From ee15efe73990ff99171a38ce1d535d57a319c695 Mon Sep 17 00:00:00 2001
From: Eric Peters <epeters@lean-ocean.com>
Date: Mon, 20 Apr 2026 22:29:46 +0200
Subject: [PATCH] Add project notification settings UI

---
 ...uildProjectNotificationSettingsPayload.php |  70 ++
 .../ProjectNotificationSettingsController.php |  94 +++
 .../StoreProjectNotificationActionRequest.php |  71 ++
 ...UpdateProjectNotificationActionRequest.php |  71 ++
 resources/js/pages/projects/Show.vue          |   7 +
 .../js/pages/projects/settings/Board.vue      |  14 +
 .../js/pages/projects/settings/General.vue    |   7 +
 .../js/pages/projects/settings/Metadata.vue   |   7 +
 .../pages/projects/settings/Notifications.vue | 640 ++++++++++++++++++
 .../pages/projects/settings/Repositories.vue  |   7 +
 .../types/models/notification-action-model.ts |  15 +
 .../notification-action-option-model.ts       |   4 +
 ...fication-action-template-variable-model.ts |   4 +
 resources/js/types/page-props.ts              |  12 +
 routes/web/project/settings.php               |  10 +
 routes/web/project/settings/notifications.php |   7 +
 ...jectNotificationSettingsControllerTest.php | 334 +++++++++
 17 files changed, 1374 insertions(+)
 create mode 100644 app/Actions/Notifications/BuildProjectNotificationSettingsPayload.php
 create mode 100644 app/Http/Controllers/ProjectNotificationSettingsController.php
 create mode 100644 app/Http/Requests/StoreProjectNotificationActionRequest.php
 create mode 100644 app/Http/Requests/UpdateProjectNotificationActionRequest.php
 create mode 100644 resources/js/pages/projects/settings/Notifications.vue
 create mode 100644 resources/js/types/models/notification-action-model.ts
 create mode 100644 resources/js/types/models/notification-action-option-model.ts
 create mode 100644 resources/js/types/models/notification-action-template-variable-model.ts
 create mode 100644 routes/web/project/settings/notifications.php
 create mode 100644 tests/Feature/Projects/ProjectNotificationSettingsControllerTest.php

diff --git a/app/Actions/Notifications/BuildProjectNotificationSettingsPayload.php b/app/Actions/Notifications/BuildProjectNotificationSettingsPayload.php
new file mode 100644
index 0000000..995a4f3
--- /dev/null
+++ b/app/Actions/Notifications/BuildProjectNotificationSettingsPayload.php
@@ -0,0 +1,70 @@
+<?php
+
+namespace App\Actions\Notifications;
+
+use App\Enums\NotificationChannel;
+use App\Enums\NotificationEventType;
+use App\Http\Resources\NotificationActionResource;
+use App\Http\Resources\ProjectResource;
+use App\Models\Project;
+
+class BuildProjectNotificationSettingsPayload
+{
+    public function __construct(
+        private readonly ListProjectNotificationActions $listProjectNotificationActions,
+    ) {}
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function handle(Project $project, mixed $status = null): array
+    {
+        return [
+            'channelOptions' => NotificationChannel::options(),
+            'eventTypeOptions' => NotificationEventType::options(),
+            'notificationActions' => NotificationActionResource::collection(
+                $this->listProjectNotificationActions->handle($project),
+            )->resolve(),
+            'project' => ProjectResource::make($project)->resolve(),
+            'status' => $status,
+            'templateVariables' => $this->templateVariables(),
+        ];
+    }
+
+    /**
+     * @return array<int, array{description: string, value: string}>
+     */
+    private function templateVariables(): array
+    {
+        return [
+            [
+                'description' => 'Absolute ticket URL for the status change event.',
+                'value' => '$url',
+            ],
+            [
+                'description' => 'Project ticket key such as CORE-42.',
+                'value' => '$ticket_key',
+            ],
+            [
+                'description' => 'Ticket title from the changed ticket.',
+                'value' => '$ticket_title',
+            ],
+            [
+                'description' => 'Project name that owns the ticket.',
+                'value' => '$project_name',
+            ],
+            [
+                'description' => 'Origin status label before the move.',
+                'value' => '$status_from',
+            ],
+            [
+                'description' => 'Destination status label after the move.',
+                'value' => '$status_to',
+            ],
+            [
+                'description' => 'Actor name when the move has a known user.',
+                'value' => '$actor_name',
+            ],
+        ];
+    }
+}
diff --git a/app/Http/Controllers/ProjectNotificationSettingsController.php b/app/Http/Controllers/ProjectNotificationSettingsController.php
new file mode 100644
index 0000000..8abb088
--- /dev/null
+++ b/app/Http/Controllers/ProjectNotificationSettingsController.php
@@ -0,0 +1,94 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Actions\Notifications\BuildProjectNotificationSettingsPayload;
+use App\Actions\Notifications\DeleteProjectNotificationAction;
+use App\Actions\Notifications\StoreProjectNotificationAction;
+use App\Actions\Notifications\UpdateProjectNotificationAction;
+use App\Actions\Permissions\PermissionService;
+use App\Enums\Permission;
+use App\Http\Requests\StoreProjectNotificationActionRequest;
+use App\Http\Requests\UpdateProjectNotificationActionRequest;
+use App\Models\NotificationAction;
+use App\Models\Project;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Inertia;
+use Inertia\Response;
+
+class ProjectNotificationSettingsController extends Controller
+{
+    public function __construct(
+        private readonly BuildProjectNotificationSettingsPayload $buildProjectNotificationSettingsPayload,
+        private readonly DeleteProjectNotificationAction $deleteProjectNotificationAction,
+        private readonly PermissionService $permissionService,
+        private readonly StoreProjectNotificationAction $storeProjectNotificationAction,
+        private readonly UpdateProjectNotificationAction $updateProjectNotificationAction,
+    ) {}
+
+    public function show(Request $request, Project $project): Response
+    {
+        $this->abortUnlessCanManage($request, $project);
+
+        return Inertia::render(
+            'projects/settings/Notifications',
+            $this->buildProjectNotificationSettingsPayload->handle($project, session('status')),
+        );
+    }
+
+    public function store(
+        StoreProjectNotificationActionRequest $request,
+        Project $project,
+    ): RedirectResponse {
+        $this->abortUnlessCanManage($request, $project);
+
+        $notificationAction = $this->storeProjectNotificationAction->handle($project, $request->validated());
+
+        return to_route('projects.settings.notifications', $project)
+            ->with('status', "{$notificationAction->name} notification was added.");
