/security-auditor skills changes done

backend/routers/notifications.py

@@ -1,12 +1,13 @@
 """Notification routes — FCM token registration and reminder settings."""
-from fastapi import APIRouter, HTTPException
+import logging
+from fastapi import APIRouter, HTTPException, Depends
 from db import get_database
 from pydantic import BaseModel
 from typing import Optional
-from bson import ObjectId
-from bson.errors import InvalidId
 from datetime import datetime
+from auth import get_current_user, verify_user_access
 
+log = logging.getLogger(__name__)
 router = APIRouter()
 
 
@@ -22,57 +23,52 @@ class ReminderSettingsRequest(BaseModel):
 
 
 @router.post("/fcm-token", response_model=dict)
-async def register_fcm_token(body: FcmTokenRequest):
+async def register_fcm_token(body: FcmTokenRequest, token: dict = Depends(get_current_user)):
     """
     Register (or refresh) an FCM device token for a user.
     Stores unique tokens per user — duplicate tokens are ignored.
     """
     db = get_database()
-
     try:
-        user_oid = ObjectId(body.userId)
-    except InvalidId:
-        raise HTTPException(status_code=400, detail="Invalid user ID")
+        user = verify_user_access(body.userId, db, token)
+        user_oid = user["_id"]
 
-    user = db.users.find_one({"_id": user_oid})
-    if not user:
-        raise HTTPException(status_code=404, detail="User not found")
-
-    # Add token to set (avoid duplicates)
-    db.users.update_one(
-        {"_id": user_oid},
-        {
-            "$addToSet": {"fcmTokens": body.fcmToken},
-            "$set": {"updatedAt": datetime.utcnow()},
-        }
-    )
-    return {"message": "FCM token registered"}
+        db.users.update_one(
+            {"_id": user_oid},
+            {
+                "$addToSet": {"fcmTokens": body.fcmToken},
+                "$set": {"updatedAt": datetime.utcnow()},
+            }
+        )
+        return {"message": "FCM token registered"}
+    except HTTPException:
+        raise
+    except Exception:
+        log.exception("Failed to register FCM token")
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @router.put("/reminder/{user_id}", response_model=dict)
-async def update_reminder(user_id: str, settings: ReminderSettingsRequest):
-    """
-    Save or update daily reminder settings for a user.
-    """
+async def update_reminder(user_id: str, settings: ReminderSettingsRequest, token: dict = Depends(get_current_user)):
+    """Save or update daily reminder settings for a user."""
     db = get_database()
-
     try:
-        user_oid = ObjectId(user_id)
-    except InvalidId:
-        raise HTTPException(status_code=400, detail="Invalid user ID")
+        user = verify_user_access(user_id, db, token)
+        user_oid = user["_id"]
 
-    user = db.users.find_one({"_id": user_oid})
-    if not user:
-        raise HTTPException(status_code=404, detail="User not found")
+        reminder_update: dict = {"reminder.enabled": settings.enabled}
+        if settings.time is not None:
+            reminder_update["reminder.time"] = settings.time
+        if settings.timezone is not None:
+            reminder_update["reminder.timezone"] = settings.timezone
 
-    reminder_update: dict = {"reminder.enabled": settings.enabled}
-    if settings.time is not None:
-        reminder_update["reminder.time"] = settings.time
-    if settings.timezone is not None:
-        reminder_update["reminder.timezone"] = settings.timezone
-
-    db.users.update_one(
-        {"_id": user_oid},
-        {"$set": {**reminder_update, "updatedAt": datetime.utcnow()}}
-    )
-    return {"message": "Reminder settings updated"}
+        db.users.update_one(
+            {"_id": user_oid},
+            {"$set": {**reminder_update, "updatedAt": datetime.utcnow()}}
+        )
+        return {"message": "Reminder settings updated"}
+    except HTTPException:
+        raise
+    except Exception:
+        log.exception("Failed to update reminder settings")
+        raise HTTPException(status_code=500, detail="Internal server error")