fix: remove notification management token from URL query parameters

[atul-upadhyay-7]

Summary

Removes the query parameter fallback (managementToken, token) from getNotificationManagementToken(). The notification management token is now only accepted via:

• x-notification-token HTTP header
• managementToken field in the POST request body

Problem

URL query parameters are persisted and exposed through channels outside the application's security perimeter:

• Server access logs — Vercel, nginx, CDN, and load balancer logs record full request URLs including query strings
• HTTP Referer headers — If the page with the token loads any third-party resource, the full URL including the token leaks to that third party
• CDN/proxy logs — Vercel's edge network and intermediate proxies log query strings

An attacker with access to any of these sources can obtain any user's management token and modify or delete their notification preferences.

Changes

1. lib/notification-management-token.ts — Removed searchParams parameter and query parameter extraction logic from getNotificationManagementToken()
2. app/api/notify/route.ts — Updated DELETE handler to stop passing searchParams to getNotificationManagementToken()
3. lib/notification-management-token.empty-fallback.test.ts — Updated tests to verify query parameters are now ignored (security regression tests)

Testing

• All 26 notification management token tests pass
• All 5 DELETE route tests pass
• All 5 mouse-interactivity tests pass
• Lint passes (0 errors)

Fixes #6132

Human Coded

[vercel]

@atul-upadhyay-7 is attempting to deploy a commit to the jhasourav07's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

📦 Next.js Bundle Size Report (Gzipped Sizes)

✨ No significant bundle size changes detected.

📊 Summary of Totals

Category	PR Size	Base Size	Difference
Total JS	3697.00 KB	3697.00 KB	0 B
Total CSS	296.58 KB	296.58 KB	0 B

[Aamod-Dev]

Great security improvement. Removing the token extraction from URL query parameters in lib/notification-management-token.ts prevents accidental exposure in proxy and server logs. The update to app/api/notify/route.test.ts nicely solidifies this new constraint. Approved!

[github-actions]

🎉 Congratulations @atul-upadhyay-7! Your PR has been successfully merged. 🚀

Thank you for contributing to CommitPulse. Your work helps us build a better tool for the community.

⚠️ Important for GSSoC Contributors:
You are strictly advised to join our Discord Server as it is mandatory for all GSSoC participants. All important announcements, point claims, and community discussions happen there.

Keep building! 💻✨