notification-service: PUT /preferences/:address doesn't enforce that at least one of email/webhook_url is provided

[abayomicornelius]

Area

Notification Service / API Validation

Complexity

Easy

File(s)

notification-service/src/api.ts (PUT handler, lines 111-166)

Problem

docs/NOTIFICATIONS.md documents: "At least one of email or webhook_url must be provided." The handler validates the type of each field individually but never checks that at least one is actually present. A PUT with an empty body (or { enabled: true } only) returns 200 and silently persists a preference that can never notify anyone — notifyInvestors computes hasEmail/hasWebhook as both false and just continues, with no error surfaced anywhere to the caller who thought they'd registered for notifications.

Scope

In:

• Reject (400) a PUT where both email and webhook_url are absent/empty on the resulting preference (accounting for updates to an existing preference that already has one set).

Out:

• Email format validation (separate, lower-priority).

Acceptance Criteria

• PUT /preferences/:address with neither email nor webhook_url (and no pre-existing preference) returns 400 with a clear error message
• Updating an existing preference that already has one channel set, without supplying either field again, is still allowed

[drips-wave]

@abayomicornelius This issue could not be added to the Stellar Wave Program because the per-repo points budget would be exceeded (25000 / 25000 points already used). The label has been automatically removed.

The budget resets at the end of each Wave. You can review the remaining budget for your repos on the Orgs & Repos page.

ℹ️ Learn more about points budgets