a36a4cac6b
Validation: the dump validators refuse the nulls their shared types don't allow (a null title or note on creation, a null URL on edit); a playlist title of spaces is refused and titles are stored trimmed; usernames and emails are checked by the same USERNAME_RE and EMAIL_RE in shared/validation.ts on sign-up, on PATCH /api/users/me (which checked other limits) and in the sign-up form. Mentions are read by shared/mention.ts's mentionedUsernames, which skips code and URLs as Markdown shows them: https://mastodon.social/@bob or a `@bob` in code notified bob; the editor's suggestions derive their trigger from the same pattern instead of a copy. Following an unknown user is a 404 rather than a foreign-key 500, and following a private playlist a 404 rather than a 403 that confirmed it exists. `ws` and `emojibase` are reserved category slugs, since the server answers them before the app. GET /api/users/me no longer turns every error into a 500. Dead code goes: adminOnlyMiddleware, verifyEmailTransport, listUsers, deleteUser with disconnectUser and the force_logout message only it sent, PATCH /api/notifications/:id/read (with markOneRead), isSlugAvailable, the unreachable 500 in fetchComment, and the `if (!ctx.state.user)` checks behind authMiddleware. 214 backend and 627 frontend tests pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
49 lines
1.6 KiB
TypeScript
49 lines
1.6 KiB
TypeScript
/**
|
|
* Serves the caller's own notifications to the client's `/notifications`
|
|
* page, which marks them all read when it opens. New ones arrive over the
|
|
* WebSocket instead, as `notification_created`.
|
|
*
|
|
* - `GET /api/notifications?page=&limit=` — signed in. Answers a page of them,
|
|
* newest first.
|
|
* - `POST /api/notifications/read-all` — signed in. Marks them all read.
|
|
*
|
|
* @module
|
|
*/
|
|
|
|
import { Router } from "@oak/oak";
|
|
import { type APIResponse, type PaginatedData } from "../../shared/api.ts";
|
|
import type { Notification } from "../../shared/notification.ts";
|
|
import { parsePagination } from "../lib/pagination.ts";
|
|
import { type AuthContext, authMiddleware } from "../middleware/auth.ts";
|
|
import {
|
|
getNotificationsForUser,
|
|
markAllRead,
|
|
} from "../services/notification-service.ts";
|
|
|
|
/**
|
|
* Mounted by `api/main.ts` behind the error, Open Graph and CORS middleware.
|
|
* An `APIException` thrown by a handler becomes the JSON error response there.
|
|
*/
|
|
const router: Router = new Router({ prefix: "/api/notifications" });
|
|
|
|
router.get("/", authMiddleware, (ctx: AuthContext) => {
|
|
const { page, limit } = parsePagination(ctx.request.url.searchParams);
|
|
const { items, hasMore } = getNotificationsForUser(
|
|
ctx.state.user.userId,
|
|
page,
|
|
limit,
|
|
);
|
|
const responseBody: APIResponse<PaginatedData<Notification>> = {
|
|
success: true,
|
|
data: { items, hasMore },
|
|
};
|
|
ctx.response.body = responseBody;
|
|
});
|
|
|
|
router.post("/read-all", authMiddleware, (ctx: AuthContext) => {
|
|
markAllRead(ctx.state.user.userId);
|
|
ctx.response.status = 204;
|
|
});
|
|
|
|
export default router;
|