Repository navigation
[HIGH] — Admin "suspend campaign" flow writes an AuditLog and resolves successfully, but never actually notifies the creator #6
Description
Activity
Hi maintainer, I'd like to work on this issue. My approach is to replace the current notification stub with a production-ready notification flow by resolving the creator's actual email, rendering the suspension email template, enqueueing it through the email queue, and creating an in-app notification. I'll add integration tests to verify the correct recipient and notification payload, and ensure notification failures are surfaced back to the admin (e.g. via a 202 response) instead of appearing as a silent success.
🦊 GrantFox — @Just-Bamford has been assigned to this issue as part of the Official Campaign campaign!
Next steps:
- Open a Pull Request referencing this issue (e.g.,
Closes #6) - Your PR will be reviewed by the OrbitChainLabs maintainers
Good luck! Track your progress on GrantFox.
- Open a Pull Request referencing this issue (e.g.,
🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign campaign!
@Just-Bamford's PR #35 was approved and merged by @Alqku.
🏆 @Just-Bamford: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (468 total points). Track your full progress on GrantFox.
👏 Great work, @Just-Bamford! Keep contributing to OrbitChainLabs.
Severity: High
Type: Bug
Scope: Admin, Notifications
Labels:
bug,security,Official CampaignDescription
AdminService.suspendCampaign(src/admin/admin.service.ts, lines ~17–58) writes the campaign status change to the database and inserts anAuditLogentry, then callsthis.notificationsService.sendCampaignSuspensionEmail(...). The implementation ofsendCampaignSuspensionEmail(src/notifications/notifications.service.ts, lines ~159–173) has aTODO: replace with real mailer callmarker and currently only emits a logger line — no email is queued, no in-app notification is created, and the recipient field is a syntheticcreator-${creatorId}@platform.internalthat cannot receive mail.Result: an admin can confidently suspend a campaign, see the API return
200, and the creator receives nothing — meaning a campaign can be frozen with the creator unaware, blocking support requests and refunds.Recommendation
suspend-campaign-email.ts, push toQUEUE_EMAIL, and also create aNotificationrow for in-app delivery.AdminService.suspendCampaign+ an injected mockNotificationsService) that assertssendCampaignSuspensionEmailis invoked and the payload contains the realuser.email(resolved throughprisma.user.findUnique).