@open-mercato/core 0.6.7-develop.6863.1.61001cf9a8 → 0.6.7

package/dist/modules/notifications/api/route.js

@@ -1,19 +1,7 @@
-import { createHash } from "node:crypto";
 import { z } from "zod";
-import { runWithCacheTenant } from "@open-mercato/cache";
-import {
-  buildCollectionTags,
-  debugCrudCache,
-  isCrudCacheEnabled,
-  resolveCrudCache
-} from "@open-mercato/shared/lib/crud/cache";
 import { Notification } from "../data/entities.js";
 import { listNotificationsSchema, createNotificationSchema } from "../data/validators.js";
 import { toNotificationDto } from "../lib/notificationMapper.js";
-import {
-  buildNotificationReadScopeWhere,
-  getNotificationReadScopeTagOrganizationIds
-} from "../lib/notificationScope.js";
 import {
   NOTIFICATION_RESOURCE_KIND,
   notificationCrudErrorResponse,
@@ -30,61 +18,15 @@ const metadata = {
   GET: { requireAuth: true },
   POST: { requireAuth: true, requireFeatures: ["notifications.create"] }
 };
-const NOTIFICATIONS_LIST_TTL_MS = 1e4;
-const NOTIFICATIONS_LIST_CACHE_VERSION = 2;
-const NOTIFICATIONS_LIST_RESOURCE = "notifications.notification";
-function buildNotificationsListCacheKey(userId, organizationScope, input) {
-  const normalizedIds = Array.from(new Set(
-    organizationScope.organizationIds.filter((value) => value.trim().length > 0)
-  )).sort((left, right) => left.localeCompare(right));
-  const scopeKey = normalizedIds.length === 0 ? "no-access" : `${organizationScope.organizationId ?? "none"}:scope=${createHash("sha256").update(normalizedIds.join("\0")).digest("hex").slice(0, 16)}`;
-  const filterSignature = JSON.stringify({
-    status: Array.isArray(input.status) ? [...input.status].sort((left, right) => left.localeCompare(right)) : input.status ?? null,
-    type: input.type ?? null,
-    severity: input.severity ?? null,
-    sourceEntityType: input.sourceEntityType ?? null,
-    sourceEntityId: input.sourceEntityId ?? null,
-    since: input.since ?? null,
-    page: input.page,
-    pageSize: input.pageSize
-  });
-  return `notifications:list:v${NOTIFICATIONS_LIST_CACHE_VERSION}:u=${userId}:org=${scopeKey}:filters=${filterSignature}`;
-}
-function isNotificationsListPayload(value) {
-  if (!value || typeof value !== "object") return false;
-  const payload = value;
-  return Array.isArray(payload.items) && typeof payload.total === "number" && typeof payload.page === "number" && typeof payload.pageSize === "number" && typeof payload.totalPages === "number";
-}
 async function GET(req) {
   const { ctx, scope } = await resolveNotificationContext(req);
   const em = ctx.container.resolve("em");
   const url = new URL(req.url);
   const queryParams = Object.fromEntries(url.searchParams.entries());
   const input = listNotificationsSchema.parse(queryParams);
-  const userId = scope.userId;
-  const cacheableOrganizationIds = Array.isArray(scope.organizationIds) ? scope.organizationIds : null;
-  const cache = userId && cacheableOrganizationIds && isCrudCacheEnabled() ? resolveCrudCache(ctx.container) : null;
-  const cacheKey = cache && userId && cacheableOrganizationIds ? buildNotificationsListCacheKey(
-    userId,
-    { organizationId: scope.organizationId, organizationIds: cacheableOrganizationIds },
-    input
-  ) : null;
-  if (cache && cacheKey) {
-    try {
-      const cached = await runWithCacheTenant(scope.tenantId, () => cache.get(cacheKey));
-      if (isNotificationsListPayload(cached)) {
-        return Response.json(cached);
-      }
-    } catch (error) {
-      debugCrudCache("notifications-list-cache-read-failed", {
-        error: error instanceof Error ? error.message : String(error)
-      });
-    }
-  }
   const filters = {
-    recipientUserId: userId,
-    tenantId: scope.tenantId,
-    ...buildNotificationReadScopeWhere(scope)
+    recipientUserId: scope.userId,
+    tenantId: scope.tenantId
   };
   if (input.status) {
     filters.status = Array.isArray(input.status) ? { $in: input.status } : input.status;
@@ -115,33 +57,13 @@ async function GET(req) {
     em.count(Notification, filters)
   ]);
   const items = notifications.map(toNotificationDto);
-  const payload = {
+  return Response.json({
     items,
     total,
     page: input.page,
     pageSize: input.pageSize,
     totalPages: Math.ceil(total / input.pageSize)
-  };
-  if (cache && cacheKey) {
-    try {
-      await runWithCacheTenant(
-        scope.tenantId,
-        () => cache.set(cacheKey, payload, {
-          ttl: NOTIFICATIONS_LIST_TTL_MS,
-          tags: buildCollectionTags(
-            NOTIFICATIONS_LIST_RESOURCE,
-            scope.tenantId,
-            getNotificationReadScopeTagOrganizationIds(scope)
-          )
-        })
-      );
-    } catch (error) {
-      debugCrudCache("notifications-list-cache-write-failed", {
-        error: error instanceof Error ? error.message : String(error)
-      });
-    }
-  }
-  return Response.json(payload);
+  });
 }
 async function POST(req) {
   const { service, scope, ctx } = await resolveNotificationContext(req);
@@ -183,7 +105,6 @@ const openApi = buildNotificationsCrudOpenApi({
 export {
   GET,
   POST,
-  buildNotificationsListCacheKey,
   metadata,
   openApi
 };

