diff --git a/src/app/(app)/notifications/page.tsx b/src/app/(app)/notifications/page.tsx
index dceecbf..498ae23 100644
--- a/src/app/(app)/notifications/page.tsx
+++ b/src/app/(app)/notifications/page.tsx
@@ -1,5 +1,134 @@
-import { ModulePlaceholder } from "@/components/module-placeholder";
+import Link from "next/link";
+import { redirect } from "next/navigation";
+import { BellDot, CheckCheck } from "lucide-react";
+import { getFormatter, getTranslations } from "next-intl/server";
+import { EVENT_TYPES } from "@/lib/events";
+import { PageHead, Pill } from "@/components/mockup-ui";
+import { Button } from "@/components/ui/button";
+import { markAllNotificationsRead, markNotificationRead, openNotification } from "@/server/actions/notifications/inbox";
+import { listNotifications } from "@/server/services/notifications/inbox";
+import { pageCtx } from "@/server/services/notifications/page-ctx";
+import { eventKey } from "@/server/services/notifications/texts";
-export default function Page() {
- return
;
+const selectCls = "h-11 rounded-md border border-input bg-card px-3 text-sm";
+
+export default async function NotificationsPage({
+ searchParams,
+}: {
+ searchParams: Promise
>;
+}) {
+ const ctx = await pageCtx();
+ if (!ctx.permissions.has("notification:read")) redirect("/dashboard");
+ const sp = await searchParams;
+ const one = (v: string | string[] | undefined) => (Array.isArray(v) ? v[0] : v);
+ const data = await listNotifications(ctx, { status: one(sp.status), type: one(sp.type), page: one(sp.page) });
+ const [t, format] = await Promise.all([getTranslations("notifications"), getFormatter()]);
+
+ const pageHref = (page: number) => {
+ const q = new URLSearchParams();
+ if (data.filter.status !== "all") q.set("status", data.filter.status);
+ if (data.filter.type) q.set("type", data.filter.type);
+ q.set("page", String(page));
+ return `/notifications?${q.toString()}`;
+ };
+
+ return (
+
+
+
+
+ }
+ />
+
+
+
+ {data.rows.length === 0 ? (
+ {t("list.empty")}
+ ) : (
+
+ )}
+
+ {data.pages > 1 && (
+
+ )}
+
+ );
}
diff --git a/src/app/(app)/settings/email/layout.tsx b/src/app/(app)/settings/email/layout.tsx
new file mode 100644
index 0000000..dcc4d43
--- /dev/null
+++ b/src/app/(app)/settings/email/layout.tsx
@@ -0,0 +1,7 @@
+import { requireModule } from "@/server/modules";
+
+/** Tenant mail settings belong to the "notifications" module (actions use its moduleGuard). */
+export default async function MailSettingsLayout({ children }: Readonly<{ children: React.ReactNode }>) {
+ await requireModule("notifications");
+ return <>{children};
+}
diff --git a/src/app/(app)/settings/email/page.tsx b/src/app/(app)/settings/email/page.tsx
new file mode 100644
index 0000000..afad8b3
--- /dev/null
+++ b/src/app/(app)/settings/email/page.tsx
@@ -0,0 +1,83 @@
+import Link from "next/link";
+import { redirect } from "next/navigation";
+import { ArrowLeft } from "lucide-react";
+import { getTranslations } from "next-intl/server";
+import { PageHead } from "@/components/mockup-ui";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { getMailConfig } from "@/server/mail/config";
+import { saveMailSettings } from "@/server/actions/notifications/mail-settings";
+import { getMailSettings } from "@/server/services/notifications/mail-settings";
+import { pageCtx } from "@/server/services/notifications/page-ctx";
+
+const areaCls = "min-h-28 w-full rounded-md border border-input bg-transparent px-3 py-2 font-mono text-sm";
+
+export default async function MailSettingsPage({ searchParams }: { searchParams: Promise<{ saved?: string; error?: string }> }) {
