Handler routes

import { createRouteHandler } from "@notifykitjs/next"
import { notify } from "@/lib/notifykit"
import { auth } from "@/lib/auth"

export const { GET, POST, DELETE, OPTIONS, dynamic } = createRouteHandler({
  notifykit: notify,
  identify: async (request) => {
    const session = await auth(request)
    if (!session) return null
    return { recipientId: session.userId }
  },
})

import { createHandler } from "@notifykitjs/core"
import { notify } from "../lib/notifykit"

const handler = createHandler(notify, {
  identify: async (req) => {
    const user = req.user
    if (!user) return null
    return { recipientId: user.id }
  },
})

app.all("/api/notifykit/*", handler)

createRouteHandler({
  notifykit: notify,
  identify: async (request) => {
    const session = await auth(request)
    if (!session) return null
    return {
      recipientId: session.userId,
      tenantId: session.orgId,
      permissions: session.isAdmin ? ["admin"] : [],
    }
  },
  authorize: async (ctx, permission) => {
    return permission === "deliveries.list" && ctx.identity.permissions?.includes("admin") === true
  },
})

import { createHandler } from "@notifykitjs/core"

const handler = createHandler(notify, {
  identify: async (request) => getIdentity(request),
  authorize: async (ctx, permission) => permission === "deliveries.list",
  unsubscribeSecret: process.env.NOTIFYKIT_SECRET,
  cors: "https://app.example.com",
  protectNotifications: true,
  requestRateLimit: { max: 120, windowMs: 60_000 },
})

{
  "notificationId": "comment_mentioned",
  "channels": { "email": false }
}

{ "error": "Inbox item not found", "code": "NOT_FOUND" }

# List inbox items (most recent first)
curl -s http://localhost:3000/api/notifykit/inbox?limit=5 \
  -H "Cookie: session=..." | jq .

[
  {
    "id": "inb_a1b2c3",
    "notificationId": "comment_mentioned",
    "recipientId": "user_123",
    "title": "Rey mentioned you",
    "body": "In Launch Plan",
    "actionUrl": "/posts/42",
    "readAt": null,
    "archivedAt": null,
    "createdAt": "2025-03-15T10:30:00.000Z"
  }
]

# Mark an item as read
curl -s -X POST http://localhost:3000/api/notifykit/inbox/inb_a1b2c3/read \
  -H "Cookie: session=..."

{
  "id": "inb_a1b2c3",
  "title": "Rey mentioned you",
  "readAt": "2025-03-15T10:31:22.000Z"
}

# Update preferences (disable email for a notification)
curl -s -X POST http://localhost:3000/api/notifykit/preferences \
  -H "Cookie: session=..." \
  -H "Content-Type: application/json" \
  -d '{"notificationId": "comment_mentioned", "channels": {"email": false}}'

{
  "recipientId": "user_123",
  "notificationId": "comment_mentioned",
  "channels": { "inbox": true, "email": false },
  "updatedAt": "2025-03-15T10:32:00.000Z"
}

# List registered notifications (public metadata)
curl -s http://localhost:3000/api/notifykit/notifications | jq .

[
  {
    "id": "comment_mentioned",
    "channels": ["inbox", "email"],
    "category": "activity",
    "description": "Someone mentioned you in a comment",
    "required": false
  },
  {
    "id": "password_reset",
    "channels": ["email"],
    "category": "billing",
    "description": "Password reset link",
    "required": true
  }
]

const BASE = "https://app.com/api/notifykit"

async function notifyFetch(path, opts = {}) {
  const res = await fetch(`${BASE}${path}`, {
    headers: {
      "Content-Type": "application/json",
      ...opts.headers,
    },
    credentials: "include",
    ...opts,
  })
  if (!res.ok) {
    const err = await res.json()
    throw new Error(`${res.status}: ${err.error}`)
  }
  const body = await res.json()
  return body.data
}

// Inbox operations
const items = await notifyFetch("/inbox?limit=20")
await notifyFetch("/inbox/inb_abc/read", { method: "POST" })
await notifyFetch("/inbox/mark-all-read", { method: "POST" })
await notifyFetch("/inbox/inb_abc", { method: "DELETE" })

// Preferences
const prefs = await notifyFetch("/preferences")
await notifyFetch("/preferences", {
  method: "POST",
  body: JSON.stringify({
    notificationId: "comment_mentioned",
    channels: { email: false },
  }),
})

