@rocapine/community 0.1.0 → 0.3.0

package/templates/functions/daily-moderation/index.ts

@@ -1,9 +1,16 @@
 // Daily moderation batch + backstop. Runs every not-yet-moderated post/comment
 // through OpenAI's moderation endpoint (free): flagged -> soft-hide, clean
 // 'pending' -> promote to 'visible' (catches items whose synchronous
-// moderate-one call failed), clean 'visible' -> just stamp. Posts a Slack
-// summary (no-op if SLACK_WEBHOOK_URL is unset — see _shared/slack.ts). Never
-// deletes rows. App criticism is not a category (stays visible).
+// moderate-one call failed), clean 'visible' -> just stamp. Also sweeps
+// not-yet-checked usernames (profiles.username is client-writable, see
+// core/007_username_moderation.sql): flagged -> blanked. Posts a Slack
+// summary when there was something to check (no-op if SLACK_WEBHOOK_URL is
+// unset — see _shared/slack.ts). Never deletes rows. App criticism is not a
+// category (stays visible).
+//
+// Reachable with the anon key (the cron calls it that way) and idempotent:
+// once a sweep has stamped its items, a stray call finds nothing to check and
+// exits without an API call or a Slack post.
 
 import { adminClient } from "../_shared/client.ts";
 import {
@@ -37,11 +44,93 @@ function toOne<T>(v: T | T[] | null | undefined): T | null {
   return Array.isArray(v) ? (v[0] ?? null) : (v ?? null);
 }
 
+/** One OpenAI moderation call for up to 100 inputs; null on any failure so
+ * the caller can skip stamping and retry next run. */
+async function moderateBatch(inputs: string[]): Promise<ModerationResult[] | null> {
+  try {
+    const res = await fetch("https://api.openai.com/v1/moderations", {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${Deno.env.get("OPENAI_API_KEY")}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({ model: "omni-moderation-latest", input: inputs }),
+    });
+    if (!res.ok) return null;
+    const { results } = await res.json();
+    return results as ModerationResult[];
+  } catch {
+    return null;
+  }
+}
+
+interface ProfileItem {
+  id: string;
+  username: string;
+  amplitude_id: string | null;
+  revenuecat_id: string | null;
+}
+
+/**
+ * Username sweep (core/007): moderate every not-yet-checked username, blank
+ * the flagged ones (remembering the value in `username_rejected` so a client
+ * re-sync keeps it blank) and stamp the rest. Capped per run so the first
+ * sweep after the migration stays within the function's time budget. On an
+ * install without core/007 the select errors and the sweep is skipped.
+ */
+async function sweepUsernames(): Promise<{
+  checked: number;
+  blanked: { profile: ProfileItem; categories: string[] }[];
+  failedBatches: number;
+  skipped: boolean;
+}> {
+  const { data, error } = await supabase
+    .from("profiles")
+    .select("id, username, amplitude_id, revenuecat_id")
+    .not("username", "is", null)
+    .is("username_checked_at", null)
+    .limit(1000);
+  if (error) return { checked: 0, blanked: [], failedBatches: 0, skipped: true };
+  const profiles = (data ?? []) as ProfileItem[];
+  const blanked: { profile: ProfileItem; categories: string[] }[] = [];
+  const processed: ProfileItem[] = [];
+  let failedBatches = 0;
+  for (let i = 0; i < profiles.length; i += 100) {
+    const batch = profiles.slice(i, i + 100);
+    const results = await moderateBatch(batch.map((p) => p.username));
+    if (!results) {
+      failedBatches++;
+      continue;
+    }
+    results.forEach((r, idx) => {
+      const cats = flaggedCategories(r);
+      if (cats.length > 0) blanked.push({ profile: batch[idx], categories: cats });
+    });
+    processed.push(...batch);
+  }
+  const now = new Date().toISOString();
+  for (const { profile } of blanked) {
+    // Guarded on the current value: a name changed since the select is left
+    // for the next sweep (the change trigger reset its checked_at anyway).
+    await supabase
+      .from("profiles")
+      .update({ username: null, username_rejected: profile.username, username_checked_at: now })
+      .eq("id", profile.id)
+      .eq("username", profile.username);
+  }
+  const blankedIds = new Set(blanked.map((b) => b.profile.id));
+  const cleanIds = processed.filter((p) => !blankedIds.has(p.id)).map((p) => p.id);
+  if (cleanIds.length > 0) {
+    await supabase.from("profiles").update({ username_checked_at: now }).in("id", cleanIds);
+  }
+  return { checked: processed.length, blanked, failedBatches, skipped: false };
+}
+
 Deno.serve(async () => {
   const { data: posts, error: postsError } = await supabase
     .from("posts")
     .select(
-      "id, content, author_id, status, poll_options(idx, label), profiles!posts_author_id_fkey(username, amplitude_id, revenuecat_id)",
+      "id, content, author_id, status, profiles!posts_author_id_fkey(username, amplitude_id, revenuecat_id)",
     )
     .is("moderated_at", null)
     .in("status", ["pending", "visible"]);
@@ -57,16 +146,34 @@ Deno.serve(async () => {
   }
 