package/dist/modules/notifications/api/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/notifications/api/route.ts"],
-  "sourcesContent": ["import { createHash } from 'node:crypto'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/core'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport {\n  buildCollectionTags,\n  debugCrudCache,\n  isCrudCacheEnabled,\n  resolveCrudCache,\n} from '@open-mercato/shared/lib/crud/cache'\nimport { Notification } from '../data/entities'\nimport { listNotificationsSchema, createNotificationSchema } from '../data/validators'\nimport { toNotificationDto } from '../lib/notificationMapper'\nimport {\n  buildNotificationReadScopeWhere,\n  getNotificationReadScopeTagOrganizationIds,\n} from '../lib/notificationScope'\nimport {\n  NOTIFICATION_RESOURCE_KIND,\n  notificationCrudErrorResponse,\n  notificationValidationErrorResponse,\n  resolveNotificationContext,\n  runGuardedNotificationWrite,\n} from '../lib/routeHelpers'\nimport {\n  buildNotificationsCrudOpenApi,\n  createPagedListResponseSchema,\n  notificationItemSchema,\n} from './openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  POST: { requireAuth: true, requireFeatures: ['notifications.create'] },\n}\n\nconst NOTIFICATIONS_LIST_TTL_MS = 10_000\n// v2: the key gained the selected-organization scope (#4840). Bumping the version\n// retires v1 entries, which were shared across organizations for the same user.\nconst NOTIFICATIONS_LIST_CACHE_VERSION = 2\nconst NOTIFICATIONS_LIST_RESOURCE = 'notifications.notification'\n\ntype NotificationsListPayload = {\n  items: ReturnType<typeof toNotificationDto>[]\n  total: number\n  page: number\n  pageSize: number\n  totalPages: number\n}\n\nexport function buildNotificationsListCacheKey(\n  userId: string,\n  organizationScope: { organizationId: string | null; organizationIds: string[] },\n  input: z.infer<typeof listNotificationsSchema>,\n): string {\n  const normalizedIds = Array.from(new Set(\n    organizationScope.organizationIds.filter((value) => value.trim().length > 0),\n  )).sort((left, right) => left.localeCompare(right))\n  const scopeKey = normalizedIds.length === 0\n    ? 'no-access'\n    : `${organizationScope.organizationId ?? 'none'}:scope=${createHash('sha256')\n        .update(normalizedIds.join('\\0'))\n        .digest('hex')\n        .slice(0, 16)}`\n  const filterSignature = JSON.stringify({\n    status: Array.isArray(input.status)\n      ? [...input.status].sort((left, right) => left.localeCompare(right))\n      : input.status ?? null,\n    type: input.type ?? null,\n    severity: input.severity ?? null,\n    sourceEntityType: input.sourceEntityType ?? null,\n    sourceEntityId: input.sourceEntityId ?? null,\n    since: input.since ?? null,\n    page: input.page,\n    pageSize: input.pageSize,\n  })\n  return `notifications:list:v${NOTIFICATIONS_LIST_CACHE_VERSION}:u=${userId}:org=${scopeKey}:filters=${filterSignature}`\n}\n\nfunction isNotificationsListPayload(value: unknown): value is NotificationsListPayload {\n  if (!value || typeof value !== 'object') return false\n  const payload = value as Partial<NotificationsListPayload>\n  return (\n    Array.isArray(payload.items)\n    && typeof payload.total === 'number'\n    && typeof payload.page === 'number'\n    && typeof payload.pageSize === 'number'\n    && typeof payload.totalPages === 'number'\n  )\n}\n\nexport async function GET(req: Request) {\n  const { ctx, scope } = await resolveNotificationContext(req)\n  const em = ctx.container.resolve('em') as EntityManager\n\n  const url = new URL(req.url)\n  const queryParams = Object.fromEntries(url.searchParams.entries())\n  const input = listNotificationsSchema.parse(queryParams)\n  const userId = scope.userId\n  // Mirrors api/unread-count/route.ts: unrestricted and omitted legacy organization\n  // scopes cannot be safely tagged for invalidation, because organization-specific\n  // writes only invalidate their own collection tag. Leave those scopes uncached\n  // rather than serving a stale tenant-wide list until the TTL expires.\n  const cacheableOrganizationIds = Array.isArray(scope.organizationIds)\n    ? scope.organizationIds\n    : null\n  const cache = userId && cacheableOrganizationIds && isCrudCacheEnabled()\n    ? resolveCrudCache(ctx.container)\n    : null\n  const cacheKey = cache && userId && cacheableOrganizationIds\n    ? buildNotificationsListCacheKey(\n        userId,\n        { organizationId: scope.organizationId, organizationIds: cacheableOrganizationIds },\n        input,\n      )\n    : null\n\n  if (cache && cacheKey) {\n    try {\n      const cached = await runWithCacheTenant(scope.tenantId, () => cache.get(cacheKey))\n      if (isNotificationsListPayload(cached)) {\n        return Response.json(cached)\n      }\n    } catch (error) {\n      debugCrudCache('notifications-list-cache-read-failed', {\n        error: error instanceof Error ? error.message : String(error),\n      })\n    }\n  }\n\n  const filters: Record<string, unknown> = {\n    recipientUserId: userId,\n    tenantId: scope.tenantId,\n    ...buildNotificationReadScopeWhere(scope),\n  }\n\n  if (input.status) {\n    filters.status = Array.isArray(input.status) ? { $in: input.status } : input.status\n  } else {\n    filters.status = { $ne: 'dismissed' }\n  }\n  if (input.type) {\n    filters.type = input.type\n  }\n  if (input.severity) {\n    filters.severity = input.severity\n  }\n  if (input.sourceEntityType) {\n    filters.sourceEntityType = input.sourceEntityType\n  }\n  if (input.sourceEntityId) {\n    filters.sourceEntityId = input.sourceEntityId\n  }\n  if (input.since) {\n    filters.createdAt = { $gt: new Date(input.since) }\n  }\n\n  const [notifications, total] = await Promise.all([\n    em.find(Notification, filters, {\n      orderBy: { createdAt: 'desc' },\n      limit: input.pageSize,\n      offset: (input.page - 1) * input.pageSize,\n    }),\n    em.count(Notification, filters),\n  ])\n\n  const items = notifications.map(toNotificationDto)\n\n  const payload: NotificationsListPayload = {\n    items,\n    total,\n    page: input.page,\n    pageSize: input.pageSize,\n    totalPages: Math.ceil(total / input.pageSize),\n  }\n\n  if (cache && cacheKey) {\n    try {\n      await runWithCacheTenant(scope.tenantId, () =>\n        cache.set(cacheKey, payload, {\n          ttl: NOTIFICATIONS_LIST_TTL_MS,\n          tags: buildCollectionTags(\n            NOTIFICATIONS_LIST_RESOURCE,\n            scope.tenantId,\n            getNotificationReadScopeTagOrganizationIds(scope),\n          ),\n        }),\n      )\n    } catch (error) {\n      debugCrudCache('notifications-list-cache-write-failed', {\n        error: error instanceof Error ? error.message : String(error),\n      })\n    }\n  }\n\n  return Response.json(payload)\n}\n\nexport async function POST(req: Request) {\n  const { service, scope, ctx } = await resolveNotificationContext(req)\n\n  const body = await req.json().catch(() => ({}))\n  const parsed = createNotificationSchema.safeParse(body)\n  if (!parsed.success) {\n    return notificationValidationErrorResponse(parsed.error)\n  }\n\n  try {\n    const guarded = await runGuardedNotificationWrite(\n      ctx.container,\n      scope,\n      req,\n      {\n        resourceKind: NOTIFICATION_RESOURCE_KIND,\n        operation: 'create',\n        payload: parsed.data as Record<string, unknown>,\n      },\n      () => service.create(parsed.data, scope),\n    )\n    if (!guarded.ok) return guarded.response\n\n    return Response.json({ id: guarded.result.id }, { status: 201 })\n  } catch (error) {\n    const errorResponse = notificationCrudErrorResponse(error)\n    if (errorResponse) return errorResponse\n    throw error\n  }\n}\n\nexport const openApi = buildNotificationsCrudOpenApi({\n  resourceName: 'Notification',\n  querySchema: listNotificationsSchema,\n  listResponseSchema: createPagedListResponseSchema(notificationItemSchema),\n  create: {\n    schema: createNotificationSchema,\n    responseSchema: z.object({ id: z.string().uuid() }),\n    description: 'Creates a notification for a user.',\n  },\n})\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,yBAAyB,gCAAgC;AAClE,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACvE;AAEA,MAAM,4BAA4B;AAGlC,MAAM,mCAAmC;AACzC,MAAM,8BAA8B;AAU7B,SAAS,+BACd,QACA,mBACA,OACQ;AACR,QAAM,gBAAgB,MAAM,KAAK,IAAI;AAAA,IACnC,kBAAkB,gBAAgB,OAAO,CAAC,UAAU,MAAM,KAAK,EAAE,SAAS,CAAC;AAAA,EAC7E,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AAClD,QAAM,WAAW,cAAc,WAAW,IACtC,cACA,GAAG,kBAAkB,kBAAkB,MAAM,UAAU,WAAW,QAAQ,EACvE,OAAO,cAAc,KAAK,IAAI,CAAC,EAC/B,OAAO,KAAK,EACZ,MAAM,GAAG,EAAE,CAAC;AACnB,QAAM,kBAAkB,KAAK,UAAU;AAAA,IACrC,QAAQ,MAAM,QAAQ,MAAM,MAAM,IAC9B,CAAC,GAAG,MAAM,MAAM,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC,IACjE,MAAM,UAAU;AAAA,IACpB,MAAM,MAAM,QAAQ;AAAA,IACpB,UAAU,MAAM,YAAY;AAAA,IAC5B,kBAAkB,MAAM,oBAAoB;AAAA,IAC5C,gBAAgB,MAAM,kBAAkB;AAAA,IACxC,OAAO,MAAM,SAAS;AAAA,IACtB,MAAM,MAAM;AAAA,IACZ,UAAU,MAAM;AAAA,EAClB,CAAC;AACD,SAAO,uBAAuB,gCAAgC,MAAM,MAAM,QAAQ,QAAQ,YAAY,eAAe;AACvH;AAEA,SAAS,2BAA2B,OAAmD;AACrF,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,UAAU;AAChB,SACE,MAAM,QAAQ,QAAQ,KAAK,KACxB,OAAO,QAAQ,UAAU,YACzB,OAAO,QAAQ,SAAS,YACxB,OAAO,QAAQ,aAAa,YAC5B,OAAO,QAAQ,eAAe;AAErC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,2BAA2B,GAAG;AAC3D,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AAErC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,cAAc,OAAO,YAAY,IAAI,aAAa,QAAQ,CAAC;AACjE,QAAM,QAAQ,wBAAwB,MAAM,WAAW;AACvD,QAAM,SAAS,MAAM;AAKrB,QAAM,2BAA2B,MAAM,QAAQ,MAAM,eAAe,IAChE,MAAM,kBACN;AACJ,QAAM,QAAQ,UAAU,4BAA4B,mBAAmB,IACnE,iBAAiB,IAAI,SAAS,IAC9B;AACJ,QAAM,WAAW,SAAS,UAAU,2BAChC;AAAA,IACE;AAAA,IACA,EAAE,gBAAgB,MAAM,gBAAgB,iBAAiB,yBAAyB;AAAA,IAClF;AAAA,EACF,IACA;AAEJ,MAAI,SAAS,UAAU;AACrB,QAAI;AACF,YAAM,SAAS,MAAM,mBAAmB,MAAM,UAAU,MAAM,MAAM,IAAI,QAAQ,CAAC;AACjF,UAAI,2BAA2B,MAAM,GAAG;AACtC,eAAO,SAAS,KAAK,MAAM;AAAA,MAC7B;AAAA,IACF,SAAS,OAAO;AACd,qBAAe,wCAAwC;AAAA,QACrD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,UAAmC;AAAA,IACvC,iBAAiB;AAAA,IACjB,UAAU,MAAM;AAAA,IAChB,GAAG,gCAAgC,KAAK;AAAA,EAC1C;AAEA,MAAI,MAAM,QAAQ;AAChB,YAAQ,SAAS,MAAM,QAAQ,MAAM,MAAM,IAAI,EAAE,KAAK,MAAM,OAAO,IAAI,MAAM;AAAA,EAC/E,OAAO;AACL,YAAQ,SAAS,EAAE,KAAK,YAAY;AAAA,EACtC;AACA,MAAI,MAAM,MAAM;AACd,YAAQ,OAAO,MAAM;AAAA,EACvB;AACA,MAAI,MAAM,UAAU;AAClB,YAAQ,WAAW,MAAM;AAAA,EAC3B;AACA,MAAI,MAAM,kBAAkB;AAC1B,YAAQ,mBAAmB,MAAM;AAAA,EACnC;AACA,MAAI,MAAM,gBAAgB;AACxB,YAAQ,iBAAiB,MAAM;AAAA,EACjC;AACA,MAAI,MAAM,OAAO;AACf,YAAQ,YAAY,EAAE,KAAK,IAAI,KAAK,MAAM,KAAK,EAAE;AAAA,EACnD;AAEA,QAAM,CAAC,eAAe,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC/C,GAAG,KAAK,cAAc,SAAS;AAAA,MAC7B,SAAS,EAAE,WAAW,OAAO;AAAA,MAC7B,OAAO,MAAM;AAAA,MACb,SAAS,MAAM,OAAO,KAAK,MAAM;AAAA,IACnC,CAAC;AAAA,IACD,GAAG,MAAM,cAAc,OAAO;AAAA,EAChC,CAAC;AAED,QAAM,QAAQ,cAAc,IAAI,iBAAiB;AAEjD,QAAM,UAAoC;AAAA,IACxC;AAAA,IACA;AAAA,IACA,MAAM,MAAM;AAAA,IACZ,UAAU,MAAM;AAAA,IAChB,YAAY,KAAK,KAAK,QAAQ,MAAM,QAAQ;AAAA,EAC9C;AAEA,MAAI,SAAS,UAAU;AACrB,QAAI;AACF,YAAM;AAAA,QAAmB,MAAM;AAAA,QAAU,MACvC,MAAM,IAAI,UAAU,SAAS;AAAA,UAC3B,KAAK;AAAA,UACL,MAAM;AAAA,YACJ;AAAA,YACA,MAAM;AAAA,YACN,2CAA2C,KAAK;AAAA,UAClD;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,SAAS,OAAO;AACd,qBAAe,yCAAyC;AAAA,QACtD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,SAAS,KAAK,OAAO;AAC9B;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,SAAS,OAAO,IAAI,IAAI,MAAM,2BAA2B,GAAG;AAEpE,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,SAAS,yBAAyB,UAAU,IAAI;AACtD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,oCAAoC,OAAO,KAAK;AAAA,EACzD;AAEA,MAAI;AACF,UAAM,UAAU,MAAM;AAAA,MACpB,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,QACE,cAAc;AAAA,QACd,WAAW;AAAA,QACX,SAAS,OAAO;AAAA,MAClB;AAAA,MACA,MAAM,QAAQ,OAAO,OAAO,MAAM,KAAK;AAAA,IACzC;AACA,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAEhC,WAAO,SAAS,KAAK,EAAE,IAAI,QAAQ,OAAO,GAAG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjE,SAAS,OAAO;AACd,UAAM,gBAAgB,8BAA8B,KAAK;AACzD,QAAI,cAAe,QAAO;AAC1B,UAAM;AAAA,EACR;AACF;AAEO,MAAM,UAAU,8BAA8B;AAAA,EACnD,cAAc;AAAA,EACd,aAAa;AAAA,EACb,oBAAoB,8BAA8B,sBAAsB;AAAA,EACxE,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAClD,aAAa;AAAA,EACf;AACF,CAAC;",
+  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/core'\nimport { Notification } from '../data/entities'\nimport { listNotificationsSchema, createNotificationSchema } from '../data/validators'\nimport { toNotificationDto } from '../lib/notificationMapper'\nimport {\n  NOTIFICATION_RESOURCE_KIND,\n  notificationCrudErrorResponse,\n  notificationValidationErrorResponse,\n  resolveNotificationContext,\n  runGuardedNotificationWrite,\n} from '../lib/routeHelpers'\nimport {\n  buildNotificationsCrudOpenApi,\n  createPagedListResponseSchema,\n  notificationItemSchema,\n} from './openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  POST: { requireAuth: true, requireFeatures: ['notifications.create'] },\n}\n\nexport async function GET(req: Request) {\n  const { ctx, scope } = await resolveNotificationContext(req)\n  const em = ctx.container.resolve('em') as EntityManager\n\n  const url = new URL(req.url)\n  const queryParams = Object.fromEntries(url.searchParams.entries())\n  const input = listNotificationsSchema.parse(queryParams)\n\n  const filters: Record<string, unknown> = {\n    recipientUserId: scope.userId,\n    tenantId: scope.tenantId,\n  }\n\n  if (input.status) {\n    filters.status = Array.isArray(input.status) ? { $in: input.status } : input.status\n  } else {\n    filters.status = { $ne: 'dismissed' }\n  }\n  if (input.type) {\n    filters.type = input.type\n  }\n  if (input.severity) {\n    filters.severity = input.severity\n  }\n  if (input.sourceEntityType) {\n    filters.sourceEntityType = input.sourceEntityType\n  }\n  if (input.sourceEntityId) {\n    filters.sourceEntityId = input.sourceEntityId\n  }\n  if (input.since) {\n    filters.createdAt = { $gt: new Date(input.since) }\n  }\n\n  const [notifications, total] = await Promise.all([\n    em.find(Notification, filters, {\n      orderBy: { createdAt: 'desc' },\n      limit: input.pageSize,\n      offset: (input.page - 1) * input.pageSize,\n    }),\n    em.count(Notification, filters),\n  ])\n\n  const items = notifications.map(toNotificationDto)\n\n  return Response.json({\n    items,\n    total,\n    page: input.page,\n    pageSize: input.pageSize,\n    totalPages: Math.ceil(total / input.pageSize),\n  })\n}\n\nexport async function POST(req: Request) {\n  const { service, scope, ctx } = await resolveNotificationContext(req)\n\n  const body = await req.json().catch(() => ({}))\n  const parsed = createNotificationSchema.safeParse(body)\n  if (!parsed.success) {\n    return notificationValidationErrorResponse(parsed.error)\n  }\n\n  try {\n    const guarded = await runGuardedNotificationWrite(\n      ctx.container,\n      scope,\n      req,\n      {\n        resourceKind: NOTIFICATION_RESOURCE_KIND,\n        operation: 'create',\n        payload: parsed.data as Record<string, unknown>,\n      },\n      () => service.create(parsed.data, scope),\n    )\n    if (!guarded.ok) return guarded.response\n\n    return Response.json({ id: guarded.result.id }, { status: 201 })\n  } catch (error) {\n    const errorResponse = notificationCrudErrorResponse(error)\n    if (errorResponse) return errorResponse\n    throw error\n  }\n}\n\nexport const openApi = buildNotificationsCrudOpenApi({\n  resourceName: 'Notification',\n  querySchema: listNotificationsSchema,\n  listResponseSchema: createPagedListResponseSchema(notificationItemSchema),\n  create: {\n    schema: createNotificationSchema,\n    responseSchema: z.object({ id: z.string().uuid() }),\n    description: 'Creates a notification for a user.',\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,oBAAoB;AAC7B,SAAS,yBAAyB,gCAAgC;AAClE,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACvE;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,2BAA2B,GAAG;AAC3D,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AAErC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,cAAc,OAAO,YAAY,IAAI,aAAa,QAAQ,CAAC;AACjE,QAAM,QAAQ,wBAAwB,MAAM,WAAW;AAEvD,QAAM,UAAmC;AAAA,IACvC,iBAAiB,MAAM;AAAA,IACvB,UAAU,MAAM;AAAA,EAClB;AAEA,MAAI,MAAM,QAAQ;AAChB,YAAQ,SAAS,MAAM,QAAQ,MAAM,MAAM,IAAI,EAAE,KAAK,MAAM,OAAO,IAAI,MAAM;AAAA,EAC/E,OAAO;AACL,YAAQ,SAAS,EAAE,KAAK,YAAY;AAAA,EACtC;AACA,MAAI,MAAM,MAAM;AACd,YAAQ,OAAO,MAAM;AAAA,EACvB;AACA,MAAI,MAAM,UAAU;AAClB,YAAQ,WAAW,MAAM;AAAA,EAC3B;AACA,MAAI,MAAM,kBAAkB;AAC1B,YAAQ,mBAAmB,MAAM;AAAA,EACnC;AACA,MAAI,MAAM,gBAAgB;AACxB,YAAQ,iBAAiB,MAAM;AAAA,EACjC;AACA,MAAI,MAAM,OAAO;AACf,YAAQ,YAAY,EAAE,KAAK,IAAI,KAAK,MAAM,KAAK,EAAE;AAAA,EACnD;AAEA,QAAM,CAAC,eAAe,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC/C,GAAG,KAAK,cAAc,SAAS;AAAA,MAC7B,SAAS,EAAE,WAAW,OAAO;AAAA,MAC7B,OAAO,MAAM;AAAA,MACb,SAAS,MAAM,OAAO,KAAK,MAAM;AAAA,IACnC,CAAC;AAAA,IACD,GAAG,MAAM,cAAc,OAAO;AAAA,EAChC,CAAC;AAED,QAAM,QAAQ,cAAc,IAAI,iBAAiB;AAEjD,SAAO,SAAS,KAAK;AAAA,IACnB;AAAA,IACA;AAAA,IACA,MAAM,MAAM;AAAA,IACZ,UAAU,MAAM;AAAA,IAChB,YAAY,KAAK,KAAK,QAAQ,MAAM,QAAQ;AAAA,EAC9C,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,SAAS,OAAO,IAAI,IAAI,MAAM,2BAA2B,GAAG;AAEpE,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,SAAS,yBAAyB,UAAU,IAAI;AACtD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,oCAAoC,OAAO,KAAK;AAAA,EACzD;AAEA,MAAI;AACF,UAAM,UAAU,MAAM;AAAA,MACpB,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,QACE,cAAc;AAAA,QACd,WAAW;AAAA,QACX,SAAS,OAAO;AAAA,MAClB;AAAA,MACA,MAAM,QAAQ,OAAO,OAAO,MAAM,KAAK;AAAA,IACzC;AACA,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAEhC,WAAO,SAAS,KAAK,EAAE,IAAI,QAAQ,OAAO,GAAG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjE,SAAS,OAAO;AACd,UAAM,gBAAgB,8BAA8B,KAAK;AACzD,QAAI,cAAe,QAAO;AAC1B,UAAM;AAAA,EACR;AACF;AAEO,MAAM,UAAU,8BAA8B;AAAA,EACnD,cAAc;AAAA,EACd,aAAa;AAAA,EACb,oBAAoB,8BAA8B,sBAAsB;AAAA,EACxE,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAClD,aAAa;AAAA,EACf;AACF,CAAC;",
   "names": []
 }

