@open-mercato/core 0.4.2-canary-ed15f2e753 → 0.4.2-canary-e2aeb1a7bf

package/src/modules/notifications/lib/notificationRecipients.ts

@@ -0,0 +1,83 @@
+import type { Knex } from 'knex'
+import { hasFeature } from '@open-mercato/shared/security/features'
+
+interface AclRow {
+  user_id: string
+  features_json: unknown
+  is_super_admin: boolean
+}
+
+function normalizeFeatures(features: unknown): string[] | undefined {
+  if (!Array.isArray(features)) return undefined
+  const normalized = features.filter((feature): feature is string => typeof feature === 'string')
+  return normalized.length ? normalized : undefined
+}
+
+/**
+ * Extract user IDs from ACL rows that have the required feature or are super admins.
+ */
+function collectUsersWithFeature(
+  userIdsSet: Set<string>,
+  rows: AclRow[],
+  requiredFeature: string
+): void {
+  for (const row of rows) {
+    if (row.is_super_admin) {
+      userIdsSet.add(row.user_id)
+      continue
+    }
+
+    const features = normalizeFeatures(row.features_json)
+    if (features && hasFeature(features, requiredFeature)) {
+      userIdsSet.add(row.user_id)
+    }
+  }
+}
+
+export async function getRecipientUserIdsForRole(
+  knex: Knex,
+  tenantId: string,
+  roleId: string
+): Promise<string[]> {
+  const userRoles = await knex('user_roles')
+    .join('users', 'user_roles.user_id', 'users.id')
+    .where('user_roles.role_id', roleId)
+    .whereNull('user_roles.deleted_at')
+    .whereNull('users.deleted_at')
+    .where('users.tenant_id', tenantId)
+    .select('users.id as user_id')
+
+  return userRoles.map((row: { user_id: string }) => row.user_id)
+}
+
+export async function getRecipientUserIdsForFeature(
+  knex: Knex,
+  tenantId: string,
+  requiredFeature: string
+): Promise<string[]> {
+  const userIdsSet = new Set<string>()
+
+  const userAcls = await knex('user_acls')
+    .join('users', 'user_acls.user_id', 'users.id')
+    .where('user_acls.tenant_id', tenantId)
+    .whereNull('user_acls.deleted_at')
+    .whereNull('users.deleted_at')
+    .where('users.tenant_id', tenantId)
+    .select('users.id as user_id', 'user_acls.features_json', 'user_acls.is_super_admin')
+
+  collectUsersWithFeature(userIdsSet, userAcls, requiredFeature)
+
+  const roleAcls = await knex('role_acls')
+    .join('user_roles', 'role_acls.role_id', 'user_roles.role_id')
+    .join('users', 'user_roles.user_id', 'users.id')
+    .where('role_acls.tenant_id', tenantId)
+    .whereNull('role_acls.deleted_at')
+    .whereNull('user_roles.deleted_at')
+    .whereNull('users.deleted_at')
+    .where('users.tenant_id', tenantId)
+    .select('users.id as user_id', 'role_acls.features_json', 'role_acls.is_super_admin')
+
+  collectUsersWithFeature(userIdsSet, roleAcls, requiredFeature)
+
+  return Array.from(userIdsSet)
+}

package/src/modules/notifications/lib/notificationService.ts

@@ -0,0 +1,414 @@
+import type { EntityManager } from '@mikro-orm/core'
+import type { Knex } from 'knex'
+import { Notification } from '../data/entities'
+import type { CreateNotificationInput, CreateBatchNotificationInput, CreateRoleNotificationInput, CreateFeatureNotificationInput, ExecuteActionInput } from '../data/validators'
+import type { NotificationPollData } from '@open-mercato/shared/modules/notifications/types'
+import { NOTIFICATION_EVENTS } from './events'
+import { buildNotificationEntity, emitNotificationCreated, emitNotificationCreatedBatch } from './notificationFactory'
+import { toNotificationDto } from './notificationMapper'
+import { getRecipientUserIdsForFeature, getRecipientUserIdsForRole } from './notificationRecipients'
+
+const DEBUG = process.env.NOTIFICATIONS_DEBUG === 'true'
+
+function debug(...args: unknown[]): void {
+  if (DEBUG) {
+    console.log('[notifications]', ...args)
+  }
+}
+
+function getKnex(em: EntityManager): Knex {
+  return (em.getConnection() as unknown as { getKnex: () => Knex }).getKnex()
+}
+
+export interface NotificationServiceContext {
+  tenantId: string
+  organizationId?: string | null
+  userId?: string | null
+}
+
+export interface NotificationService {
+  create(input: CreateNotificationInput, ctx: NotificationServiceContext): Promise<Notification>
