Initial commit

application/Espo/Classes/RecordHooks/AddressCountry/BeforeSave.php

@@ -0,0 +1,70 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\AddressCountry;
+
+use Espo\Core\Exceptions\ConflictSilent;
+use Espo\Core\Exceptions\Error\Body;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\AddressCountry;
+use Espo\ORM\Entity;
+use Espo\ORM\EntityManager;
+
+/**
+ * @implements SaveHook<AddressCountry>
+ */
+class BeforeSave implements SaveHook
+{
+    public function __construct(
+        private EntityManager $entityManager,
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $where = ['name' => $entity->getName()];
+
+        if (!$entity->isNew()) {
+            $where['id!='] = $entity->getId();
+        }
+
+        $one = $this->entityManager
+            ->getRDBRepositoryByClass(AddressCountry::class)
+            ->where($where)
+            ->findOne();
+
+        if (!$one) {
+            return;
+        }
+
+        throw ConflictSilent::createWithBody(
+            'duplicateError',
+            Body::create()->withMessageTranslation('duplicateConflict')
+        );
+    }
+}

application/Espo/Classes/RecordHooks/Attachment/AfterCreate.php

@@ -0,0 +1,45 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Attachment;
+
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Attachment;
+use Espo\ORM\Entity;
+
+/**
+ * @implements SaveHook<Attachment>
+ */
+class AfterCreate implements SaveHook
+{
+    public function process(Entity $entity): void
+    {
+        $entity->clear('contents');
+    }
+}

application/Espo/Classes/RecordHooks/Attachment/BeforeCreate.php

@@ -0,0 +1,100 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Attachment;
+
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Core\Utils\Config;
+use Espo\Core\Utils\Metadata;
+use Espo\Entities\Attachment;
+use Espo\ORM\Entity;
+use Espo\Tools\Attachment\Checker;
+use Espo\Tools\Attachment\DetailsObtainer;
+
+/**
+ * @implements SaveHook<Attachment>
+ */
+class BeforeCreate implements SaveHook
+{
+    public function __construct(
+        private Config $config,
+        private Metadata $metadata,
+        private DetailsObtainer $detailsObtainer,
+        private Checker $checker
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $this->processStorage($entity);
+        $this->processRole($entity);
+        $this->processSize($entity);
+
+        $this->checker->checkType($entity);
+    }
+
+    private function processStorage(Attachment $entity): void
+    {
+        $storage = $entity->getStorage();
+
+        $availableStorageList = $this->config->get('attachmentAvailableStorageList') ?? [];
+
+        if (
+            $storage &&
+            (
+                !in_array($storage, $availableStorageList) ||
+                !$this->metadata->get(['app', 'fileStorage', 'implementationClassNameMap', $storage])
+            )
+        ) {
+            $entity->clear('storage');
+        }
+    }
+
+    /**
+     * @throws Forbidden
+     */
+    private function processSize(Attachment $entity): void
+    {
+        $size = $entity->getSize();
+
+        $maxSize = $this->detailsObtainer->getUploadMaxSize($entity);
+
+        // Checking not actual file size but a set value.
+        if ($size && $size > $maxSize) {
+            throw new Forbidden("Attachment size exceeds `attachmentUploadMaxSize`.");
+        }
+    }
+
+    private function processRole(Attachment $entity): void
+    {
+        if (!$entity->getRole()) {
+            $entity->setRole(Attachment::ROLE_ATTACHMENT);
+        }
+    }
+}

application/Espo/Classes/RecordHooks/Email/AfterUpdate.php

@@ -0,0 +1,64 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Email;
+
+use Espo\Core\Exceptions\BadRequest;
+use Espo\Core\Exceptions\Error;
+use Espo\Core\Mail\Exceptions\NoSmtp;
+use Espo\Core\Mail\Exceptions\SendingError;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Email;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+use Espo\Tools\Email\SendService;
+
+/**
+ * @implements SaveHook<Email>
+ */
+class AfterUpdate implements SaveHook
+{
+    public function __construct(
+        private User $user,
+        private SendService $sendService
+    ) {}
+
+    /**
+     * @throws BadRequest
+     * @throws Error
+     * @throws NoSmtp
+     * @throws SendingError
+     */
+    public function process(Entity $entity): void
+    {
+        if ($entity->getStatus() === Email::STATUS_SENDING) {
+            $this->sendService->send($entity, $this->user);
+        }
+    }
+}

application/Espo/Classes/RecordHooks/Email/BeforeCreate.php

@@ -0,0 +1,50 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Email;
+
+use Espo\Core\Mail\EmailSender;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Email;
+use Espo\ORM\Entity;
+
+/**
+ * @implements SaveHook<Email>
+ */
+class BeforeCreate implements SaveHook
+{
+    public function process(Entity $entity): void
+    {
+        if ($entity->getStatus() === Email::STATUS_SENDING) {
+            $messageId = EmailSender::generateMessageId($entity);
+
+            $entity->setMessageId('<' . $messageId . '>');
+        }
+    }
+}

application/Espo/Classes/RecordHooks/Email/BeforeSave.php

@@ -0,0 +1,70 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Email;
+
+use Espo\Core\Exceptions\BadRequest;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Email;
+use Espo\ORM\Entity;
+use Espo\Tools\Email\Util;
+
+/**
+ * @implements SaveHook<Email>
+ */
+class BeforeSave implements SaveHook
+{
+    public function process(Entity $entity): void
+    {
+        if (
+            $entity->getStatus() !== Email::STATUS_DRAFT &&
+            $entity->getSendAt() &&
+            $entity->isAttributeChanged('sendAt')
+        ) {
+            throw new BadRequest("Cannot set send-at if status is not Draft.");
+        }
+
+        $this->processBodyPlain($entity);
+    }
+
+    private function processBodyPlain(Email $entity): void
+    {
+        if (!$entity->isHtml() || !$entity->isAttributeChanged('body')) {
+            return;
+        }
+
+        $body = $entity->getBody();
+
+        if ($body) {
+            $body = Util::stripHtml($body) ?: null;
+        }
+
+        $entity->setBodyPlain($body);
+    }
+}

