@omg-dev/server 0.4.24

package/src/notifications.ts

@@ -0,0 +1,628 @@
+import { collection, defineSchema, fields, type Schema } from "@omg-dev/schema"
+import { ctx } from "./ctx.ts"
+import { getDbInstance, type VibesDb } from "./db.ts"
+import { invalidate } from "./broker.ts"
+import { notifyRowChange } from "./subscriptions.ts"
+
+const NOTIFICATIONS_TABLE = "vibesNotifications"
+const PREFERENCES_TABLE = "vibesNotificationPreferences"
+const SUBSCRIPTIONS_TABLE = "vibesPushSubscriptions"
+const DELIVERIES_TABLE = "vibesNotificationDeliveries"
+export const notificationSystemCollectionNames = new Set([
+  NOTIFICATIONS_TABLE,
+  PREFERENCES_TABLE,
+  SUBSCRIPTIONS_TABLE,
+  DELIVERIES_TABLE,
+])
+
+export const notificationSystemSchema = defineSchema({
+  collections: {
+    [NOTIFICATIONS_TABLE]: collection({
+      fields: {
+        appId: fields.string(),
+        userId: fields.string(),
+        kind: fields.string(),
+        title: fields.string(),
+        body: fields.string(),
+        url: fields.string(),
+        status: fields.enum(["unread", "read", "archived"]),
+        priority: fields.enum(["low", "normal", "high"]),
+        sourceType: fields.string(),
+        sourceId: fields.string(),
+        dedupeKey: fields.string(),
+        dataJson: fields.string(),
+        readAt: fields.number(),
+        createdAt: fields.number(),
+      },
+    })
+      .scoped("user")
+      .index("_owner", "status", "createdAt")
+      .index("_owner", "createdAt")
+      .index("appId", "userId", "createdAt"),
+
+    [PREFERENCES_TABLE]: collection({
+      fields: {
+        appId: fields.string(),
+        userId: fields.string(),
+        kind: fields.string(),
+        inApp: fields.boolean(),
+        push: fields.boolean(),
+        createdAt: fields.number(),
+        updatedAt: fields.number(),
+      },
+    })
+      .scoped("user")
+      .index("_owner", "appId", "kind"),
+
+    [SUBSCRIPTIONS_TABLE]: collection({
+      fields: {
+        appId: fields.string(),
+        userId: fields.string(),
+        endpoint: fields.string(),
+        p256dh: fields.string(),
+        auth: fields.string(),
+        userAgent: fields.string(),
+        disabledAt: fields.number(),
+        lastSeenAt: fields.number(),
+        createdAt: fields.number(),
+        updatedAt: fields.number(),
+      },
+    })
+      .scoped("user")
+      .index("_owner", "appId")
+      .index("endpoint"),
+
+    [DELIVERIES_TABLE]: collection({
+      fields: {
+        notificationId: fields.ref(NOTIFICATIONS_TABLE),
+        appId: fields.string(),
+        userId: fields.string(),
+        channel: fields.enum(["in_app", "push"]),
+        status: fields.enum(["pending", "sent", "failed", "skipped"]),
+        attempts: fields.number(),
+        error: fields.string(),
+        createdAt: fields.number(),
+        updatedAt: fields.number(),
+      },
+    })
+      .scoped("user")
+      .index("_owner", "createdAt")
+      .index("notificationId", "channel"),
+  },
+})
+
+export function withNotificationSystemSchema(schema: Schema | undefined): Schema | undefined {
+  if (!schema) return notificationSystemSchema
+  return {
+    collections: {
+      ...schema.collections,
+      ...notificationSystemSchema.collections,
+    },
+  }
+}
+
+export function ensureNotificationIndexes(db: VibesDb): void {
+  db.raw().exec(
