add notification swagger; use params for notification GET; permission update

sshugsc · sshugsc · commit d6601642b295 · 2025-06-03T13:43:54.000-07:00
diff --git a/app/routes/notification/notification.js b/app/routes/notification/notification.js
@@ -5,6 +5,7 @@ const db = require('../../models');
 const logger = require('../../log');
 
 const {getUserProjects, isAdmin} = require('../../libs/helperFunctions');
+const {NOTIFICATION_EVENT} = require('../../constants');
 
 const router = express.Router({mergeParams: true});
 
@@ -18,6 +19,9 @@ const pairs = {
 // for each entry in pairs, assumes the key-named value in
 // req.body is the ident, and gets the id of the corresponding object.
 router.use(async (req, res, next) => {
+  if (req.method === 'GET') {
+    req.body = req.query;
+  }
   const operations = [];
 
   for (const [key, value] of Object.entries(pairs)) {
@@ -95,9 +99,10 @@ router.route('/')
     }
   })
   .post(async (req, res) => {
-    // TODO: Delete admin check once notification is properly implemented/tested
-    if (!isAdmin(req.user)) {
-      return res.status(HTTP_STATUS.FORBIDDEN);
+    if (req.user.id !== req.body.user_id && !isAdmin(req.user)) {
+      return res.status(HTTP_STATUS.FORBIDDEN).json({
+        error: {message: 'only user self and admin can create notification'},
+      });
     }
 
     if (req.body.user_id && req.body.user_group_id) {
@@ -124,12 +129,18 @@ router.route('/')
       });
     }
 
-    if (!req.body.event_type) {
+    if (!req.body.eventType) {
       return res.status(HTTP_STATUS.CONFLICT).json({
         error: {message: 'Event type must be specified'},
       });
     }
 
+    if (!Object.values(NOTIFICATION_EVENT).includes(req.body.eventType)) {
+      return res.status(HTTP_STATUS.CONFLICT).json({
+        error: {message: 'Event type must be reportCreated or userBound'},
+      });
+    }
+
     // check the given user, if any, is bound to the given project (or is admin)
     if (req.body.user_id) {
       let notifUser;
@@ -174,7 +185,7 @@ router.route('/')
           projectId: req.body.project_id,
           userId: req.body.user_id ? req.body.user_id : null,
           userGroupId: req.body.user_group_id ? req.body.user_group_id : null,
-          eventType: req.body.event_type,
+          eventType: req.body.eventType,
           templateId: req.body.template_id,
         },
       });
@@ -197,7 +208,7 @@ router.route('/')
     try {
       notification = await db.models.notification.findOne({
         where: {ident: req.body.ident},
-        attributes: ['id', 'ident'],
+        attributes: ['id', 'ident', 'userId'],
       });
     } catch (error) {
       logger.error(`Error while trying to find notification ${error}`);
@@ -213,6 +224,12 @@ router.route('/')
       });
     }
 
+    if (req.user.id !== notification.userId && !isAdmin(req.user)) {
+      return res.status(HTTP_STATUS.FORBIDDEN).json({
+        error: {message: 'only user self and admin can delete notification'},
+      });
+    }
+
     try {
       await notification.destroy();
       return res.status(HTTP_STATUS.NO_CONTENT).send();
diff --git a/app/routes/report/report.js b/app/routes/report/report.js
@@ -332,17 +332,6 @@ router.route('/')
       report.projects.forEach((project) => {
         projectIdArray.push(project.project_id);
       });
-      const userGroup = await db.models.userGroup.findOne({where: {name: 'admin'}});
-
-      const notify = await db.models.notification.findOrCreate({
-        where: {
-          userId: req.user.id,
-          eventType: NOTIFICATION_EVENT.REPORT_CREATED,
-          templateId: report.templateId,
-          projectId: report.projects[0].project_id,
-          userGroupId: userGroup.id,
-        },
-      });
 
       await email.notifyUsers(
         `Report Created: ${req.body.patientId} ${req.body.template}`,
@@ -351,9 +340,15 @@ router.route('/')
         Created by: ${req.user.firstName} ${req.user.lastName}
         Project: ${req.body.project}
         Template: ${req.body.template}
-        Patient: ${req.body.patientId}`,
+        Patient: ${req.body.patientId}
+
+        You're receiving this email because you have email notifications enabled in your account settings.
+        If you no longer wish to receive these notifications, you can unsubscribe at any time by visiting your User Profile and turning off the "Allow email notifications" option.`,
         {
-          id: notify[0].id,
+          userId: req.user.id,
+          eventType: NOTIFICATION_EVENT.REPORT_CREATED,
+          templateId: report.templateId,
+          projectId: report.projects[0].project_id,
         },
       );
 
diff --git a/app/routes/report/reportUser.js b/app/routes/report/reportUser.js
@@ -134,27 +134,6 @@ router.route('/')
       const reportProject = await db.models.reportProject.findOne({where: {report_id: req.report.id}});
       const project = await db.models.project.findOne({where: {id: reportProject.project_id}});
       const template = await db.models.template.findOne({where: {id: report.templateId}});
-      const userGroup = await db.models.userGroup.findOne({where: {name: 'admin'}});
-
-      const notifyReq = await db.models.notification.findOrCreate({
-        where: {
-          userId: req.user.id,
-          eventType: NOTIFICATION_EVENT.USER_BOUND,
-          templateId: report.templateId,
-          projectId: reportProject.project_id,
-          userGroupId: userGroup.id,
-        },
-      });
-
-      const notifyBinding = await db.models.notification.findOrCreate({
-        where: {
-          userId: bindUser.id,
-          eventType: NOTIFICATION_EVENT.USER_BOUND,
-          templateId: report.templateId,
-          projectId: reportProject.project_id,
-          userGroupId: userGroup.id,
-        },
-      });
 
