feat: notification enhancement

internal/repository/push_repo.go

@@ -74,8 +74,9 @@ func (r *PushRepo) PruneToMostRecent(ctx context.Context, userID string, keep in
 	return nil
 }
 
-// DeleteByEndpoint removes a subscription (on unsubscribe or when the push
-// service reports it gone).
+// DeleteByEndpoint removes a subscription (when the push service reports it
+// gone). Server-internal — user-initiated unsubscribes must go through
+// DeleteByEndpointForUser so one user can't remove another's subscription.
 func (r *PushRepo) DeleteByEndpoint(ctx context.Context, endpoint string) error {
 	_, err := r.pg.Pool.Exec(ctx,
 		`DELETE FROM push_subscriptions WHERE endpoint = $1`, endpoint)
@@ -84,3 +85,15 @@ func (r *PushRepo) DeleteByEndpoint(ctx context.Context, endpoint string) error
 	}
 	return nil
 }
+
+// DeleteByEndpointForUser removes a subscription only if it belongs to the
+// given user — the ownership-checked variant for the unsubscribe endpoint.
+func (r *PushRepo) DeleteByEndpointForUser(ctx context.Context, userID, endpoint string) error {
+	_, err := r.pg.Pool.Exec(ctx,
+		`DELETE FROM push_subscriptions WHERE endpoint = $1 AND user_id = $2`,
+		endpoint, userID)
+	if err != nil {
+		return fmt.Errorf("delete push subscription: %w", err)
+	}
+	return nil
+}