application/Espo/Classes/RecordHooks/Email/BeforeUpdate.php

@@ -0,0 +1,162 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Email;
+
+use Espo\Core\Mail\EmailSender;
+use Espo\Core\Name\Field;
+use Espo\Core\ORM\Type\FieldType;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Core\Utils\FieldUtil;
+use Espo\Core\Utils\Metadata;
+use Espo\Core\Utils\SystemUser;
+use Espo\Entities\Email;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+use Espo\ORM\EntityManager;
+
+/**
+ * @implements SaveHook<Email>
+ */
+class BeforeUpdate implements SaveHook
+{
+    /** @var string[] */
+    private $allowedForUpdateFieldList = [
+        Field::PARENT,
+        Field::TEAMS,
+        Field::ASSIGNED_USER,
+    ];
+
+    public function __construct(
+        private User $user,
+        private EntityManager $entityManager,
+        private FieldUtil $fieldUtil,
+        private Metadata $metadata,
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $skipFilter = false;
+
+        if ($this->user->isAdmin()) {
+            $skipFilter = true;
+        }
+
+        if ($this->isEmailManuallyArchived($entity)) {
+            $skipFilter = true;
+        } else if ($entity->isAttributeChanged('dateSent')) {
+            $entity->set('dateSent', $entity->getFetched('dateSent'));
+        }
+
+        if ($entity->getStatus() === Email::STATUS_DRAFT) {
+            $skipFilter = true;
+        }
+
+        if (
+            $entity->getStatus() === Email::STATUS_SENDING &&
+            $entity->getFetched('status') === Email::STATUS_DRAFT
+        ) {
+            $skipFilter = true;
+        }
+
+        if (
+            $entity->isAttributeChanged('status') &&
+            $entity->getFetched('status') === Email::STATUS_ARCHIVED
+        ) {
+            $entity->setStatus(Email::STATUS_ARCHIVED);
+        }
+
+        if (!$skipFilter) {
+            $this->clearEntityForUpdate($entity);
+        }
+
+        if ($entity->getStatus() == Email::STATUS_SENDING) {
+            $messageId = EmailSender::generateMessageId($entity);
+
+            $entity->setMessageId('<' . $messageId . '>');
+        }
+    }
+
+    private function isEmailManuallyArchived(Email $email): bool
+    {
+        if ($email->getStatus() !== Email::STATUS_ARCHIVED) {
+            return false;
+        }
+
+        $userId = $email->getCreatedBy()?->getId();
+
+        if (!$userId) {
+            return false;
+        }
+
+        $user = $this->entityManager
+            ->getRDBRepositoryByClass(User::class)
+            ->getById($userId);
+
+        if (!$user) {
+            return true;
+        }
+
+        return $user->getUserName() !== SystemUser::NAME;
+    }
+
+    private function clearEntityForUpdate(Email $email): void
+    {
+        $entityDefs = $this->entityManager
+            ->getDefs()
+            ->getEntity(Email::ENTITY_TYPE);
+
+        foreach ($entityDefs->getFieldList() as $fieldDefs) {
+            $field = $fieldDefs->getName();
+
+            if ($fieldDefs->getParam('isCustom')) {
+                continue;
+            }
+
+            if (
+                $fieldDefs->getType() === FieldType::LINK_MULTIPLE &&
+                $this->metadata->get("entityDefs.Email.links.$field.isCustom")
+            ) {
+                continue;
+            }
+
+            if (in_array($field, $this->allowedForUpdateFieldList)) {
+                continue;
+            }
+
+            $attributeList = $this->fieldUtil->getAttributeList(Email::ENTITY_TYPE, $field);
+
+            foreach ($attributeList as $attribute) {
+                if ($email->isAttributeChanged($attribute) && $email->isAttributeWritten($attribute)) {
+                    $email->set($attribute, $email->getFetched($attribute));
+                }
+            }
+        }
+    }
+}

application/Espo/Classes/RecordHooks/Email/CheckFromAddress.php

@@ -0,0 +1,100 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Email;
+
+use Espo\Core\Acl;
+use Espo\Core\Exceptions\BadRequest;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Mail\Account\SendingAccountProvider;
+use Espo\Core\Mail\ConfigDataProvider;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Email;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+
+/**
+ * @implements SaveHook<Email>
+ */
+class CheckFromAddress implements SaveHook
+{
+    public function __construct(
+        private User $user,
+        private SendingAccountProvider $sendingAccountProvider,
+        private Acl $acl,
+        private ConfigDataProvider $configDataProvider,
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        if ($this->user->isAdmin()) {
+            return;
+        }
+
+        $fromAddress = $entity->getFromAddress();
+
+        // Should be after 'getFromAddress'.
+        if (!$entity->isAttributeChanged('from')) {
+            return;
+        }
+
+        if (!$fromAddress) {
+            throw new BadRequest("No 'from' address");
+        }
+
+        if ($this->acl->checkScope('Import')) {
+            return;
+        }
+
+        $fromAddress = strtolower($fromAddress);
+
+        foreach ($this->user->getEmailAddressGroup()->getAddressList() as $address) {
+            if ($fromAddress === strtolower($address)) {
+                return;
+            }
+        }
+
+        if ($this->sendingAccountProvider->getShared($this->user, $fromAddress)) {
+            return;
+        }
+
+        $system = $this->sendingAccountProvider->getSystem();
+
+        if (
+            $system &&
+            $this->configDataProvider->isSystemOutboundAddressShared() &&
+            $system->getEmailAddress() &&
+            $fromAddress === strtolower($system->getEmailAddress())
+        ) {
+            return;
+        }
+
+        throw new Forbidden("Not allowed 'from' address.");
+    }
+}

application/Espo/Classes/RecordHooks/Email/MarkAsRead.php

@@ -0,0 +1,55 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Email;
+
+use Espo\Core\Record\Hook\ReadHook;
+use Espo\Core\Record\ReadParams;
+use Espo\Entities\Email;
+use Espo\ORM\Entity;
+use Espo\Tools\Email\InboxService;
+
+/**
+ * @implements ReadHook<Email>
+ */
+class MarkAsRead implements ReadHook
+{
+    public function __construct(
+        private InboxService $inboxService
+    ) {}
+
+    public function process(Entity $entity, ReadParams $params): void
+    {
+        if ($entity->isRead()) {
+            return;
+        }
+
+        $this->inboxService->markAsRead($entity->getId());
+    }
+}

application/Espo/Classes/RecordHooks/Email/MarkAsReadBeforeUpdate.php

@@ -0,0 +1,54 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Email;
+
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Email;
+use Espo\ORM\Entity;
+use Espo\Tools\Email\InboxService;
+
+/**
+ * @implements SaveHook<Email>
+ */
+class MarkAsReadBeforeUpdate implements SaveHook
+{
+    public function __construct(
+        private InboxService $inboxService
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        if ($entity->isRead()) {
+            return;
+        }
+
+        $this->inboxService->markAsRead($entity->getId());
+    }
+}

application/Espo/Classes/RecordHooks/EmailAccount/BeforeCreate.php

@@ -0,0 +1,69 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\EmailAccount;
+
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Core\Utils\Config;
+use Espo\Entities\EmailAccount;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+use Espo\ORM\EntityManager;
+use const PHP_INT_MAX;
+
+/**
+ * @implements SaveHook<EmailAccount>
+ */
+class BeforeCreate implements SaveHook
+{
+    public function __construct(
+        private User $user,
+        private Config $config,
+        private EntityManager $entityManager
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        if ($this->user->isAdmin()) {
+            return;
+        }
+
+        $entity->set('assignedUserId', $this->user->getId());
+
+        $count = $this->entityManager
+            ->getRDBRepository(EmailAccount::ENTITY_TYPE)
+            ->where(['assignedUserId' => $this->user->getId()])
+            ->count();
+
+        if ($count >= $this->config->get('maxEmailAccountCount', PHP_INT_MAX)) {
+            throw new Forbidden("Email Account number for user limit exceeded.");
+        }
+    }
+}