+  createBatch(input: CreateBatchNotificationInput, ctx: NotificationServiceContext): Promise<Notification[]>
+  createForRole(input: CreateRoleNotificationInput, ctx: NotificationServiceContext): Promise<Notification[]>
+  createForFeature(input: CreateFeatureNotificationInput, ctx: NotificationServiceContext): Promise<Notification[]>
+  markAsRead(notificationId: string, ctx: NotificationServiceContext): Promise<Notification>
+  markAllAsRead(ctx: NotificationServiceContext): Promise<number>
+  dismiss(notificationId: string, ctx: NotificationServiceContext): Promise<Notification>
+  restoreDismissed(
+    notificationId: string,
+    status: 'read' | 'unread' | undefined,
+    ctx: NotificationServiceContext
+  ): Promise<Notification>
+  executeAction(
+    notificationId: string,
+    input: ExecuteActionInput,
+    ctx: NotificationServiceContext
+  ): Promise<{ notification: Notification; result: unknown }>
+  getUnreadCount(ctx: NotificationServiceContext): Promise<number>
+  getPollData(ctx: NotificationServiceContext, since?: string): Promise<NotificationPollData>
+  cleanupExpired(): Promise<number>
+  deleteBySource(
+    sourceEntityType: string,
+    sourceEntityId: string,
+    ctx: NotificationServiceContext
+  ): Promise<number>
+}
+
+export interface NotificationServiceDeps {
+  em: EntityManager
+  eventBus: { emit: (event: string, payload: unknown) => Promise<void> }
+  commandBus?: {
+    execute: (
+      commandId: string,
+      options: { input: unknown; ctx: unknown; metadata?: unknown }
+    ) => Promise<{ result: unknown }>
+  }
+  container?: { resolve: (name: string) => unknown }
+}
+
+export function createNotificationService(deps: NotificationServiceDeps): NotificationService {
+  const { em: rootEm, eventBus, commandBus, container } = deps
+
+  return {
+    async create(input, ctx) {
+      const em = rootEm.fork()
+      const { recipientUserId, ...content } = input
+      const notification = buildNotificationEntity(em, content, recipientUserId, ctx)
+
+      await em.persistAndFlush(notification)
+
+      await emitNotificationCreated(eventBus, notification, ctx)
+
+      return notification
+    },
+
+    async createBatch(input, ctx) {
+      const em = rootEm.fork()
+      const { recipientUserIds, ...content } = input
+      const notifications: Notification[] = []
+
+      for (const recipientUserId of recipientUserIds) {
+        const notification = buildNotificationEntity(em, content, recipientUserId, ctx)
+        notifications.push(notification)
+      }
+
+      await em.persistAndFlush(notifications)
+
+      await emitNotificationCreatedBatch(eventBus, notifications, ctx)
+
+      return notifications
+    },
+
+    async createForRole(input, ctx) {
+      const em = rootEm.fork()
+
+      const knex = getKnex(em)
+      const recipientUserIds = await getRecipientUserIdsForRole(knex, ctx.tenantId, input.roleId)
+      if (recipientUserIds.length === 0) {
+        return []
+      }
+
+      const { roleId: _roleId, ...content } = input
+      const notifications: Notification[] = []
+
+      for (const recipientUserId of recipientUserIds) {
+        const notification = buildNotificationEntity(em, content, recipientUserId, ctx)
+        notifications.push(notification)
+      }
+
+      await em.persistAndFlush(notifications)
+
+      await emitNotificationCreatedBatch(eventBus, notifications, ctx)
+
+      return notifications
+    },
+
+    async createForFeature(input, ctx) {
+      const em = rootEm.fork()
+      const knex = getKnex(em)
+      const recipientUserIds = await getRecipientUserIdsForFeature(knex, ctx.tenantId, input.requiredFeature)
+
+      if (recipientUserIds.length === 0) {
+        debug('No users found with feature:', input.requiredFeature, 'in tenant:', ctx.tenantId)
+        return []
+      }
+
+      debug('Creating notifications for', recipientUserIds.length, 'user(s) with feature:', input.requiredFeature)
+
+      const { requiredFeature: _requiredFeature, ...content } = input
+      const notifications: Notification[] = []
+
+      for (const recipientUserId of recipientUserIds) {
+        const notification = buildNotificationEntity(em, content, recipientUserId, ctx)
