feat(messaging): Add broadcast messaging system for owners and managers

- Add BroadcastMessage and MessageRecipient models for sending messages to groups or individuals
- Add Messages page with compose form and sent messages list
- Support targeting by role (owners, managers, staff, customers) or individual users
- Add can_send_messages permission (owners always, managers by default with revocable permission)
- Add autofill search dropdown with infinite scroll for selecting individual recipients
- Add staff permission toggle for managers' messaging access
- Integrate Messages link in sidebar for users with permission

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

frontend/src/App.tsx

@@ -41,6 +41,7 @@ const Scheduler = React.lazy(() => import('./pages/Scheduler'));
 const Customers = React.lazy(() => import('./pages/Customers'));
 const Settings = React.lazy(() => import('./pages/Settings'));
 const Payments = React.lazy(() => import('./pages/Payments'));
+const Messages = React.lazy(() => import('./pages/Messages'));
 const Resources = React.lazy(() => import('./pages/Resources'));
 const Services = React.lazy(() => import('./pages/Services'));
 const Staff = React.lazy(() => import('./pages/Staff'));
@@ -861,11 +862,8 @@ const AppContent: React.FC = () => {
             <Route
               path="/messages"
               element={
-                hasAccess(['owner', 'manager']) ? (
-                  <div className="p-8">
-                    <h1 className="text-2xl font-bold mb-4">Messages</h1>
-                    <p className="text-gray-600">Messages feature coming soon...</p>
-                  </div>
+                hasAccess(['owner', 'manager']) && user?.can_send_messages ? (
+                  <Messages />
                 ) : (
                   <Navigate to="/" />
                 )

frontend/src/api/auth.ts

@@ -47,6 +47,7 @@ export interface LoginResponse {
     business?: number;
     business_name?: string;
     business_subdomain?: string;
+    can_send_messages?: boolean;
   };
   masquerade_stack?: MasqueradeStackEntry[];
   // MFA challenge response
@@ -73,6 +74,7 @@ export interface User {
   can_invite_staff?: boolean;
   can_access_tickets?: boolean;
   can_edit_schedule?: boolean;
+  can_send_messages?: boolean;
   linked_resource_id?: number;
   quota_overages?: QuotaOverage[];
 }
@@ -134,3 +136,11 @@ export const stopMasquerade = async (
   );
   return response.data;
 };
+
+/**
+ * Request password reset email
+ */
+export const forgotPassword = async (email: string): Promise<{ message: string }> => {
+  const response = await apiClient.post<{ message: string }>('/auth/password-reset/', { email });
+  return response.data;
+};

frontend/src/components/Sidebar.tsx

@@ -46,6 +46,7 @@ const Sidebar: React.FC<SidebarProps> = ({ business, user, isCollapsed, toggleCo
   const isStaff = role === 'staff';
   const canViewSettings = role === 'owner';
   const canViewTickets = role === 'owner' || role === 'manager' || (role === 'staff' && user.can_access_tickets);
+  const canSendMessages = user.can_send_messages === true;
 
   const handleSignOut = () => {
     logoutMutation.mutate();
@@ -195,9 +196,9 @@ const Sidebar: React.FC<SidebarProps> = ({ business, user, isCollapsed, toggleCo
         )}
 
         {/* Communicate Section - Tickets + Messages */}
-        {(canViewTickets || canViewAdminPages) && (
+        {(canViewTickets || canSendMessages) && (
           <SidebarSection title={t('nav.sections.communicate', 'Communicate')} isCollapsed={isCollapsed}>
-            {canViewAdminPages && (
+            {canSendMessages && (
               <SidebarItem
                 to="/messages"
                 icon={MessageSquare}

frontend/src/components/StaffPermissions.tsx

@@ -68,6 +68,15 @@ export const PERMISSION_CONFIGS: PermissionConfig[] = [
     defaultValue: false,
     roles: ['manager'],
   },
+  {
+    key: 'can_send_messages',
+    labelKey: 'staff.canSendMessages',
+    labelDefault: 'Can send broadcast messages',
+    hintKey: 'staff.canSendMessagesHint',
+    hintDefault: 'Send messages to groups of staff and customers',
+    defaultValue: true,
+    roles: ['manager'],
+  },
   // Staff-only permissions
   {
     key: 'can_view_all_schedules',

frontend/src/i18n/locales/en.json

@@ -491,9 +491,31 @@
     "reactivateAccount": "Reactivate Account",
     "deactivateHint": "Prevent this user from logging in while keeping their data",
     "reactivateHint": "Allow this user to log in again",
+    "canSendMessages": "Can send broadcast messages",
+    "canSendMessagesHint": "Send messages to groups of staff and customers",
     "deactivate": "Deactivate",
+    "canInviteStaff": "Can invite new staff members",
+    "canInviteStaffHint": "Allow this manager to send invitations to new staff members",
+    "canManageResources": "Can manage resources",
+    "canManageResourcesHint": "Create, edit, and delete bookable resources",
+    "canManageServices": "Can manage services",
+    "canManageServicesHint": "Create, edit, and delete service offerings",
+    "canViewReports": "Can view reports",
+    "canViewReportsHint": "Access business analytics and financial reports",
+    "canAccessSettings": "Can access business settings",
+    "canAccessSettingsHint": "Modify business profile, branding, and configuration",
+    "canRefundPayments": "Can refund payments",
+    "canRefundPaymentsHint": "Process refunds for customer payments",
+    "canViewAllSchedules": "Can view all schedules",
+    "canViewAllSchedulesHint": "View schedules of other staff members (otherwise only their own)",
+    "canManageOwnAppointments": "Can manage own appointments",
+    "canManageOwnAppointmentsHint": "Create, reschedule, and cancel their own appointments",
     "canSelfApproveTimeOff": "Can self-approve time off",
-    "canSelfApproveTimeOffHint": "Add time off without requiring manager/owner approval"
+    "canSelfApproveTimeOffHint": "Add time off without requiring manager/owner approval",
+    "canAccessTickets": "Can access support tickets",
+    "canAccessTicketsHint": "View and manage customer support tickets",
+    "managerPermissions": "Manager Permissions",
+    "staffPermissions": "Staff Permissions"
   },
   "staffDashboard": {
     "welcomeTitle": "Welcome, {{name}}!",