application/Espo/Classes/RecordHooks/EmailFilter/BeforeSave.php

@@ -0,0 +1,127 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\EmailFilter;
+
+use Espo\Core\Acl;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\EmailAccount as EmailAccountEntity;
+use Espo\Entities\EmailFilter;
+use Espo\Entities\InboundEmail as InboundEmailEntity;
+use Espo\Entities\User as UserEntity;
+use Espo\ORM\Entity;
+
+/**
+ * @implements SaveHook<EmailFilter>
+ */
+class BeforeSave implements SaveHook
+{
+    public function __construct(
+        private Acl $acl
+    ) {}
+
+    /**
+     * @inheritDoc
+     */
+    public function process(Entity $entity): void
+    {
+        // Check if own.
+        if ($entity->isNew() && !$this->acl->checkEntityEdit($entity)) {
+            throw new Forbidden();
+        }
+
+        $this->controlEntityValues($entity);
+    }
+
+    /**
+     * @throws Forbidden
+     */
+    private function controlEntityValues(EmailFilter $entity): void
+    {
+        if ($entity->isGlobal()) {
+            $entity->setMultiple([
+                'parentType' => null,
+                'parentId' => null,
+            ]);
+
+            if ($entity->getAction() !== EmailFilter::ACTION_SKIP) {
+                throw new Forbidden("Not allowed `action`.");
+            }
+        }
+
+        if ($entity->getParentType() && !$entity->getParentId()) {
+            throw new Forbidden("Not allowed `parentId` value.");
+        }
+
+        if (
+            $entity->getParentType() === UserEntity::ENTITY_TYPE &&
+            !in_array(
+                $entity->getAction(),
+                [
+                    EmailFilter::ACTION_NONE,
+                    EmailFilter::ACTION_SKIP,
+                    EmailFilter::ACTION_MOVE_TO_FOLDER,
+                ]
+            )
+        ) {
+            throw new Forbidden("Not allowed `action`.");
+        }
+
+        if (
+            $entity->getParentType() === InboundEmailEntity::ENTITY_TYPE &&
+            !in_array(
+                $entity->getAction(),
+                [
+                    EmailFilter::ACTION_SKIP,
+                    EmailFilter::ACTION_MOVE_TO_GROUP_FOLDER,
+                ]
+            )
+        ) {
+            throw new Forbidden("Not allowed `action`.");
+        }
+
+        if (
+            $entity->getParentType() === EmailAccountEntity::ENTITY_TYPE &&
+            $entity->getAction() !== EmailFilter::ACTION_SKIP
+        ) {
+            throw new Forbidden("Not allowed `action`.");
+        }
+
+        if ($entity->getAction() !== EmailFilter::ACTION_MOVE_TO_FOLDER) {
+            /** @noinspection PhpRedundantOptionalArgumentInspection */
+            $entity->set('emailFolderId', null);
+        }
+
+        if ($entity->getAction() !== EmailFilter::ACTION_MOVE_TO_GROUP_FOLDER) {
+            /** @noinspection PhpRedundantOptionalArgumentInspection */
+            $entity->set('groupEmailFolderId', null);
+        }
+    }
+}

application/Espo/Classes/RecordHooks/EmailFolder/BeforeCreate.php

@@ -0,0 +1,59 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\EmailFolder;
+
+use Espo\Core\Acl;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\EmailFolder;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+
+/**
+ * @implements SaveHook<EmailFolder>
+ */
+class BeforeCreate implements SaveHook
+{
+    public function __construct(
+        private User $user,
+        private Acl $acl
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        if (!$this->user->isAdmin() || !$entity->get('assignedUserId')) {
+            $entity->set('assignedUserId', $this->user->getId());
+        }
+
+        if (!$this->acl->checkEntityEdit($entity)) {
+            throw new Forbidden();
+        }
+    }
+}

application/Espo/Classes/RecordHooks/Event/BeforeUpdatePreserveDuration.php

@@ -0,0 +1,119 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Event;
+
+use Espo\Core\Record\Hook\UpdateHook;
+use Espo\Core\Record\UpdateParams;
+use Espo\Core\ORM\Entity as CoreEntity;
+use Espo\Core\Field\DateTime;
+use Espo\Core\Field\Date;
+
+use Espo\ORM\Entity;
+use Espo\ORM\Defs as OrmDefs;
+
+/**
+ * @implements UpdateHook<CoreEntity>
+ */
+class BeforeUpdatePreserveDuration implements UpdateHook
+{
+    private OrmDefs $ormDefs;
+
+    public function __construct(OrmDefs $ormDefs)
+    {
+        $this->ormDefs = $ormDefs;
+    }
+
+    public function process(Entity $entity, UpdateParams $params): void
+    {
+        /** @var CoreEntity $entity */
+
+        if (!$entity->isAttributeChanged('dateStart') && !$entity->isAttributeChanged('dateStartDate')) {
+            return;
+        }
+
+        if ($entity->isAttributeWritten('dateEnd') || $entity->isAttributeWritten('dateEndDate')) {
+            return;
+        }
+
+        $preserveDurationDisabled = $this->ormDefs
+            ->getEntity($entity->getEntityType())
+            ->getField('dateEnd')
+            ->getParam('preserveDurationDisabled');
+
+        if ($preserveDurationDisabled) {
+            return;
+        }
+
+        $this->processDateTime($entity);
+        $this->processDate($entity);
+    }
+
+    private function processDateTime(Entity $entity): void
+    {
+        $dateStartFetchedString = $entity->getFetched('dateStart');
+        $dateStartString = $entity->get('dateStart');
+        $dateEndString = $entity->get('dateEnd');
+
+        if (!$dateStartFetchedString || !$dateStartString || !$dateEndString) {
+            return;
+        }
+
+        $dateStartFetched = DateTime::fromString($dateStartFetchedString);
+        $dateStart = DateTime::fromString($dateStartString);
+        $dateEnd = DateTime::fromString($dateEndString);
+
+        $diff = $dateStartFetched->diff($dateEnd);
+
+        $dateEndModified = $dateStart->add($diff);
+
+        $entity->set('dateEnd', $dateEndModified->toString());
+    }
+
+    private function processDate(Entity $entity): void
+    {
+        $dateStartFetchedString = $entity->getFetched('dateStartDate');
+        $dateStartString = $entity->get('dateStartDate');
+        $dateEndString = $entity->get('dateEndDate');
+
+        if (!$dateStartFetchedString || !$dateStartString || !$dateEndString) {
+            return;
+        }
+
+        $dateStartFetched = Date::fromString($dateStartFetchedString);
+        $dateStart = Date::fromString($dateStartString);
+        $dateEnd = Date::fromString($dateEndString);
+
+        $diff = $dateStartFetched->diff($dateEnd);
+
+        $dateEndModified = $dateStart->add($diff);
+
+        $entity->set('dateEndDate', $dateEndModified->toString());
+    }
+}

application/Espo/Classes/RecordHooks/LeadCapture/BeforeCreate.php

@@ -0,0 +1,52 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\LeadCapture;
+
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\LeadCapture;
+use Espo\ORM\Entity;
+use Espo\Tools\LeadCapture\Service;
+
+/**
+ * @noinspection PhpUnused
+ * @implements SaveHook<LeadCapture>
+ */
+class BeforeCreate implements SaveHook
+{
+    public function __construct(
+        private Service $service
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $entity->setApiKey($this->service->generateApiKey());
+        $entity->setFormId($this->service->generateFormId());
+    }
+}

application/Espo/Classes/RecordHooks/Note/AfterCreate.php

@@ -0,0 +1,90 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Note;
+
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Core\Utils\Metadata;
+use Espo\Entities\Note;
+use Espo\Entities\Note as NoteEntity;
+use Espo\Entities\Preferences;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+use Espo\ORM\EntityManager;
+use Espo\Tools\Stream\Service;
+
+/**
+ * @implements SaveHook<Note>
+ * @noinspection PhpUnused
+ */
+class AfterCreate implements SaveHook
+{
+    public function __construct(
+        private EntityManager $entityManager,
+        private User $user,
+        private Metadata $metadata,
+        private Service $streamService
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $parentType = $entity->getParentType();
+        $parentId = $entity->getParentId();
+
+        if (
+            $entity->getType() !== NoteEntity::TYPE_POST ||
+            !$parentType ||
+            !$parentId
+        ) {
+            return;
+        }
+
+        if (!$this->metadata->get(['scopes', $parentType, 'stream'])) {
+            return;
+        }
+
+        $preferences = $this->entityManager->getEntityById(Preferences::ENTITY_TYPE, $this->user->getId());
+
+        if (!$preferences) {
+            return;
+        }
+
+        if (!$preferences->get('followEntityOnStreamPost')) {
+            return;
+        }
+
+        $parent = $this->entityManager->getEntityById($parentType, $parentId);
+
+        if (!$parent || $this->user->isSystem() || $this->user->isApi()) {
+            return;
+        }
+
+        $this->streamService->followEntity($parent, $this->user->getId());
+    }
+}

