feat: unify alerts into one plugin, channels, rules and inbox

src/backend/database/database.ts

@@ -7,7 +7,6 @@ import multer from "multer";
 import cookieParser from "cookie-parser";
 import userRoutes from "./routes/users.js";
 import hostRoutes from "./routes/host.js";
-import alertRoutes from "./routes/alerts.js";
 import credentialsRoutes from "./routes/credentials.js";
 import sshAuthRoutes from "./routes/ssh-auth-routes.js";
 import rbacRoutes from "./routes/rbac.js";
@@ -17,7 +16,6 @@ import hostSidebarPreferencesRoutes from "./routes/host-sidebar-preferences.js";
 import credentialSidebarPreferencesRoutes from "./routes/credential-sidebar-preferences.js";
 import uiPreferencesRoutes from "./routes/ui-preferences.js";
 import { registerAuditLogRoutes } from "./routes/audit-log-routes.js";
-import notificationChannelsRoutes from "./routes/notification-channels-routes.js";
 import syncRoutes from "./routes/sync.js";
 import dashboardRoutes from "./routes/dashboard-routes.js";
 import {
@@ -48,7 +46,6 @@ import { configureDirectHttps, getTlsConfig } from "../tls/tls-service.js";
 import { acmeChallengeHandler } from "../tls/acme-challenges.js";
 import {
   createCurrentCredentialRepository,
-  createCurrentDismissedAlertRepository,
   createCurrentHostRepository,
   createCurrentPluginSettingsRepository,
   createCurrentSettingsRepository,
@@ -866,13 +863,6 @@ app.post("/database/export", authenticateJWT, async (req, res) => {
           updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
         );
 
-        CREATE TABLE dismissed_alerts (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          user_id TEXT NOT NULL,
-          alert_id TEXT NOT NULL,
-          dismissed_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
-        );
-
         CREATE TABLE ssh_credential_usage (
           id INTEGER PRIMARY KEY AUTOINCREMENT,
           credential_id INTEGER NOT NULL,
@@ -1008,21 +998,6 @@ app.post("/database/export", authenticateJWT, async (req, res) => {
       // Rows the user owns in plugin tables travel with the export.
       await writeUserPluginTables(exportDb, userId);
 
-      const dismissedAlertRepository = createCurrentDismissedAlertRepository();
-      const alerts = await dismissedAlertRepository.listByUserId(userId);
-      const insertAlert = exportDb.prepare(`
-        INSERT INTO dismissed_alerts (id, user_id, alert_id, dismissed_at)
-        VALUES (?, ?, ?, ?)
-      `);
-      for (const alert of alerts) {
-        insertAlert.run(
-          alert.id,
-          alert.userId,
-          alert.alertId,
-          alert.dismissedAt,
-        );
-      }
-
       const sshCredentialUsageRepository =
         createCurrentSshCredentialUsageRepository();
       const usage = await sshCredentialUsageRepository.listByUserId(userId);
@@ -1217,7 +1192,6 @@ app.post(
           sshHostsImported: 0,
           sshCredentialsImported: 0,
           pluginItemsImported: 0,
-          dismissedAlertsImported: 0,
           credentialUsageImported: 0,
           settingsImported: 0,
           skippedItems: 0,
@@ -1366,37 +1340,6 @@ app.post(
           result.summary.skippedItems += pluginRows.skipped;
           result.summary.errors.push(...pluginRows.errors);
 
-          const dismissedAlertRepository =
-            createCurrentDismissedAlertRepository();
-
-          try {
-            const importedAlerts = importDb
-              .prepare("SELECT * FROM dismissed_alerts")
-              .all();
-            for (const alert of importedAlerts) {
-              try {
-                const created = await dismissedAlertRepository.createForImport(
-                  userId,
-                  alert.alert_id,
-                  alert.dismissed_at,
-                );
-                if (created) {
-                  result.summary.dismissedAlertsImported++;
-                } else {
-                  result.summary.skippedItems++;
-                }
-              } catch (alertError) {
-                result.summary.errors.push(
-                  `Dismissed alert import error: ${alertError.message}`,
-                );
-              }
-            }
-          } catch {
-            apiLogger.info(
-              "dismissed_alerts table not found in import file, skipping",
-            );
-          }
-
           const targetUser = await userRepository.findById(userId);
           if (targetUser?.isAdmin) {
             try {
@@ -1614,7 +1557,6 @@ app.post("/database/restore", requireAdmin, async (req, res) => {
 
 app.use("/users", userRoutes);
 app.use("/host", hostRoutes);
-app.use("/alerts", alertRoutes);
 app.use("/credentials", credentialsRoutes);
 app.use("/ssh-auth", sshAuthRoutes);
 app.use("/rbac", rbacRoutes);
@@ -1624,7 +1566,6 @@ app.use("/host-sidebar/preferences", hostSidebarPreferencesRoutes);
 app.use("/credential-sidebar/preferences", credentialSidebarPreferencesRoutes);
 app.use("/ui-preferences", uiPreferencesRoutes);
 registerAuditLogRoutes(app, authenticateJWT);
-app.use("/", notificationChannelsRoutes);
 app.use("/sync", syncRoutes);
 app.use("/dashboard", dashboardRoutes);
 app.use("/plugins", pluginRoutes);

src/backend/database/db/index.ts

@@ -322,14 +322,6 @@ async function initializeCompleteDatabase(): Promise<void> {
         FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
     );
 
