From 8eca81c8bef656e8be7575dac121d3b16a6f082b Mon Sep 17 00:00:00 2001 From: ashu130698 Date: Thu, 5 Mar 2026 18:02:55 +0530 Subject: [PATCH] fix: handle malformed IDs and allow empty set action --- server/src/controllers/notificationController.ts | 10 ++++++++-- .../repositories/monitors/MongoMonitorsRepository.ts | 7 ++++++- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/server/src/controllers/notificationController.ts b/server/src/controllers/notificationController.ts index fe8f552a9..403375508 100644 --- a/server/src/controllers/notificationController.ts +++ b/server/src/controllers/notificationController.ts @@ -164,14 +164,20 @@ class NotificationController { throw new AppError({ message: "Monitor IDs are required", status: 400 }); } - if (!notificationIds || !Array.isArray(notificationIds) || notificationIds.length === 0) { - throw new AppError({ message: "Notification IDs are required", status: 400 }); + if (!notificationIds || !Array.isArray(notificationIds)) { + throw new AppError({ message: "Notification IDs must be an array", status: 400 }); } if (!action || !["add", "remove", "set"].includes(action)) { throw new AppError({ message: "Action must be 'add', 'remove', or 'set'", status: 400 }); } + // "add" and "remove" need at least one notification ID + // "set" can be empty (to clear all notifications from monitors) + if (notificationIds.length === 0 && action !== "set") { + throw new AppError({ message: "Notification IDs are required for add/remove actions", status: 400 }); + } + const modifiedCount = await this.monitorsRepository.bulkUpdateNotifications(monitorIds, notificationIds, action, teamId); return res.status(200).json({ diff --git a/server/src/repositories/monitors/MongoMonitorsRepository.ts b/server/src/repositories/monitors/MongoMonitorsRepository.ts index 53d686554..529ce2413 100644 --- a/server/src/repositories/monitors/MongoMonitorsRepository.ts +++ b/server/src/repositories/monitors/MongoMonitorsRepository.ts @@ -304,7 +304,12 @@ class MongoMonitorsRepository implements IMonitorsRepository { action: "add" | "remove" | "set", teamId: string ): Promise => { - const objectIds = monitorIds.map((id) => new mongoose.Types.ObjectId(id)); + let objectIds; + try { + objectIds = monitorIds.map((id) => new mongoose.Types.ObjectId(id)); + } catch { + throw new AppError({ message: "One or more monitor IDs are invalid", status: 400 }); + } const filter = { _id: { $in: objectIds }, teamId: new mongoose.Types.ObjectId(teamId) }; let update;