@open-mercato/core 0.4.2-canary-f6b7824b47 → 0.4.2-canary-70c8402224

package/src/modules/auth/i18n/es.json

@@ -80,6 +80,19 @@
   "auth.users.form.errors.load": "No se pudieron cargar los datos del usuario",
   "auth.users.form.errors.aclUpdate": "No se pudo actualizar el control de acceso del usuario",
   "auth.users.form.errors.delete": "No se pudo eliminar el usuario",
+  "auth.profile.title": "Perfil",
+  "auth.profile.form.email": "Correo electrónico",
+  "auth.profile.form.password": "Nueva contraseña",
+  "auth.profile.form.confirmPassword": "Confirmar nueva contraseña",
+  "auth.profile.form.save": "Guardar cambios",
+  "auth.profile.form.loading": "Cargando perfil...",
+  "auth.profile.form.errors.load": "No se pudo cargar el perfil.",
+  "auth.profile.form.errors.save": "No se pudo actualizar el perfil.",
+  "auth.profile.form.errors.invalid": "Actualización de perfil inválida.",
+  "auth.profile.form.errors.passwordMismatch": "Las contraseñas no coinciden.",
+  "auth.profile.form.errors.noChanges": "No hay cambios para guardar.",
+  "auth.profile.form.errors.emailRequired": "El correo electrónico es obligatorio.",
+  "auth.profile.form.success": "Perfil actualizado.",
   "auth.users.list.error.load": "No se pudieron cargar los usuarios",
   "auth.users.list.error.delete": "No se pudo eliminar el usuario",
   "auth.users.flash.created": "Usuario creado",
@@ -95,5 +108,20 @@
   "auth.email.resetPassword.title": "Restablecer tu contraseña",
   "auth.email.resetPassword.body": "Haz clic en el siguiente enlace para establecer una nueva contraseña. Este enlace caducará en 60 minutos.",
   "auth.email.resetPassword.cta": "Establecer nueva contraseña",
-  "auth.email.resetPassword.hint": "Si no solicitaste esto, puedes ignorar este correo de forma segura."
+  "auth.email.resetPassword.hint": "Si no solicitaste esto, puedes ignorar este correo de forma segura.",
+  "auth.notifications.passwordReset.requested.title": "Solicitud de restablecimiento de contraseña",
+  "auth.notifications.passwordReset.requested.body": "Se ha enviado un enlace de restablecimiento de contraseña a tu correo electrónico",
+  "auth.notifications.passwordReset.completed.title": "Contraseña cambiada correctamente",
+  "auth.notifications.passwordReset.completed.body": "Tu contraseña se actualizó correctamente",
+  "auth.notifications.account.locked.title": "Cuenta bloqueada",
+  "auth.notifications.account.locked.body": "Tu cuenta ha sido bloqueada por razones de seguridad. Ponte en contacto con soporte.",
+  "auth.notifications.login.newDevice.title": "Nuevo inicio de sesión detectado",
+  "auth.notifications.login.newDevice.body": "Se detectó un inicio de sesión desde un dispositivo no reconocido en tu cuenta",
+  "auth.notifications.role.assigned.title": "Nuevo rol asignado",
+  "auth.notifications.role.assigned.body": "Se te ha asignado un nuevo rol con permisos adicionales",
+  "auth.notifications.role.revoked.title": "Rol eliminado",
+  "auth.notifications.role.revoked.body": "Se ha eliminado un rol de tu cuenta",
+  "auth.actions.contactSupport": "Contactar soporte",
+  "auth.actions.viewSessions": "Ver sesiones",
+  "auth.actions.viewPermissions": "Ver permisos"
 }

package/src/modules/auth/i18n/pl.json

@@ -80,6 +80,19 @@
   "auth.users.form.errors.load": "Nie udało się wczytać danych użytkownika",
   "auth.users.form.errors.aclUpdate": "Nie udało się zaktualizować uprawnień użytkownika",
   "auth.users.form.errors.delete": "Nie udało się usunąć użytkownika",
+  "auth.profile.title": "Profil",
+  "auth.profile.form.email": "Email",
+  "auth.profile.form.password": "Nowe hasło",
+  "auth.profile.form.confirmPassword": "Potwierdź nowe hasło",
+  "auth.profile.form.save": "Zapisz zmiany",
+  "auth.profile.form.loading": "Ładowanie profilu...",
+  "auth.profile.form.errors.load": "Nie udało się wczytać profilu.",
+  "auth.profile.form.errors.save": "Nie udało się zaktualizować profilu.",
+  "auth.profile.form.errors.invalid": "Nieprawidłowa aktualizacja profilu.",
+  "auth.profile.form.errors.passwordMismatch": "Hasła nie są zgodne.",
+  "auth.profile.form.errors.noChanges": "Brak zmian do zapisania.",
+  "auth.profile.form.errors.emailRequired": "Email jest wymagany.",
+  "auth.profile.form.success": "Profil zaktualizowany.",
   "auth.users.list.error.load": "Nie udało się wczytać użytkowników",
   "auth.users.list.error.delete": "Nie udało się usunąć użytkownika",
   "auth.users.flash.created": "Użytkownik utworzony",
@@ -95,5 +108,20 @@
   "auth.email.resetPassword.title": "Zresetuj swoje hasło",
   "auth.email.resetPassword.body": "Kliknij poniższy link, aby ustawić nowe hasło. Link wygaśnie za 60 minut.",
   "auth.email.resetPassword.cta": "Ustaw nowe hasło",
-  "auth.email.resetPassword.hint": "Jeśli nie prosiłeś o tę wiadomość, możesz ją bezpiecznie zignorować."
+  "auth.email.resetPassword.hint": "Jeśli nie prosiłeś o tę wiadomość, możesz ją bezpiecznie zignorować.",
+  "auth.notifications.passwordReset.requested.title": "Żądanie resetu hasła",
+  "auth.notifications.passwordReset.requested.body": "Link do resetu hasła został wysłany na Twój adres e-mail",
+  "auth.notifications.passwordReset.completed.title": "Hasło zmienione pomyślnie",
+  "auth.notifications.passwordReset.completed.body": "Twoje hasło zostało pomyślnie zaktualizowane",
+  "auth.notifications.account.locked.title": "Konto zablokowane",
+  "auth.notifications.account.locked.body": "Twoje konto zostało zablokowane z powodów bezpieczeństwa. Skontaktuj się z pomocą techniczną.",
+  "auth.notifications.login.newDevice.title": "Wykryto logowanie z nowego urządzenia",
+  "auth.notifications.login.newDevice.body": "Wykryto logowanie z nieznanego urządzenia na Twoim koncie",
+  "auth.notifications.role.assigned.title": "Przypisano nową rolę",
+  "auth.notifications.role.assigned.body": "Przypisano Ci nową rolę z dodatkowymi uprawnieniami",
+  "auth.notifications.role.revoked.title": "Rola usunięta",
+  "auth.notifications.role.revoked.body": "Z Twojego konta usunięto rolę",
+  "auth.actions.contactSupport": "Skontaktuj się z pomocą",
+  "auth.actions.viewSessions": "Zobacz sesje",
+  "auth.actions.viewPermissions": "Zobacz uprawnienia"
 }

package/src/modules/auth/lib/setup-app.ts

@@ -395,6 +395,7 @@ async function ensureDefaultRoleAcls(
       'dashboards.*',
       'dashboards.admin.assign-widgets',
       'api_keys.*',
+      'notifications.manage',
       'perspectives.use',
       'perspectives.role_defaults',
       'business_rules.*',

package/src/modules/auth/notifications.ts

@@ -0,0 +1,109 @@
+import type { NotificationTypeDefinition } from '@open-mercato/shared/modules/notifications/types'
+
+export const notificationTypes: NotificationTypeDefinition[] = [
+  {
+    type: 'auth.password_reset.requested',
+    module: 'auth',
+    titleKey: 'auth.notifications.passwordReset.requested.title',
+    bodyKey: 'auth.notifications.passwordReset.requested.body',
+    icon: 'key',
+    severity: 'info',
+    actions: [
+      {
+        id: 'view',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/auth/profile',
+        icon: 'external-link',
+      },
+    ],
+    linkHref: '/backend/auth/profile',
+    expiresAfterHours: 24,
+  },
+  {
+    type: 'auth.password_reset.completed',
+    module: 'auth',
+    titleKey: 'auth.notifications.passwordReset.completed.title',
+    bodyKey: 'auth.notifications.passwordReset.completed.body',
+    icon: 'check-circle',
+    severity: 'success',
+    actions: [],
+    expiresAfterHours: 72,
+  },
+  {
+    type: 'auth.account.locked',
+    module: 'auth',
+    titleKey: 'auth.notifications.account.locked.title',
+    bodyKey: 'auth.notifications.account.locked.body',
+    icon: 'lock',
+    severity: 'warning',
+    actions: [
+      {
+        id: 'contact_support',
+        labelKey: 'auth.actions.contactSupport',
+        variant: 'default',
+        href: '/backend/support',
+        icon: 'mail',
+      },
+    ],
+    linkHref: '/backend/support',
+  },
+  {
+    type: 'auth.login.new_device',
+    module: 'auth',
+    titleKey: 'auth.notifications.login.newDevice.title',
+    bodyKey: 'auth.notifications.login.newDevice.body',
+    icon: 'smartphone',
+    severity: 'info',
+    actions: [
+      {
+        id: 'view_sessions',
+        labelKey: 'auth.actions.viewSessions',
+        variant: 'outline',
+        href: '/backend/auth/sessions',
+        icon: 'list',
+      },
+    ],
+    linkHref: '/backend/auth/sessions',
+    expiresAfterHours: 168, // 7 days
+  },
+  {
+    type: 'auth.role.assigned',
+    module: 'auth',
+    titleKey: 'auth.notifications.role.assigned.title',
+    bodyKey: 'auth.notifications.role.assigned.body',
+    icon: 'user-plus',
+    severity: 'success',
+    actions: [
+      {
+        id: 'view_permissions',
+        labelKey: 'auth.actions.viewPermissions',
+        variant: 'outline',
+        href: '/backend/auth/profile',
+        icon: 'shield',
+      },
+    ],
+    linkHref: '/backend/auth/profile',
+    expiresAfterHours: 168,
+  },
+  {
+    type: 'auth.role.revoked',
+    module: 'auth',
+    titleKey: 'auth.notifications.role.revoked.title',
+    bodyKey: 'auth.notifications.role.revoked.body',
+    icon: 'user-minus',
+    severity: 'warning',
+    actions: [
+      {
+        id: 'view_profile',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/auth/profile',
+      },
+    ],
+    linkHref: '/backend/auth/profile',
+    expiresAfterHours: 168,
+  },
+]
+
+export default notificationTypes

package/src/modules/auth/services/authService.ts

@@ -75,15 +75,15 @@ export class AuthService {
     return { user, token }
   }
 
-  async confirmPasswordReset(token: string, newPassword: string) {
+  async confirmPasswordReset(token: string, newPassword: string): Promise<User | null> {
     const now = new Date()
     const row = await this.em.findOne(PasswordReset, { token })
-    if (!row || (row.usedAt && row.usedAt <= now) || row.expiresAt <= now) return false
+    if (!row || (row.usedAt && row.usedAt <= now) || row.expiresAt <= now) return null
     const user = await this.em.findOne(User, { id: row.user.id })
-    if (!user) return false
+    if (!user) return null
     user.passwordHash = await hash(newPassword, 10)
     row.usedAt = new Date()
     await this.em.flush()
-    return true
+    return user
   }
 }