+    }
+
+    public function update(
+        UpdateProjectNotificationActionRequest $request,
+        Project $project,
+        NotificationAction $notificationAction,
+    ): RedirectResponse {
+        $this->abortUnlessCanManage($request, $project);
+
+        $notificationAction = $this->updateProjectNotificationAction->handle(
+            $project,
+            $notificationAction,
+            $request->validated(),
+        );
+
+        return to_route('projects.settings.notifications', $project)
+            ->with('status', "{$notificationAction->name} notification was updated.");
+    }
+
+    public function destroy(
+        Request $request,
+        Project $project,
+        NotificationAction $notificationAction,
+    ): RedirectResponse {
+        $this->abortUnlessCanManage($request, $project);
+
+        $notificationAction = $project->notificationActions()
+            ->whereKey($notificationAction->id)
+            ->firstOrFail();
+        $deletedName = $notificationAction->name;
+
+        $this->deleteProjectNotificationAction->handle($project, $notificationAction);
+
+        return to_route('projects.settings.notifications', $project)
+            ->with('status', "{$deletedName} notification was deleted.");
+    }
+
+    private function abortUnlessCanManage(Request $request, Project $project): void
+    {
+        abort_unless(
+            $this->permissionService->allows($request->user(), Permission::ProjectAdmin, $project),
+            403,
+        );
+    }
+}
diff --git a/app/Http/Requests/StoreProjectNotificationActionRequest.php b/app/Http/Requests/StoreProjectNotificationActionRequest.php
new file mode 100644
index 0000000..ed7f636
--- /dev/null
+++ b/app/Http/Requests/StoreProjectNotificationActionRequest.php
@@ -0,0 +1,71 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Enums\NotificationChannel;
+use App\Enums\NotificationEventType;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class StoreProjectNotificationActionRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return $this->user() !== null;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'event_type' => ['required', 'string', Rule::in($this->eventTypes())],
+            'channel' => ['required', 'string', Rule::in($this->channels())],
+            'enabled' => ['required', 'boolean'],
+            'delivery_url' => ['required', 'string', 'max:2048', 'url'],
+            'message_template' => $this->messageTemplateRules(),
+        ];
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private function channels(): array
+    {
+        return array_map(
+            static fn (NotificationChannel $channel): string => $channel->value,
+            NotificationChannel::cases(),
+        );
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private function eventTypes(): array
+    {
+        return array_map(
+            static fn (NotificationEventType $eventType): string => $eventType->value,
+            NotificationEventType::cases(),
+        );
+    }
+
+    /**
+     * @return array<int, ValidationRule|string>
+     */
+    private function messageTemplateRules(): array
+    {
+        if ($this->input('channel') === NotificationChannel::Discord->value) {
+            return ['required', 'string', 'max:2000'];
+        }
+
+        return ['nullable', 'string', 'max:2000'];
+    }
+}
diff --git a/app/Http/Requests/UpdateProjectNotificationActionRequest.php b/app/Http/Requests/UpdateProjectNotificationActionRequest.php
new file mode 100644
index 0000000..0e281bf
--- /dev/null
+++ b/app/Http/Requests/UpdateProjectNotificationActionRequest.php
@@ -0,0 +1,71 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Enums\NotificationChannel;
+use App\Enums\NotificationEventType;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class UpdateProjectNotificationActionRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return $this->user() !== null;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'event_type' => ['required', 'string', Rule::in($this->eventTypes())],
+            'channel' => ['required', 'string', Rule::in($this->channels())],
+            'enabled' => ['required', 'boolean'],
+            'delivery_url' => ['nullable', 'string', 'max:2048', 'url'],
+            'message_template' => $this->messageTemplateRules(),
+        ];
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private function channels(): array
+    {
+        return array_map(
+            static fn (NotificationChannel $channel): string => $channel->value,
+            NotificationChannel::cases(),
+        );
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private function eventTypes(): array
+    {
+        return array_map(
+            static fn (NotificationEventType $eventType): string => $eventType->value,
+            NotificationEventType::cases(),
+        );
+    }
+
+    /**
+     * @return array<int, ValidationRule|string>
+     */
+    private function messageTemplateRules(): array
+    {
+        if ($this->input('channel') === NotificationChannel::Discord->value) {
+            return ['required', 'string', 'max:2000'];
+        }
+
+        return ['nullable', 'string', 'max:2000'];
+    }
+}
diff --git a/resources/js/pages/projects/Show.vue b/resources/js/pages/projects/Show.vue
index 1591081..46d86bd 100644
--- a/resources/js/pages/projects/Show.vue
+++ b/resources/js/pages/projects/Show.vue
@@ -19,6 +19,7 @@ import {
     board as boardSettings,
     general as generalSettings,
     metadata as metadataSettings,
+    notifications as notificationSettings,
     repositories as repositorySettings,
 } from '@/routes/projects/settings';
 import type { BreadcrumbItem, ProjectShowPageProps } from '@/types';
@@ -128,6 +129,12 @@ const projectAreas = [
                     </Link>
                 </Button>
 
+                <Button as-child variant="outline">
+                    <Link :href="notificationSettings(project.id)">
+                        Notification settings
+                    </Link>
+                </Button>
+
                 <Button as-child variant="outline">
                     <Link :href="access(project.id)">Manage access</Link>
                 </Button>
diff --git a/resources/js/pages/projects/settings/Board.vue b/resources/js/pages/projects/settings/Board.vue
index 1d24f50..e56e69c 100644
--- a/resources/js/pages/projects/settings/Board.vue
+++ b/resources/js/pages/projects/settings/Board.vue
@@ -19,6 +19,8 @@ import { index, show } from '@/routes/projects/index';
 import {
     board as boardSettings,
     general as generalSettings,
+    metadata as metadataSettings,
+    notifications as notificationSettings,
     repositories as repositorySettings,
 } from '@/routes/projects/settings';
 import type { BreadcrumbItem, ProjectBoardSettingsPageProps } from '@/types';
@@ -105,12 +107,24 @@ const statusAllowsTarget = (
                         </Link>
