feat: saved posts and major product gap fixes

CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to VouchNet are documented here. This project follows
 
 ## Unreleased
 
+### Saved posts and notification inbox
+
+- Added saved posts as a real vertical slice: migration `0040_saved_posts`, `/api/saved`, feed Save
+  controls, and a private `/saved` page that re-checks visibility and block rules on every read.
+- Added mark-all-as-read for member notifications at `/api/notifications/read-all`.
+- Updated the implementation matrix and authenticated-app docs so messaging and saved content are
+  no longer described as missing stubs.
+
 ## 1.5.0 - 2026-10-28
 
 ### Desktop signal desk

apps/web/app/api/notifications/read-all/route.ts

@@ -0,0 +1,17 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { markAllMemberNotificationsRead } from '../../../lib/daily-strategy';
+import { actorFromRequest } from '../../../lib/identity';
+import { hasSameOrigin } from '../../../lib/request-security';
+
+export async function POST(request: NextRequest) {
+  if (!hasSameOrigin(request))
+    return NextResponse.json({ error: 'CSRF_REJECTED' }, { status: 403 });
+  try {
+    const actor = await actorFromRequest(request);
+    if (actor === null) return NextResponse.json({ error: 'UNAUTHENTICATED' }, { status: 401 });
+    const updated = await markAllMemberNotificationsRead(actor.userId);
+    return NextResponse.json({ updated });
+  } catch {
+    return NextResponse.json({ error: 'NOTIFICATIONS_UNAVAILABLE' }, { status: 503 });
+  }
+}

apps/web/app/api/saved/[postId]/route.ts

@@ -0,0 +1,28 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { actorFromRequest } from '../../../lib/identity';
+import { hasSameOrigin } from '../../../lib/request-security';
+import { unsavePost } from '../../../lib/saved-posts';
+import { enforceRateLimit } from '../../../lib/security/rate-limit';
+import { rateLimitResponse } from '../../../lib/security/rate-limit-response';
+
+export async function DELETE(
+  request: NextRequest,
+  context: { params: Promise<{ postId: string }> },
+) {
+  if (!hasSameOrigin(request))
+    return NextResponse.json({ error: 'CSRF_REJECTED' }, { status: 403 });
+  try {
+    const actor = await actorFromRequest(request);
+    if (actor === null) return NextResponse.json({ error: 'UNAUTHENTICATED' }, { status: 401 });
+    const rateLimit = await enforceRateLimit(request, 'socialWrite', actor.userId);
+    if (!rateLimit.allowed) return rateLimitResponse(rateLimit);
+    const { postId } = await context.params;
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(postId)) {
+      return NextResponse.json({ error: 'INVALID_POST' }, { status: 400 });
+    }
+    const removed = await unsavePost(actor.userId, postId);
+    return NextResponse.json({ saved: false, removed });
+  } catch {
+    return NextResponse.json({ error: 'UNSAVE_FAILED' }, { status: 400 });
+  }
+}

apps/web/app/api/saved/route.test.ts

@@ -0,0 +1,120 @@
+import { NextRequest } from 'next/server';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { GET, POST } from './route';
+
+const state = vi.hoisted(() => ({
+  actor: { userId: 'user-1' } as { userId: string } | null,
+  posts: [] as Array<{
+    id: string;
+    authorId: string;
+    authorName: string;
+    authorSlug: string;
+    authorHeadline: string | null;
+    bodyMarkdown: string;
+    category: string;
+    createdAt: Date;
+    savedAt: Date;
+    peerSignal: number;
+    commentCount: number;
+  }>,
+  saveResult: 'saved' as 'saved' | 'unchanged',
+  fail: false,
+  allowed: true,
+}));
+
+vi.mock('../../lib/identity', () => ({
+  actorFromRequest: async () => state.actor,
+}));
+
+vi.mock('../../lib/request-security', () => ({
+  hasSameOrigin: () => true,
+}));
+
+vi.mock('../../lib/security/rate-limit', () => ({
+  enforceRateLimit: async () => ({ allowed: state.allowed, retryAfterSeconds: 60 }),
+}));
+
+vi.mock('../../lib/security/rate-limit-response', () => ({
+  rateLimitResponse: () => new Response(JSON.stringify({ error: 'RATE_LIMITED' }), { status: 429 }),
+}));
+
+vi.mock('../../lib/saved-posts', () => ({
+  listSavedPosts: async () => {
+    if (state.fail) throw new Error('DATABASE_UNAVAILABLE');
+    return state.posts;
+  },
+  savePost: async () => {
+    if (state.fail) throw new Error('DATABASE_UNAVAILABLE');
+    return state.saveResult;
+  },
+}));
+
+describe('saved posts API', () => {
+  beforeEach(() => {
+    state.actor = { userId: 'user-1' };
+    state.fail = false;
+    state.allowed = true;
+    state.saveResult = 'saved';
+    state.posts = [
+      {
+        id: '11111111-1111-4111-8111-111111111111',
+        authorId: 'user-2',
+        authorName: 'Ada Example',
+        authorSlug: 'ada',
+        authorHeadline: 'Builder',
+        bodyMarkdown: 'Useful note',
+        category: 'TECHNICAL',
+        createdAt: new Date('2026-10-28T12:00:00.000Z'),
+        savedAt: new Date('2026-10-28T13:00:00.000Z'),
+        peerSignal: 2,
+        commentCount: 1,
+      },
+    ];
+  });
+
+  it('lists saved posts with ISO timestamps', async () => {
+    const response = await GET(new NextRequest('https://vouchnet.dev/api/saved'));
+    expect(response.status).toBe(200);
+    expect(await response.json()).toEqual({
+      posts: [
+        {
+          id: '11111111-1111-4111-8111-111111111111',
+          authorId: 'user-2',
+          authorName: 'Ada Example',
+          authorSlug: 'ada',
+          authorHeadline: 'Builder',
+          bodyMarkdown: 'Useful note',
+          category: 'TECHNICAL',
+          createdAt: '2026-10-28T12:00:00.000Z',
+          savedAt: '2026-10-28T13:00:00.000Z',
+          peerSignal: 2,
+          commentCount: 1,
+        },
+      ],
+    });
+  });
+
+  it('requires authentication to save', async () => {
+    state.actor = null;
+    const response = await POST(
+      new NextRequest('https://vouchnet.dev/api/saved', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', origin: 'https://vouchnet.dev' },
+        body: JSON.stringify({ postId: '11111111-1111-4111-8111-111111111111' }),
+      }),
+    );
+    expect(response.status).toBe(401);
+  });
+
+  it('saves a visible post id', async () => {
+    const response = await POST(
+      new NextRequest('https://vouchnet.dev/api/saved', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', origin: 'https://vouchnet.dev' },
+        body: JSON.stringify({ postId: '11111111-1111-4111-8111-111111111111' }),
+      }),
+    );
+    expect(response.status).toBe(200);
+    expect(await response.json()).toEqual({ saved: true, result: 'saved' });
+  });
+});

apps/web/app/api/saved/route.ts

@@ -0,0 +1,50 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { z } from 'zod';
+import { actorFromRequest } from '../../lib/identity';
+import { hasSameOrigin } from '../../lib/request-security';
+import { listSavedPosts, savePost } from '../../lib/saved-posts';
+import { enforceRateLimit } from '../../lib/security/rate-limit';
+import { rateLimitResponse } from '../../lib/security/rate-limit-response';
+
+const saveSchema = z
+  .object({
+    postId: z.string().uuid(),
+  })
+  .strict();
+
+export async function GET(request: NextRequest) {
+  try {
+    const actor = await actorFromRequest(request);
+    if (actor === null) return NextResponse.json({ error: 'UNAUTHENTICATED' }, { status: 401 });
+    const posts = await listSavedPosts(actor.userId);
+    return NextResponse.json({
+      posts: posts.map((post) => ({
+        ...post,
+        createdAt: post.createdAt.toISOString(),
+        savedAt: post.savedAt.toISOString(),
+      })),
+    });
+  } catch {
+    return NextResponse.json({ error: 'SAVED_UNAVAILABLE' }, { status: 503 });
+  }
+}
+
+export async function POST(request: NextRequest) {
+  if (!hasSameOrigin(request))
+    return NextResponse.json({ error: 'CSRF_REJECTED' }, { status: 403 });
+  try {
+    const actor = await actorFromRequest(request);
+    if (actor === null) return NextResponse.json({ error: 'UNAUTHENTICATED' }, { status: 401 });
+    const rateLimit = await enforceRateLimit(request, 'socialWrite', actor.userId);
+    if (!rateLimit.allowed) return rateLimitResponse(rateLimit);
+    const body = saveSchema.parse(await request.json());
+    const result = await savePost(actor.userId, body.postId);
+    return NextResponse.json({ saved: true, result });
+  } catch (error) {
+    if (error instanceof z.ZodError)
+      return NextResponse.json({ error: 'INVALID_SAVE' }, { status: 400 });
+    if (error instanceof Error && error.message === 'POST_NOT_FOUND')
+      return NextResponse.json({ error: 'POST_NOT_FOUND' }, { status: 404 });
+    return NextResponse.json({ error: 'SAVE_FAILED' }, { status: 400 });
+  }
+}