application/Espo/Classes/RecordHooks/Note/AssignmentCheck.php

@@ -0,0 +1,198 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Note;
+
+use Espo\Core\Acl;
+use Espo\Core\Acl\Permission;
+use Espo\Core\Acl\Table as AclTable;
+use Espo\Core\Exceptions\BadRequest;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Name\Field;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Note;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+use Espo\ORM\EntityManager;
+use Espo\ORM\Name\Attribute;
+use Espo\Repositories\User as UserRepository;
+
+/**
+ * @implements SaveHook<Note>
+ */
+class AssignmentCheck implements SaveHook
+{
+    public function __construct(
+        private User $user,
+        private Acl $acl,
+        private EntityManager $entityManager
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $targetType = $entity->getTargetType();
+
+        if (!$targetType) {
+            return;
+        }
+
+        $userTeamIdList = $this->user->getTeamIdList();
+
+        $userIdList = $entity->getLinkMultipleIdList('users');
+        $portalIdList = $entity->getLinkMultipleIdList('portals');
+        $teamIdList = $entity->getLinkMultipleIdList(Field::TEAMS);
+
+        /** @var iterable<User> $targetUserList */
+        $targetUserList = [];
+
+        if ($targetType === Note::TARGET_USERS) {
+            /** @var iterable<User> $targetUserList */
+            $targetUserList = $this->entityManager
+                ->getRDBRepository(User::ENTITY_TYPE)
+                ->select([Attribute::ID, 'type'])
+                ->where([Attribute::ID => $userIdList])
+                ->find();
+        }
+
+        $hasPortalTargetUser = false;
+        $allTargetUsersArePortal = true;
+
+        foreach ($targetUserList as $user) {
+            if (!$user->isPortal()) {
+                $allTargetUsersArePortal = false;
+            }
+
+            if ($user->isPortal()) {
+                $hasPortalTargetUser = true;
+            }
+        }
+
+        $messagePermission = $this->acl->getPermissionLevel(Permission::MESSAGE);
+
+        if ($messagePermission === AclTable::LEVEL_NO) {
+            if (
+                $targetType !== Note::TARGET_SELF &&
+                $targetType !== Note::TARGET_PORTALS &&
+                !(
+                    $targetType === Note::TARGET_USERS &&
+                    count($userIdList) === 1 &&
+                    $userIdList[0] === $this->user->getId()
+                ) &&
+                !(
+                    $targetType === Note::TARGET_USERS && $allTargetUsersArePortal
+                )
+            ) {
+                throw new Forbidden('Not permitted to post to anybody except self.');
+            }
+        }
+
+        if ($targetType === Note::TARGET_TEAMS) {
+            if (empty($teamIdList)) {
+                throw new BadRequest("No team IDS.");
+            }
+        }
+
+        if ($targetType === Note::TARGET_USERS) {
+            if (empty($userIdList)) {
+                throw new BadRequest("No user IDs.");
+            }
+        }
+
+        if ($targetType === Note::TARGET_PORTALS) {
+            if (empty($portalIdList)) {
+                throw new BadRequest("No portal IDs.");
+            }
+
+            if ($this->acl->getPermissionLevel(Permission::PORTAL) !== AclTable::LEVEL_YES) {
+                throw new Forbidden('Not permitted to post to portal users.');
+            }
+        }
+
+        if (
+            $targetType === Note::TARGET_USERS &&
+            $this->acl->getPermissionLevel(Permission::PORTAL) !== AclTable::LEVEL_YES
+        ) {
+            if ($hasPortalTargetUser) {
+                throw new Forbidden('Not permitted to post to portal users.');
+            }
+        }
+
+        if ($messagePermission === AclTable::LEVEL_TEAM) {
+            if ($targetType === Note::TARGET_ALL) {
+                throw new Forbidden('Not permitted to post to all.');
+            }
+        }
+
+        if (
+            $messagePermission === AclTable::LEVEL_TEAM &&
+            $targetType === Note::TARGET_TEAMS
+        ) {
+            if (empty($userTeamIdList)) {
+                throw new Forbidden('Not permitted to post to foreign teams.');
+            }
+
+            foreach ($teamIdList as $teamId) {
+                if (!in_array($teamId, $userTeamIdList)) {
+                    throw new Forbidden("Not permitted to post to foreign teams.");
+                }
+            }
+        }
+
+        if (
+            $messagePermission === AclTable::LEVEL_TEAM &&
+            $targetType === Note::TARGET_USERS
+        ) {
+            if (empty($userTeamIdList)) {
+                throw new Forbidden('Not permitted to post to users from foreign teams.');
+            }
+
+            foreach ($targetUserList as $user) {
+                if ($user->getId() === $this->user->getId()) {
+                    continue;
+                }
+
+                if ($user->isPortal()) {
+                    continue;
+                }
+
+                $inTeam = $this->getUserRepository()->checkBelongsToAnyOfTeams($user->getId(), $userTeamIdList);
+
+                if (!$inTeam) {
+                    throw new Forbidden('Not permitted to post to users from foreign teams.');
+                }
+            }
+        }
+    }
+
+    private function getUserRepository(): UserRepository
+    {
+        /** @var UserRepository */
+        return $this->entityManager->getRepository(User::ENTITY_TYPE);
+    }
+}

application/Espo/Classes/RecordHooks/Note/BeforeCreate.php

@@ -0,0 +1,136 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Note;
+
+use Espo\Core\Acl;
+use Espo\Core\Acl\Table as AclTable;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Note;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+use Espo\ORM\EntityManager;
+use Espo\Tools\Stream\NoteUtil;
+
+/**
+ * @implements SaveHook<Note>
+ * @noinspection PhpUnused
+ */
+class BeforeCreate implements SaveHook
+{
+    public function __construct(
+        private EntityManager $entityManager,
+        private Acl $acl,
+        private User $user,
+        private NoteUtil $noteUtil
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $this->checkParent($entity);
+
+        if (!$entity->isPost() && !$this->user->isAdmin()) {
+            throw new Forbidden("Only 'Post' type allowed.");
+        }
+
+        if ($this->user->isPortal()) {
+            $entity->set('isInternal', false);
+        }
+
+        if ($entity->isPost()) {
+            $this->noteUtil->handlePostText($entity);
+        }
+
+        $targetType = $entity->getTargetType();
+
+        $entity->clear('isPinned');
+        $entity->clear('isGlobal');
+
+        switch ($targetType) {
+            case Note::TARGET_ALL:
+
+                $entity->clear('usersIds');
+                $entity->clear('teamsIds');
+                $entity->clear('portalsIds');
+                $entity->set('isGlobal', true);
+
+                break;
+
+            case Note::TARGET_SELF:
+
+                $entity->clear('usersIds');
+                $entity->clear('teamsIds');
+                $entity->clear('portalsIds');
+                $entity->setUsersIds([$this->user->getId()]);
+                $entity->set('isForSelf', true);
+
+                break;
+
+            case Note::TARGET_USERS:
+
+                $entity->clear('teamsIds');
+                $entity->clear('portalsIds');
+
+                break;
+
+            case Note::TARGET_TEAMS:
+
+                $entity->clear('usersIds');
+                $entity->clear('portalsIds');
+
+                break;
+
+            case Note::TARGET_PORTALS:
+
+                $entity->clear('usersIds');
+                $entity->clear('teamsIds');
+
+                break;
+        }
+    }
+
+    /**
+     * @throws Forbidden
+     */
+    private function checkParent(Note $entity): void
+    {
+        if (!$entity->getParentType() || !$entity->getParentId()) {
+            return;
+        }
+
+        $parent = $this->entityManager->getEntityById($entity->getParentType(), $entity->getParentId());
+
+        if ($parent && $this->acl->check($parent, AclTable::ACTION_READ)) {
+            return;
+        }
+
+        throw new Forbidden("No access to parent.");
+    }
+}