                     </Button>
 
+                    <Button as-child variant="outline">
+                        <Link :href="metadataSettings(project.id)">
+                            Ticket settings
+                        </Link>
+                    </Button>
+
                     <Button as-child variant="outline">
                         <Link :href="repositorySettings(project.id)">
                             Repository settings
                         </Link>
                     </Button>
 
+                    <Button as-child variant="outline">
+                        <Link :href="notificationSettings(project.id)">
+                            Notification settings
+                        </Link>
+                    </Button>
+
                     <Button as-child variant="outline">
                         <Link :href="show(project.id)">Back to project</Link>
                     </Button>
diff --git a/resources/js/pages/projects/settings/General.vue b/resources/js/pages/projects/settings/General.vue
index 3ae452a..f309dd8 100644
--- a/resources/js/pages/projects/settings/General.vue
+++ b/resources/js/pages/projects/settings/General.vue
@@ -20,6 +20,7 @@ import {
     board as boardSettings,
     general as generalSettings,
     metadata as metadataSettings,
+    notifications as notificationSettings,
     repositories as repositorySettings,
 } from '@/routes/projects/settings';
 import type { BreadcrumbItem, ProjectGeneralSettingsPageProps } from '@/types';
@@ -98,6 +99,12 @@ const submitDelete = (): void => {
                         </Link>
                     </Button>
 
+                    <Button as-child variant="outline">
+                        <Link :href="notificationSettings(project.id)">
+                            Notification settings
+                        </Link>
+                    </Button>
+
                     <Button as-child variant="outline">
                         <Link :href="show(project.id)">Back to project</Link>
                     </Button>
diff --git a/resources/js/pages/projects/settings/Metadata.vue b/resources/js/pages/projects/settings/Metadata.vue
index 3df2aa9..5b0274c 100644
--- a/resources/js/pages/projects/settings/Metadata.vue
+++ b/resources/js/pages/projects/settings/Metadata.vue
@@ -20,6 +20,7 @@ import {
     board as boardSettings,
     general as generalSettings,
     metadata as metadataSettings,
+    notifications as notificationSettings,
     repositories as repositorySettings,
 } from '@/routes/projects/settings';
 import type {
@@ -90,6 +91,12 @@ const replacementTicketTypes = (ticketTypeId: number) =>
                         </Link>
                     </Button>
 
+                    <Button as-child variant="outline">
+                        <Link :href="notificationSettings(project.id)">
+                            Notification settings
+                        </Link>
+                    </Button>
+
                     <Button as-child variant="outline">
                         <Link :href="show(project.id)">Back to project</Link>
                     </Button>
diff --git a/resources/js/pages/projects/settings/Notifications.vue b/resources/js/pages/projects/settings/Notifications.vue
new file mode 100644
index 0000000..978e9d2
--- /dev/null
+++ b/resources/js/pages/projects/settings/Notifications.vue
@@ -0,0 +1,640 @@
+<script setup lang="ts">
+import { Form, Head, Link } from '@inertiajs/vue3';
+import { reactive } from 'vue';
+import ProjectNotificationSettingsController from '@/actions/App/Http/Controllers/ProjectNotificationSettingsController';
+import Heading from '@/components/Heading.vue';
+import InputError from '@/components/InputError.vue';
+import { Badge } from '@/components/ui/badge';
+import { Button } from '@/components/ui/button';
+import {
+    Card,
+    CardContent,
+    CardDescription,
+    CardHeader,
+    CardTitle,
+} from '@/components/ui/card';
+import { Input } from '@/components/ui/input';
+import { Label } from '@/components/ui/label';
+import AppLayout from '@/layouts/AppLayout.vue';
+import { index, show } from '@/routes/projects/index';
+import {
+    board as boardSettings,
+    general as generalSettings,
+    metadata as metadataSettings,
+    notifications as notificationSettings,
+    repositories as repositorySettings,
+} from '@/routes/projects/settings';
+import type {
+    BreadcrumbItem,
+    ProjectNotificationSettingsPageProps,
+} from '@/types';
+import type { NotificationActionModel } from '@/types/models/notification-action-model';
+
+const props = defineProps<ProjectNotificationSettingsPageProps>();
+
+const defaultCreateChannel =
+    props.channelOptions.find((option) => option.value === 'webhook')?.value ??
+    props.channelOptions[0]?.value ??
+    '';
+const createChannelState = reactive<{ value: string }>({
+    value: defaultCreateChannel,
+});
+const editChannelState = reactive<Record<number, string>>({});
+const timestampFormatter = new Intl.DateTimeFormat(undefined, {
+    dateStyle: 'medium',
+    timeStyle: 'short',
+});
+
+const breadcrumbs: BreadcrumbItem[] = [
+    {
+        title: 'Projects',
+        href: index(),
+    },
+    {
+        title: props.project.name,
+        href: show(props.project.id),
+    },
+    {
+        title: 'Notification settings',
+        href: notificationSettings(props.project.id),
+    },
+];
+
+props.notificationActions.forEach((notificationAction) => {
+    editChannelState[notificationAction.id] = notificationAction.channel;
+});
+
+const selectedChannel = (notificationAction: NotificationActionModel): string =>
+    editChannelState[notificationAction.id] ?? notificationAction.channel;
+
+const notificationActionTimestamp = (
+    notificationAction: NotificationActionModel,
+): string => {
+    const createdAt = notificationAction.created_at;
+    const updatedAt = notificationAction.updated_at ?? createdAt;
+
+    if (updatedAt === null) {
+        return 'No saved changes yet';
+    }
+
+    if (createdAt !== null && createdAt !== updatedAt) {
+        return `Updated ${timestampFormatter.format(new Date(updatedAt))}`;
+    }
+
+    return `Created ${timestampFormatter.format(new Date(updatedAt))}`;
+};
+</script>
+
+<template>
+    <AppLayout :breadcrumbs="breadcrumbs">
+        <Head :title="`${project.name} notification settings`" />
+
+        <div class="flex flex-1 flex-col gap-6 p-4">
+            <div
+                class="flex flex-col gap-4 sm:flex-row sm:items-start sm:justify-between"
+            >
+                <div class="space-y-3">
+                    <Badge variant="outline" class="px-3 py-1">
+                        {{ project.key }}
+                    </Badge>
+                    <Heading
+                        :title="`${project.name} notification settings`"
+                        description="Configure project-scoped webhook and Discord notification actions for ticket status changes."