-    CREATE TABLE IF NOT EXISTS dismissed_alerts (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        user_id TEXT NOT NULL,
-        alert_id TEXT NOT NULL,
-        dismissed_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
-        FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
-    );
-
     CREATE TABLE IF NOT EXISTS ssh_credentials (
         id INTEGER PRIMARY KEY AUTOINCREMENT,
         user_id TEXT NOT NULL,
@@ -1549,29 +1541,6 @@ const migrateSchema = () => {
       });
     }
   }
-
-  try {
-    sqlite.prepare("SELECT id FROM notification_channels LIMIT 1").get();
-  } catch {
-    try {
-      sqlite.exec(`
-        CREATE TABLE IF NOT EXISTS notification_channels (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-          name TEXT NOT NULL,
-          type TEXT NOT NULL,
-          config TEXT NOT NULL,
-          enabled INTEGER NOT NULL DEFAULT 1,
-          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
-        );
-      `);
-    } catch (createError) {
-      databaseLogger.warn("Failed to create notification_channels table", {
-        operation: "schema_migration",
-        error: createError,
-      });
-    }
-  }
   // --- alerts end ---
 
 

src/backend/database/db/performance-indexes.ts

@@ -109,11 +109,6 @@ export const PERFORMANCE_INDEXES: PerformanceIndex[] = [
     table: "user_open_tabs",
     columns: "user_id",
   },
-  {
-    name: "idx_dismissed_alerts_user_id",
-    table: "dismissed_alerts",
-    columns: "user_id",
-  },
 ];
 
 interface IndexableDatabase {

src/backend/database/db/schema.mysql.ts

@@ -271,20 +271,6 @@ export const hosts = mysqlTable(
   ],
 );
 
-export const dismissedAlerts = mysqlTable(
-  "dismissed_alerts",
-  {
-    id: int("id").autoincrement().primaryKey(),
-    userId: varchar("user_id", { length: 255 })
-      .notNull()
-      .references(() => users.id, { onDelete: "cascade" }),
-    alertId: text("alert_id").notNull(),
-    dismissedAt: text("dismissed_at")
-      .notNull()
-      .default(sql`(CURRENT_TIMESTAMP)`),
-  },
-  (table) => [index("idx_dismissed_alerts_user_id").on(table.userId)],
-);
 
 export const sshCredentials = mysqlTable(
   "ssh_credentials",
@@ -720,22 +706,6 @@ export const uiPreferences = mysqlTable("ui_preferences", {
     .default(sql`(CURRENT_TIMESTAMP)`),
 });
 
-// --- alerts begin ---
-export const notificationChannels = mysqlTable("notification_channels", {
-  id: int("id").autoincrement().primaryKey(),
-  userId: varchar("user_id", { length: 255 })
-    .notNull()
-    .references(() => users.id, { onDelete: "cascade" }),
-  name: text("name").notNull(),
-  type: text("type").notNull(),
-  config: text("config").notNull(),
-  enabled: boolean("enabled").notNull().default(true),
-  createdAt: text("created_at")
-    .notNull()
-    .default(sql`(CURRENT_TIMESTAMP)`),
-});
-// --- alerts end ---
-
 // --- sync begin ---
 // Records a delete for a synced entity type so the other side of a sync
 // pair (embedded desktop backend <-> connected remote server) learns about

src/backend/database/db/schema.pg.ts

@@ -272,20 +272,6 @@ export const hosts = pgTable(
   ],
 );
 
-export const dismissedAlerts = pgTable(
-  "dismissed_alerts",
-  {
-    id: serial("id").primaryKey(),
-    userId: varchar("user_id", { length: 255 })
-      .notNull()
-      .references(() => users.id, { onDelete: "cascade" }),
-    alertId: text("alert_id").notNull(),
-    dismissedAt: text("dismissed_at")
-      .notNull()
-      .default(sql`CURRENT_TIMESTAMP`),
-  },
-  (table) => [index("idx_dismissed_alerts_user_id").on(table.userId)],
-);
 
 export const sshCredentials = pgTable(
   "ssh_credentials",
@@ -721,22 +707,6 @@ export const uiPreferences = pgTable("ui_preferences", {
     .default(sql`CURRENT_TIMESTAMP`),
 });
 
-// --- alerts begin ---
-export const notificationChannels = pgTable("notification_channels", {
-  id: serial("id").primaryKey(),
-  userId: varchar("user_id", { length: 255 })
-    .notNull()
-    .references(() => users.id, { onDelete: "cascade" }),
-  name: text("name").notNull(),
-  type: text("type").notNull(),
-  config: text("config").notNull(),
-  enabled: boolean("enabled").notNull().default(true),
-  createdAt: text("created_at")
-    .notNull()
-    .default(sql`CURRENT_TIMESTAMP`),
-});
-// --- alerts end ---
-
 // --- sync begin ---
 // Records a delete for a synced entity type so the other side of a sync
 // pair (embedded desktop backend <-> connected remote server) learns about

src/backend/database/db/schema.ts

@@ -264,20 +264,6 @@ export const hosts = sqliteTable(
   ],
 );
 