   // Poll option labels are user content: fold them into the post's moderated
-  // text (same treatment as the synchronous moderate-one function).
+  // text (same treatment as the synchronous moderate-one function). The polls
+  // module is optional: without it the table doesn't exist, the query errors,
+  // and posts are moderated on their text alone (a separate query instead of
+  // an embed so a core-only install doesn't 400 the whole sweep).
+  const optionsByPost = new Map<string, { idx: number; label: string }[]>();
+  if (posts && posts.length > 0) {
+    const { data: options, error } = await supabase
+      .from("poll_options")
+      .select("post_id, idx, label")
+      .in(
+        "post_id",
+        posts.map((p) => p.id),
+      );
+    if (!error) {
+      for (const o of options ?? []) {
+        const list = optionsByPost.get(o.post_id) ?? [];
+        list.push({ idx: o.idx, label: o.label });
+        optionsByPost.set(o.post_id, list);
+      }
+    }
+  }
   const items: Item[] = [
     ...(posts ?? []).map((p) => ({
       ...p,
       profiles: toOne(p.profiles),
       content: [
         p.content,
-        ...(p.poll_options ?? [])
-          .sort((a: { idx: number }, b: { idx: number }) => a.idx - b.idx)
-          .map((o: { label: string }) => o.label),
+        ...(optionsByPost.get(p.id) ?? []).sort((a, b) => a.idx - b.idx).map((o) => o.label),
       ].join("\n"),
       table: "posts" as const,
     })),
@@ -76,9 +183,6 @@ Deno.serve(async () => {
       table: "comments" as const,
     })),
   ];
-  if (items.length === 0) {
-    return new Response(JSON.stringify({ checked: 0, hidden: 0, failed_batches: 0 }));
-  }
 
   // Moderate in batches of 100 (API limit). Only items whose batch succeeded
   // get stamped moderated_at, so a transient failure is retried tomorrow.
@@ -87,40 +191,29 @@ Deno.serve(async () => {
   let failedBatches = 0;
   for (let i = 0; i < items.length; i += 100) {
     const batch = items.slice(i, i + 100);
-    try {
-      const res = await fetch("https://api.openai.com/v1/moderations", {
-        method: "POST",
-        headers: {
-          Authorization: `Bearer ${Deno.env.get("OPENAI_API_KEY")}`,
-          "Content-Type": "application/json",
-        },
-        body: JSON.stringify({
-          model: "omni-moderation-latest",
-          input: batch.map((it) => it.content),
-        }),
-      });
-      if (!res.ok) {
-        failedBatches++;
-        continue; // skip stamping; retried next run
-      }
-      const { results } = await res.json();
-      results.forEach((r: ModerationResult, idx: number) => {
-        const cats = flaggedCategories(r);
-        if (cats.length > 0) flagged.push({ item: batch[idx], categories: cats });
-      });
-      processed.push(...batch);
-    } catch {
-      failedBatches++; // network error; skip stamping, retried next run
+    const results = await moderateBatch(batch.map((it) => it.content));
+    if (!results) {
+      failedBatches++; // API/network error; skip stamping, retried next run
+      continue;
     }
+    results.forEach((r, idx) => {
+      const cats = flaggedCategories(r);
+      if (cats.length > 0) flagged.push({ item: batch[idx], categories: cats });
+    });
+    processed.push(...batch);
   }
   const totalItems = items.length;
 