package/src/modules/business_rules/i18n/en.json

@@ -367,5 +367,7 @@
   "business_rules.components.conditionRow.field.comparisonPlaceholder": "e.g., user.role",
   "business_rules.components.conditionRow.value.help": "Use JSON for arrays: [\"a\",\"b\"]",
   "business_rules.components.conditionRow.field.comparisonHelp": "Field path to compare with",
-  "business_rules.components.conditionRow.deleteCondition": "Delete condition"
+  "business_rules.components.conditionRow.deleteCondition": "Delete condition",
+  "businessRules.notifications.rule.executionFailed.title": "Business Rule Failed",
+  "businessRules.notifications.rule.executionFailed.body": "Rule \"{ruleName}\" failed to execute{entityType, select, other { on {entityType}}}: {errorMessage}"
 }

package/src/modules/business_rules/notifications.ts

@@ -0,0 +1,25 @@
+import type { NotificationTypeDefinition } from '@open-mercato/shared/modules/notifications/types'
+
+export const notificationTypes: NotificationTypeDefinition[] = [
+  {
+    type: 'business_rules.rule.execution_failed',
+    module: 'business_rules',
+    titleKey: 'businessRules.notifications.rule.executionFailed.title',
+    bodyKey: 'businessRules.notifications.rule.executionFailed.body',
+    icon: 'alert-triangle',
+    severity: 'error',
+    actions: [
+      {
+        id: 'view',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/business-rules/{sourceEntityId}',
+        icon: 'external-link',
+      },
+    ],
+    linkHref: '/backend/business-rules/{sourceEntityId}',
+    expiresAfterHours: 168, // 7 days
+  },
+]
+
+export default notificationTypes

package/src/modules/business_rules/subscribers/rule-execution-failed-notification.ts

@@ -0,0 +1,50 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { resolveNotificationService } from '../../notifications/lib/notificationService'
+import { buildFeatureNotificationFromType } from '../../notifications/lib/notificationBuilder'
+import { notificationTypes } from '../notifications'
+
+export const metadata = {
+  event: 'business_rules.rule.execution_failed',
+  persistent: true,
+  id: 'business_rules:rule-execution-failed-notification',
+}
+
+type RuleExecutionFailedPayload = {
+  ruleId: string
+  ruleName: string
+  entityType?: string | null
+  errorMessage?: string | null
+  tenantId: string
+  organizationId?: string | null
+}
+
+type ResolverContext = {
+  resolve: <T = unknown>(name: string) => T
+}
+
+export default async function handle(payload: RuleExecutionFailedPayload, ctx: ResolverContext) {
+  try {
+    const notificationService = resolveNotificationService(ctx)
+    const typeDef = notificationTypes.find((type) => type.type === 'business_rules.rule.execution_failed')
+    if (!typeDef) return
+
+    const notificationInput = buildFeatureNotificationFromType(typeDef, {
+      requiredFeature: 'business_rules.manage',
+      bodyVariables: {
+        ruleName: payload.ruleName,
+        entityType: payload.entityType ?? '',
+        errorMessage: payload.errorMessage ?? 'Unknown error',
+      },
+      sourceEntityType: 'business_rules:rule',
+      sourceEntityId: payload.ruleId,
+      linkHref: `/backend/business-rules/${payload.ruleId}`,
+    })
+
+    await notificationService.createForFeature(notificationInput, {
+      tenantId: payload.tenantId,
+      organizationId: payload.organizationId ?? null,
+    })
+  } catch (err) {
+    console.error('[business_rules:rule-execution-failed-notification] Failed to create notification:', err)
+  }
+}

package/src/modules/catalog/i18n/en.json

@@ -681,5 +681,7 @@
         "deleteError": "Failed to delete variant."
       }
     }
-  }
+  },
+  "catalog.notifications.product.lowStock.title": "Low Stock Alert",
+  "catalog.notifications.product.lowStock.body": "{productName}{sku, select, other { ({sku})}} is running low on stock ({currentStock} remaining, threshold: {threshold})"
 }

