Skip to content

feat(api): allow non-admin users to generate notifications for themselves - #3569

Merged
nickvergessen merged 3 commits into
masterfrom
feat/user-notifications
Nov 2, 2026
Merged

nickvergessen merged 3 commits into
masterfrom
feat/user-notifications

Conversation

@ArtificialOwl

@ArtificialOwl ArtificialOwl commented Nov 2, 2026 •

Copy link
Copy Markdown
Member

  • Should the endpoints be enabled by default?
  • Is 4 per hour the right limit for /self?

What it adds:

  • POST /ocs/v2.php/apps/notifications/api/v3/self lets any logged-in user send a notification to themselves. It's limited to 4 per hour per user.
  • POST /ocs/v2.php/apps/notifications/api/v3/user_notifications/{userId} sends a notification to any user. Only admins and members of groups listed in user_notifications_allowed_groups can call it, and it has no rate limit.
  • Both accept the same parameters as the V3 admin endpoint (subject, message, subjectParameters, messageParameters) and reuse its logic. That means the same validation and the same AdminNotifications formatting, and the notification is pushed to devices.
  • New settings, declared in a new config lexicon (lib/ConfigLexicon.php):
    • user_notifications_enabled: bool, default true, not lazy. It turns both endpoints on or off.
    • user_notifications_allowed_groups: array, default [], lazy.
  • Capabilities: when enabled, ocs-endpoints includes self-notification and user-notification.
  • Responses: 403 disabled when the setting is off; 403 forbidden when the caller isn't allowed; 400 for invalid data or no session.

Tests

curl -u user:apppassword -X POST -H "OCS-APIRequest: true" \
     -d subject="Hello" -d message="From the API" \
     https://<server>/ocs/v2.php/apps/notifications/api/v3/self

Possible extensions:

  • allow Team's moderators to send notification to their team

🤖 AI (if applicable)

  • The content of this PR was partly or fully generated using AI (N/A)

Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
Assisted-by: ClaudeCode:claude-opus-5-5
@nickvergessen
nickvergessen force-pushed the feat/user-notifications branch from e0bf1ac to b2380f2 Compare November 2, 2026 13:01
@nickvergessen nickvergessen changed the title feat(api): allow non-admin users to generate notifications feat(api): allow non-admin users to generate notifications for themselves Nov 2, 2026
Assisted-by: ClaudeCode:claude-opus-5-5
Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessen

Copy link
Copy Markdown
Member

Changed the approach to reuse the admin_notification endpoint as it's just a name.
Diff is down to 10 lines of product code

Signed-off-by: Joas Schilling <coding@schilljs.com>
@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown
Contributor

🐢 Performance warning.
It looks like the query count of the integration tests increased with this PR.
Database query count is now 9656 was 9158 (+5.43%)
Please check your code again. If you added a new test this can be expected and the base value in tests/Integration/base-query-count.txt can be increased.

@nickvergessen
nickvergessen merged commit b120b66 into master Nov 2, 2026
41 checks passed
@nickvergessen
nickvergessen deleted the feat/user-notifications branch November 2, 2026 14:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Allow non-admins to use notifications as a push web service

2 participants