+    `CREATE UNIQUE INDEX IF NOT EXISTS uniq_vibes_notifications_owner_dedupe
+       ON ${NOTIFICATIONS_TABLE} (_owner, appId, dedupeKey)
+       WHERE dedupeKey != ''`,
+  )
+  db.raw().exec(
+    `CREATE UNIQUE INDEX IF NOT EXISTS uniq_vibes_push_subscriptions_owner_endpoint
+       ON ${SUBSCRIPTIONS_TABLE} (_owner, appId, endpoint)`,
+  )
+  db.raw().exec(
+    `CREATE UNIQUE INDEX IF NOT EXISTS uniq_vibes_notification_prefs_owner_kind
+       ON ${PREFERENCES_TABLE} (_owner, appId, kind)`,
+  )
+}
+
+export interface NotifyInput {
+  userId?: string | null
+  appId?: string
+  kind: string
+  title: string
+  body?: string
+  url?: string
+  priority?: "low" | "normal" | "high"
+  source?: {
+    type: string
+    id: string
+  }
+  dedupeKey?: string
+  data?: Record<string, unknown>
+  channels?: {
+    inApp?: boolean
+    push?: boolean
+  }
+}
+
+interface NotificationRow {
+  id: string
+  appId: string
+  userId: string
+  kind: string
+  title: string
+  body: string
+  url: string
+  status: "unread" | "read" | "archived"
+  priority: "low" | "normal" | "high"
+  sourceType: string
+  sourceId: string
+  dedupeKey: string
+  dataJson: string
+  readAt: number
+  createdAt: number
+  _owner: string
+  created_at: string
+  updated_at: string
+}
+
+interface WebPushSubscriptionPayload {
+  endpoint: string
+  keys: {
+    p256dh: string
+    auth: string
+  }
+}
+
+interface WebPushSender {
+  setVapidDetails(subject: string, publicKey: string, privateKey: string): void
+  sendNotification(subscription: WebPushSubscriptionPayload, payload: string): Promise<unknown>
+}
+
+function dbOrThrow(): VibesDb {
+  const db = getDbInstance()
+  if (!db) throw new Error("[vibes:notifications] db not initialized")
+  return db
+}
+
+function nowIso(): string {
+  return new Date().toISOString()
+}
+
+function insertRaw(db: VibesDb, table: string, data: Record<string, unknown>): Record<string, unknown> {
+  const id = typeof data.id === "string" ? data.id : crypto.randomUUID()
+  const iso = nowIso()
+  const record = { ...data, id, created_at: iso, updated_at: iso }
+  const cols = Object.keys(record)
+  const placeholders = cols.map(() => "?").join(", ")
+  db.raw()
+    .prepare(`INSERT INTO ${table} (${cols.join(", ")}) VALUES (${placeholders})`)
+    .run(...Object.values(record))
+  invalidate(table)
+  void notifyRowChange(table, "insert", null, record)
+  return record
+}
+
+function patchRaw(db: VibesDb, table: string, id: string, patch: Record<string, unknown>): Record<string, unknown> | null {
+  const before = db.raw()
+    .prepare(`SELECT * FROM ${table} WHERE id = ? LIMIT 1`)
+    .get(id) as Record<string, unknown> | null
+  if (!before) return null
+  const write: Record<string, unknown> = { ...patch, updated_at: nowIso() }
+  const cols = Object.keys(write)
+  db.raw()
+    .prepare(`UPDATE ${table} SET ${cols.map((c) => `${c} = ?`).join(", ")} WHERE id = ?`)
+    .run(...cols.map((c) => write[c]), id)
+  const after = { ...before, ...write }
+  invalidate(table)
+  void notifyRowChange(table, "update", before, after)
+  return after
+}
+
+function getPreference(db: VibesDb, userId: string, appId: string, kind: string): { inApp: number; push: number } | null {
+  return db.raw()
+    .prepare(
+      `SELECT inApp, push FROM ${PREFERENCES_TABLE}
+        WHERE _owner = ? AND appId = ? AND kind = ?
