Files
vikunja/pkg/models/notifications_refresh_test.go
T
kolaenteandkolaente 0638200ac0 fix(notifications): check project access when reading notifications
Notification rows outlived access. A subscription survives a project being
unshared, so every notification already written for a revoked user stayed
readable — comment bodies, task titles, project names, deletion notices. The
read paths filtered on notifiable_id alone, with no permission check anywhere.
#3325 stopped the sender writing new ones; this is the other half.

The project a notification is about is persisted on the row when it is written
and the read paths filter on it in SQL, so LIMIT, OFFSET and total are all
computed on the filtered set. Notification types declare their project through
a capability interface in pkg/notifications, the same way they already declare
SubjectID, ThreadID and ToTitle — which is what lets the package below
pkg/models stay ignorant of what a project is.

project_id 0 means account-scoped and always visible, a positive value is
checked against the projects the caller can read, and -1 marks a project-scoped
row whose project could not be determined, so it is visible to nobody. Filtering
reuses the existing accessibleProjectIDsSubquery, so the page query and the
count cannot drift apart. A migration backfills existing rows from their stored
payloads, resolving through soft-deleted tasks so task.deleted rows still land
on their project.

Covers every read path: the v1 and v2 list endpoints, mark-as-read (which
echoes the payload back), the Atom feed, and the websocket push — the last of
which is load-bearing, since a row is still written for a revoked subscriber.
Deliberately no instance-admin bypass: notifications are always the caller's
own, and being an admin says nothing about whether they should still read a
comment out of a project they were removed from.
2026-07-29 07:58:17 +00:00

113 lines
3.8 KiB
Go

// Vikunja is a to-do list application to facilitate your life.
// Copyright 2018-present Vikunja and contributors. All rights reserved.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with this program. If not, see <https://www.gnu.org/licenses/>.
package models
import (
"encoding/json"
"testing"
"code.vikunja.io/api/pkg/db"
"code.vikunja.io/api/pkg/notifications"
"code.vikunja.io/api/pkg/user"
"github.com/stretchr/testify/require"
"xorm.io/xorm"
)
// TestDatabaseNotifications_ReadAll_RefreshesUsers guards #2720 for notifications
// already in the database: those were serialized with a partial doer (id +
// username, no display Name), so reading them must reload the embedded users so
// the display name is shown. The fix in the dispatch path only helps new
// notifications; old rows are healed here at read time.
func TestDatabaseNotifications_ReadAll_RefreshesUsers(t *testing.T) {
t.Run("fills in the display name from the database", func(t *testing.T) {
db.LoadAndAssertFixtures(t)
s := db.NewSession()
defer s.Close()
// user12 has the display name "Name with spaces" in the fixtures.
insertStoredNotification(t, s, 1, &TaskAssignedNotification{
Doer: &user.User{ID: 12, Username: "user12"},
Assignee: &user.User{ID: 12, Username: "user12"},
Task: &Task{ID: 1, ProjectID: 1},
})
got := readAssignedNotification(t, s, 1)
require.Equal(t, "Name with spaces", got.Doer.GetName())
require.Equal(t, "Name with spaces", got.Assignee.GetName())
})
t.Run("keeps the stored value when the user no longer exists", func(t *testing.T) {
db.LoadAndAssertFixtures(t)
s := db.NewSession()
defer s.Close()
insertStoredNotification(t, s, 1, &TaskAssignedNotification{
Doer: &user.User{ID: 999999, Username: "ghost"},
Task: &Task{ID: 1, ProjectID: 1},
})
got := readAssignedNotification(t, s, 1)
require.Equal(t, "ghost", got.Doer.Username)
})
t.Run("refreshes a disabled user", func(t *testing.T) {
db.LoadAndAssertFixtures(t)
s := db.NewSession()
defer s.Close()
// user17 is disabled in the fixtures; the reload must still win over the
// stale stored value.
insertStoredNotification(t, s, 1, &TaskAssignedNotification{
Doer: &user.User{ID: 17, Username: "stale"},
Task: &Task{ID: 1, ProjectID: 1},
})
got := readAssignedNotification(t, s, 1)
require.Equal(t, "user17", got.Doer.Username)
})
}
func insertStoredNotification(t *testing.T, s *xorm.Session, notifiableID int64, n notifications.Notification) *notifications.DatabaseNotification {
t.Helper()
content, err := json.Marshal(n)
require.NoError(t, err)
dbn := &notifications.DatabaseNotification{
NotifiableID: notifiableID,
Notification: json.RawMessage(content),
Name: n.Name(),
ProjectID: notifications.ProjectIDOf(n),
}
_, err = s.Insert(dbn)
require.NoError(t, err)
return dbn
}
func readAssignedNotification(t *testing.T, s *xorm.Session, notifiableID int64) *TaskAssignedNotification {
t.Helper()
result, _, _, err := (&DatabaseNotifications{}).ReadAll(s, &user.User{ID: notifiableID}, "", 1, 50)
require.NoError(t, err)
for _, dbn := range result.([]*notifications.DatabaseNotification) {
if n, is := dbn.Notification.(*TaskAssignedNotification); is {
return n
}
}
t.Fatal("no task.assigned notification was returned")
return nil
}