+                    />
+                </div>
+
+                <div class="flex flex-wrap gap-3">
+                    <Button
+                        v-if="$page.props.auth.permissions.globalAdmin"
+                        as-child
+                        variant="outline"
+                    >
+                        <Link :href="generalSettings(project.id)">
+                            General settings
+                        </Link>
+                    </Button>
+
+                    <Button as-child variant="outline">
+                        <Link :href="boardSettings(project.id)">
+                            Board settings
+                        </Link>
+                    </Button>
+
+                    <Button as-child variant="outline">
+                        <Link :href="metadataSettings(project.id)">
+                            Ticket settings
+                        </Link>
+                    </Button>
+
+                    <Button as-child variant="outline">
+                        <Link :href="repositorySettings(project.id)">
+                            Repository settings
+                        </Link>
+                    </Button>
+
+                    <Button as-child variant="outline">
+                        <Link :href="show(project.id)">Back to project</Link>
+                    </Button>
+                </div>
+            </div>
+
+            <div
+                v-if="status"
+                class="rounded-xl border border-emerald-200 bg-emerald-50 px-4 py-3 text-sm text-emerald-900 dark:border-emerald-900/70 dark:bg-emerald-950/40 dark:text-emerald-100"
+            >
+                {{ status }}
+            </div>
+
+            <div class="grid gap-6 xl:grid-cols-[24rem_minmax(0,1fr)]">
+                <div class="space-y-6">
+                    <Card>
+                        <CardHeader>
+                            <CardTitle>Create notification</CardTitle>
+                            <CardDescription>
+                                Add a project-scoped notification action for
+                                the supported ticket status change event.
+                            </CardDescription>
+                        </CardHeader>
+
+                        <CardContent>
+                            <Form
+                                v-bind="
+                                    ProjectNotificationSettingsController.store.form(
+                                        project.id,
+                                    )
+                                "
+                                error-bag="createNotificationAction"
+                                reset-on-success
+                                @success="
+                                    createChannelState.value =
+                                        defaultCreateChannel
+                                "
+                                class="space-y-4"
+                                v-slot="{ errors, processing }"
+                            >
+                                <div class="grid gap-2">
+                                    <Label for="create-notification-name">
+                                        Name
+                                    </Label>
+                                    <Input
+                                        id="create-notification-name"
+                                        name="name"
+                                        placeholder="Discord alerts"
+                                    />
+                                    <InputError :message="errors.name" />
+                                </div>
+
+                                <div class="grid gap-4 md:grid-cols-2">
+                                    <div class="grid gap-2">
+                                        <Label
+                                            for="create-notification-event-type"
+                                        >
+                                            Event type
+                                        </Label>
+                                        <select
+                                            id="create-notification-event-type"
+                                            name="event_type"
+                                            class="border-input bg-background shadow-xs focus-visible:border-ring focus-visible:ring-ring/50 rounded-md border px-3 py-2 text-sm outline-none transition-[color,box-shadow] focus-visible:ring-[3px]"
+                                        >
+                                            <option
+                                                v-for="eventTypeOption in eventTypeOptions"
+                                                :key="eventTypeOption.value"
+                                                :value="eventTypeOption.value"
+                                            >
+                                                {{ eventTypeOption.label }}
+                                            </option>
+                                        </select>
+                                        <InputError
+                                            :message="errors.event_type"
+                                        />
+                                    </div>
+
+                                    <div class="grid gap-2">
+                                        <Label for="create-notification-channel">
+                                            Channel
+                                        </Label>
+                                        <select
+                                            id="create-notification-channel"
+                                            name="channel"
+                                            v-model="createChannelState.value"
+                                            class="border-input bg-background shadow-xs focus-visible:border-ring focus-visible:ring-ring/50 rounded-md border px-3 py-2 text-sm outline-none transition-[color,box-shadow] focus-visible:ring-[3px]"
+                                        >
+                                            <option
+                                                v-for="channelOption in channelOptions"
+                                                :key="channelOption.value"
+                                                :value="channelOption.value"
+                                            >
+                                                {{ channelOption.label }}
+                                            </option>
+                                        </select>
+                                        <InputError :message="errors.channel" />
+                                    </div>
+                                </div>
+
+                                <div class="grid gap-2">
+                                    <Label for="create-notification-delivery-url">
+                                        Delivery URL
+                                    </Label>
+                                    <Input
+                                        id="create-notification-delivery-url"
+                                        name="delivery_url"
+                                        type="url"
+                                        placeholder="https://hooks.example.test/kanbangit/secret-token"
+                                    />
+                                    <p class="text-muted-foreground text-sm">
+                                        Secret URLs are stored encrypted and are
+                                        never rendered back to the browser after
+                                        save.
+                                    </p>
+                                    <InputError :message="errors.delivery_url" />
+                                </div>
+
+                                <div class="grid gap-2">
+                                    <Label
+                                        for="create-notification-message-template"
+                                    >
+                                        Discord message template
+                                    </Label>
+                                    <textarea
+                                        id="create-notification-message-template"
+                                        name="message_template"
+                                        rows="4"
+                                        :disabled="
+                                            createChannelState.value !==
+                                            'discord'
+                                        "
+                                        :class="[
+                                            'border-input bg-background shadow-xs focus-visible:border-ring focus-visible:ring-ring/50 min-h-28 rounded-md border px-3 py-2 text-sm outline-none transition-[color,box-shadow] focus-visible:ring-[3px]',
+                                            createChannelState.value !==
+                                            'discord'
+                                                ? 'hidden'
+                                                : 'block',
+                                        ]"
+                                        placeholder="$ticket_key moved from $status_from to $status_to by $actor_name: $url"
+                                    />
+                                    <p class="text-muted-foreground text-sm">
+                                        {{
+                                            createChannelState.value ===
+                                            'discord'
+                                                ? 'Available for Discord actions only. Use the fixed variables listed below.'
+                                                : 'Discord message templates are only used when the channel is Discord.'
+                                        }}
+                                    </p>
+                                    <InputError
+                                        :message="errors.message_template"
+                                    />
+                                </div>
+
+                                <div class="grid gap-2">
+                                    <Label
+                                        for="create-notification-enabled"
+                                        class="flex items-center gap-3"
+                                    >
+                                        <input
+                                            type="hidden"
+                                            name="enabled"
+                                            value="0"
+                                        />
+                                        <input
+                                            id="create-notification-enabled"
+                                            type="checkbox"
+                                            name="enabled"
+                                            value="1"
+                                            checked
+                                            class="border-input text-primary focus:ring-ring size-4 rounded"
+                                        />
+                                        <span>Enabled immediately</span>
+                                    </Label>
+                                    <InputError :message="errors.enabled" />
+                                </div>
+
+                                <Button type="submit" :disabled="processing">
+                                    Save notification
+                                </Button>
+                            </Form>
+                        </CardContent>
+                    </Card>
+
+                    <Card>
+                        <CardHeader>
+                            <CardTitle>Template variables</CardTitle>
+                            <CardDescription>
+                                Discord templates can reference the following
+                                fixed variables.
+                            </CardDescription>
+                        </CardHeader>
+
+                        <CardContent class="space-y-3">
+                            <div
+                                v-for="templateVariable in templateVariables"
+                                :key="templateVariable.value"
+                                class="border-border/70 rounded-xl border p-4"
+                            >
+                                <div class="flex flex-wrap items-center gap-2">
+                                    <Badge variant="secondary">
+                                        {{ templateVariable.value }}
+                                    </Badge>
+                                </div>
+                                <p class="text-muted-foreground mt-2 text-sm">
+                                    {{ templateVariable.description }}
+                                </p>
+                            </div>
+                        </CardContent>
+                    </Card>
+                </div>
+
+                <div class="space-y-6">
+                    <Card
+                        v-if="notificationActions.length === 0"
+                        class="border-dashed"
+                    >
+                        <CardHeader>
+                            <CardTitle>No notifications configured</CardTitle>
+                            <CardDescription>
+                                Create your first webhook or Discord action to
+                                start sending project notifications later in
+                                this release.
+                            </CardDescription>
+                        </CardHeader>
+                    </Card>
+
+                    <Card
+                        v-for="notificationAction in notificationActions"
+                        :key="notificationAction.id"
+                    >
+                        <CardHeader
+                            class="flex flex-col gap-4 sm:flex-row sm:items-start sm:justify-between"
+                        >
+                            <div class="space-y-3">
+                                <div class="flex flex-wrap items-center gap-2">
+                                    <CardTitle>
+                                        {{ notificationAction.name }}
+                                    </CardTitle>
+                                    <Badge variant="outline">
+                                        {{
+                                            notificationAction.event_type_label
+                                        }}
+                                    </Badge>
+                                    <Badge variant="outline">
+                                        {{ notificationAction.channel_label }}
+                                    </Badge>
+                                    <Badge
+                                        :variant="
+                                            notificationAction.enabled
+                                                ? 'default'
+                                                : 'secondary'
+                                        "
+                                    >
+                                        {{
+                                            notificationAction.enabled
+                                                ? 'Enabled'
+                                                : 'Disabled'
+                                        }}
+                                    </Badge>
+                                </div>
+                                <CardDescription>
+                                    {{ notificationActionTimestamp(notificationAction) }}
+                                </CardDescription>
+                            </div>
+                        </CardHeader>
+
+                        <CardContent class="space-y-4">
+                            <Form
+                                v-bind="
+                                    ProjectNotificationSettingsController.update.form(
+                                        [project.id, notificationAction.id],
+                                    )
+                                "
+                                :error-bag="
+                                    `updateNotificationAction-${notificationAction.id}`
+                                "
+                                class="space-y-4"
+                                v-slot="{ errors, processing }"
+                            >
+                                <div class="grid gap-4 md:grid-cols-2">
+                                    <div class="grid gap-2">
+                                        <Label
+                                            :for="
+                                                `notification-name-${notificationAction.id}`
+                                            "
+                                        >
+                                            Name
+                                        </Label>
+                                        <Input
+                                            :id="
+                                                `notification-name-${notificationAction.id}`
+                                            "
+                                            name="name"
+                                            :default-value="
+                                                notificationAction.name
+                                            "
+                                        />
+                                        <InputError :message="errors.name" />
+                                    </div>
+
+                                    <div class="grid gap-2">
+                                        <Label
+                                            :for="
+                                                `notification-delivery-url-${notificationAction.id}`
+                                            "
+                                        >
+                                            Delivery URL
+                                        </Label>
+                                        <Input
+                                            :id="
+                                                `notification-delivery-url-${notificationAction.id}`
+                                            "
+                                            name="delivery_url"
+                                            type="url"
+                                            :placeholder="
+                                                notificationAction.has_delivery_url
+                                                    ? 'Saved URL stays hidden. Enter a new URL to replace it.'
+                                                    : 'https://hooks.example.test/kanbangit/secret-token'
+                                            "
+                                        />
+                                        <p
+                                            class="text-muted-foreground text-sm"
+                                        >
+                                            {{
+                                                notificationAction.has_delivery_url
+                                                    ? 'A delivery URL is already stored. Leaving this blank keeps the existing secret.'
+                                                    : 'No delivery URL is stored yet. Enter a secret URL to enable delivery later.'
+                                            }}
+                                        </p>
+                                        <InputError
+                                            :message="errors.delivery_url"
+                                        />
+                                    </div>
+
+                                    <div class="grid gap-2">
+                                        <Label
+                                            :for="
+                                                `notification-event-type-${notificationAction.id}`
+                                            "
+                                        >
+                                            Event type
+                                        </Label>
+                                        <select
+                                            :id="
+                                                `notification-event-type-${notificationAction.id}`
+                                            "
+                                            name="event_type"
+                                            :default-value="
+                                                notificationAction.event_type
+                                            "
+                                            class="border-input bg-background shadow-xs focus-visible:border-ring focus-visible:ring-ring/50 rounded-md border px-3 py-2 text-sm outline-none transition-[color,box-shadow] focus-visible:ring-[3px]"
+                                        >
+                                            <option
+                                                v-for="eventTypeOption in eventTypeOptions"
+                                                :key="eventTypeOption.value"
+                                                :value="eventTypeOption.value"
+                                            >
+                                                {{ eventTypeOption.label }}
+                                            </option>
+                                        </select>
+                                        <InputError
+                                            :message="errors.event_type"
+                                        />
+                                    </div>
+
+                                    <div class="grid gap-2">
+                                        <Label
+                                            :for="
+                                                `notification-channel-${notificationAction.id}`
+                                            "
+                                        >
+                                            Channel
+                                        </Label>
+                                        <select
+                                            :id="
+                                                `notification-channel-${notificationAction.id}`
+                                            "
+                                            name="channel"
+                                            v-model="
+                                                editChannelState[
+                                                    notificationAction.id
+                                                ]
+                                            "
+                                            class="border-input bg-background shadow-xs focus-visible:border-ring focus-visible:ring-ring/50 rounded-md border px-3 py-2 text-sm outline-none transition-[color,box-shadow] focus-visible:ring-[3px]"
+                                        >
+                                            <option
+                                                v-for="channelOption in channelOptions"
+                                                :key="channelOption.value"
+                                                :value="channelOption.value"
+                                            >
+                                                {{ channelOption.label }}
+                                            </option>
+                                        </select>
+                                        <InputError :message="errors.channel" />
+                                    </div>
+                                </div>
+
+                                <div class="grid gap-2">
+                                    <Label
+                                        :for="
+                                            `notification-message-template-${notificationAction.id}`
+                                        "
+                                    >
+                                        Discord message template
+                                    </Label>
+                                    <textarea
+                                        :id="
+                                            `notification-message-template-${notificationAction.id}`
+                                        "
+                                        name="message_template"
+                                        rows="4"
+                                        :default-value="
+                                            notificationAction.message_template ??
