@open-mercato/core 0.6.8-develop.6983.1.e4f794099e → 0.6.8-develop.6985.1.fb93574faa

package/src/modules/notifications/api/types/[id]/channels/[channel]/route.ts

@@ -0,0 +1,226 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { isUniqueViolation } from '@open-mercato/shared/lib/crud/errors'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { NotificationType } from '../../../../../data/entities'
+import { syncNotificationTypes } from '../../../../../lib/notification-type-registry'
+import { computeChannelsPatch } from '../../../../../lib/typeChannelSettings'
+import {
+  applyTypeOverride,
+  loadTypeOverrideForUpdate,
+  resolveCatalogueTranslate,
+  resolveEffectiveChannels,
+  resolveRegisteredChannelIds,
+  typeItem,
+} from '../../../../../lib/typeCatalogue'
+import { notificationTypeItemSchema } from '../../../../../data/validators'
+import { errorResponseSchema } from '../../../../openapi'
+import {
+  NOTIFICATION_SETTINGS_RESOURCE_KIND,
+  notificationCrudErrorResponse,
+  runGuardedNotificationWrite,
+} from '../../../../../lib/routeHelpers'
+
+const logger = createLogger('notifications').child({ component: 'type-channels-api' })
+
+const paramsSchema = z.object({
+  id: z.string().min(1),
+  channel: z.string().min(1),
+})
+
+export const metadata = {
+  PUT: { requireAuth: true, requireFeatures: ['notifications.manage'] },
+  DELETE: { requireAuth: true, requireFeatures: ['notifications.manage'] },
+}
+
+type RouteContext = { params?: { id?: string; channel?: string } | Promise<{ id?: string; channel?: string }> }
+
+async function readParams(ctx: RouteContext) {
+  const raw = await ctx.params
+  return paramsSchema.parse({ id: raw?.id, channel: raw?.channel })
+}
+
+/**
+ * Enable (`PUT`) or disable (`DELETE`) ONE channel for a notification type in the caller's tenant.
+ *
+ * Why a per-channel sub-resource rather than PATCHing the whole `channels` array: the array form
+ * makes the client read-modify-write the full set, so two operators editing the same type from
+ * stale views silently clobber each other — and while no override row exists yet there is no
+ * `updated_at` to version-lock against, so the optimistic-lock guard cannot even detect it. Here
+ * the server derives the next set from the CURRENT stored state under a row lock, so a concurrent
+ * toggle of a different channel survives. Same shape as the other member-collection endpoints in
+ * the repo (`customers/people/{id}/companies/{companyId}`, `catalog` media attach/detach).
+ *
+ * The full-array `PATCH /api/notifications/types` stays supported and unchanged for callers that
+ * genuinely want to set the whole set at once.
+ */
+async function toggleChannel(req: Request, ctx: RouteContext, enabled: boolean): Promise<Response> {
+  const { t } = await resolveTranslations()
+  const auth = await getAuthFromRequest(req)
+  if (!auth?.sub || !auth.tenantId) {
+    return NextResponse.json({ error: t('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })
+  }
+  const tenantId = auth.tenantId
+
+  let params: z.infer<typeof paramsSchema>
+  try {
+    params = await readParams(ctx)
+  } catch {
+    return NextResponse.json(
+      { error: t('api.errors.invalidPayload', 'Invalid request body') },
+      { status: 400 },
+    )
+  }
+
+  const container = await createRequestContainer()
+  try {
+    const em = container.resolve('em') as EntityManager
+    await syncNotificationTypes(em)
+    const row = await em.findOne(NotificationType, {
+      id: params.id,
+      $or: [{ tenantId: null }, { tenantId }],
+    })
+    if (!row) {
+      return NextResponse.json(
+        { error: t('notifications.types.unknownType', 'Unknown notification type') },
+        { status: 404 },
+      )
+    }
+
+    // Reject unregistered channels up front: silently storing one would put a dead entry in the
+    // eligibility set that no delivery strategy can ever satisfy.
+    const registeredChannelIds = resolveRegisteredChannelIds()
+    if (!registeredChannelIds.includes(params.channel)) {
+      return NextResponse.json(
+        { error: t('notifications.types.unknownChannel', 'Unknown notification channel') },
+        { status: 404 },
+      )
+    }
+
+    const translate = await resolveCatalogueTranslate(req)
+
+    const guarded = await runGuardedNotificationWrite(
+      container,
+      {
+        tenantId,
+        organizationId: auth.orgId ?? null,
+        userId: auth.sub ?? null,
+      },
+      req,
+      {
+        resourceKind: NOTIFICATION_SETTINGS_RESOURCE_KIND,
+        resourceId: row.id,
+        operation: 'update',
+        payload: { id: row.id, channel: params.channel, enabled },
+      },
+      async () => {
+        // optimistic-lock-exempt: notification type channel add/remove. The next set is derived
+        // server-side from the current stored state inside a transaction that holds a row lock on
