feat(notifications): User Notifications

backend/src/server/routes/index.ts

@@ -218,6 +218,9 @@ import { kmsServiceFactory } from "@app/services/kms/kms-service";
 import { microsoftTeamsIntegrationDALFactory } from "@app/services/microsoft-teams/microsoft-teams-integration-dal";
 import { microsoftTeamsServiceFactory } from "@app/services/microsoft-teams/microsoft-teams-service";
 import { projectMicrosoftTeamsConfigDALFactory } from "@app/services/microsoft-teams/project-microsoft-teams-config-dal";
+import { notificationQueueServiceFactory } from "@app/services/notification/notification-queue";
+import { notificationServiceFactory } from "@app/services/notification/notification-service";
+import { userNotificationDALFactory } from "@app/services/notification/user-notification-dal";
 import { incidentContactDALFactory } from "@app/services/org/incident-contacts-dal";
 import { orgBotDALFactory } from "@app/services/org/org-bot-dal";
 import { orgDALFactory } from "@app/services/org/org-dal";
@@ -418,6 +421,7 @@ export const registerRoutes = async (
   const telemetryDAL = telemetryDALFactory(db);
   const appConnectionDAL = appConnectionDALFactory(db);
   const secretSyncDAL = secretSyncDALFactory(db, folderDAL);
+  const userNotificationDAL = userNotificationDALFactory(db);
 
   // ee db layer ops
   const permissionDAL = permissionDALFactory(db);
@@ -563,6 +567,13 @@ export const registerRoutes = async (
     auditLogStreamDAL
   });
 
+  const notificationQueue = await notificationQueueServiceFactory({
+    userNotificationDAL,
+    queueService
+  });
+
+  const notificationService = notificationServiceFactory({ notificationQueue, userNotificationDAL });
+
   const auditLogService = auditLogServiceFactory({ auditLogDAL, permissionService, auditLogQueue });
   const auditLogStreamService = auditLogStreamServiceFactory({
     licenseService,
@@ -1368,7 +1379,8 @@ export const registerRoutes = async (
     kmsService,
     groupDAL,
     microsoftTeamsService,
-    projectMicrosoftTeamsConfigDAL
+    projectMicrosoftTeamsConfigDAL,
+    notificationService
   });
 
   const secretReplicationService = secretReplicationServiceFactory({
@@ -1666,7 +1678,8 @@ export const registerRoutes = async (
     secretVersionV2DAL: secretVersionV2BridgeDAL,
     identityUniversalAuthClientSecretDAL: identityUaClientSecretDAL,
     serviceTokenService,
-    orgService
+    orgService,
+    userNotificationDAL
   });
 
   const dailyReminderQueueService = dailyReminderQueueServiceFactory({
@@ -2094,7 +2107,8 @@ export const registerRoutes = async (
     secretScanningV2: secretScanningV2Service,
     reminder: reminderService,
     bus: eventBusService,
-    sse: sseService
+    sse: sseService,
+    notification: notificationService
   });
 
   const cronJobs: CronJob[] = [];

backend/src/server/routes/v1/index.ts

@@ -33,6 +33,7 @@ import { registerIntegrationAuthRouter } from "./integration-auth-router";
 import { registerIntegrationRouter } from "./integration-router";
 import { registerInviteOrgRouter } from "./invite-org-router";
 import { registerMicrosoftTeamsRouter } from "./microsoft-teams-router";
+import { registerNotificationRouter } from "./notification-router";
 import { registerOrgAdminRouter } from "./org-admin-router";
 import { registerOrgRouter } from "./organization-router";
 import { registerPasswordRouter } from "./password-router";
@@ -83,6 +84,7 @@ export const registerV1Routes = async (server: FastifyZodProvider) => {
   await server.register(registerAdminRouter, { prefix: "/admin" });
   await server.register(registerOrgAdminRouter, { prefix: "/organization-admin" });
   await server.register(registerUserRouter, { prefix: "/user" });
+  await server.register(registerNotificationRouter, { prefix: "/notifications" });
   await server.register(registerInviteOrgRouter, { prefix: "/invite-org" });
   await server.register(registerUserActionRouter, { prefix: "/user-action" });
   await server.register(registerSecretImportRouter, { prefix: "/secret-imports" });

backend/src/server/routes/v1/notification-router.ts

@@ -0,0 +1,106 @@
+import { z } from "zod";
+
+import { UserNotificationsSchema } from "@app/db/schemas/user-notifications";
+import { UnauthorizedError } from "@app/lib/errors";
+import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+export const registerNotificationRouter = async (server: FastifyZodProvider) => {
+  server.route({
+    url: "/user",
+    config: {
+      rateLimit: readLimit
+    },
+    method: "GET",
+    schema: {
+      response: {
+        200: z.object({
+          notifications: UserNotificationsSchema.array()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      if (req.auth.authMode !== AuthMode.JWT) {
+        throw new UnauthorizedError({ message: "This endpoint can only be accessed by users" });
+      }
+
+      const notifications = await server.services.notification.listUserNotifications({ userId: req.auth.userId });
+
+      return { notifications };
+    }
+  });
+
+  server.route({
+    url: "/user/:notificationId",
+    config: {
+      rateLimit: writeLimit
+    },
+    method: "DELETE",
+    schema: {
+      params: z.object({
+        notificationId: z.string()
+      }),
+      response: {
+        200: z.object({
+          notification: UserNotificationsSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      if (req.auth.authMode !== AuthMode.JWT) {
+        throw new UnauthorizedError({ message: "This endpoint can only be accessed by users" });
+      }
+
+      const notification = await server.services.notification.deleteUserNotification({
+        notificationId: req.params.notificationId,
+        userId: req.auth.userId
+      });
+
+      return { notification };
+    }
+  });
+
+  server.route({
+    url: "/user/:notificationId/mark-as-read",
+    config: {
+      rateLimit: writeLimit
+    },
+    method: "POST",
+    schema: {
+      params: z.object({
+        notificationId: z.string()
+      })
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      if (req.auth.authMode !== AuthMode.JWT) {
+        throw new UnauthorizedError({ message: "This endpoint can only be accessed by users" });
+      }
+
+      await server.services.notification.markUserNotificationAsRead({
+        notificationId: req.params.notificationId,
+        userId: req.auth.userId
+      });
+    }
+  });
+
+  // Mark all user notifications as read
+  server.route({
+    url: "/user/mark-as-read",
+    config: {
+      rateLimit: writeLimit
+    },
+    method: "POST",
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      if (req.auth.authMode !== AuthMode.JWT) {
+        throw new UnauthorizedError({ message: "This endpoint can only be accessed by users" });
+      }
+
+      await server.services.notification.markUserNotificationsAsRead({ userId: req.auth.userId });
+    }
+  });
+};