Feat/missing pages audit implementation

apps/api/package.json

@@ -6,7 +6,7 @@
   "private": true,
   "license": "UNLICENSED",
   "scripts": {
-    "build": "prisma generate && nest build && cp generated/prisma/package.json dist/generated/prisma/package.json",
+    "build": "prisma generate && nest build && node -e \"const fs=require('fs'); const source=['generated/prisma/package.json','node_modules/.prisma/client/package.json','node_modules/@prisma/client/package.json'].find((file)=>fs.existsSync(file)); if(source){ fs.mkdirSync('dist/generated/prisma',{recursive:true}); fs.copyFileSync(source,'dist/generated/prisma/package.json'); }\"",
     "prisma:generate": "prisma generate",
     "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
     "start": "nest start",

apps/api/prisma/migrations/20260418090000_add_notifications/migration.sql

@@ -0,0 +1,19 @@
+-- CreateTable
+CREATE TABLE "Notification" (
+    "id" TEXT NOT NULL,
+    "merchantId" TEXT NOT NULL,
+    "type" TEXT NOT NULL,
+    "title" TEXT NOT NULL,
+    "body" TEXT NOT NULL,
+    "read" BOOLEAN NOT NULL DEFAULT false,
+    "metadata" JSONB,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "Notification_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "Notification_merchantId_createdAt_idx" ON "Notification"("merchantId", "createdAt");
+
+-- AddForeignKey
+ALTER TABLE "Notification" ADD CONSTRAINT "Notification_merchantId_fkey" FOREIGN KEY ("merchantId") REFERENCES "Merchant"("id") ON DELETE CASCADE ON UPDATE CASCADE;

apps/api/prisma/migrations/20260601115707/migration.sql

@@ -0,0 +1,5 @@
+-- DropForeignKey
+ALTER TABLE "Payment" DROP CONSTRAINT "Payment_quoteId_fkey";
+
+-- AddForeignKey
+ALTER TABLE "Payment" ADD CONSTRAINT "Payment_quoteId_fkey" FOREIGN KEY ("quoteId") REFERENCES "Quote"("id") ON DELETE SET NULL ON UPDATE CASCADE;

apps/api/prisma/schema.prisma

@@ -46,6 +46,7 @@ model Merchant {
   teamMembers       TeamMember[]
   webhookEvents     WebhookEvent[]
   apiKeys           ApiKey[]
+  notifications     Notification[]
   settlementKey     MerchantSettlementKey?
 }
 
@@ -355,3 +356,17 @@ enum WebhookStatus {
   FAILED
   EXHAUSTED
 }
+
+model Notification {
+  id         String   @id @default(cuid())
+  merchantId String
+  type       String
+  title      String
+  body       String
+  read       Boolean  @default(false)
+  metadata   Json?
+  createdAt  DateTime @default(now())
+  merchant    Merchant @relation(fields: [merchantId], references: [id], onDelete: Cascade)
+
+  @@index([merchantId, createdAt])
+}

apps/api/src/modules/auth/auth.service.ts

@@ -205,6 +205,10 @@ export class AuthService {
       },
     });
 
+    void this.notifications
+      .notifyApiKeyCreated(merchantId, apiKey.id, apiKey.name)
+      .catch(() => undefined);
+
     return {
       apiKey: plainTextKey,
       id: apiKey.id,

apps/api/src/modules/events/events/events.service.ts

@@ -9,6 +9,15 @@ interface WebhookEventData {
   createdAt: Date | string;
 }
 
+interface NotificationCreatedPayload {
+  id: string;
+  type: string;
+  title: string;
+  body: string;
+  metadata?: unknown;
+  createdAt: Date | string;
+}
+
 /**
  * Events Service
  * Handles real-time event emission to connected WebSocket clients
@@ -242,4 +251,33 @@ export class EventsService {
       );
     }
   }
+
+  emitNotificationCreated(
+    merchantId: string,
+    notification: NotificationCreatedPayload,
+  ): void {
+    try {
+      const normalizedPayload = {
+        id: notification.id,
+        type: notification.type,
+        title: notification.title,
+        body: notification.body,
+        metadata: notification.metadata,
+        createdAt: new Date(notification.createdAt).toISOString(),
+      };
+
+      this.gateway.server
+        .to(`merchant:${merchantId}`)
+        .emit('notification.created', normalizedPayload);
+
+      this.gateway.server.to(`merchant:${merchantId}`).emit('message', {
+        event: 'notification.created',
+        data: normalizedPayload,
+      });
+    } catch (error) {
+      this.logger.error(
+        `Failed to emit notification.created: ${error instanceof Error ? error.message : 'Unknown error'}`,
+      );
+    }
+  }
 }

