@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.4

package/dist/notifications/channels/push-notification.channel.d.ts

@@ -0,0 +1,82 @@
+import type { NotificationsPrisma } from '../data/notifications-db';
+import { PushConfigService } from '../push-config.service';
+import type { NotificationChannel } from '../notification-events';
+import { type PushPayloadHook } from './push-payload';
+import type { ChannelDeliveryResult, NotificationChannelSender, NotificationDispatchContext, NotificationRecipient } from '../notification.types';
+/**
+ * Exported for an app's own unit tests (`@marinoscar/platform-api/notifications/testing`); not an extension point: reach it through `NotificationsModule` and its documented seams.
+ *
+ * @internal
+ */
+export declare class PushNotificationChannel implements NotificationChannelSender {
+    private readonly prisma;
+    private readonly pushConfig;
+    private readonly pushPayload?;
+    readonly channel: NotificationChannel;
+    private readonly logger;
+    constructor(prisma: NotificationsPrisma, pushConfig: PushConfigService, pushPayload?: (PushPayloadHook | null) | undefined);
+    /**
+     * The "address" for this channel is the ACCOUNT ITSELF, same as
+     * `BrowserNotificationChannel.resolveTo` and for the identical reason: a
+     * push delivery fans out to every subscription ROW this user has, keyed by
+     * `userId`, so there is no single "address" to resolve up front — that
+     * happens inside `deliver`, once the subscriptions are actually loaded.
+     *
+     * `null` for a recipient with no account (`allowlist.invitation`'s
+     * recipient), which by construction can never have a `push_subscriptions`
+     * row either: subscribing requires a signed-in browser calling the
+     * subscribe endpoint, which requires an account.
+     */
+    resolveTo(recipient: NotificationRecipient): string | null;
+    /**
+     * Render, write the inbox row, then fan the encrypted payload out to every
+     * subscription this user has registered.
+     *
+     * NEVER THROWS — see the interface's own note on this being a guarantee
+     * that must survive a future implementer, not a promise this
+     * implementation happens to keep today. Every branch below returns a
+     * `ChannelDeliveryResult`.
+     *
+     * @param to - the user id from {@link resolveTo}.
+     */
+    deliver(context: NotificationDispatchContext, to: string): Promise<ChannelDeliveryResult>;
+    /**
+     * The subscriptions this channel pushes to, as a `where` filter added to the
+     * recipient's (#746). Every subscription for `push`; the `android_app`
+     * channel narrows it to `platform: 'android_app'`.
+     *
+     * @returns a Prisma `where` fragment.
+     */
+    protected subscriptionScope(): Record<string, unknown>;
+    /**
+     * The delivery error when the recipient has no subscription in scope.
+     *
+     * @returns the error text recorded on the delivery row.
+     */
+    protected noSubscriptionsError(): string;
+    /** The allowlisted extras the app's hook adds for this push (empty without a hook). */
+    private extrasFor;
+    private deliverInner;
+    /**
+     * Render an event's untyped payload into what the device shows.
+     *
+     * A DELIBERATE DUPLICATE of `BrowserNotificationChannel.render`, not an
+     * extraction into a shared helper — see that file's `formatRoles` comment,
+     * which rejects sharing formatting logic across channel surfaces for the
+     * same reason this method is copied rather than imported: the two channels
+     * are independently pluggable, and a "shared render" would be the first
+     * thread tying their behaviour together, the same coupling this file's own
+     * header comment argues against for the *id* they each mint. What genuinely
+     * IS shared — the browser binding (`eventBrowserTemplateRegistry`, since
+     * #678; `EVENT_BROWSER_TEMPLATES` before it), and `sanitizeLink` — is
+     * imported, because a divergence there would be a security or content bug,
+     * not a legitimate per-channel choice.
+     *
+     * Falls back to the registry's `label`/`description` on a template miss,
+     * identical to the browser channel's own fallback rule: there is already
+     * user-facing copy for every event, and a push notification with no body at
+     * all is a worse outcome than one with slightly generic copy.