package/dist/modules/notifications/api/unread-count/route.js

@@ -1,4 +1,3 @@
-import { createHash } from "node:crypto";
 import { runWithCacheTenant } from "@open-mercato/cache";
 import {
   buildCollectionTags,
@@ -8,33 +7,20 @@ import {
 import { Notification } from "../../data/entities.js";
 import { unreadCountResponseSchema } from "../openapi.js";
 import { resolveNotificationContext } from "../../lib/routeHelpers.js";
-import {
-  buildNotificationReadScopeWhere,
-  getNotificationReadScopeTagOrganizationIds
-} from "../../lib/notificationScope.js";
 const metadata = {
   GET: { requireAuth: true }
 };
 const UNREAD_COUNT_RESOURCE = "notifications.notification";
 const UNREAD_COUNT_TTL_MS = 1e4;
-function buildUnreadCountCacheKey(params) {
-  const normalizedIds = Array.from(new Set(
-    params.organizationIds.filter((value) => value.trim().length > 0)
-  )).sort((left, right) => left.localeCompare(right));
-  const scopeKey = normalizedIds.length === 0 ? "no-access" : `${params.organizationId ?? "none"}:scope=${createHash("sha256").update(normalizedIds.join("\0")).digest("hex").slice(0, 16)}`;
-  return `notifications:unread-count:u=${params.userId}:org=${scopeKey}`;
+function buildUnreadCountCacheKey(userId) {
+  return `notifications:unread-count:u=${userId}`;
 }
 async function GET(req) {
   const { scope, ctx } = await resolveNotificationContext(req);
   const em = ctx.container.resolve("em");
   const userId = scope.userId;
-  const cacheableOrganizationIds = Array.isArray(scope.organizationIds) ? scope.organizationIds : null;
-  const cache = userId && cacheableOrganizationIds && isCrudCacheEnabled() ? resolveCrudCache(ctx.container) : null;
-  const cacheKey = cache && userId && cacheableOrganizationIds ? buildUnreadCountCacheKey({
-    userId,
-    organizationId: scope.organizationId,
-    organizationIds: cacheableOrganizationIds
-  }) : null;
+  const cache = userId && isCrudCacheEnabled() ? resolveCrudCache(ctx.container) : null;
+  const cacheKey = cache && userId ? buildUnreadCountCacheKey(userId) : null;
   if (cache && cacheKey) {
     try {
       const cached = await runWithCacheTenant(scope.tenantId, () => cache.get(cacheKey));
@@ -47,8 +33,7 @@ async function GET(req) {
   const count = await em.count(Notification, {
     recipientUserId: userId,
     tenantId: scope.tenantId,
-    status: "unread",
-    ...buildNotificationReadScopeWhere(scope)
+    status: "unread"
   });
   if (cache && cacheKey) {
     try {
@@ -56,11 +41,7 @@ async function GET(req) {
         scope.tenantId,
         () => cache.set(cacheKey, count, {
           ttl: UNREAD_COUNT_TTL_MS,
-          tags: buildCollectionTags(
-            UNREAD_COUNT_RESOURCE,
-            scope.tenantId,
-            getNotificationReadScopeTagOrganizationIds(scope)
-          )
+          tags: buildCollectionTags(UNREAD_COUNT_RESOURCE, scope.tenantId, [null])
         })
       );
     } catch {