+ const ctx = await pageCtx();
+ if (!ctx.permissions.has("tenant:manage")) redirect("/dashboard");
+ const [sp, s, t] = await Promise.all([searchParams, getMailSettings(ctx), getTranslations("notifications")]);
+ const platformFrom = getMailConfig().config?.from ?? "—";
+
+ return (
+
+
+ {t("mailSettings.back")}
+
+
+
+ {sp.saved && (
+
+ ✓ {t("mailSettings.saved")}
+
+ )}
+ {sp.error && (
+
+ ⚠ {t("mailSettings.invalid", { detail: sp.error.split(",").map((f) => t.has(`mailSettings.${f}`) ? t(`mailSettings.${f}`) : f).join(", ") })}
+
+ )}
+
+
+
+ );
+}
diff --git a/src/components/notifications/bell.tsx b/src/components/notifications/bell.tsx
new file mode 100644
index 0000000..fde5920
--- /dev/null
+++ b/src/components/notifications/bell.tsx
@@ -0,0 +1,94 @@
+import Link from "next/link";
+import { Bell } from "lucide-react";
+import { getFormatter, getTranslations } from "next-intl/server";
+import { markAllNotificationsRead, openNotification } from "@/server/actions/notifications/inbox";
+import { bellSummary } from "@/server/services/notifications/inbox";
+import { isNotificationsModuleEnabled, pageCtx } from "@/server/services/notifications/page-ctx";
+import { cn } from "@/lib/utils";
+
+/**
+ * Notification bell for the back office header and the mobile header (L4 embeds
+ * ``). Server component, no client JS: the dropdown is a
+ * native . Hidden without `notification:read` or with the module disabled.
+ */
+export async function NotificationBell({ variant = "desktop" }: { variant?: "desktop" | "mobile" }) {
+ const ctx = await pageCtx();
+ if (!ctx.permissions.has("notification:read") || !(await isNotificationsModuleEnabled(ctx))) return null;
+
+ const [{ unread, latest }, t, format] = await Promise.all([bellSummary(ctx), getTranslations("notifications"), getFormatter()]);
+ const touch = variant === "mobile" ? "size-12" : "size-11";
+
+ return (
+
+
+
+ {unread > 0 && (
+
+ {unread > 99 ? "99+" : unread}
+
+ )}
+
+
+
+
+
+
{t("bell.label")}
+
{t("bell.unreadCount", { count: unread })}
+
+ {unread > 0 && (
+
+ )}
+
+
+ {latest.length === 0 ? (
+
{t("bell.empty")}
+ ) : (
+
+ {latest.map((n) => (
+ -
+
+
+ ))}
+
+ )}
+
+
+
+ {t("bell.showAll")}
+
+
+
+ );
+}
diff --git a/src/components/notifications/preferences-form.tsx b/src/components/notifications/preferences-form.tsx
new file mode 100644
index 0000000..a96fa33
--- /dev/null
+++ b/src/components/notifications/preferences-form.tsx
@@ -0,0 +1,57 @@
+"use client";
+
+import { useActionState } from "react";
+import { Button } from "@/components/ui/button";
+import { saveNotificationPreferences, type PreferencesState } from "@/server/actions/notifications/preferences";
+
+export type PreferenceItem = { type: string; label: string; email: boolean; mandatory: boolean };
+
+/** E-mail opt-out per notification type (in-app notifications are always on). */
+export function NotificationPreferencesForm({
+ items,
+ labels,
+}: {
+ items: PreferenceItem[];
+ labels: { email: string; mandatory: string; save: string; saved: string; error: string };
+}) {
+ const [state, action, pending] = useActionState(saveNotificationPreferences, { status: "idle" } as PreferencesState);
+
+ return (
+
+ );
+}
diff --git a/src/components/notifications/preferences-section.tsx b/src/components/notifications/preferences-section.tsx
new file mode 100644
index 0000000..7d52264
--- /dev/null
+++ b/src/components/notifications/preferences-section.tsx
@@ -0,0 +1,31 @@