+     */
+    private render;
+}
+//# sourceMappingURL=push-notification.channel.d.ts.map

package/dist/notifications/channels/push-notification.channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-notification.channel.d.ts","sourceRoot":"","sources":["../../../src/notifications/channels/push-notification.channel.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAQlE,OAAO,EAGL,KAAK,eAAe,EAErB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACV,qBAAqB,EACrB,yBAAyB,EACzB,2BAA2B,EAC3B,qBAAqB,EACtB,MAAM,uBAAuB,CAAC;AA6G/B;;;;GAIG;AACH,qBACa,uBAAwB,YAAW,yBAAyB;IAM5C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAChD,OAAO,CAAC,QAAQ,CAAC,UAAU;IAEoB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAR9E,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAU;IAE/C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4C;gBAGvB,MAAM,EAAE,mBAAmB,EACpD,UAAU,EAAE,iBAAiB,EAEkB,WAAW,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA;IAGtG;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,SAAS,EAAE,qBAAqB,GAAG,MAAM,GAAG,IAAI;IAI1D;;;;;;;;;;OAUG;IACG,OAAO,CACX,OAAO,EAAE,2BAA2B,EACpC,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,qBAAqB,CAAC;IAgBjC;;;;;;OAMG;IACH,SAAS,CAAC,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAItD;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,IAAI,MAAM;IAIxC,uFAAuF;IACvF,OAAO,CAAC,SAAS;YAUH,YAAY;IA2N1B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,MAAM;CA6Bf"}

package/dist/notifications/channels/push-notification.channel.js

@@ -0,0 +1,463 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var PushNotificationChannel_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PushNotificationChannel = void 0;
+const common_1 = require("@nestjs/common");
+const webpush = __importStar(require("web-push"));
+const web_push_1 = require("web-push");
+const index_1 = require("../../core/index");
+const describe_thrown_1 = require("../describe-thrown");
+const push_config_service_1 = require("../push-config.service");
+const registry_1 = require("../registry");
+const browser_notification_channel_1 = require("./browser-notification.channel");
+const ports_1 = require("../ports");
+const push_payload_1 = require("./push-payload");
+// =============================================================================
+// PushNotificationChannel (issue #230, epic #215)
+// =============================================================================
+//
+// The third `NotificationChannelSender`, and the first one that leaves this
+// process entirely: `BrowserNotificationChannel` writes a row and nudges a
+// socket THIS SERVER holds open; this one hands an encrypted payload to a
+// push service (FCM, Mozilla's autopush, ...) that is under no obligation to
+// deliver it promptly, or at all, or to a tab that is even open. That is also
+// the whole point of it existing — it is the one channel that can reach a
+// user with the app closed, which #226's "browser toast" plainly cannot.
+//
+// -----------------------------------------------------------------------------
+// WHAT ID DOES A PUSH DELIVERY REFERENCE? PUSH WRITES ITS OWN `Notification` ROW.
+// -----------------------------------------------------------------------------
+//
+// `NotificationDispatchContext` carries no id produced by a sibling channel —
+// by the interface's own design (`notification.types.ts`), nothing threads
+// state from one channel's `deliver()` call into the next. Channels are
+// dispatched sequentially in `NotificationsService.dispatch()`'s `for` loop,
+// but the same `context` object is simply reused across them; it never
+// mutates and it never accumulates a "the browser channel already wrote row
+// X" fact for this channel to read.
+//
+// Depending on the browser channel having run first — and successfully —
+// within the same dispatch would therefore be an undocumented, fragile
+// coupling between two channels that are supposed to be independently
+// pluggable (add one, remove one, reorder the array in
+// `notifications.module.ts`, and nothing else should care). Today that
+// coupling would not even have a payoff: no `NOTIFICATION_EVENTS` entry
+// declares `push` in its `channels` array yet (this channel ships
+// correctly-unreachable until a future event opts in, exactly as `browser`
+// did in #122 before #127/#128 gave it real registrations), so there is no
+// event today where browser and push would BOTH fire for the same
+// notification — the id-collision case a shared id would exist to prevent
+// does not exist yet either.
+//
+// So: `deliver` creates its own `Notification` row via
+// `this.prisma.notification.create(...)` — the exact same call shape
+// `BrowserNotificationChannel` makes — and uses THAT row's `id` in the push
+// payload. This makes push self-sufficient regardless of whether browser is
+// also registered for a future event, and it gives a push recipient a
+// durable, findable bell entry even if they never had a tab open, which is
+// arguably the more correct default for a push-first event.
+//
+// ACCEPTED TRADEOFF: if a future event declares BOTH `browser` and `push`,
+// this produces TWO separate `Notification` rows for one logical event — one
+// written by each channel, both real, neither referencing the other. That is
+// deliberate for now. The real fix if that combination is ever wanted is
+// threading a shared id down from the dispatcher itself, not channels
+// guessing at, or depending on the order of, each other's side effects.
+//
+// -----------------------------------------------------------------------------
+// WHY THIS CHANNEL READS/WRITES `push_subscriptions` DIRECTLY, NOT THROUGH
+// `PushSubscriptionService`
+// -----------------------------------------------------------------------------
+//
+// See `notifications.module.ts`: that service stays scoped to the
+// subscribe/unsubscribe endpoints, which is the only place a *user* mutates
+// their own subscription rows. This channel's relationship to the table is
+// different in kind — it reads every subscription for a recipient to fan a
+// delivery out, and it prunes or ages rows based on what a push SERVICE says
+// about them, never on behalf of a signed-in user's own request. Folding that
+// into `PushSubscriptionService` would mix "acting for the current user" with
+// "acting for the dispatcher", which is exactly the kind of blurred
+// responsibility `NotificationStreamService`/`NotificationStoreService` avoid
+// by being separately scoped, single-purpose providers.
+// =============================================================================
+/** Length caps applied before a push payload is built. See {@link truncate}. */
+const MAX_TITLE_LENGTH = 200;
+const MAX_BODY_LENGTH = 2_000;
+/**
+ * How many consecutive delivery failures (429/5xx, or anything else
+ * unexpected) an endpoint tolerates before its subscription row is deleted.
+ *
+ * 5 tolerates a handful of transient failures — a push service having a bad
+ * minute — without endlessly accumulating rows for an endpoint that is
+ * actually gone for good. A 404/410 is unambiguous ("this endpoint no longer
+ * exists") and prunes immediately regardless of this counter; this threshold
+ * only governs the ambiguous case where the push service is complaining but
+ * has not yet told us the subscription is dead.
+ */
+const MAX_PUSH_FAILURE_COUNT = 5;
+/**
+ * Exported for an app's own unit tests (`@marinoscar/platform-api/notifications/testing`); not an extension point: reach it through `NotificationsModule` and its documented seams.
+ *
+ * @internal
+ */
+let PushNotificationChannel = PushNotificationChannel_1 = class PushNotificationChannel {
+    prisma;
+    pushConfig;
+    pushPayload;
+    channel = 'push';
+    logger = new common_1.Logger(PushNotificationChannel_1.name);
+    constructor(prisma, pushConfig, pushPayload) {
+        this.prisma = prisma;
+        this.pushConfig = pushConfig;
+        this.pushPayload = pushPayload;
+    }
+    /**
+     * The "address" for this channel is the ACCOUNT ITSELF, same as
+     * `BrowserNotificationChannel.resolveTo` and for the identical reason: a
+     * push delivery fans out to every subscription ROW this user has, keyed by
+     * `userId`, so there is no single "address" to resolve up front — that
+     * happens inside `deliver`, once the subscriptions are actually loaded.
+     *
+     * `null` for a recipient with no account (`allowlist.invitation`'s
+     * recipient), which by construction can never have a `push_subscriptions`
+     * row either: subscribing requires a signed-in browser calling the
+     * subscribe endpoint, which requires an account.
+     */
+    resolveTo(recipient) {
+        return recipient.userId;
+    }
+    /**
+     * Render, write the inbox row, then fan the encrypted payload out to every
+     * subscription this user has registered.
+     *
+     * NEVER THROWS — see the interface's own note on this being a guarantee
+     * that must survive a future implementer, not a promise this
+     * implementation happens to keep today. Every branch below returns a
+     * `ChannelDeliveryResult`.
+     *
+     * @param to - the user id from {@link resolveTo}.
+     */
+    async deliver(context, to) {
+        try {
+            return await this.deliverInner(context, to);
+        }
+        catch (err) {
+            // A catch-all around the whole method, matching the discipline every
+            // other channel applies: `NotificationsService` does not trust
+            // `deliver` not to throw either, but #125's guarantee — `notify` never
+            // throws to ITS caller — must hold even if a future edit here adds a
+            // code path this file's own author forgot to wrap.
+            return {
+                success: false,
+                error: `Push delivery failed unexpectedly: ${(0, describe_thrown_1.describeThrown)(err)}`,
+            };
+        }
+    }
+    /**
+     * The subscriptions this channel pushes to, as a `where` filter added to the
+     * recipient's (#746). Every subscription for `push`; the `android_app`
+     * channel narrows it to `platform: 'android_app'`.
+     *
+     * @returns a Prisma `where` fragment.
+     */
+    subscriptionScope() {
+        return {};
+    }
+    /**
+     * The delivery error when the recipient has no subscription in scope.
+     *
+     * @returns the error text recorded on the delivery row.
+     */
+    noSubscriptionsError() {
+        return 'No push subscriptions for this user';
+    }
+    /** The allowlisted extras the app's hook adds for this push (empty without a hook). */
+    extrasFor(context) {
+        if (!this.pushPayload)
+            return { payload: {} };
+        try {
+            return (0, push_payload_1.sanitizePushExtras)(this.pushPayload(context.event, context.data));
+        }
+        catch (err) {
+            this.logger.warn(`The pushPayload hook threw for '${context.event.key}'; sending without extras: ${(0, describe_thrown_1.describeThrown)(err)}`);
+            return { payload: {} };
+        }
+    }
+    async deliverInner(context, to) {
+        const eventKey = context.event.key;
+        const subscriptions = await this.prisma.pushSubscription.findMany({
+            where: { ...this.subscriptionScope(), userId: to },
+        });
+        if (subscriptions.length === 0) {
+            // Not an error in the sense of something going wrong — this is simply a
+            // user who has never granted push permission, or has revoked it on
+            // every device. Reported as a failed delivery anyway (rather than
+            // `resolveTo` returning `null` and skipping the row entirely) because,
+            // unlike the no-account case, this IS a user this event applies to; an
+            // operator triaging "why did this user never get pushed?" should find
+            // an explanatory row, not silence.
+            return {
+                success: false,
+                error: this.noSubscriptionsError(),
+            };
+        }
+        const rendered = this.render(context);
+        if (!rendered.ok) {
+            return { success: false, error: rendered.error };
+        }
+        // Normalised once, exactly as `BrowserNotificationChannel.deliver` does,
+        // and for the same reason: the row and the wire payload must be built
+        // from identical values or an audit of the table cannot explain what a
+        // device actually showed.
+        const title = truncate(rendered.content.title, MAX_TITLE_LENGTH);
+        const body = truncate(rendered.content.body, MAX_BODY_LENGTH);
+        const link = (0, browser_notification_channel_1.sanitizeLink)(rendered.content.link);
+        let notification;
+        try {
+            notification = await this.prisma.notification.create({
+                data: { userId: to, eventKey, title, body, link },
+                select: { id: true },
+            });
+        }
+        catch (err) {
+            return {
+                success: false,
+                error: `Could not write the notification record: ${(0, describe_thrown_1.describeThrown)(err)}`,
+            };
+        }
+        const payload = {
+            id: notification.id,
+            eventKey,
+            title,
+            body,
+            link,
+        };
+        // The app's extras (PP-14.10), through the allowlist: a throwing or
+        // oversize hook costs the extras, never the push.
+        const extras = this.extrasFor(context);
+        let serializedPayload = JSON.stringify({ ...payload, ...extras.payload });
+        if (Buffer.byteLength(serializedPayload) > push_payload_1.PUSH_MAX_PAYLOAD_BYTES) {
+            this.logger.warn(`Push extras for '${eventKey}' push the payload over ${push_payload_1.PUSH_MAX_PAYLOAD_BYTES} bytes; sending without them.`);
+            serializedPayload = JSON.stringify(payload);
+        }
+        // ONE call, ONE source of truth for "what VAPID key pair is active right
+        // now" — see `PushConfigService.resolveActiveVapidConfig`'s own header
+        // for the full env/DB precedence (#355). This channel used to read three
+        // `ConfigService` keys directly, which only ever reflected the deploy-time
+        // env vars; now the same call also picks up an admin-configured, runtime
+        // key pair with no restart.
+        //
+        // Registration (see notifications.module.ts) means this channel is always
+        // reachable now, regardless of configuration — so `null` here is the
+        // ORDINARY "this deployment has not turned Web Push on" case, not a
+        // programming error, and it is reported as an honest, admin-actionable
+        // failed delivery rather than a `sendNotification` call throwing a
+        // TypeError three lines further down for a reason nobody logged.
+        const active = await this.pushConfig.resolveActiveVapidConfig();
+        if (!active) {
+            return {
+                success: false,
+                error: 'Web Push is not configured or is disabled on this deployment',
+            };
+        }
+        const vapidDetails = {
+            subject: active.subject,
+            publicKey: active.publicKey,
+            privateKey: active.privateKey,
+        };
+        // `Promise.allSettled`, NEVER `Promise.all` — one dead endpoint among
+        // several must not stop the others from being tried, and must not turn
+        // "3 of 4 devices got this" into a thrown exception this channel is
+        // supposed to have already contained.
+        const results = await Promise.allSettled(subscriptions.map((subscription) => webpush.sendNotification({
+            endpoint: subscription.endpoint,
+            keys: { p256dh: subscription.p256dh, auth: subscription.auth },
+        }, serializedPayload, { vapidDetails, ...(extras.urgency ? { urgency: extras.urgency } : {}) })));
+        let successCount = 0;
+        let prunedCount = 0;
+        let failedCount = 0;
+        await Promise.all(results.map(async (result, index) => {
+            const subscription = subscriptions[index];
+            if (result.status === 'fulfilled') {
+                successCount++;
+                await this.prisma.pushSubscription
+                    .update({
+                    where: { id: subscription.id },
+                    data: { lastSuccessAt: new Date(), failureCount: 0 },
+                })
+                    // A subscription that was deleted by a CONCURRENT delivery (or by
+                    // the user unsubscribing) between the `findMany` above and this
+                    // update is not a bug to surface — the send already succeeded,
+                    // there is simply no row left to credit it to.
+                    .catch((err) => {
+                    this.logger.warn(`Could not record a successful push to subscription ${subscription.id}: ${(0, describe_thrown_1.describeThrown)(err)}`);
+                });
+                return;
+            }
+            const err = result.reason;
+            // 404/410: the push service is telling us, unambiguously, that this
+            // endpoint no longer exists (browser uninstalled, profile wiped,
+            // permission revoked at the OS level). Nothing short of the user
+            // re-subscribing can ever make this endpoint valid again, so the row
+            // is deleted outright rather than run through the failure counter.
+            if (err instanceof web_push_1.WebPushError &&
+                (err.statusCode === 404 || err.statusCode === 410)) {
+                prunedCount++;
+                await this.prisma.pushSubscription
+                    .delete({ where: { id: subscription.id } })
+                    .catch((deleteErr) => {
+                    this.logger.warn(`Could not prune dead push subscription ${subscription.id}: ${(0, describe_thrown_1.describeThrown)(deleteErr)}`);
+                });
+                return;
+            }
+            // Everything else — a `WebPushError` with a 429/5xx status, and any
+            // other rejection this library or the network can produce (a socket
+            // timeout, DNS failure, ...) — is treated as the SAME "the endpoint
+            // might still be good, but this attempt did not land" case. Failing
+            // open here (counting toward the threshold rather than deleting
+            // immediately, or than silently doing nothing) is the safer default:
+            // a push service having a bad minute must not cost a user their
+            // subscription, but a genuinely dead endpoint that never happens to
+            // return 404/410 must not accumulate forever either.