   const flaggedIds = new Set(flagged.map((f) => f.item.id));
+  // Status guards: a row the author soft-deleted while the sweep ran must not
+  // be resurrected as hidden/visible, so every write re-checks the status it
+  // was selected with.
   for (const { item, categories } of flagged) {
     await supabase
       .from(item.table)
       .update({ status: "hidden", moderation_reason: categories.join(",") })
-      .eq("id", item.id);
+      .eq("id", item.id)
+      .in("status", ["pending", "visible"]);
   }
   // Backstop: promote clean 'pending' items to 'visible' (their synchronous
   // moderate-one call must have failed).
@@ -128,10 +221,18 @@ Deno.serve(async () => {
   const promotePostIds = promote.filter((i) => i.table === "posts").map((i) => i.id);
   const promoteCommentIds = promote.filter((i) => i.table === "comments").map((i) => i.id);
   if (promotePostIds.length > 0) {
-    await supabase.from("posts").update({ status: "visible" }).in("id", promotePostIds);
+    await supabase
+      .from("posts")
+      .update({ status: "visible" })
+      .in("id", promotePostIds)
+      .eq("status", "pending");
   }
   if (promoteCommentIds.length > 0) {
-    await supabase.from("comments").update({ status: "visible" }).in("id", promoteCommentIds);
+    await supabase
+      .from("comments")
+      .update({ status: "visible" })
+      .in("id", promoteCommentIds)
+      .eq("status", "pending");
   }
   const now = new Date().toISOString();
   const processedPostIds = processed.filter((i) => i.table === "posts").map((i) => i.id);
@@ -143,6 +244,23 @@ Deno.serve(async () => {
     await supabase.from("comments").update({ moderated_at: now }).in("id", processedCommentIds);
   }
 
+  const usernames = await sweepUsernames();
+  const allFailedBatches = failedBatches + usernames.failedBatches;
+
+  // Quiet when there was nothing to check at all (a stray or duplicate call
+  // finds every item already stamped): no Slack noise, no API cost.
+  if (totalItems === 0 && usernames.checked === 0 && allFailedBatches === 0) {
+    return new Response(
+      JSON.stringify({
+        checked: 0,
+        hidden: 0,
+        usernames_checked: 0,
+        usernames_blanked: 0,
+        failed_batches: 0,
+      }),
+    );
+  }
+
   const lines = flagged.map(({ item, categories }) => {
     const p = item.profiles;
     return (
@@ -151,17 +269,28 @@ Deno.serve(async () => {
       `  amplitude: \`${p?.amplitude_id ?? "?"}\` | revenuecat: \`${p?.revenuecat_id ?? "?"}\``
     );
   });
+  const usernameLines = usernames.blanked.map(
+    ({ profile, categories }) =>
+      `* [username] *${profile.username}* blanked, _${categories.join(", ")}_\n` +
+      `  amplitude: \`${profile.amplitude_id ?? "?"}\` | revenuecat: \`${profile.revenuecat_id ?? "?"}\``,
+  );
+  const usernameSummary =
+    usernames.checked > 0
+      ? ` Usernames: ${usernames.blanked.length}/${usernames.checked} blanked.`
+      : "";
   let summaryText: string;
-  if (failedBatches > 0) {
+  if (allFailedBatches > 0) {
     const uncheckedCount = totalItems - processed.length;
     summaryText =
-      `Daily moderation: WARNING, ${failedBatches} batch(es) failed to reach the moderation API ` +
+      `Daily moderation: WARNING, ${allFailedBatches} batch(es) failed to reach the moderation API ` +
       `(${uncheckedCount} of ${totalItems} items were not checked and will be retried). ` +
-      `${flagged.length} items hidden.`;
-  } else if (flagged.length === 0) {
-    summaryText = `Daily moderation: ${processed.length} items checked, nothing to report.`;
+      `${flagged.length} items hidden.${usernameSummary}`;
+  } else if (flagged.length === 0 && usernames.blanked.length === 0) {
+    summaryText = `Daily moderation: ${processed.length} items checked, nothing to report.${usernameSummary}`;
   } else {
-    summaryText = `Daily moderation: ${flagged.length}/${processed.length} items hidden\n\n${lines.join("\n")}`;
+    summaryText =
+      `Daily moderation: ${flagged.length}/${processed.length} items hidden.${usernameSummary}\n\n` +
+      [...lines, ...usernameLines].join("\n");
   }
   await postToSlack({ text: summaryText });
 
