Merge pull request #226 from jonathanayubausara-a11y/fix/issue-19-notification-websocket

feat(backend): add real-time notification service with WebSocket push

Author: jobbykings

backend/src/controllers/notificationController.ts

@@ -1,21 +1,30 @@
-import { Request, Response } from "express";
+import { Response } from "express";
+import { AuthenticatedRequest } from "../middleware/auth";
 import { notificationService } from "../services/notificationService";
+import { NotificationType } from "../models/Notification";
 import logger from "../utils/logger";
 
 export class NotificationController {
-  public async getNotifications(req: Request, res: Response): Promise<void> {
+  public async getNotifications(req: AuthenticatedRequest, res: Response): Promise<void> {
     try {
-      const { userId } = req.params;
-      const { category, isRead, priority, limit, skip } = req.query;
+      const userId = req.user.id;
+      // Cast query params to plain strings to prevent NoSQL operator injection
+      const category = typeof req.query.category === 'string' ? req.query.category : undefined;
+      const type = typeof req.query.type === 'string' ? req.query.type : undefined;
+      const isRead = req.query.isRead;
+      const priority = typeof req.query.priority === 'string' ? req.query.priority : undefined;
+      const limit = req.query.limit ? parseInt(req.query.limit as string) : 20;
+      const skip = req.query.skip ? parseInt(req.query.skip as string) : 0;
 
       const result = await notificationService.getNotifications({
         userId,
         category: category as any,
+        type: type as any,
         isRead:
           isRead === "true" ? true : isRead === "false" ? false : undefined,
         priority: priority as any,
-        limit: limit ? parseInt(limit as string) : 20,
-        skip: skip ? parseInt(skip as string) : 0,
+        limit: isNaN(limit) ? 20 : limit,
+        skip: isNaN(skip) ? 0 : skip,
       });
 
       res.status(200).json({
@@ -30,10 +39,10 @@ export class NotificationController {
     }
   }
 
-  public async markAsRead(req: Request, res: Response): Promise<void> {
+  public async markAsRead(req: AuthenticatedRequest, res: Response): Promise<void> {
     try {
       const { notificationId } = req.params;
-      const { userId } = req.body; // In a real app, get from auth middleware
+      const userId = req.user.id;
 
       const success = await notificationService.markAsRead(
         notificationId,
@@ -48,9 +57,9 @@ export class NotificationController {
     }
   }
 
-  public async markAllAsRead(req: Request, res: Response): Promise<void> {
+  public async markAllAsRead(req: AuthenticatedRequest, res: Response): Promise<void> {
     try {
-      const { userId } = req.body;
+      const userId = req.user.id;
       const count = await notificationService.markAllAsRead(userId);
       res.status(200).json({ success: true, count });
     } catch (error) {
@@ -61,9 +70,9 @@ export class NotificationController {
     }
   }
 
-  public async getPreferences(req: Request, res: Response): Promise<void> {
+  public async getPreferences(req: AuthenticatedRequest, res: Response): Promise<void> {
     try {
-      const { userId } = req.params;
+      const userId = req.user.id;
       const preferences = await notificationService.getUserPreferences(userId);
       res.status(200).json({ success: true, data: preferences });
     } catch (error) {
@@ -74,10 +83,20 @@ export class NotificationController {
     }
   }
 
-  public async updatePreferences(req: Request, res: Response): Promise<void> {
+  public async updatePreferences(req: AuthenticatedRequest, res: Response): Promise<void> {
     try {
-      const { userId } = req.params;
-      const preferences = req.body;
+      const userId = req.user.id;
+      // Sanitize input to only whitelisted preference fields
+      const allowedFields = new Set([
+        'emailNotifications', 'pushNotifications', 'inAppNotifications',
+        'digestFrequency', 'quietHoursStart', 'quietHoursEnd',
+      ]);
+      const preferences: Record<string, unknown> = {};
+      for (const [key, value] of Object.entries(req.body)) {
+        if (allowedFields.has(key)) {
+          preferences[key] = value;
+        }
+      }
 
       await notificationService.setNotificationPreferences(userId, preferences);
       res.status(200).json({ success: true, message: "Preferences updated" });
@@ -89,10 +108,10 @@ export class NotificationController {
     }
   }
 