+        notifications.push(notification)
+      }
+
+      await em.persistAndFlush(notifications)
+
+      await emitNotificationCreatedBatch(eventBus, notifications, ctx)
+
+      return notifications
+    },
+
+    async markAsRead(notificationId, ctx) {
+      const em = rootEm.fork()
+      const notification = await em.findOneOrFail(Notification, {
+        id: notificationId,
+        recipientUserId: ctx.userId,
+        tenantId: ctx.tenantId,
+      })
+
+      if (notification.status === 'unread') {
+        notification.status = 'read'
+        notification.readAt = new Date()
+        await em.flush()
+
+        await eventBus.emit(NOTIFICATION_EVENTS.READ, {
+          notificationId: notification.id,
+          userId: ctx.userId,
+          tenantId: ctx.tenantId,
+        })
+      }
+
+      return notification
+    },
+
+    async markAllAsRead(ctx) {
+      const em = rootEm.fork()
+      const knex = getKnex(em)
+
+      const result = await knex('notifications')
+        .where({
+          recipient_user_id: ctx.userId,
+          tenant_id: ctx.tenantId,
+          status: 'unread',
+        })
+        .update({
+          status: 'read',
+          read_at: knex.fn.now(),
+        })
+
+      return result
+    },
+
+    async dismiss(notificationId, ctx) {
+      const em = rootEm.fork()
+      const notification = await em.findOneOrFail(Notification, {
+        id: notificationId,
+        recipientUserId: ctx.userId,
+        tenantId: ctx.tenantId,
+      })
+
+      notification.status = 'dismissed'
+      notification.dismissedAt = new Date()
+      await em.flush()
+
+      await eventBus.emit(NOTIFICATION_EVENTS.DISMISSED, {
+        notificationId: notification.id,
+        userId: ctx.userId,
+        tenantId: ctx.tenantId,
+      })
+
+      return notification
+    },
+
+    async restoreDismissed(notificationId, status, ctx) {
+      const em = rootEm.fork()
+      const notification = await em.findOneOrFail(Notification, {
+        id: notificationId,
+        recipientUserId: ctx.userId,
+        tenantId: ctx.tenantId,
+      })
+
+      if (notification.status !== 'dismissed') {
+        return notification
+      }
+
+      const targetStatus = status ?? 'read'
+      notification.status = targetStatus
+      notification.dismissedAt = null
+
+      if (targetStatus === 'unread') {
+        notification.readAt = null
+      } else if (!notification.readAt) {
+        notification.readAt = new Date()
+      }
+
+      await em.flush()
+
+      await eventBus.emit(NOTIFICATION_EVENTS.RESTORED, {
+        notificationId: notification.id,
+        userId: ctx.userId,
+        tenantId: ctx.tenantId,
+        status: targetStatus,
+      })
+
+      return notification
+    },
+
+    async executeAction(notificationId, input, ctx) {
+      const em = rootEm.fork()
+      const notification = await em.findOneOrFail(Notification, {
+        id: notificationId,
+        recipientUserId: ctx.userId,
+        tenantId: ctx.tenantId,
+      })
+
+      const actionData = notification.actionData
+      const action = actionData?.actions?.find((a) => a.id === input.actionId)
+
+      if (!action) {
+        throw new Error('Action not found')
+      }
+
+      let result: unknown = null
+
+      if (action.commandId && commandBus && container) {
+        const commandInput = {
+          id: notification.sourceEntityId,
+          ...input.payload,
+        }
+
+        // Build a CommandRuntimeContext from the notification service context
+        const commandCtx = {
+          container,
+          auth: {
+            sub: ctx.userId,
+            tenantId: ctx.tenantId,
+            orgId: ctx.organizationId,
+          },
+          organizationScope: null,
+          selectedOrganizationId: ctx.organizationId ?? null,
+          organizationIds: ctx.organizationId ? [ctx.organizationId] : null,
+        }
+
+        const commandResult = await commandBus.execute(action.commandId, {
+          input: commandInput,
+          ctx: commandCtx,
+          metadata: {
+            tenantId: ctx.tenantId,
+            organizationId: ctx.organizationId,