+import { getTranslations } from "next-intl/server";
+import { getPreferences } from "@/server/services/notifications/preferences";
+import { isNotificationsModuleEnabled, pageCtx } from "@/server/services/notifications/page-ctx";
+import { eventKey } from "@/server/services/notifications/texts";
+import { NotificationPreferencesForm } from "./preferences-form";
+
+/** "Benachrichtigungen" section of /account (self-contained: loads its own data). */
+export async function NotificationPreferencesSection() {
+ const ctx = await pageCtx();
+ if (!ctx.permissions.has("notification:read") || !(await isNotificationsModuleEnabled(ctx))) return null;
+ const [prefs, t, tc] = await Promise.all([getPreferences(ctx), getTranslations("notifications"), getTranslations("common")]);
+
+ return (
+
+
+ {t("preferences.title")}
+
+ {t("preferences.sub")}
+ ({ type: p.type, label: t(`types.${eventKey(p.type)}`), email: p.email, mandatory: p.mandatory }))}
+ labels={{
+ email: t("preferences.email"),
+ mandatory: t("preferences.mandatory"),
+ save: t("preferences.save"),
+ saved: t("preferences.saved"),
+ error: tc("readOnly"),
+ }}
+ />
+
+ );
+}
diff --git a/src/lib/nav.ts b/src/lib/nav.ts
index 94985ce..714f4bb 100644
--- a/src/lib/nav.ts
+++ b/src/lib/nav.ts
@@ -8,6 +8,9 @@ import {
FileText,
FolderOpen,
Settings,
+ Bell,
+ History,
+ Mail,
type LucideIcon,
} from "lucide-react";
import type { ModuleKey } from "@/lib/modules";
@@ -49,7 +52,10 @@ export const NAV_ITEMS: readonly NavItem[] = [
{ href: "/teams", label: "teams", icon: UsersRound, module: "teams", permissions: ["team:read"], section: "main" },
{ href: "/reports", label: "reports", icon: FileText, module: "reports", permissions: ["report:read"], section: "main" },
{ href: "/documents", label: "documents", icon: FolderOpen, module: "documents", permissions: ["document:read"], section: "main" },
+ { href: "/notifications", label: "notifications", icon: Bell, module: "notifications", permissions: ["notification:read"], section: "main" },
{ href: "/settings", label: "settings", icon: Settings, permissions: ["tenant:manage"], section: "admin" },
+ { href: "/settings/email", label: "email", icon: Mail, module: "notifications", permissions: ["tenant:manage"], section: "admin" },
+ { href: "/settings/audit", label: "audit", icon: History, permissions: ["audit:read"], section: "admin" },
];
/** Filtert die Navigation nach aktiven Modulen und Rechten der Session. */
diff --git a/src/server/actions/notifications/inbox.ts b/src/server/actions/notifications/inbox.ts
new file mode 100644
index 0000000..cf03e08
--- /dev/null
+++ b/src/server/actions/notifications/inbox.ts
@@ -0,0 +1,36 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { redirect } from "next/navigation";
+import { moduleGuard } from "@/server/action-guard";
+import { ctxFromGuard, ServiceError } from "@/server/services/context";
+import { markAllRead, markRead } from "@/server/services/notifications/inbox";
+
+const guard = moduleGuard("notifications");
+
+/** Mark one own notification as read. */
+export async function markNotificationRead(formData: FormData) {
+ const g = await guard("notification:read");
+ await markRead(ctxFromGuard(g), formData.get("id"));
+ revalidatePath("/", "layout");
+}
+
+/** Mark as read and open the linked entity (relative links only). */
+export async function openNotification(formData: FormData) {
+ const g = await guard("notification:read");
+ let target = "/notifications";
+ try {
+ const { link } = await markRead(ctxFromGuard(g), formData.get("id"));
+ if (link) target = link;