frontend/src/pages/Messages.tsx

@@ -0,0 +1,842 @@
+import React, { useState, useMemo, useRef, useCallback } from 'react';
+import { useTranslation } from 'react-i18next';
+import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
+import api from '../api/client';
+import {
+  MessageSquare,
+  Send,
+  Users,
+  Mail,
+  Smartphone,
+  Bell,
+  CheckCircle2,
+  Clock,
+  Eye,
+  AlertCircle,
+  X,
+  Loader2,
+  Search,
+  UserPlus
+} from 'lucide-react';
+import toast from 'react-hot-toast';
+
+// Types
+interface BroadcastMessage {
+  id: string;
+  subject: string;
+  body: string;
+  target_roles: string[];
+  target_users: string[];
+  delivery_method: 'IN_APP' | 'EMAIL' | 'SMS' | 'ALL';
+  status: 'DRAFT' | 'SENDING' | 'SENT' | 'FAILED';
+  total_recipients: number;
+  delivered_count: number;
+  read_count: number;
+  created_at: string;
+  sent_at: string | null;
+  created_by: string;
+  created_by_name: string;
+}
+
+interface RecipientOption {
+  id: string;
+  name: string;
+  email: string;
+  role: string;
+}
+
+interface RecipientOptionsResponse {
+  users: RecipientOption[];
+}
+
+type TabType = 'compose' | 'sent';
+
+const Messages: React.FC = () => {
+  const { t } = useTranslation();
+  const queryClient = useQueryClient();
+
+  // State
+  const [activeTab, setActiveTab] = useState<TabType>('compose');
+  const [subject, setSubject] = useState('');
+  const [body, setBody] = useState('');
+  const [selectedRoles, setSelectedRoles] = useState<string[]>([]);
+  const [selectedUsers, setSelectedUsers] = useState<RecipientOption[]>([]);
+  const [deliveryMethod, setDeliveryMethod] = useState<'IN_APP' | 'EMAIL' | 'SMS' | 'ALL'>('IN_APP');
+  const [searchTerm, setSearchTerm] = useState('');
+  const [statusFilter, setStatusFilter] = useState<'ALL' | 'SENT' | 'SENDING' | 'FAILED'>('ALL');
+  const [selectedMessage, setSelectedMessage] = useState<BroadcastMessage | null>(null);
+  const [recipientSearchTerm, setRecipientSearchTerm] = useState('');
+  const [isRecipientDropdownOpen, setIsRecipientDropdownOpen] = useState(false);
+  const [visibleRecipientCount, setVisibleRecipientCount] = useState(20);
+  const dropdownRef = useRef<HTMLDivElement>(null);
+
+  // Queries
+  const { data: messages = [], isLoading: messagesLoading } = useQuery<BroadcastMessage[]>({
+    queryKey: ['broadcast-messages'],
+    queryFn: async () => {
+      const response = await api.get('/messages/broadcast-messages/');
+      return response.data;
+    },
+  });
+
+  const { data: recipientOptions, isLoading: recipientsLoading } = useQuery<RecipientOptionsResponse>({
+    queryKey: ['message-recipient-options'],
+    queryFn: async () => {
+      const response = await api.get('/messages/broadcast-messages/recipient_options/');
+      return response.data;
+    },
+  });
+
+  // Mutations
+  const createMessage = useMutation({
+    mutationFn: async (data: {
+      subject: string;
+      body: string;
+      target_roles: string[];
+      target_users: string[];
+      delivery_method: string;
+    }) => {
+      const response = await api.post('/messages/broadcast-messages/', data);
+      return response.data;
+    },
+    onSuccess: (data) => {
+      queryClient.invalidateQueries({ queryKey: ['broadcast-messages'] });
+      // Auto-send the message
+      sendMessage.mutate(data.id);
+    },
+    onError: (error: any) => {
+      toast.error(error.response?.data?.error || 'Failed to create message');
+    },
+  });
+
+  const sendMessage = useMutation({
+    mutationFn: async (messageId: string) => {
+      const response = await api.post(`/messages/broadcast-messages/${messageId}/send/`);
+      return response.data;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['broadcast-messages'] });
+      toast.success('Message sent successfully!');
+      resetForm();
+      setActiveTab('sent');
+    },
+    onError: (error: any) => {
+      toast.error(error.response?.data?.error || 'Failed to send message');
+    },
+  });
+
+  // Handlers
+  const handleRoleToggle = (role: string) => {
+    setSelectedRoles((prev) =>
+      prev.includes(role) ? prev.filter((r) => r !== role) : [...prev, role]
+    );
+  };
+
+  const handleAddUser = (user: RecipientOption) => {
+    if (!selectedUsers.find(u => u.id === user.id)) {
+      setSelectedUsers((prev) => [...prev, user]);
+    }
+    // Clear search and close dropdown for tag-style input
+    setRecipientSearchTerm('');
+    setIsRecipientDropdownOpen(false);
+  };
+
+  const handleRemoveUser = (userId: string) => {
+    setSelectedUsers((prev) => prev.filter((u) => u.id !== userId));
+  };
+
+  const handleDropdownScroll = useCallback((e: React.UIEvent<HTMLDivElement>) => {
+    const target = e.target as HTMLDivElement;
+    const scrollBottom = target.scrollHeight - target.scrollTop - target.clientHeight;
+
+    // Load more when within 50px of bottom
+    if (scrollBottom < 50) {
+      setVisibleRecipientCount((prev) => prev + 20);
+    }
+  }, []);
+
+  const handleSubmit = (e: React.FormEvent) => {
+    e.preventDefault();
+
+    // Validation
+    if (!subject.trim()) {
+      toast.error('Subject is required');
+      return;
+    }
+    if (!body.trim()) {
+      toast.error('Message body is required');
+      return;
+    }
+    if (selectedRoles.length === 0 && selectedUsers.length === 0) {
+      toast.error('Please select at least one recipient');
+      return;
+    }
+
+    createMessage.mutate({
+      subject,
+      body,
+      target_roles: selectedRoles,
+      target_users: selectedUsers.map(u => u.id),
+      delivery_method: deliveryMethod,
+    });
+  };
+
+  const resetForm = () => {
+    setSubject('');
+    setBody('');
+    setSelectedRoles([]);
+    setSelectedUsers([]);
+    setDeliveryMethod('IN_APP');
+    setRecipientSearchTerm('');
+    setIsRecipientDropdownOpen(false);
+    setVisibleRecipientCount(20);
+  };
+
+  // Computed
+  const roleOptions = [
+    { value: 'owner', label: 'All Owners', icon: Users },
+    { value: 'manager', label: 'All Managers', icon: Users },
+    { value: 'staff', label: 'All Staff', icon: Users },
+    { value: 'customer', label: 'All Customers', icon: Users },
+  ];
+
+  const deliveryMethodOptions = [
+    { value: 'IN_APP' as const, label: 'In-App Only', icon: Bell },
+    { value: 'EMAIL' as const, label: 'Email Only', icon: Mail },
+    { value: 'SMS' as const, label: 'SMS Only', icon: Smartphone },
+    { value: 'ALL' as const, label: 'All Channels', icon: MessageSquare },
+  ];
+
+  const filteredMessages = useMemo(() => {
+    let filtered = messages;
+
+    // Status filter
+    if (statusFilter !== 'ALL') {
+      filtered = filtered.filter((msg) => msg.status === statusFilter);
+    }
+
+    // Search filter
+    if (searchTerm) {
+      const term = searchTerm.toLowerCase();
+      filtered = filtered.filter(
+        (msg) =>
+          msg.subject.toLowerCase().includes(term) ||
+          msg.body.toLowerCase().includes(term) ||
+          msg.created_by_name.toLowerCase().includes(term)
+      );
+    }
+
+    return filtered;
+  }, [messages, statusFilter, searchTerm]);
+
+  const filteredRecipients = useMemo(() => {
+    if (!recipientOptions) return [];
+
+    // Filter out already selected users
+    const selectedIds = selectedUsers.map(u => u.id);
+    let filtered = recipientOptions.users.filter(u => !selectedIds.includes(u.id));
+
+    // Apply search filter
+    if (recipientSearchTerm) {
+      const term = recipientSearchTerm.toLowerCase();
+      filtered = filtered.filter(
+        (user) =>
+          user.name.toLowerCase().includes(term) ||
+          user.email.toLowerCase().includes(term)
+      );
+    }
+
+    return filtered;
+  }, [recipientOptions, recipientSearchTerm, selectedUsers]);
+
+  const recipientCount = useMemo(() => {
+    let count = 0;
+
+    // Count users from selected roles
+    if (recipientOptions) {
+      selectedRoles.forEach((role) => {
+        count += recipientOptions.users.filter((u) => u.role === role).length;
+      });
+    }
+
+    // Add individually selected users (avoid double counting)
+    const roleUserIds = recipientOptions?.users
+      .filter((u) => selectedRoles.includes(u.role))
+      .map((u) => u.id) || [];
+
+    count += selectedUsers.filter((u) => !roleUserIds.includes(u.id)).length;
+
+    return count;
+  }, [selectedRoles, selectedUsers, recipientOptions]);
+
+  const getDeliveryMethodIcon = (method: string) => {
+    switch (method) {
+      case 'IN_APP': return <Bell size={16} />;
+      case 'EMAIL': return <Mail size={16} />;
+      case 'SMS': return <Smartphone size={16} />;
+      case 'ALL': return <MessageSquare size={16} />;
+      default: return <Bell size={16} />;
+    }
+  };
+
+  const getStatusBadge = (status: string) => {
+    switch (status) {
+      case 'SENT':
+        return (
+          <span className="inline-flex items-center gap-1 px-2.5 py-0.5 rounded-full text-xs font-medium bg-green-100 text-green-800 dark:bg-green-900/30 dark:text-green-400">
+            <CheckCircle2 size={12} />
+            Sent
+          </span>
+        );
+      case 'SENDING':
+        return (
+          <span className="inline-flex items-center gap-1 px-2.5 py-0.5 rounded-full text-xs font-medium bg-blue-100 text-blue-800 dark:bg-blue-900/30 dark:text-blue-400">
+            <Loader2 size={12} className="animate-spin" />
+            Sending
+          </span>
+        );
+      case 'FAILED':
+        return (
+          <span className="inline-flex items-center gap-1 px-2.5 py-0.5 rounded-full text-xs font-medium bg-red-100 text-red-800 dark:bg-red-900/30 dark:text-red-400">
+            <AlertCircle size={12} />
+            Failed
+          </span>
+        );
+      default:
+        return (
+          <span className="inline-flex items-center gap-1 px-2.5 py-0.5 rounded-full text-xs font-medium bg-gray-100 text-gray-800 dark:bg-gray-700 dark:text-gray-300">
+            <Clock size={12} />
+            Draft
+          </span>
+        );
+    }
+  };
+
+  const formatDate = (dateStr: string | null) => {
+    if (!dateStr) return 'Not sent';
+    return new Intl.DateTimeFormat('en-US', {
+      month: 'short',
+      day: 'numeric',
+      year: 'numeric',
+      hour: 'numeric',
+      minute: '2-digit',
+    }).format(new Date(dateStr));
+  };
+
+  const getTargetDescription = (message: BroadcastMessage) => {
+    const parts: string[] = [];
+
+    if (message.target_roles.length > 0) {
+      const roleLabels = message.target_roles.map((role) => {
+        const option = roleOptions.find((opt) => opt.value === role);
+        return option?.label || role;
+      });
+      parts.push(...roleLabels);
+    }
+
+    if (message.target_users.length > 0) {
+      parts.push(`${message.target_users.length} individual user(s)`);
+    }
+
+    return parts.join(', ');
+  };
+
+  return (
+    <div className="space-y-6">
+      {/* Header */}
+      <div className="flex flex-col sm:flex-row sm:items-center justify-between gap-4">
+        <div>
+          <h2 className="text-2xl font-bold text-gray-900 dark:text-white">Broadcast Messages</h2>
+          <p className="text-gray-500 dark:text-gray-400">
+            Send messages to staff and customers
+          </p>
+        </div>
+      </div>
+
+      {/* Tabs */}
+      <div className="border-b border-gray-200 dark:border-gray-700">
+        <nav className="-mb-px flex space-x-8">
+          <button
+            onClick={() => setActiveTab('compose')}
+            className={`whitespace-nowrap py-4 px-1 border-b-2 font-medium text-sm transition-colors ${
+              activeTab === 'compose'