application/Espo/Classes/RecordHooks/Note/BeforeUpdate.php

@@ -0,0 +1,68 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Note;
+
+use Espo\Core\Exceptions\ForbiddenSilent;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Note;
+use Espo\ORM\Entity;
+use Espo\Tools\Stream\NoteUtil;
+
+/**
+ * @implements SaveHook<Note>
+ * @noinspection PhpUnused
+ */
+class BeforeUpdate implements SaveHook
+{
+    public function __construct(
+        private NoteUtil $noteUtil,
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        if (!$this->isEditableType($entity)) {
+            throw new ForbiddenSilent("Note is not editable.");
+        }
+
+        if ($entity->isPost()) {
+            $this->noteUtil->handlePostText($entity);
+        }
+
+        if (!$entity->isPost()) {
+            $entity->clear('post');
+            $entity->clear('attachmentsIds');
+        }
+    }
+
+    private function isEditableType(Note $entity): bool
+    {
+        return $entity->getType() == Note::TYPE_POST;
+    }
+}

application/Espo/Classes/RecordHooks/Portal/AfterUpdate.php

@@ -0,0 +1,68 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Portal;
+
+use Espo\Core\Acl\Cache\Clearer;
+use Espo\Core\DataManager;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Portal;
+use Espo\ORM\Entity;
+use Espo\ORM\EntityManager;
+use Espo\Repositories\Portal as PortalRepository;
+
+/**
+ * @implements SaveHook<Portal>
+ */
+class AfterUpdate implements SaveHook
+{
+    public function __construct(
+        private Clearer $clearer,
+        private DataManager $dataManager,
+        private EntityManager $entityManager
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $this->getPortalRepository()->loadUrlField($entity);
+
+        if (!$entity->isAttributeChanged('portalRolesIds')) {
+            return;
+        }
+
+        $this->clearer->clearForAllPortalUsers();
+        $this->dataManager->updateCacheTimestamp();
+    }
+
+    private function getPortalRepository(): PortalRepository
+    {
+        /** @var PortalRepository */
+        return $this->entityManager->getRDBRepositoryByClass(Portal::class);
+    }
+}

application/Espo/Classes/RecordHooks/PortalRole/AfterSave.php

@@ -0,0 +1,53 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\PortalRole;
+
+use Espo\Core\Acl\Cache\Clearer;
+use Espo\Core\DataManager;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\PortalRole;
+use Espo\ORM\Entity;
+
+/**
+ * @implements SaveHook<PortalRole>
+ */
+class AfterSave implements SaveHook
+{
+    public function __construct(
+        private Clearer $clearer,
+        private DataManager $dataManager
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $this->clearer->clearForAllPortalUsers();
+        $this->dataManager->updateCacheTimestamp();
+    }
+}

application/Espo/Classes/RecordHooks/Role/AfterSave.php

@@ -0,0 +1,53 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Role;
+
+use Espo\Core\Acl\Cache\Clearer;
+use Espo\Core\DataManager;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Role;
+use Espo\ORM\Entity;
+
+/**
+ * @implements SaveHook<Role>
+ */
+class AfterSave implements SaveHook
+{
+    public function __construct(
+        private Clearer $clearer,
+        private DataManager $dataManager
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $this->clearer->clearForAllInternalUsers();
+        $this->dataManager->updateCacheTimestamp();
+    }
+}

application/Espo/Classes/RecordHooks/Role/BeforeSaveValidate.php

@@ -0,0 +1,256 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Role;
+
+use Espo\Core\Acl\Table;
+use Espo\Core\Exceptions\BadRequest;
+use Espo\Core\Portal\Acl\Table as TablePortal;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Core\Utils\Metadata;
+use Espo\Entities\PortalRole;
+use Espo\Entities\Role;
+use Espo\ORM\Entity;
+use stdClass;
+
+/**
+ * @noinspection PhpUnused
+ * @implements SaveHook<Role|PortalRole>
+ */
+class BeforeSaveValidate implements SaveHook
+{
+    /** @var string[] */
+    private array $levelList = [
+        Table::LEVEL_YES,
+        Table::LEVEL_ALL,
+        Table::LEVEL_TEAM,
+        Table::LEVEL_OWN,
+        Table::LEVEL_NO,
+    ];
+
+    /** @var string[] */
+    private array $portalLevelList = [
+        Table::LEVEL_YES,
+        Table::LEVEL_ALL,
+        TablePortal::LEVEL_ACCOUNT,
+        TablePortal::LEVEL_CONTACT,
+        Table::LEVEL_OWN,
+        Table::LEVEL_NO,
+    ];
+
+    public function __construct(
+        private Metadata $metadata
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $this->validateData($entity);
+        $this->validateFieldData($entity);
+    }
+
+    /**
+     * @throws BadRequest
+     */
+    private function validateData(Role|PortalRole $entity): void
+    {
+        if ($entity->get('data') === null) {
+            return;
+        }
+
+        /** @var array<string, mixed> $data */
+        $data = get_object_vars($entity->get('data'));
+
+        foreach ($data as $scope => $item) {
+            if (!is_bool($item) && !$item instanceof stdClass) {
+                throw new BadRequest("Bad data. Should be bool or object.");
+            }
+
+            $this->validateDataItem($scope, $entity, $item);
+        }
+    }
+
+    /**
+     * @throws BadRequest
+     */
+    private function validateDataItem(string $scope, Role|PortalRole $entity, bool|stdClass $item): void
+    {
+        $key = $entity instanceof PortalRole ? 'aclPortal' : 'acl';
+
+        $type = $this->metadata->get("scopes.$scope.$key");
+
+        if ($type === Table\ScopeDataType::BOOLEAN) {
+            if (!is_bool($item)) {
+                throw new BadRequest("Bad data. Value for *$scope* should be be boolean.");
+            }
+
+            return;
+        }
+
+        if ($type === null) {
+            throw new BadRequest("Bad data. Scope *$scope* is not allowed.");
+        }
+
+        if ($item === false) {
+            return;
+        }
+
+        if (is_bool($item)) {
+            throw new BadRequest("Bad data. Value for *$scope* should be be false or object.");
+        }
+
+        $actions = [
+            Table::ACTION_CREATE,
+            Table::ACTION_READ,
+            Table::ACTION_EDIT,
+            Table::ACTION_DELETE,
+            Table::ACTION_STREAM,
+        ];
+
+        $isPortal = $entity instanceof PortalRole;
+
+        foreach ($actions as $action) {
+            if (!property_exists($item, $action)) {
+                continue;
+            }
+
+            $level = $item->$action;
+
+            $this->checkActionLevel($scope, $action, $level, $isPortal);
+        }
+    }
+
+    /**
+     * @throws BadRequest
+     */
+    private function checkActionLevel(string $scope, string $action, string $level, bool $isPortal): void
+    {
+        if ($action === Table::ACTION_CREATE) {
+            if (!in_array($level, [Table::LEVEL_YES, Table::LEVEL_NO])) {
+                throw new BadRequest("Level `$level` is not allowed for action *$action* for *$scope*.");
+            }
+
+            return;
+        }
+
+        $mapKey = $isPortal ? 'aclPortalActionLevelListMap' : 'aclActionLevelListMap';
+        $key = $isPortal ? 'aclPortalLevelList' : 'aclLevelList';
+        $defaultLevels = $isPortal ? $this->portalLevelList : $this->levelList;
+
+        $levels = $this->metadata->get("scopes.$scope.$mapKey.$action") ??
+            $this->metadata->get("scopes.$scope.$key") ??
+            $defaultLevels;
+
+        if (in_array($level, $levels)) {
+            return;
+        }
+
+        throw new BadRequest("Level `$level` is not allowed for action *$action* for *$scope*.");
+    }
+
+    /**
+     * @throws BadRequest
+     */
+    private function validateFieldData(Role|PortalRole $entity): void
+    {
+        if ($entity->get('fieldData') === null) {
+            return;
+        }
+
+        /** @var array<string, mixed> $data */
+        $data = get_object_vars($entity->get('fieldData'));
+
+        foreach ($data as $scope => $item) {
+            if (!$item instanceof stdClass) {
+                throw new BadRequest("Bad field-level data. Should be object.");
+            }
+
+            $this->validateFieldDataItem($scope, $entity, $item);
+        }
+    }
+
+    /**
+     * @throws BadRequest
+     */
+    private function validateFieldDataItem(string $scope, PortalRole|Role $entity, stdClass $item): void
+    {
+        $disabledKey = $entity instanceof PortalRole ? 'aclPortalFieldLevelDisabled' : 'aclFieldLevelDisabled';
+        $key = $entity instanceof PortalRole ? 'aclPortal' : 'acl';
+
+        if (
+            !$this->metadata->get("scopes.$scope.entity") ||
+            !$this->metadata->get("scopes.$scope.$key") ||
+            $this->metadata->get("scopes.$scope.$disabledKey")
+        ) {
+            throw new BadRequest("Bad field-level data. Scope *$scope* is not allowed.");
+        }
+
+        /** @var array<string, mixed> $data */
+        $data = get_object_vars($item);
+
+        foreach ($data as $field => $fieldItem) {
+            if (!$fieldItem instanceof stdClass) {
+                throw new BadRequest("Data for field *$field*, scope *$scope* should be object.");
+            }
+
+            $this->validateFieldDataItemItem($scope, $field, $fieldItem);
+        }
+    }
+
+    /**
+     * @throws BadRequest
+     */
+    private function validateFieldDataItemItem(string $scope, string $field, stdClass $item): void
+    {
+        if (!$this->metadata->get("entityDefs.$scope.fields.$field")) {
+            throw new BadRequest("Field *$field* does not exist in *$scope*.");
+        }
+
+        $actions = [
+            Table::ACTION_READ,
+            Table::ACTION_EDIT,
+        ];
+
+        $levels = [
+            Table::LEVEL_YES,
+            Table::LEVEL_NO,
+        ];
+
+        foreach ($actions as $action) {
+            if (!property_exists($item, $action)) {
+                continue;
+            }
+
+            $level = $item->$action;
+
+            if (!in_array($level, $levels)) {
+                throw new BadRequest("Level `$level` is not allowed for *$scope*, field *$field*.");
+            }
+        }
+    }
+}

