fix(notifications): address review feedback and lint

Address all review comments from PR #2528, add missing test coverage, and fix
lint/formatting issues:

- SDK integration: use SDK CleanProject (CleanAllNotificationSubscriptionsRequest)
  for test cleanup instead of manual deletion
- Add E2E test documenting push behavior with unsupported custom filter
  (API returns HTTP 400 and local files remain unchanged)
- Address review comments: field naming, error handling, code structure
- Fix push operation: add persist support, fix stale key removal, preserve folder paths
- Fix DeleteObject: clean up manifest entry and clear remote state on delete
- Fix manifest: move Notifications field after Rows in ConfigManifestWithRows
- Fix E2E tests: correct test expectations for push/pull/filter scenarios
- Fix encrypt E2E test manifest: correct naming fields
- Lint: gofumpt, go mod tidy, golangci-lint, import ordering

Author: Matovidlo

docs/CLI_OBJECT_LIFECYCLE.md

@@ -350,39 +350,6 @@ u.changes.AddCreated(notificationState)
 // IDs in manifest.json are updated for new notifications via manifest.Save()
 ```
 
-### Auto-Filter Behavior
-
-Users write only `event` + `recipient` (and optionally custom `filters`) in `config.json`. During push, three standard filters are **auto-populated** by `createNotificationRequest()`:
-
-- `branch.id` — from the notification's `BranchID`
-- `job.component.id` — from the notification's `ComponentID`
-- `job.configuration.id` — from the notification's `ConfigID`
-
-These filters are required by the API to scope the notification to a specific config. They are appended before any user-defined filters.
-
-The API returns all filters (auto + user) in the response, so after a `pull`, `config.json` contains all three auto-filters plus any user-defined ones.
-
-**Consequence:** On a repeated `push` without `pull`:
-- Local `config.json` has no auto-filters (they were never written locally)
-- Remote notification has all three auto-filters
-- Diff engine shows `changed: filters`
-- This is **expected behavior**, not a bug
-
-### Delete-Then-Create for Updates
-
-The notifications API has no update endpoint. Changes are implemented as:
-1. Delete the old notification subscription
-2. Create a new one with the changed values
-
-This is implemented via `WithOnSuccess` callback chaining in `UnitOfWork.SaveObject`:
-```go
-// Pseudocode in remote/manager.go
-deleteReq.WithOnSuccess(func(...) {
-    // On successful delete, create the new one
-    return createReq.Send(ctx)
-})
-```
-
 ---
 
 ## Common Pitfalls

go.mod

@@ -43,7 +43,7 @@ require (
 	github.com/json-iterator/go v1.1.12
 	github.com/keboola/go-cloud-encrypt v0.0.0-20250422071622-41a5d5547c43
 	github.com/keboola/go-utils v1.4.0
-	github.com/keboola/keboola-sdk-go/v2 v2.12.1-0.20260223100110-432345f77343
+	github.com/keboola/keboola-sdk-go/v2 v2.12.1-0.20260224141819-0b0f6e9b37d3
 	github.com/klauspost/compress v1.18.4
 	github.com/klauspost/pgzip v1.2.6
 	github.com/kylelemons/godebug v1.1.0

go.sum

@@ -589,8 +589,8 @@ github.com/keboola/go-oauth2-proxy/v7 v7.13.1-0.20251120082210-251fbcb18c16 h1:m
 github.com/keboola/go-oauth2-proxy/v7 v7.13.1-0.20251120082210-251fbcb18c16/go.mod h1:2KeAM0/QPbyUAoky+PXVgQDt/5m0qNcn30z9jh4ig8A=
 github.com/keboola/go-utils v1.4.0 h1:WTyj95yrr8O8HxtC8TSTyUcElZiRGDeEdVvDpFo6HUo=
 github.com/keboola/go-utils v1.4.0/go.mod h1:IopwJzFz2gh0Yj3fUbIe2eamRoDKzbXvjqFjQyw3ZdQ=
-github.com/keboola/keboola-sdk-go/v2 v2.12.1-0.20260223100110-432345f77343 h1:xcHtXh3n6F2f3nBqGf+/AwdEKV06zAXXYlKZwVcOgI8=
-github.com/keboola/keboola-sdk-go/v2 v2.12.1-0.20260223100110-432345f77343/go.mod h1:N/PkJnEHcyHMbVjHPjTdQwj5b9Iajl7PEaFUVtywHKU=
+github.com/keboola/keboola-sdk-go/v2 v2.12.1-0.20260224141819-0b0f6e9b37d3 h1:cM+iINgvPYtdeFtbaVRLMZBxpzu9gAp2VPuY2nFg740=
+github.com/keboola/keboola-sdk-go/v2 v2.12.1-0.20260224141819-0b0f6e9b37d3/go.mod h1:N/PkJnEHcyHMbVjHPjTdQwj5b9Iajl7PEaFUVtywHKU=
