Skip to content

feat(notify): outbound channels — ntfy, Gotify, webhook#139

Merged
bndct-devops merged 7 commits into
mainfrom
feat/outbound-notifications
Jul 19, 2026
Merged

feat(notify): outbound channels — ntfy, Gotify, webhook#139
bndct-devops merged 7 commits into
mainfrom
feat/outbound-notifications

Conversation

@bndct-devops

Copy link
Copy Markdown
Owner

Overnight run PR 8/12 — stacked on #138; merge in order. Adds one additive table.

What

  • notification_channels (per-user; additive, startup create_all): kind (ntfy | gotify | webhook), URL, optional token, enabled flag.
  • Fanout at the ORM layer: after_insert on Notification collects payloads on the session; after_commit hands them to a daemon thread that POSTs to the owner's enabled channels (5s timeout, best-effort, no retries). This means zero changes at the six existing Notification creation sites (wishlist, wish matcher, goals, hardcover, release detection), rolled-back transactions never send, and the request path never blocks on HTTP.
  • Payloads: ntfy gets Title/Click/Bearer headers + body; Gotify gets /message?token= JSON; webhook gets {event, title, body, link} JSON. Relative links get the TOME_PUBLIC_URL origin when configured.
  • Settings → Notifications: add/test/pause/delete channels. The test button delivers synchronously and surfaces the exact error (the only way to debug a typo'd topic at setup). Tokens are write-only (has_token in responses).
  • TOME_OUTBOUND_NOTIFY=false: operator kill-switch. Nothing is ever sent unless a user configures a channel.

Verification

  • 5 backend tests: CRUD + token never echoed, invalid kind/scheme 422s, fanout on commit (enabled channel delivers, disabled skipped) via the ORM-event path, kill-switch, and exact request construction per kind (headers/URLs/JSON asserted).
  • Real end-to-end: added a webhook channel through the Settings UI pointing at a local HTTP sink, pressed Test — the sink received {"event": "test", "title": "Tome test notification", ...} and the UI showed the green check.
  • Existing notification/wishlist suites green; build/typecheck clean.

bndct-devops and others added 7 commits July 18, 2026 23:46
- The tooltip resolves the day under the cursor (date + that day's minutes,
  or "no reading" inside a gap) below the book totals — the per-day data was
  only legible as tick opacity before.
- Phones (<480px container): the rail narrows 200->96px so the ribbon keeps
  the viewport; coarse-pointer taps inspect first (tooltip), navigate on the
  second tap on the same bar. Scroll or empty-space tap dismisses.

Book-page activity sparkline (planned as part of this PR) was investigated
and dropped: the per-book stats hero already charts per-day activity for
both live sessions and imported page-stats (sessions are synthesized from
page-stats), so the strip would duplicate an adjacent chart.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
GET /api/meta/whats-new parses CHANGELOG.md for the running version's
section (Unreleased fallback for dev builds); the frontend shows a one-time
dismissible panel when the server version differs from the last one this
browser saw. Fresh browsers baseline silently — first login never opens
with a modal. Panel portals to <body>: the header that mounts it has
backdrop-blur, which would otherwise contain the fixed overlay.

GET /api/meta/update-check (admin-only) compares against the latest GitHub
release, cached in memory 24h (1h after failures), gated by
TOME_UPDATE_CHECK (default true). Settings -> About shows a quiet
"vX.Y.Z available" link only when something is newer.

CHANGELOG.md is now copied into the Docker image for the panel.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Upload dialog: files are sha256-hashed in the browser (sequential, 512MB
cap) and checked via the existing POST /books/check-hashes before upload;
exact duplicates show "already in your library" with a link and are
skipped. The server already deduped silently — this saves the transfer
and makes it visible. Hash-check failures degrade to the old behavior.

Admin -> Covers (GET /admin/covers/audit): flags missing, unreadable, and
low-res covers (PIL header reads only). The floor is 300px — the standard
Google Books cover is 329px and fine in practice; the audit exists for the
98-128px thumbnails. Missing covers offer one-click auto-fix via the
existing cover-candidates + set-cover endpoints (nothing to downgrade);
low-res rows deep-link to the book's cover picker.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Global palette mounted from the shared header: full-text book search via
GET /books?q= (debounced, covers in rows), series/authors ranked from the
facets list client-side (startsWith > includes > shorter), and plain
navigation actions (admin sees Admin). Arrow keys + Enter, Esc closes,
portaled past the header's backdrop-blur containing block. Registered in
the "?" shortcuts help.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
New position_history table (additive, created by the startup create_all
like every other table): upsert_position — the single choke point all
position writers go through — appends an entry whenever the position moves
meaningfully (>=0.2% or locator change; the idle heartbeat can't spam it),
pruned to the newest 40 per user+book.

GET /books/{id}/position-history lists the log + live position;
POST .../{hid}/restore sets the live position back. Restore is an explicit
override of the sticky-completion rule: recovering from a false 100% also
un-finishes the book (status/finished_at), or the position would come back
while the book stayed "read". The restore itself is logged, so it can be
undone the same way. Devices converge on their next pull.

UI: history button on the book page's Reading Stats header opens the log
with per-entry Restore; refreshes stats + status pill after.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
GET /books/{id}/reader-pacing returns the chapter fraction boundaries,
book word count, and the user's true WPM (same rule as the stats tile:
finished word-counted books with >=5min reconciled read-time; null without
history). The reader computes words-left from the current relocate
fraction against the chapter's end_fraction — no pagination involved —
and shows "~N min left" in the footer beside the chapter name (250wpm
default, tooltip says which pace is in use). Recomputes when pacing
arrives, since the initial relocate races the fetch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Per-user notification_channels table (additive) + fanout hooked at the ORM
layer: an after_insert listener collects fresh Notification rows on the
session, after_commit hands them to a daemon thread that loads the owners'
enabled channels and POSTs each (5s timeout, best-effort, no retries).
Zero changes at the six Notification creation sites; a rolled-back
transaction never sends.

Settings -> Notifications: add/pause/delete channels per kind (ntfy topic
URL + optional bearer token; Gotify base URL + app token; bare webhook),
with a synchronous test button that surfaces delivery errors. Tokens are
never echoed back (has_token only). TOME_OUTBOUND_NOTIFY=false is the
operator kill-switch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@bndct-devops
bndct-devops changed the base branch from feat/chapter-time-left to main July 19, 2026 10:10
@bndct-devops
bndct-devops merged commit c3b5cb0 into main Jul 19, 2026
@bndct-devops
bndct-devops deleted the feat/outbound-notifications branch July 19, 2026 10:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant