@open-mercato/core 0.6.8-develop.6983.1.e4f794099e → 0.6.8-develop.6985.1.fb93574faa

package/src/modules/notifications/lib/notification-type-registry.ts

@@ -0,0 +1,182 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { type Kysely, sql } from 'kysely'
+import type { NotificationTypeDefinition } from '@open-mercato/shared/modules/notifications/types'
+import { deriveCategory } from './derive-category'
+
+const registry = new Map<string, NotificationTypeDefinition>()
+
+let synced = false
+
+export type RegisterNotificationTypesOptions = {
+  replace?: boolean
+}
+
+/**
+ * In-memory mirror of the code-registered notification type catalogue. Fed at
+ * app bootstrap from the generated aggregate (`notificationTypes`) — mirrors the
+ * `messages` registry. This stays the source of truth for code; the
+ * `notification_types` table is a read-through mirror for remote clients.
+ */
+export function registerNotificationTypes(
+  types: NotificationTypeDefinition[],
+  options: RegisterNotificationTypesOptions = {},
+): void {
+  if (options.replace) {
+    registry.clear()
+    synced = false
+  }
+  for (const type of types) {
+    registry.set(type.type, type)
+  }
+}
+
+export function getNotificationType(type: string): NotificationTypeDefinition | undefined {
+  return registry.get(type)
+}
+
+export function getNotificationTypes(): NotificationTypeDefinition[] {
+  return Array.from(registry.values())
+}
+
+export type SyncNotificationTypesResult = {
+  created: number
+  updated: number
+  deleted: number
+  total: number
+}
+
+/**
+ * Reconcile the in-memory catalogue into the `notification_types` table.
+ * Code-registered types are system-wide, so rows are written with
+ * `tenant_id IS NULL`. Idempotent: updates the mirrored columns
+ * (`label_key`/`description_key`/`category`/`silent`/`non_opt_out`) only on
+ * drift, and prunes system-wide rows no longer in the catalogue. Guarded by a
+ * once-per-process flag on the lazy path; pass `force` to bypass it (used by the
+ * explicit `notifications.type_registry.sync` subscriber).
+ *
+ * Writes go through kysely with `INSERT ... ON CONFLICT DO NOTHING` so a
+ * concurrent first-sync (or the seedDefaults subscriber racing a `GET /types`)
+ * can never raise a duplicate-PK 500 — mirrors `query_index/lib/jobs.ts`.
+ */
+export async function syncNotificationTypes(
+  em: EntityManager,
+  opts: { force?: boolean } = {},
+): Promise<SyncNotificationTypesResult> {
+  const definitions = getNotificationTypes()
+  if (synced && !opts.force) {
+    return { created: 0, updated: 0, deleted: 0, total: definitions.length }
+  }
+
+  const db = em.getKysely<any>() as Kysely<any>
+
+  // Read existing system-wide rows via kysely (not the ORM) so they stay out of the identity map and
+  // the route's subsequent em.find reflects exactly what this function just wrote.
+  const existing = (await db
+    .selectFrom('notification_types')
+    .select(['id', 'label_key', 'description_key', 'category', 'silent', 'non_opt_out'])
+    .where('tenant_id', 'is', null)
+    .execute()) as Array<{
+    id: string
+    label_key: string
+    description_key: string | null
+    category: string | null
+    silent: boolean
+    non_opt_out: boolean
+  }>
+  const byId = new Map(existing.map((row) => [row.id, row]))
+
+  const labelKeyFor = (def: NotificationTypeDefinition) => def.labelKey ?? def.titleKey
+  const descKeyFor = (def: NotificationTypeDefinition) => def.descriptionKey ?? null
+  // Resolved once here so every mirrored row carries a grouping key and read paths
+  // (GET /api/notifications/types) never need a fallback branch of their own.
+  const categoryFor = (def: NotificationTypeDefinition) => def.category ?? deriveCategory(def.type)