// SSE realtime (browser EventSource)
const events = new EventSource(`${BASE}/inbox/stream`, { withCredentials: true })
events.onmessage = (e) => {
  const data = JSON.parse(e.data)
  if (data.type === "inbox.created") addToList(data.item)
}

event: inbox.created
data: {"type":"inbox.created","item":{"id":"inb_a1b2c3","notificationId":"comment_mentioned","recipientId":"user_123","title":"Rey mentioned you","readAt":null,"createdAt":"2025-03-15T10:30:00.000Z"}}

event: inbox.updated
data: {"type":"inbox.updated","item":{"id":"inb_a1b2c3","readAt":"2025-03-15T10:31:22.000Z"}}

: heartbeat

const events = new EventSource(`${BASE}/inbox/stream`, { withCredentials: true })

events.addEventListener("inbox.created", (e) => {
  const { item } = JSON.parse(e.data)
  addToInbox(item)
  incrementUnreadCount()
})

events.addEventListener("inbox.updated", (e) => {
  const { item } = JSON.parse(e.data)
  updateInboxItem(item.id, item)
  if (item.readAt) decrementUnreadCount()
})

events.addEventListener("inbox.deleted", (e) => {
  const { itemId } = JSON.parse(e.data)
  removeFromInbox(itemId)
})

events.addEventListener("inbox.all_read", () => {
  markAllItemsRead(new Date())
  resetUnreadCount()
})

events.onerror = () => {
  // Browser retries automatically — no manual reconnect needed
}

function createInboxStore(baseUrl) {
  let items = []
  let unreadCount = 0
  const listeners = new Set()

  function notify() { listeners.forEach(fn => fn({ items, unreadCount })) }

  return {
    subscribe(fn) { listeners.add(fn); return () => listeners.delete(fn) },

    setItems(newItems) {
      items = newItems
      unreadCount = items.filter(i => !i.readAt).length
      notify()
    },

    async markRead(itemId) {
      // 1. Snapshot for rollback
      const prev = items.map(i => ({ ...i }))
      const prevCount = unreadCount

      // 2. Optimistic update
      items = items.map(i =>
        i.id === itemId ? { ...i, readAt: new Date().toISOString() } : i
      )
      unreadCount = items.filter(i => !i.readAt).length
      notify()

      // 3. Confirm with server
      try {
        const res = await fetch(`${baseUrl}/inbox/${itemId}/read`, { method: "POST", credentials: "include" })
        if (!res.ok) throw new Error(res.statusText)
        const updated = await res.json()
        items = items.map(i => i.id === itemId ? updated : i)
        notify()
      } catch {
        // 4. Rollback on failure
        items = prev
        unreadCount = prevCount
        notify()
      }
    },

    async markAllRead() {
      const prev = items.map(i => ({ ...i }))
      items = items.map(i => ({ ...i, readAt: i.readAt ?? new Date().toISOString() }))
      unreadCount = 0
      notify()

      try {
        const res = await fetch(`${baseUrl}/inbox/mark-all-read`, { method: "POST", credentials: "include" })
        if (!res.ok) throw new Error(res.statusText)
      } catch {
        items = prev
        unreadCount = prev.filter(i => !i.readAt).length
        notify()
      }
    },

    async deleteItem(itemId) {
      const prev = items.map(i => ({ ...i }))
      items = items.filter(i => i.id !== itemId)
      unreadCount = items.filter(i => !i.readAt).length
      notify()

      try {
        const res = await fetch(`${baseUrl}/inbox/${itemId}`, { method: "DELETE", credentials: "include" })
        if (!res.ok) throw new Error(res.statusText)
      } catch {
        items = prev
        unreadCount = prev.filter(i => !i.readAt).length
        notify()
      }
    },
  }
}

GET /api/notifykit/inbox?limit=20
GET /api/notifykit/inbox?archived=true&limit=20

# Step 1: Route exists?
curl -s http://localhost:3000/api/notifykit/notifications | jq .
# Expected: array of notification definitions (or 200 with [])

# Step 2: Auth resolves?
curl -s -H "Cookie: session=YOUR_SESSION_COOKIE" \
  http://localhost:3000/api/notifykit/inbox | jq .
# Expected: 200 with inbox items (or empty array)
# If 401: identify() returned null

# Step 3: SSE connects?
curl -N -H "Cookie: session=YOUR_SESSION_COOKIE" \
  http://localhost:3000/api/notifykit/inbox/stream
# Expected: ": heartbeat" within 30s