feat: expose CC and BCC recipients in message API (#242)

## Summary
- The `message_recipients` table already stores `cc` and `bcc` recipient
types from Gmail sync (215K CC rows, 4.5K BCC rows in production), but
the API only returned `to` recipients
- Adds `cc` and `bcc` fields to `MessageSummary` (omitted from JSON when
empty)
- Populates them via the existing `batchGetRecipients` / `getRecipients`
helpers for both list and detail endpoints
- Refactors `ListMessages` to use `batchPopulate` (like `SearchMessages`
already does) to avoid duplicating batch-loading logic

## Test plan
- [x] All existing tests pass (`go test ./internal/store/...
./internal/api/...`)
- [ ] Verify CC/BCC appears in `/api/v1/messages` list response for
messages with CC recipients
- [ ] Verify CC/BCC appears in `/api/v1/messages/{id}` detail response
- [ ] Verify messages without CC/BCC omit the fields (omitempty)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Dan Shapiro <dan@example.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Wes McKinney <wesmckinn+git@gmail.com>

Author: 4 people

internal/api/handlers.go

@@ -72,6 +72,8 @@ type MessageSummary struct {
 	Subject        string   `json:"subject"`
 	From           string   `json:"from"`
 	To             []string `json:"to"`
+	Cc             []string `json:"cc,omitempty"`
+	Bcc            []string `json:"bcc,omitempty"`
 	SentAt         string   `json:"sent_at"`
 	DeletedAt      string   `json:"deleted_at,omitempty"`
 	Snippet        string   `json:"snippet"`
@@ -131,6 +133,8 @@ func toMessageSummary(m APIMessage) MessageSummary {
 		Subject:        m.Subject,
 		From:           m.From,
 		To:             to,
+		Cc:             m.Cc,
+		Bcc:            m.Bcc,
 		SentAt:         m.SentAt.UTC().Format(time.RFC3339),
 		DeletedAt:      formatDeletedAt(m.DeletedAt),
 		Snippet:        m.Snippet,

internal/api/handlers_test.go

@@ -7,6 +7,7 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -375,6 +376,106 @@ func TestMessageSummaryNilSlices(t *testing.T) {
 	}
 }
 
+func TestMessageSummaryCcBccInResponse(t *testing.T) {
+	srv, ms := newTestServerWithMockStore(t)
+	ms.messages[0].Cc = []string{"cc1@example.com", "cc2@example.com"}
+	ms.messages[0].Bcc = []string{"bcc@example.com"}
+
+	req := httptest.NewRequest("GET", "/api/v1/messages", nil)
+	w := httptest.NewRecorder()
+	srv.Router().ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d", w.Code, http.StatusOK)
+	}
+
+	var resp map[string]interface{}
+	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+
+	msg := resp["messages"].([]interface{})[0].(map[string]interface{})
+
+	ccRaw, ok := msg["cc"].([]interface{})
+	if !ok {
+		t.Fatalf("expected 'cc' array, got %T", msg["cc"])
+	}
+	var gotCc []string
+	for _, v := range ccRaw {
+		gotCc = append(gotCc, v.(string))
+	}
+	slices.Sort(gotCc)
+	wantCc := []string{"cc1@example.com", "cc2@example.com"}
+	if !slices.Equal(gotCc, wantCc) {
+		t.Errorf("cc = %v, want %v", gotCc, wantCc)
+	}
+
+	bcc, ok := msg["bcc"].([]interface{})
+	if !ok {
+		t.Fatalf("expected 'bcc' array, got %T", msg["bcc"])
+	}
+	if len(bcc) != 1 || bcc[0] != "bcc@example.com" {
+		t.Errorf("bcc = %v, want [bcc@example.com]", bcc)
+	}
+}
+
+func TestMessageSummaryCcBccOmittedWhenEmpty(t *testing.T) {
+	srv, _ := newTestServerWithMockStore(t)
+
+	req := httptest.NewRequest("GET", "/api/v1/messages", nil)
+	w := httptest.NewRecorder()
+	srv.Router().ServeHTTP(w, req)
+
+	// Parse raw JSON to check field presence
+	var raw map[string]json.RawMessage
+	if err := json.Unmarshal(w.Body.Bytes(), &raw); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+
+	var messages []json.RawMessage
+	if err := json.Unmarshal(raw["messages"], &messages); err != nil {
+		t.Fatalf("decode messages: %v", err)
+	}
+
+	var msg map[string]json.RawMessage
+	if err := json.Unmarshal(messages[0], &msg); err != nil {
+		t.Fatalf("decode message: %v", err)
+	}
+
+	if _, exists := msg["cc"]; exists {
+		t.Error("expected 'cc' to be omitted from JSON when empty")
+	}
+	if _, exists := msg["bcc"]; exists {
+		t.Error("expected 'bcc' to be omitted from JSON when empty")
+	}
+}
+
+func TestGetMessageCcBccInResponse(t *testing.T) {
+	srv, ms := newTestServerWithMockStore(t)
+	ms.messages[0].Cc = []string{"cc@example.com"}
+	ms.messages[0].Bcc = []string{"bcc@example.com"}
+
+	req := httptest.NewRequest("GET", "/api/v1/messages/1", nil)
+	w := httptest.NewRecorder()
+	srv.Router().ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d", w.Code, http.StatusOK)
+	}
+
+	var resp MessageDetail
+	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+
+	if len(resp.Cc) != 1 || resp.Cc[0] != "cc@example.com" {
+		t.Errorf("cc = %v, want [cc@example.com]", resp.Cc)
+	}
+	if len(resp.Bcc) != 1 || resp.Bcc[0] != "bcc@example.com" {
+		t.Errorf("bcc = %v, want [bcc@example.com]", resp.Bcc)
+	}
+}
+
 func TestHandleUploadToken(t *testing.T) {
 	// Create temp directory for tokens
 	tmpDir, err := os.MkdirTemp("", "msgvault-test-tokens-*")

