@flusys/nestjs-notification 9.1.1 → 9.2.0

package/README.md

@@ -49,7 +49,7 @@ import { NotificationModule } from '@flusys/nestjs-notification';
 export class AppModule {}
 ```
 
-The Socket.IO gateway is always registered. Real-time delivery is chosen per send: pass `realtime: false` to store a notification without pushing it.
+The Socket.IO gateway is always registered. Real-time delivery is chosen per send: pass `realtime: false` to store a notification without pushing it. Clients connect to the `/notifications` namespace with an **access** token (`auth.token`, `?token=` or `Authorization: Bearer`) signed with `config.jwtSecret` (HS256); refresh tokens and tokens without a user id are refused.
 
 #### Mode 2: Multi-Tenant
 
@@ -201,6 +201,13 @@ export class OrderService {
 
 `NotificationModule` provides and exports `NOTIFICATION_ADAPTER` (`nestjs-shared`), implemented by `NotificationAdapter`: `send({ userId, ...content })`, `sendToMany({ userIds, ...content })` and `isUserOnline(userId)`. It is a singleton: it resolves the request-scoped `NotificationHelperService` (tenant datasource) per call and asks the gateway who is online, so a singleton that injects the token stays one. A feature package injects it `@Optional()` and never imports this package (auth's login notice and the entity builder's **Send notification** flow step use it).
 
+## 5. Caching and Multiple Instances
+
+- **No cached reads.** `NotificationService` is not cacheable: every list is scoped to the caller (user + company), and the unread count is always a live `COUNT`. Every write still bumps the `notification` cache stamp after it commits (`ApiService` CRUD, `mark-read`, `mark-all-read`, `send`, `send-bulk`), so a service that lists `NOTIFICATION_EVENT_ENTITIES.NOTIFICATION` in its `cacheDependencies()` stays correct.
+- **`notification:new` is pushed after commit.** CRUD inserts emit from `publishLifecycleEvents` (after the transaction commits), so a client that refetches on the event always finds the row.
+- **Socket fan-out is per instance.** The gateway uses Socket.IO's default in-memory adapter: an emit reaches only sockets connected to the instance that handled the write, and `isUserOnline()` / `getOnlineUserCount()` only see local sockets. Behind several instances, install a Socket.IO pub/sub adapter (e.g. `@socket.io/redis-adapter` via a custom `IoAdapter` in the app) so rooms span instances; the online checks stay instance-local even then.
+- **Socket auth is checked at connect only.** The handshake verifies the access token's signature, expiry and `type`, but not nestjs-auth's session revocation markers (logout, deactivation): a revoked but unexpired token can still connect, and an open socket keeps receiving its rooms' events after revocation or expiry until it reconnects.
+
 ## License
 
 MIT © FLUSYS

package/controllers/notification.controller.d.ts

@@ -7,6 +7,7 @@ declare const NotificationController_base: abstract new (service: NotificationSe
     readonly enabledEndpoints: import("@flusys/nestjs-shared").ApiEndpoint[] | "all";
     service: NotificationService;
     isEnabled(endpoint: import("@flusys/nestjs-shared").ApiEndpoint): boolean;
+    assertEnabled(endpoint: import("@flusys/nestjs-shared").ApiEndpoint): void;
     insert(addDto: CreateNotificationDto, user: ILoggedUserInfo | null): Promise<SingleResponseDto<NotificationResponseDto>>;
     insertMany(addDto: CreateNotificationDto[], user: ILoggedUserInfo | null): Promise<BulkResponseDto<NotificationResponseDto>>;
     getById(id: string, body: import("@flusys/nestjs-shared").GetByIdBodyDto, user: ILoggedUserInfo | null): Promise<SingleResponseDto<NotificationResponseDto>>;

package/fesm/244.js

@@ -389,12 +389,16 @@ class NotificationGateway {
             if (!secret) {
                 return null;
             }
-            return this.jwtService.verify(token, {
+            const payload = this.jwtService.verify(token, {
                 secret,
                 algorithms: [
                     'HS256'
                 ]
             });
+            if (payload?.type !== 'access' || typeof payload.id !== 'string' || !payload.id) {
+                return null;
+            }
+            return payload;
         } catch  {
             return null;
         }
@@ -729,8 +733,10 @@ class NotificationHelperService {
             createdAt: notification.createdAt
         };
     }
+    // Nothing caches notifications today, but NotificationService bumps this stamp on every write too, so a
+    // service that later lists 'notification' as a cache dependency can rely on it
     async clearCache() {
-        await this.utilsService.clearCache(_config_index_js__rspack_import_10/* .NOTIFICATION_EVENT_ENTITIES.NOTIFICATION */.BA.NOTIFICATION, this.cacheManager, undefined, (0,_flusys_nestjs_shared_utils__rspack_import_4.cacheTenantId)(this.dataSourceProvider));
+        await this.utilsService.clearCache(_config_index_js__rspack_import_10/* .NOTIFICATION_EVENT_ENTITIES.NOTIFICATION */.BA.NOTIFICATION, this.cacheManager, (0,_flusys_nestjs_shared_utils__rspack_import_4.cacheTenantId)(this.dataSourceProvider));
     }
 }
 _ts_decorate([

package/fesm/446.js

@@ -1,4 +1,4 @@
-import { IsEnum, IsNotEmpty, IsObject, IsOptional, IsString, IsUUID, MaxLength } from "class-validator";
+import { IsArray, IsEnum, IsNotEmpty, IsObject, IsOptional, IsString, IsUUID, MaxLength } from "class-validator";
 import * as __rspack_external__nestjs_swagger_7cd450b5 from "@nestjs/swagger";
 import * as __rspack_external_class_transformer_c5a479fb from "class-transformer";
 import * as __rspack_external__flusys_nestjs_shared_decorators_c129b601 from "@flusys/nestjs-shared/decorators";
@@ -453,6 +453,7 @@ _ts_decorate([
         ]
     }),
     IsNotEmpty(),
+    IsArray(),
     IsUUID('4', {
         each: true
     }),
@@ -674,13 +675,16 @@ class NotificationService extends _flusys_nestjs_shared_classes__rspack_import_1
     }
     async convertSingleDtoToEntity(dto, user) {
         let entity = {};
-        if ('id' in dto && dto.id) {
+        const companyFeature = this.notificationConfig.isCompanyFeatureEnabled();
+        const isUpdate = 'id' in dto && !!dto.id;
+        if (isUpdate) {
             const existing = await this.repository.findOne({
                 where: {
                     id: dto.id
                 }
             });
-            if (!existing) {
+            const otherCompany = companyFeature && (!user?.companyId || existing?.companyId !== user.companyId);
+            if (!existing || otherCompany) {
                 throw new _nestjs_common__rspack_import_4.NotFoundException({
                     message: 'Notification not found',
                     messageKey: _config_index_js__rspack_import_10/* .NOTIFICATION_MESSAGES.NOT_FOUND */.x.NOT_FOUND
@@ -688,9 +692,10 @@ class NotificationService extends _flusys_nestjs_shared_classes__rspack_import_1
             }
             entity = existing;
         }
+        const recipient = 'userId' in dto ? dto.userId : undefined;
         const merged = {
             ...entity,
-            userId: user?.id ?? entity.userId,
+            userId: isUpdate ? entity.userId : recipient ?? user?.id,
             type: dto.type ?? entity.type ?? 'info',
             title: dto.title ?? entity.title,
             message: dto.message ?? entity.message,
@@ -698,8 +703,8 @@ class NotificationService extends _flusys_nestjs_shared_classes__rspack_import_1
             isRead: entity.isRead ?? false,
             readAt: entity.readAt
         };
-        if (this.notificationConfig.isCompanyFeatureEnabled()) {
-            merged.companyId = dto.companyId ?? user?.companyId ?? entity.companyId ?? null;
+        if (companyFeature && !isUpdate) {
+            merged.companyId = dto.companyId ?? user?.companyId ?? null;
         }
         return merged;
     }
@@ -759,11 +764,16 @@ class NotificationService extends _flusys_nestjs_shared_classes__rspack_import_1
         }
         return result;
     }
-    async afterInsertOperation(entities, _dto, _user, _qr) {
-        for (const entity of entities){
-            const ext = entity;
-            this.emitToUser(entity.userId, ext.companyId, 'notification:new', this.toPayload(entity));
+    // Pushed only once the insert has committed: a client refetching on `notification:new` must find the row
+    async publishLifecycleEvents(groups, user) {
+        for (const group of groups){
+            if (group.action !== 'created') continue;
+            for (const entity of group.entities){
+                const ext = entity;
+                this.emitToUser(entity.userId, ext.companyId, 'notification:new', this.toPayload(entity));
+            }
         }
+        await super.publishLifecycleEvents(groups, user);
     }
     async markAsRead(id, user) {
         await this.ensureDataSourceRepository();
@@ -782,13 +792,7 @@ class NotificationService extends _flusys_nestjs_shared_classes__rspack_import_1
         notification.isRead = true;
         notification.readAt = new Date();
         await this.repository.save(notification);
-        await Promise.all([
-            this.clearCacheForAll(),
-            this.clearCacheForId([
-                notification
-            ])
-        ]);
-        // Emit to user's sockets in the same company context
+        await this.invalidateCache();
         const ext = notification;
         this.emitToUser(user.id, ext.companyId ?? user.companyId, 'notification:read', {
             id
@@ -802,20 +806,14 @@ class NotificationService extends _flusys_nestjs_shared_classes__rspack_import_1
         return notification;
     }
     async markAllAsRead(user) {
+        const where = this.unreadWhere(user);
+        if (!where) return 0;
         await this.ensureDataSourceRepository();
-        const where = {
-            userId: user.id,
-            isRead: false
-        };
-        if (this.notificationConfig.isCompanyFeatureEnabled() && user.companyId) {
-            where.companyId = user.companyId;
-        }
         const result = await this.repository.update(where, {
             isRead: true,
             readAt: new Date()
         });
-        await this.clearCacheForAll();
-        // Emit to user's sockets in the current company context
+        await this.invalidateCache();
         this.emitToUser(user.id, user.companyId, 'notification:read-all', {});
         await this.publishDomainAction(_config_index_js__rspack_import_9/* .NOTIFICATION_EVENT_ACTIONS.ALL_READ */.R.ALL_READ, {
             metadata: {
@@ -826,18 +824,27 @@ class NotificationService extends _flusys_nestjs_shared_classes__rspack_import_1
         return result.affected ?? 0;
     }
     async getUnreadCount(user) {
+        const where = this.unreadWhere(user);
+        if (!where) return 0;
         await this.ensureDataSourceRepository();
-        const where = {
-            userId: user.id,
-            isRead: false
-        };
-        if (this.notificationConfig.isCompanyFeatureEnabled() && user.companyId) {
-            where.companyId = user.companyId;
-        }
         return this.repository.count({
             where
         });
     }
+    unreadWhere(user) {
+        if (!this.notificationConfig.isCompanyFeatureEnabled()) {
+            return {
+                userId: user.id,
+                isRead: false
+            };
+        }
+        if (!user.companyId) return null;
+        return {
+            userId: user.id,
+            isRead: false,
+            companyId: user.companyId
+        };
+    }
     toPayload(entity) {
         return {
             id: entity.id,

package/fesm/docs/index.js

@@ -74,9 +74,9 @@ Real-time notification system with WebSocket support.
 
 ### WebSocket Events
 
-Connect to WebSocket with JWT authentication:
+Connect to the \`/notifications\` Socket.IO namespace with an access token (\`auth.token\`, \`?token=\` or \`Authorization: Bearer\`):
 \`\`\`
-ws://localhost:2002/notification?token=<jwt>
+ws://localhost:2002/notifications?token=<access-token>
 \`\`\`
 
 **Events:**

package/fesm/dtos/index.js

@@ -1,4 +1,4 @@
-import { IsEnum, IsNotEmpty, IsObject, IsOptional, IsString, IsUUID, MaxLength } from "class-validator";
+import { IsArray, IsEnum, IsNotEmpty, IsObject, IsOptional, IsString, IsUUID, MaxLength } from "class-validator";
 import * as __rspack_external__flusys_nestjs_shared_enums_327421f8 from "@flusys/nestjs-shared/enums";
 import * as __rspack_external__nestjs_swagger_7cd450b5 from "@nestjs/swagger";
 import * as __rspack_external_class_transformer_c5a479fb from "class-transformer";
@@ -111,6 +111,7 @@ _ts_decorate([
         ]
     }),
     IsNotEmpty(),
+    IsArray(),
     IsUUID('4', {
         each: true
     }),

package/fesm/gateways/index.js

@@ -173,12 +173,16 @@ class NotificationGateway {
             if (!secret) {
                 return null;
             }
-            return this.jwtService.verify(token, {
+            const payload = this.jwtService.verify(token, {
                 secret,
                 algorithms: [
                     'HS256'
                 ]
             });
+            if (payload?.type !== 'access' || typeof payload.id !== 'string' || !payload.id) {
+                return null;
+            }
+            return payload;
         } catch  {
             return null;
         }

package/fesm/index.js

@@ -175,9 +175,9 @@ Real-time notification system with WebSocket support.
 
 ### WebSocket Events
 
-Connect to WebSocket with JWT authentication:
+Connect to the \`/notifications\` Socket.IO namespace with an access token (\`auth.token\`, \`?token=\` or \`Authorization: Bearer\`):
 \`\`\`
-ws://localhost:2002/notification?token=<jwt>
+ws://localhost:2002/notifications?token=<access-token>
 \`\`\`
 
 **Events:**

package/fesm/services/index.js

@@ -93,13 +93,16 @@ class NotificationService extends _flusys_nestjs_shared_classes__rspack_import_1
     }
     async convertSingleDtoToEntity(dto, user) {
         let entity = {};
-        if ('id' in dto && dto.id) {
+        const companyFeature = this.notificationConfig.isCompanyFeatureEnabled();
+        const isUpdate = 'id' in dto && !!dto.id;
+        if (isUpdate) {
             const existing = await this.repository.findOne({
                 where: {
                     id: dto.id
                 }
             });
-            if (!existing) {
+            const otherCompany = companyFeature && (!user?.companyId || existing?.companyId !== user.companyId);
+            if (!existing || otherCompany) {
                 throw new _nestjs_common__rspack_import_4.NotFoundException({
                     message: 'Notification not found',
                     messageKey: _config_index_js__rspack_import_10/* .NOTIFICATION_MESSAGES.NOT_FOUND */.x.NOT_FOUND
@@ -107,9 +110,10 @@ class NotificationService extends _flusys_nestjs_shared_classes__rspack_import_1
             }
             entity = existing;
         }
+        const recipient = 'userId' in dto ? dto.userId : undefined;
         const merged = {
             ...entity,
-            userId: user?.id ?? entity.userId,
+            userId: isUpdate ? entity.userId : recipient ?? user?.id,
             type: dto.type ?? entity.type ?? 'info',
             title: dto.title ?? entity.title,
             message: dto.message ?? entity.message,
@@ -117,8 +121,8 @@ class NotificationService extends _flusys_nestjs_shared_classes__rspack_import_1
             isRead: entity.isRead ?? false,
             readAt: entity.readAt
         };
-        if (this.notificationConfig.isCompanyFeatureEnabled()) {
-            merged.companyId = dto.companyId ?? user?.companyId ?? entity.companyId ?? null;
+        if (companyFeature && !isUpdate) {
+            merged.companyId = dto.companyId ?? user?.companyId ?? null;
         }
         return merged;
     }
@@ -178,11 +182,16 @@ class NotificationService extends _flusys_nestjs_shared_classes__rspack_import_1
         }
         return result;
     }
-    async afterInsertOperation(entities, _dto, _user, _qr) {
-        for (const entity of entities){
-            const ext = entity;
-            this.emitToUser(entity.userId, ext.companyId, 'notification:new', this.toPayload(entity));
+    // Pushed only once the insert has committed: a client refetching on `notification:new` must find the row
+    async publishLifecycleEvents(groups, user) {
+        for (const group of groups){
+            if (group.action !== 'created') continue;
+            for (const entity of group.entities){
+                const ext = entity;
+                this.emitToUser(entity.userId, ext.companyId, 'notification:new', this.toPayload(entity));
+            }
         }
+        await super.publishLifecycleEvents(groups, user);
     }
     async markAsRead(id, user) {
         await this.ensureDataSourceRepository();
@@ -201,13 +210,7 @@ class NotificationService extends _flusys_nestjs_shared_classes__rspack_import_1
         notification.isRead = true;
         notification.readAt = new Date();
         await this.repository.save(notification);
-        await Promise.all([
-            this.clearCacheForAll(),
-            this.clearCacheForId([
-                notification
-            ])
-        ]);
-        // Emit to user's sockets in the same company context
+        await this.invalidateCache();
         const ext = notification;
         this.emitToUser(user.id, ext.companyId ?? user.companyId, 'notification:read', {
             id
