';
+
+ if (!transporter) {
+ console.warn('SMTP not configured — skipping email notification');
+ return false;
+ }
+
+ try {
+ await transporter.sendMail({ from: fromAddress, to, subject, html });
+ return true;
+ } catch (err) {
+ console.error('Email send failed:', err);
+ return false;
+ }
+}
+
+// ============================================
+// NOTIFICATION EVENT TYPES
+// ============================================
+
+export type NotificationEvent =
+ | { type: 'new_video'; projectName: string; videoTitle: string; addedBy: string; url: string }
+ | { type: 'new_comment'; projectName: string; videoTitle: string; commentAuthor: string; commentText: string; timestamp: string; url: string }
+ | { type: 'new_reply'; projectName: string; videoTitle: string; replyAuthor: string; replyText: string; parentAuthor: string; timestamp: string; url: string };
+
+/** Structured Telegram message with text body + button label/URL */
+interface TelegramMessage {
+ text: string;
+ buttonLabel: string;
+ buttonUrl: string;
+}
+
+/**
+ * Format a notification event into a Telegram message with an inline keyboard button.
+ * The URL is no longer in the text body — it's attached as a clickable button instead.
+ */
+function formatTelegramMessage(event: NotificationEvent, timezone: string): TelegramMessage {
+ const now = formatNow(timezone);
+ switch (event.type) {
+ case 'new_video':
+ return {
+ text:
+ `🎬 New Video Added\n\n` +
+ `▸ Project: ${event.projectName}\n` +
+ `▸ Video: ${event.videoTitle}\n` +
+ `▸ Added by: ${event.addedBy}\n` +
+ `▸ ${now}`,
+ buttonLabel: 'View Video',
+ buttonUrl: event.url,
+ };
+ case 'new_comment':
+ return {
+ text:
+ `💬 New Comment\n\n` +
+ `▸ Project: ${event.projectName}\n` +
+ `▸ Video: ${event.videoTitle}\n` +
+ `▸ By: ${event.commentAuthor} at ${event.timestamp}\n` +
+ `▸ ${now}\n\n` +
+ `"${truncate(event.commentText, 200)}"`,
+ buttonLabel: 'View Comment',
+ buttonUrl: event.url,
+ };
+ case 'new_reply':
+ return {
+ text:
+ `↩️ New Reply\n\n` +
+ `▸ Project: ${event.projectName}\n` +
+ `▸ Video: ${event.videoTitle}\n` +
+ `▸ ${event.replyAuthor} replied to ${event.parentAuthor}\n` +
+ `▸ ${now}\n\n` +
+ `"${truncate(event.replyText, 200)}"`,
+ buttonLabel: 'View Reply',
+ buttonUrl: event.url,
+ };
+ }
+}
+
+// ============================================
+// EMAIL TEMPLATE
+// ============================================
+
+const BASE_URL = () => process.env.NEXTAUTH_URL || '';
+
+// Theme colors (hex equivalents of oklch dark theme)
+const COLORS = {
+ bg: '#111114', // page background (very dark)
+ card: '#1a1a20', // card background
+ cardInner: '#212128', // inner card / section bg
+ border: '#2a2a32', // subtle border
+ accent: '#2ec8d8', // primary/accent teal-cyan
+ accentDark: '#1a3a40',// accent background for headings
+ text: '#ebebeb', // primary text
+ textSecondary: '#9a9a9f', // muted text
+ textDim: '#6a6a72', // dimmer labels
+} as const;
+
+/**
+ * Wrap email body content in a branded template matching OpenFrame's dark theme.
+ * Square corners (radius:0), card-based layout, teal accent, unsubscribe footer.
+ */
+function emailTemplate(body: string): string {
+ const settingsUrl = `${BASE_URL()}/settings`;
+ return `
+
+
+
+
+
+`;
+}
+
+/** Generates an info row for email detail tables */
+function emailRow(label: string, value: string, isHighlight = false): string {
+ const valStyle = isHighlight
+ ? `color:${COLORS.text};font-weight:600;`
+ : `color:${COLORS.textSecondary};`;
+ return `
+ | ${label} |
+ ${value} |
+
`;
+}
+
+/** Generates the accent-colored event type heading bar */
+function emailHeading(icon: string, title: string): string {
+ return `
+ ${icon} ${title}
+ | `;
+}
+
+/** Generates a CTA button */
+function emailButton(text: string, url: string): string {
+ return `${text}`;
+}
+
+/**
+ * Format a notification event into an email subject + full branded HTML email.
