markRead() pruefte bisher nicht, ob die Benachrichtigung dem anfragenden Nutzer gehoert - jeder authentifizierte Nutzer konnte fremde Benachrichtigungen als gelesen markieren. Jetzt: 403 bei fremder Benachrichtigung, weiterhin erlaubt fuer eigene und Broadcast-Benachrichtigungen (userId = null). E2E-Regressionstest ergaenzt.
59 lines
1.6 KiB
TypeScript
59 lines
1.6 KiB
TypeScript
import {
|
|
ForbiddenException,
|
|
Injectable,
|
|
NotFoundException,
|
|
} from '@nestjs/common';
|
|
import { PrismaService } from '../prisma/prisma.service';
|
|
import { Notification, NotificationPriority } from '../../generated/prisma';
|
|
|
|
export interface CreateNotificationInput {
|
|
userId?: string;
|
|
priority: NotificationPriority;
|
|
message: string;
|
|
relatedType?: string;
|
|
relatedId?: string;
|
|
}
|
|
|
|
export interface NotificationFilter {
|
|
userId?: string;
|
|
unreadOnly?: boolean;
|
|
}
|
|
|
|
@Injectable()
|
|
export class NotificationsService {
|
|
constructor(private readonly prisma: PrismaService) {}
|
|
|
|
async record(input: CreateNotificationInput): Promise<Notification> {
|
|
return this.prisma.notification.create({ data: { ...input } });
|
|
}
|
|
|
|
async findAll(filter: NotificationFilter = {}): Promise<Notification[]> {
|
|
return this.prisma.notification.findMany({
|
|
where: {
|
|
OR: filter.userId
|
|
? [{ userId: filter.userId }, { userId: null }]
|
|
: undefined,
|
|
read: filter.unreadOnly ? false : undefined,
|
|
},
|
|
orderBy: { createdAt: 'desc' },
|
|
take: 100,
|
|
});
|
|
}
|
|
|
|
async markRead(id: string, actingUserId: string): Promise<Notification> {
|
|
const notification = await this.prisma.notification.findUnique({
|
|
where: { id },
|
|
});
|
|
if (!notification) {
|
|
throw new NotFoundException('Notification not found');
|
|
}
|
|
if (notification.userId !== null && notification.userId !== actingUserId) {
|
|
throw new ForbiddenException("Cannot modify another user's notification");
|
|
}
|
|
return this.prisma.notification.update({
|
|
where: { id },
|
|
data: { read: true },
|
|
});
|
|
}
|
|
}
|