@openneuro/server 4.47.6 → 4.47.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openneuro/server",
-  "version": "4.47.6",
+  "version": "4.47.7",
   "description": "Core service for the OpenNeuro platform.",
   "license": "MIT",
   "main": "src/server.js",
@@ -21,7 +21,7 @@
     "@elastic/elasticsearch": "8.13.1",
     "@graphql-tools/schema": "^10.0.0",
     "@keyv/redis": "^4.5.0",
-    "@openneuro/search": "^4.47.6",
+    "@openneuro/search": "^4.47.7",
     "@sentry/node": "^10.37.0",
     "@sentry/profiling-node": "^10.37.0",
     "base64url": "^3.0.0",
@@ -89,5 +89,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "e00e369a538900524544a396e7fd60e5e41d715e"
+  "gitHead": "af17c267fa700dff5b13d1b31aaf4f89c0853165"
 }

package/src/graphql/resolvers/__tests__/user.spec.ts

@@ -10,7 +10,8 @@ import {
 import { MongoMemoryServer } from "mongodb-memory-server"
 import mongoose, { Types } from "mongoose"
 import User from "../../../models/user"
-import { user, users } from "../user.js"
+import DatasetEvent from "../../../models/datasetEvents"
+import { notifications, user, users } from "../user.js"
 import type { GraphQLContext } from "../user.js"
 
 vi.mock("ioredis")
@@ -385,4 +386,57 @@ describe("user resolvers", () => {
       expect(result.totalCount).toBe(3) // u1, u4, u6 are admins
     })
   })
+
+  describe("notifications()", () => {
+    it("returns empty array for reviewer users", async () => {
+      const result = await notifications(
+        { id: "reviewer" },
+        null,
+        { userInfo: { reviewer: true, admin: false, blocked: false } },
+      )
+      expect(result).toEqual([])
+    })
+
+    it("does not crash when userInfo is undefined", async () => {
+      await expect(
+        notifications({ id: "u1" }, null, { userInfo: undefined }),
+      ).rejects.toThrow("Not authorized to view these notifications.")
+    })
+
+    it("returns notifications for a user viewing their own", async () => {
+      await DatasetEvent.create({
+        id: "event-1",
+        datasetId: "ds000001",
+        userId: "u1",
+        timestamp: new Date(),
+        event: {
+          type: "contributorCitation",
+          datasetId: "ds000001",
+          addedBy: "u2",
+          targetUserId: "u1",
+          contributorData: { name: "Test User" },
+        },
+        success: true,
+        note: "Added as contributor",
+      })
+      const result = await notifications(
+        { id: "u1" },
+        null,
+        { userInfo: { id: "u1", admin: false, userId: "u1" } },
+      )
+      expect(result.length).toBe(1)
+      expect(result[0].id).toBe("event-1")
+      expect(result[0].notificationStatus.status).toBe("UNREAD")
+    })
+
+    it("throws authorization error for regular user viewing another user's notifications", async () => {
+      await expect(
+        notifications(
+          { id: "u1" },
+          null,
+          { userInfo: { id: "u2", admin: false, userId: "u2" } },
+        ),
+      ).rejects.toThrow("Not authorized to view these notifications.")
+    })
+  })
 })

package/src/graphql/resolvers/user.ts

@@ -279,7 +279,7 @@ export async function notifications(obj, _, { userInfo }) {
   const userId = obj.id
 
   // Reviewers never have notifications
-  if (userInfo.reviewer) {
+  if (userInfo?.reviewer) {
     return []
   }