package/dist/modules/notifications/api/unread-count/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/notifications/api/unread-count/route.ts"],
-  "sourcesContent": ["import { createHash } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/core'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport {\n  buildCollectionTags,\n  isCrudCacheEnabled,\n  resolveCrudCache,\n} from '@open-mercato/shared/lib/crud/cache'\nimport { Notification } from '../../data/entities'\nimport { unreadCountResponseSchema } from '../openapi'\nimport { resolveNotificationContext } from '../../lib/routeHelpers'\nimport {\n  buildNotificationReadScopeWhere,\n  getNotificationReadScopeTagOrganizationIds,\n} from '../../lib/notificationScope'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\nconst UNREAD_COUNT_RESOURCE = 'notifications.notification'\nconst UNREAD_COUNT_TTL_MS = 10_000\n\nfunction buildUnreadCountCacheKey(params: {\n  userId: string\n  organizationId: string | null\n  organizationIds: string[]\n}): string {\n  const normalizedIds = Array.from(new Set(\n    params.organizationIds.filter((value) => value.trim().length > 0),\n  )).sort((left, right) => left.localeCompare(right))\n  const scopeKey = normalizedIds.length === 0\n    ? 'no-access'\n    : `${params.organizationId ?? 'none'}:scope=${createHash('sha256')\n        .update(normalizedIds.join('\\0'))\n        .digest('hex')\n        .slice(0, 16)}`\n  return `notifications:unread-count:u=${params.userId}:org=${scopeKey}`\n}\n\nexport async function GET(req: Request) {\n  const { scope, ctx } = await resolveNotificationContext(req)\n  const em = ctx.container.resolve('em') as EntityManager\n\n  const userId = scope.userId\n  const cacheableOrganizationIds = Array.isArray(scope.organizationIds)\n    ? scope.organizationIds\n    : null\n  // Unrestricted and omitted legacy scopes cannot be safely tagged for invalidation:\n  // org-specific writes only invalidate their own collection tag. Keep those scopes\n  // uncached rather than serving a stale tenant-wide total until the TTL expires.\n  const cache = userId && cacheableOrganizationIds && isCrudCacheEnabled()\n    ? resolveCrudCache(ctx.container)\n    : null\n  const cacheKey = cache && userId && cacheableOrganizationIds\n    ? buildUnreadCountCacheKey({\n        userId,\n        organizationId: scope.organizationId,\n        organizationIds: cacheableOrganizationIds,\n      })\n    : null\n\n  if (cache && cacheKey) {\n    try {\n      const cached = await runWithCacheTenant(scope.tenantId, () => cache.get(cacheKey))\n      if (typeof cached === 'number') {\n        return Response.json({ unreadCount: cached })\n      }\n    } catch {}\n  }\n\n  const count = await em.count(Notification, {\n    recipientUserId: userId,\n    tenantId: scope.tenantId,\n    status: 'unread',\n    ...buildNotificationReadScopeWhere(scope),\n  })\n\n  if (cache && cacheKey) {\n    try {\n      await runWithCacheTenant(scope.tenantId, () =>\n        cache.set(cacheKey, count, {\n          ttl: UNREAD_COUNT_TTL_MS,\n          tags: buildCollectionTags(\n            UNREAD_COUNT_RESOURCE,\n            scope.tenantId,\n            getNotificationReadScopeTagOrganizationIds(scope),\n          ),\n        }),\n      )\n    } catch {}\n  }\n\n  return Response.json({ unreadCount: count })\n}\n\nexport const openApi = {\n  GET: {\n    summary: 'Get unread notification count',\n    tags: ['Notifications'],\n    responses: {\n      200: {\n        description: 'Unread count',\n        content: {\n          'application/json': {\n            schema: unreadCountResponseSchema,\n          },\n        },\n      },\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,iCAAiC;AAC1C,SAAS,kCAAkC;AAC3C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,MAAM,wBAAwB;AAC9B,MAAM,sBAAsB;AAE5B,SAAS,yBAAyB,QAIvB;AACT,QAAM,gBAAgB,MAAM,KAAK,IAAI;AAAA,IACnC,OAAO,gBAAgB,OAAO,CAAC,UAAU,MAAM,KAAK,EAAE,SAAS,CAAC;AAAA,EAClE,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AAClD,QAAM,WAAW,cAAc,WAAW,IACtC,cACA,GAAG,OAAO,kBAAkB,MAAM,UAAU,WAAW,QAAQ,EAC5D,OAAO,cAAc,KAAK,IAAI,CAAC,EAC/B,OAAO,KAAK,EACZ,MAAM,GAAG,EAAE,CAAC;AACnB,SAAO,gCAAgC,OAAO,MAAM,QAAQ,QAAQ;AACtE;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,OAAO,IAAI,IAAI,MAAM,2BAA2B,GAAG;AAC3D,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AAErC,QAAM,SAAS,MAAM;AACrB,QAAM,2BAA2B,MAAM,QAAQ,MAAM,eAAe,IAChE,MAAM,kBACN;AAIJ,QAAM,QAAQ,UAAU,4BAA4B,mBAAmB,IACnE,iBAAiB,IAAI,SAAS,IAC9B;AACJ,QAAM,WAAW,SAAS,UAAU,2BAChC,yBAAyB;AAAA,IACvB;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,iBAAiB;AAAA,EACnB,CAAC,IACD;AAEJ,MAAI,SAAS,UAAU;AACrB,QAAI;AACF,YAAM,SAAS,MAAM,mBAAmB,MAAM,UAAU,MAAM,MAAM,IAAI,QAAQ,CAAC;AACjF,UAAI,OAAO,WAAW,UAAU;AAC9B,eAAO,SAAS,KAAK,EAAE,aAAa,OAAO,CAAC;AAAA,MAC9C;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,QAAM,QAAQ,MAAM,GAAG,MAAM,cAAc;AAAA,IACzC,iBAAiB;AAAA,IACjB,UAAU,MAAM;AAAA,IAChB,QAAQ;AAAA,IACR,GAAG,gCAAgC,KAAK;AAAA,EAC1C,CAAC;AAED,MAAI,SAAS,UAAU;AACrB,QAAI;AACF,YAAM;AAAA,QAAmB,MAAM;AAAA,QAAU,MACvC,MAAM,IAAI,UAAU,OAAO;AAAA,UACzB,KAAK;AAAA,UACL,MAAM;AAAA,YACJ;AAAA,YACA,MAAM;AAAA,YACN,2CAA2C,KAAK;AAAA,UAClD;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,SAAO,SAAS,KAAK,EAAE,aAAa,MAAM,CAAC;AAC7C;AAEO,MAAM,UAAU;AAAA,EACrB,KAAK;AAAA,IACH,SAAS;AAAA,IACT,MAAM,CAAC,eAAe;AAAA,IACtB,WAAW;AAAA,MACT,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,oBAAoB;AAAA,YAClB,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport {\n  buildCollectionTags,\n  isCrudCacheEnabled,\n  resolveCrudCache,\n} from '@open-mercato/shared/lib/crud/cache'\nimport { Notification } from '../../data/entities'\nimport { unreadCountResponseSchema } from '../openapi'\nimport { resolveNotificationContext } from '../../lib/routeHelpers'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\nconst UNREAD_COUNT_RESOURCE = 'notifications.notification'\nconst UNREAD_COUNT_TTL_MS = 10_000\n\nfunction buildUnreadCountCacheKey(userId: string): string {\n  return `notifications:unread-count:u=${userId}`\n}\n\nexport async function GET(req: Request) {\n  const { scope, ctx } = await resolveNotificationContext(req)\n  const em = ctx.container.resolve('em') as EntityManager\n\n  const userId = scope.userId\n  const cache = userId && isCrudCacheEnabled() ? resolveCrudCache(ctx.container) : null\n  const cacheKey = cache && userId ? buildUnreadCountCacheKey(userId) : null\n\n  if (cache && cacheKey) {\n    try {\n      const cached = await runWithCacheTenant(scope.tenantId, () => cache.get(cacheKey))\n      if (typeof cached === 'number') {\n        return Response.json({ unreadCount: cached })\n      }\n    } catch {}\n  }\n\n  const count = await em.count(Notification, {\n    recipientUserId: userId,\n    tenantId: scope.tenantId,\n    status: 'unread',\n  })\n\n  if (cache && cacheKey) {\n    try {\n      await runWithCacheTenant(scope.tenantId, () =>\n        cache.set(cacheKey, count, {\n          ttl: UNREAD_COUNT_TTL_MS,\n          tags: buildCollectionTags(UNREAD_COUNT_RESOURCE, scope.tenantId, [null]),\n        }),\n      )\n    } catch {}\n  }\n\n  return Response.json({ unreadCount: count })\n}\n\nexport const openApi = {\n  GET: {\n    summary: 'Get unread notification count',\n    tags: ['Notifications'],\n    responses: {\n      200: {\n        description: 'Unread count',\n        content: {\n          'application/json': {\n            schema: unreadCountResponseSchema,\n          },\n        },\n      },\n    },\n  },\n}\n"],
+  "mappings": "AACA,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,iCAAiC;AAC1C,SAAS,kCAAkC;AAEpC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,MAAM,wBAAwB;AAC9B,MAAM,sBAAsB;AAE5B,SAAS,yBAAyB,QAAwB;AACxD,SAAO,gCAAgC,MAAM;AAC/C;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,OAAO,IAAI,IAAI,MAAM,2BAA2B,GAAG;AAC3D,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AAErC,QAAM,SAAS,MAAM;AACrB,QAAM,QAAQ,UAAU,mBAAmB,IAAI,iBAAiB,IAAI,SAAS,IAAI;AACjF,QAAM,WAAW,SAAS,SAAS,yBAAyB,MAAM,IAAI;AAEtE,MAAI,SAAS,UAAU;AACrB,QAAI;AACF,YAAM,SAAS,MAAM,mBAAmB,MAAM,UAAU,MAAM,MAAM,IAAI,QAAQ,CAAC;AACjF,UAAI,OAAO,WAAW,UAAU;AAC9B,eAAO,SAAS,KAAK,EAAE,aAAa,OAAO,CAAC;AAAA,MAC9C;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,QAAM,QAAQ,MAAM,GAAG,MAAM,cAAc;AAAA,IACzC,iBAAiB;AAAA,IACjB,UAAU,MAAM;AAAA,IAChB,QAAQ;AAAA,EACV,CAAC;AAED,MAAI,SAAS,UAAU;AACrB,QAAI;AACF,YAAM;AAAA,QAAmB,MAAM;AAAA,QAAU,MACvC,MAAM,IAAI,UAAU,OAAO;AAAA,UACzB,KAAK;AAAA,UACL,MAAM,oBAAoB,uBAAuB,MAAM,UAAU,CAAC,IAAI,CAAC;AAAA,QACzE,CAAC;AAAA,MACH;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,SAAO,SAAS,KAAK,EAAE,aAAa,MAAM,CAAC;AAC7C;AAEO,MAAM,UAAU;AAAA,EACrB,KAAK;AAAA,IACH,SAAS;AAAA,IACT,MAAM,CAAC,eAAe;AAAA,IACtB,WAAW;AAAA,MACT,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,oBAAoB;AAAA,YAClB,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/notifications/di.js

@@ -3,7 +3,7 @@ import { createNotificationService } from "./lib/notificationService.js";
 function register(container) {
   container.register({
     notificationService: asFunction(
-      ({ em, eventBus, commandBus }) => createNotificationService({ em, eventBus, commandBus, container })
+      ({ em, eventBus, commandBus }) => createNotificationService({ em, eventBus, commandBus })
     ).scoped().proxy()
   });
 }

package/dist/modules/notifications/di.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/notifications/di.ts"],
-  "sourcesContent": ["import type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { asFunction } from 'awilix'\nimport { createNotificationService } from './lib/notificationService'\n\nexport function register(container: AppContainer): void {\n  container.register({\n    notificationService: asFunction(({ em, eventBus, commandBus }) =>\n      createNotificationService({ em, eventBus, commandBus, container })\n    ).scoped().proxy(),\n  })\n}\n"],
-  "mappings": "AACA,SAAS,kBAAkB;AAC3B,SAAS,iCAAiC;AAEnC,SAAS,SAAS,WAA+B;AACtD,YAAU,SAAS;AAAA,IACjB,qBAAqB;AAAA,MAAW,CAAC,EAAE,IAAI,UAAU,WAAW,MAC1D,0BAA0B,EAAE,IAAI,UAAU,YAAY,UAAU,CAAC;AAAA,IACnE,EAAE,OAAO,EAAE,MAAM;AAAA,EACnB,CAAC;AACH;",
+  "sourcesContent": ["import type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { asFunction } from 'awilix'\nimport { createNotificationService } from './lib/notificationService'\n\nexport function register(container: AppContainer): void {\n  container.register({\n    notificationService: asFunction(({ em, eventBus, commandBus }) =>\n      createNotificationService({ em, eventBus, commandBus })\n    ).scoped().proxy(),\n  })\n}\n"],
+  "mappings": "AACA,SAAS,kBAAkB;AAC3B,SAAS,iCAAiC;AAEnC,SAAS,SAAS,WAA+B;AACtD,YAAU,SAAS;AAAA,IACjB,qBAAqB;AAAA,MAAW,CAAC,EAAE,IAAI,UAAU,WAAW,MAC1D,0BAA0B,EAAE,IAAI,UAAU,WAAW,CAAC;AAAA,IACxD,EAAE,OAAO,EAAE,MAAM;AAAA,EACnB,CAAC;AACH;",
   "names": []
 }

