enabled="false" level="WEAK WARNING" enabled_by_default="false" />
     <inspection_tool class="PhpDocSignatureIsNotCompleteInspection" enabled="false" level="WEAK WARNING" enabled_by_default="false" />

.idea/misc.xml

@@ -3,5 +3,6 @@
   <component name="PhpEntryPointsManager">
     <pattern value="\Espo\Controllers\*" member="*Action*" />
     <pattern value="\Espo\Modules\*\Controllers\*" member="*Action*" />
+    <suppressed_annotations>@implements</suppressed_annotations>
   </component>
 </project>

.vscode/settings.json

@@ -16,7 +16,7 @@
             "fileMatch": [
                 "*/Resources/module.json"
             ],
-            "url": "./schema/routes.json"
+            "url": "./schema/module.json"
         },
         {
             "fileMatch": [
@@ -58,12 +58,6 @@
             ],
             "url": "./schema/metadata/dashlets.json"
         },
-        {
-            "fileMatch": [
-                "*/metadata//*.json"
-            ],
-            "url": "./schema/metadata/.json"
-        },
         {
             "fileMatch": [
                 "*/metadata/entityAcl/*.json"

Gruntfile.js

@@ -134,9 +134,11 @@ module.exports = grunt => {
                 src: [
                     'build/tmp/custom/Espo/Custom/*',
                     '!build/tmp/custom/Espo/Custom/.htaccess',
+                    '!build/tmp/custom/Espo/Modules',
+                    'build/tmp/custom/Espo/Modules/*',
+                    '!build/tmp/custom/Espo/Modules/.htaccess',
                     'build/tmp/install/config.php',
                     'build/tmp/vendor/*/*/.git',
-                    'build/tmp/custom/Espo/Custom/*',
                     'build/tmp/client/custom/*',
                     '!build/tmp/client/custom/modules',
                     'build/tmp/client/custom/modules/*',

README.md

@@ -2,37 +2,41 @@
 
 [![PHPStan level 8](https://img.shields.io/badge/PHPStan-level%208-brightgreen)](#espocrm)
 
-[EspoCRM is an Open Source CRM](https://www.espocrm.com) (Customer Relationship Management)
-software that allows you to see, enter and evaluate all your company relationships regardless
-of the type. People, companies or opportunities – all in an easy and intuitive interface.
-
-It's a web application with a frontend designed as a single page application and a REST API
-backend written in PHP.
-
-[Download](https://www.espocrm.com/download/) the latest release from our website. Release notes
-and release packages are available at [Releases](https://github.com/espocrm/espocrm/releases) on GitHub.
+[EspoCRM](https://www.espocrm.com) is a free, open-source CRM platform designed to help organizations build and maintain strong customer relationships. 
+It provides a wide range of tools to store, organize, and manage leads, contacts, sales opportunities, marketing campaigns, 
+support cases, and more – all business information in a simple and intuitive interface.
 
 ![Screenshot](https://user-images.githubusercontent.com/1006792/226094559-995dfd2a-a18f-4619-a21b-79a4e671990a.png)
 
+### Architecture
+
+EspoCRM is a web application with a frontend designed as a single-page application and a REST API
+backend written in PHP.
+
 ### Demo
 
-You can try the CRM on the online [demo](https://www.espocrm.com/demo/).
+You can try the CRM on an online [demo](https://www.espocrm.com/demo/).
 
 ### Requirements
 
 * PHP 8.1 - 8.3;
-* MySQL 5.7 (and later), or MariaDB 10.2 (and later).
-* PostgreSQL 15 (and later) (yet experimental, officially supported soon)
+* MySQL 5.7 (and later), or MariaDB 10.2 (and later);
+* PostgreSQL 15 (and later) (beta, official support soon).
 
-For more information about server configuration see [this article](https://docs.espocrm.com/administration/server-configuration/).
+For more information about server configuration, see [this article](https://docs.espocrm.com/administration/server-configuration/).
 
-### Documentation
+### Why EspoCRM?
 
-See the [documentation](https://docs.espocrm.com) for administrators, users and developers.
+* **Open-source transparency**. EspoCRM’s source code is open and accessible, so anyone can inspect it and see how data is being managed within the CRM.
+* **Customization freedom**. You can develop features, create custom entities, fields, relationships, buttons to make the CRM fit your specific needs.
+* **Clean user interface**. EspoCRM has a uncluttered, minimalist and very fast user inteface that is easy to navigate and has a short learning curve.
+* **Straightforward REST API**. It can be easily integrated with other applications using a REST API.
 
-### Bug reporting
+### Who is EspoCRM for?
 
-Create a [GitHub issue](https://github.com/espocrm/espocrm/issues/new/choose) or post on our [forum](https://forum.espocrm.com/forum/bug-reports).
+* **Startups, small & medium-sized businesses**. It’s an affordable solution that is flexible and fully customizable.
+* **Developers & tech enthusiasts**. You can extend functionalities, build extensions, and create custom integrations.
+* **Anyone seeking a free CRM**. If you're looking for a user-friendly and secure CRM platform, it can be a good option.
 
 ### Installing stable version
 
@@ -43,21 +47,29 @@ See installation instructions:
 * [Installation with Docker](https://docs.espocrm.com/administration/docker/installation/)
 * [Installation with Traefik](https://docs.espocrm.com/administration/docker/traefik/)
 
+### Download
+
+[Download](https://www.espocrm.com/download/) the latest release from our website. You can also download the latest and previous release packages from GitHub [releases](https://github.com/espocrm/espocrm/releases).
+
+### Release notes
+
+Release notes are available at GitHub [releases](https://github.com/espocrm/espocrm/releases).
+
+### Documentation
+
+See the [documentation](https://docs.espocrm.com) for administrators, users and developers.
+
+### Bug reporting
+
+Create a [GitHub issue](https://github.com/espocrm/espocrm/issues/new/choose) or post on our [forum](https://forum.espocrm.com/forum/bug-reports).
+
 ### Development
 
 See the [developer documentation](https://docs.espocrm.com/development/).
 
-We highly recommend using IDE for development. The backend codebase follows SOLID principles, utilizes interfaces, static typing and generics. We recommend to start learning EspoCRM from the Dependency Injection article in the documentation.
+We highly recommend using an IDE for development. The backend codebase follows SOLID principles, utilizes interfaces, static typing and generics. We recommend to start learning EspoCRM from the Dependency Injection article in the documentation.
 
-### Contributing
-
-Before we can merge your pull request, you need to accept our CLA [here](https://github.com/espocrm/cla). It's very simple to do.
-
-Branches:
-
-* *fix* – upcoming maintenance release; minor fixes should be pushed to this branch;
-* *master* – develop branch; new features should be pushed to this branch;
-* *stable* – last stable release.
+Metadata plays an integral role in the EspoCRM application. All possible parameters are described with a JSON Schema, meaning you will have autocompletion in the IDE. You can also find the full metadata reference in the documentation.
 
 ### Community & Support
 
@@ -65,7 +77,17 @@ If you have a question regarding some features, need help or customizations, wan
 
 ### License
 
-EspoCRM is published under the GNU AGPLv3 [license](https://raw.githubusercontent.com/espocrm/espocrm/master/LICENSE.txt).
+EspoCRM is an open-source project licensed under [GNU AGPLv3](https://raw.githubusercontent.com/espocrm/espocrm/master/LICENSE.txt).
+
+### Contributing
+
+Before we can merge your pull request, you need to accept our CLA [here](https://github.com/espocrm/cla). See the [contributing guidelines](https://github.com/espocrm/espocrm/blob/master/.github/CONTRIBUTING.md).
+
+Branches:
+
+* *fix* – upcoming maintenance release; minor fixes should be pushed to this branch;
+* *master* – develop branch; new features should be pushed to this branch;
+* *stable* – last stable release.
 
 ### Language
 

application/Espo/Binding.php

@@ -63,11 +63,6 @@ class Binding implements BindingProcessor
             'container'
         );
 
-        $binder->bindService(
-            'Espo\\Core\\Container',
-            'container'
-        );
-
         $binder->bindService(
             'Psr\\Container\\ContainerInterface',
             'container'
@@ -148,11 +143,6 @@ class Binding implements BindingProcessor
             'recordServiceContainer'
         );
 
-        $binder->bindService(
-            'Espo\\Core\\Record\\HookManager',
-            'recordHookManager'
-        );
-
         $binder->bindService(
             'Espo\\Core\\HookManager',
             'hookManager'

application/Espo/Classes/Acl/Attachment/AccessChecker.php

@@ -99,10 +99,7 @@ class AccessChecker implements AccessEntityCREDChecker
         else if ($this->aclManager->checkEntity($user, $parent)) {
             if (
                 $entity->getTargetField() &&
-                in_array(
-                    $entity->getTargetField(),
-                    $this->aclManager->getScopeForbiddenFieldList($user, $parent->getEntityType())
-                )
+                !$this->aclManager->checkField($user, $parent->getEntityType(), $entity->getTargetField())
             ) {
                 return false;
             }

application/Espo/Classes/Acl/ImportEml/AccessChecker.php

@@ -0,0 +1,47 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Acl\ImportEml;
+
+use Espo\Core\Acl\AccessCreateChecker;
+use Espo\Core\Acl\ScopeData;
+use Espo\Entities\User;
+
+class AccessChecker implements AccessCreateChecker
+{
+    public function check(User $user, ScopeData $data): bool
+    {
+        return $data->isTrue();
+    }
+
+    public function checkCreate(User $user, ScopeData $data): bool
+    {
+        return $data->isTrue();
+    }
+}

application/Espo/Classes/Acl/Note/AccessChecker.php

@@ -29,6 +29,8 @@
 
 namespace Espo\Classes\Acl\Note;
 
+use Espo\Core\Acl\Permission;
+use Espo\Core\Acl\Table;
 use Espo\Entities\Note;
 use Espo\Entities\User;
 use Espo\ORM\Entity;
@@ -141,6 +143,10 @@ class AccessChecker implements AccessEntityCREDChecker
             return in_array($user->getId(), $entity->getLinkMultipleIdList('users'));
         }
 
+        if ($entity->getTargetType() === Note::TARGET_PORTALS) {
+            return $this->aclManager->getPermissionLevel($user, Permission::PORTAL) === Table::LEVEL_YES;
+        }
+
         return false;
     }
 

application/Espo/Classes/Acl/Portal/AccessChecker.php

@@ -29,6 +29,7 @@
 
 namespace Espo\Classes\Acl\Portal;
 
+use Espo\Core\Acl\Permission;
 use Espo\Entities\Portal;
 use Espo\Entities\User;
 use Espo\Core\Acl\AccessEntityCREDChecker;
@@ -45,18 +46,12 @@ class AccessChecker implements AccessEntityCREDChecker
 {
     use DefaultAccessCheckerDependency;
 
-    private DefaultAccessChecker $defaultAccessChecker;
-    private AclManager $aclManager;
-
-    public function __construct(DefaultAccessChecker $defaultAccessChecker, AclManager $aclManager)
-    {
-        $this->defaultAccessChecker = $defaultAccessChecker;
-        $this->aclManager = $aclManager;
-    }
+    public function __construct(private DefaultAccessChecker $defaultAccessChecker, private AclManager $aclManager)
+    {}
 
     public function check(User $user, ScopeData $data): bool
     {
-        $level = $this->aclManager->getPermissionLevel($user, 'portal');
+        $level = $this->aclManager->getPermissionLevel($user, Permission::PORTAL);
 
         return $level === Table::LEVEL_YES;
     }

application/Espo/Classes/Acl/User/AccessChecker.php

@@ -29,6 +29,7 @@
 
 namespace Espo\Classes\Acl\User;
 
+use Espo\Core\Acl\Permission;
 use Espo\Entities\User;
 use Espo\ORM\Entity;
 use Espo\Core\Acl\AccessEntityCREDSChecker;
@@ -60,8 +61,6 @@ class AccessChecker implements AccessEntityCREDSChecker
             return false;
         }
 
-        /** @var User $entity */
-
         if ($entity->isSuperAdmin() && !$user->isSuperAdmin()) {
             return false;
         }
@@ -71,10 +70,8 @@ class AccessChecker implements AccessEntityCREDSChecker
 
     public function checkEntityRead(User $user, Entity $entity, ScopeData $data): bool
     {
-        /** @var User $entity */
-
         if ($entity->isPortal()) {
-            if ($this->aclManager->getPermissionLevel($user, 'portal') === Table::LEVEL_YES) {
+            if ($this->aclManager->getPermissionLevel($user, Permission::PORTAL) === Table::LEVEL_YES) {
                 return true;
             }
 
@@ -90,8 +87,6 @@ class AccessChecker implements AccessEntityCREDSChecker
 
     public function checkEntityEdit(User $user, Entity $entity, ScopeData $data): bool
     {
-        /** @var User $entity */
-
         if ($entity->isSystem()) {
             return false;
         }
@@ -111,8 +106,6 @@ class AccessChecker implements AccessEntityCREDSChecker
 
     public function checkEntityDelete(User $user, Entity $entity, ScopeData $data): bool
     {
-        /** @var User $entity */
-
         if (!$user->isAdmin()) {
             return false;
         }
@@ -130,8 +123,7 @@ class AccessChecker implements AccessEntityCREDSChecker
 
     public function checkEntityStream(User $user, Entity $entity, ScopeData $data): bool
     {
-        /** @var User $entity */
-
-        return $this->aclManager->checkUserPermission($user, $entity, 'user');
+        /** @noinspection PhpRedundantOptionalArgumentInspection */
+        return $this->aclManager->checkUserPermission($user, $entity, Permission::USER);
     }
 }

application/Espo/Classes/AclPortal/Attachment/AccessChecker.php

@@ -105,10 +105,7 @@ class AccessChecker implements AccessEntityCREDChecker
         else if ($this->aclManager->checkEntity($user, $parent)) {
             if (
                 $entity->getTargetField() &&
-                in_array(
-                    $entity->getTargetField(),
-                    $this->aclManager->getScopeForbiddenFieldList($user, $parent->getEntityType())
-                )
+                !$this->aclManager->checkField($user, $parent->getEntityType(), $entity->getTargetField())
             ) {
                 return false;
             }

application/Espo/Classes/AppParams/AddressCountryData.php

@@ -0,0 +1,48 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\AppParams;
+
+use Espo\Core\Utils\Address\CountryDataProvider;
+use Espo\Tools\App\AppParam;
+
+class AddressCountryData implements AppParam
+{
+    public function __construct(
+        private CountryDataProvider $provider
+    ) {}
+
+    /**
+     * @return array{list: string[], preferredList: string[]}
+     */
+    public function get(): array
+    {
+        return $this->provider->get();
+    }
+}

application/Espo/Classes/Cleanup/AppLog.php

@@ -0,0 +1,65 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Cleanup;
+
+use Espo\Core\Cleanup\Cleanup;
+use Espo\Core\Field\DateTime;
+use Espo\Core\Utils\Config;
+use Espo\Entities\AppLogRecord;
+use Espo\ORM\EntityManager;
+use Espo\ORM\Query\DeleteBuilder;
+
+class AppLog implements Cleanup
+{
+    private const PERIOD = '30 days';
+
+    public function __construct(
+        private EntityManager $entityManager,
+        private Config $config
+    ) {}
+
+    public function process(): void
+    {
+        $query = DeleteBuilder::create()
+            ->from(AppLogRecord::ENTITY_TYPE)
+            ->where(['createdAt<' => $this->getBefore()->toString()])
+            ->build();
+
+        $this->entityManager->getQueryExecutor()->execute($query);
+    }
+
+    private function getBefore(): DateTime
+    {
+        /** @var string $period */
+        $period = $this->config->get('cleanupAppLogPeriod') ?? self::PERIOD;
+
+        return DateTime::createNow()->modify('-' . $period);
+    }
+}

application/Espo/Classes/Cleanup/Audit.php

@@ -0,0 +1,104 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Cleanup;
+
+use Espo\Core\Cleanup\Cleanup;
+use Espo\Core\Field\DateTime;
+use Espo\Core\Utils\Config;
+use Espo\Core\Utils\Metadata;
+use Espo\Entities\Note;
+use Espo\ORM\EntityManager;
+
+/**
+ * @noinspection PhpUnused
+ */
+class Audit implements Cleanup
+{
+    private const PERIOD = '3 months';
+
+    public function __construct(
+        private Metadata $metadata,
+        private EntityManager $entityManager,
+        private Config $config
+    ) {}
+
+    public function process(): void
+    {
+        if (!$this->config->get('cleanupAudit')) {
+            return;
+        }
+
+        $entityTypeList = $this->getEntityTypeList();
+
+        foreach ($entityTypeList as $scope) {
+            $this->processEntityType($scope);
+        }
+    }
+
+    private function processEntityType(string $entityType): void
+    {
+        $query = $this->entityManager
+            ->getQueryBuilder()
+            ->delete()
+            ->from(Note::ENTITY_TYPE)
+            ->where([
+                'parentType' => $entityType,
+                'createdAt<' => $this->getBefore()->toString(),
+                'type' => [Note::TYPE_UPDATE, Note::TYPE_STATUS],
+            ])
+            ->build();
+
+        $this->entityManager->getQueryExecutor()->execute($query);
+    }
+
+    /**
+     * @return string[]
+     */
+    private function getEntityTypeList(): array
+    {
+        /** @var string[] $scopeList */
+        $scopeList = array_keys($this->metadata->get(['scopes']) ?? []);
+
+        $scopeList = array_filter($scopeList, function ($item) {
+            return $this->metadata->get(['scopes', $item, 'entity']) &&
+                !$this->metadata->get(['scopes', $item, 'stream']);
+        });
+
+        return array_values($scopeList);
+    }
+
+    private function getBefore(): DateTime
+    {
+        /** @var string $period */
+        $period = $this->config->get('cleanupAuditPeriod') ?? self::PERIOD;
+
+        return DateTime::createNow()->modify('-' . $period);
+    }
+}