application/Espo/Classes/RecordHooks/Team/AfterUpdate.php

@@ -0,0 +1,58 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Team;
+
+use Espo\Core\Acl\Cache\Clearer;
+use Espo\Core\DataManager;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Entities\Team;
+use Espo\ORM\Entity;
+
+/**
+ * @implements SaveHook<Team>
+ * @noinspection PhpUnused
+ */
+class AfterUpdate implements SaveHook
+{
+    public function __construct(
+        private Clearer $clearer,
+        private DataManager $dataManager
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        if (!$entity->isAttributeChanged('rolesIds')) {
+            return;
+        }
+
+        $this->clearer->clearForAllInternalUsers();
+        $this->dataManager->updateCacheTimestamp();
+    }
+}

application/Espo/Classes/RecordHooks/Team/BeforeLinkUserCheck.php

@@ -0,0 +1,65 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Team;
+
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\Hook\LinkHook;
+
+use Espo\ORM\Entity;
+
+use Espo\Entities\User;
+
+/**
+ * @implements LinkHook<\Espo\Entities\Team>
+ */
+class BeforeLinkUserCheck implements LinkHook
+{
+    public function process(Entity $entity, string $link, Entity $foreignEntity): void
+    {
+        if ($link !== 'users') {
+            return;
+        }
+
+        assert($foreignEntity instanceof User);
+
+        $this->processUserCheck($foreignEntity);
+    }
+
+    private function processUserCheck(User $user): void
+    {
+        if ($user->isPortal()) {
+            throw new Forbidden("Can't add portal users to team.");
+        }
+
+        if ($user->isSystem()) {
+            throw new Forbidden("Can't add system users to team.");
+        }
+    }
+}

application/Espo/Classes/RecordHooks/Team/ClearCacheAfterLink.php

@@ -0,0 +1,58 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Team;
+
+use Espo\Core\Acl\Cache\Clearer;
+use Espo\Core\DataManager;
+use Espo\Core\Record\Hook\LinkHook;
+use Espo\Entities\Team;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+
+/**
+ * @implements LinkHook<Team>
+ */
+class ClearCacheAfterLink implements LinkHook
+{
+    public function __construct(
+        private Clearer $clearer,
+        private DataManager $dataManager
+    ) {}
+
+    public function process(Entity $entity, string $link, Entity $foreignEntity): void
+    {
+        if ($link !== 'users' || !$foreignEntity instanceof User) {
+            return;
+        }
+
+        $this->clearer->clearForUser($foreignEntity);
+        $this->dataManager->updateCacheTimestamp();
+    }
+}

application/Espo/Classes/RecordHooks/Team/ClearCacheAfterUnlink.php

@@ -0,0 +1,58 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Team;
+
+use Espo\Core\Acl\Cache\Clearer;
+use Espo\Core\DataManager;
+use Espo\Core\Record\Hook\UnlinkHook;
+use Espo\Entities\Team;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+
+/**
+ * @implements UnlinkHook<Team>
+ */
+class ClearCacheAfterUnlink implements UnlinkHook
+{
+    public function __construct(
+        private Clearer $clearer,
+        private DataManager $dataManager
+    ) {}
+
+    public function process(Entity $entity, string $link, Entity $foreignEntity): void
+    {
+        if ($link !== 'users' || !$foreignEntity instanceof User) {
+            return;
+        }
+
+        $this->clearer->clearForUser($foreignEntity);
+        $this->dataManager->updateCacheTimestamp();
+    }
+}

application/Espo/Classes/RecordHooks/Team/UnsetUserDefaultTeam.php

@@ -0,0 +1,60 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Team;
+
+use Espo\Core\Record\Hook\UnlinkHook;
+use Espo\Entities\Team;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+use Espo\ORM\EntityManager;
+
+/**
+ * @implements UnlinkHook<Team>
+ */
+class UnsetUserDefaultTeam implements UnlinkHook
+{
+    public function __construct(private EntityManager $entityManager)
+    {}
+
+    public function process(Entity $entity, string $link, Entity $foreignEntity): void
+    {
+        if (!$foreignEntity instanceof User || $link !== 'users') {
+            return;
+        }
+
+        if ($foreignEntity->getDefaultTeam()?->getId() !== $entity->getId()) {
+            return;
+        }
+
+        $foreignEntity->setDefaultTeam(null);
+
+        $this->entityManager->saveEntity($foreignEntity);
+    }
+}

