[Backend] GET /notifications ignores its Zod query schema, passing unvalidated type/status straight to SQL

[grantfox-oss]

Telegram (ask questions / claim the issue here first): https://t.me/+DOylgFv1jyJlNzM0

Labels: backend, bug

getNotificationsQuerySchema is defined in backend/src/schemas/notificationSchemas.ts:26 but is imported nowhere (grep finds only the definition), so it is dead. The route wires getNotifications with no validate(...) middleware (backend/src/routes/notificationsRoutes.ts:66), and the controller reads req.query.type/req.query.status as raw strings and forwards them unchecked to notificationService.getNotificationsForUser (backend/src/controllers/notificationController.ts:23-37). Arbitrary type/status values reach the query layer instead of being rejected with a 400.

What the fix has to hold to

• type and status must be validated against their allowed enums before hitting the service
• limit/from/to validation should go through the same schema path
• Invalid values return a 400, consistent with other list endpoints

Done when

• The GET /notifications route validates query params via getNotificationsQuerySchema (or the schema is removed and validation added)
• Invalid type/status yields a 400
• A test asserts an invalid status is rejected

Where to start
backend/src/routes/notificationsRoutes.ts (~66), backend/src/controllers/notificationController.ts (~18-42), backend/src/schemas/notificationSchemas.ts (~26-40). Small.