@@ -221,20 +224,14 @@ class NotificationService extends _flusys_nestjs_shared_classes__rspack_import_1
         return notification;
     }
     async markAllAsRead(user) {
+        const where = this.unreadWhere(user);
+        if (!where) return 0;
         await this.ensureDataSourceRepository();
-        const where = {
-            userId: user.id,
-            isRead: false
-        };
-        if (this.notificationConfig.isCompanyFeatureEnabled() && user.companyId) {
-            where.companyId = user.companyId;
-        }
         const result = await this.repository.update(where, {
             isRead: true,
             readAt: new Date()
         });
-        await this.clearCacheForAll();
-        // Emit to user's sockets in the current company context
+        await this.invalidateCache();
         this.emitToUser(user.id, user.companyId, 'notification:read-all', {});
         await this.publishDomainAction(_config_index_js__rspack_import_9/* .NOTIFICATION_EVENT_ACTIONS.ALL_READ */.R.ALL_READ, {
             metadata: {
@@ -245,18 +242,27 @@ class NotificationService extends _flusys_nestjs_shared_classes__rspack_import_1
         return result.affected ?? 0;
     }
     async getUnreadCount(user) {
+        const where = this.unreadWhere(user);
+        if (!where) return 0;
         await this.ensureDataSourceRepository();
-        const where = {
-            userId: user.id,
-            isRead: false
-        };
-        if (this.notificationConfig.isCompanyFeatureEnabled() && user.companyId) {
-            where.companyId = user.companyId;
-        }
         return this.repository.count({
             where
         });
     }
+    unreadWhere(user) {
+        if (!this.notificationConfig.isCompanyFeatureEnabled()) {
+            return {
+                userId: user.id,
+                isRead: false
+            };
+        }
+        if (!user.companyId) return null;
+        return {
+            userId: user.id,
+            isRead: false,
+            companyId: user.companyId
+        };
+    }
     toPayload(entity) {
         return {
             id: entity.id,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-notification",
-  "version": "9.1.1",
+  "version": "9.2.0",
   "description": "Notification module with real-time Socket.IO support",
   "type": "module",
   "main": "./fesm/index.js",
@@ -82,7 +82,7 @@
     "express": "^5.0.0"
   },
   "dependencies": {
-    "@flusys/nestjs-core": "9.1.1",
-    "@flusys/nestjs-shared": "9.1.1"
+    "@flusys/nestjs-core": "9.2.0",
+    "@flusys/nestjs-shared": "9.2.0"
   }
 }

package/services/notification.service.d.ts

@@ -1,7 +1,7 @@
 import { ApiService, HybridCache } from '@flusys/nestjs-shared/classes';
-import { type ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
+import { type CrudEventActionName, type ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
-import { type QueryRunner, SelectQueryBuilder } from 'typeorm';
+import { SelectQueryBuilder } from 'typeorm';
 import { CreateNotificationDto, UpdateNotificationDto } from '../dtos/index.js';
 import { NotificationBase } from '../entities/index.js';
 import { NotificationGateway } from '../gateways/index.js';
@@ -27,10 +27,15 @@ export declare class NotificationService extends ApiService<CreateNotificationDt
         query: SelectQueryBuilder<NotificationBase>;
         isRaw: boolean;
     }>;
-    protected afterInsertOperation(entities: NotificationBase[], _dto: CreateNotificationDto | Array<CreateNotificationDto>, _user: ILoggedUserInfo | null, _qr: QueryRunner): Promise<void>;
+    protected publishLifecycleEvents(groups: {
+        action: CrudEventActionName;
+        entities: NotificationBase[];
+        idsOnly?: boolean;
+    }[], user: ILoggedUserInfo | null): Promise<void>;
     markAsRead(id: string, user: ILoggedUserInfo): Promise<NotificationBase>;
     markAllAsRead(user: ILoggedUserInfo): Promise<number>;
     getUnreadCount(user: ILoggedUserInfo): Promise<number>;
+    private unreadWhere;
     private toPayload;
     private emitToUser;
 }