+        LIMIT 1`,
+    )
+    .get(userId, appId, kind) as { inApp: number; push: number } | null
+}
+
+function desiredChannels(db: VibesDb, input: Required<Pick<NotifyInput, "kind">> & NotifyInput, userId: string, appId: string) {
+  const pref = getPreference(db, userId, appId, input.kind)
+  return {
+    inApp: input.channels?.inApp ?? (pref ? Boolean(pref.inApp) : true),
+    push: input.channels?.push ?? (pref ? Boolean(pref.push) : true),
+  }
+}
+
+async function configureWebPush(): Promise<{ sender: WebPushSender | null; error: string; skipped: boolean }> {
+  const publicKey = process.env.VIBES_VAPID_PUBLIC_KEY
+  const privateKey = process.env.VIBES_VAPID_PRIVATE_KEY
+  if (!publicKey || !privateKey) {
+    return { sender: null, error: "VAPID keys not configured", skipped: true }
+  }
+  try {
+    // Keep web-push out of generated app bundles unless push delivery is actually
+    // configured at runtime. The package e2e fixture intentionally installs
+    // local tarballs without all optional transitive npm dependencies.
+    const runtimeImport = new Function("specifier", "return import(specifier)") as (
+      specifier: string,
+    ) => Promise<{ default?: WebPushSender } & Partial<WebPushSender>>
+    const mod = await runtimeImport("web-push")
+    const sender = (mod.default ?? mod) as WebPushSender
+    sender.setVapidDetails(
+      process.env.VIBES_VAPID_SUBJECT || "mailto:support@omg.dev",
+      publicKey,
+      privateKey,
+    )
+    return { sender, error: "", skipped: false }
+  } catch (err) {
+    return {
+      sender: null,
+      error: err instanceof Error ? err.message : String(err),
+      skipped: false,
+    }
+  }
+}
+
+async function fanoutPush(db: VibesDb, row: NotificationRow): Promise<void> {
+  const subscriptions = db.raw()
+    .prepare(
+      `SELECT * FROM ${SUBSCRIPTIONS_TABLE}
+        WHERE _owner = ? AND appId = ? AND disabledAt = 0`,
+    )
+    .all(row.userId, row.appId) as Array<Record<string, unknown>>
+  if (subscriptions.length === 0) {
+    insertRaw(db, DELIVERIES_TABLE, {
+      _owner: row.userId,
+      notificationId: row.id,
+      appId: row.appId,
+      userId: row.userId,
+      channel: "push",
+      status: "skipped",
+      attempts: 0,
+      error: "no push subscriptions",
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+    })
+    return
+  }
+  const webPush = await configureWebPush()
+  for (const sub of subscriptions) {
+    const delivery = insertRaw(db, DELIVERIES_TABLE, {
+      _owner: row.userId,
+      notificationId: row.id,
+      appId: row.appId,
+      userId: row.userId,
+      channel: "push",
+      status: webPush.sender ? "pending" : webPush.skipped ? "skipped" : "failed",
+      attempts: 0,
+      error: webPush.sender ? "" : webPush.error,
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+    })
+    if (!webPush.sender) continue
+    const pushSub: WebPushSubscriptionPayload = {
+      endpoint: String(sub.endpoint),
+      keys: {
+        p256dh: String(sub.p256dh),
+        auth: String(sub.auth),
+      },
+    }
+    try {
+      await webPush.sender.sendNotification(
+        pushSub,
+        JSON.stringify({
+          id: row.id,
+          title: row.title,
+          body: row.body,
+          url: row.url,
+          tag: row.dedupeKey || row.id,
+          data: safeJson(row.dataJson),
+        }),
+      )
+      patchRaw(db, DELIVERIES_TABLE, String(delivery.id), {
+        status: "sent",
+        attempts: 1,
+        error: "",
