SUM-SEC-14 [P1][14/20][Med] Scope mail activity queries and company settings to active company

[CHINMAYVIVEK]

ID: SUM-SEC-14
Wave: P1
Severity: Medium
Labels: security, mail, company, P1, medium
Branch: fix/SUM-SEC-14-mail-activity-company-scope
Languages: Go
CWE: CWE-862

Summary

QueryActivityLog lists notifications without CheckModelAccess / company filter. Chatter/mail settings read first core.company row (ORDER BY id ASC LIMIT 1) instead of the user’s active company — cross-company config bleed and activity leakage.

Acceptance criteria

• Activity listing: model Access Control List (ACL) + domain limited to readable records / active company
• Settings load via ActiveCompanyIDForUser / context company
• Tests for cross-company denial

Files to check / change

• sumeru/addons/mail/mail.go (~L36–55, ~L150–177)
• sumeru/core/engine/render/branding.go (activity panel consumer)