-  public async deleteNotification(req: Request, res: Response): Promise<void> {
+  public async deleteNotification(req: AuthenticatedRequest, res: Response): Promise<void> {
     try {
       const { notificationId } = req.params;
-      const { userId } = req.query;
+      const userId = req.user.id;
 
       const success = await notificationService.deleteNotification(
         notificationId,
@@ -106,6 +125,136 @@ export class NotificationController {
         .json({ success: false, message: "Internal server error" });
     }
   }
+
+  /// Get unread notification count for a user
+  public async getUnreadCount(req: AuthenticatedRequest, res: Response): Promise<void> {
+    try {
+      const userId = req.user.id;
+      const unreadCount = await notificationService.getUnreadCount(userId);
+      res.status(200).json({ success: true, data: { unreadCount } });
+    } catch (error) {
+      logger.error("Error in getUnreadCount controller:", error);
+      res
+        .status(500)
+        .json({ success: false, message: "Internal server error" });
+    }
+  }
+
+  /// Push a real-time notification via WebSocket
+  public async pushNotification(req: AuthenticatedRequest, res: Response): Promise<void> {
+    try {
+      const { userId, type, title, message, category, priority, actionUrl, metadata } = req.body;
+
+      // Enforce string types to prevent type confusion (e.g., array/object injection)
+      if (!userId || !type || !title || !message) {
+        res.status(400).json({
+          success: false,
+          message: "Missing required fields: userId, type, title, and message are required",
+        });
+        return;
+      }
+      if (typeof userId !== 'string' || typeof type !== 'string' || typeof title !== 'string' || typeof message !== 'string') {
+        res.status(400).json({
+          success: false,
+          message: "userId, type, title and message must be strings",
+        });
+        return;
+      }
+
+      // Validate and sanitize actionUrl and metadata before passing to service
+      const safeActionUrl = typeof actionUrl === 'string' ? actionUrl : undefined;
+      const safeMetadata = metadata && typeof metadata === 'object' && !Array.isArray(metadata)
+        ? metadata as Record<string, unknown>
+        : undefined;
+
+      const notification = await notificationService.createAndPushNotification(
+        userId,
+        type as NotificationType,
+        title,
+        message,
+        category || "system",
+        {
+          priority: priority || "medium",
+          actionUrl: safeActionUrl,
+          metadata: safeMetadata,
+          deliveryMethods: ["websocket"],
+        },
+      );
+
+      res.status(200).json({ success: true, data: notification });
+    } catch (error) {
+      logger.error("Error in pushNotification controller:", error);
+      res
+        .status(500)
+        .json({ success: false, message: "Internal server error" });
+    }
+  }
+
+  /// Admin announcement: push to all connected users or targeted roles
+  public async sendAnnouncement(req: AuthenticatedRequest, res: Response): Promise<void> {
+    try {
+      const { title, message, targetRoles, priority, actionUrl } = req.body;
+
+      if (!title || !message) {
+        res.status(400).json({
+          success: false,
+          message: "Title and message are required for announcements",
+        });
+        return;
+      }
+      if (typeof title !== 'string' || typeof message !== 'string') {
+        res.status(400).json({
+          success: false,
+          message: "title and message must be strings",
+        });
+        return;
+      }
+
+      // Validate that actionUrl is a string if provided
+      const safeActionUrl = typeof actionUrl === 'string' ? actionUrl : undefined;
+
+      const result = await notificationService.sendAnnouncement(
+        title,
+        message,
+        targetRoles || [],
+        {
+          priority: priority || "high",
+          actionUrl: safeActionUrl,
+        },
+      );
+
+      res.status(200).json({ success: true, data: result });
+    } catch (error) {
+      logger.error("Error in sendAnnouncement controller:", error);
+      res
+        .status(500)
+        .json({ success: false, message: "Internal server error" });
+    }
+  }
+
+  /// Deliver missed notifications to a user on reconnect
+  public async deliverMissedNotifications(
+    req: AuthenticatedRequest,
+    res: Response,
+  ): Promise<void> {
+    try {
+      const userId = req.user.id;
+
+      const delivered = await notificationService.deliverMissedNotifications(
+        userId,
+      );
+
+      res.status(200).json({ success: true, data: { delivered } });
+    } catch (error) {
+      logger.error(
+        "Error in deliverMissedNotifications controller:",
+        error,
+      );
+      res
+        .status(500)
+        .json({ success: false, message: "Internal server error" });
+    }
+  }
 }
 
 export const notificationController = new NotificationController();

backend/src/middleware/validation.ts

@@ -908,41 +908,21 @@ export const markAsReadSchema: ValidationSchema = {
 };
 