+        updatedAt: Date.now(),
+      })
+    } catch (err) {
+      const statusCode = typeof err === "object" && err && "statusCode" in err
+        ? Number((err as { statusCode?: unknown }).statusCode)
+        : 0
+      if (statusCode === 404 || statusCode === 410) {
+        patchRaw(db, SUBSCRIPTIONS_TABLE, String(sub.id), {
+          disabledAt: Date.now(),
+          updatedAt: Date.now(),
+        })
+      }
+      patchRaw(db, DELIVERIES_TABLE, String(delivery.id), {
+        status: "failed",
+        attempts: 1,
+        error: err instanceof Error ? err.message : String(err),
+        updatedAt: Date.now(),
+      })
+    }
+  }
+}
+
+function safeJson(raw: string): unknown {
+  if (!raw) return {}
+  try {
+    return JSON.parse(raw)
+  } catch {
+    return {}
+  }
+}
+
+export async function notify(input: NotifyInput): Promise<NotificationRow | null> {
+  const db = dbOrThrow()
+  const userId = input.userId ?? ctx.userId
+  if (!userId) return null
+  const appId = input.appId ?? ctx.appId ?? "app"
+  const channels = desiredChannels(db, input, userId, appId)
+  if (!channels.inApp && !channels.push) return null
+
+  const dedupeKey = input.dedupeKey ?? ""
+  if (dedupeKey) {
+    const existing = db.raw()
+      .prepare(
+        `SELECT * FROM ${NOTIFICATIONS_TABLE}
+          WHERE _owner = ? AND appId = ? AND dedupeKey = ?
+          LIMIT 1`,
+      )
+      .get(userId, appId, dedupeKey) as NotificationRow | null
+    if (existing) return existing
+  }
+
+  const now = Date.now()
+  let inserted: NotificationRow
+  try {
+    inserted = insertRaw(db, NOTIFICATIONS_TABLE, {
+      _owner: userId,
+      appId,
+      userId,
+      kind: input.kind,
+      title: input.title,
+      body: input.body ?? "",
+      url: input.url ?? "",
+      status: "unread",
+      priority: input.priority ?? "normal",
+      sourceType: input.source?.type ?? "",
+      sourceId: input.source?.id ?? "",
+      dedupeKey,
+      dataJson: input.data ? JSON.stringify(input.data) : "{}",
+      readAt: 0,
+      createdAt: now,
+    }) as unknown as NotificationRow
+  } catch (err) {
+    if (dedupeKey && err instanceof Error && /UNIQUE/i.test(err.message)) {
+      return db.raw()
+        .prepare(
+          `SELECT * FROM ${NOTIFICATIONS_TABLE}
+            WHERE _owner = ? AND appId = ? AND dedupeKey = ?
+            LIMIT 1`,
+        )
+        .get(userId, appId, dedupeKey) as NotificationRow | null
+    }
+    throw err
+  }
+
+  if (channels.inApp) {
+    insertRaw(db, DELIVERIES_TABLE, {
+      _owner: userId,
+      notificationId: inserted.id,
+      appId,
+      userId,
+      channel: "in_app",
+      status: "sent",
+      attempts: 0,
+      error: "",
+      createdAt: now,
+      updatedAt: now,
+    })
+  }
+  if (channels.push) void fanoutPush(db, inserted)
+  return inserted
+}
+
+async function readBody(req: Request): Promise<Record<string, unknown>> {
+  try {
+    const body = await req.json()
+    return body && typeof body === "object" ? body as Record<string, unknown> : {}
+  } catch {
+    return {}
+  }
+}
+
+function requireUser(): string | Response {
+  if (!ctx.userId) return Response.json({ error: "Authentication required" }, { status: 401 })
+  return ctx.userId
+}
+
+export async function notificationsConfigHandler(): Promise<Response> {
+  return Response.json({
+    vapidPublicKey: process.env.VIBES_VAPID_PUBLIC_KEY ?? "",
+  })
+}
+
+export async function notificationsListHandler(req: Request): Promise<Response> {
+  const userId = requireUser()