application/Espo/Classes/RecordHooks/User/AfterUpdate.php

@@ -0,0 +1,114 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\User;
+
+use Espo\Core\Acl\Cache\Clearer;
+use Espo\Core\DataManager;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Modules\Crm\Entities\Contact;
+use Espo\ORM\Entity;
+use Espo\Entities\User;
+use Espo\ORM\EntityManager;
+
+/**
+ * @implements SaveHook<User>
+ * @noinspection PhpUnused
+ */
+class AfterUpdate implements SaveHook
+{
+    public function __construct(
+        private EntityManager $entityManager,
+        private Clearer $clearer,
+        private DataManager $dataManager
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $this->processCache($entity);
+        $this->processContactName($entity);
+    }
+
+    private function processCache(User $entity): void
+    {
+        if (
+            $entity->isAttributeChanged('rolesIds') ||
+            $entity->isAttributeChanged('teamsIds') ||
+            $entity->isAttributeChanged('type') ||
+            $entity->isAttributeChanged('portalRolesIds') ||
+            $entity->isAttributeChanged('portalsIds')
+        ) {
+            $this->clearer->clearForUser($entity);
+            $this->dataManager->updateCacheTimestamp();
+        }
+
+        if (
+            $entity->isAttributeChanged('portalRolesIds') ||
+            $entity->isAttributeChanged('portalsIds') ||
+            $entity->isAttributeChanged('contactId') ||
+            $entity->isAttributeChanged('accountsIds')
+        ) {
+            $this->clearer->clearForAllPortalUsers();
+            $this->dataManager->updateCacheTimestamp();
+        }
+    }
+
+    private function processContactName(User $entity): void
+    {
+        if (
+            !$entity->isPortal() ||
+            !$entity->getContactId() ||
+            !$entity->isAttributeChanged('firstName') &&
+            !$entity->isAttributeChanged('lastName') &&
+            !$entity->isAttributeChanged('salutationName')
+        ) {
+            return;
+        }
+
+        $contact = $this->entityManager->getEntityById(Contact::ENTITY_TYPE, $entity->getContactId());
+
+        if (!$contact) {
+            return;
+        }
+
+        if ($entity->isAttributeChanged('firstName')) {
+            $contact->set('firstName', $entity->get('firstName'));
+        }
+
+        if ($entity->isAttributeChanged('lastName')) {
+            $contact->set('lastName', $entity->get('lastName'));
+        }
+
+        if ($entity->isAttributeChanged('salutationName')) {
+            $contact->set('salutationName', $entity->get('salutationName'));
+        }
+
+        $this->entityManager->saveEntity($contact);
+    }
+}

application/Espo/Classes/RecordHooks/User/BeforeCreate.php

@@ -0,0 +1,135 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\User;
+
+use Espo\Core\Authentication\Logins\Hmac;
+use Espo\Core\Exceptions\Conflict;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Core\Utils\Config;
+use Espo\Core\Utils\Util;
+use Espo\ORM\Entity;
+use Espo\Entities\User;
+use Espo\Tools\User\UserUtil;
+
+/**
+ * @implements SaveHook<User>
+ * @noinspection PhpUnused
+ */
+class BeforeCreate implements SaveHook
+{
+    public function __construct(
+        private Config $config,
+        private User $user,
+        private UserUtil $util
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $this->processLimitChecking($entity);
+        $this->processUserExistsChecking($entity);
+        $this->processApi($entity);
+        $this->processTypeChecking($entity);
+    }
+
+    /**
+     * @throws Conflict
+     */
+    private function processUserExistsChecking(User $entity): void
+    {
+        if ($this->util->checkExists($entity)) {
+            throw new Conflict('userNameExists');
+        }
+    }
+
+    /**
+     * @throws Forbidden
+     */
+    private function processLimitChecking(User $entity): void
+    {
+        $userLimit = $this->config->get('userLimit');
+        $portalUserLimit = $this->config->get('portalUserLimit');
+
+        if (
+            $userLimit &&
+            !$this->user->isSuperAdmin() &&
+            !$entity->isPortal() && !$entity->isApi()
+        ) {
+            $userCount = $this->util->getInternalCount();
+
+            if ($userCount >= $userLimit) {
+                throw new Forbidden("User limit $userLimit is reached.");
+            }
+        }
+
+        if (
+            $portalUserLimit &&
+            !$this->user->isSuperAdmin() &&
+            $entity->isPortal()
+        ) {
+            $portalUserCount = $this->util->getPortalCount();
+
+            if ($portalUserCount >= $portalUserLimit) {
+                throw new Forbidden("Portal user limit $portalUserLimit is reached.");
+            }
+        }
+    }
+
+    private function processApi(User $entity): void
+    {
+        if (!$entity->isApi()) {
+            return;
+        }
+
+        $entity->set('apiKey', Util::generateApiKey());
+
+        if ($entity->getAuthMethod() === Hmac::NAME) {
+            $secretKey = Util::generateSecretKey();
+
+            $entity->set('secretKey', $secretKey);
+        }
+    }
+
+    /**
+     * @throws Forbidden
+     */
+    private function processTypeChecking(User $entity): void
+    {
+        if (
+            $entity->isSuperAdmin() ||
+            !$entity->getType() ||
+            in_array($entity->getType(), $this->util->getAllowedUserTypeList())
+        ) {
+            return;
+        }
+
+        throw new Forbidden("Not allowed 'type'.");
+    }
+}

application/Espo/Classes/RecordHooks/User/BeforeDelete.php

@@ -0,0 +1,53 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\User;
+
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\DeleteParams;
+use Espo\Core\Record\Hook\DeleteHook;
+use Espo\Entities\User;
+use Espo\ORM\Entity;
+
+/**
+ * @implements DeleteHook<User>
+ */
+class BeforeDelete implements DeleteHook
+{
+    public function __construct(
+        private User $user,
+    ) {}
+
+    public function process(Entity $entity, DeleteParams $params): void
+    {
+        if ($entity->getId() === $this->user->getId()) {
+            throw new Forbidden("Can't delete own user.");
+        }
+    }
+}

application/Espo/Classes/RecordHooks/User/BeforeUpdate.php

@@ -0,0 +1,171 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\User;
+
+use Espo\Core\Authentication\Logins\Hmac;
+use Espo\Core\Exceptions\Conflict;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Core\Utils\Config;
+use Espo\Core\Utils\Util;
+use Espo\Entities\User as UserEntity;
+use Espo\ORM\Entity;
+use Espo\Entities\User;
+use Espo\Tools\User\UserUtil;
+
+/**
+ * @implements SaveHook<User>
+ * @noinspection PhpUnused
+ */
+class BeforeUpdate implements SaveHook
+{
+    public function __construct(
+        private Config $config,
+        private User $user,
+        private UserUtil $util
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $this->processLimitChecking($entity);
+        $this->processUserExistsChecking($entity);
+        $this->processApi($entity);
+        $this->processTypeChecking($entity);
+    }
+
+    /**
+     * @throws Conflict
+     */
+    private function processUserExistsChecking(User $entity): void
+    {
+        if (!$entity->isAttributeChanged('userName')) {
+            return;
+        }
+
+        if ($this->util->checkExists($entity)) {
+            throw new Conflict('userNameExists');
+        }
+    }
+
+    /**
+     * @throws Forbidden
+     */
+    private function processLimitChecking(User $entity): void
+    {
+        $userLimit = $this->config->get('userLimit');
+        $portalUserLimit = $this->config->get('portalUserLimit');
+
+        if (
+            $userLimit &&
+            !$this->user->isSuperAdmin() &&
+            (
+                (
+                    $entity->isActive() &&
+                    $entity->isAttributeChanged('isActive') &&
+                    !$entity->isPortal() &&
+                    !$entity->isApi()
+                ) ||
+                (
+                    !$entity->isPortal() &&
+                    !$entity->isApi() &&
+                    $entity->isAttributeChanged('type') &&
+                    (
+                        $entity->isRegular() ||
+                        $entity->isAdmin()
+                    ) &&
+                    (
+                        $entity->getFetched('type') == UserEntity::TYPE_PORTAL ||
+                        $entity->getFetched('type') == UserEntity::TYPE_API
+                    )
+                )
+            )
+        ) {
+            $userCount = $this->util->getInternalCount();
+
+            if ($userCount >= $userLimit) {
+                throw new Forbidden("User limit $userLimit is reached.");
+            }
+        }
+
+        if (
+            $portalUserLimit &&
+            !$this->user->isSuperAdmin() &&
+            (
+                (
+                    $entity->isActive() &&
+                    $entity->isAttributeChanged('isActive') &&
+                    $entity->isPortal()
+                ) ||
+                (
+                    $entity->isPortal() &&
+                    $entity->isAttributeChanged('type')
+                )
+            )
+        ) {
+            $portalUserCount = $this->util->getPortalCount();
+
+            if ($portalUserCount >= $portalUserLimit) {
+                throw new Forbidden("Portal user limit $portalUserLimit is reached.");
+            }
+        }
+    }
+
+    private function processApi(User $entity): void
+    {
+        if (
+            !$entity->isApi() ||
+            !$entity->isAttributeChanged('authMethod') ||
+            $entity->getAuthMethod() !== Hmac::NAME
+        ) {
+            return;
+        }
+
+        $secretKey = Util::generateSecretKey();
+
+        $entity->set('secretKey', $secretKey);
+    }
+
+    /**
+     * @throws Forbidden
+     */
+    private function processTypeChecking(User $entity): void
+    {
+        if (
+            $entity->isSuperAdmin() ||
+            !$entity->isAttributeChanged('type') ||
+            !$entity->getType() ||
+            in_array($entity->getType(), $this->util->getAllowedUserTypeList())
+        ) {
+            return;
+        }
+
+        throw new Forbidden("Can't change type.");
+    }
+}

application/Espo/Classes/RecordHooks/Webhook/AfterDelete.php

@@ -0,0 +1,62 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Webhook;
+
+use Espo\Core\Record\DeleteParams;
+use Espo\Core\Record\Hook\DeleteHook;
+use Espo\Core\Webhook\Manager;
+use Espo\Entities\Webhook;
+use Espo\ORM\Entity;
+
+/**
+ * @implements DeleteHook<Webhook>
+ * @noinspection PhpUnused
+ */
+class AfterDelete implements DeleteHook
+{
+    public function __construct(
+        private Manager $webhookManager
+    ) {}
+
+    public function process(Entity $entity, DeleteParams $params): void
+    {
+        $event = $entity->getEvent();
+
+        if (!$event) {
+            return;
+        }
+
+        if (!$entity->isActive()) {
+            return;
+        }
+
+        $this->webhookManager->removeEvent($event);
+    }
+}

application/Espo/Classes/RecordHooks/Webhook/AfterSave.php

@@ -0,0 +1,75 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Webhook;
+
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Core\Webhook\Manager;
+use Espo\Entities\Webhook;
+use Espo\ORM\Entity;
+use RuntimeException;
+
+/**
+ * @implements SaveHook<Webhook>
+ */
+class AfterSave implements SaveHook
+{
+    public function __construct(
+        private Manager $webhookManager
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        $event = $entity->getEvent();
+
+        if (!$event) {
+            throw new RuntimeException("No 'event'.");
+        }
+
+        if ($entity->isNew()) {
+            if ($entity->isActive()) {
+                $this->webhookManager->addEvent($event);
+            }
+
+            return;
+        }
+
+        if (!$entity->isAttributeChanged('isActive')) {
+            return;
+        }
+
+        if ($entity->isActive()) {
+            $this->webhookManager->addEvent($event);
+
+            return;
+        }
+
+        $this->webhookManager->removeEvent($event);
+    }
+}

application/Espo/Classes/RecordHooks/Webhook/BeforeSave.php

@@ -0,0 +1,190 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM – Open Source CRM application.
+ * Copyright (C) 2014-2025 EspoCRM, Inc.
+ * Website: https://www.espocrm.com
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU Affero General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Classes\RecordHooks\Webhook;
+
+use Espo\Core\Acl;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Record\Hook\SaveHook;
+use Espo\Core\Utils\Config;
+use Espo\Core\Utils\Metadata;
+use Espo\Entities\User;
+use Espo\Entities\Webhook;
+use Espo\ORM\Entity;
+use Espo\ORM\EntityManager;
+
+/**
+ * @implements SaveHook<Webhook>
+ */
+class BeforeSave implements SaveHook
+{
+    private const WEBHOOK_MAX_COUNT_PER_USER = 50;
+
+    /** @var string[] */
+    private $eventTypeList = [
+        'create',
+        'update',
+        'delete',
+        'fieldUpdate',
+    ];
+
+    public function __construct(
+        private User $user,
+        private EntityManager $entityManager,
+        private Acl $acl,
+        private Metadata $metadata,
+        private Config $config
+    ) {}
+
+    public function process(Entity $entity): void
+    {
+        if ($entity->skipOwn() && !$entity->getUserId()) {
+            $entity->setSkipOwn(false);
+        }
+
+        $this->checkEntityUserIsApi($entity);
+        $this->processEntityEventData($entity);
+
+        if ($entity->isNew() && !$this->user->isAdmin()) {
+            $this->checkMaxCount();
+        }
+    }
+
+    /**
+     * @throws Forbidden
+     */
+    private function checkEntityUserIsApi(Webhook $entity): void
+    {
+        $userId = $entity->getUserId();
+
+        if (!$userId) {
+            return;
+        }
+
+        $user = $this->entityManager->getRDBRepositoryByClass(User::class)->getById($userId);
+
+        if ($user && $user->isApi()) {
+            return;
+        }
+
+        throw new Forbidden("User must be an API User.");
+    }
+
+    /**
+     * @throws Forbidden
+     */
+    private function processEntityEventData(Webhook $entity): void
+    {
+        $event = $entity->get('event');
+
+        if (!$event) {
+            throw new Forbidden("Event is empty.");
+        }
+
+        if (!$entity->isNew() && $entity->isAttributeChanged('event')) {
+            throw new Forbidden("Event can't be changed.");
+        }
+
+        $arr = explode('.', $event);
+
+        if (count($arr) !== 2 && count($arr) !== 3) {
+            throw new Forbidden("Not supported event.");
+        }
+
+        $entityType = $arr[0];
+        $type = $arr[1];
+
+        $entity->set('entityType', $entityType);
+        $entity->set('type', $type);
+
+        $field = null;
+
+        if (!$entityType) {
+            throw new Forbidden("Entity Type is empty.");
+        }
+
+        if (!$this->metadata->get(['scopes', $entityType, 'object'])) {
+            throw new Forbidden("Entity type is not available for Webhooks.");
+        }
+
+        if (!$this->entityManager->hasRepository($entityType)) {
+            throw new Forbidden("Not existing Entity Type.");
+        }
+
+        if (!$this->acl->checkScope($entityType, Acl\Table::ACTION_READ)) {
+            throw new Forbidden("Entity type is forbidden.");
+        }
+
+        if (!in_array($type, $this->eventTypeList)) {
+            throw new Forbidden("Not supported event.");
+        }
+
+        if ($type === 'fieldUpdate') {
+            if (count($arr) == 3) {
+                $field = $arr[2];
+            }
+
+            $entity->set('field', $field);
+
+            if (!$field) {
+                throw new Forbidden("Field is empty.");
+            }
+
+            if (!$this->acl->checkField($entityType, $field)) {
+                throw new Forbidden("Field is forbidden.");
+            }
+
+            if (!$this->metadata->get(['entityDefs', $entityType, 'fields', $field])) {
+                throw new Forbidden("Field does not exist.");
+            }
+
+            return;
+        }
+
+        /** @noinspection PhpRedundantOptionalArgumentInspection */
+        $entity->set('field', null);
+    }
+
+    /**
+     * @throws Forbidden
+     */
+    private function checkMaxCount(): void
+    {
+        $maxCount = $this->config->get('webhookMaxCountPerUser', self::WEBHOOK_MAX_COUNT_PER_USER);
+
+        $count = $this->entityManager
+            ->getRDBRepositoryByClass(Webhook::class)
+            ->where(['userId' => $this->user->getId()])
+            ->count();
+
+        if ($maxCount && $count >= $maxCount) {
+            throw new Forbidden("Webhook number per user exceeded the limit.");
+        }
+    }
+}