application/Espo/Classes/Cleanup/Stars.php

@@ -0,0 +1,137 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Cleanup;
+
+use Espo\Core\Cleanup\Cleanup;
+use Espo\Core\Utils\Acl\UserAclManagerProvider;
+use Espo\Entities\StarSubscription;
+use Espo\Entities\User;
+use Espo\ORM\EntityManager;
+use Espo\ORM\Query\DeleteBuilder;
+use Espo\Tools\Stars\StarService;
+
+/**
+ * @noinspection PhpUnused
+ */
+class Stars implements Cleanup
+{
+    public function __construct(
+        private EntityManager $entityManager,
+        private UserAclManagerProvider $userAclManagerProvider,
+        private StarService $service
+    ) {}
+
+    public function process(): void
+    {
+        foreach ($this->getEntityTypeList() as $entityType) {
+            $this->processEntityType($entityType);
+        }
+    }
+
+    /**
+     * @return string[]
+     */
+    private function getEntityTypeList(): array
+    {
+        $groups = $this->entityManager->getRDBRepositoryByClass(StarSubscription::class)
+            ->group('entityType')
+            ->select('entityType')
+            ->find();
+
+        $list = [];
+
+        foreach ($groups as $group) {
+            $list[] = $group->get('entityType');
+        }
+
+        return $list;
+    }
+
+    private function processEntityType(string $entityType): void
+    {
+        if (
+            !$this->service->isEnabled($entityType) ||
+            !$this->entityManager->hasRepository($entityType)
+        ) {
+            $deleteQuery = DeleteBuilder::create()
+                ->from(StarSubscription::ENTITY_TYPE)
+                ->where(['entityType' => $entityType])
+                ->build();
+
+            $this->entityManager->getQueryExecutor()->execute($deleteQuery);
+
+            return;
+        }
+
+        $stars = $this->entityManager
+            ->getRDBRepositoryByClass(StarSubscription::class)
+            ->where(['entityType' => $entityType])
+            ->sth()
+            ->find();
+
+        foreach ($stars as $star) {
+            $entityId = $star->get('entityId');
+            $userId = $star->get('userId');
+
+            if ($userId === null || $entityId === null) {
+                continue;
+            }
+
+            $entity = $this->entityManager->getEntityById($entityType, $entityId);
+            $user = $this->entityManager->getRDBRepositoryByClass(User::class)->getById($userId);
+
+            if (!$entity || !$user) {
+                $this->unstar($userId, $entityType, $entityId);
+
+                continue;
+            }
+
+            $aclManager = $this->userAclManagerProvider->get($user);
+
+            if (!$aclManager->checkEntityRead($user, $entity)) {
+                $this->unstar($userId, $entityType, $entityId);
+            }
+        }
+    }
+
+    private function unstar(string $userId, string $entityType, string $entityId): void
+    {
+        $deleteQuery = DeleteBuilder::create()
+            ->from(StarSubscription::ENTITY_TYPE)
+            ->where([
+                'userId' => $userId,
+                'entityType' => $entityType,
+                'entityId' => $entityId,
+            ])
+            ->build();
+
+        $this->entityManager->getQueryExecutor()->execute($deleteQuery);
+    }
+}

application/Espo/Classes/Cleanup/Subscribers.php

@@ -33,7 +33,7 @@ use Espo\Core\Cleanup\Cleanup;
 use Espo\Core\Field\DateTime;
 use Espo\Core\Utils\Config;
 use Espo\Core\Utils\Metadata;
-use Espo\Entities\Subscription;
+use Espo\Entities\StreamSubscription;
 use Espo\ORM\EntityManager;
 use Espo\ORM\Query\Part\Condition as Cond;
 
@@ -41,19 +41,11 @@ class Subscribers implements Cleanup
 {
     private const PERIOD = '2 months';
 
-    private Metadata $metadata;
-    private EntityManager $entityManager;
-    private Config $config;
-
     public function __construct(
-        Metadata $metadata,
-        EntityManager $entityManager,
-        Config $config
-    ) {
-        $this->metadata = $metadata;
-        $this->entityManager = $entityManager;
-        $this->config = $config;
-    }
+        private Metadata $metadata,
+        private EntityManager $entityManager,
+        private Config $config
+    ) {}
 
     public function process(): void
     {
@@ -105,7 +97,7 @@ class Subscribers implements Cleanup
         $query = $this->entityManager
             ->getQueryBuilder()
             ->delete()
-            ->from(Subscription::ENTITY_TYPE, 'subscription')
+            ->from(StreamSubscription::ENTITY_TYPE, 'subscription')
             ->join(
                 $entityType,
                 'entity',

application/Espo/Classes/ConsoleCommands/CheckFilePermissions.php

@@ -0,0 +1,66 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\ConsoleCommands;
+
+use Espo\Core\Console\Command;
+use Espo\Core\Console\Command\Params;
+use Espo\Core\Console\IO;
+use Espo\Core\Utils\File\Manager as FileManager;
+use Espo\Core\Utils\System;
+use Espo\Core\Utils\Util;
+
+/**
+ * @noinspection PhpUnused
+ */
+class CheckFilePermissions implements Command
+{
+    public function __construct(
+        private FileManager $fileManager,
+        private System $system
+    ) {}
+
+    public function run(Params $params, IO $io): void
+    {
+        $io->writeLine("\nNote: Run this command under the web server user.\n");
+
+        $io->writeLine('Writable:');
+        $io->writeLine('');
+
+        foreach ($this->fileManager->getPermissionUtils()->getWritableList() as $path) {
+            $fullPath = Util::concatPath($this->system->getRootDir(), $path);
+
+            $isWritable = $this->fileManager->isWritable($fullPath);
+
+            $msg = " " . ($isWritable ? "OK" : "FAIL") . " : $path";
+
+            $io->writeLine($msg);
+        }
+    }
+}

application/Espo/Classes/FieldProcessing/Email/FolderDataLoader.php

@@ -0,0 +1,66 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldProcessing\Email;
+
+use Espo\Core\FieldProcessing\Loader;
+use Espo\Core\FieldProcessing\Loader\Params;
+use Espo\Entities\Email;
+use Espo\Entities\EmailFolder;
+use Espo\ORM\Entity;
+use Espo\ORM\EntityManager;
+
+/**
+ * @implements Loader<Email>
+ */
+class FolderDataLoader implements Loader
+{
+    public function __construct(private EntityManager $entityManager) {}
+
+    public function process(Entity $entity, Params $params): void
+    {
+        $folderId = $entity->get(Email::USERS_COLUMN_FOLDER_ID);
+
+        if (!$folderId) {
+            return;
+        }
+
+        $folder = $this->entityManager
+            ->getRDBRepositoryByClass(EmailFolder::class)
+            ->select(['id', 'name'])
+            ->where(['id' => $folderId])
+            ->findOne();
+
+        if (!$folder) {
+            return;
+        }
+
+        $entity->set('folderName', $folder->getName());
+    }
+}

application/Espo/Classes/FieldProcessing/Email/UserColumnsLoader.php

@@ -41,14 +41,10 @@ use Espo\Entities\User;
  */
 class UserColumnsLoader implements Loader
 {
-    private EntityManager $entityManager;
-    private User $user;
-
-    public function __construct(EntityManager $entityManager, User $user)
-    {
-        $this->entityManager = $entityManager;
-        $this->user = $user;
-    }
+    public function __construct(
+        private EntityManager $entityManager,
+        private User $user
+    ) {}
 
     public function process(Entity $entity, Params $params): void
     {
@@ -58,6 +54,7 @@ class UserColumnsLoader implements Loader
                 Email::USERS_COLUMN_IS_READ,
                 Email::USERS_COLUMN_IS_IMPORTANT,
                 Email::USERS_COLUMN_IN_TRASH,
+                Email::USERS_COLUMN_IN_ARCHIVE,
             ])
             ->where([
                 'deleted' => false,
@@ -70,6 +67,7 @@ class UserColumnsLoader implements Loader
             $entity->set(Email::USERS_COLUMN_IS_READ, null);
             $entity->clear(Email::USERS_COLUMN_IS_IMPORTANT);
             $entity->clear(Email::USERS_COLUMN_IN_TRASH);
+            $entity->clear(Email::USERS_COLUMN_IN_ARCHIVE);
 
             return;
         }
@@ -78,6 +76,8 @@ class UserColumnsLoader implements Loader
             Email::USERS_COLUMN_IS_READ => $emailUser->get(Email::USERS_COLUMN_IS_READ),
             Email::USERS_COLUMN_IS_IMPORTANT => $emailUser->get(Email::USERS_COLUMN_IS_IMPORTANT),
             Email::USERS_COLUMN_IN_TRASH => $emailUser->get(Email::USERS_COLUMN_IN_TRASH),
+            Email::USERS_COLUMN_IN_ARCHIVE => $emailUser->get(Email::USERS_COLUMN_IN_ARCHIVE),
+            'isUsersSent' => $entity->getSentBy()?->getId() === $this->user->getId(),
         ]);
     }
 }

application/Espo/Classes/FieldProcessing/InboundEmail/IsSystemLoader.php

@@ -0,0 +1,27 @@
+<?php
+/**LICENSE**/
+
+namespace Espo\Classes\FieldProcessing\InboundEmail;
+
+use Espo\Core\FieldProcessing\Loader;
+use Espo\Core\FieldProcessing\Loader\Params;
+use Espo\Core\Utils\Config;
+use Espo\Entities\InboundEmail;
+use Espo\ORM\Entity;
+
+/**
+ * @implements Loader<InboundEmail>
+ */
+class IsSystemLoader implements Loader
+{
+    public function __construct(
+        private Config $config,
+    ) {}
+
+    public function process(Entity $entity, Params $params): void
+    {
+        $isSystem = $entity->getEmailAddress() === $this->config->get('outboundEmailFromAddress');
+
+        $entity->set('isSystem', $isSystem);
+    }
+}

application/Espo/Classes/FieldProcessing/LeadCapture/ExampleLoader.php

@@ -27,46 +27,58 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Services;
+namespace Espo\Classes\FieldProcessing\LeadCapture;
 
-use Espo\Entities\LeadCapture as LeadCaptureEntity;
+use Espo\Core\FieldProcessing\Loader;
+use Espo\Core\FieldProcessing\Loader\Params;
+use Espo\Core\Utils\Config;
+use Espo\Core\Utils\FieldUtil;
+use Espo\Core\Utils\Util;
+use Espo\Entities\LeadCapture;
 use Espo\Modules\Crm\Entities\Lead;
 use Espo\ORM\Entity;
-use Espo\Tools\LeadCapture\Service as LeadCaptureService;
-use Espo\Core\Utils\Util;
+use Espo\ORM\EntityManager;
 
 /**
- * @extends Record<LeadCaptureEntity>
+ * @implements Loader<LeadCapture>
  */
-class LeadCapture extends Record
+class ExampleLoader implements Loader
 {
-    /** @var string[] */
-    protected $readOnlyAttributeList = ['apiKey'];
+    public function __construct(
+        private FieldUtil $fieldUtil,
+        private Config $config,
+        private EntityManager $entityManager
+    ) {}
 
-    /**
-     * @param LeadCaptureEntity $entity
-     */
-    public function prepareEntityForOutput(Entity $entity)
+    public function process(Entity $entity, Params $params): void
     {
-        parent::prepareEntityForOutput($entity);
-
         $entity->set('exampleRequestMethod', 'POST');
 
         $entity->set('exampleRequestHeaders', [
             'Content-Type: application/json',
         ]);
 
+        $this->processRequestUrl($entity);
+        $this->processRequestPayload($entity);
+    }
+
+    private function processRequestUrl(LeadCapture $entity): void
+    {
         $apiKey = $entity->getApiKey();
+        $siteUrl = $this->config->get('siteUrl');
 
-        if ($apiKey) {
-            $requestUrl = $this->config->getSiteUrl() . '/api/v1/LeadCapture/' . $apiKey;
-
-            $entity->set('exampleRequestUrl', $requestUrl);
+        if (!$apiKey) {
+            return;
         }
 
-        $fieldUtil = $this->fieldUtil;
+        $requestUrl = "$siteUrl/api/v1/LeadCapture/$apiKey";
 
-        $requestPayload = "```{\n";
+        $entity->set('exampleRequestUrl', $requestUrl);
+    }
+
+    private function processRequestPayload(LeadCapture $entity): void
+    {
+        $requestPayload = "```\n{\n";
 
         $attributeList = [];
 
@@ -80,7 +92,7 @@ class LeadCapture extends Record
         ];
 
         foreach ($entity->getFieldList() as $field) {
-            foreach ($fieldUtil->getActualAttributeList(Lead::ENTITY_TYPE, $field) as $attribute) {
+            foreach ($this->fieldUtil->getActualAttributeList(Lead::ENTITY_TYPE, $field) as $attribute) {
                 if (!in_array($attribute, $attributeIgnoreList)) {
                     $attributeList[] = $attribute;
                 }
@@ -105,20 +117,8 @@ class LeadCapture extends Record
             $requestPayload .= "\n";
         }
 
-        $requestPayload .= '}```';
+        $requestPayload .= "}\n```";
 
         $entity->set('exampleRequestPayload', $requestPayload);
     }
-
-    protected function beforeCreateEntity(Entity $entity, $data)
-    {
-        $apiKey = $this->createLeadCaptureService()->generateApiKey();
-
-        $entity->set('apiKey', $apiKey);
-    }
-
-    protected function createLeadCaptureService(): LeadCaptureService
-    {
-        return $this->injectableFactory->create(LeadCaptureService::class);
-    }
 }

application/Espo/Classes/FieldProcessing/Note/AdditionalFieldsLoader.php

@@ -29,19 +29,18 @@
 
 namespace Espo\Classes\FieldProcessing\Note;
 
-use Espo\ORM\Entity;
 use Espo\Core\FieldProcessing\Loader;
 use Espo\Core\FieldProcessing\Loader\Params;
 use Espo\Entities\Note;
+use Espo\ORM\Entity;
 
 /**
  * @implements Loader<Note>
  */
-class AttachmentsLoader implements Loader
+class AdditionalFieldsLoader implements Loader
 {
     public function process(Entity $entity, Params $params): void
     {
-        /** @var Note $entity */
-        $entity->loadAttachments();
+        $entity->loadAdditionalFields();
     }
 }

application/Espo/Classes/FieldProcessing/User/LastAccessLoader.php

@@ -34,7 +34,6 @@ use Espo\Entities\AuthToken;
 use Espo\Entities\User;
 use Espo\ORM\Entity;
 use Espo\Core\Acl;
-use Espo\Core\Acl\Table;
 use Espo\Core\FieldProcessing\Loader;
 use Espo\Core\FieldProcessing\Loader\Params;
 use Espo\Core\ORM\EntityManager;
@@ -44,6 +43,7 @@ use Exception;
 