package/src/modules/catalog/notifications.ts

@@ -0,0 +1,25 @@
+import type { NotificationTypeDefinition } from '@open-mercato/shared/modules/notifications/types'
+
+export const notificationTypes: NotificationTypeDefinition[] = [
+  {
+    type: 'catalog.product.low_stock',
+    module: 'catalog',
+    titleKey: 'catalog.notifications.product.lowStock.title',
+    bodyKey: 'catalog.notifications.product.lowStock.body',
+    icon: 'package-x',
+    severity: 'warning',
+    actions: [
+      {
+        id: 'view',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/catalog/products/{sourceEntityId}',
+        icon: 'external-link',
+      },
+    ],
+    linkHref: '/backend/catalog/products/{sourceEntityId}',
+    expiresAfterHours: 72, // 3 days
+  },
+]
+
+export default notificationTypes

package/src/modules/catalog/subscribers/low-stock-notification.ts

@@ -0,0 +1,52 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { resolveNotificationService } from '../../notifications/lib/notificationService'
+import { buildFeatureNotificationFromType } from '../../notifications/lib/notificationBuilder'
+import { notificationTypes } from '../notifications'
+
+export const metadata = {
+  event: 'catalog.product.stock_low',
+  persistent: true,
+  id: 'catalog:low-stock-notification',
+}
+
+type LowStockPayload = {
+  productId: string
+  productName: string
+  sku?: string | null
+  currentStock: number
+  threshold: number
+  tenantId: string
+  organizationId?: string | null
+}
+
+type ResolverContext = {
+  resolve: <T = unknown>(name: string) => T
+}
+
+export default async function handle(payload: LowStockPayload, ctx: ResolverContext) {
+  try {
+    const notificationService = resolveNotificationService(ctx)
+    const typeDef = notificationTypes.find((type) => type.type === 'catalog.product.low_stock')
+    if (!typeDef) return
+
+    const notificationInput = buildFeatureNotificationFromType(typeDef, {
+      requiredFeature: 'catalog.products.manage',
+      bodyVariables: {
+        productName: payload.productName,
+        sku: payload.sku ?? '',
+        currentStock: String(payload.currentStock),
+        threshold: String(payload.threshold),
+      },
+      sourceEntityType: 'catalog:product',
+      sourceEntityId: payload.productId,
+      linkHref: `/backend/catalog/products/${payload.productId}`,
+    })
+
+    await notificationService.createForFeature(notificationInput, {
+      tenantId: payload.tenantId,
+      organizationId: payload.organizationId ?? null,
+    })
+  } catch (err) {
+    console.error('[catalog:low-stock-notification] Failed to create notification:', err)
+  }
+}

package/src/modules/configs/cli.ts

@@ -2,6 +2,7 @@ import type { ModuleCli } from '@open-mercato/shared/modules/registry'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { ModuleConfigService } from './lib/module-config-service'
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
+import { DEFAULT_NOTIFICATION_DELIVERY_CONFIG, NOTIFICATIONS_DELIVERY_CONFIG_KEY } from '../notifications/lib/deliveryConfig'
 
 function envDisablesAutoIndexing(): boolean {
   const raw = process.env.DISABLE_VECTOR_SEARCH_AUTOINDEXING
@@ -31,6 +32,11 @@ const restoreDefaults: ModuleCli = {
             name: 'auto_index_enabled',
             value: defaultEnabled,
           },
+          {
+            moduleId: 'notifications',
+            name: NOTIFICATIONS_DELIVERY_CONFIG_KEY,
+            value: DEFAULT_NOTIFICATION_DELIVERY_CONFIG,
+          },
         ],
         { force: true },
       )

package/src/modules/customers/commands/deals.ts

@@ -35,6 +35,9 @@ import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import type { CrudIndexerConfig } from '@open-mercato/shared/lib/crud/types'
 import { E } from '#generated/entities.ids.generated'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { resolveNotificationService } from '../../notifications/lib/notificationService'
+import { buildNotificationFromType } from '../../notifications/lib/notificationBuilder'
+import { notificationTypes } from '../notifications'
 
 const DEAL_ENTITY_ID = 'customers:customer_deal'
 const dealCrudIndexer: CrudIndexerConfig<CustomerDeal> = {
@@ -281,6 +284,8 @@ const updateDealCommand: CommandHandler<DealUpdateInput, { dealId: string }> = {
     ensureTenantScope(ctx, record.tenantId)
     ensureOrganizationScope(ctx, record.organizationId)
 