 github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU=
 github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=

internal/pkg/encoding/json/json.go

@@ -10,18 +10,22 @@ import (
 type RawMessage = json.RawMessage
 
 func Encode(v any, pretty bool) ([]byte, error) {
-	var data []byte
-	var err error
+	var buf bytes.Buffer
+	enc := json.NewEncoder(&buf)
+	enc.SetEscapeHTML(false)
 	if pretty {
-		data, err = json.MarshalIndent(v, "", "  ")
-		data = append(data, '\n')
-	} else {
-		data, err = json.Marshal(v)
+		enc.SetIndent("", "  ")
 	}
-	if err != nil {
+	if err := enc.Encode(v); err != nil {
 		return nil, processJSONEncodeError(err)
 	}
-	return data, nil
+	data := buf.Bytes()
+	if pretty {
+		// json.Encoder always appends a newline, which matches the previous behavior for pretty output.
+		return data, nil
+	}
+	// For non-pretty output, strip the trailing newline appended by json.Encoder.
+	return bytes.TrimRight(data, "\n"), nil
 }
 
 func MustEncode(v any, pretty bool) []byte {

internal/pkg/model/manifest.go

@@ -1,11 +1,9 @@
 package model
 
 import (
-	"encoding/json"
 	"fmt"
 
 	"github.com/keboola/go-utils/pkg/orderedmap"
-	"github.com/keboola/keboola-sdk-go/v2/pkg/keboola"
 
 	"github.com/keboola/keboola-as-code/internal/pkg/filesystem"
 	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
@@ -79,9 +77,8 @@ type ConfigManifest struct {
 	RecordState `json:"-"`
 	ConfigKey
 	Paths
-	Relations     Relations               `json:"relations,omitempty" validate:"dive"` // relations with other objects, for example variables definition
-	Metadata      *orderedmap.OrderedMap  `json:"metadata,omitempty"`
-	Notifications []*NotificationManifest `json:"notifications,omitempty"`
+	Relations Relations              `json:"relations,omitempty" validate:"dive"` // relations with other objects, for example variables definition
+	Metadata  *orderedmap.OrderedMap `json:"metadata,omitempty"`
 }
 
 type ConfigRowManifest struct {
@@ -91,42 +88,10 @@ type ConfigRowManifest struct {
 	Relations Relations `json:"relations,omitempty" validate:"dive"` // relations with other objects, for example variables values definition
 }
 
-type NotificationManifestRef struct {
-	ID   keboola.NotificationSubscriptionID `json:"id"`
-	Path string                             `json:"path,omitempty"`
-}
-
 type ConfigManifestWithRows struct {
 	ConfigManifest
-	Rows []*ConfigRowManifest `json:"rows"`
-}
-
-// MarshalJSON implements custom JSON marshaling to simplify notifications to just IDs.
-func (c *ConfigManifestWithRows) MarshalJSON() ([]byte, error) {
-	// Convert notifications to simplified refs
-	notificationRefs := make([]*NotificationManifestRef, 0, len(c.Notifications))
-	for _, n := range c.Notifications {
-		if n != nil {
-			notificationRefs = append(notificationRefs, &NotificationManifestRef{ID: n.ID, Path: n.GetRelativePath()})
-		}
-	}
-
-	// Create a copy with simplified notifications
-	return json.Marshal(&struct {
-		ConfigKey
-		Paths
-		Relations     Relations                  `json:"relations,omitempty"`
-		Metadata      *orderedmap.OrderedMap     `json:"metadata,omitempty"`
-		Rows          []*ConfigRowManifest       `json:"rows"`
-		Notifications []*NotificationManifestRef `json:"notifications,omitempty"`
-	}{
-		ConfigKey:     c.ConfigKey,
-		Paths:         c.Paths,
-		Relations:     c.Relations,
-		Metadata:      c.Metadata,
-		Rows:          c.Rows,
-		Notifications: notificationRefs,
-	})
+	Rows          []*ConfigRowManifest    `json:"rows"`
+	Notifications []*NotificationManifest `json:"notifications,omitempty"`
 }
 
 func (p *Paths) ClearRelatedPaths() {

internal/pkg/model/notification_validation.go

@@ -9,31 +9,33 @@ import (
 	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
 )
 
-// Valid notification filter field names as per the API specification.