+ */
+function formatEmail(event: NotificationEvent, timezone: string): { subject: string; html: string } {
+ const now = formatNow(timezone);
+ switch (event.type) {
+ case 'new_video':
+ return {
+ subject: `[OpenFrame] New video in ${event.projectName}: ${event.videoTitle}`,
+ html: emailTemplate(`
+ ${emailHeading('▶', 'New Video Added')}
+
+
+ ${emailRow('Project', escapeHtml(event.projectName), true)}
+ ${emailRow('Video', escapeHtml(event.videoTitle), true)}
+ ${emailRow('Added by', escapeHtml(event.addedBy))}
+ ${emailRow('When', now)}
+
+ ${emailButton('View Video →', event.url)}
+ |
+ `),
+ };
+ case 'new_comment':
+ return {
+ subject: `[OpenFrame] New comment on ${event.videoTitle}`,
+ html: emailTemplate(`
+ ${emailHeading('●', 'New Comment')}
+
+
+ ${emailRow('Project', escapeHtml(event.projectName), true)}
+ ${emailRow('Video', escapeHtml(event.videoTitle), true)}
+ ${emailRow('From', escapeHtml(event.commentAuthor))}
+ ${emailRow('At', event.timestamp)}
+ ${emailRow('When', now)}
+
+
+ ${escapeHtml(truncate(event.commentText, 300))}
+
+ ${emailButton('View Comment →', event.url)}
+ |
+ `),
+ };
+ case 'new_reply':
+ return {
+ subject: `[OpenFrame] ${event.replyAuthor} replied on ${event.videoTitle}`,
+ html: emailTemplate(`
+ ${emailHeading('↩', 'New Reply')}
+
+
+ ${emailRow('Project', escapeHtml(event.projectName), true)}
+ ${emailRow('Video', escapeHtml(event.videoTitle), true)}
+ ${emailRow('From', `${escapeHtml(event.replyAuthor)} → ${escapeHtml(event.parentAuthor)}`)}
+ ${emailRow('When', now)}
+
+
+ ${escapeHtml(truncate(event.replyText, 300))}
+
+ ${emailButton('View Reply →', event.url)}
+ |
+ `),
+ };
+ }
+}
+
+/**
+ * Generate branded HTML for test emails sent from settings page.
+ */
+export function testEmailHtml(): string {
+ return emailTemplate(`
+ ${emailHeading('✓', 'Test Notification')}
+ |
+ Email notifications are working.
+ You’ll receive emails when there’s activity on your projects.
+ |
+ `);
+}
+
+// ============================================
+// MAIN DISPATCH
+// ============================================
+
+/**
+ * Notify the project owner about an event.
+ * Looks up the owner's notification settings and dispatches to enabled channels.
+ * Best-effort — never throws, logs errors.
+ */
+export async function notifyProjectOwner(ownerId: string, event: NotificationEvent): Promise {
+ try {
+ const settings = await db.notificationSetting.findUnique({
+ where: { userId: ownerId },
+ include: { user: { select: { email: true } } },
+ });
+
+ if (!settings) return; // No notification preferences configured
+
+ const shouldNotify =
+ (event.type === 'new_video' && settings.onNewVideo) ||
+ (event.type === 'new_comment' && settings.onNewComment) ||
+ (event.type === 'new_reply' && settings.onNewReply);
+
+ if (!shouldNotify) return;
+
+ const promises: Promise[] = [];
+ const tz = settings.timezone || 'UTC';
+ // Telegram
+ if (settings.telegramEnabled && settings.telegramBotToken && settings.telegramChatId) {
+ const msg = formatTelegramMessage(event, tz);
+ promises.push(sendTelegram(
+ settings.telegramBotToken,
+ settings.telegramChatId,
+ msg.text,
+ msg.buttonLabel,
+ msg.buttonUrl,
+ ));
+ }
+
+ // Email
+ if (settings.emailEnabled && settings.user.email) {
+ const { subject, html } = formatEmail(event, tz);
+ promises.push(sendEmail(settings.user.email, subject, html));
+ }
+
+ await Promise.allSettled(promises);
+ } catch (err) {
+ console.error('Notification dispatch failed:', err);
+ }
+}
+
+// ============================================
+// HELPERS
+// ============================================
+
+/**
+ * Format current date/time in the user's timezone.