-export const dismissedAlerts = sqliteTable(
-  "dismissed_alerts",
-  {
-    id: integer("id").primaryKey({ autoIncrement: true }),
-    userId: text("user_id")
-      .notNull()
-      .references(() => users.id, { onDelete: "cascade" }),
-    alertId: text("alert_id").notNull(),
-    dismissedAt: text("dismissed_at")
-      .notNull()
-      .default(sql`CURRENT_TIMESTAMP`),
-  },
-  (table) => [index("idx_dismissed_alerts_user_id").on(table.userId)],
-);
 
 export const sshCredentials = sqliteTable(
   "ssh_credentials",
@@ -717,22 +703,6 @@ export const uiPreferences = sqliteTable("ui_preferences", {
     .default(sql`CURRENT_TIMESTAMP`),
 });
 
-// --- alerts begin ---
-export const notificationChannels = sqliteTable("notification_channels", {
-  id: integer("id").primaryKey({ autoIncrement: true }),
-  userId: text("user_id")
-    .notNull()
-    .references(() => users.id, { onDelete: "cascade" }),
-  name: text("name").notNull(),
-  type: text("type").notNull(),
-  config: text("config").notNull(),
-  enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
-  createdAt: text("created_at")
-    .notNull()
-    .default(sql`CURRENT_TIMESTAMP`),
-});
-// --- alerts end ---
-
 // --- sync begin ---
 // Records a delete for a synced entity type so the other side of a sync
 // pair (embedded desktop backend <-> connected remote server) learns about

src/backend/database/repositories/dismissed-alert-repository.ts

@@ -1,107 +0,0 @@
-import { and, eq } from "drizzle-orm";
-import { dismissedAlerts } from "../db/schema.js";
-import type { DatabaseContext } from "./database-context.js";
-import { rowsAffected } from "./mutation-result.js";
-
-export type DismissedAlertRecord = typeof dismissedAlerts.$inferSelect;
-
-export class DismissedAlertRepository {
-  constructor(
-    private readonly context: DatabaseContext,
-    private readonly onWrite?: () => void | Promise<void>,
-  ) {}
-
-  async listByUserId(userId: string): Promise<DismissedAlertRecord[]> {
-    return this.context.drizzle
-      .select()
-      .from(dismissedAlerts)
-      .where(eq(dismissedAlerts.userId, userId));
-  }
-
-  async listAlertIdsByUserId(userId: string): Promise<string[]> {
-    const rows = await this.context.drizzle
-      .select({ alertId: dismissedAlerts.alertId })
-      .from(dismissedAlerts)
-      .where(eq(dismissedAlerts.userId, userId));
-
-    return rows.map((row) => row.alertId);
-  }
-
-  async findForUser(
-    userId: string,
-    alertId: string,
-  ): Promise<DismissedAlertRecord | null> {
-    const rows = await this.context.drizzle
-      .select()
-      .from(dismissedAlerts)
-      .where(
-        and(
-          eq(dismissedAlerts.userId, userId),
-          eq(dismissedAlerts.alertId, alertId),
-        ),
-      )
-      .limit(1);
-
-    return rows[0] ?? null;
-  }
-
-  async create(userId: string, alertId: string): Promise<void> {
-    await this.context.drizzle.insert(dismissedAlerts).values({
-      userId,
-      alertId,
-    });
-    await this.afterWrite();
-  }
-
-  async createForImport(
-    userId: string,
-    alertId: string,
-    dismissedAt = new Date().toISOString(),
-  ): Promise<boolean> {
-    const existing = await this.findForUser(userId, alertId);
-    if (existing) {
-      return false;
-    }
-
-    await this.context.drizzle.insert(dismissedAlerts).values({
-      userId,
-      alertId,
-      dismissedAt,
-    });
-    await this.afterWrite();
-    return true;
-  }
-
-  async deleteForUser(userId: string, alertId: string): Promise<boolean> {
-    const result = await this.context.drizzle
-      .delete(dismissedAlerts)
-      .where(
-        and(
-          eq(dismissedAlerts.userId, userId),
-          eq(dismissedAlerts.alertId, alertId),
-        ),
-      );
-
-    if (rowsAffected(result) > 0) {
-      await this.afterWrite();
-    }
-
-    return rowsAffected(result) > 0;
-  }
-
-  async deleteByUserId(userId: string): Promise<number> {
-    const result = await this.context.drizzle
-      .delete(dismissedAlerts)
-      .where(eq(dismissedAlerts.userId, userId));
-
-    if (rowsAffected(result) > 0) {
-      await this.afterWrite();
-    }
-
-    return rowsAffected(result);
-  }
-
-  private async afterWrite(): Promise<void> {
-    await this.onWrite?.();
-  }
-}

src/backend/database/repositories/factory.ts

@@ -3,11 +3,9 @@ import { getDb, getSqlite } from "../db/index.js";
 import { needsExplicitPersist, resolveDatabaseDialect } from "../db/dialect.js";
 import { primeSettingsCache, readCachedSetting } from "./settings-cache.js";
 import type { DatabaseContext } from "./database-context.js";
-import { NotificationChannelRepository } from "./notification-channel-repository.js";
 import { ApiKeyRepository } from "./api-key-repository.js";
 import { AuditLogRepository } from "./audit-log-repository.js";
 import { CredentialRepository } from "./credential-repository.js";
-import { DismissedAlertRepository } from "./dismissed-alert-repository.js";
 import { HostFolderRepository } from "./host-folder-repository.js";
 import { HostRepository } from "./host-repository.js";
 import { HostResolutionRepository } from "./host-resolution-repository.js";
@@ -119,13 +117,6 @@ export function getCurrentSettingValue(key: string): string | null {
   return row?.value ?? null;
 }
 
