pezza_action_push_web 0.1.2 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eb9c4ebdcbd17365efb10ed10e722ddc65e1313c46904a2fefcab41e2a77d7b3
-  data.tar.gz: b470819fb3149a2a9b48d98ccdfce99aafa86bf7f7f153eb0019c33b15a2e9ac
+  metadata.gz: 93d488729aae040d4f85f2251e45aefb608835869b9c5d568f8e538c02b0e41d
+  data.tar.gz: f6984298ffdcf0b4722bf7eb4a7efdd860befe66ac602add26061596a2bef0c2
 SHA512:
-  metadata.gz: 3b550df8977bdd96661dd9cb96993697d409b0f6555a22e235429971b2e7cbd68a5800205526217b622a101774f1482b65fc60ef4a6ecd99467d8bc28cfb353b
-  data.tar.gz: 644ee1e71e8d4065e87fe9334078725b801ff3a9c2a7ea6f81de719e3e53ec139c4642c4d19852fbed0b798eb051854901a79f3f561189d2419971dd9b5eadef
+  metadata.gz: eb237077e3d17e665abe9213a2a1aac9dbb53458b78ffef87ae3533c7239b2695927f3d94f3c0d01c0ed97e0c568fe12c4a6432a0bdcbac2f326ce2eb0469fdc
+  data.tar.gz: 0d72b0362ea10d90bd530e89eaf4efb083f8e00dff5cf287f966106782bc3ca33f014e45e7498a183844fd2b6e5c3db2441e2c36aa214e29ef3486acc010c717

data/README.md

@@ -93,8 +93,8 @@ shared:
     # Change the subject (default: mailto:sender@example.com).
     # expiration: mailto:support@my-domain.com
 