+                                            ''
+                                        "
+                                        :disabled="
+                                            selectedChannel(notificationAction) !==
+                                            'discord'
+                                        "
+                                        :class="[
+                                            'border-input bg-background shadow-xs focus-visible:border-ring focus-visible:ring-ring/50 min-h-28 rounded-md border px-3 py-2 text-sm outline-none transition-[color,box-shadow] focus-visible:ring-[3px]',
+                                            selectedChannel(notificationAction) !==
+                                            'discord'
+                                                ? 'hidden'
+                                                : 'block',
+                                        ]"
+                                        placeholder="$ticket_key moved from $status_from to $status_to by $actor_name: $url"
+                                    />
+                                    <p class="text-muted-foreground text-sm">
+                                        {{
+                                            selectedChannel(notificationAction) ===
+                                            'discord'
+                                                ? 'Available for Discord actions only. Use the fixed variables listed in the sidebar.'
+                                                : 'Discord message templates are only used when the channel is Discord.'
+                                        }}
+                                    </p>
+                                    <InputError
+                                        :message="errors.message_template"
+                                    />
+                                </div>
+
+                                <div
+                                    class="flex flex-col gap-3 border-t pt-4 sm:flex-row sm:items-center sm:justify-between"
+                                >
+                                    <div class="grid gap-2">
+                                        <Label
+                                            :for="
+                                                `notification-enabled-${notificationAction.id}`
+                                            "
+                                            class="flex items-center gap-3"
+                                        >
+                                            <input
+                                                type="hidden"
+                                                name="enabled"
+                                                value="0"
+                                            />
+                                            <input
+                                                :id="
+                                                    `notification-enabled-${notificationAction.id}`
+                                                "
+                                                type="checkbox"
+                                                name="enabled"
+                                                value="1"
+                                                :default-checked="
+                                                    notificationAction.enabled
+                                                "
+                                                class="border-input text-primary focus:ring-ring size-4 rounded"
+                                            />
+                                            <span>Enabled</span>
+                                        </Label>
+                                        <InputError :message="errors.enabled" />
+                                    </div>
+
+                                    <Button
+                                        type="submit"
+                                        :disabled="processing"
+                                    >
+                                        Save changes
+                                    </Button>
+                                </div>
+                            </Form>
+
+                            <Form
+                                v-bind="
+                                    ProjectNotificationSettingsController.destroy.form(
+                                        [project.id, notificationAction.id],
+                                    )
+                                "
+                                class="border-t pt-4"
+                                v-slot="{ processing }"
+                            >
+                                <Button
+                                    type="submit"
+                                    variant="destructive"
+                                    :disabled="processing"
+                                >
+                                    Delete notification
+                                </Button>
+                            </Form>
+                        </CardContent>
+                    </Card>
+                </div>
+            </div>
+        </div>
+    </AppLayout>
+</template>
diff --git a/resources/js/pages/projects/settings/Repositories.vue b/resources/js/pages/projects/settings/Repositories.vue
index 8ee4a54..42efbb0 100644
--- a/resources/js/pages/projects/settings/Repositories.vue
+++ b/resources/js/pages/projects/settings/Repositories.vue
@@ -21,6 +21,7 @@ import {
     board as boardSettings,
     general as generalSettings,
     metadata as metadataSettings,
+    notifications as notificationSettings,
     repositories as repositorySettings,
 } from '@/routes/projects/settings';
 import type { AvailableGitRepositorySourceModel } from '@/types/models/available-git-repository-source-model';
@@ -257,6 +258,12 @@ const submitUpdate = (): void => {
                         </Link>
                     </Button>
 
+                    <Button as-child variant="outline">
+                        <Link :href="notificationSettings(project.id)">
+                            Notification settings
+                        </Link>
+                    </Button>
+
                     <Button as-child variant="outline">
                         <Link :href="show(project.id)">Back to project</Link>
                     </Button>
diff --git a/resources/js/types/models/notification-action-model.ts b/resources/js/types/models/notification-action-model.ts
new file mode 100644
index 0000000..085e60c
--- /dev/null
+++ b/resources/js/types/models/notification-action-model.ts
@@ -0,0 +1,15 @@
+export type NotificationActionModel = {
+    id: number;
+    project_id: number;
+    name: string;
+    enabled: boolean;
+    event_type: string;
+    event_type_label: string;
+    channel: string;
+    channel_label: string;
+    channel_configuration: Record<string, unknown>;
+    has_delivery_url: boolean;
+    message_template: string | null;
+    created_at: string | null;
+    updated_at: string | null;
+};
diff --git a/resources/js/types/models/notification-action-option-model.ts b/resources/js/types/models/notification-action-option-model.ts
new file mode 100644
index 0000000..f706b88
--- /dev/null
+++ b/resources/js/types/models/notification-action-option-model.ts
@@ -0,0 +1,4 @@
+export type NotificationActionOptionModel = {
+    label: string;
+    value: string;
+};
diff --git a/resources/js/types/models/notification-action-template-variable-model.ts b/resources/js/types/models/notification-action-template-variable-model.ts
new file mode 100644
index 0000000..5f06398
--- /dev/null
+++ b/resources/js/types/models/notification-action-template-variable-model.ts
@@ -0,0 +1,4 @@
+export type NotificationActionTemplateVariableModel = {
+    description: string;
+    value: string;
+};
diff --git a/resources/js/types/page-props.ts b/resources/js/types/page-props.ts
index 5a102ac..17579fc 100644
--- a/resources/js/types/page-props.ts
+++ b/resources/js/types/page-props.ts
@@ -1,5 +1,8 @@
 import type { BoardColumnModel } from '@/types/models/board-column-model';
 import type { AvailableGitRepositorySourceModel } from '@/types/models/available-git-repository-source-model';
+import type { NotificationActionModel } from '@/types/models/notification-action-model';
+import type { NotificationActionOptionModel } from '@/types/models/notification-action-option-model';
+import type { NotificationActionTemplateVariableModel } from '@/types/models/notification-action-template-variable-model';
 import type { ProjectModel } from '@/types/models/project-model';
 import type { RepositoryConnectionModel } from '@/types/models/repository-connection-model';
 import type { TeamModel } from '@/types/models/team-model';
@@ -103,6 +106,15 @@ export type ProjectRepositorySettingsPageProps = {
     status?: string | null;
 };
 
+export type ProjectNotificationSettingsPageProps = {
+    channelOptions: NotificationActionOptionModel[];
+    eventTypeOptions: NotificationActionOptionModel[];
+    notificationActions: NotificationActionModel[];
+    project: ProjectModel;
+    status?: string | null;
+    templateVariables: NotificationActionTemplateVariableModel[];
+};
+
 export type ProjectBacklogPageProps = {
     backlogTicketStatuses: TicketStatusModel[];
     canCreateTickets: boolean;
diff --git a/routes/web/project/settings.php b/routes/web/project/settings.php
index d89d5f8..5a99db3 100644
--- a/routes/web/project/settings.php
+++ b/routes/web/project/settings.php
@@ -2,6 +2,7 @@
 
 use App\Http\Controllers\ProjectBoardSettingsController;
 use App\Http\Controllers\ProjectController;
+use App\Http\Controllers\ProjectNotificationSettingsController;
 use App\Http\Controllers\ProjectRepositorySettingsController;
 use App\Http\Controllers\ProjectTicketMetadataSettingsController;
 use Illuminate\Support\Facades\Route;
@@ -35,3 +36,12 @@ Route::prefix('repositories')
     ->group(function (): void {
         require __DIR__.'/settings/repositories.php';
     });
+
+Route::get('notifications', [ProjectNotificationSettingsController::class, 'show'])->name('notifications');
+
+Route::prefix('notifications')
+    ->name('notifications.')
