[0xApotheosis]

Description

Supplied user IDs could select another profile's notifications. Scopes HTTP/WebSocket reads to device sessions and requires the internal key for sends.

Test/release with microservices #68, web #12742 and mobile #165/#166; apply shared migrations once and configure the internal caller key.

Verification

Create two device profiles in the paired QA environment. A's /notifications/me and socket must return only A's records even when B's ID is supplied. Revoke A's session: socket delivery should stop. Anonymous/device-token sends should return 401; the internal key should work. On both native builds, verify silent registration and correctly addressed ordinary push delivery.

Mocked checks passed; integration/device QA remains outstanding.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}