-export function createCurrentNotificationChannelRepository(): NotificationChannelRepository {
-  return new NotificationChannelRepository(
-    createCurrentRepositoryContext(),
-    createCurrentRepositoryWriteHook("notification_channel_repository_write"),
-  );
-}
-
 export function createCurrentApiKeyRepository(): ApiKeyRepository {
   return new ApiKeyRepository(
     createCurrentRepositoryContext(),
@@ -154,13 +145,6 @@ export function createCurrentSyncTombstoneRepository(): SyncTombstoneRepository
   );
 }
 
-export function createCurrentDismissedAlertRepository(): DismissedAlertRepository {
-  return new DismissedAlertRepository(
-    createCurrentRepositoryContext(),
-    createCurrentRepositoryWriteHook("dismissed_alert_repository_write"),
-  );
-}
-
 export function createCurrentHostFolderRepository(): HostFolderRepository {
   return new HostFolderRepository(
     createCurrentRepositoryContext(),

src/backend/database/repositories/notification-channel-repository.ts

@@ -1,231 +0,0 @@
-import { and, eq } from "drizzle-orm";
-import { notificationChannels } from "../db/schema.js";
-import { DataCrypto } from "../../utils/data-crypto.js";
-import type { DatabaseContext } from "./database-context.js";
-import { rowsAffected } from "./mutation-result.js";
-import { insertReturning, updateReturning } from "./returning.js";
-
-type NotificationChannelRecord = typeof notificationChannels.$inferSelect;
-
-export interface NotificationChannelRow {
-  id: number;
-  user_id: string;
-  name: string;
-  type: string;
-  config: string;
-  enabled: number;
-  created_at: string;
-}
-
-export class NotificationChannelRepository {
-  constructor(
-    private readonly context: DatabaseContext,
-    private readonly onWrite?: () => void | Promise<void>,
-  ) {}
-
-  /**
-   * Channel configs carry ntfy tokens and webhook auth headers, so they are
-   * field-encrypted like any other secret. The key is derived from the row id,
-   * which does not exist until after the insert, so a new channel is written
-   * once and then re-encrypted in place with its real id.
-   */
-  private userDataKey(userId: string): Buffer | null {
-    try {
-      return DataCrypto.getUserDataKey(userId);
-    } catch {
-      // Crypto is not initialized (tests, early boot); leave the value as is.
-      return null;
-    }
-  }
-
-  private encryptConfig(
-    config: string,
-    userId: string,
-    recordId: number | string,
-  ): string {
-    const userDataKey = this.userDataKey(userId);
-    if (!userDataKey) return config;
-    return DataCrypto.encryptRecord(
-      "notification_channels",
-      { id: recordId, config },
-      userId,
-      userDataKey,
-    ).config;
-  }
-
-  private decryptConfig(
-    config: string,
-    userId: string,
-    recordId: number | string,
-  ): string {
-    const userDataKey = this.userDataKey(userId);
-    if (!userDataKey) return config;
-    try {
-      return DataCrypto.decryptRecord(
-        "notification_channels",
-        { id: recordId, config },
-        userId,
-        userDataKey,
-      ).config;
-    } catch {
-      // Rows written before channel configs were encrypted are still plaintext.
-      return config;
-    }
-  }
-
-  async listNotificationChannels(
-    userId: string,
-  ): Promise<NotificationChannelRow[]> {
-    const rows = await this.context.drizzle
-      .select()
-      .from(notificationChannels)
-      .where(eq(notificationChannels.userId, userId))
-      .orderBy(notificationChannels.id);
-
-    return rows.map((row) => {
-      const mapped = mapChannelRow(row);
-      mapped.config = this.decryptConfig(mapped.config, userId, mapped.id);
-      return mapped;
-    });
-  }
-
-  async findNotificationChannelForUser(
-    id: number,
-    userId: string,
-  ): Promise<NotificationChannelRow | null> {
-    const rows = await this.context.drizzle
-      .select()
-      .from(notificationChannels)
-      .where(
-        and(
-          eq(notificationChannels.id, id),
-          eq(notificationChannels.userId, userId),
-        ),
-      )
-      .limit(1);
-
-    if (!rows[0]) return null;
-    const mapped = mapChannelRow(rows[0]);
-    mapped.config = this.decryptConfig(mapped.config, userId, mapped.id);
-    return mapped;
-  }
-
-  async createNotificationChannel(input: {
-    userId: string;
-    name: string;
-    type: string;
-    config: string;
-    enabled: boolean;
-  }): Promise<NotificationChannelRow> {
-    const [created] = await insertReturning(
-      this.context,
-      notificationChannels,
-      {
-        userId: input.userId,
-        name: input.name,
-        type: input.type,
-        config: input.config,
-        enabled: input.enabled,
-      },
-    );
-
-    const encrypted = this.encryptConfig(
-      input.config,
-      input.userId,
-      created.id,
-    );
-    if (encrypted !== input.config) {
-      await this.context.drizzle
-        .update(notificationChannels)
-        .set({ config: encrypted })
-        .where(eq(notificationChannels.id, created.id));
-    }
-
-    await this.afterWrite();
-    const mapped = mapChannelRow(created);
-    mapped.config = input.config;
-    return mapped;
-  }
-
-  async updateNotificationChannel(
-    id: number,
-    userId: string,
-    input: {
-      name?: string;
-      type?: string;
-      config?: string;
-      enabled?: boolean;
-    },
-  ): Promise<NotificationChannelRow | null> {
-    if (Object.keys(input).length === 0) {
-      return this.findNotificationChannelForUser(id, userId);
-    }
-
-    const values =
-      input.config !== undefined
-        ? { ...input, config: this.encryptConfig(input.config, userId, id) }
-        : input;
-
-    const [updated] = await updateReturning(
-      this.context,
-      notificationChannels,
-      values,
-      and(
-        eq(notificationChannels.id, id),
-        eq(notificationChannels.userId, userId),
-      ),
-    );
-
-    if (!updated) return null;
-    await this.afterWrite();
-    const mapped = mapChannelRow(updated);
-    mapped.config = this.decryptConfig(mapped.config, userId, mapped.id);
-    return mapped;
-  }
-
-  async deleteNotificationChannel(
-    id: number,
-    userId: string,
-  ): Promise<boolean> {
-    const result = await this.context.drizzle
-      .delete(notificationChannels)
-      .where(
-        and(
-          eq(notificationChannels.id, id),
-          eq(notificationChannels.userId, userId),
-        ),
-      );
-
-    if (rowsAffected(result) === 0) return false;
-    await this.afterWrite();
-    return true;
-  }
-
-  async deleteByUserId(userId: string): Promise<{ channelsDeleted: number }> {
-    const result = await this.context.drizzle
-      .delete(notificationChannels)
-      .where(eq(notificationChannels.userId, userId));
-
-    if (rowsAffected(result) > 0) {
-      await this.afterWrite();
-    }
-
-    return { channelsDeleted: rowsAffected(result) };
-  }
-
-  private async afterWrite(): Promise<void> {
-    await this.onWrite?.();
-  }
-}
-
-function mapChannelRow(row: NotificationChannelRecord): NotificationChannelRow {
-  return {
-    id: row.id,
-    user_id: row.userId,
-    name: row.name,
-    type: row.type,
-    config: row.config,
-    enabled: row.enabled ? 1 : 0,
-    created_at: row.createdAt,
-  };
-}

