Notifications & notification center

Active contributors: vault, platform.

Purpose

Two related concepts share the "notifications" name:

1. Push notifications — the Notifications host fans real-time vault-update messages out to connected clients. Mobile uses Azure Notification Hub.
2. Notification Center — an in-product inbox of human-readable notifications (banners, alerts) targeted at a user or an organization.

The push pipeline is documented in systems/push-and-signalr. This page covers the Notification Center.

Notification Center

src/Core/NotificationCenter/
├── Authorization/
├── Commands/
├── Entities/                            # Notification, NotificationStatus
├── Enums/
├── Models/
├── NotificationCenterServiceCollectionExtensions.cs
├── Queries/
└── Repositories/

src/Api/NotificationCenter/
├── Controllers/
└── Models/

src/Sql/dbo/Tables/Notification.sql

Key abstractions

Type	Description
Notification (src/Core/NotificationCenter/Entities/Notification.cs)	Title, body, priority, target (user id and/or organization id), client type filter, schedule.
NotificationStatus	Per-user read / dismissed / deleted state.
INotificationCommand family	Create / update / delete notifications + per-user mark-as-read / dismiss.
INotificationQuery	Query "what notifications should this user see right now?" — combines user-targeted, org-targeted, broadcast, and time-window filters.
Notification_* SQL sprocs	Filtered fetches per user.

How it works

sequenceDiagram
    participant Admin as Admin / Sender
    participant Api
    participant Db
    participant Push as Notifications
    participant Client

    Admin->>Api: POST /notifications (target, body, schedule)
    Api->>Db: Insert Notification
    Api->>Push: PushSyncNotification(userId|orgId)
    Client->>Api: GET /notifications (on app open)
    Api->>Db: NotificationQuery → list
    Client->>Api: PUT /notifications/{id}/dismiss

When a notification is created, the API also pushes a notification-center sync event so connected clients refresh.

Notification types

Notifications come from several sources:

• Bitwarden-broadcast — server announcements (e.g. maintenance windows). Sent by ops via the Admin host.
• Org-issued — admin-driven announcements within an organisation.
• System-generated — login-with-device prompts, auth-request approvals, expiration warnings.

Authorization

src/Core/NotificationCenter/Authorization/ carries handlers that check whether the caller can see / dismiss / delete a particular notification. Org-targeted notifications respect org-membership; broadcasts are public to confirmed users.

Push event types

Notification-center activity is mirrored on the push channel via PushType.SyncNotificationStatus and friends, so an unread badge appears in real time. See systems/push-and-signalr for the routing.

Entry points for modification

• New notification target type → extend Notification + the query/command interfaces; add a push-type if real-time delivery matters.
• New filter (e.g. notify only iOS users) → extend Notification.ClientType + the query predicate.
• New notification source → add a command in src/Core/NotificationCenter/Commands/ and a controller endpoint, or create directly from the relevant feature.