-var validFilterFields = []string{
-	"branch.id",
-	"job.id",
-	"job.component.id",
-	"job.configuration.id",
-	"job.token.id",
-	"project.id",
-	"eventType",
+func validNotificationFilterFields() []string {
+	return []string{
+		"branch.id",
+		"job.id",
+		"job.component.id",
+		"job.configuration.id",
+		"job.token.id",
+		"project.id",
+		"eventType",
+	}
 }
 
-// Map of deprecated field names to their correct equivalents.
-var deprecatedFieldNames = map[string]string{
-	"configId":      "job.configuration.id",
-	"componentId":   "job.component.id",
-	"branchId":      "branch.id",
-	"jobId":         "job.id",
-	"tokenId":       "job.token.id",
-	"projectId":     "project.id",
-	"configuration": "job.configuration.id",
-	"component":     "job.component.id",
-	"branch":        "branch.id",
-	"job":           "job.id",
-	"token":         "job.token.id",
-	"project":       "project.id",
+func deprecatedNotificationFilterFieldNames() map[string]string {
+	return map[string]string{
+		"configId":      "job.configuration.id",
+		"componentId":   "job.component.id",
+		"branchId":      "branch.id",
+		"jobId":         "job.id",
+		"tokenId":       "job.token.id",
+		"projectId":     "project.id",
+		"configuration": "job.configuration.id",
+		"component":     "job.component.id",
+		"branch":        "branch.id",
+		"job":           "job.id",
+		"token":         "job.token.id",
+		"project":       "project.id",
+	}
 }
 
 // ValidateNotificationFilters validates that all filter field names are valid.
@@ -48,13 +50,16 @@ func ValidateNotificationFilters(filters []keboola.NotificationFilter) error {
 }
 
 func validateFilterField(fieldName string, index int) error {
+	validFields := validNotificationFilterFields()
+	deprecatedFields := deprecatedNotificationFilterFieldNames()
+
 	// Check if field is valid
-	if slices.Contains(validFilterFields, fieldName) {
+	if slices.Contains(validFields, fieldName) {
 		return nil
 	}
 
 	// Check if it's a deprecated field name
-	if correctName, ok := deprecatedFieldNames[fieldName]; ok {
+	if correctName, ok := deprecatedFields[fieldName]; ok {
 		return errors.Errorf(
 			`filter[%d] uses deprecated field name "%s". Use "%s" instead`,
 			index,
@@ -78,16 +83,19 @@ func validateFilterField(fieldName string, index int) error {
 		`filter[%d] has invalid field name "%s". Valid field names are: %s`,
 		index,
 		fieldName,
-		strings.Join(validFilterFields, ", "),
+		strings.Join(validFields, ", "),
 	)
 }
 
 func findSimilarFieldNames(input string) []string {
+	validFields := validNotificationFilterFields()
+	deprecatedFields := deprecatedNotificationFilterFieldNames()
+
 	var suggestions []string
 	lowerInput := strings.ToLower(input)
 
 	// Check if input contains any part of valid field names
-	for _, validField := range validFilterFields {
+	for _, validField := range validFields {
 		lowerValid := strings.ToLower(validField)
 		// If input contains part of valid field, or valid field contains part of input
 		if strings.Contains(lowerValid, lowerInput) || strings.Contains(lowerInput, lowerValid) {
@@ -96,11 +104,9 @@ func findSimilarFieldNames(input string) []string {
 	}
 
 	// Also check deprecated names that contain the input
-	for deprecatedName, correctName := range deprecatedFieldNames {
-		if strings.Contains(strings.ToLower(deprecatedName), lowerInput) {
-			if !slices.Contains(suggestions, correctName) {
-				suggestions = append(suggestions, correctName)
-			}
+	for deprecatedName, correctName := range deprecatedFields {
+		if strings.Contains(strings.ToLower(deprecatedName), lowerInput) && !slices.Contains(suggestions, correctName) {
+			suggestions = append(suggestions, correctName)
 		}
 	}
 

internal/pkg/model/notification_validation_test.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/keboola/keboola-sdk-go/v2/pkg/keboola"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestValidateNotificationFilters_ValidFields(t *testing.T) {