+    const previousStatus = record.status
+
     if (parsed.title !== undefined) record.title = parsed.title
     if (parsed.description !== undefined) record.description = parsed.description ?? null
     if (parsed.status !== undefined) record.status = parsed.status ?? record.status
@@ -319,6 +324,40 @@ const updateDealCommand: CommandHandler<DealUpdateInput, { dealId: string }> = {
       indexer: dealCrudIndexer,
     })
 
+    // Send notifications for deal won/lost status changes
+    const newStatus = record.status
+    const normalizedStatus = newStatus === 'win' ? 'won' : newStatus === 'loose' ? 'lost' : newStatus
+    if (previousStatus !== newStatus && (normalizedStatus === 'won' || normalizedStatus === 'lost') && record.ownerUserId) {
+      try {
+        const notificationService = resolveNotificationService(ctx.container)
+        const notificationType = normalizedStatus === 'won' ? 'customers.deal.won' : 'customers.deal.lost'
+        const typeDef = notificationTypes.find((type) => type.type === notificationType)
+        if (typeDef) {
+          const valueDisplay = record.valueAmount && record.valueCurrency
+            ? `${record.valueCurrency} ${record.valueAmount}`
+            : ''
+
+          const notificationInput = buildNotificationFromType(typeDef, {
+            recipientUserId: record.ownerUserId,
+            bodyVariables: {
+              dealTitle: record.title,
+              dealValue: valueDisplay,
+            },
+            sourceEntityType: 'customers:customer_deal',
+            sourceEntityId: record.id,
+            linkHref: `/backend/customers/deals/${record.id}`,
+          })
+
+          await notificationService.create(notificationInput, {
+            tenantId: record.tenantId,
+            organizationId: record.organizationId,
+          })
+        }
+      } catch {
+        // Notification creation is non-critical, don't fail the command
+      }
+    }
+
     return { dealId: record.id }
   },
   buildLog: async ({ snapshots, ctx }) => {

package/src/modules/customers/i18n/en.json

@@ -943,5 +943,9 @@
   "customers.workPlan.customerTodos.table.state.empty": "No customer tasks yet.",
   "customers.workPlan.customerTodos.table.error.load": "Failed to load customer tasks.",
   "customers.workPlan.customerTodos.table.export.view": "Exports the current list with filters and visible columns.",
-  "customers.workPlan.customerTodos.table.export.full": "Exports every linked task field, including hidden attributes."
+  "customers.workPlan.customerTodos.table.export.full": "Exports every linked task field, including hidden attributes.",
+  "customers.notifications.deal.won.title": "Deal Won",
+  "customers.notifications.deal.won.body": "{dealTitle} has been marked as won{dealValue, select, other { ({dealValue})}}",
+  "customers.notifications.deal.lost.title": "Deal Lost",
+  "customers.notifications.deal.lost.body": "{dealTitle} has been marked as lost"
 }