 /**
  * @implements Loader<User>
+ * @noinspection PhpUnused
  */
 class LastAccessLoader implements Loader
 {
@@ -58,10 +58,7 @@ class LastAccessLoader implements Loader
 
     public function process(Entity $entity, Params $params): void
     {
-        $forbiddenFieldList = $this->acl
-            ->getScopeForbiddenFieldList($entity->getEntityType(), Table::ACTION_READ);
-
-        if (in_array('lastAccess', $forbiddenFieldList)) {
+        if (!$this->acl->checkField($entity->getEntityType(), 'lastAccess')) {
             return;
         }
 

application/Espo/Classes/FieldSanitizers/ArrayFromNull.php

@@ -0,0 +1,54 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldSanitizers;
+
+use Espo\Core\FieldSanitize\Sanitizer;
+use Espo\Core\FieldSanitize\Sanitizer\Data;
+
+/**
+ * @noinspection PhpUnused
+ */
+class ArrayFromNull implements Sanitizer
+{
+    public function sanitize(Data $data, string $field): void
+    {
+        if (!$data->has($field)) {
+            return;
+        }
+
+        $value = $data->get($field);
+
+        if ($value !== null) {
+            return;
+        }
+
+        $data->set($field, []);
+    }
+}

application/Espo/Classes/FieldSanitizers/ArrayStringTrim.php

@@ -0,0 +1,62 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldSanitizers;
+
+use Espo\Core\FieldSanitize\Sanitizer;
+use Espo\Core\FieldSanitize\Sanitizer\Data;
+
+/**
+ * @noinspection PhpUnused
+ */
+class ArrayStringTrim implements Sanitizer
+{
+    public function sanitize(Data $data, string $field): void
+    {
+        if (!$data->has($field)) {
+            return;
+        }
+
+        $value = $data->get($field);
+
+        if (!is_array($value)) {
+            return;
+        }
+
+        foreach ($value as $i => $item) {
+            if (!is_string($item)) {
+                continue;
+            }
+
+            $value[$i] = trim($item);
+        }
+
+        $data->set($field, $value);
+    }
+}

application/Espo/Classes/FieldSanitizers/Date.php

@@ -0,0 +1,70 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldSanitizers;
+
+use DateTimeImmutable;
+use DateTimeInterface;
+use Espo\Core\Field\Date as DateValue;
+use Espo\Core\FieldSanitize\Sanitizer;
+use Espo\Core\FieldSanitize\Sanitizer\Data;
+use Espo\Core\Utils\DateTime as DateTimeUtil;
+use Exception;
+
+/**
+ * @noinspection PhpUnused
+ */
+class Date implements Sanitizer
+{
+    public function sanitize(Data $data, string $field): void
+    {
+        $value = $data->get($field);
+
+        if ($value === null) {
+            return;
+        }
+
+        try {
+            DateValue::fromString($value);
+
+            return;
+        }
+        catch (Exception) {}
+
+        $dateTime = DateTimeImmutable::createFromFormat(DateTimeInterface::ATOM, $value);
+
+        if ($dateTime === false) {
+            return;
+        }
+
+        $value = $dateTime->format(DateTimeUtil::SYSTEM_DATE_FORMAT);
+
+        $data->set($field, $value);
+    }
+}

application/Espo/Classes/FieldSanitizers/Datetime.php

@@ -0,0 +1,73 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldSanitizers;
+
+use DateTimeImmutable;
+use DateTimeInterface;
+use DateTimeZone;
+use Espo\Core\Field\DateTime as DateTimeValue;
+use Espo\Core\FieldSanitize\Sanitizer;
+use Espo\Core\FieldSanitize\Sanitizer\Data;
+use Espo\Core\Utils\DateTime as DateTimeUtil;
+use Exception;
+
+/**
+ * @noinspection PhpUnused
+ */
+class Datetime implements Sanitizer
+{
+    public function sanitize(Data $data, string $field): void
+    {
+        $value = $data->get($field);
+
+        if ($value === null) {
+            return;
+        }
+
+        try {
+            DateTimeValue::fromString($value);
+
+            return;
+        }
+        catch (Exception) {}
+
+        $dateTime = DateTimeImmutable::createFromFormat(DateTimeInterface::ATOM, $value);
+
+        if ($dateTime === false) {
+            return;
+        }
+
+        $value = $dateTime
+            ->setTimezone(new DateTimeZone('UTC'))
+            ->format(DateTimeUtil::SYSTEM_DATE_TIME_FORMAT);
+
+        $data->set($field, $value);
+    }
+}

application/Espo/Classes/FieldSanitizers/DatetimeOptionalDate.php

@@ -0,0 +1,72 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldSanitizers;
+
+use DateTimeImmutable;
+use DateTimeInterface;
+use Espo\Core\Field\Date;
+use Espo\Core\FieldSanitize\Sanitizer;
+use Espo\Core\FieldSanitize\Sanitizer\Data;
+use Espo\Core\Utils\DateTime as DateTimeUtil;
+use Exception;
+
+/**
+ * @noinspection PhpUnused
+ */
+class DatetimeOptionalDate implements Sanitizer
+{
+    public function sanitize(Data $data, string $field): void
+    {
+        $attribute = $field . 'Date';
+
+        $value = $data->get($attribute);
+
+        if ($value === null) {
+            return;
+        }
+
+        try {
+            Date::fromString($value);
+
+            return;
+        }
+        catch (Exception) {}
+
+        $dateTime = DateTimeImmutable::createFromFormat(DateTimeInterface::ATOM, $value);
+
+        if ($dateTime === false) {
+            return;
+        }
+
+        $value = $dateTime->format(DateTimeUtil::SYSTEM_DATE_FORMAT);
+
+        $data->set($attribute, $value);
+    }
+}

application/Espo/Classes/FieldSanitizers/EmptyStringToNull.php

@@ -0,0 +1,58 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldSanitizers;
+
+use Espo\Core\FieldSanitize\Sanitizer;
+use Espo\Core\FieldSanitize\Sanitizer\Data;
+
+/**
+ * @noinspection PhpUnused
+ */
+class EmptyStringToNull implements Sanitizer
+{
+    public function sanitize(Data $data, string $field): void
+    {
+        if (!$data->has($field)) {
+            return;
+        }
+
+        $value = $data->get($field);
+
+        if (!is_string($value)) {
+            return;
+        }
+
+        if ($value === '') {
+            $value = null;
+        }
+
+        $data->set($field, $value);
+    }
+}

application/Espo/Classes/FieldSanitizers/StringLowerCase.php

@@ -0,0 +1,56 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldSanitizers;
+
+use Espo\Core\FieldSanitize\Sanitizer;
+use Espo\Core\FieldSanitize\Sanitizer\Data;
+
+/**
+ * @noinspection PhpUnused
+ */
+class StringLowerCase implements Sanitizer
+{
+    public function sanitize(Data $data, string $field): void
+    {
+        if (!$data->has($field)) {
+            return;
+        }
+
+        $value = $data->get($field);
+
+        if (!is_string($value)) {
+            return;
+        }
+
+        $value = mb_strtolower($value);
+
+        $data->set($field, $value);
+    }
+}

application/Espo/Classes/FieldSanitizers/StringTrim.php

@@ -0,0 +1,60 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldSanitizers;
+
+use Espo\Core\FieldSanitize\Sanitizer;
+use Espo\Core\FieldSanitize\Sanitizer\Data;
+
+/**
+ * @noinspection PhpUnused
+ */
+class StringTrim implements Sanitizer
+{
+    public function sanitize(Data $data, string $field): void
+    {
+        if (!$data->has($field)) {
+            return;
+        }
+
+        $value = $data->get($field);
+
+        if (!is_string($value)) {
+            return;
+        }
+
+        $value = trim($value);
+
+        if ($value === '') {
+            $value = null;
+        }
+
+        $data->set($field, $value);
+    }
+}

application/Espo/Classes/FieldSanitizers/StringUpperCase.php

@@ -0,0 +1,56 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldSanitizers;
+
+use Espo\Core\FieldSanitize\Sanitizer;
+use Espo\Core\FieldSanitize\Sanitizer\Data;
+
+/**
+ * @noinspection PhpUnused
+ */
+class StringUpperCase implements Sanitizer
+{
+    public function sanitize(Data $data, string $field): void
+    {
+        if (!$data->has($field)) {
+            return;
+        }
+
+        $value = $data->get($field);
+
+        if (!is_string($value)) {
+            return;
+        }
+
+        $value = mb_strtoupper($value);
+
+        $data->set($field, $value);
+    }
+}

application/Espo/Classes/FieldValidators/InboundEmail/FetchSince/Required.php

@@ -0,0 +1,56 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldValidators\InboundEmail\FetchSince;
+
+use Espo\Core\FieldValidation\Validator;
+use Espo\Core\FieldValidation\Validator\Data;
+use Espo\Core\FieldValidation\Validator\Failure;
+use Espo\Entities\EmailAccount;
+use Espo\Entities\InboundEmail;
+use Espo\ORM\Entity;
+
+/**
+ * @implements Validator<InboundEmail|EmailAccount>
+ */
+class Required implements Validator
+{
+    public function validate(Entity $entity, string $field, Data $data): ?Failure
+    {
+        if (!$entity->isAvailableForFetching()) {
+            return null;
+        }
+
+        if (!$entity->get('fetchSince')) {
+            return Failure::create();
+        }
+
+        return null;
+    }
+}

application/Espo/Classes/FieldValidators/IntType.php

@@ -29,16 +29,54 @@
 
 namespace Espo\Classes\FieldValidators;
 
+use Doctrine\DBAL\Types\Types;
+use Espo\ORM\Defs;
 use Espo\ORM\Entity;
 use stdClass;
 
 class IntType
 {
+    public function __construct(
+        private Defs $defs,
+    ) {}
+
     public function checkRequired(Entity $entity, string $field): bool
     {
         return $this->isNotEmpty($entity, $field);
     }
 
+    /** @noinspection PhpUnused */
+    public function checkRangeInternal(Entity $entity, string $field): bool
+    {
+        $value = $entity->get($field);
+
+        if ($value === null) {
+            return true;
+        }
+
+        $dbType = $this->defs
+            ->getEntity($entity->getEntityType())
+            ->tryGetAttribute($field)
+            ?->getParam('dbType') ?? Types::INTEGER;
+
+        $ranges = [
+            Types::INTEGER => [-2147483648, 2147483647],
+            Types::SMALLINT => [-32768, 32767],
+        ];
+
+        $range = $ranges[$dbType] ?? null;
+
+        if (!$range) {
+            return true;
+        }
+
+        if ($value < $range[0] || $value > $range[1]) {
+            return false;
+        }
+
+        return true;
+    }
+
     /**
      * @param mixed $validationValue
      * @noinspection PhpUnused

application/Espo/Classes/FieldValidators/LinkMultipleType.php

@@ -36,20 +36,17 @@ use Espo\Core\ORM\Entity as CoreEntity;
 
 use stdClass;
 
+/**
+ * @noinspection PhpUnused
+ */
 class LinkMultipleType
 {
-    private Metadata $metadata;
-    private Defs $defs;
-
     private const COLUMN_TYPE_ENUM = 'enum';
     private const COLUMN_TYPE_VARCHAR = 'varchar';
     private const COLUMN_TYPE_BOOL = 'bool';
 
-    public function __construct(Metadata $metadata, Defs $defs)
-    {
-        $this->metadata = $metadata;
-        $this->defs = $defs;
-    }
+    public function __construct(private Metadata $metadata, private Defs $defs)
+    {}
 
     public function checkRequired(Entity $entity, string $field): bool
     {
@@ -63,6 +60,7 @@ class LinkMultipleType
         return count($idList) > 0;
     }
 
+    /** @noinspection PhpUnused */
     public function checkPattern(Entity $entity, string $field): bool
     {
         /** @var ?mixed[] $idList */
@@ -93,6 +91,27 @@ class LinkMultipleType
         return true;
     }
 
+    /** @noinspection PhpUnused */
+    public function checkMaxCount(Entity $entity, string $field, ?int $maxCount): bool
+    {
+        if ($maxCount === null) {
+            return true;
+        }
+
+        $list = $entity->get($field . 'Ids');
+
+        if (!is_array($list)) {
+            return true;
+        }
+
+        if (count($list) > $maxCount) {
+            return false;
+        }
+
+        return true;
+    }
+
+    /** @noinspection PhpUnused */
     public function checkColumnsValid(Entity $entity, string $field): bool
     {
         if (!$entity instanceof CoreEntity) {

application/Espo/Classes/FieldValidators/PhoneType.php

@@ -31,6 +31,7 @@ namespace Espo\Classes\FieldValidators;
 
 use Brick\PhoneNumber\PhoneNumber;
 use Brick\PhoneNumber\PhoneNumberParseException;
+use Espo\Core\PhoneNumber\Util;
 use Espo\Core\Utils\Config;
 use Espo\Core\Utils\Metadata;
 use Espo\ORM\Defs;
@@ -203,6 +204,22 @@ class PhoneType
             return true;
         }
 
+        $ext = null;
+
+        if ($this->config->get('phoneNumberExtensions')) {
+            [$number, $ext] = Util::splitExtension($number);
+        }
+
+        if ($ext) {
+            if (!preg_match('/[0-9]+/', $ext)) {
+                return false;
+            }
+
+            if (strlen($ext) > 6) {
+                return false;
+            }
+        }
+
         try {
             $numberObj = PhoneNumber::parse($number);
         }

application/Espo/Classes/FieldValidators/ScheduledJob/Scheduling/Valid.php

@@ -27,38 +27,36 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Services;
-
-use Espo\ORM\Entity;
-
-use Espo\Core\Exceptions\BadRequest;
+namespace Espo\Classes\FieldValidators\ScheduledJob\Scheduling;
 
 use Cron\CronExpression;
-
+use Espo\Core\FieldValidation\Validator;
+use Espo\Core\FieldValidation\Validator\Data;
+use Espo\Core\FieldValidation\Validator\Failure;
+use Espo\Entities\ScheduledJob;
+use Espo\ORM\Entity;
 use Exception;
 
 /**
- * @extends Record<\Espo\Entities\ScheduledJob>
+ * @implements Validator<ScheduledJob>
  */
-class ScheduledJob extends Record
+class Valid implements Validator
 {
-    /** Should not be removed. */
-    protected bool $findLinkedLogCountQueryDisabled = true;
-
-    public function processValidation(Entity $entity, $data)
+    public function validate(Entity $entity, string $field, Data $data): ?Failure
     {
-        parent::processValidation($entity, $data);
+        $scheduling = $entity->getScheduling();
 
-        $scheduling = $entity->get('scheduling');
+        if ($scheduling === null) {
+            return null;
+        }
 
         try {
-            $cronExpression = CronExpression::factory($scheduling);
+            new CronExpression($scheduling);
+        }
+        catch (Exception) {
+            return Failure::create();
+        }
 
-            /** @phpstan-ignore-next-line*/
-            $cronExpression->getNextRunDate()->format('Y-m-d H:i:s');
-        }
-        catch (Exception $e) {
-            throw new BadRequest("Not valid scheduling expression.");
-        }
+        return null;
     }
 }

application/Espo/Classes/FieldValidators/Settings/AuthIpAddressWhitelist/Valid.php

@@ -0,0 +1,90 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldValidators\Settings\AuthIpAddressWhitelist;
+
+use Espo\Core\FieldValidation\Validator;
+use Espo\Core\FieldValidation\Validator\Data;
+use Espo\Core\FieldValidation\Validator\Failure;
+use Espo\ORM\Entity;
+
+/**
+ * @implements Validator<Entity>
+ */
+class Valid implements Validator
+{
+    public function validate(Entity $entity, string $field, Data $data): ?Failure
+    {
+        $list = $entity->get($field);
+
+        if (!is_array($list)) {
+            return null;
+        }
+
+        foreach ($list as $item) {
+            if (!is_string($item)) {
+                continue;
+            }
+
+            if (!$this->isValid($item)) {
+                return Failure::create();
+            }
+        }
+
+        return null;
+    }
+
+    private function isValid(string $item): bool
+    {
+        $address = $item;
+
+        if (count(explode('/', $item)) > 1) {
+            [$address, $mask] = explode('/', $item, 2);
+
+            if (!is_numeric($mask)) {
+                return false;
+            }
+
+            $mask = (int) $mask;
+
+            if ($mask < 0 || $mask > 128) {
+                return false;
+            }
+        }
+
+        if (
+            filter_var($address, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) === false &&
+            filter_var($address, FILTER_VALIDATE_IP) === false
+        ) {
+            return false;
+        }
+
+        return true;
+    }
+}

application/Espo/Classes/FieldValidators/Settings/ThousandSeparator/Valid.php

@@ -0,0 +1,60 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldValidators\Settings\ThousandSeparator;
+
+use Espo\Core\FieldValidation\Validator;
+use Espo\Core\FieldValidation\Validator\Data;
+use Espo\Core\FieldValidation\Validator\Failure;
+use Espo\ORM\Entity;
+
+/**
+ * @implements Validator<Entity>
+ */
+class Valid implements Validator
+{
+    public function validate(Entity $entity, string $field, Data $data): ?Failure
+    {
+        $value = $entity->get($field);
+
+        if (!$value) {
+            return null;
+        }
+
+        if (!is_string($value)) {
+            return Failure::create();
+        }
+
+        if (preg_match('/^[0-9]$/', $value)) {
+            return Failure::create();
+        }
+
+        return null;
+    }
+}

application/Espo/Classes/FieldValidators/User/DefaultTeam/IsUserTeam.php

@@ -0,0 +1,55 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\FieldValidators\User\DefaultTeam;
+
+use Espo\Core\FieldValidation\Validator;
+use Espo\Core\FieldValidation\Validator\Data;
+use Espo\Core\FieldValidation\Validator\Failure;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+
+/**
+ * @implements Validator<User>
+ */
+class IsUserTeam implements Validator
+{
+    public function validate(Entity $entity, string $field, Data $data): ?Failure
+    {
+        if (!$entity->getDefaultTeam()) {
+            return null;
+        }
+
+        if (in_array($entity->getDefaultTeam()->getId(), $entity->getTeamIdList())) {
+            return null;
+        }
+
+        return Failure::create();
+    }
+}

application/Espo/Classes/Jobs/AuthTokenControl.php

@@ -30,61 +30,99 @@
 namespace Espo\Classes\Jobs;
 
 use Espo\Entities\AuthToken;
+use Espo\Entities\Portal;
 use Espo\Core\Job\JobDataLess;
 use Espo\Core\ORM\EntityManager;
 use Espo\Core\Utils\Config;
 use Espo\Core\Utils\DateTime as DateTimeUtil;
-
 use DateTime;
 
+/**
+ * @noinspection PhpUnused
+ */
 class AuthTokenControl implements JobDataLess
 {
-    private Config $config;
-    private EntityManager $entityManager;
+    private const LIMIT = 500;
 
-    public function __construct(Config $config, EntityManager $entityManager)
-    {
-        $this->config = $config;
-        $this->entityManager = $entityManager;
-    }
+    public function __construct(
+        private Config $config,
+        private EntityManager $entityManager
+    ) {}
 
     public function run(): void
     {
-        $authTokenLifetime = $this->config->get('authTokenLifetime');
-        $authTokenMaxIdleTime = $this->config->get('authTokenMaxIdleTime');
+        $lifetime = (int) ($this->config->get('authTokenLifetime', 0) * 60);
+        $maxIdleTime = (int) ($this->config->get('authTokenMaxIdleTime', 0) * 60);
 
-        if (!$authTokenLifetime && !$authTokenMaxIdleTime) {
+        $portalIds = [];
+
+        /** @var iterable<Portal> $portals */
+        $portals = $this->entityManager
+            ->getRDBRepositoryByClass(Portal::class)
+            ->find();
+
+        foreach ($portals as $portal) {
+            $portalIds[] = $portal->getId();
+        }
+
+        $this->process(null, $lifetime, $maxIdleTime, $portalIds);
+
+        foreach ($portals as $portal) {
+            $itemLifetime = $portal->get('authTokenLifetime') !== null ?
+                (int) ($portal->get('authTokenLifetime') * 60) :
+                $lifetime;
+
+            $itemMaxIdleTime = $portal->get('authTokenMaxIdleTime') !== null ?
+                (int) ($portal->get('authTokenMaxIdleTime') * 60) :
+                $maxIdleTime;
+
+            $this->process($portal->getId(), $itemLifetime, $itemMaxIdleTime);
+        }
+    }
+
+    /**
+     * @param string[] $ignorePortalIds
+     */
+    private function process(?string $portalId, int $lifetime, int $maxIdleTime, array $ignorePortalIds = []): void
+    {
+        if (!$lifetime && !$maxIdleTime) {
             return;
         }
 
-        $whereClause = [
-            'isActive' => true,
-        ];
+        $whereClause = ['isActive' => true];
 
-        if ($authTokenLifetime) {
-            $dt = new DateTime();
-
-            $dt->modify('-' . $authTokenLifetime . ' hours');
-
-            $authTokenLifetimeThreshold = $dt->format(DateTimeUtil::SYSTEM_DATE_TIME_FORMAT);
-
-            $whereClause['createdAt<'] = $authTokenLifetimeThreshold;
+        if ($portalId) {
+            $whereClause['portalId'] = $portalId;
         }
 
-        if ($authTokenMaxIdleTime) {
+        if (!$portalId && $ignorePortalIds !== []) {
+            $whereClause[] = [
+                'OR' => [
+                    ['portalId' => null],
+                    ['portalId!=' => $ignorePortalIds],
+                ]
+            ];
+        }
+
+        if ($lifetime) {
             $dt = new DateTime();
+            $dt->modify("-$lifetime minutes");
 
-            $dt->modify('-' . $authTokenMaxIdleTime . ' hours');
+            $whereClause['createdAt<'] = $dt->format(DateTimeUtil::SYSTEM_DATE_TIME_FORMAT);
+        }
 
-            $authTokenMaxIdleTimeThreshold = $dt->format(DateTimeUtil::SYSTEM_DATE_TIME_FORMAT);
+        if ($maxIdleTime) {
+            $dt = new DateTime();
+            $dt->modify("-$maxIdleTime minutes");
 
-            $whereClause['lastAccess<'] = $authTokenMaxIdleTimeThreshold;
+            $whereClause['lastAccess<'] = $dt->format(DateTimeUtil::SYSTEM_DATE_TIME_FORMAT);
         }
 
         $tokenList = $this->entityManager
             ->getRDBRepository(AuthToken::ENTITY_TYPE)
+            ->sth()
             ->where($whereClause)
-            ->limit(0, 500)
+            ->limit(0, self::LIMIT)
             ->find();
 
         foreach ($tokenList as $token) {

application/Espo/Classes/Jobs/CheckEmailAccounts.php

@@ -29,39 +29,31 @@
 
 namespace Espo\Classes\Jobs;
 
-use Espo\Core\Exceptions\Error;
-
 use Espo\Core\Mail\Account\PersonalAccount\Service;
 use Espo\Core\Job\Job;
 use Espo\Core\Job\Job\Data;
 
+use RuntimeException;
 use Throwable;
 
 class CheckEmailAccounts implements Job
 {
-    private $service;
-
-    public function __construct(Service $service)
-    {
-        $this->service = $service;
-    }
+    public function __construct(private Service $service)
+    {}
 
     public function run(Data $data): void
     {
         $targetId = $data->getTargetId();
 
         if (!$targetId) {
-            throw new Error("No target.");
+            throw new RuntimeException("No target.");
         }
 
         try {
             $this->service->fetch($targetId);
         }
         catch (Throwable $e) {
-            throw new Error(
-                'Job CheckEmailAccounts ' . $targetId . ': [' . $e->getCode() . '] ' . $e->getMessage() . ' ' .
-                $e->getFile() . ':' . $e->getLine()
-            );
+            throw new RuntimeException("CheckInboundEmails job failed, $targetId; {$e->getMessage()}", 0, $e);
         }
     }
 }

application/Espo/Classes/Jobs/CheckInboundEmails.php

@@ -29,37 +29,31 @@
 
 namespace Espo\Classes\Jobs;
 
-use Espo\Core\Exceptions\Error;
 use Espo\Core\Mail\Account\GroupAccount\Service;
 use Espo\Core\Job\Job;
 use Espo\Core\Job\Job\Data;
 
+use RuntimeException;
 use Throwable;
 
 class CheckInboundEmails implements Job
 {
-    private $service;
-
-    public function __construct(Service $service)
-    {
-        $this->service = $service;
-    }
+    public function __construct(private Service $service)
+    {}
 
     public function run(Data $data): void
     {
         $targetId = $data->getTargetId();
 
         if (!$targetId) {
-            throw new Error("No target.");
+            throw new RuntimeException("No target.");
         }
 
         try {
             $this->service->fetch($targetId);
         }
         catch (Throwable $e) {
-            throw new Error(
-                'Job CheckInboundEmails ' . $targetId . ': [' . $e->getCode() . '] ' .$e->getMessage()
-            );
+            throw new RuntimeException("CheckInboundEmails job failed, $targetId; {$e->getMessage()}", 0, $e);
         }
     }
 }

application/Espo/Classes/MassAction/Email/MoveToFolder.php

@@ -30,6 +30,7 @@
 namespace Espo\Classes\MassAction\Email;
 
 use Espo\Core\Exceptions\BadRequest;
+use Espo\Core\Exceptions\Error;
 use Espo\Core\Exceptions\Forbidden;
 use Espo\Core\MassAction\Data;
 use Espo\Core\MassAction\MassAction;
@@ -44,11 +45,10 @@ use Espo\ORM\EntityManager;
 use Espo\Tools\Email\Folder;
 use Espo\Tools\Email\InboxService as EmailService;
 use Exception;
+use RuntimeException;
 
 class MoveToFolder implements MassAction
 {
-    private const FOLDER_INBOX = Folder::INBOX;
-
     public function __construct(
         private QueryBuilder $queryBuilder,
         private EntityManager $entityManager,
@@ -68,7 +68,11 @@ class MoveToFolder implements MassAction
             throw new BadRequest("No folder ID.");
         }
 
-        if ($folderId !== self::FOLDER_INBOX && !str_starts_with($folderId, 'group:')) {
+        if (
+            $folderId !== Folder::INBOX &&
+            $folderId !== Folder::ARCHIVE &&
+            !str_starts_with($folderId, 'group:')
+        ) {
             $folder = $this->entityManager
                 ->getRDBRepositoryByClass(EmailFolder::class)
                 ->where([
@@ -93,7 +97,12 @@ class MoveToFolder implements MassAction
             }
         }
 
-        $query = $this->queryBuilder->build($params);
+        try {
+            $query = $this->queryBuilder->build($params);
+        }
+        catch (BadRequest|Forbidden $e) {
+            throw new RuntimeException($e->getMessage());
+        }
 
         $collection = $this->entityManager
             ->getRDBRepositoryByClass(Email::class)

application/Espo/Classes/MassAction/User/MassDelete.php

@@ -31,6 +31,7 @@ namespace Espo\Classes\MassAction\User;
 
 use Espo\Core\Acl;
 use Espo\Core\Exceptions\BadRequest;
+use Espo\Core\Exceptions\Error;
 use Espo\Core\Exceptions\Forbidden;
 use Espo\Core\MassAction\Actions\MassDelete as MassDeleteOriginal;
 use Espo\Core\MassAction\Data;
@@ -59,18 +60,19 @@ class MassDelete implements MassAction
     /**
      * @throws Forbidden
      * @throws BadRequest
+     * @throws Error
      */
     public function process(Params $params, Data $data): Result
     {
         $entityType = $params->getEntityType();
 
         if (!$this->acl->check($entityType, Acl\Table::ACTION_DELETE)) {
-            throw new Forbidden("No delete access for '{$entityType}'.");
+            throw new Forbidden("No delete access for '$entityType'.");
         }
 
         if (
             !$params->hasIds() &&
-            $this->acl->getPermissionLevel('massUpdatePermission') !== Acl\Table::LEVEL_YES
+            $this->acl->getPermissionLevel(Acl\Permission::MASS_UPDATE) !== Acl\Table::LEVEL_YES
         ) {
             throw new Forbidden("No mass-update permission.");
         }

application/Espo/Classes/MassAction/User/MassUpdate.php

@@ -51,7 +51,7 @@ use Espo\Tools\MassUpdate\Data as MassUpdateData;
 
 class MassUpdate implements MassAction
 {
-    private const PERMISSION = 'massUpdatePermission';
+    private const PERMISSION = Acl\Permission::MASS_UPDATE;
 
     /** @var string[] */
     private array $notAllowedAttributeList = [

application/Espo/Classes/Record/Attachment/CreateInputFilter.php

@@ -0,0 +1,156 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Record\Attachment;
+
+use Espo\Core\Exceptions\BadRequest;
+use Espo\Core\Exceptions\Error;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\Input\Data;
+use Espo\Core\Record\Input\Filter;
+use Espo\Entities\Attachment;
+use Espo\ORM\EntityManager;
+use Espo\Tools\Attachment\AccessChecker;
+use Espo\Tools\Attachment\DetailsObtainer;
+use Espo\Tools\Attachment\FieldData;
+
+/**
+ * @noinspection PhpUnused
+ */
+class CreateInputFilter implements Filter
+{
+    public function __construct(
+        private EntityManager $entityManager,
+        private AccessChecker $accessChecker,
+        private DetailsObtainer $detailsObtainer
+    ) {}
+
+    /**
+     * @throws BadRequest
+     * @throws Error
+     * @throws Forbidden
+     */
+    public function filter(Data $data): void
+    {
+        $data->clear('parentId');
+        $data->clear('relatedId');
+
+        $contents = $this->handleContents($data);
+
+        $relatedEntityType = $this->getRelatedEntityType($data);
+
+        $field = $data->get('field');
+        $role = $data->get('role') ?? Attachment::ROLE_ATTACHMENT;
+
+        if (!$relatedEntityType || !$field) {
+            throw new BadRequest("No `field` and `parentType`.");
+        }
+
+        $fieldData = new FieldData($field, $data->get('parentType'), $data->get('relatedType'));
+
+        $this->accessChecker->check($fieldData, $role);
+        $this->checkMaxSize($contents, $data, $field, $role);
+    }
+
+    private function getRelatedEntityType(Data $data): ?string
+    {
+        if ($data->get('parentType') !== null) {
+            $data->clear('relatedType');
+
+            return $data->get('parentType');
+        }
+
+        if ($data->get('relatedType') !== null) {
+            return $data->get('relatedType');
+        }
+
+        return null;
+    }
+
+    /**
+     * @throws BadRequest
+     */
+    private function handleContents(Data $data): string
+    {
+        $isBeingUploaded = $data->get('isBeingUploaded') ?? false;
+
+        $contents = '';
+
+        if (!$isBeingUploaded) {
+            if (!$data->has('file')) {
+                throw new BadRequest("No file contents.");
+            }
+
+            $file = $data->get('file');
+
+            if (!is_string($file)) {
+                throw new BadRequest("Non-string file contents.");
+            }
+
+            $arr = explode(',', $file);
+
+            if (count($arr) < 2) {
+                throw new BadRequest("Bad file contents.");
+            }
+
+            $contents = base64_decode($arr[1]);
+
+            if ($contents === false) {
+                throw new BadRequest("Could not decode file contents.");
+            }
+        }
+
+        $data->set('contents', $contents);
+
+        return $contents;
+    }
+
+    /**
+     * @throws BadRequest
+     */
+    private function checkMaxSize(string $contents, Data $data, mixed $field, mixed $role): void
+    {
+        $size = mb_strlen($contents, '8bit');
+
+        $dummy = $this->entityManager->getRepositoryByClass(Attachment::class)->getNew();
+
+        $dummy->set([
+            'parentType' => $data->get('parentType'),
+            'relatedType' => $data->get('relatedType'),
+            'field' => $field,
+            'role' => $role,
+        ]);
+
+        $maxSize = $this->detailsObtainer->getUploadMaxSize($dummy);
+
+        if ($maxSize && $size > $maxSize * 1024 * 1024) {
+            throw new BadRequest("File size should not exceed $maxSize Mb.");
+        }
+    }
+}

application/Espo/Classes/Record/Attachment/UpdateInputFilter.php

@@ -0,0 +1,49 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Record\Attachment;
+
+use Espo\Core\Record\Input\Data;
+use Espo\Core\Record\Input\Filter;
+
+/**
+ * @noinspection PhpUnused
+ */
+class UpdateInputFilter implements Filter
+{
+    public function filter(Data $data): void
+    {
+        $data->clear('parentId');
+        $data->clear('parentType');
+        $data->clear('relatedId');
+        $data->clear('relatedType');
+        $data->clear('isBeingUploaded');
+        $data->clear('storage');
+    }
+}

application/Espo/Classes/Record/AuthToken/UpdateInputFilter.php

@@ -27,33 +27,26 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Services;
+namespace Espo\Classes\Record\AuthToken;
 
-use stdClass;
+use Espo\Core\Record\Input\Data;
+use Espo\Core\Record\Input\Filter;
 
 /**
- * @extends Record<\Espo\Entities\AuthToken>
+ * @noinspection PhpUnused
  */
-class AuthToken extends Record
+class UpdateInputFilter implements Filter
 {
-    protected $actionHistoryDisabled = true;
-
-    public function filterUpdateInput(stdClass $data): void
+    public function filter(Data $data): void
     {
-        parent::filterUpdateInput($data);
-
-        $dataArray = get_object_vars($data);
-
-        foreach (array_keys($dataArray) as $attribute) {
+        foreach ($data->getAttributeList() as $attribute) {
             if ($attribute !== 'isActive') {
-                unset($data->$attribute);
-
-                continue;
+                $data->clear($attribute);
             }
         }
 
-        if ($data->isActive ?? false) {
-            unset($data->isActive);
+        if ($data->get('isActive')) {
+            $data->clear('isActive');
         }
     }
 }

application/Espo/Classes/Record/InboundEmail/PasswordsInputFilter.php

@@ -0,0 +1,71 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Record\InboundEmail;
+
+use Espo\Core\Exceptions\BadRequest;
+use Espo\Core\Record\Input\Data;
+use Espo\Core\Record\Input\Filter;
+use Espo\Core\Utils\Crypt;
+
+/**
+ * @noinspection PhpUnused
+ */
+class PasswordsInputFilter implements Filter
+{
+    public function __construct(
+        private Crypt $crypt
+    ) {}
+
+    /**
+     * @throws BadRequest
+     */
+    public function filter(Data $data): void
+    {
+        $password = $data->get('password');
+
+        if ($password !== null) {
+            if (!is_string($password)) {
+                throw new BadRequest();
+            }
+
+            $data->set('password', $this->crypt->encrypt($password));
+        }
+
+        $smtpPassword = $data->get('smtpPassword');
+
+        if ($smtpPassword !== null) {
+            if (!is_string($smtpPassword)) {
+                throw new BadRequest();
+            }
+
+            $data->set('smtpPassword', $this->crypt->encrypt($smtpPassword));
+        }
+    }
+}

application/Espo/Classes/Record/Note/UpdateInputFilter.php

@@ -0,0 +1,50 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Record\Note;
+
+use Espo\Core\Record\Input\Data;
+use Espo\Core\Record\Input\Filter;
+
+/**
+ * @noinspection PhpUnused
+ */
+class UpdateInputFilter implements Filter
+{
+    public function filter(Data $data): void
+    {
+        $data->clear('parentId');
+        $data->clear('parentType');
+        $data->clear('targetType');
+        $data->clear('usersIds');
+        $data->clear('teamsIds');
+        $data->clear('portalsIds');
+        $data->clear('isGlobal');
+    }
+}

application/Espo/Classes/Record/Portal/InputFilter.php

@@ -0,0 +1,59 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Record\Portal;
+
+use Espo\Core\Record\Input\Data;
+use Espo\Core\Record\Input\Filter;
+use Espo\Core\Utils\Config;
+use Espo\Entities\User;
+
+/**
+ * @noinspection PhpUnused
+ */
+class InputFilter implements Filter
+{
+    public function __construct(
+        private User $user,
+        private Config $config
+    ) {}
+
+    public function filter(Data $data): void
+    {
+        if (!$this->config->get('restrictedMode')) {
+            return;
+        }
+
+        if ($this->user->isSuperAdmin()) {
+            return;
+        }
+
+        $data->clear('customUrl');
+    }
+}

application/Espo/Classes/Record/User/OutputFilter.php

@@ -0,0 +1,74 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Record\User;
+
+use Espo\Core\Authentication\Logins\Hmac;
+use Espo\Core\Record\Output\Filter;
+use Espo\Core\Utils\ApiKey;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+
+/**
+ * @implements Filter<User>
+ */
+class OutputFilter implements Filter
+{
+    public function __construct(
+        private User $user,
+        private ApiKey $apiKey
+    ) {}
+
+    public function filter(Entity $entity): void
+    {
+        $entity->clear('sendAccessInfo');
+
+        $this->filterApiUser($entity);
+    }
+
+    private function filterApiUser(User $entity): void
+    {
+        if (!$entity->isApi()) {
+            return;
+        }
+
+        if ($this->user->isAdmin()) {
+            if ($entity->getAuthMethod() === Hmac::NAME) {
+                $secretKey = $this->apiKey->getSecretKeyForUserId($entity->getId());
+
+                $entity->set('secretKey', $secretKey);
+            }
+
+            return;
+        }
+
+        $entity->clear('apiKey');
+        $entity->clear('secretKey');
+    }
+}

application/Espo/Classes/Record/Webhook/DefaultsPopulator.php

@@ -0,0 +1,56 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Record\Webhook;
+
+use Espo\Core\Record\Defaults\DefaultPopulator;
+use Espo\Core\Record\Defaults\Populator;
+use Espo\Entities\User;
+use Espo\Entities\Webhook;
+use Espo\ORM\Entity;
+
+/**
+ * @implements Populator<Webhook>
+ */
+class DefaultsPopulator implements Populator
+{
+    public function __construct(
+        private DefaultPopulator $defaultsDefaultsPopulator,
+        private User $user
+    ) {}
+
+    public function populate(Entity $entity): void
+    {
+        $this->defaultsDefaultsPopulator->populate($entity);
+
+        if ($this->user->isApi()) {
+            $entity->set('userId', $this->user->getId());
+        }
+    }
+}

application/Espo/Classes/Record/Webhook/UpdateInputFilter.php

@@ -0,0 +1,51 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Record\Webhook;
+
+use Espo\Core\Record\Input\Data;
+use Espo\Core\Record\Input\Filter;
+use Espo\Entities\User;
+
+/**
+ * @noinspection PhpUnused
+ */
+class UpdateInputFilter implements Filter
+{
+    public function __construct(
+        private User $user
+    ) {}
+
+    public function filter(Data $data): void
+    {
+        if (!$this->user->isAdmin()) {
+            $data->clear('event');
+        }
+    }
+}

application/Espo/Classes/RecordHooks/AddressCountry/BeforeSave.php

@@ -0,0 +1,70 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\AddressCountry;
+
+use Espo\Core\Exceptions\ConflictSilent;
+use Espo\Core\Exceptions\Error\Body;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\AddressCountry;
+use Espo\ORM\Entity;
+use Espo\ORM\EntityManager;
+
+/**
+ * @implements SaveHook<AddressCountry>
+ */
+class BeforeSave implements SaveHook
+{
+    public function __construct(
+        private EntityManager $entityManager,
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $where = ['name' => $entity->getName()];
+
+        if (!$entity->isNew()) {
+            $where['id!='] = $entity->getId();
+        }
+
+        $one = $this->entityManager
+            ->getRDBRepositoryByClass(AddressCountry::class)
+            ->where($where)
+            ->findOne();
+
+        if (!$one) {
+            return;
+        }
+
+        throw ConflictSilent::createWithBody(
+            'duplicateError',
+            Body::create()->withMessageTranslation('duplicateConflict')
+        );
+    }
+}

application/Espo/Classes/RecordHooks/Attachment/AfterCreate.php

@@ -27,18 +27,19 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Modules\Crm\Services;
+namespace Espo\Classes\RecordHooks\Attachment;
 
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Attachment;
 use Espo\ORM\Entity;
 
-class Call extends Meeting
+/**
+ * @implements SaveHook<Attachment>
+ */
+class AfterCreate implements SaveHook
 {
-    protected function afterUpdateEntity(Entity $entity, $data)
+    public function process(Entity $entity): void
     {
-        parent::afterUpdateEntity($entity, $data);
-
-        if (isset($data->contactsIds) || isset($data->leadsIds)) {
-            $this->loadAdditionalFields($entity);
-        }
+        $entity->clear('contents');
     }
 }

application/Espo/Classes/RecordHooks/Attachment/BeforeCreate.php

@@ -0,0 +1,100 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Attachment;
+
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Core\Utils\Config;
+use Espo\Core\Utils\Metadata;
+use Espo\Entities\Attachment;
+use Espo\ORM\Entity;
+use Espo\Tools\Attachment\Checker;
+use Espo\Tools\Attachment\DetailsObtainer;
+
+/**
+ * @implements SaveHook<Attachment>
+ */
+class BeforeCreate implements SaveHook
+{
+    public function __construct(
+        private Config $config,
+        private Metadata $metadata,
+        private DetailsObtainer $detailsObtainer,
+        private Checker $checker
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $this->processStorage($entity);
+        $this->processRole($entity);
+        $this->processSize($entity);
+
+        $this->checker->checkType($entity);
+    }
+
+    private function processStorage(Attachment $entity): void
+    {
+        $storage = $entity->getStorage();
+
+        $availableStorageList = $this->config->get('attachmentAvailableStorageList') ?? [];
+
+        if (
+            $storage &&
+            (
+                !in_array($storage, $availableStorageList) ||
+                !$this->metadata->get(['app', 'fileStorage', 'implementationClassNameMap', $storage])
+            )
+        ) {
+            $entity->clear('storage');
+        }
+    }
+
+    /**
+     * @throws Forbidden
+     */
+    private function processSize(Attachment $entity): void
+    {
+        $size = $entity->getSize();
+
+        $maxSize = $this->detailsObtainer->getUploadMaxSize($entity);
+
+        // Checking not actual file size but a set value.
+        if ($size && $size > $maxSize) {
+            throw new Forbidden("Attachment size exceeds `attachmentUploadMaxSize`.");
+        }
+    }
+
+    private function processRole(Attachment $entity): void
+    {
+        if (!$entity->getRole()) {
+            $entity->setRole(Attachment::ROLE_ATTACHMENT);
+        }
+    }
+}

application/Espo/Classes/RecordHooks/Email/AfterUpdate.php

@@ -0,0 +1,64 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Email;
+
+use Espo\Core\Exceptions\BadRequest;
+use Espo\Core\Exceptions\Error;
+use Espo\Core\Mail\Exceptions\NoSmtp;
+use Espo\Core\Mail\Exceptions\SendingError;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Email;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+use Espo\Tools\Email\SendService;
+
+/**
+ * @implements SaveHook<Email>
+ */
+class AfterUpdate implements SaveHook
+{
+    public function __construct(
+        private User $user,
+        private SendService $sendService
+    ) {}
+
+    /**
+     * @throws BadRequest
+     * @throws Error
+     * @throws NoSmtp
+     * @throws SendingError
+     */
+    public function process(Entity $entity): void
+    {
+        if ($entity->getStatus() === Email::STATUS_SENDING) {
+            $this->sendService->send($entity, $this->user);
+        }
+    }
+}

application/Espo/Classes/RecordHooks/Email/BeforeCreate.php

@@ -0,0 +1,50 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Email;
+
+use Espo\Core\Mail\Sender;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Email;
+use Espo\ORM\Entity;
+
+/**
+ * @implements SaveHook<Email>
+ */
+class BeforeCreate implements SaveHook
+{
+    public function process(Entity $entity): void
+    {
+        if ($entity->getStatus() === Email::STATUS_SENDING) {
+            $messageId = Sender::generateMessageId($entity);
+
+            $entity->setMessageId('<' . $messageId . '>');
+        }
+    }
+}

application/Espo/Classes/RecordHooks/Email/BeforeUpdate.php

@@ -0,0 +1,151 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Email;
+
+use Espo\Core\Mail\Sender;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Core\Utils\FieldUtil;
+use Espo\Core\Utils\SystemUser;
+use Espo\Entities\Email;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+use Espo\ORM\EntityManager;
+
+/**
+ * @implements SaveHook<Email>
+ */
+class BeforeUpdate implements SaveHook
+{
+    /** @var string[] */
+    private $allowedForUpdateFieldList = [
+        'parent',
+        'teams',
+        'assignedUser',
+    ];
+
+    public function __construct(
+        private User $user,
+        private EntityManager $entityManager,
+        private FieldUtil $fieldUtil
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $skipFilter = false;
+
+        if ($this->user->isAdmin()) {
+            $skipFilter = true;
+        }
+
+        if ($this->isEmailManuallyArchived($entity)) {
+            $skipFilter = true;
+        }
+        else if ($entity->isAttributeChanged('dateSent')) {
+            $entity->set('dateSent', $entity->getFetched('dateSent'));
+        }
+
+        if ($entity->getStatus() === Email::STATUS_DRAFT) {
+            $skipFilter = true;
+        }
+
+        if (
+            $entity->getStatus() === Email::STATUS_SENDING &&
+            $entity->getFetched('status') === Email::STATUS_DRAFT
+        ) {
+            $skipFilter = true;
+        }
+
+        if (
+            $entity->isAttributeChanged('status') &&
+            $entity->getFetched('status') === Email::STATUS_ARCHIVED
+        ) {
+            $entity->setStatus(Email::STATUS_ARCHIVED);
+        }
+
+        if (!$skipFilter) {
+            $this->clearEntityForUpdate($entity);
+        }
+
+        if ($entity->getStatus() == Email::STATUS_SENDING) {
+            $messageId = Sender::generateMessageId($entity);
+
+            $entity->setMessageId('<' . $messageId . '>');
+        }
+    }
+
+    private function isEmailManuallyArchived(Email $email): bool
+    {
+        if ($email->getStatus() !== Email::STATUS_ARCHIVED) {
+            return false;
+        }
+
+        $userId = $email->getCreatedBy()?->getId();
+
+        if (!$userId) {
+            return false;
+        }
+
+        $user = $this->entityManager
+            ->getRDBRepositoryByClass(User::class)
+            ->getById($userId);
+
+        if (!$user) {
+            return true;
+        }
+
+        return $user->getUserName() !== SystemUser::NAME;
+    }
+
+    private function clearEntityForUpdate(Email $email): void
+    {
+        $fieldDefsList = $this->entityManager
+            ->getDefs()
+            ->getEntity(Email::ENTITY_TYPE)
+            ->getFieldList();
+
+        foreach ($fieldDefsList as $fieldDefs) {
+            $field = $fieldDefs->getName();
+
+            if ($fieldDefs->getParam('isCustom')) {
+                continue;
+            }
+
+            if (in_array($field, $this->allowedForUpdateFieldList)) {
+                continue;
+            }
+
+            $attributeList = $this->fieldUtil->getAttributeList(Email::ENTITY_TYPE, $field);
+
+            foreach ($attributeList as $attribute) {
+                $email->clear($attribute);
+            }
+        }
+    }
+}

application/Espo/Classes/RecordHooks/Email/CheckFromAddress.php

@@ -0,0 +1,101 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Email;
+
+use Espo\Core\Acl;
+use Espo\Core\Exceptions\BadRequest;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Mail\Account\SendingAccountProvider;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Core\Utils\Config;
+use Espo\Entities\Email;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+
+/**
+ * @implements SaveHook<Email>
+ */
+class CheckFromAddress implements SaveHook
+{
+    public function __construct(
+        private User $user,
+        private SendingAccountProvider $sendingAccountProvider,
+        private Config $config,
+        private Acl $acl,
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        if ($this->user->isAdmin()) {
+            return;
+        }
+
+        $fromAddress = $entity->getFromAddress();
+
+        // Should be after 'getFromAddress'.
+        if (!$entity->isAttributeChanged('from')) {
+            return;
+        }
+
+        if (!$fromAddress) {
+            throw new BadRequest("No 'from' address");
+        }
+
+        if ($this->acl->checkScope('Import')) {
+            return;
+        }
+
+        $fromAddress = strtolower($fromAddress);
+
+        foreach ($this->user->getEmailAddressGroup()->getAddressList() as $address) {
+            if ($fromAddress === strtolower($address)) {
+                return;
+            }
+        }
+
+        if ($this->sendingAccountProvider->getShared($this->user, $fromAddress)) {
+            return;
+        }
+
+        $system = $this->sendingAccountProvider->getSystem();
+
+        if (
+            $system &&
+            $this->config->get('outboundEmailIsShared') &&
+            $system->getEmailAddress()
+        ) {
+            if ($fromAddress === strtolower($system->getEmailAddress())) {
+                return;
+            }
+        }
+
+        throw new Forbidden("Not allowed 'from' address.");
+    }
+}

application/Espo/Classes/RecordHooks/Email/MarkAsRead.php

@@ -0,0 +1,55 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Email;
+
+use Espo\Core\Record\Hook\ReadHook;
+use Espo\Core\Record\ReadParams;
+use Espo\Entities\Email;
+use Espo\ORM\Entity;
+use Espo\Tools\Email\InboxService;
+
+/**
+ * @implements ReadHook<Email>
+ */
+class MarkAsRead implements ReadHook
+{
+    public function __construct(
+        private InboxService $inboxService
+    ) {}
+
+    public function process(Entity $entity, ReadParams $params): void
+    {
+        if ($entity->isRead()) {
+            return;
+        }
+
+        $this->inboxService->markAsRead($entity->getId());
+    }
+}

application/Espo/Classes/RecordHooks/Email/MarkAsReadBeforeUpdate.php

@@ -0,0 +1,54 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Email;
+
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Email;
+use Espo\ORM\Entity;
+use Espo\Tools\Email\InboxService;
+
+/**
+ * @implements SaveHook<Email>
+ */
+class MarkAsReadBeforeUpdate implements SaveHook
+{
+    public function __construct(
+        private InboxService $inboxService
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        if ($entity->isRead()) {
+            return;
+        }
+
+        $this->inboxService->markAsRead($entity->getId());
+    }
+}

application/Espo/Classes/RecordHooks/EmailAccount/BeforeCreate.php

@@ -0,0 +1,69 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\EmailAccount;
+
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Core\Utils\Config;
+use Espo\Entities\EmailAccount;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+use Espo\ORM\EntityManager;
+use const PHP_INT_MAX;
+
+/**
+ * @implements SaveHook<EmailAccount>
+ */
+class BeforeCreate implements SaveHook
+{
+    public function __construct(
+        private User $user,
+        private Config $config,
+        private EntityManager $entityManager
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        if ($this->user->isAdmin()) {
+            return;
+        }
+
+        $entity->set('assignedUserId', $this->user->getId());
+
+        $count = $this->entityManager
+            ->getRDBRepository(EmailAccount::ENTITY_TYPE)
+            ->where(['assignedUserId' => $this->user->getId()])
+            ->count();
+
+        if ($count >= $this->config->get('maxEmailAccountCount', PHP_INT_MAX)) {
+            throw new Forbidden("Email Account number for user limit exceeded.");
+        }
+    }
+}

application/Espo/Classes/RecordHooks/EmailFilter/BeforeSave.php

@@ -27,32 +27,33 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Services;
+namespace Espo\Classes\RecordHooks\EmailFilter;
 
+use Espo\Core\Acl;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\Hook\SaveHook;
 use Espo\Entities\EmailAccount as EmailAccountEntity;
-use Espo\Entities\EmailFilter as EmailFilterEntity;
+use Espo\Entities\EmailFilter;
 use Espo\Entities\InboundEmail as InboundEmailEntity;
 use Espo\Entities\User as UserEntity;
 use Espo\ORM\Entity;
 
-use Espo\Core\Exceptions\Forbidden;
-use stdClass;
-
 /**
- * @extends Record<EmailFilterEntity>
+ * @implements SaveHook<EmailFilter>
  */
-class EmailFilter extends Record
+class BeforeSave implements SaveHook
 {
-    /**
-     * @param EmailFilterEntity $entity
-     * @throws Forbidden
-     */
-    protected function beforeCreateEntity(Entity $entity, $data)
-    {
-        parent::beforeCreateEntity($entity, $data);
+    public function __construct(
+        private Acl $acl
+    ) {}
 
+    /**
+     * @inheritDoc
+     */
+    public function process(Entity $entity): void
+    {
         // Check if own.
-        if (!$this->acl->checkEntityEdit($entity)) {
+        if ($entity->isNew() && !$this->acl->checkEntityEdit($entity)) {
             throw new Forbidden();
         }
 
@@ -60,26 +61,17 @@ class EmailFilter extends Record
     }
 
     /**
-     * @param EmailFilterEntity $entity
      * @throws Forbidden
      */
-    protected function beforeUpdateEntity(Entity $entity, $data)
-    {
-        parent::beforeUpdateEntity($entity, $data);
-
-        $this->controlEntityValues($entity);
-    }
-
-    /**
-     * @throws Forbidden
-     */
-    private function controlEntityValues(EmailFilterEntity $entity): void
+    private function controlEntityValues(EmailFilter $entity): void
     {
         if ($entity->isGlobal()) {
-            $entity->set('parentId', null);
-            $entity->set('parentType', null);
+            $entity->setMultiple([
+                'parentType' => null,
+                'parentId' => null,
+            ]);
 
-            if ($entity->getAction() !== EmailFilterEntity::ACTION_SKIP) {
+            if ($entity->getAction() !== EmailFilter::ACTION_SKIP) {
                 throw new Forbidden("Not allowed `action`.");
             }
         }
@@ -93,9 +85,9 @@ class EmailFilter extends Record
             !in_array(
                 $entity->getAction(),
                 [
-                    EmailFilterEntity::ACTION_NONE,
-                    EmailFilterEntity::ACTION_SKIP,
-                    EmailFilterEntity::ACTION_MOVE_TO_FOLDER,
+                    EmailFilter::ACTION_NONE,
+                    EmailFilter::ACTION_SKIP,
+                    EmailFilter::ACTION_MOVE_TO_FOLDER,
                 ]
             )
         ) {
@@ -107,8 +99,8 @@ class EmailFilter extends Record
             !in_array(
                 $entity->getAction(),
                 [
-                    EmailFilterEntity::ACTION_SKIP,
-                    EmailFilterEntity::ACTION_MOVE_TO_GROUP_FOLDER,
+                    EmailFilter::ACTION_SKIP,
+                    EmailFilter::ACTION_MOVE_TO_GROUP_FOLDER,
                 ]
             )
         ) {
@@ -117,26 +109,19 @@ class EmailFilter extends Record
 
         if (
             $entity->getParentType() === EmailAccountEntity::ENTITY_TYPE &&
-            $entity->getAction() !== EmailFilterEntity::ACTION_SKIP
+            $entity->getAction() !== EmailFilter::ACTION_SKIP
         ) {
             throw new Forbidden("Not allowed `action`.");
         }
 