 export const markAllAsReadSchema: ValidationSchema = {
-  body: Joi.object({
-    userId: Joi.string()
-      .trim()
-      .min(1)
-      .required()
-      .messages({ "any.required": '"userId" is required' }),
-  }),
+  // userId is obtained from the authenticated request (req.user.id)
 };
 
 export const updatePreferencesSchema: ValidationSchema = {
-  params: Joi.object({
-    userId: Joi.string().trim().min(1).required(),
-  }),
   body: Joi.object({
     emailNotifications: Joi.boolean().optional(),
     pushNotifications: Joi.boolean().optional(),
     inAppNotifications: Joi.boolean().optional(),
-    digestFrequency: Joi.string().valid("daily", "weekly", "never").optional(),
-    quietHoursStart: Joi.string()
-      .regex(/^\d{2}:\d{2}$/)
-      .optional(),
-    quietHoursEnd: Joi.string()
-      .regex(/^\d{2}:\d{2}$/)
-      .optional(),
-  })
-    .min(1)
-    .messages({
-      "object.min": "At least one preference field must be provided",
-    }),
+    digestFrequency: Joi.string().valid('daily', 'weekly', 'never').optional(),
+    quietHoursStart: Joi.string().regex(/^\d{2}:\d{2}$/).optional(),
+    quietHoursEnd: Joi.string().regex(/^\d{2}:\d{2}$/).optional(),
+  }).min(1).unknown(false).messages({ 'object.min': 'At least one preference field must be provided' }),
 };
 
 export const getNotificationsSchema: ValidationSchema = {
-  params: Joi.object({
-    userId: Joi.string().trim().min(1).required(),
-  }),
   query: Joi.object({
     page: Joi.number().integer().min(1).optional(),
     limit: Joi.number().integer().min(1).max(100).optional(),

backend/src/models/Notification.ts

@@ -1,19 +1,32 @@
 import mongoose, { Document, Schema, Model } from "mongoose";
 
+export type NotificationType =
+  | "credential_issued"
+  | "enrollment_confirmed"
+  | "announcement"
+  | "course_update"
+  | "achievement_earned"
+  | "assignment_graded"
+  | "payment_confirmed"
+  | "system_alert";
+
 export interface INotification extends Document {
   _id: string;
   userId: string;
+  type: NotificationType;
   title: string;
   message: string;
   category: "course" | "message" | "system" | "achievement";
   isRead: boolean;
   isDelivered: boolean;
+  deliveredAt?: Date;
   priority: "low" | "medium" | "high";
   deliveryMethods: ("email" | "push" | "websocket")[];
   scheduledTime?: Date;
   sentTime?: Date;
   actionUrl?: string;
   metadata?: Record<string, any>;
+  targetRoles?: string[];
   createdAt: Date;
   updatedAt: Date;
 }
@@ -25,6 +38,21 @@ const NotificationSchema: Schema = new Schema(
       required: true,
       index: true,
     },
+    type: {
+      type: String,
+      enum: [
+        "credential_issued",
+        "enrollment_confirmed",
+        "announcement",
+        "course_update",
+        "achievement_earned",
+        "assignment_graded",
+        "payment_confirmed",
+        "system_alert",
+      ],
+      required: true,
+      index: true,
+    },
     title: {
       type: String,
       required: true,
@@ -48,6 +76,9 @@ const NotificationSchema: Schema = new Schema(
       type: Boolean,
       default: false,
     },
+    deliveredAt: {
+      type: Date,
+    },
     priority: {
       type: String,
       enum: ["low", "medium", "high"],
@@ -72,6 +103,11 @@ const NotificationSchema: Schema = new Schema(
     metadata: {
       type: Schema.Types.Mixed,
     },
+    targetRoles: [
+      {
+        type: String,
+      },
+    ],
   },
   {
     timestamps: true,
@@ -81,10 +117,16 @@ const NotificationSchema: Schema = new Schema(
 // Indexes for common queries
 NotificationSchema.index({ userId: 1, createdAt: -1 });
 NotificationSchema.index({ userId: 1, isRead: 1 });
+NotificationSchema.index({ userId: 1, type: 1 });
+NotificationSchema.index({ type: 1, createdAt: -1 });
 NotificationSchema.index(
   { scheduledTime: 1 },
   { partialFilterExpression: { isDelivered: false } },
 );
+NotificationSchema.index(
+  { userId: 1, isDelivered: 1 },
+  { partialFilterExpression: { isDelivered: false } },
+);
 
 export const Notification: Model<INotification> = mongoose.model<INotification>(
   "Notification",