Security: Notification management endpoints lack explicit authentication/authorization middleware

[tuanaiseo]

Problem

The notification routes expose create, test, read, update, and delete handlers without verifyJWT or role checks at route level. If these routes are mounted without a global auth guard, an unauthenticated or low-privileged caller could manage notification channels (including webhook-like destinations), leading to data exposure and abuse.

Severity: high
File: server/src/routes/notificationRoute.ts

Solution

Require authentication middleware (e.g., verifyJWT) and enforce authorization per action (e.g., owner/team checks, isAllowed(["admin","superadmin"]) where appropriate) on all notification endpoints.

Changes

• server/src/routes/notificationRoute.ts (modified)

Testing

• Existing tests pass
• Manual review completed
• No new warnings/errors introduced

[ajhollid]

Notification routes are secured at the config level in routes.ts

app.use("/api/v1/notifications", verifyJWT, notificationRoutes.getRouter());

Unless I'm missing something, this can be safely closed. Let me know if I have indeed missed something.

[ajhollid]

Closing as it is a non-issue