feat(notifications): protect security-critical notification preferences (#1160)

[NoahJoseph-ux]

Overview

This PR makes it impossible for a user (or a compromised session) to disable security-critical notifications. Security events — new-device login, password change, payment receipts, and account deletion — are the user's early-warning system for account compromise, so opting out of them (via updatePreferences, toggleChannel, or unsubscribe) is now rejected with a 400. It also hardens preference updates by validating every incoming key against a known allowlist, so typos or unknown fields fail fast instead of silently writing junk rows.

Related Issue

Closes #1160

Changes

Security-critical event protection

• [ADD] src/notifications/preferences/notification-preferences.constants.ts — SECURITY_CRITICAL_EVENT_TYPES, KNOWN_EVENT_TYPES, EVENT_FREQUENCIES, CHANNEL_KEYS.
• [MODIFY] preferences.service.ts — updatePreferences rejects never frequency or false subscription for any security-critical event type; unsubscribe rejects security-critical types while still allowing non-critical opt-out and the global "all" switch.

Key validation (allowlist)

• [MODIFY] preferences.service.ts — updatePreferences now rejects unknown top-level keys, unknown event types, and invalid frequency values with BadRequestException before any write.

Delivery-channel safety net

• [MODIFY] preferences.service.ts — updatePreferences/toggleChannel refuse to disable the last remaining enabled delivery channel, guaranteeing security-critical notifications always keep a delivery path.

Tests

• [ADD] preferences.service.spec.ts — 17 unit tests covering every guard and the allowed paths (non-critical opt-out, protected-type re-enable, global unsubscribe, multi-channel toggles).

Verification Results

npx jest src/notifications/preferences

• ✅ Test Suites: 1 passed, 1 total / Tests: 17 passed, 17 total
• ✅ eslint clean on all changed files
• ✅ TypeScript compiles for the notifications module (pre-existing unrelated tsc errors exist elsewhere in the repo, e.g. src/rbac/roles/roles.controller.ts, untouched by this PR)

Acceptance Criteria

Status	Criterion
✅	Security-critical event types cannot be disabled via eventFrequency or topicSubscriptions
✅	unsubscribe rejects security-critical event types
✅	Unknown preference keys / event types / frequencies rejected with 400
✅	Last enabled delivery channel cannot be disabled
✅	Non-security-critical opt-out still works
✅	Global unsubscribe ("all") still works
✅	17/17 unit tests pass

[drips-wave]

@NoahJoseph-ux Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[RUKAYAT-CODER]

Thank you for contributing to the project