+        // the override, so a concurrent toggle cannot be lost — there is no shared aggregate for a
+        // version check to protect. Mirrors the add/remove endpoints in customers/catalog/staff.
+        const applyOnce = async () => {
+          return em.transactional(async (tem) => {
+            const existing = await loadTypeOverrideForUpdate(tem, tenantId, row.id)
+            const base = resolveEffectiveChannels(row.id, existing?.channels, registeredChannelIds)
+            // Unchecking the last channel maps to `null` (clear the override → the code-declared
+            // default reapplies) rather than an empty set, which would black-hole the type.
+            const nextChannels = computeChannelsPatch(base, params.channel, enabled)
+            const override = applyTypeOverride(tem, {
+              tenantId,
+              notificationTypeId: row.id,
+              existing,
+              nextChannels,
+              nextNonOptOut: existing?.nonOptOut ?? null,
+            })
+            await tem.flush()
+            return typeItem(row, override, translate)
+          })
+        }
+
+        try {
+          return await applyOnce()
+        } catch (err) {
+          // First-write race: no row existed to lock, so a concurrent INSERT for this
+          // (tenant, type) won and the partial unique index rejected ours. A single-channel
+          // toggle is idempotent, so re-apply it on top of the winner instead of surfacing a
+          // conflict the operator would only have to resolve by clicking again.
+          if (!isUniqueViolation(err)) throw err
+          em.clear()
+          return applyOnce()
+        }
+      },
+    )
+    if (!guarded.ok) return guarded.response
+    return NextResponse.json({ ok: true, item: guarded.result })
+  } catch (error) {
+    const crudResponse = notificationCrudErrorResponse(error)
+    if (crudResponse) return crudResponse
+    logger.error('notification type channel toggle failed', {
+      typeId: params.id,
+      channel: params.channel,
+      enabled,
+      error: error instanceof Error ? error.message : String(error),
+    })
+    return NextResponse.json(
+      { error: t('api.errors.internal', 'Internal error') },
+      { status: 500 },
+    )
+  } finally {
+    const disposable = container as unknown as { dispose?: () => Promise<void> }
+    if (typeof disposable.dispose === 'function') await disposable.dispose()
+  }
+}
+
+export async function PUT(req: Request, ctx: RouteContext): Promise<Response> {
+  return toggleChannel(req, ctx, true)
+}
+
+export async function DELETE(req: Request, ctx: RouteContext): Promise<Response> {
+  return toggleChannel(req, ctx, false)
+}
+
+const toggleResponseSchema = z.object({
+  ok: z.literal(true),
+  item: notificationTypeItemSchema,
+})
+
+export const openApi = {
+  PUT: {
+    summary: 'Enable one delivery channel for a notification type',
+    description:
+      'Adds a single channel to the tenant\'s eligibility set for this notification type. The next set is derived server-side from the currently stored state under a row lock, so concurrent toggles of different channels do not overwrite each other — prefer this over `PATCH /api/notifications/types` with a full `channels` array whenever a UI toggles one cell at a time. Idempotent: enabling an already-enabled channel is a no-op. Returns the refreshed catalogue item.',
+    tags: ['Notifications'],
+    responses: {
+      200: {
+        description: 'Updated notification type',
+        content: { 'application/json': { schema: toggleResponseSchema } },
+      },
+      401: { description: 'Unauthorized', content: { 'application/json': { schema: errorResponseSchema } } },
+      404: {
+        description: 'Unknown notification type or unregistered channel',
+        content: { 'application/json': { schema: errorResponseSchema } },
+      },
+    },
+  },
+  DELETE: {
+    summary: 'Disable one delivery channel for a notification type',
+    description:
+      'Removes a single channel from the tenant\'s eligibility set for this notification type, with the same concurrency-safe server-side derivation as `PUT`. Removing the last remaining channel clears the override entirely so the code-declared default reapplies (an empty set is never stored — it would leave the type undeliverable). Idempotent: disabling an already-disabled channel is a no-op.',
+    tags: ['Notifications'],
+    responses: {
+      200: {
+        description: 'Updated notification type',
+        content: { 'application/json': { schema: toggleResponseSchema } },
+      },
+      401: { description: 'Unauthorized', content: { 'application/json': { schema: errorResponseSchema } } },
+      404: {
+        description: 'Unknown notification type or unregistered channel',
+        content: { 'application/json': { schema: errorResponseSchema } },
+      },
+    },
+  },
+}