@@ -169,7 +298,9 @@ Deno.serve(async () => {
     JSON.stringify({
       checked: processed.length,
       hidden: flagged.length,
-      failed_batches: failedBatches,
+      usernames_checked: usernames.checked,
+      usernames_blanked: usernames.blanked.length,
+      failed_batches: allFailedBatches,
     }),
   );
 });

package/templates/functions/daily-translation/index.ts

@@ -0,0 +1,120 @@
+// Daily translation sweep: back-fills the history after installation and
+// catches every item translate-one missed (API outage, secret set later, a
+// locale added to COMMUNITY_TRANSLATION_LOCALES). Each invocation runs a
+// bounded time budget at limited concurrency, then self-chains (POSTs itself)
+// to keep going until the backlog is drained or MAX_CHAIN is hit. Quiet
+// unless something failed.
+
+import { adminClient, json } from "../_shared/client.ts";
+import { ensureTranslations, runPool, TARGET_LOCALES } from "../_shared/translation.ts";
+import { postToSlack } from "../_shared/slack.ts";
+
+const supabase = adminClient();
+// COMMUNITY_TRANSLATION_SWEEP_BATCH: optional test/cost knob (a small value
+// forces chaining on a small backlog).
+const MAX_ITEMS_PER_KIND = Math.max(
+  1,
+  Number(Deno.env.get("COMMUNITY_TRANSLATION_SWEEP_BATCH")) || 250,
+);
+const CONCURRENCY = 4;
+const TIME_BUDGET_MS = 60_000;
+const MAX_CHAIN = 200;
+
+async function sweep(
+  kind: "post" | "comment",
+  withinBudget: () => boolean,
+): Promise<{ done: number; failed: number; remaining: number }> {
+  const { data, error } = await supabase.rpc("items_missing_translations", {
+    kind,
+    target_locales: TARGET_LOCALES,
+    max_items: MAX_ITEMS_PER_KIND,
+  });
+  if (error) {
+    console.error("items_missing_translations failed", error.message);
+    return { done: 0, failed: 1, remaining: 0 };
+  }
+  const ids = ((data ?? []) as { id: string }[]).map((row) => row.id);
+  const { results, processed } = await runPool(
+    ids,
+    CONCURRENCY,
+    (id) => ensureTranslations(supabase, kind, id),
+    withinBudget,
+  );
+  const done = results.filter((r) => r !== null).length;
+  const failed = processed - done;
+  const remaining = Math.max(ids.length - processed, ids.length === MAX_ITEMS_PER_KIND ? 1 : 0);
+  return { done, failed, remaining };
+}
+
+Deno.serve(async (req) => {
+  if (TARGET_LOCALES.length === 0) {
+    return json({
+      posts: 0,
+      comments: 0,
+      failed: 0,
+      note: "COMMUNITY_TRANSLATION_LOCALES not set",
+    });
+  }
+  const started = Date.now();
+  const withinBudget = () => Date.now() - started < TIME_BUDGET_MS;
+
+  const posts = await sweep("post", withinBudget);
+  const comments = await sweep("comment", withinBudget);
+  const done = posts.done + comments.done;
+  const failed = posts.failed + comments.failed;
+  const remaining = posts.remaining + comments.remaining;
+
+  // The endpoint only needs the public anon key, so the caller controls this
+  // header: clamp to a non-negative integer so a malicious/garbage value (a
+  // large negative number, NaN, -Infinity) can't bypass MAX_CHAIN.
+  const depth = Math.max(0, Math.trunc(Number(req.headers.get("x-community-chain"))) || 0);
+  let chained = false;
+  // Why no chain was started, reported to Slack when items remain.
+  let chainFailure = done > 0 ? "depth cap" : "no progress this run";
+  if (remaining > 0 && done > 0 && depth < MAX_CHAIN) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 2_000);
+    try {
+      const res = await fetch(`${Deno.env.get("SUPABASE_URL")}/functions/v1/daily-translation`, {
+        method: "POST",
+        headers: {
+          // Forward the caller's own JWT (cron/pg_net sends the anon key the CLI
+          // substituted, which passes verify_jwt); the platform's SUPABASE_ANON_KEY
+          // env may be a publishable sb_ key that verify_jwt rejects.
+          Authorization:
+            req.headers.get("authorization") ?? `Bearer ${Deno.env.get("SUPABASE_ANON_KEY")}`,
+          "Content-Type": "application/json",
+          "x-community-chain": String(depth + 1),
+        },
+        body: JSON.stringify({}),
+        signal: controller.signal,
+      });
+      chained = res.ok;
+      if (!res.ok) chainFailure = `chain request failed (${res.status})`;
+    } catch (e) {
+      if (e instanceof DOMException && e.name === "AbortError") {
+        // We stopped waiting after 2s; the request was already sent and the
+        // chained run continues server-side regardless of our response.
+        chained = true;
+      } else {
+        chainFailure = "chain request failed";
+      }
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+
+  // Only the last link of a chain reports: an item that always fails would
+  // otherwise post a warning on every one of up to 200 chained links.
+  if (failed > 0 && !chained) {
+    await postToSlack({
+      text: `Daily translation: WARNING, ${failed} item(s) failed to translate (${posts.done} posts and ${comments.done} comments done, ${remaining} remaining); they will be retried by the next sweep.`,
+    });
+  }
+  if (remaining > 0 && !chained) {
+    await postToSlack({
+      text: `Translation sweep stopped with ${remaining} items remaining (chain not started: ${chainFailure}); the daily cron continues tomorrow.`,
+    });
+  }
+  return json({ posts: posts.done, comments: comments.done, failed, remaining, chained, depth });
+});

