refactor(backend): move notifications update endpoint to monitors route and handle security feedback

server/src/controllers/monitorController.ts

@@ -1,5 +1,5 @@
 import { Request, Response, NextFunction } from "express";
-
+import { updateNotificationsValidation } from "@/validation/notificationValidation.js";
 import {
 	getMonitorByIdParamValidation,
 	getMonitorByIdQueryValidation,
@@ -26,7 +26,7 @@ import {
 	requireUserId,
 } from "./controllerUtils.js";
 import { AppError } from "@/utils/AppError.js";
-import { IMonitorService } from "@/service/index.js";
+import { IMonitorService, INotificationsService } from "@/service/index.js";
 import { GeoContinent } from "@/types/geoCheck.js";
 
 const SERVICE_NAME = "monitorController";
@@ -34,9 +34,11 @@ class MonitorController {
 	static SERVICE_NAME = SERVICE_NAME;
 
 	private monitorService: IMonitorService;
+	private notificationsService: INotificationsService;
 
-	constructor(monitorService: IMonitorService) {
+	constructor(monitorService: IMonitorService, notificationsService: INotificationsService) {
 		this.monitorService = monitorService;
+		this.notificationsService = notificationsService;
 	}
 
 	get serviceName() {
@@ -439,6 +441,42 @@ class MonitorController {
 			next(error);
 		}
 	};
+
+	updateNotifications = async (req: Request, res: Response, next: NextFunction) => {
+		try {
+			updateNotificationsValidation.parse(req.body);
+
+			const teamId = requireTeamId(req.user?.teamId);
+			const { monitorIds, notificationIds, action } = req.body;
+
+			// Verify all requested notification IDs actually belong to this team
+			const teamNotifications = await this.notificationsService.findNotificationsByTeamId(teamId);
+			const validNotificationIds = teamNotifications.map((n) => n.id);
+			
+			const invalidIds = notificationIds.filter((id: string) => !validNotificationIds.includes(id));
+			if (invalidIds.length > 0) {
+				throw new AppError({ 
+					message: `The following notification IDs are invalid or do not belong to your team: ${invalidIds.join(", ")}`, 
+					status: 403 
+				});
+			}
+
+			const modifiedCount = await this.monitorService.updateNotifications({
+				teamId,
+				monitorIds,
+				notificationIds,
+				action
+			});
+
+			return res.status(200).json({
+				success: true,
+				msg: `Notifications updated successfully on ${modifiedCount} monitor(s)`,
+				data: { modifiedCount },
+			});
+		} catch (error) {
+			next(error);
+		}
+	};
 }
 
 export default MonitorController;