-        if ($entity->getAction() !== EmailFilterEntity::ACTION_MOVE_TO_FOLDER) {
+        if ($entity->getAction() !== EmailFilter::ACTION_MOVE_TO_FOLDER) {
+            /** @noinspection PhpRedundantOptionalArgumentInspection */
             $entity->set('emailFolderId', null);
         }
 
-        if ($entity->getAction() !== EmailFilterEntity::ACTION_MOVE_TO_GROUP_FOLDER) {
+        if ($entity->getAction() !== EmailFilter::ACTION_MOVE_TO_GROUP_FOLDER) {
+            /** @noinspection PhpRedundantOptionalArgumentInspection */
             $entity->set('groupEmailFolderId', null);
         }
     }
-
-    public function filterUpdateInput(stdClass $data): void
-    {
-        parent::filterUpdateInput($data);
-
-        unset($data->isGlobal);
-        unset($data->parentId);
-        unset($data->parentType);
-    }
 }

application/Espo/Classes/RecordHooks/EmailFolder/BeforeCreate.php

@@ -27,20 +27,27 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Services;
+namespace Espo\Classes\RecordHooks\EmailFolder;
 
-use Espo\ORM\Entity;
+use Espo\Core\Acl;
 use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\EmailFolder;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
 
 /**
- * @extends Record<\Espo\Entities\EmailFolder>
+ * @implements SaveHook<EmailFolder>
  */
-class EmailFolder extends Record
+class BeforeCreate implements SaveHook
 {
-    protected function beforeCreateEntity(Entity $entity, $data)
-    {
-        parent::beforeCreateEntity($entity, $data);
+    public function __construct(
+        private User $user,
+        private Acl $acl
+    ) {}
 
+    public function process(Entity $entity): void
+    {
         if (!$this->user->isAdmin() || !$entity->get('assignedUserId')) {
             $entity->set('assignedUserId', $this->user->getId());
         }

application/Espo/Classes/RecordHooks/LeadCapture/BeforeCreate.php

@@ -0,0 +1,53 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\LeadCapture;
+
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\LeadCapture;
+use Espo\ORM\Entity;
+use Espo\Tools\LeadCapture\Service;
+
+/**
+ * @noinspection PhpUnused
+ * @implements SaveHook<LeadCapture>
+ */
+class BeforeCreate implements SaveHook
+{
+    public function __construct(
+        private Service $service
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $apiKey = $this->service->generateApiKey();
+
+        $entity->setApiKey($apiKey);
+    }
+}

application/Espo/Classes/RecordHooks/Note/AfterCreate.php

@@ -0,0 +1,90 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Note;
+
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Core\Utils\Metadata;
+use Espo\Entities\Note;
+use Espo\Entities\Note as NoteEntity;
+use Espo\Entities\Preferences;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+use Espo\ORM\EntityManager;
+use Espo\Tools\Stream\Service;
+
+/**
+ * @implements SaveHook<Note>
+ * @noinspection PhpUnused
+ */
+class AfterCreate implements SaveHook
+{
+    public function __construct(
+        private EntityManager $entityManager,
+        private User $user,
+        private Metadata $metadata,
+        private Service $streamService
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $parentType = $entity->getParentType();
+        $parentId = $entity->getParentId();
+
+        if (
+            $entity->getType() !== NoteEntity::TYPE_POST ||
+            !$parentType ||
+            !$parentId
+        ) {
+            return;
+        }
+
+        if (!$this->metadata->get(['scopes', $parentType, 'stream'])) {
+            return;
+        }
+
+        $preferences = $this->entityManager->getEntityById(Preferences::ENTITY_TYPE, $this->user->getId());
+
+        if (!$preferences) {
+            return;
+        }
+
+        if (!$preferences->get('followEntityOnStreamPost')) {
+            return;
+        }
+
+        $parent = $this->entityManager->getEntityById($parentType, $parentId);
+
+        if (!$parent || $this->user->isSystem() || $this->user->isApi()) {
+            return;
+        }
+
+        $this->streamService->followEntity($parent, $this->user->getId());
+    }
+}

application/Espo/Classes/RecordHooks/Note/AssignmentCheck.php

@@ -0,0 +1,196 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Note;
+
+use Espo\Core\Acl;
+use Espo\Core\Acl\Permission;
+use Espo\Core\Acl\Table as AclTable;
+use Espo\Core\Exceptions\BadRequest;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Note;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+use Espo\ORM\EntityManager;
+use Espo\Repositories\User as UserRepository;
+
+/**
+ * @implements SaveHook<Note>
+ */
+class AssignmentCheck implements SaveHook
+{
+    public function __construct(
+        private User $user,
+        private Acl $acl,
+        private EntityManager $entityManager
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $targetType = $entity->getTargetType();
+
+        if (!$targetType) {
+            return;
+        }
+
+        $userTeamIdList = $this->user->getTeamIdList();
+
+        $userIdList = $entity->getLinkMultipleIdList('users');
+        $portalIdList = $entity->getLinkMultipleIdList('portals');
+        $teamIdList = $entity->getLinkMultipleIdList('teams');
+
+        /** @var iterable<User> $targetUserList */
+        $targetUserList = [];
+
+        if ($targetType === Note::TARGET_USERS) {
+            /** @var iterable<User> $targetUserList */
+            $targetUserList = $this->entityManager
+                ->getRDBRepository(User::ENTITY_TYPE)
+                ->select(['id', 'type'])
+                ->where(['id' => $userIdList])
+                ->find();
+        }
+
+        $hasPortalTargetUser = false;
+        $allTargetUsersArePortal = true;
+
+        foreach ($targetUserList as $user) {
+            if (!$user->isPortal()) {
+                $allTargetUsersArePortal = false;
+            }
+
+            if ($user->isPortal()) {
+                $hasPortalTargetUser = true;
+            }
+        }
+
+        $messagePermission = $this->acl->getPermissionLevel(Permission::MESSAGE);
+
+        if ($messagePermission === AclTable::LEVEL_NO) {
+            if (
+                $targetType !== Note::TARGET_SELF &&
+                $targetType !== Note::TARGET_PORTALS &&
+                !(
+                    $targetType === Note::TARGET_USERS &&
+                    count($userIdList) === 1 &&
+                    $userIdList[0] === $this->user->getId()
+                ) &&
+                !(
+                    $targetType === Note::TARGET_USERS && $allTargetUsersArePortal
+                )
+            ) {
+                throw new Forbidden('Not permitted to post to anybody except self.');
+            }
+        }
+
+        if ($targetType === Note::TARGET_TEAMS) {
+            if (empty($teamIdList)) {
+                throw new BadRequest("No team IDS.");
+            }
+        }
+
+        if ($targetType === Note::TARGET_USERS) {
+            if (empty($userIdList)) {
+                throw new BadRequest("No user IDs.");
+            }
+        }
+
+        if ($targetType === Note::TARGET_PORTALS) {
+            if (empty($portalIdList)) {
+                throw new BadRequest("No portal IDs.");
+            }
+
+            if ($this->acl->getPermissionLevel(Permission::PORTAL) !== AclTable::LEVEL_YES) {
+                throw new Forbidden('Not permitted to post to portal users.');
+            }
+        }
+
+        if (
+            $targetType === Note::TARGET_USERS &&
+            $this->acl->getPermissionLevel(Permission::PORTAL) !== AclTable::LEVEL_YES
+        ) {
+            if ($hasPortalTargetUser) {
+                throw new Forbidden('Not permitted to post to portal users.');
+            }
+        }
+
+        if ($messagePermission === AclTable::LEVEL_TEAM) {
+            if ($targetType === Note::TARGET_ALL) {
+                throw new Forbidden('Not permitted to post to all.');
+            }
+        }
+
+        if (
+            $messagePermission === AclTable::LEVEL_TEAM &&
+            $targetType === Note::TARGET_TEAMS
+        ) {
+            if (empty($userTeamIdList)) {
+                throw new Forbidden('Not permitted to post to foreign teams.');
+            }
+
+            foreach ($teamIdList as $teamId) {
+                if (!in_array($teamId, $userTeamIdList)) {
+                    throw new Forbidden("Not permitted to post to foreign teams.");
+                }
+            }
+        }
+
+        if (
+            $messagePermission === AclTable::LEVEL_TEAM &&
+            $targetType === Note::TARGET_USERS
+        ) {
+            if (empty($userTeamIdList)) {
+                throw new Forbidden('Not permitted to post to users from foreign teams.');
+            }
+
+            foreach ($targetUserList as $user) {
+                if ($user->getId() === $this->user->getId()) {
+                    continue;
+                }
+
+                if ($user->isPortal()) {
+                    continue;
+                }
+
+                $inTeam = $this->getUserRepository()->checkBelongsToAnyOfTeams($user->getId(), $userTeamIdList);
+
+                if (!$inTeam) {
+                    throw new Forbidden('Not permitted to post to users from foreign teams.');
+                }
+            }
+        }
+    }
+
+    private function getUserRepository(): UserRepository
+    {
+        /** @var UserRepository */
+        return $this->entityManager->getRepository(User::ENTITY_TYPE);
+    }
+}

application/Espo/Classes/RecordHooks/Note/BeforeCreate.php

@@ -0,0 +1,136 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Note;
+
+use Espo\Core\Acl;
+use Espo\Core\Acl\Table as AclTable;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Note;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+use Espo\ORM\EntityManager;
+use Espo\Tools\Stream\NoteUtil;
+
+/**
+ * @implements SaveHook<Note>
+ * @noinspection PhpUnused
+ */
+class BeforeCreate implements SaveHook
+{
+    public function __construct(
+        private EntityManager $entityManager,
+        private Acl $acl,
+        private User $user,
+        private NoteUtil $noteUtil
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $this->checkParent($entity);
+
+        if (!$entity->isPost() && !$this->user->isAdmin()) {
+            throw new Forbidden("Only 'Post' type allowed.");
+        }
+
+        if ($this->user->isPortal()) {
+            $entity->set('isInternal', false);
+        }
+
+        if ($entity->isPost()) {
+            $this->noteUtil->handlePostText($entity);
+        }
+
+        $targetType = $entity->getTargetType();
+
+        $entity->clear('isPinned');
+        $entity->clear('isGlobal');
+
+        switch ($targetType) {
+            case Note::TARGET_ALL:
+
+                $entity->clear('usersIds');
+                $entity->clear('teamsIds');
+                $entity->clear('portalsIds');
+                $entity->set('isGlobal', true);
+
+                break;
+
+            case Note::TARGET_SELF:
+
+                $entity->clear('usersIds');
+                $entity->clear('teamsIds');
+                $entity->clear('portalsIds');
+                $entity->setUsersIds([$this->user->getId()]);
+                $entity->set('isForSelf', true);
+
+                break;
+
+            case Note::TARGET_USERS:
+
+                $entity->clear('teamsIds');
+                $entity->clear('portalsIds');
+
+                break;
+
+            case Note::TARGET_TEAMS:
+
+                $entity->clear('usersIds');
+                $entity->clear('portalsIds');
+
+                break;
+
+            case Note::TARGET_PORTALS:
+
+                $entity->clear('usersIds');
+                $entity->clear('teamsIds');
+
+                break;
+        }
+    }
+
+    /**
+     * @throws Forbidden
+     */
+    private function checkParent(Note $entity): void
+    {
+        if (!$entity->getParentType() || !$entity->getParentId()) {
+            return;
+        }
+
+        $parent = $this->entityManager->getEntityById($entity->getParentType(), $entity->getParentId());
+
+        if ($parent && $this->acl->check($parent, AclTable::ACTION_READ)) {
+            return;
+        }
+
+        throw new Forbidden("No access to parent.");
+    }
+}

application/Espo/Classes/RecordHooks/Note/BeforeUpdate.php

@@ -0,0 +1,68 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Note;
+
+use Espo\Core\Exceptions\ForbiddenSilent;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Note;
+use Espo\ORM\Entity;
+use Espo\Tools\Stream\NoteUtil;
+
+/**
+ * @implements SaveHook<Note>
+ * @noinspection PhpUnused
+ */
+class BeforeUpdate implements SaveHook
+{
+    public function __construct(
+        private NoteUtil $noteUtil,
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        if (!$this->isEditableType($entity)) {
+            throw new ForbiddenSilent("Note is not editable.");
+        }
+
+        if ($entity->isPost()) {
+            $this->noteUtil->handlePostText($entity);
+        }
+
+        if (!$entity->isPost()) {
+            $entity->clear('post');
+            $entity->clear('attachmentsIds');
+        }
+    }
+
+    private function isEditableType(Note $entity): bool
+    {
+        return $entity->getType() == Note::TYPE_POST;
+    }
+}

application/Espo/Classes/RecordHooks/Portal/AfterUpdate.php

@@ -27,45 +27,42 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Services;
+namespace Espo\Classes\RecordHooks\Portal;
 
-use Espo\Core\Acl\Cache\Clearer as AclCacheClearer;
+use Espo\Core\Acl\Cache\Clearer;
+use Espo\Core\DataManager;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Portal;
 use Espo\ORM\Entity;
-
-use Espo\Core\Di;
+use Espo\ORM\EntityManager;
+use Espo\Repositories\Portal as PortalRepository;
 
 /**
- * @extends Record<\Espo\Entities\PortalRole>
+ * @implements SaveHook<Portal>
  */
-class PortalRole extends Record implements
-
-    Di\DataManagerAware
+class AfterUpdate implements SaveHook
 {
-    use Di\DataManagerSetter;
+    public function __construct(
+        private Clearer $clearer,
+        private DataManager $dataManager,
+        private EntityManager $entityManager
+    ) {}
 
-    protected $forceSelectAllAttributes = true;
-
-    public function afterCreateEntity(Entity $entity, $data)
+    public function process(Entity $entity): void
     {
-        parent::afterCreateEntity($entity, $data);
-        $this->clearRolesCache();
-    }
+        $this->getPortalRepository()->loadUrlField($entity);
 
-    public function afterUpdateEntity(Entity $entity, $data)
-    {
-        parent::afterUpdateEntity($entity, $data);
-        $this->clearRolesCache();
-    }
-
-    protected function clearRolesCache(): void
-    {
-        $this->createAclCacheClearer()->clearForAllPortalUsers();
+        if (!$entity->isAttributeChanged('portalRolesIds')) {
+            return;
+        }
 
+        $this->clearer->clearForAllPortalUsers();
         $this->dataManager->updateCacheTimestamp();
     }
 
-    private function createAclCacheClearer(): AclCacheClearer
+    private function getPortalRepository(): PortalRepository
     {
-        return $this->injectableFactory->create(AclCacheClearer::class);
+        /** @var PortalRepository */
+        return $this->entityManager->getRDBRepositoryByClass(Portal::class);
     }
 }

application/Espo/Classes/RecordHooks/PortalRole/AfterSave.php

@@ -0,0 +1,53 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\PortalRole;
+
+use Espo\Core\Acl\Cache\Clearer;
+use Espo\Core\DataManager;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\PortalRole;
+use Espo\ORM\Entity;
+
+/**
+ * @implements SaveHook<PortalRole>
+ */
+class AfterSave implements SaveHook
+{
+    public function __construct(
+        private Clearer $clearer,
+        private DataManager $dataManager
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $this->clearer->clearForAllInternalUsers();
+        $this->dataManager->updateCacheTimestamp();
+    }
+}

application/Espo/Classes/RecordHooks/Role/AfterSave.php

@@ -0,0 +1,53 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Role;
+
+use Espo\Core\Acl\Cache\Clearer;
+use Espo\Core\DataManager;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Role;
+use Espo\ORM\Entity;
+
+/**
+ * @implements SaveHook<Role>
+ */
+class AfterSave implements SaveHook
+{
+    public function __construct(
+        private Clearer $clearer,
+        private DataManager $dataManager
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $this->clearer->clearForAllInternalUsers();
+        $this->dataManager->updateCacheTimestamp();
+    }
+}

application/Espo/Classes/RecordHooks/Role/BeforeSaveValidate.php

@@ -0,0 +1,232 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Role;
+
+use Espo\Core\Acl\Table;
+use Espo\Core\Exceptions\BadRequest;
+use Espo\Core\Portal\Acl\Table as TablePortal;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Core\Utils\Metadata;
+use Espo\Entities\PortalRole;
+use Espo\Entities\Role;
+use Espo\ORM\Entity;
+use stdClass;
+
+/**
+ * @noinspection PhpUnused
+ * @implements SaveHook<Role|PortalRole>
+ */
+class BeforeSaveValidate implements SaveHook
+{
+    /** @var string[] */
+    private array $levelList = [
+        Table::LEVEL_YES,
+        Table::LEVEL_ALL,
+        Table::LEVEL_TEAM,
+        Table::LEVEL_OWN,
+        Table::LEVEL_NO,
+    ];
+
+    /** @var string[] */
+    private array $portalLevelList = [
+        Table::LEVEL_YES,
+        Table::LEVEL_ALL,
+        TablePortal::LEVEL_ACCOUNT,
+        TablePortal::LEVEL_CONTACT,
+        Table::LEVEL_OWN,
+        Table::LEVEL_NO,
+    ];
+
+    public function __construct(
+        private Metadata $metadata
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $this->validateData($entity);
+        $this->validateFieldData($entity);
+    }
+
+    /**
+     * @throws BadRequest
+     */
+    private function validateData(Role|PortalRole $entity): void
+    {
+        if ($entity->get('data') === null) {
+            return;
+        }
+
+        /** @var array<string, mixed> $data */
+        $data = get_object_vars($entity->get('data'));
+
+        foreach ($data as $scope => $item) {
+            if (!is_bool($item) && !$item instanceof stdClass) {
+                throw new BadRequest("Bad data. Should be bool or object.");
+            }
+
+            $this->validateDataItem($scope, $entity, $item);
+        }
+    }
+
+    /**
+     * @throws BadRequest
+     */
+    private function validateDataItem(string $scope, Role|PortalRole $entity, bool|stdClass $item): void
+    {
+        $key = $entity instanceof PortalRole ?
+            'aclPortal' : 'acl';
+
+        $type = $this->metadata->get("scopes.$scope.$key");
+
+        if ($type === 'boolean') {
+            if (!is_bool($item)) {
+                throw new BadRequest("Bad data. Value for *$scope* should be be bool.");
+            }
+
+            return;
+        }
+
+        if ($type === null) {
+            throw new BadRequest("Bad data. Scope *$scope* is not allowed.");
+        }
+
+        if ($item === false) {
+            return;
+        }
+
+        if (is_bool($item)) {
+            throw new BadRequest("Bad data. Value for *$scope* should be be false or object.");
+        }
+
+        $actions = [
+            Table::ACTION_CREATE,
+            Table::ACTION_READ,
+            Table::ACTION_EDIT,
+            Table::ACTION_DELETE,
+            Table::ACTION_STREAM,
+        ];
+
+        $levels = $entity instanceof PortalRole ?
+            $this->portalLevelList : $this->levelList;
+
+        foreach ($actions as $action) {
+            if (!property_exists($item, $action)) {
+                continue;
+            }
+
+            $level = $item->$action;
+
+            if (!in_array($level, $levels)) {
+                throw new BadRequest("Level `$level` is not allowed for action *$action* for *$scope*.");
+            }
+        }
+    }
+
+    /**
+     * @throws BadRequest
+     */
+    private function validateFieldData(Role|PortalRole $entity): void
+    {
+        if ($entity->get('fieldData') === null) {
+            return;
+        }
+
+        /** @var array<string, mixed> $data */
+        $data = get_object_vars($entity->get('fieldData'));
+
+        foreach ($data as $scope => $item) {
+            if (!$item instanceof stdClass) {
+                throw new BadRequest("Bad field-level data. Should be object.");
+            }
+
+            $this->validateFieldDataItem($scope, $entity, $item);
+        }
+    }
+
+    /**
+     * @throws BadRequest
+     */
+    private function validateFieldDataItem(string $scope, PortalRole|Role $entity, stdClass $item): void
+    {
+        $disabledKey = $entity instanceof PortalRole ? 'aclPortalFieldLevelDisabled' : 'aclFieldLevelDisabled';
+        $key = $entity instanceof PortalRole ? 'aclPortal' : 'acl';
+
+        if (
+            !$this->metadata->get("scopes.$scope.entity") ||
+            !$this->metadata->get("scopes.$scope.$key") ||
+            $this->metadata->get("scopes.$scope.$disabledKey")
+        ) {
+            throw new BadRequest("Bad field-level data. Scope *$scope* is not allowed.");
+        }
+
+        /** @var array<string, mixed> $data */
+        $data = get_object_vars($item);
+
+        foreach ($data as $field => $fieldItem) {
+            if (!$fieldItem instanceof stdClass) {
+                throw new BadRequest("Data for field *$field*, scope *$scope* should be object.");
+            }
+
+            $this->validateFieldDataItemItem($scope, $field, $fieldItem);
+        }
+    }
+
+    /**
+     * @throws BadRequest
+     */
+    private function validateFieldDataItemItem(string $scope, string $field, stdClass $item): void
+    {
+        if (!$this->metadata->get("entityDefs.$scope.fields.$field")) {
+            throw new BadRequest("Field *$field* does not exist in *$scope*.");
+        }
+
+        $actions = [
+            Table::ACTION_READ,
+            Table::ACTION_EDIT,
+        ];
+
+        $levels = [
+            Table::LEVEL_YES,
+            Table::LEVEL_NO,
+        ];
+
+        foreach ($actions as $action) {
+            if (!property_exists($item, $action)) {
+                continue;
+            }
+
+            $level = $item->$action;
+
+            if (!in_array($level, $levels)) {
+                throw new BadRequest("Level `$level` is not allowed for *$scope*, field *$field*.");
+            }
+        }
+    }
+}

application/Espo/Classes/RecordHooks/Team/AfterUpdate.php

@@ -0,0 +1,58 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Team;
+
+use Espo\Core\Acl\Cache\Clearer;
+use Espo\Core\DataManager;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Team;
+use Espo\ORM\Entity;
+
+/**
+ * @implements SaveHook<Team>
+ * @noinspection PhpUnused
+ */
+class AfterUpdate implements SaveHook
+{
+    public function __construct(
+        private Clearer $clearer,
+        private DataManager $dataManager
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        if (!$entity->isAttributeChanged('rolesIds')) {
+            return;
+        }
+
+        $this->clearer->clearForAllInternalUsers();
+        $this->dataManager->updateCacheTimestamp();
+    }
+}

application/Espo/Classes/RecordHooks/Team/ClearCacheAfterLink.php

@@ -0,0 +1,58 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Team;
+
+use Espo\Core\Acl\Cache\Clearer;
+use Espo\Core\DataManager;
+use Espo\Core\Record\Hook\LinkHook;
+use Espo\Entities\Team;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+
+/**
+ * @implements LinkHook<Team>
+ */
+class ClearCacheAfterLink implements LinkHook
+{
+    public function __construct(
+        private Clearer $clearer,
+        private DataManager $dataManager
+    ) {}
+
+    public function process(Entity $entity, string $link, Entity $foreignEntity): void
+    {
+        if ($link !== 'users' || !$foreignEntity instanceof User) {
+            return;
+        }
+
+        $this->clearer->clearForUser($foreignEntity);
+        $this->dataManager->updateCacheTimestamp();
+    }
+}

application/Espo/Classes/RecordHooks/Team/ClearCacheAfterUnlink.php

@@ -0,0 +1,58 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Team;
+
+use Espo\Core\Acl\Cache\Clearer;
+use Espo\Core\DataManager;
+use Espo\Core\Record\Hook\UnlinkHook;
+use Espo\Entities\Team;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+
+/**
+ * @implements UnlinkHook<Team>
+ */
+class ClearCacheAfterUnlink implements UnlinkHook
+{
+    public function __construct(
+        private Clearer $clearer,
+        private DataManager $dataManager
+    ) {}
+
+    public function process(Entity $entity, string $link, Entity $foreignEntity): void
+    {
+        if ($link !== 'users' || !$foreignEntity instanceof User) {
+            return;
+        }
+
+        $this->clearer->clearForUser($foreignEntity);
+        $this->dataManager->updateCacheTimestamp();
+    }
+}

application/Espo/Classes/RecordHooks/User/AfterUpdate.php

@@ -0,0 +1,114 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\User;
+
+use Espo\Core\Acl\Cache\Clearer;
+use Espo\Core\DataManager;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Modules\Crm\Entities\Contact;
+use Espo\ORM\Entity;
+use Espo\Entities\User;
+use Espo\ORM\EntityManager;
+
+/**
+ * @implements SaveHook<User>
+ * @noinspection PhpUnused
+ */
+class AfterUpdate implements SaveHook
+{
+    public function __construct(
+        private EntityManager $entityManager,
+        private Clearer $clearer,
+        private DataManager $dataManager
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $this->processCache($entity);
+        $this->processContactName($entity);
+    }
+
+    private function processCache(User $entity): void
+    {
+        if (
+            $entity->isAttributeChanged('rolesIds') ||
+            $entity->isAttributeChanged('teamsIds') ||
+            $entity->isAttributeChanged('type') ||
+            $entity->isAttributeChanged('portalRolesIds') ||
+            $entity->isAttributeChanged('portalsIds')
+        ) {
+            $this->clearer->clearForUser($entity);
+            $this->dataManager->updateCacheTimestamp();
+        }
+
+        if (
+            $entity->isAttributeChanged('portalRolesIds') ||
+            $entity->isAttributeChanged('portalsIds') ||
+            $entity->isAttributeChanged('contactId') ||
+            $entity->isAttributeChanged('accountsIds')
+        ) {
+            $this->clearer->clearForAllPortalUsers();
+            $this->dataManager->updateCacheTimestamp();
+        }
+    }
+
+    private function processContactName(User $entity): void
+    {
+        if (
+            !$entity->isPortal() ||
+            !$entity->getContactId() ||
+            !$entity->isAttributeChanged('firstName') &&
+            !$entity->isAttributeChanged('lastName') &&
+            !$entity->isAttributeChanged('salutationName')
+        ) {
+            return;
+        }
+
+        $contact = $this->entityManager->getEntityById(Contact::ENTITY_TYPE, $entity->getContactId());
+
+        if (!$contact) {
+            return;
+        }
+
+        if ($entity->isAttributeChanged('firstName')) {
+            $contact->set('firstName', $entity->get('firstName'));
+        }
+
+        if ($entity->isAttributeChanged('lastName')) {
+            $contact->set('lastName', $entity->get('lastName'));
+        }
+
+        if ($entity->isAttributeChanged('salutationName')) {
+            $contact->set('salutationName', $entity->get('salutationName'));
+        }
+
+        $this->entityManager->saveEntity($contact);
+    }
+}

application/Espo/Classes/RecordHooks/User/BeforeCreate.php

@@ -0,0 +1,135 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\User;
+
+use Espo\Core\Authentication\Logins\Hmac;
+use Espo\Core\Exceptions\Conflict;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Core\Utils\Config;
+use Espo\Core\Utils\Util;
+use Espo\ORM\Entity;
+use Espo\Entities\User;
+use Espo\Tools\User\UserUtil;
+
+/**
+ * @implements SaveHook<User>
+ * @noinspection PhpUnused
+ */
+class BeforeCreate implements SaveHook
+{
+    public function __construct(
+        private Config $config,
+        private User $user,
+        private UserUtil $util
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $this->processLimitChecking($entity);
+        $this->processUserExistsChecking($entity);
+        $this->processApi($entity);
+        $this->processTypeChecking($entity);
+    }
+
+    /**
+     * @throws Conflict
+     */
+    private function processUserExistsChecking(User $entity): void
+    {
+        if ($this->util->checkExists($entity)) {
+            throw new Conflict('userNameExists');
+        }
+    }
+
+    /**
+     * @throws Forbidden
+     */
+    private function processLimitChecking(User $entity): void
+    {
+        $userLimit = $this->config->get('userLimit');
+        $portalUserLimit = $this->config->get('portalUserLimit');
+
+        if (
+            $userLimit &&
+            !$this->user->isSuperAdmin() &&
+            !$entity->isPortal() && !$entity->isApi()
+        ) {
+            $userCount = $this->util->getInternalCount();
+
+            if ($userCount >= $userLimit) {
+                throw new Forbidden("User limit $userLimit is reached.");
+            }
+        }
+
+        if (
+            $portalUserLimit &&
+            !$this->user->isSuperAdmin() &&
+            $entity->isPortal()
+        ) {
+            $portalUserCount = $this->util->getPortalCount();
+
+            if ($portalUserCount >= $portalUserLimit) {
+                throw new Forbidden("Portal user limit $portalUserLimit is reached.");
+            }
+        }
+    }
+
+    private function processApi(User $entity): void
+    {
+        if (!$entity->isApi()) {
+            return;
+        }
+
+        $entity->set('apiKey', Util::generateApiKey());
+
+        if ($entity->getAuthMethod() === Hmac::NAME) {
+            $secretKey = Util::generateSecretKey();
+
+            $entity->set('secretKey', $secretKey);
+        }
+    }
+
+    /**
+     * @throws Forbidden
+     */
+    private function processTypeChecking(User $entity): void
+    {
+        if (
+            $entity->isSuperAdmin() ||
+            !$entity->getType() ||
+            in_array($entity->getType(), $this->util->getAllowedUserTypeList())
+        ) {
+            return;
+        }
+
+        throw new Forbidden("Not allowed 'type'.");
+    }
+}

application/Espo/Classes/RecordHooks/User/BeforeUpdate.php

@@ -0,0 +1,171 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\User;
+
+use Espo\Core\Authentication\Logins\Hmac;
+use Espo\Core\Exceptions\Conflict;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Core\Utils\Config;
+use Espo\Core\Utils\Util;
+use Espo\Entities\User as UserEntity;
+use Espo\ORM\Entity;
+use Espo\Entities\User;
+use Espo\Tools\User\UserUtil;
+
+/**
+ * @implements SaveHook<User>
+ * @noinspection PhpUnused
+ */
+class BeforeUpdate implements SaveHook
+{
+    public function __construct(
+        private Config $config,
+        private User $user,
+        private UserUtil $util
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $this->processLimitChecking($entity);
+        $this->processUserExistsChecking($entity);
+        $this->processApi($entity);
+        $this->processTypeChecking($entity);
+    }
+
+    /**
+     * @throws Conflict
+     */
+    private function processUserExistsChecking(User $entity): void
+    {
+        if (!$entity->isAttributeChanged('userName')) {
+            return;
+        }
+
+        if ($this->util->checkExists($entity)) {
+            throw new Conflict('userNameExists');
+        }
+    }
+
+    /**
+     * @throws Forbidden
+     */
+    private function processLimitChecking(User $entity): void
+    {
+        $userLimit = $this->config->get('userLimit');
+        $portalUserLimit = $this->config->get('portalUserLimit');
+
+        if (
+            $userLimit &&
+            !$this->user->isSuperAdmin() &&
+            (
+                (
+                    $entity->isActive() &&
+                    $entity->isAttributeChanged('isActive') &&
+                    !$entity->isPortal() &&
+                    !$entity->isApi()
+                ) ||
+                (
+                    !$entity->isPortal() &&
+                    !$entity->isApi() &&
+                    $entity->isAttributeChanged('type') &&
+                    (
+                        $entity->isRegular() ||
+                        $entity->isAdmin()
+                    ) &&
+                    (
+                        $entity->getFetched('type') == UserEntity::TYPE_PORTAL ||
+                        $entity->getFetched('type') == UserEntity::TYPE_API
+                    )
+                )
+            )
+        ) {
+            $userCount = $this->util->getInternalCount();
+
+            if ($userCount >= $userLimit) {
+                throw new Forbidden("User limit $userLimit is reached.");
+            }
+        }
+
+        if (
+            $portalUserLimit &&
+            !$this->user->isSuperAdmin() &&
+            (
+                (
+                    $entity->isActive() &&
+                    $entity->isAttributeChanged('isActive') &&
+                    $entity->isPortal()
+                ) ||
+                (
+                    $entity->isPortal() &&
+                    $entity->isAttributeChanged('type')
+                )
+            )
+        ) {
+            $portalUserCount = $this->util->getPortalCount();
+
+            if ($portalUserCount >= $portalUserLimit) {
+                throw new Forbidden("Portal user limit $portalUserLimit is reached.");
+            }
+        }
+    }
+
+    private function processApi(User $entity): void
+    {
+        if (
+            !$entity->isApi() ||
+            !$entity->isAttributeChanged('authMethod') ||
+            $entity->getAuthMethod() !== Hmac::NAME
+        ) {
+            return;
+        }
+
+        $secretKey = Util::generateSecretKey();
+
+        $entity->set('secretKey', $secretKey);
+    }
+
+    /**
+     * @throws Forbidden
+     */
+    private function processTypeChecking(User $entity): void
+    {
+        if (
+            $entity->isSuperAdmin() ||
+            !$entity->isAttributeChanged('type') ||
+            !$entity->getType() ||
+            in_array($entity->getType(), $this->util->getAllowedUserTypeList())
+        ) {
+            return;
+        }
+
+        throw new Forbidden("Can't change type.");
+    }
+}

application/Espo/Classes/RecordHooks/Webhook/AfterDelete.php

@@ -0,0 +1,62 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Webhook;
+
+use Espo\Core\Record\DeleteParams;
+use Espo\Core\Record\Hook\DeleteHook;
+use Espo\Core\Webhook\Manager;
+use Espo\Entities\Webhook;
+use Espo\ORM\Entity;
+
+/**
+ * @implements DeleteHook<Webhook>
+ * @noinspection PhpUnused
+ */
+class AfterDelete implements DeleteHook
+{
+    public function __construct(
+        private Manager $webhookManager
+    ) {}
+
+    public function process(Entity $entity, DeleteParams $params): void
+    {
+        $event = $entity->getEvent();
+
+        if (!$event) {
+            return;
+        }
+
+        if (!$entity->isActive()) {
+            return;
+        }
+
+        $this->webhookManager->removeEvent($event);
+    }
+}

application/Espo/Classes/RecordHooks/Webhook/AfterSave.php

@@ -0,0 +1,75 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Webhook;
+
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Core\Webhook\Manager;
+use Espo\Entities\Webhook;
+use Espo\ORM\Entity;
+use RuntimeException;
+
+/**
+ * @implements SaveHook<Webhook>
+ */
+class AfterSave implements SaveHook
+{
+    public function __construct(
+        private Manager $webhookManager
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $event = $entity->getEvent();
+
+        if (!$event) {
+            throw new RuntimeException("No 'event'.");
+        }
+
+        if ($entity->isNew()) {
+            if ($entity->isActive()) {
+                $this->webhookManager->addEvent($event);
+            }
+
+            return;
+        }
+
+        if (!$entity->isAttributeChanged('isActive')) {
+            return;
+        }
+
+        if ($entity->isActive()) {
+            $this->webhookManager->addEvent($event);
+
+            return;
+        }
+
+        $this->webhookManager->removeEvent($event);
+    }
+}

application/Espo/Classes/RecordHooks/Webhook/BeforeSave.php

@@ -27,124 +27,75 @@
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
-namespace Espo\Services;
+namespace Espo\Classes\RecordHooks\Webhook;
 
-use Espo\Entities\Webhook as WebhookEntity;
-use Espo\ORM\Entity;
+use Espo\Core\Acl;
 use Espo\Core\Exceptions\Forbidden;
-use Espo\Core\Di;
-
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Core\Utils\Config;
+use Espo\Core\Utils\Metadata;
 use Espo\Entities\User;
-
-use stdClass;
+use Espo\Entities\Webhook;
+use Espo\ORM\Entity;
+use Espo\ORM\EntityManager;
 
 /**
- * @extends Record<WebhookEntity>
+ * @implements SaveHook<Webhook>
  */
-class Webhook extends Record implements
-    Di\WebhookManagerAware
-
+class BeforeSave implements SaveHook
 {
-    use Di\WebhookManagerSetter;
+    private const WEBHOOK_MAX_COUNT_PER_USER = 50;
 
-    const WEBHOOK_MAX_COUNT_PER_USER = 50;
-
-    /**
-     * @var string[]
-     */
-    protected $eventTypeList = [
+    /** @var string[] */
+    private $eventTypeList = [
         'create',
         'update',
         'delete',
         'fieldUpdate',
     ];
 
-    /**
-     * @var string[]
-     */
-    protected $onlyAdminAttributeList = ['userId', 'userName'];
+    public function __construct(
+        private User $user,
+        private EntityManager $entityManager,
+        private Acl $acl,
+        private Metadata $metadata,
+        private Config $config
+    ) {}
 
-    /**
-     * @var string[]
-     */
-    protected $readOnlyAttributeList = ['secretKey'];
-
-    public function populateDefaults(Entity $entity, stdClass $data): void
-    {
-        parent::populateDefaults($entity, $data);
-
-        if ($this->user->isApi()) {
-            $entity->set('userId', $this->user->getId());
-        }
-    }
-
-    protected function filterInput($data)
-    {
-        parent::filterInput($data);
-
-        unset($data->entityType);
-        unset($data->field);
-        unset($data->type);
-    }
-
-    public function filterUpdateInput(stdClass $data): void
-    {
-        if (!$this->user->isAdmin()) {
-            unset($data->event);
-        }
-
-        parent::filterUpdateInput($data);
-    }
-
-    protected function beforeCreateEntity(Entity $entity, $data)
+    public function process(Entity $entity): void
     {
         $this->checkEntityUserIsApi($entity);
         $this->processEntityEventData($entity);
 
-        if (!$this->user->isAdmin()) {
+        if ($entity->isNew() && !$this->user->isAdmin()) {
             $this->checkMaxCount();
         }
     }
 
-    protected function checkMaxCount(): void
+    /**
+     * @throws Forbidden
+     */
+    private function checkEntityUserIsApi(Webhook $entity): void
     {
-        $maxCount = $this->config->get('webhookMaxCountPerUser', self::WEBHOOK_MAX_COUNT_PER_USER);
-
-        $count = $this->entityManager
-            ->getRDBRepository(WebhookEntity::ENTITY_TYPE)
-            ->where([
-                'userId' => $this->user->getId(),
-            ])
-            ->count();
-
-        if ($maxCount && $count >= $maxCount) {
-            throw new Forbidden("Webhook number per user exceeded the limit.");
-        }
-    }
-
-    protected function beforeUpdateEntity(Entity $entity, $data)
-    {
-        $this->checkEntityUserIsApi($entity);
-        $this->processEntityEventData($entity);
-    }
-
-    protected function checkEntityUserIsApi(Entity $entity): void
-    {
-        $userId = $entity->get('userId');
+        $userId = $entity->getUserId();
 
         if (!$userId) {
             return;
         }
 
-        /** @var User|null $user */
-        $user = $this->entityManager->getEntity(User::ENTITY_TYPE, $userId);
+        $user = $this->entityManager->getRDBRepositoryByClass(User::class)->getById($userId);
 
-        if (!$user || !$user->isApi()) {
-            throw new Forbidden("User must be an API User.");
+        if ($user && $user->isApi()) {
+            return;
         }
+
+        throw new Forbidden("User must be an API User.");
     }
 
-    protected function processEntityEventData(Entity $entity): void
+    /**
+     * @throws Forbidden
+     */
+    private function processEntityEventData(Webhook $entity): void
     {
         $event = $entity->get('event');
 
@@ -152,10 +103,8 @@ class Webhook extends Record implements
             throw new Forbidden("Event is empty.");
         }
 
-        if (!$entity->isNew()) {
-            if ($entity->isAttributeChanged('event')) {
-                throw new Forbidden("Event can't be changed.");
-            }
+        if (!$entity->isNew() && $entity->isAttributeChanged('event')) {
+            throw new Forbidden("Event can't be changed.");
         }
 
         $arr = explode('.', $event);
@@ -164,7 +113,6 @@ class Webhook extends Record implements
             throw new Forbidden("Not supported event.");
         }
 
-        $arr = explode('.', $event);
         $entityType = $arr[0];
         $type = $arr[1];
 
@@ -185,7 +133,7 @@ class Webhook extends Record implements
             throw new Forbidden("Not existing Entity Type.");
         }
 
-        if (!$this->acl->checkScope($entityType, 'read')) {
+        if (!$this->acl->checkScope($entityType, Acl\Table::ACTION_READ)) {
             throw new Forbidden("Entity type is forbidden.");
         }
 
@@ -204,43 +152,35 @@ class Webhook extends Record implements
                 throw new Forbidden("Field is empty.");
             }
 
-            $forbiddenFieldList = $this->getAcl()->getScopeForbiddenFieldList($entityType);
-
-            if (in_array($field, $forbiddenFieldList)) {
+            if (!$this->acl->checkField($entityType, $field)) {
                 throw new Forbidden("Field is forbidden.");
             }
 
             if (!$this->metadata->get(['entityDefs', $entityType, 'fields', $field])) {
                 throw new Forbidden("Field does not exist.");
             }
-        } else {
-            $entity->set('field', null);
+
+            return;
         }
+
+        /** @noinspection PhpRedundantOptionalArgumentInspection */
+        $entity->set('field', null);
     }
 
-    protected function afterCreateEntity(Entity $entity, $data)
+    /**
+     * @throws Forbidden
+     */
+    private function checkMaxCount(): void
     {
-        if ($entity->get('isActive')) {
-            $this->webhookManager->addEvent($entity->get('event'));
-        }
-    }
+        $maxCount = $this->config->get('webhookMaxCountPerUser', self::WEBHOOK_MAX_COUNT_PER_USER);
 
-    protected function afterDeleteEntity(Entity $entity)
-    {
-        if ($entity->get('isActive')) {
-            $this->webhookManager->removeEvent($entity->get('event'));
-        }
-    }
+        $count = $this->entityManager
+            ->getRDBRepositoryByClass(Webhook::class)
+            ->where(['userId' => $this->user->getId()])
+            ->count();
 
-    protected function afterUpdateEntity(Entity $entity, $data)
-    {
-        if (isset($data->isActive)) {
-            if ($entity->get('isActive')) {
-                $this->webhookManager->addEvent($entity->get('event'));
-            }
-            else {
-                $this->webhookManager->removeEvent($entity->get('event'));
-            }
+        if ($maxCount && $count >= $maxCount) {
+            throw new Forbidden("Webhook number per user exceeded the limit.");
         }
     }
 }

application/Espo/Classes/Select/AddressCountry/PreferredNameOrderer.php

@@ -0,0 +1,45 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Select\AddressCountry;
+
+use Espo\Core\Select\Order\Item;
+use Espo\Core\Select\Order\Orderer;
+use Espo\ORM\Query\Part\Order;
+use Espo\ORM\Query\SelectBuilder;
+
+class PreferredNameOrderer implements Orderer
+{
+    public function apply(SelectBuilder $queryBuilder, Item $item): void
+    {
+        $queryBuilder
+            ->order('isPreferred', $item->getOrder() === Order::ASC ? Order::DESC : Order::ASC)
+            ->order('name', $item->getOrder());
+    }
+}

application/Espo/Classes/Select/AppLogRecord/PrimaryFilters/Errors.php

@@ -0,0 +1,49 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2024 Yurii Kuznietsov, Taras Machyshyn, Oleksii Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\Select\AppLogRecord\PrimaryFilters;
+
+use Espo\Core\Select\Primary\Filter;
+use Espo\ORM\Query\SelectBuilder as QueryBuilder;
+use Psr\Log\LogLevel;
+
+class Errors implements Filter
+{
+    public function apply(QueryBuilder $queryBuilder): void
+    {
+        $queryBuilder->where([
+            'level' => [
+                ucfirst(LogLevel::ERROR),
+                ucfirst(LogLevel::EMERGENCY),
+                ucfirst(LogLevel::CRITICAL),
+                ucfirst(LogLevel::ALERT),
+            ]
+        ]);
+    }
+}

application/Espo/Classes/Select/Attachment/PrimaryFilters/Orphan.php

@@ -30,6 +30,8 @@
 namespace Espo\Classes\Select\Attachment\PrimaryFilters;
 
 use Espo\Core\Select\Primary\Filter;
+use Espo\Entities\Attachment;
+use Espo\Entities\Settings;
 use Espo\ORM\Query\SelectBuilder;
 
 class Orphan implements Filter
@@ -37,32 +39,35 @@ class Orphan implements Filter
     public function apply(SelectBuilder $queryBuilder): void
     {
         $queryBuilder->where([
-            'role' => ['Attachment', 'Inline Attachment'],
+            'role' => [
+                Attachment::ROLE_ATTACHMENT,
+                Attachment::ROLE_INLINE_ATTACHMENT,
+            ],
             [
                 'OR' => [
                     [
-                        'parentId' => null,
                         'parentType!=' => null,
-                        'relatedType=' => null,
+                        'parentId' => null,
+                        'relatedType' => null,
                     ],
                     [
-                        'parentType' => null,
-                        'relatedId' => null,
                         'relatedType!=' => null,
+                        'relatedId' => null,
+                        'parentType' => null,
                     ],
                 ],
             ],
             [
                 'OR' => [
-                    'relatedType!=' => 'Settings',
-                    'relatedType=' => null,
+                    'relatedType!=' => Settings::ENTITY_TYPE,
+                    'relatedType' => null,
                 ],
             ],
             'attachmentChild.id' => null,
         ]);
 
         $queryBuilder->leftJoin(
-            'Attachment',
+            Attachment::ENTITY_TYPE,
             'attachmentChild',
             [
                 'attachmentChild.sourceId:' => 'attachment.id',

application/Espo/Classes/Select/Email/AccessControlFilters/OnlyOwn.php

@@ -32,6 +32,7 @@ namespace Espo\Classes\Select\Email\AccessControlFilters;
 use Espo\Core\Select\AccessControl\Filter;
 
 use Espo\Classes\Select\Email\Helpers\JoinHelper;
+use Espo\Entities\Email;
 use Espo\Entities\User;
 use Espo\ORM\Query\SelectBuilder as QueryBuilder;
 
@@ -46,6 +47,6 @@ class OnlyOwn implements Filter
     {
         $this->joinHelper->joinEmailUser($queryBuilder, $this->user->getId());
 
-        $queryBuilder->where(['emailUser.userId' => $this->user->getId()]);
+        $queryBuilder->where([Email::ALIAS_INBOX . '.userId' => $this->user->getId()]);
     }
 }

application/Espo/Classes/Select/Email/AccessControlFilters/OnlyTeam.php

@@ -52,15 +52,15 @@ class OnlyTeam implements Filter
                 'entityTeam.entityType' => Email::ENTITY_TYPE,
                 'entityTeam.deleted' => false,
             ])
-            ->leftJoin(Email::RELATIONSHIP_EMAIL_USER, 'emailUser', [
-                'emailUser.emailId:' => 'id',
-                'emailUser.deleted' => false,
-                'emailUser.userId' => $this->user->getId(),
+            ->leftJoin(Email::RELATIONSHIP_EMAIL_USER, Email::ALIAS_INBOX, [
+                Email::ALIAS_INBOX . '.emailId:' => 'id',
+                Email::ALIAS_INBOX . '.deleted' => false,
+                Email::ALIAS_INBOX . '.userId' => $this->user->getId(),
             ])
             ->where([
                 'OR' => [
                     'entityTeam.teamId' => $this->user->getTeamIdList(),
-                    'emailUser.userId' => $this->user->getId(),
+                    Email::ALIAS_INBOX . '.userId' => $this->user->getId(),
                 ]
             ])
             ->build();

application/Espo/Classes/Select/Email/AccessControlFilters/PortalOnlyAccount.php

@@ -31,6 +31,7 @@ namespace Espo\Classes\Select\Email\AccessControlFilters;
 
 use Espo\Core\Select\AccessControl\Filter;
 use Espo\Classes\Select\Email\Helpers\JoinHelper;
+use Espo\Entities\Email;
 use Espo\Entities\User;
 use Espo\ORM\Query\SelectBuilder as QueryBuilder;
 
@@ -46,10 +47,9 @@ class PortalOnlyAccount implements Filter
         $queryBuilder->distinct();
 
         $orGroup = [
-            'emailUser.userId' => $this->user->getId(),
+            Email::ALIAS_INBOX . '.userId' => $this->user->getId(),
         ];
 
-        /** @var string[] $accountIdList */
         $accountIdList = $this->user->getLinkMultipleIdList('accounts');
 
         if (count($accountIdList)) {

application/Espo/Classes/Select/Email/AccessControlFilters/PortalOnlyContact.php

@@ -31,6 +31,7 @@ namespace Espo\Classes\Select\Email\AccessControlFilters;
 
 use Espo\Core\Select\AccessControl\Filter;
 use Espo\Classes\Select\Email\Helpers\JoinHelper;
+use Espo\Entities\Email;
 use Espo\Entities\User;
 use Espo\ORM\Query\SelectBuilder as QueryBuilder;
 
@@ -46,7 +47,7 @@ class PortalOnlyContact implements Filter
         $queryBuilder->distinct();
 
         $orGroup = [
-            'emailUser.userId' => $this->user->getId(),
+            Email::ALIAS_INBOX . '.userId' => $this->user->getId(),
         ];
 
         $contactId = $this->user->get('contactId');

application/Espo/Classes/Select/Email/AdditionalAppliers/Main.php

@@ -76,9 +76,9 @@ class Main implements AdditionalApplier
             return;
         }
 
-        if ($this->checkApplyDateSentIndex($queryBuilder, $searchParams)) {
+        /*if ($this->checkApplyDateSentIndex($queryBuilder, $searchParams)) {
             $queryBuilder->useIndex('dateSent');
-        }
+        }*/
     }
 
     private function joinEmailUser(SelectBuilder $queryBuilder): void
@@ -93,11 +93,12 @@ class Main implements AdditionalApplier
             Email::USERS_COLUMN_IS_READ,
             Email::USERS_COLUMN_IS_IMPORTANT,
             Email::USERS_COLUMN_IN_TRASH,
+            Email::USERS_COLUMN_IN_ARCHIVE,
             Email::USERS_COLUMN_FOLDER_ID,
         ];
 
         foreach ($itemList as $item) {
-            $queryBuilder->select('emailUser.' . $item, $item);
+            $queryBuilder->select(Email::ALIAS_INBOX . '.' . $item, $item);
         }
     }
 
@@ -116,7 +117,7 @@ class Main implements AdditionalApplier
         return null;
     }
 
-    private function checkApplyDateSentIndex(SelectBuilder $queryBuilder, SearchParams $searchParams): bool
+    /*private function checkApplyDateSentIndex(SelectBuilder $queryBuilder, SearchParams $searchParams): bool
     {
         if ($searchParams->getTextFilter()) {
             return false;
@@ -149,5 +150,5 @@ class Main implements AdditionalApplier
         }
 
         return true;
-    }
+    }*/
 }

application/Espo/Classes/Select/Email/BoolFilters/OnlyMy.php

@@ -31,6 +31,7 @@ namespace Espo\Classes\Select\Email\BoolFilters;
 
 use Espo\Classes\Select\Email\Helpers\JoinHelper;
 use Espo\Core\Select\Bool\Filter;
+use Espo\Entities\Email;
 use Espo\Entities\User;
 use Espo\ORM\Query\Part\Where\OrGroupBuilder;
 use Espo\ORM\Query\Part\WhereClause;
@@ -46,7 +47,7 @@ class OnlyMy implements Filter
         $this->joinHelper->joinEmailUser($queryBuilder, $this->user->getId());
 
         $item = WhereClause::fromRaw([
-            'emailUser.userId' => $this->user->getId(),
+            Email::ALIAS_INBOX . '.userId' => $this->user->getId(),
         ]);
 
         $orGroupBuilder->add($item);

application/Espo/Classes/Select/Email/Helpers/JoinHelper.php

@@ -36,14 +36,14 @@ class JoinHelper
 {
     public function joinEmailUser(QueryBuilder $queryBuilder, string $userId): void
     {
-        if ($queryBuilder->hasLeftJoinAlias('emailUser')) {
+        if ($queryBuilder->hasLeftJoinAlias(Email::ALIAS_INBOX)) {
             return;
         }
 
-        $queryBuilder->leftJoin(Email::RELATIONSHIP_EMAIL_USER, 'emailUser', [
-            'emailUser.emailId:' => 'id',
-            'emailUser.deleted' => false,
-            'emailUser.userId' => $userId,
+        $queryBuilder->leftJoin(Email::RELATIONSHIP_EMAIL_USER, Email::ALIAS_INBOX, [
+            Email::ALIAS_INBOX . '.emailId:' => 'id',
+            Email::ALIAS_INBOX . '.deleted' => false,
+            Email::ALIAS_INBOX . '.userId' => $userId,
         ]);
     }
 }