+ } catch (err) {
+ if (!(err instanceof ServiceError)) throw err;
+ }
+ revalidatePath("/", "layout");
+ redirect(target);
+}
+
+export async function markAllNotificationsRead() {
+ const g = await guard("notification:read");
+ await markAllRead(ctxFromGuard(g));
+ revalidatePath("/", "layout");
+}
diff --git a/src/server/actions/notifications/mail-settings.ts b/src/server/actions/notifications/mail-settings.ts
new file mode 100644
index 0000000..174a00c
--- /dev/null
+++ b/src/server/actions/notifications/mail-settings.ts
@@ -0,0 +1,30 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { redirect } from "next/navigation";
+import { ZodError } from "zod";
+import { moduleGuard } from "@/server/action-guard";
+import { ctxFromGuard } from "@/server/services/context";
+import { updateMailSettings } from "@/server/services/notifications/mail-settings";
+
+const guard = moduleGuard("notifications");
+
+/** Tenant mail settings (§33.2) — tenant:manage. Result is reported via query string. */
+export async function saveMailSettings(formData: FormData) {
+ const g = await guard("tenant:manage");
+ let target = "/settings/email?saved=1";
+ try {
+ await updateMailSettings(ctxFromGuard(g), {
+ mailFromName: String(formData.get("mailFromName") ?? ""),
+ mailReplyTo: String(formData.get("mailReplyTo") ?? ""),
+ emergencyRecipients: String(formData.get("emergencyRecipients") ?? ""),
+ billingRecipients: String(formData.get("billingRecipients") ?? ""),
+ });
+ } catch (err) {
+ if (!(err instanceof ZodError)) throw err;
+ const fields = [...new Set(err.issues.map((i) => String(i.path[0] ?? "")))].filter(Boolean).join(",");
+ target = `/settings/email?error=${encodeURIComponent(fields || "input")}`;
+ }
+ revalidatePath("/settings/email");
+ redirect(target);
+}
diff --git a/src/server/actions/notifications/preferences.ts b/src/server/actions/notifications/preferences.ts
new file mode 100644
index 0000000..6a96cef
--- /dev/null
+++ b/src/server/actions/notifications/preferences.ts
@@ -0,0 +1,23 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { moduleGuard } from "@/server/action-guard";
+import { ctxFromGuard } from "@/server/services/context";
+import { setPreferences } from "@/server/services/notifications/preferences";
+
+const guard = moduleGuard("notifications");
+
+export type PreferencesState = { status: "idle" | "saved" | "error" };
+
+/** Save the current user's e-mail opt-outs (checked boxes = e-mail on). */
+export async function saveNotificationPreferences(_prev: PreferencesState, formData: FormData): Promise {
+ const g = await guard("notification:read");
+ try {
+ await setPreferences(ctxFromGuard(g), { emailOn: formData.getAll("emailOn").map(String) });
+ } catch (err) {
+ console.error("[notifications] saving preferences failed:", (err as Error).message);
+ return { status: "error" };
+ }
+ revalidatePath("/account");
+ return { status: "saved" };
+}
diff --git a/src/server/services/notifications/inbox.ts b/src/server/services/notifications/inbox.ts
new file mode 100644
index 0000000..c610c4e
--- /dev/null
+++ b/src/server/services/notifications/inbox.ts
@@ -0,0 +1,103 @@
+import { z } from "zod";
+import { EVENT_TYPES } from "@/lib/events";
+import { writeAuditLog } from "@/server/audit";
+import { assertCan, ServiceError, type ServiceCtx } from "@/server/services/context";
+
+/**
+ * Personal notification inbox. A user only ever sees/changes their OWN notifications
+ * (userId filter) inside their tenant (ctx.db). Foreign ids → not_found (no existence leak).