package/templates/functions/deno.json

@@ -0,0 +1 @@
+{ "compilerOptions": { "lib": ["deno.window"], "strict": true } }

package/templates/functions/moderate-one/index.ts

@@ -3,8 +3,14 @@
 // promoted to 'visible' (published); flagged -> 'hidden' (rejected) with the
 // reason. On an OpenAI error we fail closed (leave it pending); the daily
 // backstop re-checks stale pending items so nothing is silently lost.
+//
+// Security: the caller must be the row's author (resolved from their user
+// JWT through Auth) or the service role — an anon-key-only call can't
+// moderate someone else's pending item. Every status write is guarded with
+// `status = 'pending'` so a row the author deleted mid-flight is never
+// resurrected.
 
-import { adminClient, json } from "../_shared/client.ts";
+import { adminClient, callerUserId, isServiceCaller, json } from "../_shared/client.ts";
 import { assertModerationConfigured, moderateInput } from "../_shared/moderation.ts";
 
 assertModerationConfigured();
@@ -12,7 +18,10 @@ assertModerationConfigured();
 const supabase = adminClient();
 
 Deno.serve(async (req) => {
-  const { kind, id } = (await req.json()) as { kind: "post" | "comment"; id: string };
+  const { kind, id } = (await req.json().catch(() => ({}))) as {
+    kind?: "post" | "comment";
+    id?: string;
+  };
   if ((kind !== "post" && kind !== "comment") || !id) {
     return json({ status: "error", error: "bad request" }, 400);
   }
@@ -20,25 +29,33 @@ Deno.serve(async (req) => {
 
   const { data: row } = await supabase
     .from(table)
-    .select("id, content, status")
+    .select("id, author_id, content, status")
     .eq("id", id)
     .single();
   if (!row) return json({ status: "error", error: "not found" });
+
+  if (!isServiceCaller(req)) {
+    const uid = await callerUserId(req);
+    if (!uid || uid !== row.author_id) return json({ status: "error", error: "forbidden" }, 403);
+  }
+
   // Idempotent: only pending rows are moderated here.
   if (row.status !== "pending") {
     return json({ status: row.status === "visible" ? "published" : row.status });
   }
 