+    ->controller(ProjectNotificationSettingsController::class)
+    ->group(function (): void {
+        require __DIR__.'/settings/notifications.php';
+    });
diff --git a/routes/web/project/settings/notifications.php b/routes/web/project/settings/notifications.php
new file mode 100644
index 0000000..39f4580
--- /dev/null
+++ b/routes/web/project/settings/notifications.php
@@ -0,0 +1,7 @@
+<?php
+
+use Illuminate\Support\Facades\Route;
+
+Route::post('/', 'store')->name('store');
+Route::patch('{notificationAction}', 'update')->name('update');
+Route::delete('{notificationAction}', 'destroy')->name('destroy');
diff --git a/tests/Feature/Projects/ProjectNotificationSettingsControllerTest.php b/tests/Feature/Projects/ProjectNotificationSettingsControllerTest.php
new file mode 100644
index 0000000..e2c317a
--- /dev/null
+++ b/tests/Feature/Projects/ProjectNotificationSettingsControllerTest.php
@@ -0,0 +1,334 @@
+<?php
+
+namespace Tests\Feature\Projects;
+
+use App\Enums\NotificationChannel;
+use App\Enums\NotificationEventType;
+use App\Models\NotificationAction;
+use App\Models\Project;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Inertia\Testing\AssertableInertia as Assert;
+use Tests\TestCase;
+
+class ProjectNotificationSettingsControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    /**
+     * Ensure project admins can view notification settings with notification action metadata.
+     */
+    public function test_project_admins_can_view_notification_settings(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create([
+            'key' => 'CORE',
+        ]);
+        $notificationAction = NotificationAction::factory()
+            ->discord()
+            ->for($project)
+            ->create([
+                'name' => 'Discord alerts',
+            ]);
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->get(route('projects.settings.notifications', $project))
+            ->assertOk()
+            ->assertInertia(fn (Assert $page) => $page
+                ->component('projects/settings/Notifications')
+                ->where('project.id', $project->id)
+                ->where('notificationActions.0.name', 'Discord alerts')
+                ->where('notificationActions.0.channel', NotificationChannel::Discord->value)
+                ->where('notificationActions.0.event_type', NotificationEventType::TicketStatusChanged->value)
+                ->where('notificationActions.0.enabled', true)
+                ->where('notificationActions.0.has_delivery_url', true)
+                ->where('notificationActions.0.updated_at', $notificationAction->updated_at?->toISOString())
+                ->where('channelOptions.0.value', NotificationChannel::Discord->value)
+                ->where('eventTypeOptions.0.value', NotificationEventType::TicketStatusChanged->value)
+                ->where('templateVariables.0.value', '$url')
+                ->where('templateVariables.6.value', '$actor_name')
+                ->missing('notificationActions.0.delivery_url'),
+            );
+    }
+
+    /**
+     * Ensure non-admin project users cannot open notification settings.
+     */
+    public function test_non_admin_users_cannot_view_notification_settings(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+
+        $this->syncProjectPermissions($project, $user, ['view']);
+
+        $this->actingAs($user)
+            ->get(route('projects.settings.notifications', $project))
+            ->assertForbidden();
+    }
+
+    /**
+     * Ensure project admins can create notification actions from settings.
+     */
+    public function test_project_admins_can_create_notification_actions(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->post(route('projects.settings.notifications.store', $project), [
+                'name' => 'Discord alerts',
+                'event_type' => NotificationEventType::TicketStatusChanged->value,
+                'channel' => NotificationChannel::Discord->value,
+                'enabled' => '1',
+                'delivery_url' => 'https://discord.com/api/webhooks/123456/discord-alerts',
+                'message_template' => '$ticket_key moved from $status_from to $status_to by $actor_name: $url',
+            ])
+            ->assertRedirect(route('projects.settings.notifications', $project))
+            ->assertSessionHas('status', 'Discord alerts notification was added.');
+
+        $notificationAction = NotificationAction::query()->firstOrFail();
+
+        $this->assertSame($project->id, $notificationAction->project_id);
+        $this->assertSame(NotificationChannel::Discord, $notificationAction->channel);
+        $this->assertSame(NotificationEventType::TicketStatusChanged, $notificationAction->event_type);
+        $this->assertTrue($notificationAction->enabled);
+        $this->assertSame(
+            'https://discord.com/api/webhooks/123456/discord-alerts',
+            $notificationAction->delivery_url,
+        );
+    }
+
+    /**
+     * Ensure project admins can update notification actions without replacing stored secret URLs.