src/backend/database/routes/alerts.ts

@@ -1,282 +0,0 @@
-import { getErrorMessage } from "../../utils/error-message.js";
-import type {
-  AuthenticatedRequest,
-  CacheEntry,
-  TermixAlert,
-} from "../../../types/index.js";
-import express from "express";
-import { authLogger } from "../../utils/logger.js";
-import { AuthManager } from "../../utils/auth-manager.js";
-import { getProxyAgent } from "../../utils/proxy-agent.js";
-import { createCurrentDismissedAlertRepository } from "../repositories/factory.js";
-
-class AlertCache {
-  private cache: Map<string, CacheEntry> = new Map();
-  private readonly CACHE_DURATION = 5 * 60 * 1000;
-
-  set<T>(key: string, data: T): void {
-    const now = Date.now();
-    this.cache.set(key, {
-      data,
-      timestamp: now,
-      expiresAt: now + this.CACHE_DURATION,
-    });
-  }
-
-  get<T>(key: string): T | null {
-    const entry = this.cache.get(key);
-    if (!entry) {
-      return null;
-    }
-
-    if (Date.now() > entry.expiresAt) {
-      this.cache.delete(key);
-      return null;
-    }
-
-    return entry.data as T;
-  }
-}
-
-const alertCache = new AlertCache();
-
-const GITHUB_RAW_BASE = "https://raw.githubusercontent.com";
-const REPO_OWNER = "Termix-SSH";
-const REPO_NAME = "Docs";
-const ALERTS_FILE = "main/termix-alerts.json";
-
-async function fetchAlertsFromGitHub(): Promise<TermixAlert[]> {
-  const cacheKey = "termix_alerts";
-  const cachedData = alertCache.get<TermixAlert[]>(cacheKey);
-  if (cachedData) {
-    return cachedData;
-  }
-  try {
-    const url = `${GITHUB_RAW_BASE}/${REPO_OWNER}/${REPO_NAME}/${ALERTS_FILE}`;
-
-    const response = await fetch(url, {
-      headers: {
-        Accept: "application/json",
-        "User-Agent": "TermixAlertChecker/1.0",
-      },
-      dispatcher: getProxyAgent(url),
-    });
-
-    if (!response.ok) {
-      authLogger.warn("GitHub API returned error status", {
-        operation: "alerts_fetch",
-        status: response.status,
-        statusText: response.statusText,
-      });
-      throw new Error(
-        `GitHub raw content error: ${response.status} ${response.statusText}`,
-      );
-    }
-
-    const alerts: TermixAlert[] = (await response.json()) as TermixAlert[];
-
-    const now = new Date();
-
-    const validAlerts = alerts.filter((alert) => {
-      const expiryDate = new Date(alert.expiresAt);
-      const isValid = expiryDate > now;
-      return isValid;
-    });
-
-    alertCache.set(cacheKey, validAlerts);
-    return validAlerts;
-  } catch (error) {
-    authLogger.error("Failed to fetch alerts from GitHub", {
-      operation: "alerts_fetch",
-      error: getErrorMessage(error),
-    });
-    return [];
-  }
-}
-
-const router = express.Router();
-
-const authManager = AuthManager.getInstance();
-const authenticateJWT = authManager.createAuthMiddleware();
-
-/**
- * @openapi
- * /alerts:
- *   get:
- *     summary: Get active alerts
- *     description: Fetches active alerts for the authenticated user, excluding those that have been dismissed.
- *     tags:
- *      - Alerts
- *     responses:
- *       200:
- *         description: A list of active alerts.
- *       500:
- *         description: Failed to fetch alerts.
- */
-router.get("/", authenticateJWT, async (req, res) => {
-  try {
-    const userId = (req as AuthenticatedRequest).userId;
-
-    const allAlerts = await fetchAlertsFromGitHub();
-
-    const dismissedAlertIds = new Set(
-      await createCurrentDismissedAlertRepository().listAlertIdsByUserId(
-        userId,
-      ),
-    );
-
-    const activeAlertsForUser = allAlerts.filter(
-      (alert) => !dismissedAlertIds.has(alert.id),
-    );
-
-    res.json({
-      alerts: activeAlertsForUser,
-      cached: alertCache.get("termix_alerts") !== null,
-      total_count: activeAlertsForUser.length,
-    });
-  } catch (error) {
-    authLogger.error("Failed to get user alerts", error);
-    res.status(500).json({ error: "Failed to fetch alerts" });
-  }
-});
-
-/**
- * @openapi
- * /alerts/dismiss:
- *   post:
