> ## Documentation Index
> Fetch the complete documentation index at: https://docs.encoreos.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Platform Email Signature Service - Integration

> Feature ID: PF-86 Status: ✅ Complete Spec Reference: PF-86-platform-email-signature-service.md Last Updated: 2026-03-20

**Feature ID:** PF-86\
**Status:** ✅ Complete\
**Spec Reference:** [PF-86-platform-email-signature-service.md](../../../specs/pf/specs/PF-86-platform-email-signature-service.md)\
**Last Updated:** 2026-03-20

***

## Overview

PF-86 adds organization-wide and per-user HTML/text email signatures with optional compliance disclaimers. Consumers integrate through the Platform Integration Layer at `@/platform/email-signatures` and shared Deno helpers under `supabase/functions/_shared/email-signature.ts` (or equivalent). PF-10 notification sends and CE email campaigns are **MVP consumers**; other cores call the same APIs when they send mail.

***

## Integration Points (from Spec)

| Dependency            | Type            | Purpose                                                                            |
| --------------------- | --------------- | ---------------------------------------------------------------------------------- |
| PF-01 (Orgs)          | Platform / Data | Organization name, address, contact fields for variable substitution               |
| PF-06 (Profiles)      | Platform / Data | User name, title, phone, email for variable substitution                           |
| PF-10 (Notifications) | Platform        | Injects rendered signature into transactional notification emails                  |
| CE (Campaigns)        | Consumer core   | Injects organization (and applicable user) signature into campaign sends           |
| PF-30 (RBAC)          | Platform        | `pf.email_signatures.*` permission keys for settings UI                            |
| `pf_module_settings`  | Platform        | Feature toggles: require org default, allow user customization, require disclaimer |

***

## Platform Layer Contract (target)

* **Module path:** `@/platform/email-signatures` (to be created in implementation).
* **Hooks (from spec):** `useOrganizationEmailSignature`, `useUserEmailSignature`, `useEmailSignatureMutation`, `useRenderEmailSignature`.
* **Server shared utility:** `supabase/functions/_shared/email-signature.ts` — substitution, sanitization, HTML/text rendering; imported by PF-10/CE send paths and optionally wrapped by a thin `render-email-signature` edge function for HTTP-only callers.
* **Events / REST:** No new event or public REST contract for MVP (direct calls / shared utilities only).

***

## Security and Tenant Isolation

* All persisted rows in `pf_email_signatures` are tenant-scoped via `organization_id`; RLS + `pf_has_email_signature_access` per spec.
* HTML stored and rendered MUST be sanitized (save + render) to reduce XSS risk in email clients; no PHI in platform-provided templates—disclaimer text is organization-configured.
* Optional HTTP edge wrapper MUST use `getCorsHeaders(req.headers.get('origin'))`, structured logging via `createLogger` from `_shared/logger.ts`, and appropriate JWT verification per function config (see `.cursor/rules/edge-functions.md`).

***

## Event Contracts

None for MVP. Revisit if a future phase publishes “signature updated” events for cache invalidation across workers.

***

## Related Docs

* [PF-86 Spec](../../../specs/pf/specs/PF-86-platform-email-signature-service.md)
* [PLATFORM\_INTEGRATION\_LAYERS.md](./PLATFORM_INTEGRATION_LAYERS.md) — register `@/platform/email-signatures` when the module lands
* [CROSS\_CORE\_INTEGRATIONS.md](./CROSS_CORE_INTEGRATIONS.md)