Update routes/notifications.py

routes/notifications.py

@@ -25,14 +25,14 @@ SUPABASE_HEADERS = {
 SERVICE_ACCOUNT_FILE = './closetcoach-2d50b-firebase-adminsdk-fbsvc-7fcccbacb1.json'
 FCM_PROJECT_ID = "closetcoach-2d50b"
 
-# Request body
+# Modelo da requisição
 class SimpleNotification(BaseModel):
-    target: str  # "all" or user ID
+    target: str  # "all" ou user_id
     title: str
     content: str
     image_url: str = ""
 
-# Firebase Auth
+# Função para obter token do Firebase
 def get_fcm_access_token():
     credentials = service_account.Credentials.from_service_account_file(
         SERVICE_ACCOUNT_FILE
@@ -43,7 +43,23 @@ def get_fcm_access_token():
     scoped.refresh(Request())
     return scoped.token
 
-# Fetch user info from Supabase
+# Verifica o token de usuário no Supabase
+async def get_user_id_from_token(user_token: str) -> str:
+    url = f"{SUPABASE_URL}/auth/v1/user"
+    headers = {
+        "Authorization": f"Bearer {user_token}",
+        "apikey": SUPABASE_KEY,
+        "Content-Type": "application/json"
+    }
+
+    async with aiohttp.ClientSession() as session:
+        async with session.get(url, headers=headers) as resp:
+            if resp.status != 200:
+                raise HTTPException(status_code=401, detail="Invalid or expired token")
+            data = await resp.json()
+            return data.get("id")
+
+# Busca informações de um usuário pelo ID
 async def get_user(user_id: str):
     url = f"{SUPABASE_URL}/rest/v1/User?id=eq.{user_id}&select=id,token_fcm,manage_notifications"
     async with aiohttp.ClientSession() as session:
@@ -56,10 +72,12 @@ async def get_user(user_id: str):
 @router.post("/send-global-notification")
 async def send_global_notification(
     payload: SimpleNotification,
-    user_id: str = Header(..., alias="User-id")
+    user_token: str = Header(..., alias="User-key")
 ):
-    # Autorização
-    sender = await get_user(user_id)
+    # Verifica o ID do usuário autenticado
+    sender_id = await get_user_id_from_token(user_token)
+    sender = await get_user(sender_id)
+
     if not sender or not sender.get("manage_notifications"):
         raise HTTPException(status_code=403, detail="Not authorized to send notifications")
 
@@ -76,13 +94,11 @@ async def send_global_notification(
     if payload.target == "all":
         message["topic"] = "all"
     else:
-        # Busca o token FCM do usuário de destino
         target_user = await get_user(payload.target)
         if not target_user or not target_user.get("token_fcm"):
             raise HTTPException(status_code=404, detail="Target user or FCM token not found")
         message["token"] = target_user["token_fcm"]
 
-    # Enviar para Firebase
     access_token = get_fcm_access_token()
     headers = {
         "Authorization": f"Bearer {access_token}",