🐛 fix(notifications): resolve shorthand trigger references in notification rule matching (#253)

Notification rule allow-lists stored shorthand trigger references (e.g.
`mobile`, `smtp.gmail`) but dispatch matching used exact string comparison
against fully-qualified runtime IDs (e.g. `edge.pushover.mobile`). This
caused triggers to be silently excluded from allow-lists even when the
UI showed them as enabled.

- Add `doesNotificationTriggerReferenceMatchId()` with suffix-based
  resolution: matches by name, provider.name, or exact ID
- Update `getTriggerDispatchDecisionForRule()` to use fuzzy matching
- Update `normalizeNotificationTriggerIds()` to expand shorthand refs
  via `resolveNotificationTriggerIds()`
- Fix API validation to use resolution before rejecting trigger IDs

Author: s-b-e-n-s-o-n

app/api/notification.test.ts

@@ -146,6 +146,77 @@ describe('Notification Router', () => {
     });
   });
 
+  test('should canonicalize shorthand trigger references when updating a notification rule', () => {
+    mockGetRegistryState.mockReturnValueOnce({
+      trigger: {
+        'edge.pushover.mobile': { type: 'pushover', name: 'mobile' },
+        'smtp.gmail': { type: 'smtp', name: 'gmail' },
+      },
+    });
+
+    notificationRouter.init();
+    const handler = mockRouter.patch.mock.calls.find((call) => call[0] === '/:id')[1];
+    const res = createMockResponse();
+
+    handler(
+      {
+        params: { id: 'update-available' },
+        body: {
+          triggers: ['mobile', 'smtp.gmail'],
+        },
+      },
+      res,
+    );
+
+    expect(mockUpdateNotificationRule).toHaveBeenCalledWith('update-available', {
+      triggers: ['edge.pushover.mobile', 'smtp.gmail'],
+    });
+    expect(res.json).toHaveBeenCalledWith({
+      id: 'update-available',
+      name: 'Update Available',
+      enabled: true,
+      triggers: ['edge.pushover.mobile', 'smtp.gmail'],
+      description: 'When a container has a new version',
+    });
+  });
+
+  test('should expand shorthand trigger references when listing persisted rules', () => {
+    mockGetRegistryState.mockReturnValueOnce({
+      trigger: {
+        'edge.pushover.mobile': { type: 'pushover', name: 'mobile' },
+        'fallback.pushover.mobile': { type: 'pushover', name: 'mobile' },
+      },
+    });
+    mockGetNotificationRules.mockReturnValueOnce([
+      {
+        id: 'update-available',
+        name: 'Update Available',
+        enabled: true,
+        triggers: ['mobile'],
+        description: 'When a container has a new version',
+      },
+    ]);
+
+    notificationRouter.init();
+    const handler = mockRouter.get.mock.calls.find((call) => call[0] === '/')[1];
+    const res = createMockResponse();
+
+    handler({}, res);
+
+    expect(res.json).toHaveBeenCalledWith({
+      data: [
+        {
+          id: 'update-available',
+          name: 'Update Available',
+          enabled: true,
+          triggers: ['edge.pushover.mobile', 'fallback.pushover.mobile'],
+          description: 'When a container has a new version',
+        },
+      ],
+      total: 1,
+    });
+  });
+
   test('should reject unsupported trigger ids when updating a notification rule', () => {
     notificationRouter.init();
     const handler = mockRouter.patch.mock.calls.find((call) => call[0] === '/:id')[1];

app/api/notification.ts

@@ -4,6 +4,7 @@ import nocache from 'nocache';
 import {
   getNotificationTriggerIdsFromState,
   normalizeNotificationTriggerIds,
+  resolveNotificationTriggerIds,
 } from '../notifications/trigger-policy.js';
 import * as registry from '../registry/index.js';
 import * as notificationStore from '../store/notification.js';
@@ -64,21 +65,22 @@ function updateNotificationRule(req, res) {
     const allowedTriggerIds = getAllowedNotificationTriggerIds();
     const triggersRequested = notificationRuleToUpdate.value.triggers;
     if (Array.isArray(triggersRequested)) {
-      const triggersNormalized = normalizeNotificationTriggerIds(
-        triggersRequested,
-        allowedTriggerIds,
+      const invalidTriggers = triggersRequested.filter(
+        (triggerId) => resolveNotificationTriggerIds(triggerId, allowedTriggerIds).length === 0,
       );
-      if (triggersNormalized.length !== triggersRequested.length) {
-        const invalidTriggers = triggersRequested.filter(
-          (triggerId) => !allowedTriggerIds.has(triggerId),
-        );
+      if (invalidTriggers.length > 0) {
         sendErrorResponse(
           res,
           400,
           `Unsupported notification triggers: ${invalidTriggers.join(', ')}`,
         );
         return;
       }
+
+      const triggersNormalized = normalizeNotificationTriggerIds(
+        triggersRequested,
+        allowedTriggerIds,
+      );
       notificationRuleToUpdate.value.triggers = triggersNormalized;
     }
 

app/notifications/trigger-policy.test.ts

@@ -49,6 +49,25 @@ describe('notification trigger policy', () => {
     ).toEqual(['slack.ops', 'smtp.ops']);
   });
 