- *     summary: Dismiss an alert
- *     description: Marks an alert as dismissed for the authenticated user.
- *     tags:
- *      - Alerts
- *     requestBody:
- *       required: true
- *       content:
- *         application/json:
- *           schema:
- *             type: object
- *             properties:
- *               alertId:
- *                 type: string
- *     responses:
- *       200:
- *         description: Alert dismissed successfully.
- *       400:
- *         description: Alert ID is required.
- *       409:
- *         description: Alert already dismissed.
- *       500:
- *         description: Failed to dismiss alert.
- */
-router.post("/dismiss", authenticateJWT, async (req, res) => {
-  try {
-    const { alertId } = req.body;
-    const userId = (req as AuthenticatedRequest).userId;
-
-    if (!alertId) {
-      authLogger.warn("Missing alertId in dismiss request", { userId });
-      return res.status(400).json({ error: "Alert ID is required" });
-    }
-
-    const existingDismissal =
-      await createCurrentDismissedAlertRepository().findForUser(
-        userId,
-        alertId,
-      );
-
-    if (existingDismissal) {
-      authLogger.warn(`Alert ${alertId} already dismissed by user ${userId}`);
-      return res.status(409).json({ error: "Alert already dismissed" });
-    }
-
-    await createCurrentDismissedAlertRepository().create(userId, alertId);
-
-    res.json({ message: "Alert dismissed successfully" });
-  } catch (error) {
-    authLogger.error("Failed to dismiss alert", error);
-    res.status(500).json({ error: "Failed to dismiss alert" });
-  }
-});
-
-/**
- * @openapi
- * /alerts/dismissed:
- *   get:
- *     summary: Get dismissed alerts
- *     description: Fetches a list of alerts that have been dismissed by the authenticated user.
- *     tags:
- *      - Alerts
- *     responses:
- *       200:
- *         description: A list of dismissed alerts.
- *       500:
- *         description: Failed to fetch dismissed alerts.
- */
-router.get("/dismissed", authenticateJWT, async (req, res) => {
-  try {
-    const userId = (req as AuthenticatedRequest).userId;
-
-    const dismissedAlertRecords =
-      await createCurrentDismissedAlertRepository().listByUserId(userId);
-
-    res.json({
-      dismissed_alerts: dismissedAlertRecords,
-      total_count: dismissedAlertRecords.length,
-    });
-  } catch (error) {
-    authLogger.error("Failed to get dismissed alerts", error);
-    res.status(500).json({ error: "Failed to fetch dismissed alerts" });
-  }
-});
-
-/**
- * @openapi
- * /alerts/dismiss:
- *   delete:
- *     summary: Undismiss an alert
- *     description: Removes an alert from the dismissed list for the authenticated user.
- *     tags:
- *      - Alerts
- *     requestBody:
- *       required: true
- *       content:
- *         application/json:
- *           schema:
- *             type: object
- *             properties:
- *               alertId:
- *                 type: string
- *     responses:
- *       200:
- *         description: Alert undismissed successfully.
- *       400:
- *         description: Alert ID is required.
- *       404:
- *         description: Dismissed alert not found.
- *       500:
- *         description: Failed to undismiss alert.
- */
-router.delete("/dismiss", authenticateJWT, async (req, res) => {
-  try {
-    const { alertId } = req.body;
-    const userId = (req as AuthenticatedRequest).userId;
-
-    if (!alertId) {
-      return res.status(400).json({ error: "Alert ID is required" });
-    }
-
-    const deleted = await createCurrentDismissedAlertRepository().deleteForUser(
-      userId,
-      alertId,
-    );
-
-    if (!deleted) {
-      return res.status(404).json({ error: "Dismissed alert not found" });
-    }
-    res.json({ message: "Alert undismissed successfully" });
-  } catch (error) {
-    authLogger.error("Failed to undismiss alert", error);
-    res.status(500).json({ error: "Failed to undismiss alert" });
-  }
-});
-
-export default router;