+ * Returns e.g. "Jan 15, 2025 at 3:45 PM"
+ */
+function formatNow(timezone: string): string {
+ try {
+ return new Date().toLocaleString('en-US', {
+ timeZone: timezone,
+ month: 'short',
+ day: 'numeric',
+ year: 'numeric',
+ hour: 'numeric',
+ minute: '2-digit',
+ hour12: true,
+ });
+ } catch {
+ // Invalid timezone — fall back to UTC
+ return new Date().toLocaleString('en-US', {
+ timeZone: 'UTC',
+ month: 'short',
+ day: 'numeric',
+ year: 'numeric',
+ hour: 'numeric',
+ minute: '2-digit',
+ hour12: true,
+ });
+ }
+}
+
+function escapeHtml(str: string): string {
+ return str
+ .replace(/&/g, '&')
+ .replace(//g, '>')
+ .replace(/"/g, '"');
+}
+
+/** Escape a URL for use inside an HTML href="..." attribute */
+function escapeAttr(str: string): string {
+ return str
+ .replace(/&/g, '&')
+ .replace(/"/g, '"')
+ .replace(//g, '>');
+}
+
+function truncate(str: string, maxLen: number): string {
+ return str.length > maxLen ? str.slice(0, maxLen) + '...' : str;
+}
diff --git a/package.json b/package.json
index 5cf38b0..1ab362c 100644
--- a/package.json
+++ b/package.json
@@ -6,7 +6,13 @@
"dev": "next dev",
"build": "next build",
"start": "next start",
- "lint": "eslint"
+ "lint": "eslint",
+ "db:generate": "prisma generate",
+ "db:push": "prisma db push",
+ "db:migrate": "prisma migrate deploy",
+ "db:seed": "prisma db seed",
+ "db:setup": "bun run db:generate && bun run db:push && bun run db:extras",
+ "db:extras": "bun run scripts/db-extras.ts"
},
"dependencies": {
"@auth/prisma-adapter": "^2.11.1",
@@ -23,6 +29,7 @@
"next": "16.1.6",
"next-auth": "^5.0.0-beta.30",
"next-themes": "^0.4.6",
+ "nodemailer": "^8.0.1",
"pg": "^8.18.0",
"prisma": "^7.3.0",
"radix-ui": "^1.4.3",
@@ -37,6 +44,7 @@
"@tailwindcss/postcss": "^4",
"@types/bcryptjs": "^3.0.0",
"@types/node": "^20",
+ "@types/nodemailer": "^7.0.9",
"@types/pg": "^8.16.0",
"@types/react": "^19",
"@types/react-dom": "^19",
diff --git a/prisma/schema.prisma b/prisma/schema.prisma
index a505b8a..367447e 100644
--- a/prisma/schema.prisma
+++ b/prisma/schema.prisma
@@ -30,6 +30,7 @@ model User {
projects Project[]
comments Comment[]
projectMemberships ProjectMember[]
+ notificationSetting NotificationSetting?
@@map("users")
}
@@ -321,3 +322,51 @@ enum SharePermission {
VIEW // Can only view
COMMENT // Can view and comment
}
+
+// ============================================
+// NOTIFICATION SETTINGS
+// ============================================
+
+model NotificationSetting {
+ id String @id @default(cuid())
+
+ userId String @unique
+ user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+ // Telegram webhook
+ telegramBotToken String? // Bot token from @BotFather
+ telegramChatId String? // Chat/group ID to send messages to
+ telegramEnabled Boolean @default(false)
+
+ // Email notifications (uses account email by default)
+ emailEnabled Boolean @default(false)
+
+ // Event subscriptions
+ onNewVideo Boolean @default(true)
+ onNewComment Boolean @default(true)
+ onNewReply Boolean @default(true)
+
+ // User timezone for notification timestamps (IANA timezone identifier)
+ timezone String @default("UTC")
+
+ // Timestamps
+ createdAt DateTime @default(now())
+ updatedAt DateTime @updatedAt
+
+ @@map("notification_settings")
+}
+
+// Rate limiting table (created as UNLOGGED via raw SQL migration)
+// Defined here so `prisma db push` doesn't drop it
+model RateLimit {
+ id Int @id @default(autoincrement())
+ key String @db.VarChar(255)
+ action String @db.VarChar(50)
+ count Int @default(1)
+ windowStart DateTime @default(now()) @map("window_start")
+
+ @@unique([key, action])
+ @@index([key, action])
+ @@index([windowStart])
+ @@map("rate_limits")
+}
diff --git a/scripts/db-extras.ts b/scripts/db-extras.ts
new file mode 100644
index 0000000..9716c1f
--- /dev/null
+++ b/scripts/db-extras.ts
@@ -0,0 +1,56 @@
+/**
+ * db-extras.ts — Run all custom SQL migrations that Prisma doesn't manage.
+ *
+ * This script runs after `prisma db push` / `prisma migrate deploy` to set up
+ * tables and functions that need raw SQL (UNLOGGED tables, custom functions, etc.).
+ *
+ * Usage: bun run db:extras
+ *
+ * To add new custom migrations:
+ * 1. Create a .sql file in prisma/migrations/
+ * 2. Add the filename to the EXTRAS array below
+ */
+
+import { readFileSync } from 'fs';
+import { join } from 'path';
+import pg from 'pg';
+
+const EXTRAS = [
+ 'rate_limit.sql',
+ // Add future custom SQL files here
+];
+
+async function main() {
+ const url = process.env.DATABASE_URL;
+ if (!url) {
+ console.error('❌ DATABASE_URL is not set');
+ process.exit(1);
+ }
+
+ // Strip Prisma-specific query params (e.g. ?schema=public) that pg doesn't understand
+ const cleanUrl = url.split('?')[0];
+ const client = new pg.Client({ connectionString: cleanUrl });
+
+ try {
+ await client.connect();
+ console.log('✅ Connected to database\n');
+
+ for (const file of EXTRAS) {
+ const filePath = join(import.meta.dirname, '..', 'prisma', 'migrations', file);
+ const sql = readFileSync(filePath, 'utf-8');
+
+ console.log(`▸ Running ${file}...`);
+ await client.query(sql);
+ console.log(` ✓ ${file} applied\n`);
+ }
+
+ console.log('✅ All database extras applied successfully');
+ } catch (err) {
+ console.error('❌ Database extras failed:', err);
+ process.exit(1);
+ } finally {
+ await client.end();
+ }
+}
+
+main();