+                ? 'border-brand-500 text-brand-600 dark:text-brand-400'
+                : 'border-transparent text-gray-500 hover:text-gray-700 hover:border-gray-300 dark:text-gray-400 dark:hover:text-gray-300'
+            }`}
+          >
+            <div className="flex items-center gap-2">
+              <MessageSquare size={18} />
+              Compose
+            </div>
+          </button>
+          <button
+            onClick={() => setActiveTab('sent')}
+            className={`whitespace-nowrap py-4 px-1 border-b-2 font-medium text-sm transition-colors ${
+              activeTab === 'sent'
+                ? 'border-brand-500 text-brand-600 dark:text-brand-400'
+                : 'border-transparent text-gray-500 hover:text-gray-700 hover:border-gray-300 dark:text-gray-400 dark:hover:text-gray-300'
+            }`}
+          >
+            <div className="flex items-center gap-2">
+              <Send size={18} />
+              Sent Messages
+              {messages.length > 0 && (
+                <span className="ml-2 px-2 py-0.5 rounded-full text-xs font-medium bg-gray-100 text-gray-600 dark:bg-gray-700 dark:text-gray-300">
+                  {messages.length}
+                </span>
+              )}
+            </div>
+          </button>
+        </nav>
+      </div>
+
+      {/* Compose Tab */}
+      {activeTab === 'compose' && (
+        <div className="bg-white dark:bg-gray-800 rounded-lg shadow-sm border border-gray-200 dark:border-gray-700">
+          <form onSubmit={handleSubmit} className="p-6 space-y-6">
+            {/* Subject */}
+            <div>
+              <label htmlFor="subject" className="block text-sm font-medium text-gray-700 dark:text-gray-300 mb-2">
+                Subject *
+              </label>
+              <input
+                type="text"
+                id="subject"
+                value={subject}
+                onChange={(e) => setSubject(e.target.value)}
+                className="w-full px-4 py-2 border border-gray-300 dark:border-gray-600 rounded-lg focus:ring-2 focus:ring-brand-500 focus:border-transparent dark:bg-gray-700 dark:text-white"
+                placeholder="Enter message subject..."
+                required
+              />
+            </div>
+
+            {/* Body */}
+            <div>
+              <label htmlFor="body" className="block text-sm font-medium text-gray-700 dark:text-gray-300 mb-2">
+                Message *
+              </label>
+              <textarea
+                id="body"
+                value={body}
+                onChange={(e) => setBody(e.target.value)}
+                rows={8}
+                className="w-full px-4 py-2 border border-gray-300 dark:border-gray-600 rounded-lg focus:ring-2 focus:ring-brand-500 focus:border-transparent dark:bg-gray-700 dark:text-white resize-none"
+                placeholder="Enter your message..."
+                required
+              />
+            </div>
+
+            {/* Target Roles */}
+            <div>
+              <label className="block text-sm font-medium text-gray-700 dark:text-gray-300 mb-3">
+                Target Groups
+              </label>
+              <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-4 gap-3">
+                {roleOptions.map((role) => (
+                  <label
+                    key={role.value}
+                    className={`flex items-center gap-3 p-4 rounded-lg border-2 cursor-pointer transition-all ${
+                      selectedRoles.includes(role.value)
+                        ? 'border-brand-500 bg-brand-50 dark:bg-brand-900/20'
+                        : 'border-gray-200 dark:border-gray-600 hover:border-gray-300 dark:hover:border-gray-500'
+                    }`}
+                  >
+                    <input
+                      type="checkbox"
+                      checked={selectedRoles.includes(role.value)}
+                      onChange={() => handleRoleToggle(role.value)}
+                      className="w-5 h-5 text-brand-600 border-gray-300 rounded focus:ring-brand-500"
+                    />
+                    <role.icon size={20} className="text-gray-400" />
+                    <span className="text-sm font-medium text-gray-900 dark:text-white">
+                      {role.label}
+                    </span>
+                  </label>
+                ))}
+              </div>
+            </div>
+
+            {/* Individual Recipients */}
+            <div>
+              <label className="block text-sm font-medium text-gray-700 dark:text-gray-300 mb-3">
+                Individual Recipients (Optional)
+              </label>
+
+              {/* Autofill Search */}
+              <div className="relative">
+                <div className="relative">
+                  <Search className="absolute left-3 top-1/2 -translate-y-1/2 text-gray-400" size={18} />
+                  <input
+                    type="text"
+                    value={recipientSearchTerm}
+                    onChange={(e) => {
+                      setRecipientSearchTerm(e.target.value);
+                      setVisibleRecipientCount(20);
+                      setIsRecipientDropdownOpen(e.target.value.length > 0);
+                    }}
+                    onFocus={() => {
+                      if (recipientSearchTerm.length > 0) {
+                        setIsRecipientDropdownOpen(true);
+                      }
+                    }}
+                    placeholder="Type to search recipients..."
+                    className="w-full pl-10 pr-4 py-2.5 border border-gray-300 dark:border-gray-600 rounded-lg focus:ring-2 focus:ring-brand-500 focus:border-transparent dark:bg-gray-700 dark:text-white"
+                  />
+                  {recipientsLoading && recipientSearchTerm && (
+                    <Loader2 className="absolute right-3 top-1/2 -translate-y-1/2 text-gray-400 animate-spin" size={18} />
+                  )}
+                </div>
+
+                {/* Dropdown Results */}
+                {isRecipientDropdownOpen && recipientSearchTerm && !recipientsLoading && (
+                  <>
+                    {/* Click outside to close */}
+                    <div
+                      className="fixed inset-0 z-10"
+                      onClick={() => setIsRecipientDropdownOpen(false)}
+                    />
+                    <div
+                      ref={dropdownRef}
+                      onScroll={handleDropdownScroll}
+                      className="absolute z-20 w-full mt-1 bg-white dark:bg-gray-800 border border-gray-200 dark:border-gray-600 rounded-lg shadow-lg max-h-72 overflow-y-auto"
+                    >
+                      {filteredRecipients.length === 0 ? (
+                        <p className="text-center py-4 text-gray-500 dark:text-gray-400 text-sm">
+                          No matching users found
+                        </p>
+                      ) : (
+                        <>
+                          {filteredRecipients.slice(0, visibleRecipientCount).map((user) => (
+                            <button
+                              key={user.id}
+                              type="button"
+                              onClick={() => handleAddUser(user)}
+                              className="w-full flex items-center gap-3 p-3 hover:bg-gray-50 dark:hover:bg-gray-700/50 transition-colors border-b border-gray-100 dark:border-gray-700 last:border-b-0 text-left"
+                            >
+                              <UserPlus size={18} className="text-gray-400 flex-shrink-0" />
+                              <div className="flex-1 min-w-0">
+                                <p className="text-sm font-medium text-gray-900 dark:text-white truncate">
+                                  {user.name}
+                                </p>
+                                <p className="text-xs text-gray-500 dark:text-gray-400 truncate">
+                                  {user.email}
+                                </p>
+                              </div>
+                              <span className="px-2 py-1 rounded-full text-xs font-medium bg-gray-100 text-gray-600 dark:bg-gray-700 dark:text-gray-300 capitalize flex-shrink-0">
+                                {user.role}
+                              </span>
+                            </button>
+                          ))}
+                          {filteredRecipients.length > visibleRecipientCount && (
+                            <div className="text-center py-3 text-xs text-gray-500 dark:text-gray-400">
+                              <Loader2 size={16} className="inline-block animate-spin mr-2" />
+                              Scroll for more...
+                            </div>
+                          )}
+                        </>
+                      )}
+                    </div>
+                  </>
+                )}
+              </div>
+
+              {/* Selected Users List */}
+              {selectedUsers.length > 0 && (
+                <div className="mt-3 flex flex-wrap gap-2">
+                  {selectedUsers.map((user) => (
+                    <div
+                      key={user.id}
+                      className="inline-flex items-center gap-2 px-3 py-1.5 bg-brand-50 dark:bg-brand-900/30 text-brand-700 dark:text-brand-300 rounded-full text-sm"
+                    >
+                      <span className="font-medium">{user.name}</span>
+                      <span className="text-brand-500 dark:text-brand-400 text-xs">({user.role})</span>
+                      <button
+                        type="button"
+                        onClick={() => handleRemoveUser(user.id)}
+                        className="ml-1 p-0.5 hover:bg-brand-200 dark:hover:bg-brand-800 rounded-full transition-colors"
+                      >
+                        <X size={14} />
+                      </button>
+                    </div>
+                  ))}
+                </div>
+              )}
+            </div>
+
+            {/* Delivery Method */}
+            <div>
+              <label className="block text-sm font-medium text-gray-700 dark:text-gray-300 mb-3">
+                Delivery Method
+              </label>
+              <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-4 gap-3">
+                {deliveryMethodOptions.map((option) => (
+                  <label
+                    key={option.value}
+                    className={`flex items-center gap-3 p-4 rounded-lg border-2 cursor-pointer transition-all ${
+                      deliveryMethod === option.value
+                        ? 'border-brand-500 bg-brand-50 dark:bg-brand-900/20'
+                        : 'border-gray-200 dark:border-gray-600 hover:border-gray-300 dark:hover:border-gray-500'
+                    }`}
+                  >
+                    <input
+                      type="radio"
+                      name="delivery_method"
+                      value={option.value}
+                      checked={deliveryMethod === option.value}
+                      onChange={(e) => setDeliveryMethod(e.target.value as any)}
+                      className="w-5 h-5 text-brand-600 border-gray-300 focus:ring-brand-500"
+                    />
+                    <option.icon size={20} className="text-gray-400" />
+                    <span className="text-sm font-medium text-gray-900 dark:text-white">
+                      {option.label}
+                    </span>
+                  </label>
+                ))}
+              </div>
+            </div>
+