package/src/modules/notifications/api/types/route.ts

@@ -0,0 +1,239 @@
+import { NextResponse } from 'next/server'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { conflict, isUniqueViolation } from '@open-mercato/shared/lib/crud/errors'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { z } from 'zod'
+import { NotificationType, NotificationTypeOverride } from '../../data/entities'
+import { syncNotificationTypes } from '../../lib/notification-type-registry'
+import { applyTypeOverride, resolveCatalogueTranslate, typeItem } from '../../lib/typeCatalogue'
+import { notificationTypeItemSchema, updateNotificationTypeSchema } from '../../data/validators'
+import { errorResponseSchema } from '../openapi'
+import {
+  NOTIFICATION_SETTINGS_RESOURCE_KIND,
+  notificationCrudErrorResponse,
+  runGuardedNotificationWrite,
+} from '../../lib/routeHelpers'
+
+const logger = createLogger('notifications').child({ component: 'types-api' })
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['notifications.view'] },
+  PATCH: { requireAuth: true, requireFeatures: ['notifications.manage'] },
+}
+
+export async function GET(req: Request) {
+  const { t } = await resolveTranslations()
+  const auth = await getAuthFromRequest(req)
+  if (!auth?.sub || !auth.tenantId) {
+    return NextResponse.json({ error: t('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })
+  }
+
+  const container = await createRequestContainer()
+  try {
+    const em = container.resolve('em') as EntityManager
+    // Read-through mirror: ensure the catalogue is reflected in the DB (once per process).
+    await syncNotificationTypes(em)
+    const rows = await em.find(
+      NotificationType,
+      { $or: [{ tenantId: null }, { tenantId: auth.tenantId }] },
+      { orderBy: { id: 'asc' } },
+    )
+    const overrides = await em.find(NotificationTypeOverride, {
+      tenantId: auth.tenantId,
+      notificationTypeId: { $in: rows.map((row) => row.id) },
+    })
+    const overrideByType = new Map(overrides.map((override) => [override.notificationTypeId, override]))
+    const translate = await resolveCatalogueTranslate(req)
+    return NextResponse.json({
+      items: rows.map((row) => typeItem(row, overrideByType.get(row.id), translate)),
+    })
+  } finally {
+    const disposable = container as unknown as { dispose?: () => Promise<void> }
+    if (typeof disposable.dispose === 'function') await disposable.dispose()
+  }
+}
+
+export async function PATCH(req: Request) {
+  // Admin write: the echoed item stays on the request-context locale (no `?locale=`
+  // override), so the confirmation matches the operator's own session.
+  const { t, translate } = await resolveTranslations()
+  const auth = await getAuthFromRequest(req)
+  if (!auth?.sub || !auth.tenantId) {
+    return NextResponse.json({ error: t('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })
+  }
+  const tenantId = auth.tenantId
+
+  let body: unknown
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json(
+      { error: t('api.errors.invalidPayload', 'Invalid request body') },
+      { status: 400 },
+    )
+  }
+
+  const parsed = updateNotificationTypeSchema.safeParse(body)
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: t('notifications.types.invalidChannels', 'Invalid channels payload') },
+      { status: 400 },
+    )
+  }
+
+  const container = await createRequestContainer()
+  try {
+    const em = container.resolve('em') as EntityManager