package/src/modules/customers/notifications.ts

@@ -0,0 +1,44 @@
+import type { NotificationTypeDefinition } from '@open-mercato/shared/modules/notifications/types'
+
+export const notificationTypes: NotificationTypeDefinition[] = [
+  {
+    type: 'customers.deal.won',
+    module: 'customers',
+    titleKey: 'customers.notifications.deal.won.title',
+    bodyKey: 'customers.notifications.deal.won.body',
+    icon: 'trophy',
+    severity: 'success',
+    actions: [
+      {
+        id: 'view',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/customers/deals/{sourceEntityId}',
+        icon: 'external-link',
+      },
+    ],
+    linkHref: '/backend/customers/deals/{sourceEntityId}',
+    expiresAfterHours: 168, // 7 days
+  },
+  {
+    type: 'customers.deal.lost',
+    module: 'customers',
+    titleKey: 'customers.notifications.deal.lost.title',
+    bodyKey: 'customers.notifications.deal.lost.body',
+    icon: 'x-circle',
+    severity: 'warning',
+    actions: [
+      {
+        id: 'view',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/customers/deals/{sourceEntityId}',
+        icon: 'external-link',
+      },
+    ],
+    linkHref: '/backend/customers/deals/{sourceEntityId}',
+    expiresAfterHours: 168, // 7 days
+  },
+]
+
+export default notificationTypes

package/src/modules/notifications/acl.ts

@@ -0,0 +1,7 @@
+export const features = [
+  { id: 'notifications.view', title: 'View own notifications', module: 'notifications' },
+  { id: 'notifications.create', title: 'Create notifications for others', module: 'notifications' },
+  { id: 'notifications.manage', title: 'Manage all notifications', module: 'notifications' },
+]
+
+export default features

package/src/modules/notifications/api/[id]/action/route.ts

@@ -0,0 +1,70 @@
+import { executeActionSchema } from '../../../data/validators'
+import { actionResultResponseSchema } from '../../openapi'
+import { resolveNotificationContext } from '../../../lib/routeHelpers'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+
+export const metadata = {
+  POST: { requireAuth: true },
+}
+
+export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const { service, scope } = await resolveNotificationContext(req)
+
+  const body = await req.json().catch(() => ({}))
+  const input = executeActionSchema.parse(body)
+
+  try {
+    const { notification, result } = await service.executeAction(id, input, scope)
+
+    const action = notification.actionData?.actions?.find((a) => a.id === input.actionId)
+    const href = action?.href?.replace('{sourceEntityId}', notification.sourceEntityId ?? '')
+
+    return Response.json({
+      ok: true,
+      result,
+      href,
+    })
+  } catch (error) {
+    const { t } = await resolveTranslations()
+    const fallback = t('notifications.error.action', 'Failed to execute action')
+    const message = error instanceof Error && error.message ? error.message : fallback
+    return Response.json({ error: message }, { status: 400 })
+  }
+}
+
+export const openApi = {
+  POST: {
+    summary: 'Execute notification action',
+    tags: ['Notifications'],
+    parameters: [
+      {
+        name: 'id',
+        in: 'path',
+        required: true,
+        schema: { type: 'string', format: 'uuid' },
+      },
+    ],
+    requestBody: {
+      required: true,
+      content: {
+        'application/json': {
+          schema: executeActionSchema,
+        },
+      },
+    },
+    responses: {
+      200: {
+        description: 'Action executed successfully',
+        content: {
+          'application/json': {
+            schema: actionResultResponseSchema,
+          },
+        },
+      },
+      400: {
+        description: 'Action not found or failed',
+      },
+    },
+  },
+}

package/src/modules/notifications/api/[id]/dismiss/route.ts

@@ -0,0 +1,12 @@
+import { createSingleNotificationActionRoute, createSingleNotificationActionOpenApi } from '../../../lib/routeHelpers'
+
+export const metadata = {
+  PUT: { requireAuth: true },
+}
+
+export const PUT = createSingleNotificationActionRoute('dismiss')
+
+export const openApi = createSingleNotificationActionOpenApi(
+  'Dismiss notification',
+  'Notification dismissed'
+)

package/src/modules/notifications/api/[id]/read/route.ts

@@ -0,0 +1,12 @@
+import { createSingleNotificationActionRoute, createSingleNotificationActionOpenApi } from '../../../lib/routeHelpers'
+
+export const metadata = {
+  PUT: { requireAuth: true },
+}
+
+export const PUT = createSingleNotificationActionRoute('markAsRead')
+
+export const openApi = createSingleNotificationActionOpenApi(
+  'Mark notification as read',
+  'Notification marked as read'
+)