+            {/* Recipient Count */}
+            {recipientCount > 0 && (
+              <div className="bg-blue-50 dark:bg-blue-900/20 border border-blue-200 dark:border-blue-800 rounded-lg p-4">
+                <div className="flex items-center gap-2 text-blue-800 dark:text-blue-300">
+                  <Users size={18} />
+                  <span className="font-medium">
+                    This message will be sent to approximately {recipientCount} recipient{recipientCount !== 1 ? 's' : ''}
+                  </span>
+                </div>
+              </div>
+            )}
+
+            {/* Actions */}
+            <div className="flex items-center justify-between pt-4 border-t border-gray-200 dark:border-gray-700">
+              <button
+                type="button"
+                onClick={resetForm}
+                disabled={createMessage.isPending || sendMessage.isPending}
+                className="px-4 py-2 text-gray-700 dark:text-gray-300 hover:bg-gray-100 dark:hover:bg-gray-700 rounded-lg transition-colors disabled:opacity-50"
+              >
+                Clear
+              </button>
+              <button
+                type="submit"
+                disabled={createMessage.isPending || sendMessage.isPending}
+                className="inline-flex items-center gap-2 px-6 py-2 bg-brand-600 text-white rounded-lg hover:bg-brand-700 transition-colors disabled:opacity-50"
+              >
+                {createMessage.isPending || sendMessage.isPending ? (
+                  <>
+                    <Loader2 size={18} className="animate-spin" />
+                    Sending...
+                  </>
+                ) : (
+                  <>
+                    <Send size={18} />
+                    Send Message
+                  </>
+                )}
+              </button>
+            </div>
+          </form>
+        </div>
+      )}
+
+      {/* Sent Messages Tab */}
+      {activeTab === 'sent' && (
+        <div className="space-y-4">
+          {/* Filters */}
+          <div className="flex flex-col sm:flex-row gap-3">
+            <div className="flex-1 relative">
+              <Search className="absolute left-3 top-1/2 -translate-y-1/2 text-gray-400" size={18} />
+              <input
+                type="text"
+                value={searchTerm}
+                onChange={(e) => setSearchTerm(e.target.value)}
+                placeholder="Search messages..."
+                className="w-full pl-10 pr-4 py-2 border border-gray-300 dark:border-gray-600 rounded-lg focus:ring-2 focus:ring-brand-500 focus:border-transparent dark:bg-gray-800 dark:text-white"
+              />
+            </div>
+            <select
+              value={statusFilter}
+              onChange={(e) => setStatusFilter(e.target.value as any)}
+              className="px-4 py-2 border border-gray-300 dark:border-gray-600 rounded-lg focus:ring-2 focus:ring-brand-500 focus:border-transparent dark:bg-gray-800 dark:text-white"
+            >
+              <option value="ALL">All Statuses</option>
+              <option value="SENT">Sent</option>
+              <option value="SENDING">Sending</option>
+              <option value="FAILED">Failed</option>
+            </select>
+          </div>
+
+          {/* Messages List */}
+          {messagesLoading ? (
+            <div className="text-center py-12">
+              <Loader2 className="mx-auto h-12 w-12 animate-spin text-brand-500" />
+            </div>
+          ) : filteredMessages.length === 0 ? (
+            <div className="text-center py-12 bg-white dark:bg-gray-800 rounded-lg shadow-sm border border-gray-200 dark:border-gray-700">
+              <MessageSquare className="mx-auto h-12 w-12 text-gray-400" />
+              <p className="mt-4 text-gray-500 dark:text-gray-400">
+                {searchTerm || statusFilter !== 'ALL' ? 'No messages found' : 'No messages sent yet'}
+              </p>
+            </div>
+          ) : (
+            <div className="space-y-3">
+              {filteredMessages.map((message) => (
+                <div
+                  key={message.id}
+                  className="bg-white dark:bg-gray-800 rounded-lg shadow-sm border border-gray-200 dark:border-gray-700 p-6 hover:shadow-md transition-shadow cursor-pointer"
+                  onClick={() => setSelectedMessage(message)}
+                >
+                  <div className="flex items-start justify-between gap-4">
+                    <div className="flex-1 min-w-0">
+                      <div className="flex items-center gap-3 mb-2">
+                        <h3 className="text-lg font-semibold text-gray-900 dark:text-white truncate">
+                          {message.subject}
+                        </h3>
+                        {getStatusBadge(message.status)}
+                      </div>
+                      <p className="text-sm text-gray-600 dark:text-gray-400 line-clamp-2 mb-3">
+                        {message.body}
+                      </p>
+                      <div className="flex flex-wrap items-center gap-4 text-sm text-gray-500 dark:text-gray-400">
+                        <div className="flex items-center gap-1.5">
+                          <Users size={14} />
+                          <span>{getTargetDescription(message)}</span>
+                        </div>
+                        <div className="flex items-center gap-1.5">
+                          {getDeliveryMethodIcon(message.delivery_method)}
+                          <span className="capitalize">{message.delivery_method.toLowerCase().replace('_', ' ')}</span>
+                        </div>
+                        <div className="flex items-center gap-1.5">
+                          <Clock size={14} />
+                          <span>{formatDate(message.sent_at || message.created_at)}</span>
+                        </div>
+                      </div>
+                    </div>
+                    <div className="flex flex-col items-end gap-2 text-right">
+                      <div className="text-sm text-gray-500 dark:text-gray-400">
+                        By {message.created_by_name}
+                      </div>
+                      {message.status === 'SENT' && (
+                        <div className="flex items-center gap-4 text-xs text-gray-500 dark:text-gray-400">
+                          <div className="flex items-center gap-1">
+                            <Send size={12} />
+                            <span>{message.delivered_count}/{message.total_recipients}</span>
+                          </div>
+                          <div className="flex items-center gap-1">
+                            <Eye size={12} />
+                            <span>{message.read_count}</span>
+                          </div>
+                        </div>
+                      )}
+                    </div>
+                  </div>
+                </div>
+              ))}
+            </div>
+          )}
+        </div>
+      )}
+
+      {/* Message Detail Modal */}
+      {selectedMessage && (
+        <div className="fixed inset-0 bg-black/50 backdrop-blur-sm flex items-center justify-center p-4 z-50">
+          <div className="bg-white dark:bg-gray-800 rounded-lg shadow-xl max-w-2xl w-full max-h-[90vh] overflow-y-auto">
+            <div className="sticky top-0 bg-white dark:bg-gray-800 border-b border-gray-200 dark:border-gray-700 p-6 flex items-start justify-between">
+              <div className="flex-1">
+                <h3 className="text-xl font-bold text-gray-900 dark:text-white mb-2">
+                  {selectedMessage.subject}
+                </h3>
+                <div className="flex items-center gap-3">
+                  {getStatusBadge(selectedMessage.status)}
+                  <span className="text-sm text-gray-500 dark:text-gray-400">
+                    {formatDate(selectedMessage.sent_at || selectedMessage.created_at)}
+                  </span>
+                </div>
+              </div>
+              <button
+                onClick={() => setSelectedMessage(null)}
+                className="p-2 text-gray-400 hover:text-gray-600 dark:hover:text-gray-300 transition-colors"
+              >
+                <X size={20} />
+              </button>
+            </div>
+
+            <div className="p-6 space-y-6">
+              {/* Message Body */}
+              <div>
+                <h4 className="text-sm font-semibold text-gray-700 dark:text-gray-300 mb-2">
+                  Message
+                </h4>
+                <p className="text-gray-900 dark:text-gray-100 whitespace-pre-wrap">
+                  {selectedMessage.body}
+                </p>
+              </div>
+
+              {/* Recipients */}
+              <div>
+                <h4 className="text-sm font-semibold text-gray-700 dark:text-gray-300 mb-2">
+                  Recipients
+                </h4>
+                <p className="text-gray-900 dark:text-gray-100">
+                  {getTargetDescription(selectedMessage)}
+                </p>
+              </div>
+
+              {/* Delivery Method */}
+              <div>
+                <h4 className="text-sm font-semibold text-gray-700 dark:text-gray-300 mb-2">
+                  Delivery Method
+                </h4>
+                <div className="flex items-center gap-2 text-gray-900 dark:text-gray-100">
+                  {getDeliveryMethodIcon(selectedMessage.delivery_method)}
+                  <span className="capitalize">
+                    {selectedMessage.delivery_method.toLowerCase().replace('_', ' ')}
+                  </span>
+                </div>
+              </div>
+
+              {/* Statistics */}
+              {selectedMessage.status === 'SENT' && (
+                <div className="grid grid-cols-3 gap-4">
+                  <div className="bg-gray-50 dark:bg-gray-700/50 rounded-lg p-4">
+                    <div className="text-2xl font-bold text-gray-900 dark:text-white">
+                      {selectedMessage.total_recipients}
+                    </div>
+                    <div className="text-sm text-gray-500 dark:text-gray-400">
+                      Total Recipients
+                    </div>
+                  </div>
+                  <div className="bg-green-50 dark:bg-green-900/20 rounded-lg p-4">
+                    <div className="text-2xl font-bold text-green-700 dark:text-green-400">
+                      {selectedMessage.delivered_count}
+                    </div>
+                    <div className="text-sm text-green-600 dark:text-green-500">
+                      Delivered
+                    </div>
+                  </div>
+                  <div className="bg-blue-50 dark:bg-blue-900/20 rounded-lg p-4">
+                    <div className="text-2xl font-bold text-blue-700 dark:text-blue-400">
+                      {selectedMessage.read_count}
+                    </div>
+                    <div className="text-sm text-blue-600 dark:text-blue-500">
+                      Read
+                    </div>
+                  </div>
+                </div>
+              )}
+
+              {/* Sender */}
+              <div className="pt-4 border-t border-gray-200 dark:border-gray-700">
+                <p className="text-sm text-gray-500 dark:text-gray-400">
+                  Sent by <span className="font-medium text-gray-900 dark:text-white">{selectedMessage.created_by_name}</span>
+                </p>
+              </div>
+            </div>
+          </div>
+        </div>
+      )}
+    </div>
+  );
+};
+
+export default Messages;

