Parent Notifications (Education)

Paid pluginsize Mplanned, not built

Indicative price, not an offer: €24/mo; SMS, email, push; integration with attendance/grades

Generated from docs/plan/paid/parent-notifications/PLAN.md in the AstroBaaS repository. Nothing described below is implemented — it is the written plan for it.

SMS, email, and push notifications for parents on urgent school alerts. Admin composes bulk notifications to class/grade level. Parents opt in/out per channel. Twilio SMS integration with consent tracking. Firebase push notifications. Replaces manual email chains and ensures urgent announcements (closure, illness, emergency) reach parents fast.

The problem

Parents miss email announcements. Teachers resort to group texts or phone trees. Urgent alerts (school closure, illness outbreak, emergency) fail to reach all parents reliably. Reminder apps like Remind are $20-80/mo per school and require separate account setup.

What it does

• SMS notifications via Twilio with consent tracking (SMS opt-in is legal requirement)
• Email notifications (keep existing)
• Push notifications via Firebase Cloud Messaging
• Admin bulk send to class/grade/all
• Opt-in/opt-out per channel (email/SMS/push)
• Notification templates (school can customize subject/body)
• Scheduled sends (send at specific time, not immediately)
• Delivery status tracking (sent/failed/bounced per recipient)
• SMS consent audit (timestamp + IP for compliance)

What it deliberately does NOT do

Each boundary carries its reason. A boundary without a reason gets crossed by the next person who reads this.

• SMS credit provisioning — merchant pays Twilio directly; we pass through the cost. Reason: billing complexity; no margin on SMS credits.
• Multi-language translation — localization adds support burden; merchant must manage translations. Reason: per-language QA needed.
• Two-factor auth SMS — outside scope of announcements. Reason: authentication is different system.

Data model

New tables: notification_preferences (parentId, email_opt_in, sms_opt_in, push_opt_in, sms_consented_at, sms_consent_ip, updated_at). notifications (notificationId, schoolId, title, body, type (announcement/alert/reminder), recipients (class_ids), scheduled_time, sent_at, template_used). notification_deliveries (deliveryId, notificationId, parentId, channel (email/sms/push), status (sent/failed/bounced), error_message, delivered_at). notification_templates (templateId, schoolId, name, subject, body_email, body_sms, body_push, created_at). No migration needed for blob storage; arrays and objects nest.

API

• POST /api/parents/{parentId}/notification-preferences
• GET /api/parents/{parentId}/notification-preferences
• POST /api/admin/notifications/send
• GET /api/admin/notifications/{notificationId}/delivery-status
• POST /api/admin/notification-templates
• GET /api/admin/notification-templates
• POST /api/webhooks/twilio/delivery-status

Every route added here must also appear in src/pages/openapi.json.ts — a test fails the build if it does not.

Admin

Notifications dashboard (compose + send, recipient picker, schedule time). Template manager (create email/SMS/push variants). Recipient picker (class, grade, all). Delivery report (sent, bounced, failed, delivery rate %). Consent audit (list all parents who opted into SMS + dates). SMS credit usage dashboard.

The seam — why this is paid

Core owns: generic notification infrastructure, opt-in tracking, templates, audit logging. Paid pack owns: Twilio SMS credential, Firebase push credential, delivery status tracking.

Support commitment: SMS delivery SLA, GDPR consent management, abuse prevention

Dependencies

• Parent + class system
• Email system
• Webhook system (Twilio callbacks)
• Twilio account (merchant provides)
• Firebase account (merchant provides)

Acceptance checks

Each of these must be able to fail. Before claiming this is done, break the code deliberately and watch each one go red.

• Parent opts into SMS; receives notification on phone within 5 minutes of send
• Parent opts OUT of SMS; no SMS sent even if admin sends to their class
• Twilio delivery receipt webhook updates notification_deliveries.status to ‘delivered’
• SMS consent logged with timestamp + IP for audit trail
• SMS template > 160 characters rejected with error (SMS size limit)
• Admin sends to ‘Grade 3’; all Grade 3 parents receive notification
• Delivery report: 47 sent, 2 bounced (invalid numbers), 1 failed (Twilio error)
• Scheduled notification queues; sends at exact time (test within ±1 minute)
• Push notification displays class + message on parent’s phone (test on iOS + Android)
• Opt-in audit shows all SMS-consenting parents + consent date + IP

Risks

Not enforcing SMS opt-in before sending: legal liability (GDPR, TCPA, SMS laws). Sending SMS to wrong number (no validation): SMS to stranger, parent misses alert. Twilio credential exposed in logs: attacker sends impersonating school. Concurrent sends via email+SMS+push: spam, unsubscribe cascade. Push notification token expired: Firebase fails silently, parent never sees notification.

Commercial context

The anchor is what the nearest equivalent charges on Shopify or Magento today. It is context for a pricing decision, not the decision.

---

Generated from the commerce plan. See docs/COMMERCE-PLAN.md for the full catalogue and ../../AI-GUIDE.md for how to work on this repository.