Method postCustomNotification

coderd/notifications.go:357–428

@Summary Send a custom notification @ID send-a-custom-notification @Security CoderSessionToken @Tags Notifications @Accept json @Produce json @Param request body codersdk.CustomNotificationRequest true "Provide a non-empty title or message" @Success 204 "No Content" @Failure 400 {object} codersdk.Re

(rw http.ResponseWriter, r *http.Request)

// @Failure 500 {object} codersdk.Response "Failed to send custom notification"
// @Router /api/v2/notifications/custom [post]
func (api *API) postCustomNotification(rw http.ResponseWriter, r *http.Request) {
	var (
		ctx    = r.Context()
		apiKey = httpmw.APIKey(r)
	)

	// Parse request
	var req codersdk.CustomNotificationRequest
	if !httpapi.Read(ctx, rw, r, &req) {
		return
	}

	// Validate request: require `content` and non-empty `title` and `message`
	if err := req.Validate(); err != nil {
		api.Logger.Error(ctx, "send custom notification: validation failed", slog.Error(err))
		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
			Message: "Invalid request body",
			Detail:  err.Error(),
		})
		return
	}

	// Block system users from sending custom notifications
	user, err := api.Database.GetUserByID(ctx, apiKey.UserID)
	if err != nil {
		api.Logger.Error(ctx, "send custom notification", slog.Error(err))
		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
			Message: "Failed to send custom notification",
			Detail:  err.Error(),
		})
		return
	}
	if user.IsSystem {
		api.Logger.Error(ctx, "send custom notification: system user is not allowed",
			slog.F("id", user.ID.String()), slog.F("name", user.Name))
		httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
			Message: "Forbidden",
			Detail:  "System users cannot send custom notifications.",
		})
		return
	}

	if _, err := api.NotificationsEnqueuer.EnqueueWithData(
		//nolint:gocritic // We need to be notifier to send the notification.
		dbauthz.AsNotifier(ctx),
		user.ID,
		notifications.TemplateCustomNotification,
		map[string]string{
			"custom_title":   req.Content.Title,
			"custom_message": req.Content.Message,
		},
		map[string]any{
			// Current dedupe is done via an hash of (template, user, method, payload, targets, day).
			// Include a minute-bucketed timestamp to bypass per-day dedupe for self-sends,
			// letting the caller resend identical content the same day (but not more than
			// once per minute).
			// TODO(ssncferreira): When custom notifications can target multiple users/roles,
			//   enforce proper deduplication across recipients to reduce noise and prevent spam.