package/dist/modules/notifications/events.js

@@ -6,16 +6,14 @@ const events = [
     label: "Notification Created",
     entity: "notification",
     category: "system",
-    clientBroadcast: true,
-    portalBroadcast: true
+    clientBroadcast: true
   },
   {
     id: NOTIFICATION_SSE_EVENTS.BATCH_CREATED,
     label: "Notification Batch Created",
     entity: "notification",
     category: "system",
-    clientBroadcast: true,
-    portalBroadcast: true
+    clientBroadcast: true
   }
 ];
 const eventsConfig = createModuleEvents({

package/dist/modules/notifications/events.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/notifications/events.ts"],
-  "sourcesContent": ["import { createModuleEvents } from '@open-mercato/shared/modules/events'\nimport { NOTIFICATION_SSE_EVENTS } from './lib/events'\n\nconst events = [\n  {\n    id: NOTIFICATION_SSE_EVENTS.CREATED,\n    label: 'Notification Created',\n    entity: 'notification',\n    category: 'system',\n    clientBroadcast: true,\n    portalBroadcast: true,\n  },\n  {\n    id: NOTIFICATION_SSE_EVENTS.BATCH_CREATED,\n    label: 'Notification Batch Created',\n    entity: 'notification',\n    category: 'system',\n    clientBroadcast: true,\n    portalBroadcast: true,\n  },\n] as const\n\nexport const eventsConfig = createModuleEvents({\n  moduleId: 'notifications',\n  events,\n})\n\nexport const emitNotificationEvent = eventsConfig.emit\n\nexport default eventsConfig\n"],
-  "mappings": "AAAA,SAAS,0BAA0B;AACnC,SAAS,+BAA+B;AAExC,MAAM,SAAS;AAAA,EACb;AAAA,IACE,IAAI,wBAAwB;AAAA,IAC5B,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,EACnB;AAAA,EACA;AAAA,IACE,IAAI,wBAAwB;AAAA,IAC5B,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,EACnB;AACF;AAEO,MAAM,eAAe,mBAAmB;AAAA,EAC7C,UAAU;AAAA,EACV;AACF,CAAC;AAEM,MAAM,wBAAwB,aAAa;AAElD,IAAO,iBAAQ;",
+  "sourcesContent": ["import { createModuleEvents } from '@open-mercato/shared/modules/events'\nimport { NOTIFICATION_SSE_EVENTS } from './lib/events'\n\nconst events = [\n  {\n    id: NOTIFICATION_SSE_EVENTS.CREATED,\n    label: 'Notification Created',\n    entity: 'notification',\n    category: 'system',\n    clientBroadcast: true,\n  },\n  {\n    id: NOTIFICATION_SSE_EVENTS.BATCH_CREATED,\n    label: 'Notification Batch Created',\n    entity: 'notification',\n    category: 'system',\n    clientBroadcast: true,\n  },\n] as const\n\nexport const eventsConfig = createModuleEvents({\n  moduleId: 'notifications',\n  events,\n})\n\nexport const emitNotificationEvent = eventsConfig.emit\n\nexport default eventsConfig\n"],
+  "mappings": "AAAA,SAAS,0BAA0B;AACnC,SAAS,+BAA+B;AAExC,MAAM,SAAS;AAAA,EACb;AAAA,IACE,IAAI,wBAAwB;AAAA,IAC5B,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,iBAAiB;AAAA,EACnB;AAAA,EACA;AAAA,IACE,IAAI,wBAAwB;AAAA,IAC5B,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,iBAAiB;AAAA,EACnB;AACF;AAEO,MAAM,eAAe,mBAAmB;AAAA,EAC7C,UAAU;AAAA,EACV;AACF,CAAC;AAEM,MAAM,wBAAwB,aAAa;AAElD,IAAO,iBAAQ;",
   "names": []
 }

package/dist/modules/notifications/lib/notificationRecipients.js

@@ -1,4 +1,4 @@
-import { authorizeFeatures } from "@open-mercato/shared/security/featurePolicy";
+import { hasFeature } from "@open-mercato/shared/security/features";
 function normalizeFeatures(features) {
   if (!Array.isArray(features)) return void 0;
   const normalized = features.filter((feature) => typeof feature === "string");
@@ -6,11 +6,12 @@ function normalizeFeatures(features) {
 }
 function collectUsersWithFeature(userIdsSet, rows, requiredFeature) {
   for (const row of rows) {
-    const features = normalizeFeatures(row.features_json) ?? [];
-    if (authorizeFeatures([requiredFeature], {
-      grantedFeatures: features,
-      unrestricted: row.is_super_admin
-    })) {
+    if (row.is_super_admin) {
+      userIdsSet.add(row.user_id);
+      continue;
+    }
+    const features = normalizeFeatures(row.features_json);
+    if (features && hasFeature(features, requiredFeature)) {
       userIdsSet.add(row.user_id);
     }
   }

