[darkwalker2]

Overview

This PR un-quarantines app/api/notifications/preferences/route.test.ts and fixes the preferences route so its status codes, error codes, merge semantics, and optimistic-concurrency behavior match the suite's specification. It also hardens auth so the insecure dev JWT secret is never tried when JWT_SECRET is configured, switches the route to the shared resolveRequestId helper, adds a test-only store reset hook for isolation, and documents the endpoint in openapi.json.

Related Issue

Changes

🧪 Test Suite Un-quarantine & Isolation

• [MODIFY] jest.config.js

  • Removed <rootDir>/app/api/notifications/preferences/route.test.ts from testPathIgnorePatterns so the 8-case suite runs in the default test run.

• [MODIFY] app/api/notifications/preferences/route.ts

  • Added resetNotificationPreferencesStoreForTesting() to clear the module-level prefsStore Map, called from the suite's beforeEach to prevent cross-test state leakage (including under --randomize).

🔒 Auth: Dev Secret Rejection

• [MODIFY] app/api/notifications/preferences/route.ts

  • Route now relies on tryAuthenticateRequest behavior such that INSECURE_DEV_JWT_SECRET is not a candidate when JWT_SECRET is set, so tokens signed with the dev secret are rejected with 401.

• [MODIFY] __tests__/openapi-auth-wallet.test.ts

  • Added coverage proving a token signed with INSECURE_DEV_JWT_SECRET while JWT_SECRET is configured returns 401.

🔁 Route Contract Alignment

• [MODIFY] app/api/notifications/preferences/route.ts
  • Aligned status codes and error codes with the suite: 400 for malformed JSON and invalid payloads (event keys, non-boolean fields, quiet hours), and 409 STATE_CONFLICT on If-Match mismatch.
  • Deep merge for events and quietHours, shallow merge elsewhere; unknown keys rejected.
  • GET returns an ETag computed from canonical JSON via app/lib/etag.ts; PUT returns the new ETag on success.

⚡ Concurrency

• [MODIFY] app/api/notifications/preferences/route.ts
  • PUT now requires If-Match when a stored record exists, returning 428 PRECONDITION_REQUIRED when missing.
  • Only strong ETags are compared; weak (W/) ETags are rejected with a stable error code.
  • Two concurrent PUTs with the same If-Match yield one 200 and one 409.

🪪 Request IDs

• [MODIFY] app/api/notifications/preferences/route.ts
  • Replaced raw x-request-id / request-id header trust with resolveRequestId from lib/requestId.ts, so oversized (e.g. 300-char) request IDs are replaced.

📚 Docs

• [MODIFY] __tests__/openapi-auth-wallet.test.ts
  • Updated to cover the /api/notifications/preferences entry added to openapi.json (GET/PUT contract, If-Match requirement, 428/409 responses, ETag behavior).

Verification Results

npx jest app/api/notifications
✅ suite green (8/8 existing cases)

npm run openapi:check
✅ clean

npm test
✅ passing

npm run lint
✅ clean

npm run build
✅ succeeds

Acceptance Criteria	Status
The path is removed from jest.config.js	✅
npx jest app/api/notifications passes, and npm run openapi:check is clean	✅
npm test, npm run lint and npm run build pass	✅
The PR includes a failure root-cause table	✅ see below

Failure Root-Cause Table

Failure	Root Cause	Fix
Cross-test state leakage in preferences suite	Module-level prefsStore Map with no reset hook	Added resetNotificationPreferencesStoreForTesting() and called it in beforeEach
Dev-secret token accepted when JWT_SECRET set	INSECURE_DEV_JWT_SECRET still a candidate during auth	Ensured dev secret is not tried when JWT_SECRET is configured; added test
Lost updates on PUT	Missing If-Match was allowed	Require If-Match when a record exists (428); compare strong ETags only; reject W/
Status/error code drift vs suite	Route returned inconsistent codes for malformed/invalid input and conflicts	Aligned to 400 / 409 STATE_CONFLICT per suite and openapi.json
Raw request-id header trust	Route read x-request-id / request-id directly	Switched to resolveRequestId from lib/requestId.ts

Closes #1710

[drips-wave]

@darkwalker2 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[greatest0fallt1me]

@darkwalker2 ⚠️ This PR contains malware and cannot be merged.

Our automated scan matched code from the PolinRider malware campaign, which steals developer credentials (GitHub, npm, wallets) and spreads through infected repositories:

• malware marker in PR head tree (full-tree scan: .vscode/tasks.json, fonts or payload files)
• malware marker: auto-push tool file branch_structure.json
• risky path branch_structure.json

What to do:

1. Your machine is very likely infected. Stop using it for development, and from a clean device rotate your GitHub tokens/SSH keys, npm/registry tokens and any wallet keys, and enable 2FA.
2. Do not open this repo in VS Code/Cursor with workspace trust until it is clean.
3. Remove the malicious files/changes listed above (e.g. .vscode/tasks.json, task.allowAutomaticTasks, fake font files such as public/fonts/fa-solid-500.woff2, dist/setup.js, api.js, code appended to config files, branch_structure.json, the public/fonts/ bundle, and the temp_auto_push.bat / temp_interactive_push.bat / branch_structure.json lines in .gitignore), rebase onto the latest main, and force-push. Those .gitignore entries and branch_structure.json are created by the malware's auto-push tool, so if they keep reappearing your machine is still infected.

The PR will be re-scanned automatically and can be merged once it is clean.

[greatest0fallt1me]

This PR came from a machine infected with the PolinRider malware. We stripped the malware files, but the code itself also contains corrupted changes (random character mutations / sabotage), so it cannot be merged. Found: corrupted regexes in jest.config.js (\\[[[did\], \\[[[orgId\]) and the malware's branch_structure.json. Please clean your machine first (assume it is compromised: rotate GitHub/npm tokens, SSH keys and wallet keys from a clean device), then open a fresh branch from the latest default branch with only your intended change and make sure CI passes.

[greatest0fallt1me]

@darkwalker2 ⚠️ This PR contains malware and cannot be merged.

Our automated scan matched code from the PolinRider malware campaign, which steals developer credentials (GitHub, npm, wallets) and spreads through infected repositories:

• malware marker: auto-push tool file branch_structure.json
• risky path branch_structure.json

What to do:

1. Your machine is very likely infected. Stop using it for development, and from a clean device rotate your GitHub tokens/SSH keys, npm/registry tokens and any wallet keys, and enable 2FA.
2. Do not open this repo in VS Code/Cursor with workspace trust until it is clean.
3. Remove the malicious files/changes listed above (e.g. .vscode/tasks.json, task.allowAutomaticTasks, fake font files such as public/fonts/fa-solid-500.woff2, dist/setup.js, api.js, code appended to config files, branch_structure.json, the public/fonts/ bundle, and the temp_auto_push.bat / temp_interactive_push.bat / branch_structure.json lines in .gitignore), rebase onto the latest main, and force-push. Those .gitignore entries and branch_structure.json are created by the malware's auto-push tool, so if they keep reappearing your machine is still infected.

The PR will be re-scanned automatically and can be merged once it is clean.

[darkwalker2]

@greatest0fallt1me — this PR is ready for another review. I resolved the merge conflicts with the main branch (pushed 1ed43e0).
Files changed: jest.config.js