+            resourceKind: 'notifications',
+          },
+        })
+
+        result = commandResult.result
+      }
+
+      notification.status = 'actioned'
+      notification.actionedAt = new Date()
+      notification.actionTaken = input.actionId
+      notification.actionResult = result as Record<string, unknown>
+
+      if (!notification.readAt) {
+        notification.readAt = new Date()
+      }
+
+      await em.flush()
+
+      await eventBus.emit(NOTIFICATION_EVENTS.ACTIONED, {
+        notificationId: notification.id,
+        actionId: input.actionId,
+        userId: ctx.userId,
+        tenantId: ctx.tenantId,
+      })
+
+      return { notification, result }
+    },
+
+    async getUnreadCount(ctx) {
+      const em = rootEm.fork()
+      return em.count(Notification, {
+        recipientUserId: ctx.userId,
+        tenantId: ctx.tenantId,
+        status: 'unread',
+      })
+    },
+
+    async getPollData(ctx, since) {
+      const em = rootEm.fork()
+      const filters: Record<string, unknown> = {
+        recipientUserId: ctx.userId,
+        tenantId: ctx.tenantId,
+      }
+
+      if (since) {
+        filters.createdAt = { $gt: new Date(since) }
+      }
+
+      const [notifications, unreadCount] = await Promise.all([
+        em.find(Notification, filters, {
+          orderBy: { createdAt: 'desc' },
+          limit: 50,
+        }),
+        em.count(Notification, {
+          recipientUserId: ctx.userId,
+          tenantId: ctx.tenantId,
+          status: 'unread',
+        }),
+      ])
+
+      const recent = notifications.map(toNotificationDto)
+      const hasNew = since ? recent.length > 0 : false
+
+      return {
+        unreadCount,
+        recent,
+        hasNew,
+        lastId: recent[0]?.id,
+      }
+    },
+
+    async cleanupExpired() {
+      const em = rootEm.fork()
+      const knex = getKnex(em)
+
+      const result = await knex('notifications')
+        .where('expires_at', '<', knex.fn.now())
+        .whereNotIn('status', ['actioned', 'dismissed'])
+        .update({
+          status: 'dismissed',
+          dismissed_at: knex.fn.now(),
+        })
+
+      return result
+    },
+
+    async deleteBySource(sourceEntityType, sourceEntityId, ctx) {
+      const em = rootEm.fork()
+      const knex = getKnex(em)
+
+      const result = await knex('notifications')
+        .where({
+          source_entity_type: sourceEntityType,
+          source_entity_id: sourceEntityId,
+          tenant_id: ctx.tenantId,
+        })
+        .delete()
+
+      return result
+    },
+  }
+}
+
+/**
+ * Helper to create notification service from a DI container.
+ * Use this in API routes and commands to avoid DI resolution issues.
+ */
+export function resolveNotificationService(container: {
+  resolve: (name: string) => unknown
+}): NotificationService {
+  const em = container.resolve('em') as EntityManager
+  const eventBus = container.resolve('eventBus') as { emit: (event: string, payload: unknown) => Promise<void> }
+
+  // commandBus may not be registered in all contexts, so resolve it safely
+  let commandBus: NotificationServiceDeps['commandBus']
+  try {
+    commandBus = container.resolve('commandBus') as typeof commandBus
+  } catch {
+    // commandBus not available - actions with commandId won't work
+    commandBus = undefined
+  }
+
+  return createNotificationService({ em, eventBus, commandBus, container })
+}

package/src/modules/notifications/lib/routeHelpers.ts

@@ -0,0 +1,151 @@
+import { z } from 'zod'
+import { resolveRequestContext } from '@open-mercato/shared/lib/api/context'
+import { resolveNotificationService, type NotificationService } from './notificationService'
+
+/**
+ * Notification scope context for service calls
+ */
+export interface NotificationScope {
+  tenantId: string
+  organizationId: string | null
+  userId: string | null
+}
+
+/**
+ * Resolved notification context from a request
+ */
+export interface NotificationRequestContext {
+  service: NotificationService
+  scope: NotificationScope
+  ctx: Awaited<ReturnType<typeof resolveRequestContext>>['ctx']
+}
+
+/**
+ * Resolve notification service and scope from a request.
