medium priority low complexity backend pending backend specialist Tier 2

Acceptance Criteria

Service class `CourseEnrollmentPromptService` is defined in a Deno TypeScript module with a single exported factory/constructor and a public method `buildPrompt(mentorId: string, certType: string): Promise<EnrollmentPromptPayload>`
The `EnrollmentPromptPayload` interface contains at minimum: `mentorId`, `certType`, `enrollmentUrl`, `deepLinkScheme`, `mentorDisplayName`, and `issuedAt` (ISO 8601 timestamp) fields — all typed and non-optional
The service fetches mentor identity (display name, organisation) from Supabase using the provided `mentorId` and the service-role client; a missing mentor throws a typed `MentorNotFoundError`
Unsupported `certType` values not present in the `certification` entity's `cert_type` enum cause the method to throw a typed `UnknownCertTypeError` rather than silently proceeding
The returned payload's `deepLinkScheme` matches the application's registered deep-link prefix (e.g. `likeperson://`), and the `enrollmentUrl` field is a non-empty string placeholder pending task-012 implementation
All exported types and the service class are re-exported from the module's index barrel so downstream consumers import from a single entry point
Unit tests cover: successful payload construction, mentor-not-found error, unknown cert type error, and correct timestamp format

Technical Requirements

frameworks
Deno (Supabase Edge Function runtime)
Supabase Edge Functions TypeScript
apis
Supabase service-role REST/SDK for mentor identity lookup
data models
certification (cert_type enum, peer_mentor_id, issued_at)
contact (first_name, last_name, organisation context for mentor identity)
performance requirements
Single Supabase query to resolve mentor identity — no N+1 patterns
Method must resolve in under 300 ms excluding network latency
security requirements
Service-role Supabase client used only inside Edge Function environment — never exposed to mobile clients
Mentor PII (name) included in payload only for notification personalisation — payload must not be logged in full
Input `mentorId` validated as UUID format before database query to prevent injection

Execution Context

Execution Tier
Tier 2

Tier 2 - 518 tasks

Can start after Tier 1 completes

Implementation Notes

Implement as a plain TypeScript class (not a singleton) so the Supabase client can be injected in tests. Place the module at `supabase/functions/_shared/course-enrollment-prompt-service.ts` so it can be imported by multiple edge functions without duplication. Define `EnrollmentPromptPayload` and the two error classes in a co-located `types.ts` file. The `enrollmentUrl` field should initially be populated with a clearly marked placeholder string (`TODO:task-012`) so downstream consumers that depend on task-011 can integrate without waiting for URL generation logic.

The deep-link prefix should be read from a Deno environment variable (`APP_DEEP_LINK_SCHEME`) so it is configurable per environment.

Testing Requirements

Unit tests using Deno's built-in test runner (`Deno.test`). Test file at `functions/course-enrollment-prompt-service/service.test.ts`. Required scenarios: (1) happy-path returns fully populated `EnrollmentPromptPayload` with correct shape; (2) unknown `mentorId` throws `MentorNotFoundError` with the provided ID in the message; (3) unrecognised `certType` string throws `UnknownCertTypeError`; (4) `issuedAt` field is a valid ISO 8601 string. Mock the Supabase client via dependency injection to avoid live DB calls.

Target 100% branch coverage on the service module.

Component
Course Enrollment Prompt Service
service low
Epic Risks (4)
high impact medium prob technical

If the daily edge function runs more than once in a 24-hour window due to a Supabase scheduling anomaly or manual re-trigger, the orchestrator could dispatch duplicate push notifications to the same mentor and coordinator for the same threshold, eroding user trust.

Mitigation & Contingency

Mitigation: Implement idempotency at the notification record level using a unique constraint on (mentor_id, threshold_days, certification_id). The orchestrator checks for an existing record before dispatching. Use a database-level upsert with ON CONFLICT DO NOTHING.

Contingency: If duplicate notifications are reported in production, add a rate-limiting guard in the edge function that aborts if a notification for the same mentor and threshold was created within the last 20 hours, and add an alerting rule to Supabase logs for duplicate dispatch attempts.

medium impact medium prob scope

The mentor visibility suppressor relies on the daily edge function to detect expiry and update suppression_status. A mentor whose certificate expires at midnight may remain visible for up to 24 hours if the cron runs at a fixed time, violating HLF's requirement that expired mentors disappear promptly.

Mitigation & Contingency

Mitigation: Schedule the edge function to run at 00:05 UTC to minimise lag after midnight transitions. Additionally, the RLS policy can include a direct date comparison (certification_expiry_date < now()) as a secondary predicate that does not rely on suppression_status, providing real-time enforcement at the database level.

Contingency: If the cron lag is unacceptable after launch, implement a Supabase database trigger on the certifications table that fires on UPDATE of expiry_date and calls the suppressor immediately, reducing lag to near-zero for renewal and expiry events.

medium impact low prob integration

The orchestrator needs to resolve the coordinator assigned to a specific peer mentor to dispatch coordinator-side notifications. If the assignment relationship is not normalised or is missing for some mentors, coordinator notifications will silently fail.

Mitigation & Contingency

Mitigation: Query the coordinator assignment from the existing assignments or user_roles table before dispatch. Log a structured warning (missing_coordinator_assignment: mentor_id) when no coordinator is found. Add a data quality check in the edge function that reports mentors without coordinators.

Contingency: If coordinator assignments are missing at scale, fall back to notifying the chapter-level admin role for the mentor's chapter, and surface a data quality report to the admin dashboard showing mentors without assigned coordinators.

medium impact low prob dependency

The course enrollment prompt service generates deep-link URLs targeting the course administration feature. If the course administration feature changes its deep-link schema or the Dynamics portal URL structure changes, enrollment prompts will navigate to broken destinations.

Mitigation & Contingency

Mitigation: Define the deep-link contract between the certificate expiry feature and the course administration feature as a shared constant in a cross-feature navigation config. Version the deep-link schema and validate the generated URL format in unit tests.

Contingency: If the deep-link breaks in production, the course enrollment prompt service should gracefully fall back to opening the course administration feature root screen with a query parameter indicating the notification context, allowing the user to manually locate the correct course.