-    # Change the urgency (default: normal). You also choose to set this at the notification level.
-    # urgency: high
+    # Change the urgency (default: high). You also choose to set this at the notification level.
+    # urgency: normal
 ```
 
 This file contains the configuration for the push notification services you want to use.

data/app/controllers/action_push_web/subscriptions_controller.rb

@@ -1,11 +1,8 @@
 module ActionPushWeb
   class SubscriptionsController < ApplicationController
     def create
-      if subscription = ApplicationPushSubscription.find_by(push_subscription_params)
-        subscription.touch
-      else
-        ApplicationPushSubscription.create! push_subscription_params.merge(user_agent: request.user_agent)
-      end
+      ApplicationPushSubscription.create_with(user_agent: request.user_agent).
+        create_or_find_by!(push_subscription_params)
 
       head :ok
     end

data/app/models/action_push_web/subscription.rb

@@ -2,12 +2,58 @@ module ActionPushWeb
   class Subscription < ApplicationRecord
     include ActiveSupport::Rescuable
 
+    PERMITTED_ENDPOINT_HOSTS = %w[
+      jmt17.google.com
+      fcm.googleapis.com
+      updates.push.services.mozilla.com
+      web.push.apple.com
+      notify.windows.com
+    ].freeze
+
     rescue_from(TokenError) { destroy! }
 
     belongs_to :owner, polymorphic: true, optional: true
 
+    validates :endpoint, presence: true
+    validate :validate_endpoint_url
+
     def push(notification)
       ActionPushWeb.push(SubscriptionNotification.new(notification:, subscription: self))
     end
+
+    def resolved_endpoint_ip
+      return @resolved_endpoint_ip if defined?(@resolved_endpoint_ip)
+      @resolved_endpoint_ip = Surfguard.resolve_public_ips(endpoint_uri&.host).first
+    rescue Surfguard::Unresolvable
+      # A host that resolves to nothing has no usable public IP, same outcome as
+      # one whose only addresses are blocked: no endpoint IP to pin, which fails
+      # endpoint validation. Push has no lookup-failed surface to distinguish.
+      @resolved_endpoint_ip = nil
+    end
+
+    private
+
+      def endpoint_uri
+        @endpoint_uri ||= URI.parse(endpoint) if endpoint.present?
+      rescue URI::InvalidURIError
+        nil
+      end
+
+      def validate_endpoint_url
+        if endpoint_uri.nil?
+          errors.add(:endpoint, "is not a valid URL")
+        elsif endpoint_uri.scheme != "https"
+          errors.add(:endpoint, "must use HTTPS")
+        elsif !permitted_endpoint_host?
+          errors.add(:endpoint, "is not a permitted push service")
+        elsif resolved_endpoint_ip.nil?
+          errors.add(:endpoint, "resolves to a private or invalid IP address")
+        end
+      end
+
+      def permitted_endpoint_host?
+        host = endpoint_uri&.host&.downcase
+        PERMITTED_ENDPOINT_HOSTS.any? { |permitted| host&.end_with?(permitted) }
+      end
   end
 end

data/db/migrate/20251209235643_add_unique_index.rb

@@ -0,0 +1,6 @@
+class AddUniqueIndex < ActiveRecord::Migration[8.1]
+  def change
+    add_index :action_push_web_subscriptions,
+      [ :owner_type, :owner_id, :endpoint ], unique: true
+  end
+end

data/db/migrate/20260517003340_add_unique_index_for_null_owner.rb

@@ -0,0 +1,6 @@
+class AddUniqueIndexForNullOwner < ActiveRecord::Migration[8.1]
+  def change
+    add_index :action_push_web_subscriptions, :endpoint, unique: true,
+      where: "owner_id IS NULL AND owner_type IS NULL"
+  end
+end

data/lib/action_push_web/notification.rb

@@ -46,7 +46,7 @@ module ActionPushWeb
     end
 
     def urgency
-      (@urgency.presence || config.fetch(:urgency, :normal)).to_s
+      (@urgency.presence || config.fetch(:urgency, :high)).to_s
     end
 
     def as_json

data/lib/action_push_web/pusher.rb

@@ -10,7 +10,11 @@ module ActionPushWeb
         it.body = payload
       end
 
-      connection.request(uri, request).tap { handle_response(it) }
+      if resolved_endpoint_ip
+        pinned_connection.request(request)
+      else
+        connection.request(uri, request)
+      end.tap { handle_response(it) }
     rescue OpenSSL::OpenSSLError
       raise TokenError.new
     end
@@ -20,7 +24,7 @@ module ActionPushWeb
     attr_reader :config, :notification
 
     delegate :title, :body, :icon_path, :path, :silent, :badge, :endpoint, :p256dh_key,
-      :auth_key, to: :notification
+      :auth_key, :resolved_endpoint_ip, to: :notification
 
     def message
       JSON.generate title:, options: { body:, icon: icon_path, silent:, badge:, data: { path: } }
@@ -38,6 +42,13 @@ module ActionPushWeb
       @uri ||= URI.parse(endpoint)
     end
 
+    def pinned_connection
+      Net::HTTP.new(uri.host, uri.port).tap do |http|
+        http.ipaddr = resolved_endpoint_ip
+        http.use_ssl = true
+      end
+    end
+
     def headers
       headers = {}
       headers["Content-Type"]     = "application/octet-stream"

data/lib/action_push_web/subscription_notification.rb

@@ -8,6 +8,6 @@ module ActionPushWeb
     attr_reader :notification, :subscription
 
     delegate_missing_to :notification
-    delegate :endpoint, :p256dh_key, :auth_key, to: :subscription
+    delegate :endpoint, :p256dh_key, :auth_key, :resolved_endpoint_ip, to: :subscription
   end
 end

data/lib/action_push_web/version.rb

@@ -1,3 +1,3 @@
 module ActionPushWeb
-  VERSION = "0.1.2"
+  VERSION = "0.3.0"
 end

data/lib/action_push_web.rb

@@ -4,6 +4,7 @@ require "action_push_web/errors"
 require "net/http"
 require "net/http/persistent"
 require "jwt"
+require "surfguard"
 
 loader= Zeitwerk::Loader.for_gem(warn_on_extra_files: false)
 loader.ignore("#{__dir__}/generators")

data/lib/generators/action_push_web/install/templates/config/push.yml.tt

@@ -15,8 +15,8 @@ shared:
     # Change the subject (default: mailto:sender@example.com).
     # subject: mailto:support@my-domain.com
 
-    # Change the urgency (default: normal). You also choose to set this at the notification level.
-    # urgency: high
+    # Change the urgency (default: high). You also choose to set this at the notification level.
+    # urgency: normal
 
     # Change the icon path (default: nil). You also choose to set this at the notification level.
     # icon_path: https://example.com/icon.png

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pezza_action_push_web
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.3.0
 platform: ruby
 authors:
 - Nick Pezza
@@ -93,6 +93,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: surfguard
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Send push notifications to web apps
 email:
 - pezza@hey.com
@@ -116,6 +130,8 @@ files:
 - config/importmap.rb
 - config/routes.rb
 - db/migrate/20250907213606_create_action_push_web_subscriptions.rb
+- db/migrate/20251209235643_add_unique_index.rb
+- db/migrate/20260517003340_add_unique_index_for_null_owner.rb
 - lib/action_push_web.rb
 - lib/action_push_web/engine.rb
 - lib/action_push_web/errors.rb
@@ -156,7 +172,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.7.1
+rubygems_version: 4.0.18
 specification_version: 4
 summary: Send push notifications to web apps
 test_files: []