       // Try sending email
       try {
@@ -163,9 +142,15 @@ router.route('/')
           `User ${bindUser.firstName} ${bindUser.lastName} has been bound to report ${req.report.ident} as ${role}.
           Report Type: ${template.name}
           Patient Id: ${report.patientId}
-          Project: ${project.name}`,
+          Project: ${project.name}
+
+          You're receiving this email because you have email notifications enabled in your account settings.
+          If you no longer wish to receive these notifications, you can unsubscribe at any time by visiting your User Profile and turning off the "Allow email notifications" option.`,
           {
-            id: [notifyReq[0].id, notifyBinding[0].id],
+            userId: [req.user.id, bindUser.id],
+            eventType: NOTIFICATION_EVENT.USER_BOUND,
+            templateId: report.templateId,
+            projectId: reportProject.project_id,
           },
         );
         logger.info('Email sent successfully');
diff --git a/app/routes/swagger/schemas.js b/app/routes/swagger/schemas.js
@@ -10,7 +10,7 @@ const schemas = {};
 const ID_FIELDS = [
   'germlineReportId', 'user_id', 'createdBy_id', 'addedBy_id', 'variantId',
   'gene1Id', 'gene2Id', 'reviewerId', 'biofxAssignedId', 'logoId', 'headerId', 'templateId',
-  'product_id', 'addedById',
+  'product_id', 'addedById', 'userId', 'projectId', 'userGroupId',
 ];
 const PUBLIC_VIEW_EXCLUDE = [...ID_FIELDS, 'id', 'reportId', 'geneId', 'deletedAt', 'updatedBy'];
 const GENERAL_EXCLUDE = REPORT_EXCLUDE.concat(ID_FIELDS);
@@ -207,6 +207,42 @@ Object.assign(schemas.germlineReportUserCreate.properties, {
   },
 });
 
+// notification create
+schemas.notificationAssociations = schemaGenerator(db.models.notification, {
+  isJsonSchema: false, title: 'notificationAssociations', exclude: [...GENERAL_EXCLUDE], associations: true, includeAssociations: ['project', 'template', 'user'],
+});
+
+Object.assign(schemas.notificationCreate.properties, {
+  eventType: {
+    type: 'string',
+    description: 'either reportCreated or userBound',
+  },
+  user: {
+    type: 'string',
+    format: 'uuid',
+    description: 'ident of user to notify, either user or user_group should be specified',
+  },
+  user_group: {
+    type: 'string',
+    format: 'uuid',
+    description: 'ident of user group to notify, either user or user_group should be specified',
+  },
+  project: {
+    type: 'string',
+    format: 'uuid',
+    description: 'ident of project that user or user group want to be notified',
+  },
+  template: {
+    type: 'string',
+    format: 'uuid',
+    description: 'ident of template that user or user group want to be notified',
+  },
+});
+
+Object.assign(schemas.notificationCreate, {
+  required: ['project', 'template', 'eventType'],
+});
+
 // *PUT request body*
 
 // add template name to report update
diff --git a/app/routes/swagger/swagger.json b/app/routes/swagger/swagger.json
@@ -7882,6 +7882,164 @@
           }
         }
       }
+    },
+    "/notification/notifications": {
+      "get": {
+        "summary": "Get Notifications",
+        "description": "Retrieve all notifications",
+        "parameters": [
+          {
+            "name": "user",
+            "in": "query",
+            "required": false,
+            "description": "Filter notifications by user ident",
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "name": "user_group",
+            "in": "query",
+            "required": false,
+            "description": "Filter templates by user_group ident",
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "name": "project",
+            "in": "query",
+            "required": false,
+            "description": "Filter templates by project ident",
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "name": "template",
+            "in": "query",
+            "required": false,
+            "description": "Filter templates by template ident",
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "tags": [
+          "Notifications"
+        ],
+        "security": [
+          {
+            "basicAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Returns an array of all notifications",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/notificationAssociations"
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/UnauthorizedError"
+          }
+        }
+      },
+      "post": {
+        "summary": "Create Notification",
+        "description": "Upload a new notiifcation",
+        "parameters": [],
+        "requestBody": {
+          "description": "Notification data",
+          "required": true,
+          "content": {
+            "multipart/form-data": {
+              "schema": {
+                "$ref": "#/components/schemas/notificationCreate"
+              }
+            }
+          }
+        },
+        "tags": [
+          "Notifications"
+        ],
+        "security": [
+          {
+            "basicAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Returns the details of the created notifcation",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/notificationAssociations"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/UnauthorizedError"
+          },
+          "409": {
+            "description": "Must specify project, template, eventType, and user or user_group"
+          }
+        }
+      },
+      "delete": {
+        "summary": "Delete Notification",
+        "description": "Removes the specified notification",
+        "requestBody": {
+          "description": "Notification data",
+          "required": true,
+          "content": {
+            "multipart/form-data": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "ident": {
+                    "type": "string",
+                    "format": "uuid",
+                    "description": "The ident of the notification"
+                  }
+                },
+                "required": ["ident"]
+              }
+            }
+          }
+        },
+        "tags": [
+          "Notifications"
+        ],
+        "security": [
+          {
+            "basicAuth": []
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No content"
+          },
+          "401": {
+            "$ref": "#/components/responses/UnauthorizedError"
+          },
+          "404": {
+            "description": "Notification not found"
+          }
+        }
+      }
     }
   },
   "externalDocs": {
