Support multi-recipient targeting for custom notification #19768
Description
Description
Issue #19611 introduced custom notifications scoped to the requesting user. This follow-up adds recipient targeting (specific users and roles) and refines deduplication to reduce noise/spam.
Implementation
API
Extend POST /notifications/custom to accept a target object alongside content:
{
"content": {
"title": "Custom Title",
"message": "Custom Message"
},
"target": {
"user_ids": ["<USER_ID>", "..."],
"roles": ["templateAdmin", "..."]
}
}
If target is omitted, default to the requesting user (current behavior).
CLI
Update coder notifications custom "<title>" "<message>" to accept targeting flags:
--user-id <UUID>(repeatable)--role <role>(repeatable)
UI
Update user notification settings /settings/notifications to enable/disable receiving custom notifications.
Deduplication
Coder’s notification system uses a deduplication mechanism that computes a hash for each notification based on several factors: the notification template, recipient, delivery method, payload, targets, and the creation date (truncated to day precision). As a result, duplicate notifications are not sent in the same day. This reduces noise and prevents spam. However, for custom notifications, the same message may legitimately be sent multiple times in a single day. A good approach would be:
- For requesters sending a notification to themselves, either do not dedupe or reduce the deduplication timeframe to something shorter (e.g., 1 minute).
- For requesters sending a notification to others, enforce similar notification limits to prevent noise.
Implementation details
Current workflow
- Coder executes an
INSERTquery on thenotification_messagestable - Before the INSERT, the trigger function
update_notification_message_dedupe_hashfires and callscompute_notification_message_dedupe_hash() - The unique index
notification_messages_dedupe_hash_idxon thededupe_hashcolumn prevents duplicate hashes.
Proposal
Update compute_notification_message_dedupe_hash() so that:
- If the sender and recipient are the same user, deduplicate within a 1-minute truncated window (i.e., the same user cannot send the exact same message more than once within the same calendar minute).
- For all other cases keep the existing day-based deduplication window.
Questions
- RBAC: Is a user allowed to send notifications to everyone in the organization? Should we create a new resource specific for Custom Notifications and respective actions.
Related to
- Follow-up from: Support custom notifications #19611