Merge pull request #2657 from bluewave-labs/fix/notification-routes

fix auth for notification controller

server/controllers/notificationController.js

@@ -39,9 +39,19 @@ class NotificationController {
 			});
 
 			const body = req.body;
-			const { _id, teamId } = req.user;
-			body.userId = _id;
+
+			const teamId = req?.user?.teamId;
+			if (!teamId) {
+				throw new Error("No team ID in request");
+			}
+
+			const userId = req?.user?._id;
+			if (!userId) {
+				throw new Error("No user ID in request");
+			}
+			body.userId = userId;
 			body.teamId = teamId;
+
 			const notification = await this.db.createNotification(body);
 			return res.success({
 				msg: "Notification created successfully",
@@ -54,7 +64,13 @@ class NotificationController {
 
 	getNotificationsByTeamId = asyncHandler(
 		async (req, res, next) => {
-			const notifications = await this.db.getNotificationsByTeamId(req.user.teamId);
+			const teamId = req?.user?.teamId;
+			if (!teamId) {
+				throw new Error("No team ID in request");
+			}
+
+			const notifications = await this.db.getNotificationsByTeamId(teamId);
+
 			return res.success({
 				msg: "Notifications fetched successfully",
 				data: notifications,
@@ -66,6 +82,18 @@ class NotificationController {
 
 	deleteNotification = asyncHandler(
 		async (req, res, next) => {
+			const teamId = req?.user?.teamId;
+			if (!teamId) {
+				throw new Error("No team ID in request");
+			}
+
+			const notification = await this.db.getNotificationById(req.params.id);
+			if (!notification.teamId.equals(teamId)) {
+				const error = new Error("Unauthorized");
+				error.status = 403;
+				throw error;
+			}
+
 			await this.db.deleteNotificationById(req.params.id);
 			return res.success({
 				msg: "Notification deleted successfully",
@@ -78,6 +106,17 @@ class NotificationController {
 	getNotificationById = asyncHandler(
 		async (req, res, next) => {
 			const notification = await this.db.getNotificationById(req.params.id);
+
+			const teamId = req?.user?.teamId;
+			if (!teamId) {
+				throw new Error("No team ID in request");
+			}
+
+			if (!notification.teamId.equals(teamId)) {
+				const error = new Error("Unauthorized");
+				error.status = 403;
+				throw error;
+			}
 			return res.success({
 				msg: "Notification fetched successfully",
 				data: notification,
@@ -93,10 +132,23 @@ class NotificationController {
 				abortEarly: false,
 			});
 
-			const notification = await this.db.editNotification(req.params.id, req.body);
+			const teamId = req?.user?.teamId;
+			if (!teamId) {
+				throw new Error("No team ID in request");
+			}
+
+			const notification = await this.db.getNotificationById(req.params.id);
+
+			if (!notification.teamId.equals(teamId)) {
+				const error = new Error("Unauthorized");
+				error.status = 403;
+				throw error;
+			}
+
+			const editedNotification = await this.db.editNotification(req.params.id, req.body);
 			return res.success({
 				msg: "Notification updated successfully",
-				data: notification,
+				data: editedNotification,
 			});
 		},
 		SERVICE_NAME,
@@ -105,8 +157,20 @@ class NotificationController {
 
 	testAllNotifications = asyncHandler(
 		async (req, res, next) => {
-			const { monitorId } = req.body;
+			const monitorId = req.body.monitorId;
+			const teamId = req?.user?.teamId;
+			if (!teamId) {
+				throw new Error("No team ID in request");
+			}
+
 			const monitor = await this.db.getMonitorById(monitorId);
+
+			if (!monitor.teamId.equals(teamId)) {
+				const error = new Error("Unauthorized");
+				error.status = 403;
+				throw error;
+			}
+
 			const notifications = monitor.notifications;
 			if (notifications.length === 0) throw new Error("No notifications");
 			const result = await this.notificationService.testAllNotifications(notifications);

server/db/mongo/modules/notificationModule.js

@@ -74,6 +74,11 @@ const deleteNotificationsByMonitorId = async (monitorId) => {
 
 const deleteNotificationById = async (id) => {
 	try {
+		const notification = await Notification.findById(id);
+		if (!notification) {
+			throw new Error("Notification not found");
+		}
+
 		const result = await Notification.findByIdAndDelete(id);
 		await Monitor.updateMany({ notifications: id }, { $pull: { notifications: id } });
 		return result;

server/routes/notificationRoute.js

@@ -1,8 +1,4 @@
 import { Router } from "express";
-import { verifyJWT } from "../middleware/verifyJWT.js";
-import { verifyOwnership } from "../middleware/verifyOwnership.js";
-import { verifyTeamAccess } from "../middleware/verifyTeamAccess.js";
-import Notification from "../db/models/Notification.js";
 class NotificationRoutes {
 	constructor(notificationController) {
 		this.router = Router();
@@ -11,8 +7,6 @@ class NotificationRoutes {
 	}
 
 	initializeRoutes() {
-		this.router.use(verifyJWT);
-
 		this.router.post("/", this.notificationController.createNotification);
 
 		this.router.post("/test/all", this.notificationController.testAllNotifications);
@@ -20,9 +14,9 @@ class NotificationRoutes {
 
 		this.router.get("/team", this.notificationController.getNotificationsByTeamId);
 
-		this.router.delete("/:id", verifyOwnership(Notification, "id"), this.notificationController.deleteNotification);
 		this.router.get("/:id", this.notificationController.getNotificationById);
-		this.router.put("/:id", verifyTeamAccess(Notification, "id"), this.notificationController.editNotification);
+		this.router.delete("/:id", this.notificationController.deleteNotification);
+		this.router.put("/:id", this.notificationController.editNotification);
 	}
 
 	getRouter() {