apps/api/src/modules/invoices/invoices.service.ts

@@ -510,6 +510,10 @@ export class InvoicesService {
     });
 
     if (newStatus === InvoiceStatus.PAID) {
+      void this.notifications
+        .notifyInvoicePaid(merchantId, id, existing.invoiceNumber)
+        .catch(() => undefined);
+
       await this.webhooks.dispatch(merchantId, 'invoice.paid', {
         invoiceId: id,
         customerEmail: existing.customerEmail,

apps/api/src/modules/merchant/merchant.module.ts

@@ -3,11 +3,12 @@ import { AuthModule } from '../auth/auth.module';
 import { PrismaModule } from '../prisma/prisma.module';
 import { MerchantController } from './merchant.controller';
 import { MerchantService } from './merchant.service';
+import { NotificationsModule } from '../notifications/notifications.module';
 import { MerchantSettlementService } from './merchant-settlement.service';
 import { RolesGuard } from './guards/roles.guard';
 
 @Module({
-  imports: [AuthModule, PrismaModule],
+  imports: [AuthModule, PrismaModule, NotificationsModule],
   controllers: [MerchantController],
   providers: [MerchantService, MerchantSettlementService, RolesGuard],
   // Export MerchantSettlementService so AuthService can call .provision()

apps/api/src/modules/merchant/merchant.service.ts

@@ -10,11 +10,15 @@ import { SettlementDto } from './dto/settlement.dto';
 import { BrandingDto } from './dto/branding.dto';
 import { InviteMemberDto } from './dto/invite-member.dto';
 import { KybSubmissionDto } from './dto/kyb-submission.dto';
+import { NotificationsService } from '../notifications/notifications.service';
 import { detectAddressChain, type Chain } from '@useroutr/types';
 
 @Injectable()
 export class MerchantService {
-  constructor(private readonly prisma: PrismaService) {}
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly notifications: NotificationsService,
+  ) {}
 
   // ── Profile ──────────────────────────────────────────────────
 
@@ -138,7 +142,9 @@ export class MerchantService {
       },
     });
 
-    // TODO: send invite email via NotificationsModule once implemented
+    void this.notifications
+      .notifyTeamMemberJoined(merchantId, member.email, member.role)
+      .catch(() => undefined);
 
     return member;
   }

apps/api/src/modules/notifications/notifications.controller.ts

@@ -0,0 +1,47 @@
+import {
+  Controller,
+  Get,
+  HttpCode,
+  HttpStatus,
+  Param,
+  Patch,
+  Post,
+  Query,
+  UseGuards,
+} from '@nestjs/common';
+import { JwtAuthGuard } from '../../common/guards/jwt-auth.guard';
+import { CurrentMerchant } from '../merchant/decorators/current-merchant.decorator';
+import { NotificationsService } from './notifications.service';
+
+@Controller('v1/notifications')
+@UseGuards(JwtAuthGuard)
+export class NotificationsController {
+  constructor(private readonly notificationsService: NotificationsService) {}
+
+  @Get()
+  async listNotifications(
+    @CurrentMerchant('id') merchantId: string,
+    @Query('limit') limit?: string,
+    @Query('cursor') cursor?: string,
+  ) {
+    return this.notificationsService.listNotifications(merchantId, {
+      limit: limit ? Number(limit) : undefined,
+      cursor,
+    });
+  }
+
+  @Patch(':id/read')
+  @HttpCode(HttpStatus.OK)
+  async markAsRead(
+    @CurrentMerchant('id') merchantId: string,
+    @Param('id') notificationId: string,
+  ) {
+    return this.notificationsService.markAsRead(merchantId, notificationId);
+  }
+
+  @Post('mark-all-read')
+  @HttpCode(HttpStatus.OK)
+  async markAllAsRead(@CurrentMerchant('id') merchantId: string) {
+    return this.notificationsService.markAllAsRead(merchantId);
+  }
+}

apps/api/src/modules/notifications/notifications.module.ts

@@ -1,16 +1,22 @@
 import { Module } from '@nestjs/common';
 import { ConfigModule } from '@nestjs/config';
 import { BullModule } from '@nestjs/bullmq';
+import { PrismaModule } from '../prisma/prisma.module';
+import { EventsModule } from '../events/events.module';
+import { NotificationsController } from './notifications.controller';
 import { NotificationsService } from './notifications.service';
 import { NotificationsProcessor } from './notifications.processor';
 
 @Module({
   imports: [
     ConfigModule,
+    PrismaModule,
+    EventsModule,
     BullModule.registerQueue({
       name: 'notifications',
     }),
   ],
+  controllers: [NotificationsController],
   providers: [NotificationsService, NotificationsProcessor],
   exports: [NotificationsService],
 })