Restricted notification creation to administrators

[9larsons]

What changed

• removed notification:add from the Editor and Super Editor roles
• retained notification:browse and notification:destroy so those roles can still view and dismiss notifications
• added a migration for existing installs and aligned production/test fixtures and integrity expectations
• added API regression coverage for Administrator, Editor, and Super Editor notification creation permissions

Why

Notifications are a system-wide administrative channel. Editor-tier roles need to view and dismiss them, but do not need to create them.

This PR is intentionally limited to permission changes. Notification HTML sanitization can be evaluated separately.

Thanks to @pptx704 for reporting this permission gap in #29746.

Validation

• pnpm nx run ghost:test:unit — 7,710 tests passed
• pnpm nx run ghost:test:integration -- test/integration/migrations/migration.test.js — 4 tests passed
• pnpm nx run ghost:test:e2e -- test/e2e-api/admin/notifications.test.js — 9 tests passed
• focused ESLint on all changed JavaScript files
• schema fixture integrity test

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d2e1f479-c348-4a74-83a8-cfdc7d3c617f

📥 Commits

Reviewing files that changed from the base of the PR and between aea578f and e7314c6.

📒 Files selected for processing (3)

• ghost/core/test/e2e-api/admin/notifications.test.js
• ghost/core/test/utils/agents/admin-api-test-agent.js
• ghost/core/test/utils/e2e-framework.js

---

Walkthrough

The migration removes Add notifications permission from the Editor and Super Editor roles. Role fixtures now allow only browse and destroy notification actions. Tests update permission assertions and verify forbidden creation for restricted roles. API tests now use separate role-specific agents.

Possibly related PRs

• TryGhost/Ghost#29746: Modifies the same notification role fixtures and removes Add notifications permission from Editor and Super Editor roles.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main permission change in the pull request.
Description check	✅ Passed	The description directly explains the permission changes, migration, fixture updates, tests, and validation for the pull request.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/restrict-notification-add

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

It looks like this PR contains a migration 👀
Here's the checklist for reviewing migrations:

General requirements

• ⚠️ Tested performance on staging database servers, as performance on local machines is not comparable to a production environment
• Satisfies idempotency requirement (both up() and down())
• Does not reference models
• Filename is in the correct format (and correctly ordered)
• Targets the next minor version
• All code paths have appropriate log messages
• Uses the correct utils
• Contains a minimal changeset
• Does not mix DDL/DML operations
• Tested in MySQL and SQLite

Schema changes

• Both schema change and related migration have been implemented
• For index changes: has been performance tested for large tables
• For new tables/columns: fields use the appropriate predefined field lengths
• For new tables/columns: field names follow the appropriate conventions
• Does not drop a non-alpha table outside of a major version

Data changes

• Mass updates/inserts are batched appropriately
• Does not loop over large tables/datasets
• Defends against missing or invalid data
• For settings updates: follows the appropriate guidelines

[nx-cloud]

🤖 Nx Cloud AI Fix

Ensure the fix-ci command is configured to always run in your CI pipeline to get automatic fixes in future runs. For more information, please see https://nx.dev/ci/features/self-healing-ci

---

View your CI Pipeline Execution ↗ for commit e7314c6

Command	Status	Duration	Result
nx run ghost:test:ci:integration	✅ Succeeded	3m 13s	View ↗
nx run ghost:test:integration	✅ Succeeded	3m 26s	View ↗
nx run ghost:test:legacy	✅ Succeeded	2m 59s	View ↗
nx run ghost:test:e2e	✅ Succeeded	2m 49s	View ↗
nx run ghost-monorepo:lint:boundaries	✅ Succeeded	22s	View ↗
nx run-many -t test:unit -p ghost	✅ Succeeded	33s	View ↗
nx run-many --target=build --projects=tag:publi...	✅ Succeeded	1s	View ↗
nx run-many -t lint -p ghost,ghost-monorepo	✅ Succeeded	22s	View ↗
nx run @tryghost/admin:build	✅ Succeeded	4s	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

---

☁️ Nx Cloud last updated this comment at 2026-08-04 16:06:25 UTC

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.52%. Comparing base (9e6fe92) to head (e7314c6).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #29754      +/-   ##
==========================================
- Coverage   75.53%   75.52%   -0.02%     
==========================================
  Files        1612     1612              
  Lines      142066   142181     +115     
  Branches    17590    17582       -8     
==========================================
+ Hits       107315   107377      +62     
- Misses      33679    33759      +80     
+ Partials     1072     1045      -27     

Flag	Coverage Δ
e2e-tests	77.65% <ø> (-0.03%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[EvanHahn]

Troy and I both looked at this, and LGTU (looks good to us).

[EvanHahn]

question: do they still need read? (Same comment applies for Editor below.)

[9larsons]

There isn't a separate read action for notifications: GET /notifications is authorized by browse. Editors still need browse to render notifications and destroy to dismiss them per-user, so those two permissions are intentional.