frontend/src/types.ts

@@ -39,6 +39,7 @@ export interface PlanPermissions {
   white_label: boolean;
   custom_oauth: boolean;
   plugins: boolean;
+  can_create_plugins: boolean;
   tasks: boolean;
   export_data: boolean;
   video_conferencing: boolean;
@@ -124,8 +125,10 @@ export interface User {
   notification_preferences?: NotificationPreferences;
   can_invite_staff?: boolean;
   can_access_tickets?: boolean;
+  can_send_messages?: boolean;
   can_edit_schedule?: boolean;
   linked_resource_id?: number;
+  linked_resource_name?: string;
   permissions?: Record<string, boolean>;
   quota_overages?: QuotaOverage[];
 }

smoothschedule/config/settings/multitenancy.py

@@ -66,6 +66,9 @@ TENANT_APPS = [
     'smoothschedule.scheduling.schedule',  # Resource scheduling with configurable concurrency
     'smoothschedule.scheduling.contracts',  # Contract/e-signature system
 
+    # Communication Domain (tenant-isolated)
+    'smoothschedule.communication.messaging',  # Broadcast messaging system
+
     # Commerce Domain (tenant-isolated)
     'smoothschedule.commerce.payments',  # Stripe Connect payments bridge
 ]

smoothschedule/config/urls.py

@@ -95,6 +95,8 @@ urlpatterns += [
     path("tickets/", include("smoothschedule.commerce.tickets.urls")),
     # Notifications API
     path("notifications/", include("smoothschedule.communication.notifications.urls")),
+    # Messaging API (broadcast messages)
+    path("messages/", include("smoothschedule.communication.messaging.urls")),
     # Platform API
     path("platform/", include("smoothschedule.platform.admin.urls", namespace="platform")),
     # OAuth Email Integration API

smoothschedule/smoothschedule/communication/messaging/apps.py

@@ -1,7 +1,7 @@
 from django.apps import AppConfig
 
 
-class CommunicationConfig(AppConfig):
+class MessagingConfig(AppConfig):
     default_auto_field = 'django.db.models.BigAutoField'
     name = 'smoothschedule.communication.messaging'
-    label = 'communication'
+    label = 'messaging'

smoothschedule/smoothschedule/communication/messaging/migrations/0002_add_broadcast_messaging.py

@@ -0,0 +1,98 @@
+# Generated by Django 5.2.8 on 2025-12-08 07:05
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('messaging', '0001_initial'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='BroadcastMessage',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('subject', models.CharField(help_text='Message subject (for email) or title (for in-app)', max_length=255)),
+                ('body', models.TextField(help_text='Message body content')),
+                ('target_owners', models.BooleanField(default=False, help_text='Send to all owners')),
+                ('target_managers', models.BooleanField(default=False, help_text='Send to all managers')),
+                ('target_staff', models.BooleanField(default=False, help_text='Send to all staff')),
+                ('target_customers', models.BooleanField(default=False, help_text='Send to all customers')),
+                ('delivery_method', models.CharField(choices=[('in_app', 'In-App Notification'), ('email', 'Email'), ('sms', 'SMS'), ('all', 'All Channels')], default='in_app', help_text='How to deliver the message', max_length=20)),
+                ('status', models.CharField(choices=[('draft', 'Draft'), ('scheduled', 'Scheduled'), ('sending', 'Sending'), ('sent', 'Sent'), ('failed', 'Failed')], db_index=True, default='draft', max_length=20)),
+                ('scheduled_at', models.DateTimeField(blank=True, help_text='When to send the message (null = send immediately)', null=True)),
+                ('total_recipients', models.PositiveIntegerField(default=0, help_text='Total number of recipients')),
+                ('delivered_count', models.PositiveIntegerField(default=0, help_text='Number of successful deliveries')),
+                ('failed_count', models.PositiveIntegerField(default=0, help_text='Number of failed deliveries')),
+                ('read_count', models.PositiveIntegerField(default=0, help_text='Number of recipients who read the message')),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('updated_at', models.DateTimeField(auto_now=True)),
+                ('sent_at', models.DateTimeField(blank=True, help_text='When the message was actually sent', null=True)),
+            ],
+            options={
+                'ordering': ['-created_at'],
+            },
+        ),
+        migrations.CreateModel(
+            name='MessageRecipient',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('delivery_status', models.CharField(choices=[('pending', 'Pending'), ('delivered', 'Delivered'), ('failed', 'Failed'), ('bounced', 'Bounced')], default='pending', max_length=20)),
+                ('delivered_at', models.DateTimeField(blank=True, null=True)),
+                ('is_read', models.BooleanField(default=False)),
+                ('read_at', models.DateTimeField(blank=True, null=True)),
+                ('error_message', models.TextField(blank=True)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+            ],
+        ),
+        migrations.RenameIndex(
+            model_name='communicationsession',
+            new_name='messaging_c_is_acti_26c502_idx',
+            old_name='communicati_is_acti_ebcdc9_idx',
+        ),
+        migrations.AddField(
+            model_name='broadcastmessage',
+            name='individual_recipients',
+            field=models.ManyToManyField(blank=True, help_text='Specific users to receive the message', related_name='received_broadcast_messages', to=settings.AUTH_USER_MODEL),
+        ),
+        migrations.AddField(
+            model_name='broadcastmessage',
+            name='sender',
+            field=models.ForeignKey(help_text='User who sent the message', null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='sent_broadcast_messages', to=settings.AUTH_USER_MODEL),
+        ),
+        migrations.AddField(
+            model_name='messagerecipient',
+            name='message',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='recipients', to='messaging.broadcastmessage'),
+        ),
+        migrations.AddField(
+            model_name='messagerecipient',
+            name='user',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='message_deliveries', to=settings.AUTH_USER_MODEL),
+        ),
+        migrations.AddIndex(
+            model_name='broadcastmessage',
+            index=models.Index(fields=['status', 'scheduled_at'], name='messaging_b_status_16f15e_idx'),
+        ),
+        migrations.AddIndex(
+            model_name='broadcastmessage',
+            index=models.Index(fields=['sender', 'created_at'], name='messaging_b_sender__65f622_idx'),
+        ),
+        migrations.AddIndex(
+            model_name='messagerecipient',
+            index=models.Index(fields=['message', 'delivery_status'], name='messaging_m_message_59ed8d_idx'),
+        ),
+        migrations.AddIndex(
+            model_name='messagerecipient',
+            index=models.Index(fields=['user', 'is_read'], name='messaging_m_user_id_c6b099_idx'),
+        ),
+        migrations.AlterUniqueTogether(
+            name='messagerecipient',
+            unique_together={('message', 'user')},
+        ),
+    ]

smoothschedule/smoothschedule/communication/messaging/models.py

@@ -1,4 +1,5 @@
 from django.db import models
+from django.conf import settings
 from django.core.validators import RegexValidator
 
