[ranjan1969x]

Summary

This PR adds comprehensive unit and integration tests for GET /api/notifications and POST /api/notifications/mark-read covering stable pagination, read and status filter semantics, deleted and purged record handling, and multi-tenant authorization boundaries.

Closes #2099

Key Test Coverage Added

1. Stable Pagination & Limit Boundaries:
   • Asserts default limit of 50 when limit query parameter is omitted.
   • Tests boundary values limit=1 (minimum allowed) and limit=100 (maximum allowed).
   • Validates strict ORDER BY created_at DESC newest-first chronological sorting across items.
   • Validates empty array and 0 unreadCount when user has zero notifications.
   • Rejects invalid limits (limit=0, negative limits, limit=101, non-numeric strings) with 400 Bad Request.
2. Read & Status Filtering Semantics:
   • Asserts filtering by status=unread, status=read, and status=archived.
   • Validates that read: boolean and status: string remain synchronized (read: false for unread, read: true for read/archived).
   • Verifies that unreadCount accurately reports total active unread count regardless of active status=read filter.
   • Rejects unsupported status values with 400 Bad Request.
3. Deleted & Purged Records Behavior:
   • Verifies that records purged by retention cleanup policies do not appear in active listings.
   • Validates that POST /api/notifications/mark-read handles non-existent or previously-deleted IDs gracefully.
   • Validates immediate success on empty array { ids: [] }.
   • Rejects batches exceeding 100 IDs and non-numeric IDs with 400 Bad Request.
4. Authorization & Tenant Isolation:
   • Rejects unauthenticated requests with 401 Unauthorized.
   • Rejects callers lacking read:notifications scope (such as lender role) with 403 Forbidden.
   • Asserts caller-scoped user_id = isolation so users can never read or mark each other's notifications.

Verification

• npm test -- src/__tests__/notificationPagination.test.ts (22/22 tests passing, 100% green)
• npm run build (0 TypeScript compilation errors)

[github-actions]

Malware detection scan flagged this pull request

The scan found 1 indicator(s) in the PR diff. This PR is blocked until a maintainer reviews the flagged files.

• backend/src/__tests__/notificationPagination.test.ts — hidden-appended-config-payload (high)

This is an automated triage signal; maintainers must verify whether the finding is malicious or intentional.