+ */
+
+export const PAGE_SIZE = 25;
+
+export const listFilterSchema = z.object({
+ status: z.enum(["all", "unread", "read"]).catch("all"),
+ type: z.enum(EVENT_TYPES).optional().catch(undefined),
+ page: z.coerce.number().int().min(1).max(10_000).catch(1),
+});
+export type ListFilter = z.infer;
+
+export async function listNotifications(ctx: ServiceCtx, input: unknown) {
+ assertCan(ctx, "notification:read");
+ const filter = listFilterSchema.parse(input ?? {});
+ const where = {
+ userId: ctx.userId,
+ ...(filter.status === "unread" ? { readAt: null } : filter.status === "read" ? { readAt: { not: null } } : {}),
+ ...(filter.type ? { type: filter.type } : {}),
+ };
+ const [rows, total] = await Promise.all([
+ ctx.db.notification.findMany({
+ where,
+ orderBy: { createdAt: "desc" },
+ skip: (filter.page - 1) * PAGE_SIZE,
+ take: PAGE_SIZE,
+ select: { id: true, type: true, title: true, message: true, link: true, readAt: true, createdAt: true, entityType: true, entityId: true },
+ }),
+ ctx.db.notification.count({ where }),
+ ]);
+ return { rows, total, page: filter.page, pages: Math.max(1, Math.ceil(total / PAGE_SIZE)), filter };
+}
+
+/** Unread counter + latest 10 for the bell. */
+export async function bellSummary(ctx: ServiceCtx) {
+ assertCan(ctx, "notification:read");
+ const [unread, latest] = await Promise.all([
+ ctx.db.notification.count({ where: { userId: ctx.userId, readAt: null } }),
+ ctx.db.notification.findMany({
+ where: { userId: ctx.userId },
+ orderBy: { createdAt: "desc" },
+ take: 10,
+ select: { id: true, type: true, title: true, message: true, link: true, readAt: true, createdAt: true },
+ }),
+ ]);
+ return { unread, latest };
+}
+
+const idSchema = z.string().min(1).max(64);
+
+/** Mark one own notification as read; returns its link (safe relative path or null). */
+export async function markRead(ctx: ServiceCtx, id: unknown): Promise<{ link: string | null }> {
+ assertCan(ctx, "notification:read");
+ const notificationId = idSchema.parse(id);
+ const row = await ctx.db.notification.findFirst({
+ where: { id: notificationId, userId: ctx.userId },
+ select: { id: true, readAt: true, link: true },
+ });
+ if (!row) throw new ServiceError("not_found", "notification not found");
+ if (!row.readAt) {
+ const readAt = new Date();
+ await ctx.db.notification.update({ where: { id: row.id }, data: { readAt } });
+ await writeAuditLog({
+ tenantId: ctx.tenantId,
+ actorId: ctx.userId,
+ action: "update",
+ entity: "notification",
+ entityId: row.id,
+ before: { readAt: null },
+ after: { readAt: readAt.toISOString() },
+ });
+ }
+ return { link: safeLink(row.link) };
+}
+
+export async function markAllRead(ctx: ServiceCtx): Promise<{ count: number }> {
+ assertCan(ctx, "notification:read");
+ const res = await ctx.db.notification.updateMany({ where: { userId: ctx.userId, readAt: null }, data: { readAt: new Date() } });
+ if (res.count > 0) {
+ await writeAuditLog({
+ tenantId: ctx.tenantId,
+ actorId: ctx.userId,
+ action: "update",
+ entity: "notification",
+ before: { unread: res.count },
+ after: { unread: 0 },
+ });
+ }
+ return { count: res.count };
+}
+
+/** Only same-origin relative paths are followed (no open redirect). */
+export function safeLink(link: string | null | undefined): string | null {
+ if (!link || !link.startsWith("/") || link.startsWith("//") || link.includes("\\")) return null;
+ return link;
+}
diff --git a/src/server/services/notifications/mail-settings.ts b/src/server/services/notifications/mail-settings.ts
new file mode 100644
index 0000000..9717925
--- /dev/null
+++ b/src/server/services/notifications/mail-settings.ts
@@ -0,0 +1,96 @@
+import { z } from "zod";
+import { writeAuditLog } from "@/server/audit";
+import { assertCan, type ServiceCtx } from "@/server/services/context";
+
+/**
+ * Tenant mail settings (spec §33.2). The sender ADDRESS stays the platform domain (SPF/DKIM);
+ * per tenant only the display name and reply-to address are configurable, plus fixed recipient
+ * lists for emergency call-outs and billing.
+ */
+
+export const MAX_RECIPIENTS = 20;
+
+/** Split a textarea/comma list into trimmed, lower-cased, unique entries. */
+export function splitAddressList(raw: unknown): string[] {
+ if (Array.isArray(raw)) return [...new Set(raw.map((x) => String(x).trim().toLowerCase()).filter(Boolean))];
+ if (typeof raw !== "string") return [];
+ return [...new Set(raw.split(/[\s,;]+/).map((x) => x.trim().toLowerCase()).filter(Boolean))];
+}
+
+const email = z.string().trim().toLowerCase().email().max(254);
+
+export const mailSettingsSchema = z.object({
+ // No CR/LF or angle brackets/quotes: the name ends up in a mail header (header injection).
+ mailFromName: z
+ .string()
+ .trim()
+ .max(100)
+ .regex(/^[^\r\n<>"]*$/, "invalid characters")
+ .transform((v) => v || null),
+ mailReplyTo: z
+ .union([z.literal(""), email])
+ .transform((v) => v || null),
+ emergencyRecipients: z.preprocess(splitAddressList, z.array(email).max(MAX_RECIPIENTS)),
+ billingRecipients: z.preprocess(splitAddressList, z.array(email).max(MAX_RECIPIENTS)),
+});
+
+export type MailSettings = {
+ mailFromName: string | null;
+ mailReplyTo: string | null;
+ emergencyRecipients: string[];
+ billingRecipients: string[];
+};
+
+const SELECT = { mailFromName: true, mailReplyTo: true, emergencyRecipients: true, billingRecipients: true, orgName: true } as const;
+
+export async function getMailSettings(ctx: ServiceCtx): Promise {
+ assertCan(ctx, "tenant:manage");
+ const s = await ctx.db.tenantSettings.findFirst({ select: SELECT });
+ return {
+ mailFromName: s?.mailFromName ?? null,
+ mailReplyTo: s?.mailReplyTo ?? null,
+ emergencyRecipients: s?.emergencyRecipients ?? [],
+ billingRecipients: s?.billingRecipients ?? [],
+ orgName: s?.orgName ?? null,
+ };
+}
+
+export async function updateMailSettings(ctx: ServiceCtx, input: unknown): Promise {
+ assertCan(ctx, "tenant:manage");
+ const data = mailSettingsSchema.parse(input);
+ const before = await ctx.db.tenantSettings.findFirst({ select: SELECT });
+
+ if (before) {
+ await ctx.db.tenantSettings.update({ where: { tenantId: ctx.tenantId }, data });
+ } else {
+ const tenant = await ctx.db.tenant.findUnique({ where: { id: ctx.tenantId }, select: { name: true } });
+ await ctx.db.tenantSettings.create({ data: { tenantId: ctx.tenantId, orgName: tenant?.name ?? "", ...data } });
+ }
+
+ await writeAuditLog({
+ tenantId: ctx.tenantId,
+ actorId: ctx.userId,
+ action: "update",
+ entity: "tenant_mail_settings",
+ before: before
+ ? {
+ mailFromName: before.mailFromName,
+ mailReplyTo: before.mailReplyTo,
+ emergencyRecipients: before.emergencyRecipients,
+ billingRecipients: before.billingRecipients,
+ }
+ : undefined,
+ after: data,
+ });
+ return data;
+}
+
+/**
+ * Sender override for tenant mails — ready for the mail core once it accepts per-mail
+ * `fromName`/`replyTo` (reported as foundation requirement; deliver.ts currently uses the
+ * global MAIL_FROM_NAME/MAIL_REPLY_TO only).