+    await syncNotificationTypes(em)
+    const row = await em.findOne(NotificationType, {
+      id: parsed.data.id,
+      $or: [{ tenantId: null }, { tenantId }],
+    })
+    if (!row) {
+      return NextResponse.json(
+        { error: t('notifications.types.unknownType', 'Unknown notification type') },
+        { status: 404 },
+      )
+    }
+    const existing = await em.findOne(NotificationTypeOverride, {
+      tenantId,
+      notificationTypeId: row.id,
+    })
+
+    const guarded = await runGuardedNotificationWrite(
+      container,
+      {
+        tenantId,
+        organizationId: auth.orgId ?? null,
+        userId: auth.sub ?? null,
+      },
+      req,
+      {
+        resourceKind: NOTIFICATION_SETTINGS_RESOURCE_KIND,
+        resourceId: row.id,
+        operation: 'update',
+        payload: parsed.data as unknown as Record<string, unknown>,
+      },
+      async () => {
+        // Same 409 contract as the CRUD guard: a stale admin view (another operator saved
+        // since this client loaded the catalogue) must not silently clobber the newer
+        // override — the full `channels` array replaces, so a blind write loses edits.
+        enforceCommandOptimisticLock({
+          resourceKind: NOTIFICATION_SETTINGS_RESOURCE_KIND,
+          resourceId: row.id,
+          current: existing?.updatedAt ?? null,
+          request: req,
+        })
+        const nextChannels = parsed.data.channels !== undefined ? parsed.data.channels : existing?.channels ?? null
+        const nextNonOptOut = parsed.data.nonOptOut !== undefined ? parsed.data.nonOptOut : existing?.nonOptOut ?? null
+        const override = applyTypeOverride(em, {
+          tenantId,
+          notificationTypeId: row.id,
+          existing,
+          nextChannels,
+          nextNonOptOut,
+        })
+        try {
+          await em.flush()
+        } catch (err) {
+          // Concurrent first-write race: another operator created the override for this (tenant, type)
+          // between our read (existing === null) and this flush, so the partial unique index rejects
+          // ours. There was no version to compare, so the optimistic-lock guard couldn't fire — surface
+          // the same 409 it would rather than letting the unique violation fall through to a generic 500.
+          if (isUniqueViolation(err)) {
+            throw conflict(
+              t(
+                'notifications.types.overrideConflict',
+                'Another operator just saved this notification type. Reload and try again.',
+              ),
+            )
+          }
+          throw err
+        }
+        return typeItem(row, override, translate)
+      },
+    )
+    if (!guarded.ok) return guarded.response
+    return NextResponse.json({ ok: true, item: guarded.result })
+  } catch (error) {
+    const crudResponse = notificationCrudErrorResponse(error)
+    if (crudResponse) return crudResponse
+    logger.error('notification type override update failed', {
+      typeId: parsed.data.id,
+      error: error instanceof Error ? error.message : String(error),
+    })
+    return NextResponse.json(
+      { error: t('api.errors.internal', 'Internal error') },
+      { status: 500 },
+    )
+  } finally {
+    const disposable = container as unknown as { dispose?: () => Promise<void> }
+    if (typeof disposable.dispose === 'function') await disposable.dispose()
+  }
+}
+
+export const openApi = {
+  GET: {
+    summary: 'List notification types',
