06.14
Notifications
Executive summary
Notifications deliver the clinic inbox, native push to iOS and Android, web push and email. Delivery is driven by an outbox and reconciled on a schedule, so a crash between a change and its notification loses nothing. Push tokens are stored encrypted; a native push carries one category sentence and a web push carries no payload at all.
Overview
- ProductionOperate · NotificationsTell the right person that something needs them, on whichever device they are using.
Pipeline
- A domain change writes a notification in the same transaction.
- A change bus fans it out to open clients; a one-minute drain decides at send time whether a push is still useful (expired, resolved, muted, quiet hours, already seen in a live tab) and sends one push per person per drain.
- FCM, APNs and Web Push deliver to registered devices; email goes through the configured mail provider.
- Reconciliation re-sends anything not acknowledged.
Data owned
- Clinic notifications
- Holds
- The inbox
- Push registrations
- Holds
- Encrypted device tokens
| Store | Holds |
|---|---|
| Clinic notifications | The inbox |
| Push registrations | Encrypted device tokens |
Models and engines
This module makes no model calls. Everything it computes is deterministic code.
Guardrails
- Native push carries a generic category sentence; web push is sent without a payload, so there is nothing to leak.
- Tokens are encrypted at rest.
- No provider call runs inside a database transaction; drains work under a lease, so a crash re-sends at most once and the device collapses duplicates.
Rollout and status
- ProductionInbox, push, emailNative push through Capacitor
Interfaces
- Consumes
- What
- Domain events across modules
- Emits
- What
- Inbox entries, push and email
| Direction | What |
|---|---|
| Consumes | Domain events across modules |
| Emits | Inbox entries, push and email |
SOURCE OF TRUTH
server/services/notifications/docs/notifications-tier1-implementation-plan.md