 
@@ -83,7 +84,7 @@ class CommunicationSession(models.Model):
     )
     
     class Meta:
-        app_label = 'communication'
+        app_label = 'messaging'
         ordering = ['-created_at']
         indexes = [
             models.Index(fields=['is_active', 'created_at']),
@@ -101,3 +102,206 @@ class CommunicationSession(models.Model):
         """
         # TODO: Implement via Twilio API
         return None
+
+
+class BroadcastMessage(models.Model):
+    """
+    Broadcast message sent by owners/managers to groups of users.
+
+    Allows targeting specific role groups (owners, managers, staff, customers)
+    or individual users within those groups.
+    """
+
+    class TargetType(models.TextChoices):
+        ALL_OWNERS = 'all_owners', 'All Owners'
+        ALL_MANAGERS = 'all_managers', 'All Managers'
+        ALL_STAFF = 'all_staff', 'All Staff'
+        ALL_CUSTOMERS = 'all_customers', 'All Customers'
+        SELECTED_USERS = 'selected_users', 'Selected Users'
+
+    class DeliveryMethod(models.TextChoices):
+        IN_APP = 'in_app', 'In-App Notification'
+        EMAIL = 'email', 'Email'
+        SMS = 'sms', 'SMS'
+        ALL = 'all', 'All Channels'
+
+    class Status(models.TextChoices):
+        DRAFT = 'draft', 'Draft'
+        SCHEDULED = 'scheduled', 'Scheduled'
+        SENDING = 'sending', 'Sending'
+        SENT = 'sent', 'Sent'
+        FAILED = 'failed', 'Failed'
+
+    # Sender
+    sender = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.SET_NULL,
+        null=True,
+        related_name='sent_broadcast_messages',
+        help_text="User who sent the message"
+    )
+
+    # Message content
+    subject = models.CharField(
+        max_length=255,
+        help_text="Message subject (for email) or title (for in-app)"
+    )
+    body = models.TextField(
+        help_text="Message body content"
+    )
+
+    # Targeting - can select multiple target types
+    target_owners = models.BooleanField(
+        default=False,
+        help_text="Send to all owners"
+    )
+    target_managers = models.BooleanField(
+        default=False,
+        help_text="Send to all managers"
+    )
+    target_staff = models.BooleanField(
+        default=False,
+        help_text="Send to all staff"
+    )
+    target_customers = models.BooleanField(
+        default=False,
+        help_text="Send to all customers"
+    )
+
+    # Individual recipients (for selected_users mode)
+    individual_recipients = models.ManyToManyField(
+        settings.AUTH_USER_MODEL,
+        blank=True,
+        related_name='received_broadcast_messages',
+        help_text="Specific users to receive the message"
+    )
+
+    # Delivery settings
+    delivery_method = models.CharField(
+        max_length=20,
+        choices=DeliveryMethod.choices,
+        default=DeliveryMethod.IN_APP,
+        help_text="How to deliver the message"
+    )
+
+    # Status tracking
+    status = models.CharField(
+        max_length=20,
+        choices=Status.choices,
+        default=Status.DRAFT,
+        db_index=True
+    )
+
+    # Scheduling
+    scheduled_at = models.DateTimeField(
+        null=True,
+        blank=True,
+        help_text="When to send the message (null = send immediately)"
+    )
+
+    # Statistics
+    total_recipients = models.PositiveIntegerField(
+        default=0,
+        help_text="Total number of recipients"
+    )
+    delivered_count = models.PositiveIntegerField(
+        default=0,
+        help_text="Number of successful deliveries"
+    )
+    failed_count = models.PositiveIntegerField(
+        default=0,
+        help_text="Number of failed deliveries"
+    )
+    read_count = models.PositiveIntegerField(
+        default=0,
+        help_text="Number of recipients who read the message"
+    )
+
+    # Timestamps
+    created_at = models.DateTimeField(auto_now_add=True)
+    updated_at = models.DateTimeField(auto_now=True)
+    sent_at = models.DateTimeField(
+        null=True,
+        blank=True,
+        help_text="When the message was actually sent"
+    )
+
+    class Meta:
+        app_label = 'messaging'
+        ordering = ['-created_at']
+        indexes = [
+            models.Index(fields=['status', 'scheduled_at']),
+            models.Index(fields=['sender', 'created_at']),
+        ]
+
+    def __str__(self):
+        return f"{self.subject} ({self.get_status_display()})"
+
+    def get_target_description(self):
+        """Get human-readable description of targets."""
+        targets = []
+        if self.target_owners:
+            targets.append('Owners')
+        if self.target_managers:
+            targets.append('Managers')
+        if self.target_staff:
+            targets.append('Staff')
+        if self.target_customers:
+            targets.append('Customers')
+        if self.individual_recipients.exists():
+            count = self.individual_recipients.count()
+            targets.append(f'{count} Individual(s)')
+        return ', '.join(targets) if targets else 'No recipients'
+
+
+class MessageRecipient(models.Model):
+    """
+    Tracks individual message delivery status for each recipient.
+    """
+
+    class DeliveryStatus(models.TextChoices):
+        PENDING = 'pending', 'Pending'
+        DELIVERED = 'delivered', 'Delivered'
+        FAILED = 'failed', 'Failed'
+        BOUNCED = 'bounced', 'Bounced'
+
+    message = models.ForeignKey(
+        BroadcastMessage,
+        on_delete=models.CASCADE,
+        related_name='recipients'
+    )
+
+    user = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name='message_deliveries'
+    )
+
+    # Delivery tracking
+    delivery_status = models.CharField(
+        max_length=20,
+        choices=DeliveryStatus.choices,
+        default=DeliveryStatus.PENDING
+    )
+    delivered_at = models.DateTimeField(null=True, blank=True)
+
+    # Read tracking
+    is_read = models.BooleanField(default=False)
+    read_at = models.DateTimeField(null=True, blank=True)
+
+    # Error tracking
+    error_message = models.TextField(blank=True)
+
+    # Timestamps
+    created_at = models.DateTimeField(auto_now_add=True)
+
+    class Meta:
+        app_label = 'messaging'
+        unique_together = ['message', 'user']
+        indexes = [
+            models.Index(fields=['message', 'delivery_status']),
+            models.Index(fields=['user', 'is_read']),
+        ]
+
+    def __str__(self):
+        return f"{self.message.subject} -> {self.user.email}"

smoothschedule/smoothschedule/communication/messaging/serializers.py

@@ -0,0 +1,187 @@
+from rest_framework import serializers
+from django.utils import timezone
+from .models import BroadcastMessage, MessageRecipient
+
+
+class MessageRecipientSerializer(serializers.ModelSerializer):
+    """Serializer for message delivery tracking."""
+    user_email = serializers.CharField(source='user.email', read_only=True)
+    user_name = serializers.SerializerMethodField()
+
+    class Meta:
+        model = MessageRecipient
+        fields = [
+            'id', 'user', 'user_email', 'user_name',
+            'delivery_status', 'delivered_at',
+            'is_read', 'read_at', 'error_message'
+        ]
+        read_only_fields = fields
+
+    def get_user_name(self, obj):
+        return obj.user.get_full_name() or obj.user.username
+
+
+class BroadcastMessageListSerializer(serializers.ModelSerializer):
+    """Serializer for listing broadcast messages."""
+    sender_name = serializers.SerializerMethodField()
+    target_description = serializers.SerializerMethodField()
+
+    class Meta:
+        model = BroadcastMessage
+        fields = [
+            'id', 'subject', 'status', 'delivery_method',
+            'sender_name', 'target_description',
+            'total_recipients', 'delivered_count', 'read_count',
+            'created_at', 'sent_at', 'scheduled_at'
+        ]
+        read_only_fields = fields
+
+    def get_sender_name(self, obj):
+        if obj.sender:
+            return obj.sender.get_full_name() or obj.sender.username
+        return 'Unknown'
+
+    def get_target_description(self, obj):
+        return obj.get_target_description()
+
+
+class BroadcastMessageDetailSerializer(serializers.ModelSerializer):
+    """Serializer for broadcast message detail view."""
+    sender_name = serializers.SerializerMethodField()
+    target_description = serializers.SerializerMethodField()
+    recipients = MessageRecipientSerializer(many=True, read_only=True)
+    individual_recipient_ids = serializers.ListField(
+        child=serializers.IntegerField(),
+        write_only=True,
+        required=False
+    )
+
+    class Meta:
+        model = BroadcastMessage
+        fields = [
+            'id', 'subject', 'body', 'status', 'delivery_method',
+            'target_owners', 'target_managers', 'target_staff', 'target_customers',
+            'individual_recipient_ids',
+            'sender_name', 'target_description',
+            'total_recipients', 'delivered_count', 'failed_count', 'read_count',
+            'created_at', 'updated_at', 'sent_at', 'scheduled_at',
+            'recipients'
+        ]
+        read_only_fields = [
+            'id', 'sender_name', 'target_description',
+            'total_recipients', 'delivered_count', 'failed_count', 'read_count',
+            'created_at', 'updated_at', 'sent_at', 'recipients'
+        ]
+
+    def get_sender_name(self, obj):
+        if obj.sender:
+            return obj.sender.get_full_name() or obj.sender.username
+        return 'Unknown'
+
+    def get_target_description(self, obj):
+        return obj.get_target_description()
+
+    def validate(self, data):
+        """Ensure at least one target is selected."""
+        target_owners = data.get('target_owners', False)
+        target_managers = data.get('target_managers', False)
+        target_staff = data.get('target_staff', False)
+        target_customers = data.get('target_customers', False)
+        individual_recipients = data.get('individual_recipient_ids', [])
+
+        if not any([target_owners, target_managers, target_staff, target_customers]) and not individual_recipients:
+            raise serializers.ValidationError(
+                "At least one target group or individual recipient must be selected."
+            )
+        return data
+
+
+class BroadcastMessageCreateSerializer(serializers.ModelSerializer):
+    """Serializer for creating broadcast messages."""
+    individual_recipient_ids = serializers.ListField(
+        child=serializers.IntegerField(),
+        write_only=True,
+        required=False,
+        default=[]
+    )
+    send_immediately = serializers.BooleanField(write_only=True, default=True)
+
+    class Meta:
+        model = BroadcastMessage
+        fields = [
+            'subject', 'body', 'delivery_method',
+            'target_owners', 'target_managers', 'target_staff', 'target_customers',
+            'individual_recipient_ids', 'scheduled_at', 'send_immediately'
+        ]
+
+    def validate(self, data):
+        """Ensure at least one target is selected."""
+        target_owners = data.get('target_owners', False)
+        target_managers = data.get('target_managers', False)
+        target_staff = data.get('target_staff', False)
+        target_customers = data.get('target_customers', False)
+        individual_recipients = data.get('individual_recipient_ids', [])
+
+        if not any([target_owners, target_managers, target_staff, target_customers]) and not individual_recipients:
+            raise serializers.ValidationError(
+                "At least one target group or individual recipient must be selected."
+            )
+        return data
+
+    def create(self, validated_data):
+        individual_recipient_ids = validated_data.pop('individual_recipient_ids', [])
+        send_immediately = validated_data.pop('send_immediately', True)
+
+        # Set status based on scheduling
+        if validated_data.get('scheduled_at') and not send_immediately:
+            validated_data['status'] = BroadcastMessage.Status.SCHEDULED
+        else:
+            validated_data['status'] = BroadcastMessage.Status.DRAFT
+
+        message = BroadcastMessage.objects.create(**validated_data)
+
+        # Add individual recipients
+        if individual_recipient_ids:
+            from smoothschedule.identity.users.models import User
+            users = User.objects.filter(id__in=individual_recipient_ids)
+            message.individual_recipients.set(users)
+
+        return message
+
+
+class InboxMessageSerializer(serializers.ModelSerializer):
+    """Serializer for user's inbox (received messages)."""
+    sender_name = serializers.SerializerMethodField()
+    is_read = serializers.SerializerMethodField()
+    read_at = serializers.SerializerMethodField()
+
+    class Meta:
+        model = BroadcastMessage
+        fields = [
+            'id', 'subject', 'body', 'sender_name',
+            'is_read', 'read_at', 'sent_at', 'created_at'
+        ]
+        read_only_fields = fields
+
+    def get_sender_name(self, obj):
+        if obj.sender:
+            return obj.sender.get_full_name() or obj.sender.username
+        return 'System'
+
+    def get_is_read(self, obj):
+        """Get read status for the current user."""
+        request = self.context.get('request')
+        if request and request.user:
+            recipient = obj.recipients.filter(user=request.user).first()
+            if recipient:
+                return recipient.is_read
+        return False
+
+    def get_read_at(self, obj):
+        """Get read timestamp for the current user."""
+        request = self.context.get('request')
+        if request and request.user:
+            recipient = obj.recipients.filter(user=request.user).first()
+            if recipient:
+                return recipient.read_at
+        return None