package/dist/modules/notifications/lib/notificationRecipients.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/notifications/lib/notificationRecipients.ts"],
-  "sourcesContent": ["import type { Kysely } from 'kysely'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\n\ninterface AclRow {\n  user_id: string\n  features_json: unknown\n  is_super_admin: boolean\n}\n\nfunction normalizeFeatures(features: unknown): string[] | undefined {\n  if (!Array.isArray(features)) return undefined\n  const normalized = features.filter((feature): feature is string => typeof feature === 'string')\n  return normalized.length ? normalized : undefined\n}\n\n/**\n * Extract user IDs from ACL rows that have the required feature or are super admins.\n */\nfunction collectUsersWithFeature(\n  userIdsSet: Set<string>,\n  rows: AclRow[],\n  requiredFeature: string\n): void {\n  for (const row of rows) {\n    const features = normalizeFeatures(row.features_json) ?? []\n    if (authorizeFeatures([requiredFeature], {\n      grantedFeatures: features,\n      unrestricted: row.is_super_admin,\n    })) {\n      userIdsSet.add(row.user_id)\n    }\n  }\n}\n\nexport async function getScopedNotificationRecipientUserIds(\n  db: Kysely<any>,\n  tenantId: string,\n  organizationId: string | null,\n  recipientUserIds: string[],\n): Promise<string[]> {\n  const builder: any = db\n  let query = builder\n    .selectFrom('users')\n    .where('users.id', 'in', recipientUserIds)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n\n  if (organizationId) {\n    query = query.where('users.organization_id', '=', organizationId)\n  }\n\n  const users = await query\n    .select('users.id as user_id')\n    .execute() as Array<{ user_id: string }>\n\n  return users.map((user) => user.user_id)\n}\n\nexport async function getRecipientUserIdsForRole(\n  db: Kysely<any>,\n  tenantId: string,\n  roleId: string\n): Promise<string[]> {\n  const builder: any = db\n  const userRoles = await builder\n    .selectFrom('user_roles')\n    .innerJoin('users', 'user_roles.user_id', 'users.id')\n    .where('user_roles.role_id', '=', roleId)\n    .where('user_roles.deleted_at', 'is', null)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n    .select('users.id as user_id')\n    .execute() as Array<{ user_id: string }>\n\n  return userRoles.map((row) => row.user_id)\n}\n\nexport async function getRecipientUserIdsForFeature(\n  db: Kysely<any>,\n  tenantId: string,\n  requiredFeature: string\n): Promise<string[]> {\n  const userIdsSet = new Set<string>()\n  const builder: any = db\n\n  const userAcls = await builder\n    .selectFrom('user_acls')\n    .innerJoin('users', 'user_acls.user_id', 'users.id')\n    .where('user_acls.tenant_id', '=', tenantId)\n    .where('user_acls.deleted_at', 'is', null)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n    .select([\n      'users.id as user_id',\n      'user_acls.features_json',\n      'user_acls.is_super_admin',\n    ])\n    .execute() as AclRow[]\n\n  collectUsersWithFeature(userIdsSet, userAcls, requiredFeature)\n\n  const roleAcls = await builder\n    .selectFrom('role_acls')\n    .innerJoin('user_roles', 'role_acls.role_id', 'user_roles.role_id')\n    .innerJoin('users', 'user_roles.user_id', 'users.id')\n    .where('role_acls.tenant_id', '=', tenantId)\n    .where('role_acls.deleted_at', 'is', null)\n    .where('user_roles.deleted_at', 'is', null)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n    .select([\n      'users.id as user_id',\n      'role_acls.features_json',\n      'role_acls.is_super_admin',\n    ])\n    .execute() as AclRow[]\n\n  collectUsersWithFeature(userIdsSet, roleAcls, requiredFeature)\n\n  return Array.from(userIdsSet)\n}\n"],
-  "mappings": "AACA,SAAS,yBAAyB;AAQlC,SAAS,kBAAkB,UAAyC;AAClE,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO;AACrC,QAAM,aAAa,SAAS,OAAO,CAAC,YAA+B,OAAO,YAAY,QAAQ;AAC9F,SAAO,WAAW,SAAS,aAAa;AAC1C;AAKA,SAAS,wBACP,YACA,MACA,iBACM;AACN,aAAW,OAAO,MAAM;AACtB,UAAM,WAAW,kBAAkB,IAAI,aAAa,KAAK,CAAC;AAC1D,QAAI,kBAAkB,CAAC,eAAe,GAAG;AAAA,MACvC,iBAAiB;AAAA,MACjB,cAAc,IAAI;AAAA,IACpB,CAAC,GAAG;AACF,iBAAW,IAAI,IAAI,OAAO;AAAA,IAC5B;AAAA,EACF;AACF;AAEA,eAAsB,sCACpB,IACA,UACA,gBACA,kBACmB;AACnB,QAAM,UAAe;AACrB,MAAI,QAAQ,QACT,WAAW,OAAO,EAClB,MAAM,YAAY,MAAM,gBAAgB,EACxC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ;AAEzC,MAAI,gBAAgB;AAClB,YAAQ,MAAM,MAAM,yBAAyB,KAAK,cAAc;AAAA,EAClE;AAEA,QAAM,QAAQ,MAAM,MACjB,OAAO,qBAAqB,EAC5B,QAAQ;AAEX,SAAO,MAAM,IAAI,CAAC,SAAS,KAAK,OAAO;AACzC;AAEA,eAAsB,2BACpB,IACA,UACA,QACmB;AACnB,QAAM,UAAe;AACrB,QAAM,YAAY,MAAM,QACrB,WAAW,YAAY,EACvB,UAAU,SAAS,sBAAsB,UAAU,EACnD,MAAM,sBAAsB,KAAK,MAAM,EACvC,MAAM,yBAAyB,MAAM,IAAI,EACzC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ,EACtC,OAAO,qBAAqB,EAC5B,QAAQ;AAEX,SAAO,UAAU,IAAI,CAAC,QAAQ,IAAI,OAAO;AAC3C;AAEA,eAAsB,8BACpB,IACA,UACA,iBACmB;AACnB,QAAM,aAAa,oBAAI,IAAY;AACnC,QAAM,UAAe;AAErB,QAAM,WAAW,MAAM,QACpB,WAAW,WAAW,EACtB,UAAU,SAAS,qBAAqB,UAAU,EAClD,MAAM,uBAAuB,KAAK,QAAQ,EAC1C,MAAM,wBAAwB,MAAM,IAAI,EACxC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ,EACtC,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,QAAQ;AAEX,0BAAwB,YAAY,UAAU,eAAe;AAE7D,QAAM,WAAW,MAAM,QACpB,WAAW,WAAW,EACtB,UAAU,cAAc,qBAAqB,oBAAoB,EACjE,UAAU,SAAS,sBAAsB,UAAU,EACnD,MAAM,uBAAuB,KAAK,QAAQ,EAC1C,MAAM,wBAAwB,MAAM,IAAI,EACxC,MAAM,yBAAyB,MAAM,IAAI,EACzC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ,EACtC,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,QAAQ;AAEX,0BAAwB,YAAY,UAAU,eAAe;AAE7D,SAAO,MAAM,KAAK,UAAU;AAC9B;",
+  "sourcesContent": ["import type { Kysely } from 'kysely'\nimport { hasFeature } from '@open-mercato/shared/security/features'\n\ninterface AclRow {\n  user_id: string\n  features_json: unknown\n  is_super_admin: boolean\n}\n\nfunction normalizeFeatures(features: unknown): string[] | undefined {\n  if (!Array.isArray(features)) return undefined\n  const normalized = features.filter((feature): feature is string => typeof feature === 'string')\n  return normalized.length ? normalized : undefined\n}\n\n/**\n * Extract user IDs from ACL rows that have the required feature or are super admins.\n */\nfunction collectUsersWithFeature(\n  userIdsSet: Set<string>,\n  rows: AclRow[],\n  requiredFeature: string\n): void {\n  for (const row of rows) {\n    if (row.is_super_admin) {\n      userIdsSet.add(row.user_id)\n      continue\n    }\n\n    const features = normalizeFeatures(row.features_json)\n    if (features && hasFeature(features, requiredFeature)) {\n      userIdsSet.add(row.user_id)\n    }\n  }\n}\n\nexport async function getScopedNotificationRecipientUserIds(\n  db: Kysely<any>,\n  tenantId: string,\n  organizationId: string | null,\n  recipientUserIds: string[],\n): Promise<string[]> {\n  const builder: any = db\n  let query = builder\n    .selectFrom('users')\n    .where('users.id', 'in', recipientUserIds)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n\n  if (organizationId) {\n    query = query.where('users.organization_id', '=', organizationId)\n  }\n\n  const users = await query\n    .select('users.id as user_id')\n    .execute() as Array<{ user_id: string }>\n\n  return users.map((user) => user.user_id)\n}\n\nexport async function getRecipientUserIdsForRole(\n  db: Kysely<any>,\n  tenantId: string,\n  roleId: string\n): Promise<string[]> {\n  const builder: any = db\n  const userRoles = await builder\n    .selectFrom('user_roles')\n    .innerJoin('users', 'user_roles.user_id', 'users.id')\n    .where('user_roles.role_id', '=', roleId)\n    .where('user_roles.deleted_at', 'is', null)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n    .select('users.id as user_id')\n    .execute() as Array<{ user_id: string }>\n\n  return userRoles.map((row) => row.user_id)\n}\n\nexport async function getRecipientUserIdsForFeature(\n  db: Kysely<any>,\n  tenantId: string,\n  requiredFeature: string\n): Promise<string[]> {\n  const userIdsSet = new Set<string>()\n  const builder: any = db\n\n  const userAcls = await builder\n    .selectFrom('user_acls')\n    .innerJoin('users', 'user_acls.user_id', 'users.id')\n    .where('user_acls.tenant_id', '=', tenantId)\n    .where('user_acls.deleted_at', 'is', null)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n    .select([\n      'users.id as user_id',\n      'user_acls.features_json',\n      'user_acls.is_super_admin',\n    ])\n    .execute() as AclRow[]\n\n  collectUsersWithFeature(userIdsSet, userAcls, requiredFeature)\n\n  const roleAcls = await builder\n    .selectFrom('role_acls')\n    .innerJoin('user_roles', 'role_acls.role_id', 'user_roles.role_id')\n    .innerJoin('users', 'user_roles.user_id', 'users.id')\n    .where('role_acls.tenant_id', '=', tenantId)\n    .where('role_acls.deleted_at', 'is', null)\n    .where('user_roles.deleted_at', 'is', null)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n    .select([\n      'users.id as user_id',\n      'role_acls.features_json',\n      'role_acls.is_super_admin',\n    ])\n    .execute() as AclRow[]\n\n  collectUsersWithFeature(userIdsSet, roleAcls, requiredFeature)\n\n  return Array.from(userIdsSet)\n}\n"],
+  "mappings": "AACA,SAAS,kBAAkB;AAQ3B,SAAS,kBAAkB,UAAyC;AAClE,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO;AACrC,QAAM,aAAa,SAAS,OAAO,CAAC,YAA+B,OAAO,YAAY,QAAQ;AAC9F,SAAO,WAAW,SAAS,aAAa;AAC1C;AAKA,SAAS,wBACP,YACA,MACA,iBACM;AACN,aAAW,OAAO,MAAM;AACtB,QAAI,IAAI,gBAAgB;AACtB,iBAAW,IAAI,IAAI,OAAO;AAC1B;AAAA,IACF;AAEA,UAAM,WAAW,kBAAkB,IAAI,aAAa;AACpD,QAAI,YAAY,WAAW,UAAU,eAAe,GAAG;AACrD,iBAAW,IAAI,IAAI,OAAO;AAAA,IAC5B;AAAA,EACF;AACF;AAEA,eAAsB,sCACpB,IACA,UACA,gBACA,kBACmB;AACnB,QAAM,UAAe;AACrB,MAAI,QAAQ,QACT,WAAW,OAAO,EAClB,MAAM,YAAY,MAAM,gBAAgB,EACxC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ;AAEzC,MAAI,gBAAgB;AAClB,YAAQ,MAAM,MAAM,yBAAyB,KAAK,cAAc;AAAA,EAClE;AAEA,QAAM,QAAQ,MAAM,MACjB,OAAO,qBAAqB,EAC5B,QAAQ;AAEX,SAAO,MAAM,IAAI,CAAC,SAAS,KAAK,OAAO;AACzC;AAEA,eAAsB,2BACpB,IACA,UACA,QACmB;AACnB,QAAM,UAAe;AACrB,QAAM,YAAY,MAAM,QACrB,WAAW,YAAY,EACvB,UAAU,SAAS,sBAAsB,UAAU,EACnD,MAAM,sBAAsB,KAAK,MAAM,EACvC,MAAM,yBAAyB,MAAM,IAAI,EACzC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ,EACtC,OAAO,qBAAqB,EAC5B,QAAQ;AAEX,SAAO,UAAU,IAAI,CAAC,QAAQ,IAAI,OAAO;AAC3C;AAEA,eAAsB,8BACpB,IACA,UACA,iBACmB;AACnB,QAAM,aAAa,oBAAI,IAAY;AACnC,QAAM,UAAe;AAErB,QAAM,WAAW,MAAM,QACpB,WAAW,WAAW,EACtB,UAAU,SAAS,qBAAqB,UAAU,EAClD,MAAM,uBAAuB,KAAK,QAAQ,EAC1C,MAAM,wBAAwB,MAAM,IAAI,EACxC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ,EACtC,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,QAAQ;AAEX,0BAAwB,YAAY,UAAU,eAAe;AAE7D,QAAM,WAAW,MAAM,QACpB,WAAW,WAAW,EACtB,UAAU,cAAc,qBAAqB,oBAAoB,EACjE,UAAU,SAAS,sBAAsB,UAAU,EACnD,MAAM,uBAAuB,KAAK,QAAQ,EAC1C,MAAM,wBAAwB,MAAM,IAAI,EACxC,MAAM,yBAAyB,MAAM,IAAI,EACzC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ,EACtC,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,QAAQ;AAEX,0BAAwB,YAAY,UAAU,eAAe;AAE7D,SAAO,MAAM,KAAK,UAAU;AAC9B;",
   "names": []
 }

