3 files changed, 106 insertions, 4 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/groups.py b/packages/meshbay-hub/src/meshbay_hub/api/groups.py
index 000f3f7..43d72c3 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/groups.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/groups.py
@@ -33,12 +33,17 @@ async def my_groups(
         .order_by(Group.name)
     )
     groups = result.scalars().all()
+    muted_rows = await db.execute(
+        select(GroupMember.group_id, GroupMember.muted)
+        .where(GroupMember.user_id == current_user.id))
+    muted_map = {gid: bool(m) for gid, m in muted_rows.all()}
     return {
         "groups": [
             {
                 "id": g.id,
                 "name": g.name,
                 "visibility": g.visibility,
+                "muted": muted_map.get(g.id, False),
                 "join_policy": g.join_policy,
                 "created_at": g.created_at.isoformat(),
                 "is_admin": g.admin_id == current_user.id,
@@ -301,12 +306,39 @@ async def add_group_member(
             db, target.id, "group_invite",
             f"You were added to {group.name}",
             link=f"#/group/{group_id}",
+            group_id=group_id,
         )
 
     await db.commit()
     return {"status": "stored", "group_id": group_id, "username": username}
 
 
+class MuteRequest(BaseModel):
+    muted: bool
+
+
+@router.post("/{group_id}/mute")
+async def set_group_mute(
+    group_id: str,
+    body: MuteRequest,
+    current_user: User = Depends(require_user_scope),
+    db: AsyncSession = Depends(get_db),
+):
+    """
+    Turn this group's notifications on or off, for this account.
+
+    Server-side on purpose: it used to be a checkbox in the browser's
+    localStorage that nothing ever read, so turning notifications off for a group
+    had no effect anywhere. Now nothing is created in the first place.
+    """
+    membership = await db.get(GroupMember, (group_id, current_user.id))
+    if not membership:
+        raise HTTPException(status_code=404, detail="Not a member of this group")
+    membership.muted = body.muted
+    await db.commit()
+    return {"status": "ok", "group_id": group_id, "muted": body.muted}
+
+
 @router.delete("/{group_id}")
 async def delete_group(
     group_id: str,
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/notifications.py b/packages/meshbay-hub/src/meshbay_hub/api/notifications.py
index e7d36d2..ca56620 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/notifications.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/notifications.py
@@ -1,12 +1,14 @@
 """Notification endpoints — /v1/notifications/*"""
 
 from fastapi import APIRouter, Depends, HTTPException
-from sqlalchemy import select, func, update
+from datetime import datetime, timezone
+
+from sqlalchemy import delete, func, select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from meshbay_hub.api.deps import get_current_user
 from meshbay_hub.db.engine import get_db
-from meshbay_hub.db.models import Notification, User
+from meshbay_hub.db.models import GroupMember, Notification, User
 
 router = APIRouter(prefix="/v1/notifications", tags=["notifications"])
 
@@ -40,6 +42,7 @@ async def list_notifications(
                 "title": n.title,
                 "detail": n.detail,
                 "link": n.link,
+                "group_id": n.group_id,
                 "read": n.read,
                 "created_at": n.created_at.isoformat(),
             }
@@ -63,6 +66,24 @@ async def mark_read(
     return {"status": "ok"}
 
 
+@router.delete("")
+async def purge_notifications(
+    current_user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    """
+    Throw them all away.
+
+    These are signals, not a record: the group is still there, the message is
+    still in the chat, the invitation is still an invitation. Nothing is lost by
+    clearing the list, so it clears rather than marking a hundred rows read.
+    """
+    result = await db.execute(
+        delete(Notification).where(Notification.user_id == current_user.id))
+    await db.commit()
+    return {"status": "ok", "removed": result.rowcount}
+
+
 @router.post("/read-all")
 async def mark_all_read(
     current_user: User = Depends(get_current_user),
@@ -84,9 +105,50 @@ async def create_notification(
     title: str,
     detail: str | None = None,
     link: str | None = None,
-) -> Notification:
+    group_id: str | None = None,
+    aggregate: bool = False,
+) -> Notification | None:
+    """
+    Create a notification, or refresh the one already standing for this group.
+
+    `aggregate` is for anything that repeats — chat, above all. One row per
+    (person, kind, group) whose date moves and whose read flag clears, so a busy
+    conversation is a single line saying when it last spoke rather than forty
+    saying that it spoke.
+
+    Returns None when the person muted this group: the point of muting is that
+    nothing is created, not that something is created and hidden.
+    """
+    if group_id is not None:
+        muted = await db.execute(
+            select(GroupMember.muted).where(
+                GroupMember.group_id == group_id,
+                GroupMember.user_id == user_id,
+            )
+        )
+        if muted.scalar() is True:
+            return None
+
+    if aggregate and group_id is not None:
+        existing = (await db.execute(
+            select(Notification).where(
+                Notification.user_id == user_id,
+                Notification.kind == kind,
+                Notification.group_id == group_id,
+            ).order_by(Notification.created_at.desc()).limit(1)
+        )).scalar_one_or_none()
+        if existing is not None:
+            existing.title = title
+            existing.detail = detail
+            existing.link = link
+            existing.read = False
+            existing.created_at = datetime.now(timezone.utc)
+            await db.flush()
+            return existing
+
     notif = Notification(
         user_id=user_id, kind=kind, title=title, detail=detail, link=link,
+        group_id=group_id,
     )
     db.add(notif)
     await db.flush()
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
index 2e3323c..58ebf50 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
@@ -122,6 +122,9 @@ async def _handle_chat_notify(group_id: str, sender_name: str, sender_user_id: s
                     db, uid, "chat_message",
                     f"{sender_name or 'Someone'} posted in {group.name}",
                     link=f"#/group/{group_id}",
+                    group_id=group_id,
+                    # One line per conversation, moved to when it last spoke.
+                    aggregate=True,
                 )
             await db.commit()
     except Exception as e:
@@ -250,7 +253,12 @@ async def node_websocket(ws: WebSocket):
                 asyncio.ensure_future(_handle_chat_notify(
                     msg.get("group_id", ""),
                     msg.get("sender_name", ""),
-                    decoded.get("sub", ""),
+                    # The author, as the node authenticated them — not
+                    # decoded["sub"], which is the machine's own account and
+                    # made this filter miss everyone except the operator. A node
+                    # that lied here could only suppress one notification, which
+                    # is the same power it has by not sending the message at all.
+                    msg.get("sender_user_id", ""),
                 ))
 
     except WebSocketDisconnect: