fix: Prevent sending notifications to deactivated users

server/api/helpers/notifications/create-many.js

@@ -296,27 +296,29 @@ module.exports = {
     });
 
     const notificationsByUserId = _.groupBy(notifications, 'userId');
-    const userIds = Object.keys(notificationsByUserId);
 
-    const notificationServices = await NotificationService.qm.getByUserIds(userIds);
+    const notifiableUsers = await User.qm.getByIds(Object.keys(notificationsByUserId), {
+      withDeactivated: false,
+    });
+
+    if (notifiableUsers.length > 0) {
+      const notifiableUserIds = sails.helpers.utils.mapRecords(notifiableUsers);
+
+      const notificationServices = await NotificationService.qm.getByUserIds(notifiableUserIds);
       const { transporter } = await sails.helpers.utils.makeSmtpTransporter();
 
       if (notificationServices.length > 0 || transporter) {
-      const users = await User.qm.getByIds(userIds);
-      const userById = _.keyBy(users, 'id');
-
         const notificationServicesByUserId = _.groupBy(notificationServices, 'userId');
 
-      Object.keys(notificationsByUserId).forEach(async (userId) => {
+        notifiableUsers.forEach(async (notifiableUser) => {
-        const notifiableUser = userById[userId];
           const t = sails.helpers.utils.makeTranslator(notifiableUser.language);
 
-        const emails = notificationsByUserId[userId].flatMap((notification) => {
+          const emails = notificationsByUserId[notifiableUser.id].flatMap((notification) => {
             const values = valuesById[notification.id];
 
-          if (notificationServicesByUserId[userId]) {
+            if (notificationServicesByUserId[notifiableUser.id]) {
-            const services = notificationServicesByUserId[userId].map((notificationService) =>
+              const services = notificationServicesByUserId[notifiableUser.id].map(
-              _.pick(notificationService, ['url', 'format']),
+                (notificationService) => _.pick(notificationService, ['url', 'format']),
               );
 
               buildAndSendNotifications(
@@ -348,6 +350,7 @@ module.exports = {
           }
         });
       }
+    }
 
     return notifications;
   },

server/api/helpers/notifications/create-one.js

@@ -277,11 +277,15 @@ module.exports = {
       user: values.creatorUser,
     });
 
+    const notifiableUser = await User.qm.getOneById(notification.userId, {
+      withDeactivated: false,
+    });
+
+    if (notifiableUser) {
       const notificationServices = await NotificationService.qm.getByUserId(notification.userId);
       const { transporter } = await sails.helpers.utils.makeSmtpTransporter();
 
       if (notificationServices.length > 0 || transporter) {
-      const notifiableUser = await User.qm.getOneById(notification.userId);
         const t = sails.helpers.utils.makeTranslator(notifiableUser.language);
 
         if (notificationServices.length > 0) {
@@ -311,6 +315,7 @@ module.exports = {
           );
         }
       }
+    }
 
     return notification;
   },

server/api/hooks/query-methods/models/User.js

@@ -48,7 +48,17 @@ const createOne = async (values) => {
   return User.create({ ...values }).fetch();
 };
 
-const getByIds = (ids) => defaultFind(ids);
+const getByIds = (ids, { withDeactivated = true } = {}) => {
+  const criteria = {
+    id: ids,
+  };
+
+  if (!withDeactivated) {
+    criteria.isDeactivated = false;
+  }
+
+  return defaultFind(criteria);
+};
 
 const getAll = ({ roleOrRoles } = {}) =>
   defaultFind({