+    description: 'Returns the notification type catalogue (system-wide + tenant) so clients can render a preferences screen. `channels` is the effective channel eligibility for the caller\'s tenant (stored override, else the code-declared set; `null` = every channel); a channel outside it never delivers in that tenant and cannot be enabled by users. `updatedAt` is the override row\'s optimistic-lock version (`null` when the tenant stores no override). `label`, `description` and `categoryLabel` are resolved server-side using the request locale (`?locale=`, `x-locale`, the `locale` cookie, or `Accept-Language`) so clients without the app dictionary can render them directly; `categoryLabel` falls back to the raw category key when the owning module ships no `notifications.categories.<key>` translation, so `categoryLabel === category` signals "no server-side label". `category` defaults to the prefix before the first dot in the type id and is the stable grouping key — group on `category`, display `categoryLabel`.',
+    tags: ['Notifications'],
+    responses: {
+      200: {
+        description: 'Notification type catalogue',
+        content: {
+          'application/json': {
+            schema: z.object({ items: z.array(notificationTypeItemSchema) }),
+          },
+        },
+      },
+      401: {
+        description: 'Unauthorized',
+        content: { 'application/json': { schema: errorResponseSchema } },
+      },
+    },
+  },
+  PATCH: {
+    summary: 'Override a notification type\'s channel eligibility and opt-out governance for the caller\'s tenant',
+    description: 'Tenant-scoped operator overrides for a notification type (stored in `notification_type_overrides`; other tenants are unaffected). `channels` replaces the code-declared eligibility (a channel outside the effective set is completely off for the tenant: it beats user preferences and `nonOptOut`, and preference UIs lock the cell). `nonOptOut` overrides the code-declared opt-out governance (`true` forces the type on for users, `false` makes a required type user-editable). Omitted fields stay untouched; pass `null` to clear a stored override and inherit the code declaration. Sends the standard optimistic-lock header contract: pass the item\'s `updatedAt` as `x-om-ext-optimistic-lock-expected-updated-at` to detect concurrent edits (409 on mismatch).',
+    tags: ['Notifications'],
+    requestBody: {
+      required: true,
+      content: {
+        'application/json': { schema: updateNotificationTypeSchema },
+      },
+    },
+    responses: {
+      200: {
+        description: 'Override saved',
+        content: {
+          'application/json': {
+            schema: z.object({
+              ok: z.literal(true),
+              item: notificationTypeItemSchema,
+            }),
+          },
+        },
+      },
+      400: {
+        description: 'Invalid request body',
+        content: { 'application/json': { schema: errorResponseSchema } },
+      },
+      401: {
+        description: 'Unauthorized',
+        content: { 'application/json': { schema: errorResponseSchema } },
+      },
+      404: {
+        description: 'Unknown notification type',
+        content: { 'application/json': { schema: errorResponseSchema } },
+      },
+      409: {
+        description: 'Optimistic-lock conflict — another operator saved a newer override',
+        content: { 'application/json': { schema: errorResponseSchema } },
+      },
+    },
+  },
+}

