mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-10-26 14:30:13 +00:00
xarmian
6cfe322461
* feat(push): GET /me/notifications/{id} enrichment and the real-enqueue mention leg (TASK-3939 part B2b)
The endpoint resolves a push's nid through the dispatcher's own
notificationAccess gate; every denial is one byte-identical 404 and the
recipient's notification settings are never consulted. The mention leg
drives a real comment write through the real enqueue into a dispatch tick.
Claude-Session: https://claude.ai/code/session_01SSofJ73Kn2s3W4TTnjoAfU
* fix(push): enrichment refusals are tested through the real router, docs corrected (TASK-3939 B2b codex r1)
A disabled account is refused 403 account_disabled by RequireAuth for every
id, not 404; docs/api.md said otherwise. Tests now go through ServeHTTP: a
disabled user's real and unknown ids are byte-identical, and an installed
app's padapp_ token (401 on this route) answers identically for both. The
direct-handler tests are gone. docs/api.md also states a 500 is an
operational error, not a denial.
Claude-Session: https://claude.ai/code/session_01SSofJ73Kn2s3W4TTnjoAfU
* test(push): an unpinned API token reads its own notification through the router (TASK-3939 B2b codex r2)
Pins the docs/api.md claim that any authenticated person, an API token
included, can resolve their own notification.
Claude-Session: https://claude.ai/code/session_01SSofJ73Kn2s3W4TTnjoAfU
* fix(push): enrichment returns 500 on an owner or actor lookup error (TASK-3939 B2b codex r3)
GetUser errors were ignored, so a store failure could answer a partial 200
with an empty path owner or actor name. A missing user is still (nil, nil)
and an empty field; only a real error is now a 500, as docs/api.md says.
Claude-Session: https://claude.ai/code/session_01SSofJ73Kn2s3W4TTnjoAfU