Notification read tracking endpoint requires authentication

[innokenty]

The GET /notifications/{id}/read endpoint returns 401 for unauthenticated requests.

This endpoint serves the email tracking pixel and is supposed to be publicly accessible — email clients do not send authentication credentials when loading images.

[innokenty]

Steps to Reproduce

Insert a notification into the database and request the tracking pixel without authentication:

GET /notifications/550e8400-e29b-41d4-a716-446655440000/read

Actual: 401 Unauthorized

Expected: 200 OK with Content-Type: image/gif

---

Existing Golden Tests

Failed tests

EmailNotificationIntegrationTest.shouldMarkNotificationAsReadWhenTrackingPixelIsLoaded:149 [HTTP status code]
expected: 200
 but was: 401

EmailNotificationIntegrationTest.shouldAllowTrackingEndpointWithoutAuthentication:180 [HTTP status code]
expected: 200
 but was: 401

EmailNotificationIntegrationTest.shouldReturn404ForNonExistentNotificationId:239 [HTTP status code]
expected: 404
 but was: 401

EmailNotificationIntegrationTest.shouldReturn400ForInvalidUuidFormat:251 [HTTP status code]
expected: 400
 but was: 401

EmailNotificationIntegrationTest.shouldBeIdempotentWhenCalledMultipleTimes:277 [HTTP status code]
expected: 200
 but was: 401

EmailNotificationIntegrationTest.shouldReturnValidGifImage:341 [HTTP status code]
expected: 200
 but was: 401

Related Passing Tests

• EmailNotificationIntegrationTest
  • shouldReturnCacheControlHeaderForTrackingPixel

FAIL_TO_PASS: EmailNotificationIntegrationTest#shouldMarkNotificationAsReadWhenTrackingPixelIsLoaded, EmailNotificationIntegrationTest#shouldAllowTrackingEndpointWithoutAuthentication, EmailNotificationIntegrationTest#shouldReturn404ForNonExistentNotificationId, EmailNotificationIntegrationTest#shouldReturn400ForInvalidUuidFormat, EmailNotificationIntegrationTest#shouldBeIdempotentWhenCalledMultipleTimes, EmailNotificationIntegrationTest#shouldReturnValidGifImage

[innokenty]

Appears to be an issue in golden tests that reported this bug, the functionality seems to actually be correct.