package/dist/modules/notifications/lib/notificationService.js

@@ -1,6 +1,5 @@
 import { sql } from "kysely";
 import { CrudHttpError, conflict } from "@open-mercato/shared/lib/crud/errors";
-import { invalidateCrudCache } from "@open-mercato/shared/lib/crud/cache";
 import { Notification } from "../data/entities.js";
 import { NOTIFICATION_EVENTS, NOTIFICATION_SSE_EVENTS } from "./events.js";
 import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
@@ -10,7 +9,6 @@ import {
   emitNotificationCreatedBatch
 } from "./notificationFactory.js";
 import { toNotificationDto } from "./notificationMapper.js";
-import { buildNotificationReadScopeWhere } from "./notificationScope.js";
 import {
   getRecipientUserIdsForFeature,
   getRecipientUserIdsForRole,
@@ -26,24 +24,9 @@ function getDb(em) {
   return em.getKysely();
 }
 const UNIQUE_NOTIFICATION_ACTIVE_STATUSES = ["unread", "read", "actioned"];
-const NOTIFICATION_RESOURCE_KIND = "notifications.notification";
 function normalizeOrgScope(organizationId) {
   return organizationId ?? null;
 }
-async function invalidateNotificationCache(container, ctx, reason, notificationId) {
-  if (!container) return;
-  await invalidateCrudCache(
-    container,
-    NOTIFICATION_RESOURCE_KIND,
-    {
-      id: notificationId,
-      tenantId: ctx.tenantId,
-      organizationId: normalizeOrgScope(ctx.organizationId)
-    },
-    ctx.tenantId,
-    reason
-  );
-}
 async function assertNotificationRecipientsInScope(em, recipientUserIds, ctx) {
   const scopedRecipientUserIds = await getScopedNotificationRecipientUserIds(
     getDb(em),
@@ -162,7 +145,6 @@ function createNotificationService(deps) {
         await tx.flush();
         return entity;
       });
-      await invalidateNotificationCache(container, ctx, "created");
       await emitNotificationCreated(eventBus, notification, ctx);
       await eventBus.emit(NOTIFICATION_SSE_EVENTS.CREATED, {
         tenantId: notification.tenantId,
@@ -185,7 +167,6 @@ function createNotificationService(deps) {
         }
         await tx.flush();
       });
-      await invalidateNotificationCache(container, ctx, "created");
       await emitNotificationCreatedBatch(eventBus, notifications, ctx);
       await emitNotificationSseEvents(eventBus, notifications, ctx, recipientUserIds);
       return notifications;
@@ -208,7 +189,6 @@ function createNotificationService(deps) {
         }
         await tx.flush();
       });
-      await invalidateNotificationCache(container, ctx, "created");
       await emitNotificationCreatedBatch(eventBus, notifications, ctx);
       await emitNotificationSseEvents(eventBus, notifications, ctx, uniqueRecipientUserIds);
       return notifications;
@@ -233,7 +213,6 @@ function createNotificationService(deps) {
         }
         await tx.flush();
       });
-      await invalidateNotificationCache(container, ctx, "created");
       await emitNotificationCreatedBatch(eventBus, notifications, ctx);
       await emitNotificationSseEvents(eventBus, notifications, ctx, uniqueRecipientUserIds);
       return notifications;
@@ -245,7 +224,6 @@ function createNotificationService(deps) {
         notification.status = "read";
         notification.readAt = /* @__PURE__ */ new Date();
         await em.flush();
-        await invalidateNotificationCache(container, ctx, "updated", notification.id);
         await eventBus.emit(NOTIFICATION_EVENTS.READ, {
           notificationId: notification.id,
           userId: ctx.userId,
@@ -281,7 +259,6 @@ function createNotificationService(deps) {
         })
       ).executeTakeFirst();
       const result = Number(updateResult?.numUpdatedRows ?? targetRows.length);
-      await invalidateNotificationCache(container, ctx, "updated");
       const notifications = await findWithDecryption(em, Notification, {
         id: { $in: targetRows.map((row) => row.id) }
       }, void 0, {
@@ -309,7 +286,6 @@ function createNotificationService(deps) {
       notification.status = "dismissed";
       notification.dismissedAt = /* @__PURE__ */ new Date();
       await em.flush();
-      await invalidateNotificationCache(container, ctx, "updated", notification.id);
       await eventBus.emit(NOTIFICATION_EVENTS.DISMISSED, {
         notificationId: notification.id,
         userId: ctx.userId,
@@ -332,7 +308,6 @@ function createNotificationService(deps) {
         notification.readAt = /* @__PURE__ */ new Date();
       }
       await em.flush();
-      await invalidateNotificationCache(container, ctx, "updated", notification.id);
       await eventBus.emit(NOTIFICATION_EVENTS.RESTORED, {
         notificationId: notification.id,
         userId: ctx.userId,
@@ -417,7 +392,6 @@ function createNotificationService(deps) {
         notification.readAt = /* @__PURE__ */ new Date();
       }
       await em.flush();
-      await invalidateNotificationCache(container, ctx, "updated", notification.id);
       await eventBus.emit(NOTIFICATION_EVENTS.ACTIONED, {
         notificationId: notification.id,
         actionId: input.actionId,
@@ -431,16 +405,14 @@ function createNotificationService(deps) {
       return em.count(Notification, {
         recipientUserId: ctx.userId,
         tenantId: ctx.tenantId,
-        status: "unread",
-        ...buildNotificationReadScopeWhere(ctx)
+        status: "unread"
       });
     },
     async getPollData(ctx, since) {
       const em = rootEm.fork();
       const filters = {
         recipientUserId: ctx.userId,
-        tenantId: ctx.tenantId,
-        ...buildNotificationReadScopeWhere(ctx)
+        tenantId: ctx.tenantId
       };
       if (since) {
         filters.createdAt = { $gt: new Date(since) };
@@ -453,8 +425,7 @@ function createNotificationService(deps) {
         em.count(Notification, {
           recipientUserId: ctx.userId,
           tenantId: ctx.tenantId,
-          status: "unread",
-          ...buildNotificationReadScopeWhere(ctx)
+          status: "unread"
         })
       ]);
       const recent = notifications.map(toNotificationDto);
@@ -469,32 +440,17 @@ function createNotificationService(deps) {
     async cleanupExpired() {
       const em = rootEm.fork();
       const db = getDb(em);
-      const affectedScopes = await db.selectFrom("notifications").select([
-        "tenant_id",
-        "organization_id"
-      ]).where("expires_at", "<", sql`now()`).where("status", "not in", ["actioned", "dismissed"]).distinct().execute();
-      if (!affectedScopes.length) return 0;
       const updateResult = await db.updateTable("notifications").set({
         status: "dismissed",
         dismissed_at: sql`now()`
       }).where("expires_at", "<", sql`now()`).where("status", "not in", ["actioned", "dismissed"]).executeTakeFirst();
-      for (const scope of affectedScopes) {
-        await invalidateNotificationCache(container, {
-          tenantId: scope.tenant_id,
-          organizationId: scope.organization_id
-        }, "updated");
-      }
       return Number(updateResult?.numUpdatedRows ?? 0);
     },
     async deleteBySource(sourceEntityType, sourceEntityId, ctx) {
       const em = rootEm.fork();
       const db = getDb(em);
       const deleteResult = await db.deleteFrom("notifications").where("source_entity_type", "=", sourceEntityType).where("source_entity_id", "=", sourceEntityId).where("tenant_id", "=", ctx.tenantId).executeTakeFirst();
-      const deletedCount = Number(deleteResult?.numDeletedRows ?? 0);
-      if (deletedCount > 0) {
-        await invalidateNotificationCache(container, ctx, "deleted");
-      }
-      return deletedCount;
+      return Number(deleteResult?.numDeletedRows ?? 0);
     }
   };
 }