fix: handle malformed IDs and allow empty set action

server/src/controllers/notificationController.ts

@@ -164,14 +164,20 @@ class NotificationController {
 				throw new AppError({ message: "Monitor IDs are required", status: 400 });
 			}
 
-			if (!notificationIds || !Array.isArray(notificationIds) || notificationIds.length === 0) {
-				throw new AppError({ message: "Notification IDs are required", status: 400 });
+			if (!notificationIds || !Array.isArray(notificationIds)) {
+				throw new AppError({ message: "Notification IDs must be an array", status: 400 });
 			}
 
 			if (!action || !["add", "remove", "set"].includes(action)) {
 				throw new AppError({ message: "Action must be 'add', 'remove', or 'set'", status: 400 });
 			}
 
+			// "add" and "remove" need at least one notification ID
+			// "set" can be empty (to clear all notifications from monitors)
+			if (notificationIds.length === 0 && action !== "set") {
+				throw new AppError({ message: "Notification IDs are required for add/remove actions", status: 400 });
+			}
+
 			const modifiedCount = await this.monitorsRepository.bulkUpdateNotifications(monitorIds, notificationIds, action, teamId);
 
 			return res.status(200).json({

server/src/repositories/monitors/MongoMonitorsRepository.ts

@@ -304,7 +304,12 @@ class MongoMonitorsRepository implements IMonitorsRepository {
 		action: "add" | "remove" | "set",
 		teamId: string
 	): Promise<number> => {
-		const objectIds = monitorIds.map((id) => new mongoose.Types.ObjectId(id));
+		let objectIds;
+		try {
+			objectIds = monitorIds.map((id) => new mongoose.Types.ObjectId(id));
+		} catch {
+			throw new AppError({ message: "One or more monitor IDs are invalid", status: 400 });
+		}
 		const filter = { _id: { $in: objectIds }, teamId: new mongoose.Types.ObjectId(teamId) };
 
 		let update;