Feature: Pushover Notification Provider

[Wikid82]

No description provided.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

✅ Supply Chain Verification Results

✅ PASSED

📦 SBOM Summary

• Components: 1483

🔍 Vulnerability Scan

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	4
🟢 Low	2
Total	6

📎 Artifacts

• SBOM (CycloneDX JSON) and Grype results available in workflow artifacts

---

_{Generated by Supply Chain Verification workflow • View Details}

[codecov]

Codecov Report

❌ Patch coverage is 93.65079% with 4 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
backend/internal/services/notification_service.go	88.57%	2 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

Adds a new Pushover notification provider across backend + frontend, extends supported-provider plumbing, and adds/updates tests and documentation so the provider can be configured, stored securely (write-only token), and dispatched via Pushover’s API.

Changes:

• Add Pushover as a supported provider type end-to-end (UI form, API normalization, backend dispatch + feature flag).
• Add Playwright E2E coverage for Pushover provider CRUD/test/security behavior and update existing notification tests for the new supported type list.
• Update docs/changelog and bump a few dependencies and workflow action pins.

Reviewed changes

Copilot reviewed 29 out of 31 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/settings/pushover-notification-provider.spec.ts	New Playwright E2E spec covering Pushover form rendering + CRUD + payload/security assertions.
tests/settings/notifications.spec.ts	Updates mocked “legacy provider” examples and supported provider type option count/list.
tests/fixtures/notifications.ts	Extends fixture types with pushover and adds a pushover provider fixture.
frontend/src/pages/tests/Notifications.test.tsx	Updates supported type expectations; adds unit test for Pushover form field rendering.
frontend/src/pages/Notifications.tsx	Adds Pushover to JSON-template support; updates form labels/placeholders and token handling for submit.
frontend/src/locales/en/translation.json	Adds English i18n strings for Pushover labels/placeholders/help text.
frontend/src/components/tests/SecurityNotificationSettingsModal.test.tsx	Updates provider type dropdown option expectations to include pushover.
frontend/src/api/notifications.ts	Adds pushover to supported types and preserves token handling for write actions.
frontend/src/api/notifications.test.ts	Updates unsupported-type test and adds assertions that pushover is supported + token is preserved.
frontend/src/api/tests/notifications.test.ts	Updates unsupported-type test case now that pushover is supported.
frontend/package.json	Bumps TypeScript ESLint packages patch version.
frontend/package-lock.json	Lockfile updates for TypeScript ESLint patch bump and related transitive resolutions.
docs/reports/qa_report_pushover_notifications.md	Adds a QA/security audit report for the Pushover provider (but includes now-stale findings).
docs/plans/current_spec.md.bak2	Adds a backup plan doc unrelated to this PR’s feature scope.
docs/features/notifications.md	Documents Pushover provider setup and template examples.
backend/internal/services/notification_service_test.go	Adds Pushover dispatch tests and updates existing migration/unsupported-type tests.
backend/internal/services/notification_service.go	Implements Pushover dispatch path (hostname pin, required fields, emergency priority rejection) + feature-flag routing.
backend/internal/services/enhanced_security_notification_service.go	Includes Pushover in aggregated provider config.
backend/internal/notifications/router_test.go	Adds router tests for Slack and Pushover notify-routing feature flags.
backend/internal/notifications/router.go	Routes Slack/Pushover through notify engine based on service flags.
backend/internal/notifications/feature_flags.go	Adds feature.notifications.service.pushover.enabled flag constant.
backend/internal/api/handlers/security_notifications_final_blockers_test.go	Updates unsupported-type test inputs now that pushover is supported.
backend/internal/api/handlers/notification_provider_handler_test.go	Adds handler tests asserting TOKEN_WRITE_ONLY rejection for Telegram + Pushover in Test endpoint.
backend/internal/api/handlers/notification_provider_handler.go	Allows pushover type; preserves token on update; rejects tokens on Test endpoint for Telegram/Pushover.
backend/internal/api/handlers/notification_provider_discord_only_test.go	Updates unsupported-type test input from pushover to sms.
backend/internal/api/handlers/notification_coverage_test.go	Updates unsupported-type test input from pushover to sms.
backend/go.mod	Bumps sqlite deps (go-sqlite3 and modernc sqlite indirect).
backend/go.sum	go.sum updates for bumped sqlite deps.
CHANGELOG.md	Documents new Pushover provider feature and behavior constraints.
.github/workflows/security-pr.yml	Updates pinned github/codeql-action/upload-sarif commit SHA.

Files not reviewed (1)

• frontend/package-lock.json: Language not supported

Comments suppressed due to low confidence (1)

docs/features/notifications.md:266

• The “Planned Provider Expansion” text mentions Telegram as a future provider, but Telegram is already a supported provider type in the codebase and tests. This section should be updated to avoid misleading documentation (e.g., reference genuinely future providers or remove the outdated example).

## Planned Provider Expansion

Additional providers (for example Telegram) are planned for later staged
releases. This page will be expanded as each provider is validated and released.

---

You can also share your feedback on Copilot code review. Take the survey.