+  const silentFor = (def: NotificationTypeDefinition) => def.silent === true
+  const nonOptOutFor = (def: NotificationTypeDefinition) => def.nonOptOut === true
+
+  // Internal/admin-only types (`hiddenFromSettings`) are never exposed to the client catalogue: they
+  // are excluded from create/update, and — because they drop out of `validIds` below — any stale row
+  // for a type that was flipped to hidden gets pruned. They remain in the in-memory registry for
+  // delivery logic. GET /api/notifications/types therefore never lists them.
+  const visibleDefinitions = definitions.filter((def) => def.hiddenFromSettings !== true)
+
+  const toCreate = visibleDefinitions.filter((def) => !byId.has(def.type))
+  const toUpdate = visibleDefinitions.filter((def) => {
+    const row = byId.get(def.type)
+    if (!row) return false
+    return (
+      row.label_key !== labelKeyFor(def) ||
+      (row.description_key ?? null) !== descKeyFor(def) ||
+      (row.category ?? null) !== categoryFor(def) ||
+      row.silent !== silentFor(def) ||
+      row.non_opt_out !== nonOptOutFor(def)
+    )
+  })
+
+  let created = 0
+  let updated = 0
+  let deleted = 0
+
+  if (toCreate.length) {
+    await db
+      .insertInto('notification_types')
+      .values(
+        toCreate.map((def) => ({
+          id: def.type,
+          tenant_id: null,
+          label_key: labelKeyFor(def),
+          description_key: descKeyFor(def),
+          category: categoryFor(def),
+          silent: silentFor(def),
+          non_opt_out: nonOptOutFor(def),
+          created_at: sql`now()`,
+          updated_at: sql`now()`,
+        })),
+      )
+      .onConflict((oc: any) => oc.column('id').doNothing())
+      .execute()
+    created = toCreate.length
+  }
+
+  // Bump updated_at only on real drift, so repeated syncs don't churn timestamps.
+  for (const def of toUpdate) {
+    await db
+      .updateTable('notification_types')
+      .set({
+        label_key: labelKeyFor(def),
+        description_key: descKeyFor(def),
+        category: categoryFor(def),
+        silent: silentFor(def),
+        non_opt_out: nonOptOutFor(def),
+        updated_at: sql`now()`,
+      })
+      .where('id', '=', def.type)
+      .where('tenant_id', 'is', null)
+      .execute()
+    updated += 1
+  }
+
+  // Prune system-wide rows no longer in the catalogue (a removed/renamed module's type stops showing
+  // in the preferences matrix). Guarded by a non-empty catalogue so a mis-bootstrapped process with an
+  // empty registry can never wipe the table. Known limitation, deliberately not addressed here: the
+  // guard is a count, not a completeness check, so a process holding a PARTIAL catalogue still prunes
+  // the missing modules' rows — same for multiple apps with different module sets sharing one DB.
+  // Both are bounded: `synced` limits it to one sync per process, the rows come back on the next
+  // full-catalogue sync, and nothing cascades (overrides and preferences reference the type by plain
+  // string id with no FK, so they survive and re-attach). Closing it properly means gating on the
+  // enabled-module set that fed the registry, or moving the prune off this lazy read path entirely.
+  if (definitions.length > 0) {
+    const validIds = new Set(visibleDefinitions.map((def) => def.type))
+    const staleIds = existing.filter((row) => !validIds.has(row.id)).map((row) => row.id)
+    if (staleIds.length) {
+      await db
+        .deleteFrom('notification_types')
+        .where('tenant_id', 'is', null)
+        .where('id', 'in', staleIds)
+        .execute()
+      deleted = staleIds.length
+    }
+  }
+
+  synced = true
+  return { created, updated, deleted, total: definitions.length }
+}