smoothschedule/smoothschedule/communication/messaging/urls.py

@@ -0,0 +1,11 @@
+from django.urls import path, include
+from rest_framework.routers import DefaultRouter
+from .views import BroadcastMessageViewSet, InboxViewSet
+
+router = DefaultRouter()
+router.register(r'broadcast-messages', BroadcastMessageViewSet, basename='broadcast-message')
+router.register(r'inbox', InboxViewSet, basename='inbox')
+
+urlpatterns = [
+    path('', include(router.urls)),
+]

smoothschedule/smoothschedule/communication/messaging/views.py

@@ -1,3 +1,343 @@
-from django.shortcuts import render
+import logging
+from django.utils import timezone
+from django.db.models import Q
+from rest_framework import viewsets, status
+from rest_framework.decorators import action
+from rest_framework.response import Response
+from rest_framework.permissions import IsAuthenticated, BasePermission
+from channels.layers import get_channel_layer
+from asgiref.sync import async_to_sync
 
-# Create your views here.
+from smoothschedule.identity.users.models import User
+from .models import BroadcastMessage, MessageRecipient
+from .serializers import (
+    BroadcastMessageListSerializer,
+    BroadcastMessageDetailSerializer,
+    BroadcastMessageCreateSerializer,
+    InboxMessageSerializer,
+    MessageRecipientSerializer
+)
+
+logger = logging.getLogger(__name__)
+
+
+class CanSendMessagesPermission(BasePermission):
+    """
+    Permission check for sending broadcast messages.
+    Only owners and managers (with permission) can send.
+    """
+    message = "You do not have permission to send messages."
+
+    def has_permission(self, request, view):
+        if not request.user.is_authenticated:
+            return False
+        # Read operations allowed for anyone authenticated
+        if request.method in ['GET', 'HEAD', 'OPTIONS']:
+            return True
+        # Write operations require can_send_messages
+        return request.user.can_send_messages()
+
+
+def send_websocket_notification(user_id, message_data):
+    """Send a WebSocket notification to a user's notification group."""
+    try:
+        channel_layer = get_channel_layer()
+        if channel_layer is None:
+            logger.warning("Channel layer not configured, skipping WebSocket notification")
+            return
+
+        group_name = f'user_{user_id}'
+        async_to_sync(channel_layer.group_send)(
+            group_name,
+            {
+                "type": "notification_message",
+                "message": message_data
+            }
+        )
+    except Exception as e:
+        logger.error(f"Failed to send WebSocket notification to user {user_id}: {e}")
+
+
+def create_notification_for_user(recipient, message):
+    """Create a notification record for a broadcast message."""
+    try:
+        from smoothschedule.communication.notifications.models import Notification
+        from django.contrib.contenttypes.models import ContentType
+
+        # Create notification
+        notification = Notification.objects.create(
+            recipient=recipient,
+            actor=message.sender,
+            verb=f'sent you a message: "{message.subject}"',
+            action_object=message,
+            data={
+                'message_id': message.id,
+                'subject': message.subject,
+                'type': 'broadcast_message'
+            }
+        )
+        return notification
+    except Exception as e:
+        logger.error(f"Failed to create notification for user {recipient.id}: {e}")
+        return None
+
+
+class BroadcastMessageViewSet(viewsets.ModelViewSet):
+    """
+    API endpoint for managing broadcast messages.
+
+    Owners and managers can create and send messages to groups of users.
+    """
+    permission_classes = [IsAuthenticated, CanSendMessagesPermission]
+
+    def get_queryset(self):
+        """Return messages sent by the current user or their tenant."""
+        user = self.request.user
+        # For now, return messages where user is the sender
+        return BroadcastMessage.objects.filter(sender=user).select_related('sender')
+
+    def get_serializer_class(self):
+        if self.action == 'list':
+            return BroadcastMessageListSerializer
+        elif self.action == 'create':
+            return BroadcastMessageCreateSerializer
+        return BroadcastMessageDetailSerializer
+
+    def perform_create(self, serializer):
+        """Set the sender to the current user."""
+        serializer.save(sender=self.request.user)
+
+    @action(detail=True, methods=['post'])
+    def send(self, request, pk=None):
+        """
+        Send the message to all targeted recipients.
+        Creates notifications and sends WebSocket updates.
+        """
+        message = self.get_object()
+
+        if message.status == BroadcastMessage.Status.SENT:
+            return Response(
+                {'error': 'Message has already been sent'},
+                status=status.HTTP_400_BAD_REQUEST
+            )
+
+        # Get all targeted recipients
+        recipients = self._get_target_recipients(message)
+
+        if not recipients:
+            return Response(
+                {'error': 'No recipients found for the selected targets'},
+                status=status.HTTP_400_BAD_REQUEST
+            )
+
+        # Update message status
+        message.status = BroadcastMessage.Status.SENDING
+        message.save(update_fields=['status'])
+
+        # Create recipient records and send notifications
+        created_count = 0
+        for user in recipients:
+            # Create recipient record
+            recipient, created = MessageRecipient.objects.get_or_create(
+                message=message,
+                user=user,
+                defaults={'delivery_status': MessageRecipient.DeliveryStatus.PENDING}
+            )
+
+            if created:
+                created_count += 1
+
+                # Create in-app notification
+                notification = create_notification_for_user(user, message)
+
+                # Send WebSocket notification for immediate display
+                send_websocket_notification(user.id, {
+                    'type': 'broadcast_message',
+                    'message_id': message.id,
+                    'subject': message.subject,
+                    'sender': message.sender.get_full_name() if message.sender else 'System',
+                    'preview': message.body[:100] + '...' if len(message.body) > 100 else message.body,
+                    'timestamp': timezone.now().isoformat()
+                })
+
+                # Mark as delivered for in-app notifications
+                if message.delivery_method in [BroadcastMessage.DeliveryMethod.IN_APP, BroadcastMessage.DeliveryMethod.ALL]:
+                    recipient.delivery_status = MessageRecipient.DeliveryStatus.DELIVERED
+                    recipient.delivered_at = timezone.now()
+                    recipient.save(update_fields=['delivery_status', 'delivered_at'])
+
+        # Update message statistics
+        message.total_recipients = created_count
+        message.delivered_count = MessageRecipient.objects.filter(
+            message=message,
+            delivery_status=MessageRecipient.DeliveryStatus.DELIVERED
+        ).count()
+        message.status = BroadcastMessage.Status.SENT
+        message.sent_at = timezone.now()
+        message.save(update_fields=['total_recipients', 'delivered_count', 'status', 'sent_at'])
+
+        return Response({
+            'status': 'sent',
+            'total_recipients': message.total_recipients,
+            'delivered_count': message.delivered_count
+        })
+
+    def _get_target_recipients(self, message):
+        """Get all users that match the message targets."""
+        user = self.request.user
+        tenant = user.tenant
+
+        if not tenant:
+            return []
+
+        # Build query for targeted role groups
+        role_filters = Q()
+
+        if message.target_owners:
+            role_filters |= Q(role=User.Role.TENANT_OWNER)
+        if message.target_managers:
+            role_filters |= Q(role=User.Role.TENANT_MANAGER)
+        if message.target_staff:
+            role_filters |= Q(role=User.Role.TENANT_STAFF)
+        if message.target_customers:
+            role_filters |= Q(role=User.Role.CUSTOMER)
+
+        # Get users from role groups (same tenant)
+        recipients = set()
+        if role_filters:
+            tenant_users = User.objects.filter(
+                tenant=tenant,
+                is_active=True
+            ).filter(role_filters).exclude(id=user.id)  # Don't send to self
+            recipients.update(tenant_users)
+
+        # Add individual recipients
+        for individual in message.individual_recipients.all():
+            if individual.id != user.id:  # Don't send to self
+                recipients.add(individual)
+
+        return list(recipients)
+
+    @action(detail=True, methods=['get'])
+    def recipients(self, request, pk=None):
+        """Get delivery status for all recipients of a message."""
+        message = self.get_object()
+        recipients = message.recipients.all().select_related('user')
+        serializer = MessageRecipientSerializer(recipients, many=True)
+        return Response(serializer.data)
+
+    @action(detail=False, methods=['get'])
+    def recipient_options(self, request):
+        """
+        Get available recipient options for the message composer.
+        Returns counts for each group and list of individual users.
+        """
+        user = request.user
+        tenant = user.tenant
+
+        if not tenant:
+            return Response({'error': 'No tenant found'}, status=status.HTTP_400_BAD_REQUEST)
+
+        # Get counts for each role group
+        base_query = User.objects.filter(tenant=tenant, is_active=True).exclude(id=user.id)
+
+        owner_count = base_query.filter(role=User.Role.TENANT_OWNER).count()
+        manager_count = base_query.filter(role=User.Role.TENANT_MANAGER).count()
+        staff_count = base_query.filter(role=User.Role.TENANT_STAFF).count()
+        customer_count = base_query.filter(role=User.Role.CUSTOMER).count()
+
+        # Get list of individual users for selection
+        users_queryset = base_query.order_by('first_name', 'last_name')
+        users = [
+            {
+                'id': str(u.id),
+                'name': u.full_name or u.email,
+                'email': u.email,
+                'role': u.get_role_display().replace('Tenant ', '').lower(),
+            }
+            for u in users_queryset
+        ]
+
+        return Response({
+            'groups': {
+                'owners': {'count': owner_count, 'label': 'All Owners'},
+                'managers': {'count': manager_count, 'label': 'All Managers'},
+                'staff': {'count': staff_count, 'label': 'All Staff'},
+                'customers': {'count': customer_count, 'label': 'All Customers'},
+            },
+            'users': users
+        })
+
+
+class InboxViewSet(viewsets.ReadOnlyModelViewSet):
+    """
+    API endpoint for user's message inbox.
+    Shows broadcast messages received by the current user.
+    """
+    serializer_class = InboxMessageSerializer
+    permission_classes = [IsAuthenticated]
+
+    def get_queryset(self):
+        """Return messages where the current user is a recipient."""
+        user = self.request.user
+        # Get message IDs where user is a recipient
+        recipient_message_ids = MessageRecipient.objects.filter(
+            user=user
+        ).values_list('message_id', flat=True)
+
+        return BroadcastMessage.objects.filter(
+            id__in=recipient_message_ids,
+            status=BroadcastMessage.Status.SENT
+        ).select_related('sender').order_by('-sent_at')
+
+    @action(detail=True, methods=['post'])
+    def mark_read(self, request, pk=None):
+        """Mark a message as read for the current user."""
+        message = self.get_object()
+        recipient = MessageRecipient.objects.filter(
+            message=message,
+            user=request.user
+        ).first()
+
+        if not recipient:
+            return Response(
+                {'error': 'Message not found in inbox'},
+                status=status.HTTP_404_NOT_FOUND
+            )
+
+        if not recipient.is_read:
+            recipient.is_read = True
+            recipient.read_at = timezone.now()
+            recipient.save(update_fields=['is_read', 'read_at'])
+
+            # Update message read count
+            message.read_count = MessageRecipient.objects.filter(
+                message=message,
+                is_read=True
+            ).count()
+            message.save(update_fields=['read_count'])
+
+        return Response({'status': 'marked as read'})
+
+    @action(detail=False, methods=['post'])
+    def mark_all_read(self, request):
+        """Mark all inbox messages as read."""
+        user = request.user
+        now = timezone.now()
+
+        updated = MessageRecipient.objects.filter(
+            user=user,
+            is_read=False
+        ).update(is_read=True, read_at=now)
+
+        return Response({'status': f'marked {updated} messages as read'})
+
+    @action(detail=False, methods=['get'])
+    def unread_count(self, request):
+        """Get count of unread messages."""
+        count = MessageRecipient.objects.filter(
+            user=request.user,
+            is_read=False,
+            message__status=BroadcastMessage.Status.SENT
+        ).count()
+        return Response({'count': count})