+  test('normalizeNotificationTriggerIds should resolve shorthand references to canonical ids', () => {
+    const allowedTriggerIds = new Set(['edge.pushover.mobile', 'smtp.gmail']);
+    expect(
+      normalizeNotificationTriggerIds([' pushover.mobile ', 'gmail'], allowedTriggerIds),
+    ).toEqual(['edge.pushover.mobile', 'smtp.gmail']);
+  });
+
+  test('normalizeNotificationTriggerIds should expand shorthand references when multiple ids match', () => {
+    const allowedTriggerIds = new Set([
+      'alpha.pushover.mobile',
+      'beta.pushover.mobile',
+      'smtp.gmail',
+    ]);
+    expect(normalizeNotificationTriggerIds(['mobile'], allowedTriggerIds)).toEqual([
+      'alpha.pushover.mobile',
+      'beta.pushover.mobile',
+    ]);
+  });
+
   test('normalizeNotificationTriggerIds should return empty list for non-array payloads', () => {
     const allowedTriggerIds = new Set(['slack.ops']);
     expect(normalizeNotificationTriggerIds(undefined, allowedTriggerIds)).toEqual([]);

app/notifications/trigger-policy.ts

@@ -20,6 +20,66 @@ export function getNotificationTriggerIdsFromState(
   return triggerIds;
 }
 
+export function doesNotificationTriggerReferenceMatchId(
+  triggerReference: string | undefined,
+  triggerId: string | undefined,
+): boolean {
+  const triggerReferenceNormalized = `${triggerReference || ''}`.trim().toLowerCase();
+  const triggerIdNormalized = `${triggerId || ''}`.trim().toLowerCase();
+
+  if (!triggerReferenceNormalized || !triggerIdNormalized) {
+    return false;
+  }
+
+  if (triggerReferenceNormalized === triggerIdNormalized) {
+    return true;
+  }
+
+  const triggerIdParts = triggerIdNormalized.split('.');
+  const triggerName = triggerIdParts.at(-1);
+  if (!triggerName) {
+    return false;
+  }
+  if (triggerReferenceNormalized === triggerName) {
+    return true;
+  }
+
+  if (triggerIdParts.length >= 2) {
+    const provider = triggerIdParts.at(-2);
+    const providerAndName = `${provider}.${triggerName}`;
+    if (triggerReferenceNormalized === providerAndName) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+export function resolveNotificationTriggerIds(
+  triggerReference: string | undefined,
+  allowedTriggerIds: Set<string>,
+): string[] {
+  const triggerReferenceNormalized = `${triggerReference || ''}`.trim();
+  if (!triggerReferenceNormalized) {
+    return [];
+  }
+
+  const allowedTriggerIdEntries = Array.from(allowedTriggerIds);
+  const exactMatches = allowedTriggerIdEntries.filter(
+    (allowedTriggerId) =>
+      allowedTriggerId.toLowerCase() === triggerReferenceNormalized.toLowerCase(),
+  );
+  if (exactMatches.length > 0) {
+    return exactMatches.sort();
+  }
+
+  return allowedTriggerIdEntries
+    .filter((allowedTriggerId) =>
+      doesNotificationTriggerReferenceMatchId(triggerReferenceNormalized, allowedTriggerId),
+    )
+    .sort();
+}
+
 export function normalizeNotificationTriggerIds(
   triggerIds: string[] | undefined,
   allowedTriggerIds: Set<string>,
@@ -32,7 +92,7 @@ export function normalizeNotificationTriggerIds(
       triggerIds
         .filter((triggerId) => typeof triggerId === 'string')
         .map((triggerId) => triggerId.trim())
-        .filter((triggerId) => triggerId.length > 0 && allowedTriggerIds.has(triggerId)),
+        .flatMap((triggerId) => resolveNotificationTriggerIds(triggerId, allowedTriggerIds)),
     ),
   ).sort();
 }

app/store/notification.test.ts

@@ -353,6 +353,36 @@ describe('Notification Store', () => {
     expect(notification.isTriggerEnabledForRule('update-applied', 'slack.ops')).toBe(false);
   });
 
+  test('getTriggerDispatchDecisionForRule should match shorthand trigger references against full ids', () => {
+    const collection = createCollection();
+    const db = {
+      getCollection: vi.fn(() => collection),
+      addCollection: vi.fn(() => collection),
+    };
+
+    notification.createCollections(db);
+    notification.updateNotificationRule('update-available', {
+      triggers: ['mobile', 'smtp.gmail'],
+    });
+
+    expect(
+      notification.getTriggerDispatchDecisionForRule('update-available', 'edge.pushover.mobile', {
+        allowAllWhenNoTriggers: true,
+      }),
+    ).toEqual({
+      enabled: true,
+      reason: 'matched-allow-list',
+    });
+    expect(
+      notification.getTriggerDispatchDecisionForRule('update-available', 'edge.smtp.gmail', {
+        allowAllWhenNoTriggers: true,
+      }),
+    ).toEqual({
+      enabled: true,
+      reason: 'matched-allow-list',
+    });
+  });
+
   test('isTriggerEnabledForRule should support allow-all fallback when no triggers are configured', () => {
     const collection = createCollection();
     const db = {

app/store/notification.ts

@@ -3,6 +3,7 @@
  */
 import joi from 'joi';
 import { byString } from 'sort-es';
+import { doesNotificationTriggerReferenceMatchId } from '../notifications/trigger-policy.js';
 import { uniqStrings } from '../util/string-array.js';
 import { initCollection } from './util.js';
 
@@ -289,8 +290,8 @@ export function getTriggerDispatchDecisionForRule(
     };
   }
 
-  const matched = rule.triggers.some(
-    (configuredTriggerId) => configuredTriggerId.toLowerCase() === triggerIdNormalized,
+  const matched = rule.triggers.some((configuredTriggerId) =>
+    doesNotificationTriggerReferenceMatchId(configuredTriggerId, triggerIdNormalized),
   );
   return {
     enabled: matched,