+     */
+    public function test_project_admins_can_update_notification_actions_without_replacing_delivery_urls(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+        $notificationAction = NotificationAction::factory()
+            ->discord()
+            ->for($project)
+            ->create([
+                'delivery_url' => 'https://discord.com/api/webhooks/123456/original-secret',
+                'name' => 'Ops alerts',
+            ]);
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->patch(route('projects.settings.notifications.update', [$project, $notificationAction]), [
+                'name' => 'Ops escalation alerts',
+                'event_type' => NotificationEventType::TicketStatusChanged->value,
+                'channel' => NotificationChannel::Discord->value,
+                'enabled' => '1',
+                'delivery_url' => '',
+                'message_template' => '$ticket_key moved to $status_to: $url',
+            ])
+            ->assertRedirect(route('projects.settings.notifications', $project))
+            ->assertSessionHas('status', 'Ops escalation alerts notification was updated.');
+
+        $notificationAction->refresh();
+
+        $this->assertSame('Ops escalation alerts', $notificationAction->name);
+        $this->assertSame(
+            'https://discord.com/api/webhooks/123456/original-secret',
+            $notificationAction->delivery_url,
+        );
+        $this->assertSame('$ticket_key moved to $status_to: $url', $notificationAction->message_template);
+    }
+
+    /**
+     * Ensure project admins can disable and re-enable notification actions.
+     */
+    public function test_project_admins_can_toggle_notification_actions(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+        $notificationAction = NotificationAction::factory()
+            ->for($project)
+            ->create([
+                'enabled' => true,
+            ]);
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->patch(route('projects.settings.notifications.update', [$project, $notificationAction]), [
+                'name' => $notificationAction->name,
+                'event_type' => $notificationAction->event_type->value,
+                'channel' => $notificationAction->channel->value,
+                'enabled' => '0',
+                'delivery_url' => '',
+                'message_template' => '',
+            ])
+            ->assertRedirect(route('projects.settings.notifications', $project));
+
+        $this->assertFalse($notificationAction->fresh()->enabled);
+
+        $this->actingAs($user)
+            ->patch(route('projects.settings.notifications.update', [$project, $notificationAction]), [
+                'name' => $notificationAction->fresh()->name,
+                'event_type' => $notificationAction->fresh()->event_type->value,
+                'channel' => $notificationAction->fresh()->channel->value,
+                'enabled' => '1',
+                'delivery_url' => '',
+                'message_template' => '',
+            ])
+            ->assertRedirect(route('projects.settings.notifications', $project));
+
+        $this->assertTrue($notificationAction->fresh()->enabled);
+    }
+
+    /**
+     * Ensure project admins can replace stored delivery URLs when a new secret is submitted.
+     */
+    public function test_project_admins_can_replace_delivery_urls(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+        $notificationAction = NotificationAction::factory()
+            ->webhook()
+            ->for($project)
+            ->create([
+                'delivery_url' => 'https://hooks.example.test/kanbangit/original-secret',
+            ]);
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->patch(route('projects.settings.notifications.update', [$project, $notificationAction]), [
+                'name' => 'Primary webhook',
+                'event_type' => NotificationEventType::TicketStatusChanged->value,
+                'channel' => NotificationChannel::Webhook->value,
+                'enabled' => '1',
+                'delivery_url' => 'https://hooks.example.test/kanbangit/replaced-secret',
+                'message_template' => '',
+            ])
+            ->assertRedirect(route('projects.settings.notifications', $project));
+
+        $this->assertSame(
+            'https://hooks.example.test/kanbangit/replaced-secret',
+            $notificationAction->fresh()->delivery_url,
+        );
+    }
+
+    /**
+     * Ensure project admins can delete configured notification actions.
+     */
+    public function test_project_admins_can_delete_notification_actions(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+        $notificationAction = NotificationAction::factory()
+            ->for($project)
+            ->create([
+                'name' => 'Webhook alerts',
+            ]);
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->delete(route('projects.settings.notifications.destroy', [$project, $notificationAction]))
+            ->assertRedirect(route('projects.settings.notifications', $project))
+            ->assertSessionHas('status', 'Webhook alerts notification was deleted.');
+
+        $this->assertModelMissing($notificationAction);
+    }
+
+    /**
+     * Ensure validation errors are returned for notification action forms.
+     */
+    public function test_notification_action_validation_errors_are_returned_for_relevant_fields(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->from(route('projects.settings.notifications', $project))
+            ->post(route('projects.settings.notifications.store', $project), [
+                'name' => '',
+                'event_type' => 'invalid-event',
+                'channel' => NotificationChannel::Discord->value,
+                'enabled' => 'definitely-not-a-boolean',
+                'delivery_url' => 'not-a-url',
+                'message_template' => '',
+            ])
+            ->assertRedirect(route('projects.settings.notifications', $project))
+            ->assertSessionHasErrors([
+                'name',
+                'event_type',
+                'enabled',
+                'delivery_url',
+                'message_template',
+            ]);
+    }
+
+    /**
+     * Ensure non-admin project users cannot mutate notification actions.
+     */
+    public function test_non_admin_users_cannot_mutate_notification_actions(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+        $notificationAction = NotificationAction::factory()->for($project)->create();
+
+        $this->syncProjectPermissions($project, $user, ['view']);
+
+        $this->actingAs($user)
+            ->post(route('projects.settings.notifications.store', $project), [
+                'name' => 'Forbidden webhook',
+                'event_type' => NotificationEventType::TicketStatusChanged->value,
+                'channel' => NotificationChannel::Webhook->value,
+                'enabled' => '1',
+                'delivery_url' => 'https://hooks.example.test/kanbangit/forbidden-secret',
+                'message_template' => '',
+            ])
+            ->assertForbidden();
+
+        $this->actingAs($user)
+            ->patch(route('projects.settings.notifications.update', [$project, $notificationAction]), [
+                'name' => 'Forbidden update',
+                'event_type' => $notificationAction->event_type->value,
+                'channel' => $notificationAction->channel->value,
+                'enabled' => '0',
+                'delivery_url' => '',
+                'message_template' => '',
+            ])
+            ->assertForbidden();
+
+        $this->actingAs($user)
+            ->delete(route('projects.settings.notifications.destroy', [$project, $notificationAction]))
+            ->assertForbidden();
+    }
+
+    /**
+     * Ensure notification settings props never render stored secret URLs back to the browser.
+     */
+    public function test_notification_settings_do_not_render_secret_delivery_urls(): void
+    {
+        $user = User::factory()->create();
+        $project = Project::factory()->create();
+        NotificationAction::factory()
+            ->for($project)
+            ->create([
+                'delivery_url' => 'https://hooks.example.test/kanbangit/secret-token',
+            ]);
+
+        $this->syncProjectPermissions($project, $user, ['edit']);
+
+        $this->actingAs($user)
+            ->get(route('projects.settings.notifications', $project))
+            ->assertOk()
+            ->assertInertia(fn (Assert $page) => $page
+                ->component('projects/settings/Notifications')
+                ->where('notificationActions.0.has_delivery_url', true)
+                ->missing('notificationActions.0.delivery_url'),
+            );
+    }
+}