   // A poll post's option labels are user content too: moderate them together
-  // with the question, one verdict for the whole post.
+  // with the question, one verdict for the whole post. The polls module is
+  // optional — on an install without it the table doesn't exist and the
+  // query errors, which simply means "no options".
   let input = row.content;
   if (kind === "post") {
-    const { data: options } = await supabase
+    const { data: options, error } = await supabase
       .from("poll_options")
       .select("label")
       .eq("post_id", id)
       .order("idx");
-    if (options && options.length > 0) {
+    if (!error && options && options.length > 0) {
       input = [row.content, ...options.map((o) => o.label)].join("\n");
     }
   }
@@ -54,9 +71,17 @@ Deno.serve(async (req) => {
     await supabase
       .from(table)
       .update({ status: "hidden", moderation_reason: verdict.reason, moderated_at: now })
-      .eq("id", id);
+      .eq("id", id)
+      .eq("status", "pending");
     return json({ status: "rejected", reason: verdict.reason });
   }
-  await supabase.from(table).update({ status: "visible", moderated_at: now }).eq("id", id);
+  const { data: updated } = await supabase
+    .from(table)
+    .update({ status: "visible", moderated_at: now })
+    .eq("id", id)
+    .eq("status", "pending")
+    .select("id");
+  // Nothing updated: the author deleted (or a sweep moderated) it meanwhile.
+  if (!updated || updated.length === 0) return json({ status: "pending" });
   return json({ status: "published" });
 });

package/templates/functions/notify-comment/index.ts

@@ -1,29 +1,36 @@
-// Real-time comment notification: a pg_net trigger on comments posts the new
-// row here. We push to the post author (unless self, opted out, no token, or
-// the author has blocked the commenter).
+// Real-time comment notification: a pg_net trigger fires here when a comment
+// becomes visible (published). We push to the post author (unless self, opted
+// out, no token, or the author has blocked the commenter).
+//
+// Security: this function is reachable with the public anon key (the trigger
+// calls it that way), so the body is UNTRUSTED. Only `record.id` is used; the
+// comment is re-read from the database and must be visible — nothing in the
+// push comes from the request itself.
 
 import { adminClient } from "../_shared/client.ts";
 import { sendExpoPush } from "../_shared/push.ts";
-import { FALLBACK_ACTOR_NAME } from "../_shared/config.ts";
+import { pushCopy } from "../_shared/copy.ts";
+import { ensureTranslations, resolveTargetLocale, languageOf } from "../_shared/translation.ts";
 
 const supabase = adminClient();
 
-interface CommentRecord {
-  id: string;
-  post_id: string;
-  author_id: string;
-  content: string;
-}
-
 Deno.serve(async (req) => {
-  const { record } = (await req.json()) as { record: CommentRecord };
+  const { record } = (await req.json().catch(() => ({}))) as { record?: { id?: string } };
+  if (!record?.id) return new Response("skip: no id", { status: 400 });
+
+  const { data: comment } = await supabase
+    .from("comments")
+    .select("id, post_id, author_id, content, status")
+    .eq("id", record.id)
+    .single();
+  if (!comment || comment.status !== "visible") return new Response("skip: not visible");
 
   const { data: post } = await supabase
     .from("posts")
     .select("author_id")
-    .eq("id", record.post_id)
+    .eq("id", comment.post_id)
     .single();
-  if (!post || post.author_id === record.author_id) return new Response("skip: self/none");
+  if (!post || post.author_id === comment.author_id) return new Response("skip: self/none");
 
   const { data: pref } = await supabase
     .from("push_tokens")
@@ -36,25 +43,43 @@ Deno.serve(async (req) => {
     .from("blocks")
     .select("blocker_id")
     .eq("blocker_id", post.author_id)
-    .eq("blocked_id", record.author_id)
+    .eq("blocked_id", comment.author_id)
     .maybeSingle();
   if (blocked) return new Response("skip: blocked");
 
+  const { data: recipient } = await supabase
+    .from("profiles")
+    .select("locale")
+    .eq("id", post.author_id)
+    .single();
+  const copy = pushCopy(recipient?.locale);
+
   const { data: actor } = await supabase
     .from("profiles")
     .select("username")
-    .eq("id", record.author_id)
+    .eq("id", comment.author_id)
     .single();
-  const name = actor?.username?.trim() || FALLBACK_ACTOR_NAME;
-  const excerpt =
-    record.content.length > 140 ? `${record.content.slice(0, 137)}...` : record.content;
+  const name = actor?.username?.trim() || copy.fallbackName;
+  // Recipient-language excerpt when the translation module is on: translate
+  // now (a few seconds) rather than push the source language; on failure the
+  // original goes out and the sweep fills the rows later.
+  let excerptSource = comment.content;
+  const targetLocale = resolveTargetLocale(recipient?.locale);
+  if (targetLocale) {
+    const rows = await ensureTranslations(supabase, "comment", comment.id);
+    const match = rows?.find(
+      (r) => r.locale === targetLocale && languageOf(r.locale) !== r.source_locale,
+    );
+    if (match) excerptSource = match.content;
+  }
+  const excerpt = excerptSource.length > 140 ? `${excerptSource.slice(0, 137)}...` : excerptSource;
   // Title states the event; body is the commenter's name then the comment in
   // quotes, e.g.  Marie: "So happy for you!".
   const body = `${name}: "${excerpt}"`;
 
   await sendExpoPush({
     to: pref.expo_push_token,
-    title: "You received a comment",
+    title: copy.text("comment.title"),
     body,
     data: { route: "/community", kind: "community_comment" },
     badge: 1,

package/templates/functions/notify-like/index.ts

@@ -1,11 +1,18 @@
 // Coalesced like notifications. Trigger path (body has record): apply a 10-min
 // per-post cooldown so bursts do not spam. Digest path (no record, from cron):
 // sweep posts with unnotified likes older than the cooldown. Either way, group
-// as "<name> liked your post" (1) or "<name> and N others liked your post".
+// as "<name> liked your post" (1) or "<name> and N others liked your post",
+// in the recipient's locale (profiles.locale) — see _shared/copy.ts for the
+// built-in copy and the COMMUNITY_PUSH_COPY override.
+//
+// Security: the trigger path only takes `record.post_id` from the (anon-key
+// reachable, hence untrusted) body and re-derives everything from the likes
+// table, so a forged body can at most flush a real post's pending like
+// notifications early.
 
 import { adminClient } from "../_shared/client.ts";
 import { sendExpoPush } from "../_shared/push.ts";
-import { FALLBACK_ACTOR_NAME } from "../_shared/config.ts";
+import { pushCopy } from "../_shared/copy.ts";
 
 const supabase = adminClient();
 const COOLDOWN_MS = 10 * 60 * 1000;
@@ -52,16 +59,23 @@ async function flushPost(postId: string) {
   );
   if (contributors.length === 0) return;
 
+  const { data: recipient } = await supabase
+    .from("profiles")
+    .select("locale")
+    .eq("id", post.author_id)
+    .single();
+  const copy = pushCopy(recipient?.locale);
+
   const { data: actor } = await supabase
     .from("profiles")
     .select("username")
     .eq("id", contributors[0].user_id)
     .single();
-  const name = actor?.username?.trim() || FALLBACK_ACTOR_NAME;
+  const name = actor?.username?.trim() || copy.fallbackName;
   const title =
     contributors.length === 1
-      ? `${name} liked your post`
-      : `${name} and ${contributors.length - 1} others liked your post`;
+      ? copy.text("like.one", { name })
+      : copy.text("like.many", { name, count: contributors.length - 1 });
 
   await sendExpoPush({
     to: pref.expo_push_token,