+ * Centralizes the common pattern used across all notification API routes.
+ */
+export async function resolveNotificationContext(req: Request): Promise<NotificationRequestContext> {
+  const { ctx } = await resolveRequestContext(req)
+  return {
+    service: resolveNotificationService(ctx.container),
+    scope: {
+      tenantId: ctx.auth?.tenantId ?? '',
+      organizationId: ctx.selectedOrganizationId ?? null,
+      userId: ctx.auth?.sub ?? null,
+    },
+    ctx,
+  }
+}
+
+/**
+ * Create a POST handler for bulk notification creation routes.
+ * Used by batch, role, and feature notification endpoints.
+ */
+export function createBulkNotificationRoute<TSchema extends z.ZodTypeAny>(
+  schema: TSchema,
+  serviceMethod: 'createBatch' | 'createForRole' | 'createForFeature'
+) {
+  return async function POST(req: Request) {
+    const { service, scope } = await resolveNotificationContext(req)
+
+    const body = await req.json().catch(() => ({}))
+    const input = schema.parse(body)
+
+    const notifications = await service[serviceMethod](input as never, scope)
+
+    return Response.json({
+      ok: true,
+      count: notifications.length,
+      ids: notifications.map((n) => n.id),
+    }, { status: 201 })
+  }
+}
+
+/**
+ * Create OpenAPI spec for bulk notification creation routes.
+ */
+export function createBulkNotificationOpenApi<TSchema extends z.ZodTypeAny>(
+  schema: TSchema,
+  summary: string,
+  description?: string
+) {
+  return {
+    POST: {
+      summary,
+      description,
+      tags: ['Notifications'],
+      requestBody: {
+        required: true,
+        content: {
+          'application/json': {
+            schema,
+          },
+        },
+      },
+      responses: {
+        201: {
+          description: 'Notifications created',
+          content: {
+            'application/json': {
+              schema: z.object({
+                ok: z.boolean(),
+                count: z.number(),
+                ids: z.array(z.string().uuid()),
+              }),
+            },
+          },
+        },
+      },
+    },
+  }
+}
+
+/**
+ * Create a PUT handler for single notification action routes.
+ * Used by read and dismiss endpoints.
+ */
+export function createSingleNotificationActionRoute(
+  serviceMethod: 'markAsRead' | 'dismiss'
+) {
+  return async function PUT(req: Request, { params }: { params: Promise<{ id: string }> }) {
+    const { id } = await params
+    const { service, scope } = await resolveNotificationContext(req)
+
+    await service[serviceMethod](id, scope)
+
+    return Response.json({ ok: true })
+  }
+}
+
+/**
+ * Create OpenAPI spec for single notification action routes.
+ */
+export function createSingleNotificationActionOpenApi(
+  summary: string,
+  description: string
+) {
+  return {
+    PUT: {
+      summary,
+      tags: ['Notifications'],
+      parameters: [
+        {
+          name: 'id',
+          in: 'path',
+          required: true,
+          schema: { type: 'string', format: 'uuid' },
+        },
+      ],
+      responses: {
+        200: {
+          description,
+          content: {
+            'application/json': {
+              schema: z.object({ ok: z.boolean() }),
+            },
+          },
+        },
+      },
+    },
+  }
+}

package/src/modules/notifications/lib/safeHref.ts

@@ -0,0 +1,29 @@
+import type { NotificationAction } from '@open-mercato/shared/modules/notifications/types'
+
+export function isSafeNotificationHref(href: string): boolean {
+  return href.startsWith('/') && !href.startsWith('//')
+}
+
+export function assertSafeNotificationHref(href: string | undefined | null): string | undefined {
+  if (href == null) {
+    return undefined
+  }
+
+  if (!isSafeNotificationHref(href)) {
+    throw new Error('Notification href must be a same-origin relative path starting with /')
+  }
+
+  return href
+}
+
+export function sanitizeNotificationActions(
+  actions: NotificationAction[] | undefined
+): NotificationAction[] | undefined {
+  if (!actions) {
+    return undefined
+  }
+
+  return actions.map((action) => (
+    action.href ? { ...action, href: assertSafeNotificationHref(action.href) } : action
+  ))
+}