src/backend/database/routes/delete-user-data.ts

@@ -1,10 +1,8 @@
 import { authLogger } from "../../utils/logger.js";
 import {
-  createCurrentNotificationChannelRepository,
   createCurrentApiKeyRepository,
   createCurrentAuditLogRepository,
   createCurrentCredentialRepository,
-  createCurrentDismissedAlertRepository,
   createCurrentHostFolderRepository,
   createCurrentHostRepository,
   createCurrentHostSidebarPreferenceRepository,
@@ -62,13 +60,11 @@ export async function deleteUserAndRelatedData(
     await createCurrentTrustedDeviceRepository().deleteByUserId(userId);
 
     await createCurrentRoleRepository().removeAllRolesFromUser(userId);
-    await createCurrentNotificationChannelRepository().deleteByUserId(userId);
     await createCurrentAuditLogRepository().anonymizeByUserId(userId);
 
     await createCurrentSshCredentialUsageRepository().deleteByUserId(userId);
 
     await createCurrentRecentActivityRepository().deleteByUserId(userId);
-    await createCurrentDismissedAlertRepository().deleteByUserId(userId);
 
     await createCurrentHostFolderRepository().deleteByUserId(userId);
 

src/backend/database/routes/notification-channels-routes.ts

@@ -1,245 +0,0 @@
-import express, { type Request, type Response } from "express";
-import type { AuthenticatedRequest } from "../../../types/index.js";
-import { createCurrentNotificationChannelRepository } from "../repositories/factory.js";
-import { AuthManager } from "../../utils/auth-manager.js";
-import { databaseLogger } from "../../utils/logger.js";
-import { deliverNotification } from "../../utils/notification-sender.js";
-
-const router = express.Router();
-const authManager = AuthManager.getInstance();
-const authenticateJWT = authManager.createAuthMiddleware();
-
-router.use(authenticateJWT);
-
-/**
- * @openapi
- * /notification-channels:
- *   get:
- *     summary: List notification channels for the current user
- *     tags:
- *       - Notifications
- *     responses:
- *       200:
- *         description: List of notification channels.
- */
-router.get("/notification-channels", async (req, res) => {
-  const userId = (req as AuthenticatedRequest).userId;
-  try {
-    const rows =
-      await createCurrentNotificationChannelRepository().listNotificationChannels(
-        userId,
-      );
-    res.json(rows);
-  } catch (err) {
-    databaseLogger.error("Failed to list notification channels", {
-      operation: "list_channels",
-      error: err,
-    });
-    res.status(500).json({ error: "Failed to list channels" });
-  }
-});
-
-/**
- * @openapi
- * /notification-channels:
- *   post:
- *     summary: Create a notification channel
- *     tags:
- *       - Notifications
- */
-router.post("/notification-channels", async (req, res) => {
-  const userId = (req as AuthenticatedRequest).userId;
-  const { name, type, config, enabled } = req.body as {
-    name: string;
-    type: string;
-    config: unknown;
-    enabled?: boolean;
-  };
-
-  if (!name || typeof name !== "string" || !name.trim()) {
-    return res.status(400).json({ error: "name is required" });
-  }
-  if (type !== "webhook" && type !== "ntfy" && type !== "discord") {
-    return res
-      .status(400)
-      .json({ error: "type must be 'webhook', 'ntfy' or 'discord'" });
-  }
-  if (!config || typeof config !== "object") {
-    return res.status(400).json({ error: "config is required" });
-  }
-  if (type === "ntfy") {
-    const c = config as Record<string, unknown>;
-    if (!c.url || typeof c.url !== "string")
-      return res.status(400).json({ error: "ntfy config requires url" });
-    if (!c.topic || typeof c.topic !== "string")
-      return res.status(400).json({ error: "ntfy config requires topic" });
-  }
-  if (type === "webhook") {
-    const c = config as Record<string, unknown>;
-    if (!c.url || typeof c.url !== "string")
-      return res.status(400).json({ error: "webhook config requires url" });
-  }
-  if (type === "discord") {
-    const c = config as Record<string, unknown>;
-    if (!c.url || typeof c.url !== "string")
-      return res.status(400).json({ error: "discord config requires url" });
-    if (
-      !/^https:\/\/(?:canary\.|ptb\.)?(?:discord\.com|discordapp\.com)\/api\/webhooks\/.+/i.test(
-        c.url,
-      )
-    ) {
-      return res.status(400).json({
-        error:
-          "discord config requires a valid Discord webhook URL (https://discord.com/api/webhooks/...)",
-      });
-    }
-  }
-
-  try {
-    const row =
-      await createCurrentNotificationChannelRepository().createNotificationChannel(
-        {
-          userId,
-          name: name.trim(),
-          type,
-          config: JSON.stringify(config),
-          enabled: enabled !== false,
-        },
-      );
-    res.status(201).json(row);
-  } catch (err) {
