fix: secure send_notification endpoint and ensure correct user association #1190
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR addresses a security issue where the
/api/v1/notifications/send
endpoint lacks authorization, allowing anyone to send notifications. As a result, theuser_id
in the notification table is set toNULL
, preventing users from retrieving their notifications correctly.
Related Issue (Link to issue ticket)
Motivation and Context
🚀 Security Fix: Ensures that only authenticated users can send notifications.
🔍 Data Consistency: Prevents
NULL
values in theuser_id
field.🛠 User Experience: Ensures that users see the correct notifications associated with their accounts.
How Has This Been Tested?
The changes have been tested using unit tests and Postman
Screenshots (if appropriate - Postman, etc):
Types of changes
Checklist: