rework notifications

notifications are now system level instead of user level.

To clarify the use events/notifications/email:
* eventlog - everything that is happenning on server
* notifications - specific important events (alerts)
* email - these are really urgent things that require immediate attention. this is for
  the case where an admin does not visit the dashboard often. can also be alerts like
  bad backup config or reboot required which are not events per-se.

Notes on notifications
* oom - notification only
* appUpdated - notification only
* cert renewal failure - only raise when < 10 days to go. also send email thereafter (todo).
* Backup failure - only if last 5 backups failed (todo).
* Box update - notification only. we anyway send newsletter.
* box update available - we raise a notification. no email.
* app update available - we already have update indicator on dashboard. so, no notification or email.

Alerts:
* backup config
* disk space
* mail status
* reboot
* box updated
* ubuntu update required

src/routes/notifications.js

@@ -1,7 +1,7 @@
 'use strict';
 
 exports = module.exports = {
-    verifyOwnership,
+    load,
     get,
     list,
     update
@@ -11,29 +11,27 @@ let assert = require('assert'),
     BoxError = require('../boxerror.js'),
     HttpError = require('connect-lastmile').HttpError,
     HttpSuccess = require('connect-lastmile').HttpSuccess,
-    notifications = require('../notifications.js');
+    notifications = require('../notifications.js'),
+    safe = require('safetydance');
 
-function verifyOwnership(req, res, next) {
-    if (!req.params.notificationId) return next();  // skip for listing
+async function load(req, res, next) {
+    assert.strictEqual(typeof req.params.notificationId, 'string');
 
-    notifications.get(req.params.notificationId, function (error, result) {
-        if (error) return next(BoxError.toHttpError(error));
+    const [error, result] = await safe(notifications.get(req.params.notificationId));
+    if (error) return next(BoxError.toHttpError(error));
+    if (!result) return next(new HttpError(404, 'Notification not found'));
 
-        if (result.userId !== req.user.id) return next(new HttpError(403, 'User is not owner'));
-
-        req.notification = result;
-
-        next();
-    });
+    req.resource = result;
+    next();
 }
 
 function get(req, res, next) {
-    assert.strictEqual(typeof req.notification, 'object');
+    assert.strictEqual(typeof req.resource, 'object');
 
-    next(new HttpSuccess(200, { notification: req.notification }));
+    next(new HttpSuccess(200, req.resource));
 }
 
-function list(req, res, next) {
+async function list(req, res, next) {
     const page = typeof req.query.page !== 'undefined' ? parseInt(req.query.page) : 1;
     if (!page || page < 0) return next(new HttpError(400, 'page query param has to be a postive number'));
 
@@ -42,24 +40,20 @@ function list(req, res, next) {
 
     if (req.query.acknowledged && !(req.query.acknowledged === 'true' || req.query.acknowledged === 'false')) return next(new HttpError(400, 'acknowledged must be a true or false'));
 
-    const acknowledged = req.query.acknowledged ? req.query.acknowledged === 'true' : null;
+    const acknowledged = req.query.acknowledged ? req.query.acknowledged === 'true' : false;
 
-    notifications.list({ userId: req.user.id, acknowledged }, page, perPage, function (error, result) {
-        if (error) return next(BoxError.toHttpError(error));
-
-        next(new HttpSuccess(200, { notifications: result }));
-    });
+    const [error, result] = await safe(notifications.list({ userId: req.user.id, acknowledged }, page, perPage));
+    if (error) return next(BoxError.toHttpError(error));
+    next(new HttpSuccess(200, { notifications: result }));
 }
 
-function update(req, res, next) {
-    assert.strictEqual(typeof req.params.notificationId, 'string');
+async function update(req, res, next) {
+    assert.strictEqual(typeof req.resource, 'object');
     assert.strictEqual(typeof req.body, 'object');
 
     if (typeof req.body.acknowledged !== 'boolean') return next(new HttpError(400, 'acknowledged must be a booliean'));
 
-    notifications.update(req.params.notificationId, { acknowledged: req.body.acknowledged }, function (error) {
-        if (error) return next(BoxError.toHttpError(error));
-
-        next(new HttpSuccess(204, {}));
-    });
+    const [error] = await safe(notifications.update(req.resource, { acknowledged: req.body.acknowledged }));
+    if (error) return next(BoxError.toHttpError(error));
+    next(new HttpSuccess(204, {}));
 }