+  if (userId instanceof Response) return userId
+  const db = dbOrThrow()
+  const url = new URL(req.url)
+  const unreadOnly = url.searchParams.get("unread") === "1"
+  const rows = db.raw()
+    .prepare(
+      `SELECT * FROM ${NOTIFICATIONS_TABLE}
+        WHERE _owner = ? ${unreadOnly ? "AND status = 'unread'" : ""}
+        ORDER BY createdAt DESC
+        LIMIT 100`,
+    )
+    .all(userId) as Array<Record<string, unknown>>
+  return Response.json(rows)
+}
+
+export async function notificationsUnreadCountHandler(): Promise<Response> {
+  const userId = requireUser()
+  if (userId instanceof Response) return userId
+  const db = dbOrThrow()
+  const row = db.raw()
+    .prepare(`SELECT COUNT(*) AS count FROM ${NOTIFICATIONS_TABLE} WHERE _owner = ? AND status = 'unread'`)
+    .get(userId) as { count: number } | null
+  return Response.json({ count: row?.count ?? 0 })
+}
+
+export async function notificationsSubscribeHandler(req: Request): Promise<Response> {
+  const userId = requireUser()
+  if (userId instanceof Response) return userId
+  const body = await readBody(req)
+  const subscription = body.subscription && typeof body.subscription === "object"
+    ? body.subscription as Record<string, unknown>
+    : body
+  const endpoint = typeof subscription.endpoint === "string" ? subscription.endpoint : ""
+  const keys = subscription.keys && typeof subscription.keys === "object"
+    ? subscription.keys as Record<string, unknown>
+    : {}
+  const p256dh = typeof keys.p256dh === "string" ? keys.p256dh : ""
+  const auth = typeof keys.auth === "string" ? keys.auth : ""
+  if (!endpoint || !p256dh || !auth) {
+    return Response.json({ error: "invalid push subscription" }, { status: 400 })
+  }
+  const db = dbOrThrow()
+  const appId = typeof body.appId === "string" && body.appId ? body.appId : ctx.appId ?? "app"
+  const existing = db.raw()
+    .prepare(
+      `SELECT id FROM ${SUBSCRIPTIONS_TABLE}
+        WHERE _owner = ? AND appId = ? AND endpoint = ?
+        LIMIT 1`,
+    )
+    .get(userId, appId, endpoint) as { id: string } | null
+  const patch = {
+    p256dh,
+    auth,
+    userAgent: req.headers.get("user-agent") ?? "",
+    disabledAt: 0,
+    lastSeenAt: Date.now(),
+    updatedAt: Date.now(),
+  }
+  if (existing) {
+    patchRaw(db, SUBSCRIPTIONS_TABLE, existing.id, patch)
+    return Response.json({ ok: true, id: existing.id })
+  }
+  const row = insertRaw(db, SUBSCRIPTIONS_TABLE, {
+    _owner: userId,
+    appId,
+    userId,
+    endpoint,
+    ...patch,
+    createdAt: Date.now(),
+  })
+  return Response.json({ ok: true, id: row.id })
+}
+
+export async function notificationsUnsubscribeHandler(req: Request): Promise<Response> {
+  const userId = requireUser()
+  if (userId instanceof Response) return userId
+  const body = await readBody(req)
+  const endpoint = typeof body.endpoint === "string" ? body.endpoint : ""
+  if (!endpoint) return Response.json({ error: "endpoint required" }, { status: 400 })
+  const db = dbOrThrow()
+  const appId = typeof body.appId === "string" && body.appId ? body.appId : ctx.appId ?? "app"
+  const rows = db.raw()
+    .prepare(
+      `SELECT id FROM ${SUBSCRIPTIONS_TABLE}
+        WHERE _owner = ? AND appId = ? AND endpoint = ?`,
+    )
+    .all(userId, appId, endpoint) as Array<{ id: string }>
+  for (const row of rows) {
+    patchRaw(db, SUBSCRIPTIONS_TABLE, row.id, { disabledAt: Date.now(), updatedAt: Date.now() })
+  }
+  return Response.json({ ok: true })
+}
+
+export async function notificationsReadHandler(req: Request): Promise<Response> {
+  const userId = requireUser()
+  if (userId instanceof Response) return userId
+  const body = await readBody(req)
+  const db = dbOrThrow()
+  const now = Date.now()
+  if (Array.isArray(body.ids)) {
+    for (const id of body.ids) {
+      if (typeof id !== "string") continue
+      const row = db.raw()
+        .prepare(`SELECT * FROM ${NOTIFICATIONS_TABLE} WHERE id = ? AND _owner = ? LIMIT 1`)
+        .get(id, userId) as Record<string, unknown> | null
+      if (row) patchRaw(db, NOTIFICATIONS_TABLE, id, { status: "read", readAt: now })
+    }
+    return Response.json({ ok: true })
+  }
+  if (body.all === true) {
+    const rows = db.raw()
+      .prepare(`SELECT id FROM ${NOTIFICATIONS_TABLE} WHERE _owner = ? AND status = 'unread'`)
+      .all(userId) as Array<{ id: string }>
+    for (const row of rows) {
+      patchRaw(db, NOTIFICATIONS_TABLE, row.id, { status: "read", readAt: now })
+    }
+    return Response.json({ ok: true, count: rows.length })
+  }
+  return Response.json({ error: "ids or all required" }, { status: 400 })
+}
+
+export async function notificationsCreateHandler(req: Request): Promise<Response> {
+  const userId = requireUser()
+  if (userId instanceof Response) return userId
+  const body = await readBody(req)
+  const row = await notify({
+    userId,
+    appId: typeof body.appId === "string" ? body.appId : undefined,
+    kind: typeof body.kind === "string" ? body.kind : "app_custom",
+    title: typeof body.title === "string" ? body.title : "Notification",
+    body: typeof body.body === "string" ? body.body : "",
+    url: typeof body.url === "string" ? body.url : "",
+    priority: body.priority === "low" || body.priority === "high" ? body.priority : "normal",
+    source: {
+      type: typeof body.sourceType === "string" ? body.sourceType : "",
+      id: typeof body.sourceId === "string" ? body.sourceId : "",
+    },
+    dedupeKey: typeof body.dedupeKey === "string" ? body.dedupeKey : undefined,
+    data: body.data && typeof body.data === "object" ? body.data as Record<string, unknown> : undefined,
+  })
+  return Response.json(row)
+}
+
+export function notificationServiceWorkerHandler(): Response {
+  return new Response(
+    `self.addEventListener("push", (event) => {
+  let payload = {};
+  try { payload = event.data ? event.data.json() : {}; } catch {}
+  const title = payload.title || "Notification";
+  const options = {
+    body: payload.body || "",
+    tag: payload.tag || payload.id || undefined,
+    data: { url: payload.url || "/", id: payload.id || "" },
+    icon: "/icons/pwa-192x192.png",
+    badge: "/icons/pwa-192x192.png",
+  };
+  event.waitUntil(self.registration.showNotification(title, options));
+});
+
+self.addEventListener("notificationclick", (event) => {
+  event.notification.close();
+  const url = (event.notification.data && event.notification.data.url) || "/";
+  event.waitUntil((async () => {
+    const allClients = await clients.matchAll({ type: "window", includeUncontrolled: true });
+    for (const client of allClients) {
+      if ("focus" in client) {
+        client.focus();
+        if ("navigate" in client) return client.navigate(url);
+        return;
+      }
+    }
+    if (clients.openWindow) return clients.openWindow(url);
+  })());
+});`,
+    {
+      headers: {
+        "content-type": "text/javascript; charset=utf-8",
+        "cache-control": "no-cache",
+        "service-worker-allowed": "/__vibes_push/",
+      },
+    },
+  )
+}