feat: add nudge application functionality

[AnujChhikara]

Date: 15 Jan 2026

Developer Name: @AnujChhikara

---

Tech Doc

User Onboarding flow

Issue Ticket Number

• feat: Add Application Nudge API with 24-Hour Cooldown #2540

Description

• Introduced a new endpoint to nudge applications, allowing users to send reminders.
• Implemented logic to prevent nudging if the last nudge was less than 24 hours ago, with appropriate error messages.
• Updated application constants to include new API response and error messages related to the nudge feature.
• Enhanced the applications controller to handle nudge requests and update application nudge counts accordingly.

Documentation Updated?

• Yes
• No

Under Feature Flag

• Yes
• No

Database Changes

• Yes
• No

Breaking Changes

• Yes
• No

Development Tested?

• Yes
• No

Screenshots

Screenshot 1

Screen.Recording.2026-01-15.at.1.00.53.AM.mov

Test Coverage

Screenshot 1

Additional Notes

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Walkthrough

This PR implements a nudge application feature by adding success and error message constants, creating a nudgeApplication controller that enforces a 24-hour cooldown between nudges, and exposing it via a new authenticated PATCH route.

Changes

Cohort / File(s)	Summary
Message Constants constants/application.ts	Added NUDGE_SUCCESS to API_RESPONSE_MESSAGES and NUDGE_TOO_SOON to APPLICATION_ERROR_MESSAGES
Nudge Controller controllers/applications.ts	Implemented nudgeApplication handler that fetches the application, validates existence, enforces 24-hour cooldown via convertDaysToMilliseconds, increments nudge count, updates lastNudgeAt, and returns appropriate responses
Route Registration routes/applications.ts	Added PATCH /:applicationId/nudge route with authentication middleware connected to the nudge controller

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related issues

• feat: Add Application Nudge API with 24-Hour Cooldown #2540: Directly addresses nudge application feature implementation with 24-hour cooldown and related constants

Possibly related PRs

• feat: Implement Create Application Flow for User Onboarding #2534: Prior expansion of constants/application.ts with API response and error message keys used by this feature
• test: add test for the application create flow  #2536: Related constants expansion that establishes the message infrastructure this PR extends

Suggested reviewers

• MayankBansal12
• iamitprakash

Poem

🐰 A nudge here, a nudge there,
Applications get some care,
Twenty-four hours must pass by,
Before another nudge can fly,
Success messages hop with glee! 🥕

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The pull request title accurately and concisely describes the main change: adding nudge application functionality that is reflected across constants, controller, and routes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description check	✅ Passed	The pull request description accurately details the changes: a new nudge endpoint, 24-hour cooldown logic, updated constants, and controller enhancements.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

In general, to fix missing rate limiting on an authenticated/authorized route, you introduce a rate-limiting middleware (e.g., using express-rate-limit) and apply it to that route (or to the router) so that each client can only call it a bounded number of times per time window.

For this specific file, the least intrusive fix that preserves existing behavior is:

• Import express-rate-limit at the top.
• Define a limiter (e.g., allowing a small number of “nudge” calls per IP per time window, such as 10 per minute or similar).
• Insert that limiter in the middleware chain for the router.patch("/:applicationId/nudge", ...) route, immediately after authenticate so that it rate-limits per client IP while still ensuring only authenticated users access the endpoint.
• Do not change other routes or application logic.

Concretely:

• In routes/applications.ts, add const RateLimit = require("express-rate-limit"); after the existing require statements.
• Add a constant nudgeRateLimiter = RateLimit({ ... }) near the router definition.
• Modify line 27 to include nudgeRateLimiter in the middleware list: router.patch("/:applicationId/nudge", authenticate, nudgeRateLimiter, applications.nudgeApplication);.

This addresses all alert variants, since they all refer to missing rate limiting on that same route.

[coderabbitai]

Actionable comments posted: 3

🤖 Fix all issues with AI agents

In `@controllers/applications.ts`:
- Around line 163-205: The nudgeApplication handler currently reads the
application, checks cooldown, and then updates, which risks race conditions and
lacks ownership checks; update nudgeApplication to verify req.userData.id owns
the application (compare against application.ownerId or similar) and return 403
if not, and move the cooldown check + increment into an atomic model operation
(e.g., add a new ApplicationModel.atomicNudge or modify updateApplication to
accept a conditional where lastNudgeAt < now - 24h) so the DB performs the
check-and-update in one transaction; keep references to
ApplicationModel.getApplicationById and ApplicationModel.updateApplication (or
replace with ApplicationModel.atomicNudge) and ensure the handler uses the
model-level method and only returns the new nudgeCount/lastNudgeAt from the
atomic response.
- Around line 172-174: Move the computation of twentyFourHoursInMilliseconds
(currently set via convertDaysToMilliseconds(1)) inside the if (lastNudgeAt)
block so it is only calculated when application.lastNudgeAt is truthy; keep
currentTime and lastNudgeAt declarations where they are, then reference
twentyFourHoursInMilliseconds only inside the block that checks if (lastNudgeAt)
to avoid unnecessary work.

In `@routes/applications.ts`:
- Line 33: The nudgeApplication controller currently allows any authenticated
user to nudge any application; after you load the application in
applications.nudgeApplication, add an ownership check that compares the
authenticated user id (e.g., req.user.id or req.userId depending on your auth
middleware) to the application's owner id (e.g., application.userId or
application.ownerId) and return a 403/Unauthorized response if they don’t match
unless the user is a superuser; specifically insert this check immediately after
fetching the application in nudgeApplication and before performing the nudge
action, using the same error response format your API uses.

📜 Review details

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 07a3363 and f3e14e7.

📒 Files selected for processing (3)

• constants/application.ts
• controllers/applications.ts
• routes/applications.ts

🧰 Additional context used

🧠 Learnings (1)

📚 Learning: 2026-01-13T05:25:47.159Z

Learnt from: AnujChhikara
Repo: RealDevSquad/website-backend PR: 2534
File: services/applicationService.ts:79-85
Timestamp: 2026-01-13T05:25:47.159Z
Learning: In the application creation flow (services/applicationService.ts), users with applications created before January 1, 2026 are intentionally allowed to create new applications regardless of whether their old application status was ACCEPTED, REJECTED, or PENDING. Only applications created after the cutoff date should prevent duplicate submissions by throwing a Conflict error.

Applied to files:

• controllers/applications.ts

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: build (22.10.0)
• GitHub Check: Analyze (javascript)

🔇 Additional comments (3)

constants/application.ts (1)

20-20: LGTM!

The new constants are clear, descriptive, and follow the existing naming conventions.

Also applies to: 25-25

controllers/applications.ts (2)

6-6: LGTM!

The new imports are correctly added and used by the nudgeApplication handler.

Also applies to: 10-10

---

213-213: LGTM!

The new handler is correctly exported.

_{✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.}