---
issue: 026
title: "GET /notifications/:id only returns user's most-recent notification — all others return 404 erroneously"
severity: major
domain: Notification
status: resolved
resolved: 2026-05-29
fix: "Fixed getNotificationById in notificationController.ts to use Notification.findOne({ _id: id, userId }) instead of fetching page 1 of user notifications."
labels: [bug, backend, major, broken-feature]
status: open
created: 2026-05-29
source: Doc vs Code Audit 2026-05-29
---

# 🟠 GET /notifications/:id only returns user's most-recent notification — all others return 404 erroneously

**Severity:** major
**Domain:** Notification
**Labels:** bug, backend, major, broken-feature

## Description

The backend getNotificationById controller calls getUserNotifications(userId, 1, 1) — fetching page 1 with limit 1 — then does an in-memory _id string match. Any notification that is not the single most-recent record for that user always returns 404, regardless of ownership.

## Current Behavior

GET /notifications/:id returns 404 for all notifications except the user's most recently created one.

## Expected Behavior

getNotificationById should perform a direct MongoDB query by _id and userId: Notification.findOne({_id, userId}).

## Affected Files

- `backend/src/controllers/notificationController.ts`

## References

- [Doc vs Code Audit Report](../09%20-%20Audits/Doc%20vs%20Code%20Audit%20Report%20-%202026-05-29.md)