apps/web/app/globals.css

@@ -2092,6 +2092,109 @@ button:not([class]):hover {
   gap: 10px;
   align-items: center;
 }
+.post-header > div:nth-child(2) {
+  flex: 1;
+  min-width: 0;
+}
+.post-save-control {
+  flex: 0 0 auto;
+  min-height: 34px;
+  margin-left: auto;
+  padding: 0 12px;
+  border: 1px solid var(--line);
+  border-radius: 10px;
+  color: var(--ink);
+  background: var(--surface);
+  font-size: 0.74rem;
+  font-weight: 760;
+}
+.post-save-control:hover,
+.post-save-control:focus-visible {
+  border-color: color-mix(in srgb, var(--accent) 55%, var(--line));
+  outline: 2px solid color-mix(in srgb, var(--accent) 35%, transparent);
+  outline-offset: 1px;
+}
+.post-save-control.is-saved {
+  border-color: color-mix(in srgb, var(--accent) 45%, var(--line));
+  color: var(--accent-strong, var(--accent));
+  background: var(--accent-soft, #e8efff);
+}
+.saved-page {
+  display: grid;
+  gap: 18px;
+  max-width: 760px;
+}
+.saved-heading h1 {
+  margin: 8px 0 8px;
+  letter-spacing: -0.04em;
+}
+.saved-heading p {
+  margin: 0;
+  color: var(--muted);
+  line-height: 1.55;
+}
+.saved-empty,
+.saved-loading {
+  padding: 28px;
+  border: 1px solid var(--line);
+  border-radius: 14px;
+  background: var(--surface);
+}
+.saved-empty h2 {
+  margin: 0 0 8px;
+}
+.saved-empty p {
+  margin: 0 0 16px;
+  color: var(--muted);
+}
+.saved-list {
+  display: grid;
+  gap: 12px;
+}
+.saved-card {
+  padding: 16px;
+  border: 1px solid var(--line);
+  border-radius: 14px;
+  background: var(--surface);
+}
+.saved-card header {
+  display: flex;
+  gap: 12px;
+  align-items: flex-start;
+  justify-content: space-between;
+}
+.saved-card header a {
+  color: var(--ink);
+  font-weight: 800;
+  text-decoration: none;
+}
+.saved-card header p,
+.saved-card header time {
+  display: block;
+  margin: 3px 0 0;
+  color: var(--muted);
+  font-size: 0.76rem;
+}
+.saved-card > p {
+  margin: 14px 0;
+  white-space: pre-wrap;
+  line-height: 1.55;
+}
+.saved-card footer {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+  padding-top: 12px;
+  border-top: 1px solid var(--line);
+  color: var(--muted);
+  font-size: 0.76rem;
+}
+.saved-card footer a {
+  color: var(--accent-strong, var(--accent));
+  font-weight: 760;
+  text-decoration: none;
+}
 .post-avatar {
   display: grid;
   width: 40px;
@@ -3756,6 +3859,19 @@ button.signal-cell:focus-visible {
   color: #66758c;
 }
 
+.notification-inbox-toolbar {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+  margin-bottom: 14px;
+}
+.notification-inbox-toolbar p {
+  margin: 0;
+  color: var(--muted);
+  font-size: 0.8rem;
+  font-weight: 700;
+}
 .notification-inbox {
   overflow: hidden;
 }

apps/web/app/lib/daily-strategy.ts

@@ -188,3 +188,17 @@ export async function markMemberNotificationRead(
     await sql.end({ timeout: 1 });
   }
 }
+
+export async function markAllMemberNotificationsRead(userId: string): Promise<number> {
+  const sql = createSqlClient(databaseUrl());
+  try {
+    const rows = await sql<{ id: string }[]>`
+      UPDATE member_notifications SET read_at=now()
+      WHERE user_id=${userId} AND read_at IS NULL
+      RETURNING id
+    `;
+    return rows.length;
+  } finally {
+    await sql.end({ timeout: 1 });
+  }
+}