internal/store/api.go

@@ -14,6 +14,8 @@ type APIMessage struct {
 	Subject        string
 	From           string
 	To             []string
+	Cc             []string
+	Bcc            []string
 	SentAt         time.Time
 	Snippet        string
 	Labels         []string
@@ -76,23 +78,11 @@ func (s *Store) ListMessages(offset, limit int) ([]APIMessage, int64, error) {
 		return messages, total, nil
 	}
 
-	// Batch-load recipients for all messages
-	recipientMap, err := s.batchGetRecipients(ids, "to")
-	if err != nil {
-		return nil, 0, err
-	}
-
-	// Batch-load labels for all messages
-	labelMap, err := s.batchGetLabels(ids)
-	if err != nil {
+	// Batch-load recipients and labels for all messages
+	if err := s.batchPopulate(messages, ids); err != nil {
 		return nil, 0, err
 	}
 
-	for i := range messages {
-		messages[i].To = recipientMap[messages[i].ID]
-		messages[i].Labels = labelMap[messages[i].ID]
-	}
-
 	return messages, total, nil
 }
 
@@ -139,6 +129,14 @@ func (s *Store) GetMessage(id int64) (*APIMessage, error) {
 	if err != nil {
 		return nil, err
 	}
+	m.Cc, err = s.getRecipients(m.ID, "cc")
+	if err != nil {
+		return nil, err
+	}
+	m.Bcc, err = s.getRecipients(m.ID, "bcc")
+	if err != nil {
+		return nil, err
+	}
 
 	// Get labels (single message, per-row is fine)
 	m.Labels, err = s.getLabels(m.ID)
@@ -353,12 +351,22 @@ func (s *Store) batchPopulate(messages []APIMessage, ids []int64) error {
 	if err != nil {
 		return err
 	}
+	ccMap, err := s.batchGetRecipients(ids, "cc")
+	if err != nil {
+		return err
+	}
+	bccMap, err := s.batchGetRecipients(ids, "bcc")
+	if err != nil {
+		return err
+	}
 	labelMap, err := s.batchGetLabels(ids)
 	if err != nil {
 		return err
 	}
 	for i := range messages {
 		messages[i].To = recipientMap[messages[i].ID]
+		messages[i].Cc = ccMap[messages[i].ID]
+		messages[i].Bcc = bccMap[messages[i].ID]
 		messages[i].Labels = labelMap[messages[i].ID]
 	}
 	return nil

internal/store/api_test.go

@@ -3,6 +3,7 @@ package store
 import (
 	"database/sql"
 	"path/filepath"
+	"slices"
 	"testing"
 	"time"
 )
@@ -163,6 +164,139 @@ func TestParseSQLiteTime(t *testing.T) {
 	}
 }
 
+func TestGetMessageCcBcc(t *testing.T) {
+	st := openTestStore(t)
+
+	source, err := st.GetOrCreateSource("gmail", "test@example.com")
+	if err != nil {
+		t.Fatalf("GetOrCreateSource: %v", err)
+	}
+	convID, err := st.EnsureConversation(source.ID, "thread-1", "Thread")
+	if err != nil {
+		t.Fatalf("EnsureConversation: %v", err)
+	}
+	msgID := seedMessage(t, st, source.ID, convID, "msg-cc-bcc", "CC/BCC test", "snippet")
+
+	db := st.DB()
+
+	// Insert participants
+	for _, p := range []struct {
+		id    int
+		email string
+	}{
+		{1, "to@example.com"},
+		{2, "cc1@example.com"},
+		{3, "cc2@example.com"},
+		{4, "bcc@example.com"},
+	} {
+		if _, err := db.Exec(
+			`INSERT INTO participants (id, email_address, domain, created_at, updated_at)
+			 VALUES (?, ?, 'example.com', datetime('now'), datetime('now'))`,
+			p.id, p.email,
+		); err != nil {
+			t.Fatalf("insert participant %s: %v", p.email, err)
+		}
+	}
+
+	// Insert message_recipients
+	for _, r := range []struct {
+		participantID int
+		recipientType string
+	}{
+		{1, "to"},
+		{2, "cc"},
+		{3, "cc"},
+		{4, "bcc"},
+	} {
+		if _, err := db.Exec(
+			`INSERT INTO message_recipients (message_id, participant_id, recipient_type)
+			 VALUES (?, ?, ?)`,
+			msgID, r.participantID, r.recipientType,
+		); err != nil {
+			t.Fatalf("insert recipient %s: %v", r.recipientType, err)
+		}
+	}
+
+	// Test GetMessage
+	m, err := st.GetMessage(msgID)
+	if err != nil {
+		t.Fatalf("GetMessage: %v", err)
+	}
+	if len(m.To) != 1 || m.To[0] != "to@example.com" {
+		t.Errorf("To = %v, want [to@example.com]", m.To)
+	}
+	gotCc := slices.Clone(m.Cc)
+	slices.Sort(gotCc)
+	wantCc := []string{"cc1@example.com", "cc2@example.com"}
+	if !slices.Equal(gotCc, wantCc) {
+		t.Errorf("Cc = %v, want %v", m.Cc, wantCc)
+	}
+	if len(m.Bcc) != 1 || m.Bcc[0] != "bcc@example.com" {
+		t.Errorf("Bcc = %v, want [bcc@example.com]", m.Bcc)
+	}
+}
+
+func TestListMessagesCcBcc(t *testing.T) {
+	st := openTestStore(t)
+
+	source, err := st.GetOrCreateSource("gmail", "test@example.com")
+	if err != nil {
+		t.Fatalf("GetOrCreateSource: %v", err)
+	}
+	convID, err := st.EnsureConversation(source.ID, "thread-1", "Thread")
+	if err != nil {
+		t.Fatalf("EnsureConversation: %v", err)
+	}
+	msgID := seedMessage(t, st, source.ID, convID, "msg-list-cc", "List CC test", "snippet")
+
+	db := st.DB()
+
+	// Insert CC and BCC participants
+	for _, p := range []struct {
+		id    int
+		email string
+	}{
+		{10, "cc@example.com"},
+		{11, "bcc@example.com"},
+	} {
+		if _, err := db.Exec(
+			`INSERT INTO participants (id, email_address, domain, created_at, updated_at)
+			 VALUES (?, ?, 'example.com', datetime('now'), datetime('now'))`,
+			p.id, p.email,
+		); err != nil {
+			t.Fatalf("insert participant %s: %v", p.email, err)
+		}
+	}
+	for _, r := range []struct {
+		participantID int
+		recipientType string
+	}{
+		{10, "cc"},
+		{11, "bcc"},
+	} {
+		if _, err := db.Exec(
+			`INSERT INTO message_recipients (message_id, participant_id, recipient_type)
+			 VALUES (?, ?, ?)`, msgID, r.participantID, r.recipientType,
+		); err != nil {
+			t.Fatalf("insert recipient %s: %v", r.recipientType, err)
+		}
+	}
+
+	messages, total, err := st.ListMessages(0, 100)
+	if err != nil {
+		t.Fatalf("ListMessages: %v", err)
+	}
+	if total != 1 {
+		t.Fatalf("total = %d, want 1", total)
+	}
+	if len(messages[0].Cc) != 1 || messages[0].Cc[0] != "cc@example.com" {
+		t.Errorf("Cc = %v, want [cc@example.com]", messages[0].Cc)
+	}
+	if len(messages[0].Bcc) != 1 || messages[0].Bcc[0] != "bcc@example.com" {
+		t.Errorf("Bcc = %v, want [bcc@example.com]", messages[0].Bcc)
+	}
+}
+
 func TestSearchMessagesLikeLiteralWildcards(t *testing.T) {
 	st := openTestStore(t)