+ */
+export async function tenantMailSender(ctx: ServiceCtx): Promise<{ fromName: string | null; replyTo: string | null }> {
+ const s = await ctx.db.tenantSettings.findFirst({ select: { mailFromName: true, mailReplyTo: true, orgName: true } });
+ return { fromName: s?.mailFromName || s?.orgName || null, replyTo: s?.mailReplyTo ?? null };
+}
diff --git a/src/server/services/notifications/page-ctx.ts b/src/server/services/notifications/page-ctx.ts
new file mode 100644
index 0000000..8f6bed8
--- /dev/null
+++ b/src/server/services/notifications/page-ctx.ts
@@ -0,0 +1,26 @@
+import { requireSession } from "@/server/auth";
+import { dbForTenant } from "@/server/db";
+import type { ServiceCtx } from "@/server/services/context";
+
+/**
+ * Read-path context for server components (pages, bell). Permissions come from the session
+ * (JWT copy), which is accepted for READ paths (AGENTS.md); mutations go through moduleGuard,
+ * which re-checks permissions against the database.
+ */
+export async function pageCtx(): Promise {
+ const session = await requireSession();
+ return {
+ db: dbForTenant(session.user.tenantId),
+ tenantId: session.user.tenantId,
+ userId: session.user.id,
+ permissions: new Set(session.user.permissions ?? []),
+ };
+}
+
+export async function isNotificationsModuleEnabled(ctx: ServiceCtx): Promise {
+ const row = await ctx.db.tenantModule.findUnique({
+ where: { tenantId_moduleKey: { tenantId: ctx.tenantId, moduleKey: "notifications" } },
+ select: { enabled: true },
+ });
+ return !row || row.enabled;
+}
diff --git a/src/server/services/notifications/preferences.ts b/src/server/services/notifications/preferences.ts
new file mode 100644
index 0000000..c553923
--- /dev/null
+++ b/src/server/services/notifications/preferences.ts
@@ -0,0 +1,58 @@
+import { z } from "zod";
+import { EVENT_TYPES, type EventType } from "@/lib/events";
+import { writeAuditLog } from "@/server/audit";
+import { assertCan, type ServiceCtx } from "@/server/services/context";
+import { MANDATORY_EMAIL_EVENTS } from "./recipients";
+
+/**
+ * Per-user e-mail opt-out per event type (NotificationPreference, default opt-in).
+ * Mandatory events (emergency call-outs) are always on and cannot be stored as opted out.
+ */
+
+export type PreferenceRow = { type: EventType; email: boolean; mandatory: boolean };
+
+export async function getPreferences(ctx: ServiceCtx): Promise {
+ assertCan(ctx, "notification:read");
+ const rows = await ctx.db.notificationPreference.findMany({
+ where: { userId: ctx.userId },
+ select: { eventType: true, email: true },
+ });
+ const map = new Map(rows.map((r) => [r.eventType, r.email]));
+ return EVENT_TYPES.map((type) => {
+ const mandatory = MANDATORY_EMAIL_EVENTS.has(type);
+ return { type, mandatory, email: mandatory ? true : (map.get(type) ?? true) };
+ });
+}
+
+export const setPreferencesSchema = z.object({
+ /** event types that should still send e-mail; everything else (non-mandatory) is opted out */
+ emailOn: z.array(z.enum(EVENT_TYPES)).max(EVENT_TYPES.length),
+});
+
+export async function setPreferences(ctx: ServiceCtx, input: unknown): Promise {
+ assertCan(ctx, "notification:read");
+ const { emailOn } = setPreferencesSchema.parse(input);
+ const on = new Set(emailOn);
+ const before = await getPreferences(ctx);
+
+ for (const type of EVENT_TYPES) {
+ const email = MANDATORY_EMAIL_EVENTS.has(type) ? true : on.has(type);
+ await ctx.db.notificationPreference.upsert({
+ where: { userId_eventType: { userId: ctx.userId, eventType: type } },
+ update: { email },
+ create: { tenantId: ctx.tenantId, userId: ctx.userId, eventType: type, email },
+ });
+ }
+
+ const after = await getPreferences(ctx);
+ await writeAuditLog({
+ tenantId: ctx.tenantId,
+ actorId: ctx.userId,
+ action: "update",
+ entity: "notification_settings",
+ entityId: ctx.userId,
+ before: Object.fromEntries(before.map((p) => [p.type, p.email])),
+ after: Object.fromEntries(after.map((p) => [p.type, p.email])),
+ });
+ return after;
+}