package/src/modules/notifications/lib/notificationCopy.ts

@@ -0,0 +1,34 @@
+import { loadDictionary } from '@open-mercato/shared/lib/i18n/server'
+import { createFallbackTranslator } from '@open-mercato/shared/lib/i18n/translate'
+import { defaultLocale, type Locale } from '@open-mercato/shared/lib/i18n/config'
+
+/**
+ * Localizable notification copy: i18n keys + variables, with already-resolved (or raw) strings as
+ * the fallback when a key is absent or has no translation. Structurally satisfied by a `Notification`
+ * row (in-app/email delivery) and built ad hoc by the push fan-out (per-device delivery).
+ */
+export type NotificationCopySource = {
+  titleKey?: string | null
+  bodyKey?: string | null
+  titleVariables?: Record<string, string> | null
+  bodyVariables?: Record<string, string> | null
+  title: string
+  body?: string | null
+}
+
+/**
+ * Resolve a notification's title/body in a given locale. Dictionaries are memoized by
+ * {@link loadDictionary}, so repeated calls per locale are cheap. Also returns the translator so
+ * callers can localize sibling strings (email chrome, action labels) without reloading the dictionary.
+ */
+export async function resolveNotificationCopy(source: NotificationCopySource, locale: Locale = defaultLocale) {
+  const dictionary = await loadDictionary(locale)
+  const t = createFallbackTranslator(dictionary)
+  const title = source.titleKey
+    ? t(source.titleKey, source.title ?? source.titleKey, source.titleVariables ?? undefined)
+    : source.title
+  const body = source.bodyKey
+    ? t(source.bodyKey, source.body ?? source.bodyKey ?? '', source.bodyVariables ?? undefined)
+    : source.body ?? null
+  return { title, body, t }
+}

package/src/modules/notifications/lib/notificationFactory.ts

@@ -15,7 +15,8 @@ export function buildNotificationEntity(
   em: EntityManager,
   input: NotificationContentInput,
   recipientUserId: string,
-  ctx: NotificationTenantContext
+  ctx: NotificationTenantContext,
+  channels: string[] | null = null
 ): Notification {
   const actions = sanitizeNotificationActions(input.actions)
   const linkHref = assertSafeNotificationHref(input.linkHref)
@@ -44,6 +45,9 @@ export function buildNotificationEntity(
     sourceEntityId: input.sourceEntityId,
     linkHref,
     groupKey: input.groupKey,
+    data: input.data ?? null,
+    pushOptions: input.pushOptions ?? null,
+    channels,
     expiresAt: input.expiresAt ? new Date(input.expiresAt) : null,
     tenantId: ctx.tenantId,
     organizationId: ctx.organizationId,

package/src/modules/notifications/lib/notificationMapper.ts

@@ -37,6 +37,8 @@ export function toNotificationDto(notification: Notification): NotificationDto {
     sourceEntityType: notification.sourceEntityType,
     sourceEntityId: notification.sourceEntityId,
     linkHref: notification.linkHref,
+    data: notification.data ?? null,
+    channels: notification.channels ?? null,
     createdAt: createdAt.toISOString(),
     readAt: notification.readAt?.toISOString() ?? null,
     actionTaken: notification.actionTaken,

