fix(api): harden notification assignee persistence

packages/api/src/router/notification-broadcast-procedure-support.ts

@@ -31,6 +31,19 @@ function hasTaskLikeBroadcastMetadata(input: z.infer<typeof CreateBroadcastInput
     || input.dueDate !== undefined;
 }
 
+function requireImmediateBroadcastTransaction(
+  db: BroadcastPersistenceDb,
+): NonNullable<BroadcastPersistenceDb["$transaction"]> {
+  if (typeof db.$transaction !== "function") {
+    throw new TRPCError({
+      code: "INTERNAL_SERVER_ERROR",
+      message: "Immediate broadcasts require transactional persistence support.",
+    });
+  }
+
+  return db.$transaction.bind(db);
+}
+
 function buildBroadcastCreateData(
   senderId: string,
   input: z.infer<typeof CreateBroadcastInputSchema>,
@@ -178,10 +191,9 @@ export async function createBroadcast(
   let notificationIds: BroadcastRecipientNotification[] = [];
 
   try {
-    const transactionResult = typeof ctx.db.$transaction === "function"
-      ? await ctx.db.$transaction((tx) =>
-          persistImmediateBroadcast(tx as typeof ctx.db, senderId, input, recipientIds))
-      : await persistImmediateBroadcast(ctx.db, senderId, input, recipientIds);
+    const transaction = requireImmediateBroadcastTransaction(ctx.db);
+    const transactionResult = await transaction((tx) =>
+      persistImmediateBroadcast(tx as typeof ctx.db, senderId, input, recipientIds));
 
     persistedBroadcast = transactionResult.broadcast;
     notificationIds = transactionResult.notificationIds;

packages/api/src/router/notification-procedure-base.ts

@@ -93,6 +93,18 @@ export function rethrowNotificationReferenceError(error: unknown): never {
       ? candidate.meta.modelName.toLowerCase()
       : "";
 
+    if (
+      typeof candidate.code === "string"
+      && (candidate.code === "P2003" || candidate.code === "P2025")
+      && fieldName.includes("assignee")
+    ) {
+      throw new TRPCError({
+        code: "NOT_FOUND",
+        message: "Assignee user not found",
+        cause: error,
+      });
+    }
+
     if (
       typeof candidate.code === "string"
       && (candidate.code === "P2003" || candidate.code === "P2025")

packages/api/src/router/notification-task-procedure-support.ts

@@ -15,6 +15,7 @@ import {
   ListNotificationTasksInputSchema,
   NotificationIdInputSchema,
   type NotificationProcedureContext,
+  rethrowNotificationReferenceError,
   requireNotificationDbUser,
   resolveUserId,
   sendNotificationEmail,
@@ -312,10 +313,15 @@ export async function assignTask(
     });
   }
 
-  const updated = await ctx.db.notification.update({
-    where: { id: input.id },
-    data: { assigneeId: input.assigneeId },
-  });
+  let updated;
+  try {
+    updated = await ctx.db.notification.update({
+      where: { id: input.id },
+      data: { assigneeId: input.assigneeId },
+    });
+  } catch (error) {
+    rethrowNotificationReferenceError(error);
+  }
 
   emitTaskAssigned(input.assigneeId, updated.id);
   return updated;