@@ -49,7 +50,7 @@ func TestValidateNotificationFilters_DeprecatedFields(t *testing.T) {
 			}
 
 			err := ValidateNotificationFilters(filters)
-			assert.Error(t, err, "deprecated field should return error")
+			require.Error(t, err, "deprecated field should return error")
 			assert.Contains(t, err.Error(), "deprecated field name")
 			assert.Contains(t, err.Error(), tt.field)
 			assert.Contains(t, err.Error(), tt.correctField)
@@ -77,7 +78,7 @@ func TestValidateNotificationFilters_InvalidFields(t *testing.T) {
 			}
 
 			err := ValidateNotificationFilters(filters)
-			assert.Error(t, err, "invalid field should return error")
+			require.Error(t, err, "invalid field should return error")
 			assert.Contains(t, err.Error(), "invalid field name")
 			assert.Contains(t, err.Error(), tt.field)
 		})
@@ -101,7 +102,7 @@ func TestValidateNotificationFilters_MultipleFilters(t *testing.T) {
 	}
 
 	err := ValidateNotificationFilters(filters)
-	assert.Error(t, err, "should fail on first invalid filter")
+	require.Error(t, err, "should fail on first invalid filter")
 	assert.Contains(t, err.Error(), "filter[1]")
 	assert.Contains(t, err.Error(), "configId")
 }

internal/pkg/model/notificationmanifest.go

@@ -1,7 +1,10 @@
 package model
 
 import (
+	"encoding/json"
 	"fmt"
+
+	"github.com/keboola/keboola-sdk-go/v2/pkg/keboola"
 )
 
 // NotificationManifest represents a notification manifest record.
@@ -12,6 +15,18 @@ type NotificationManifest struct {
 	Relations Relations `json:"relations,omitempty" validate:"dive"`
 }
 
+// MarshalJSON serializes only the ID and path, omitting the embedded NotificationKey fields
+// (branchId, componentId, configId) which would otherwise appear in the manifest JSON.
+func (n *NotificationManifest) MarshalJSON() ([]byte, error) {
+	return json.Marshal(&struct {
+		ID   keboola.NotificationSubscriptionID `json:"id"`
+		Path string                             `json:"path,omitempty"`
+	}{
+		ID:   n.ID,
+		Path: n.GetRelativePath(),
+	})
+}
+
 // NewEmptyObject creates an empty Notification object with the key from this manifest.
 func (n NotificationManifest) NewEmptyObject() Object {
 	return &Notification{NotificationKey: n.NotificationKey}

internal/pkg/naming/matcher.go

@@ -1,6 +1,8 @@
 package naming
 
 import (
+	"strings"
+
 	"github.com/keboola/keboola-sdk-go/v2/pkg/keboola"
 
 	"github.com/keboola/keboola-as-code/internal/pkg/model"
@@ -56,6 +58,11 @@ func (m PathMatcher) MatchConfigPath(parentKey model.Key, path model.AbsPath) (c
 	return "", nil
 }
 
+// MatchNotificationPath returns true if the path is a notification directory.
+func (m PathMatcher) MatchNotificationPath(path model.AbsPath) bool {
+	return strings.HasPrefix(path.GetRelativePath(), "notifications/")
+}
+
 func (m PathMatcher) MatchConfigRowPath(component *keboola.Component, path model.AbsPath) bool {
 	// Shared code
 	if component.IsSharedCode() {

internal/pkg/plan/persist/executor.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/keboola/keboola-sdk-go/v2/pkg/keboola"
 
+	"github.com/keboola/keboola-as-code/internal/pkg/idgenerator"
 	"github.com/keboola/keboola-as-code/internal/pkg/log"
 	"github.com/keboola/keboola-as-code/internal/pkg/model"
 	"github.com/keboola/keboola-as-code/internal/pkg/state"
@@ -68,6 +69,11 @@ func (e *executor) persistNewObject(action *newObjectAction) {
 	case model.ConfigRowKey:
 		k.ID = keboola.RowID(newID)
 		key = k
+	case model.NotificationKey:
+		// Assign a short random local ID to ensure unique manifest key.
+		// The real ID is assigned by the API on push (see buildNotificationCreateRequest success callback).
+		k.ID = keboola.NotificationSubscriptionID(idgenerator.Random(6))
+		key = k
 	default:
 		panic(errors.Errorf(`unexpected type "%s" of the persisted object "%s"`, key.Kind(), key.Desc()))
 	}