package/src/modules/notifications/api/unread-count/route.ts

@@ -13,6 +13,7 @@ import {
   buildNotificationReadScopeWhere,
   getNotificationReadScopeTagOrganizationIds,
 } from '../../lib/notificationScope'
+import { inAppVisibleFilter } from '../../lib/notificationVisibility'
 
 export const metadata = {
   GET: { requireAuth: true },
@@ -75,7 +76,10 @@ export async function GET(req: Request) {
     recipientUserId: userId,
     tenantId: scope.tenantId,
     status: 'unread',
-    ...buildNotificationReadScopeWhere(scope),
+    $and: [
+      buildNotificationReadScopeWhere(scope),
+      inAppVisibleFilter(),
+    ],
   })
 
   if (cache && cacheKey) {

package/src/modules/notifications/backend/notifications/user-preferences/page.meta.ts

@@ -0,0 +1,26 @@
+import React from 'react'
+
+const usersCogIcon = React.createElement(
+  'svg',
+  { width: 16, height: 16, viewBox: '0 0 24 24', fill: 'none', stroke: 'currentColor', strokeWidth: 2, strokeLinecap: 'round', strokeLinejoin: 'round' },
+  React.createElement('path', { d: 'M17 21v-2a4 4 0 0 0-4-4H5a4 4 0 0 0-4 4v2' }),
+  React.createElement('circle', { cx: 9, cy: 7, r: 4 }),
+  React.createElement('circle', { cx: 19, cy: 16, r: 2 }),
+  React.createElement('path', { d: 'M19 12v1' }),
+  React.createElement('path', { d: 'M19 19v1' }),
+)
+
+export const metadata = {
+  requireAuth: true,
+  requireFeatures: ['notifications.manage_user_preferences'],
+  pageTitle: 'User Notification Preferences',
+  pageTitleKey: 'notifications.preferences.admin.pageTitle',
+  pageGroup: 'Auth',
+  pageGroupKey: 'settings.sections.auth',
+  pageOrder: 5,
+  icon: usersCogIcon,
+  pageContext: 'settings' as const,
+  breadcrumb: [
+    { label: 'User Notification Preferences', labelKey: 'notifications.preferences.admin.pageTitle' },
+  ],
+} as const

package/src/modules/notifications/backend/notifications/user-preferences/page.tsx

@@ -0,0 +1,12 @@
+import { Page, PageBody } from '@open-mercato/ui/backend/Page'
+import { NotificationUserPreferencesAdminPageClient } from '../../../frontend/NotificationUserPreferencesAdminPageClient'
+
+export default async function NotificationUserPreferencesAdminPage() {
+  return (
+    <Page>
+      <PageBody>
+        <NotificationUserPreferencesAdminPageClient />
+      </PageBody>
+    </Page>
+  )
+}

package/src/modules/notifications/backend/profile/notification-preferences/page.meta.ts

@@ -0,0 +1,31 @@
+import React from 'react'
+
+const slidersIcon = React.createElement(
+  'svg',
+  { width: 16, height: 16, viewBox: '0 0 24 24', fill: 'none', stroke: 'currentColor', strokeWidth: 2, strokeLinecap: 'round', strokeLinejoin: 'round' },
+  React.createElement('line', { x1: 4, y1: 21, x2: 4, y2: 14 }),
+  React.createElement('line', { x1: 4, y1: 10, x2: 4, y2: 3 }),
+  React.createElement('line', { x1: 12, y1: 21, x2: 12, y2: 12 }),
+  React.createElement('line', { x1: 12, y1: 8, x2: 12, y2: 3 }),
+  React.createElement('line', { x1: 20, y1: 21, x2: 20, y2: 16 }),
+  React.createElement('line', { x1: 20, y1: 12, x2: 20, y2: 3 }),
+  React.createElement('line', { x1: 1, y1: 14, x2: 7, y2: 14 }),
+  React.createElement('line', { x1: 9, y1: 8, x2: 15, y2: 8 }),
+  React.createElement('line', { x1: 17, y1: 16, x2: 23, y2: 16 }),
+)
+
+export const metadata = {
+  requireAuth: true,
+  requireFeatures: ['notifications.manage_preferences'],
+  pageTitle: 'Notification Preferences',
+  pageTitleKey: 'notifications.preferences.pageTitle',
+  pageGroup: 'Profile',
+  pageGroupKey: 'notifications.preferences.profileGroup',
+  pageOrder: 30,
+  icon: slidersIcon,
+  pageContext: 'profile' as const,
+  breadcrumb: [
+    { label: 'Profile', labelKey: 'notifications.preferences.profileGroup' },
+    { label: 'Notification Preferences', labelKey: 'notifications.preferences.pageTitle' },
+  ],
+} as const

package/src/modules/notifications/backend/profile/notification-preferences/page.tsx

@@ -0,0 +1,12 @@
+import { Page, PageBody } from '@open-mercato/ui/backend/Page'
+import { NotificationPreferencesPageClient } from '../../../frontend/NotificationPreferencesPageClient'
+
+export default async function NotificationPreferencesProfilePage() {
+  return (
+    <Page>
+      <PageBody>
+        <NotificationPreferencesPageClient />
+      </PageBody>
+    </Page>
+  )
+}