package/src/modules/notifications/lib/notificationPreferenceService.ts

@@ -0,0 +1,138 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
+import { NotificationPreference } from '../data/entities'
+import { getNotificationType } from './notification-type-registry'
+import { getNotificationTypeOverrides } from './typeOverrides'
+
+/**
+ * Tenant + user scope for preference operations. Tenant scoping is mandatory,
+ * so it is part of every call (the spec's bare `userId` signatures are widened
+ * here to stay tenant-safe).
+ */
+export interface NotificationPreferenceScope {
+  tenantId: string
+  userId: string
+}
+
+export interface NotificationPreferenceInput {
+  typeId: string
+  channel: string
+  enabled: boolean
+}
+
+export interface NotificationPreferenceService {
+  /**
+   * Whether a channel is enabled for a user + type. Defaults to `true` when no
+   * row exists (lazy-seed, default-on) — does not write.
+   */
+  isChannelEnabled(scope: NotificationPreferenceScope, typeId: string, channel: string): Promise<boolean>
+  /**
+   * Bulk find-or-upsert of preference rows for the scoped user. Returns the number of rows actually
+   * changed (created, or whose `enabled` flipped) so callers can skip emitting events on no-op writes.
+   */
+  setPreferences(scope: NotificationPreferenceScope, items: NotificationPreferenceInput[]): Promise<number>
+  /** All stored preference rows for the scoped user (absence ⇒ enabled). */
+  listForUser(scope: NotificationPreferenceScope): Promise<NotificationPreference[]>
+}
+
+export interface NotificationPreferenceServiceDeps {
+  em: EntityManager
+}
+
+export function createNotificationPreferenceService(
+  deps: NotificationPreferenceServiceDeps,
+): NotificationPreferenceService {
+  const { em: rootEm } = deps
+
+  return {
+    async isChannelEnabled(scope, typeId, channel) {
+      const row = await rootEm.findOne(NotificationPreference, {
+        tenantId: scope.tenantId,
+        userId: scope.userId,
+        notificationTypeId: typeId,
+        channel,
+      })
+      return row ? row.enabled : true
+    },
+
+    async listForUser(scope) {
+      return rootEm.find(
+        NotificationPreference,
+        { tenantId: scope.tenantId, userId: scope.userId },
+        { orderBy: { notificationTypeId: 'asc', channel: 'asc' } },
+      )
+    },
+
+    async setPreferences(scope, items) {
+      const storedOverrides = items.length
+        ? await getNotificationTypeOverrides(rootEm.fork(), scope.tenantId, items.map((item) => item.typeId))
+        : new Map()
+      // Effectively-nonOptOut types (operator override ?? code flag) ignore stored preferences at
+      // delivery time; refuse to persist an opt-out row for them so the stored state can never
+      // contradict enforcement. An `enabled: true` write matches the forced-on state and is
+      // allowed through (a preferences UI can still confirm it).
+      const optOutFiltered = items.filter((item) => {
+        if (item.enabled === true) return true
+        const nonOptOut =
+          storedOverrides.get(item.typeId)?.nonOptOut ?? getNotificationType(item.typeId)?.nonOptOut
+        return nonOptOut !== true
+      })
+      // Channels outside the type's effective eligibility (operator override on
+      // `notification_types.channels`, else the code-declared `type.channels`) are locked:
+      // delivery rejects them before preferences and the UI renders the cell off, so a stored
+      // row would only lie. Drop those writes server-side (the UI lock is not a guarantee).
+      const writable = optOutFiltered.filter((item) => {
+        const eligible = storedOverrides.get(item.typeId)?.channels ?? getNotificationType(item.typeId)?.channels
+        return !eligible || eligible.includes(item.channel)
+      })
+      if (writable.length === 0) return 0
+      const em = rootEm.fork()
+      const existing = await em.find(NotificationPreference, {
+        tenantId: scope.tenantId,
+        userId: scope.userId,
+      })
+      const byKey = new Map(
+        existing.map((row) => [`${row.notificationTypeId}::${row.channel}`, row]),
+      )
+
+      let changed = 0
+      await withAtomicFlush(
+        em,
+        [
+          () => {
+            for (const item of writable) {
+              const row = byKey.get(`${item.typeId}::${item.channel}`)
+              if (row) {
+                if (row.enabled === item.enabled) continue
+                row.enabled = item.enabled
+                changed += 1
+                continue
+              }
+              const next = em.create(NotificationPreference, {
+                tenantId: scope.tenantId,
+                userId: scope.userId,
+                notificationTypeId: item.typeId,
+                channel: item.channel,
+                enabled: item.enabled,
+              })
+              em.persist(next)
+              changed += 1
+            }
+          },
+        ],
+        { transaction: true, label: 'notifications.setPreferences' },
+      )
+      return changed
+    },
+  }
+}
+
+export function resolveNotificationPreferenceService(container: {
+  resolve: (name: string) => unknown
+}): NotificationPreferenceService {
+  // Construct from the request-scoped `em`, mirroring `resolveNotificationService`. (The request
+  // container does not expose the module's scoped service bindings, so resolving `em` directly is the
+  // module convention — see notificationService.ts.)
+  const em = container.resolve('em') as EntityManager
+  return createNotificationPreferenceService({ em })
+}