-    databaseLogger.error("Failed to create notification channel", {
-      operation: "create_channel",
-      error: err,
-    });
-    res.status(500).json({ error: "Failed to create channel" });
-  }
-});
-
-/**
- * @openapi
- * /notification-channels/{id}:
- *   put:
- *     summary: Update a notification channel
- *     tags:
- *       - Notifications
- */
-router.put(
-  "/notification-channels/:id",
-  async (req: Request, res: Response) => {
-    const userId = (req as AuthenticatedRequest).userId;
-    const channelId = Number(req.params.id);
-    const { name, type, config, enabled } = req.body as {
-      name?: string;
-      type?: string;
-      config?: unknown;
-      enabled?: boolean;
-    };
-
-    const repository = createCurrentNotificationChannelRepository();
-    const existing = await repository.findNotificationChannelForUser(
-      channelId,
-      userId,
-    );
-    if (!existing) return res.status(404).json({ error: "Channel not found" });
-
-    if (type && type !== "webhook" && type !== "ntfy" && type !== "discord") {
-      return res
-        .status(400)
-        .json({ error: "type must be 'webhook', 'ntfy' or 'discord'" });
-    }
-    if (
-      name === undefined &&
-      type === undefined &&
-      config === undefined &&
-      enabled === undefined
-    ) {
-      return res.json({ success: true });
-    }
-
-    try {
-      const row = await repository.updateNotificationChannel(
-        channelId,
-        userId,
-        {
-          ...(name !== undefined ? { name: name.trim() } : {}),
-          ...(type !== undefined ? { type } : {}),
-          ...(config !== undefined ? { config: JSON.stringify(config) } : {}),
-          ...(enabled !== undefined ? { enabled } : {}),
-        },
-      );
-      if (!row) return res.status(404).json({ error: "Channel not found" });
-      res.json(row);
-    } catch (err) {
-      databaseLogger.error("Failed to update notification channel", {
-        operation: "update_channel",
-        error: err,
-      });
-      res.status(500).json({ error: "Failed to update channel" });
-    }
-  },
-);
-
-/**
- * @openapi
- * /notification-channels/{id}:
- *   delete:
- *     summary: Delete a notification channel
- *     tags:
- *       - Notifications
- */
-router.delete(
-  "/notification-channels/:id",
-  async (req: Request, res: Response) => {
-    const userId = (req as AuthenticatedRequest).userId;
-    const channelId = Number(req.params.id);
-    const deleted =
-      await createCurrentNotificationChannelRepository().deleteNotificationChannel(
-        channelId,
-        userId,
-      );
-    if (!deleted) return res.status(404).json({ error: "Channel not found" });
-    res.json({ success: true });
-  },
-);
-
-/**
- * @openapi
- * /notification-channels/{id}/test:
- *   post:
- *     summary: Send a test notification
- *     tags:
- *       - Notifications
- */
-router.post(
-  "/notification-channels/:id/test",
-  async (req: Request, res: Response) => {
-    const userId = (req as AuthenticatedRequest).userId;
-    const channelId = Number(req.params.id);
-    const row =
-      await createCurrentNotificationChannelRepository().findNotificationChannelForUser(
-        channelId,
-        userId,
-      );
-    if (!row) return res.status(404).json({ error: "Channel not found" });
-
-    try {
-      // The same path an automation's notify step takes, so a test proves
-      // the channel works for real, private-network opt-in included.
-      await deliverNotification(row, {
-        title: "Termix",
-        body: "This is a test notification from Termix",
-        severity: "info",
-        context: { sourceName: "Test", triggerType: "test" },
-      });
-      res.json({ success: true });
-    } catch (err) {
-      res.json({
-        success: false,
-        error: err instanceof Error ? err.message : String(err),
-      });
-    }
-  },
-);
-
-export default router;

src/backend/database/routes/user-password-reset-routes.ts

@@ -7,7 +7,6 @@ import { authLogger } from "../../utils/logger.js";
 import { loginRateLimiter } from "../../utils/login-rate-limiter.js";
 import {
   createCurrentCredentialRepository,
-  createCurrentDismissedAlertRepository,
   createCurrentHostRepository,
   createCurrentRecentActivityRepository,
   createCurrentSettingsRepository,
@@ -70,7 +69,6 @@ export async function resetUserPassword(
 
   await createCurrentSshCredentialUsageRepository().deleteByUserId(userId);
   await createCurrentRecentActivityRepository().deleteByUserId(userId);
-  await createCurrentDismissedAlertRepository().deleteByUserId(userId);
   await createCurrentHostRepository().deleteByUserId(userId);
   await createCurrentCredentialRepository().deleteByUserId(userId);
   // A plugin holding this user's data (snippets and anything else keyed by