smoothschedule/smoothschedule/identity/users/api_views.py

@@ -185,6 +185,7 @@ def current_user_view(request):
         'permissions': user.permissions,
         'can_invite_staff': user.can_invite_staff(),
         'can_access_tickets': user.can_access_tickets(),
+        'can_send_messages': user.can_send_messages(),
         'can_edit_schedule': can_edit_schedule,
         'linked_resource_id': linked_resource_id,
         'quota_overages': quota_overages,
@@ -317,6 +318,7 @@ def _get_user_data(user):
 
     # Get linked resource info for tenant users (staff, managers, owners can all be linked to resources)
     linked_resource_id = None
+    linked_resource_name = None
     can_edit_schedule = False
     if user.tenant and user.role in [User.Role.TENANT_STAFF, User.Role.TENANT_MANAGER, User.Role.TENANT_OWNER]:
         try:
@@ -324,6 +326,7 @@ def _get_user_data(user):
                 linked_resource = Resource.objects.filter(user=user).first()
                 if linked_resource:
                     linked_resource_id = linked_resource.id
+                    linked_resource_name = linked_resource.name
                     can_edit_schedule = linked_resource.user_can_edit_schedule
         except Exception as e:
             import logging
@@ -347,8 +350,10 @@ def _get_user_data(user):
         'permissions': user.permissions,
         'can_invite_staff': user.can_invite_staff(),
         'can_access_tickets': user.can_access_tickets(),
+        'can_send_messages': user.can_send_messages(),
         'can_edit_schedule': can_edit_schedule,
         'linked_resource_id': linked_resource_id,
+        'linked_resource_name': linked_resource_name,
     }
 
 
@@ -790,20 +795,24 @@ def accept_invitation_view(request, token):
         # Get the resource name (use invitation setting or user's full name)
         resource_name = invitation.resource_name or user.full_name
 
-        # Find or create the default STAFF resource type
-        staff_resource_type = ResourceType.objects.filter(
-            category=ResourceType.Category.STAFF,
-            is_default=True
-        ).first()
+        # IMPORTANT: Must use schema_context to create resource in the correct tenant schema
+        # Without this, the resource is created in the public schema and won't be found
+        # when querying for linked resources later
+        with schema_context(invitation.tenant.schema_name):
+            # Find or create the default STAFF resource type
+            staff_resource_type = ResourceType.objects.filter(
+                category=ResourceType.Category.STAFF,
+                is_default=True
+            ).first()
 
-        # Create the resource
-        resource_created = Resource.objects.create(
-            name=resource_name,
-            type=Resource.Type.STAFF,  # Legacy field
-            resource_type=staff_resource_type,  # New field
-            user=user,
-            max_concurrent_events=1,  # Default to exclusive booking
-        )
+            # Create the resource
+            resource_created = Resource.objects.create(
+                name=resource_name,
+                type=Resource.Type.STAFF,  # Legacy field
+                resource_type=staff_resource_type,  # New field
+                user=user,
+                max_concurrent_events=1,  # Default to exclusive booking
+            )
 
     # Create auth token for immediate login
     auth_token, _ = Token.objects.get_or_create(user=user)

smoothschedule/smoothschedule/identity/users/models.py

@@ -286,6 +286,22 @@ class User(AbstractUser):
         """
         return self.role in [self.Role.TENANT_OWNER, self.Role.TENANT_MANAGER]
 
+    def can_send_messages(self):
+        """
+        Check if user can send broadcast messages to staff/customers.
+        Owners can always send messages.
+        Managers can by default but can be revoked.
+        Staff cannot send messages.
+        """
+        # Owners can always send messages
+        if self.role == self.Role.TENANT_OWNER:
+            return True
+        # Managers can send by default, but can be revoked
+        if self.role == self.Role.TENANT_MANAGER:
+            return self.permissions.get('can_send_messages', True)
+        # Staff and others cannot send messages
+        return False
+
     def get_accessible_tenants(self):
         """
         Get list of tenants this user can access.