+            failedCount++;
+            const updated = await this.prisma.pushSubscription
+                .update({
+                where: { id: subscription.id },
+                data: { failureCount: { increment: 1 } },
+                select: { failureCount: true },
+            })
+                .catch((updateErr) => {
+                this.logger.warn(`Could not record a push failure for subscription ${subscription.id}: ${(0, describe_thrown_1.describeThrown)(updateErr)}`);
+                return null;
+            });
+            if (updated && updated.failureCount >= MAX_PUSH_FAILURE_COUNT) {
+                prunedCount++;
+                await this.prisma.pushSubscription
+                    .delete({ where: { id: subscription.id } })
+                    .catch((deleteErr) => {
+                    this.logger.warn(`Could not prune exhausted push subscription ${subscription.id}: ${(0, describe_thrown_1.describeThrown)(deleteErr)}`);
+                });
+            }
+        }));
+        this.logger.log(`Push '${eventKey}' for user ${to}: ${successCount} sent, ` +
+            `${failedCount} failed, ${prunedCount} subscription(s) pruned ` +
+            `(of ${subscriptions.length}).`);
+        // Success = AT LEAST ONE endpoint accepted the push. A user with three
+        // devices, two of which are offline, still received the notification —
+        // failing the whole delivery because one endpoint bounced would record a
+        // false negative for a delivery that genuinely reached them.
+        if (successCount > 0) {
+            return { success: true, messageId: notification.id };
+        }
+        // No secrets, no payload text — only counts, matching
+        // `ChannelDeliveryResult.error`'s contract.
+        return {
+            success: false,
+            error: `Push failed for all ${subscriptions.length} subscription(s) (${prunedCount} pruned).`,
+        };
+    }
+    /**
+     * Render an event's untyped payload into what the device shows.
+     *
+     * A DELIBERATE DUPLICATE of `BrowserNotificationChannel.render`, not an
+     * extraction into a shared helper — see that file's `formatRoles` comment,
+     * which rejects sharing formatting logic across channel surfaces for the
+     * same reason this method is copied rather than imported: the two channels
+     * are independently pluggable, and a "shared render" would be the first
+     * thread tying their behaviour together, the same coupling this file's own
+     * header comment argues against for the *id* they each mint. What genuinely
+     * IS shared — the browser binding (`eventBrowserTemplateRegistry`, since
+     * #678; `EVENT_BROWSER_TEMPLATES` before it), and `sanitizeLink` — is
+     * imported, because a divergence there would be a security or content bug,
+     * not a legitimate per-channel choice.
+     *
+     * Falls back to the registry's `label`/`description` on a template miss,
+     * identical to the browser channel's own fallback rule: there is already
+     * user-facing copy for every event, and a push notification with no body at
+     * all is a worse outcome than one with slightly generic copy.
+     */
+    render(context) {
+        const { event, data } = context;
+        const template = registry_1.eventBrowserTemplateRegistry.get(event.key)?.render;
+        if (!template) {
+            this.logger.warn(`No browser template registered for '${event.key}'; ` +
+                `falling back to the registry's label and description for push.`);
+            return {
+                ok: true,
+                content: { title: event.label, body: event.description },
+            };
+        }
+        try {
+            return { ok: true, content: template(data) };
+        }
+        catch (err) {
+            return {
+                ok: false,
+                error: `Rendering the push notification for '${event.key}' failed: ${(0, describe_thrown_1.describeThrown)(err)}`,
+            };
+        }
+    }
+};
+exports.PushNotificationChannel = PushNotificationChannel;
+exports.PushNotificationChannel = PushNotificationChannel = PushNotificationChannel_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(index_1.PLATFORM_PRISMA)),
+    __param(2, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Inject)(ports_1.NOTIFICATION_PUSH_PAYLOAD)),
+    __metadata("design:paramtypes", [Object, push_config_service_1.PushConfigService, Object])
+], PushNotificationChannel);
+/**
+ * Hard cap on stored/sent text, cutting at a character boundary and marking
+ * it. A second, smaller copy of `browser-notification.channel.ts`'s helper of
+ * the same name and behaviour — not exported from there, so redeclared here
+ * rather than reached across a module boundary for a five-line pure function.
+ */
+function truncate(value, max) {
+    return value.length <= max ? value : `${value.slice(0, max - 1)}…`;
+}
+//# sourceMappingURL=push-notification.channel.js.map

package/dist/notifications/channels/push-notification.channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-notification.channel.js","sourceRoot":"","sources":["../../../src/notifications/channels/push-notification.channel.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAsE;AACtE,kDAAoC;AACpC,uCAAwC;AAGxC,4CAAmD;AAEnD,wDAAoD;AACpD,gEAA2D;AAE3D,0CAA2D;AAK3D,iFAA8D;AAC9D,oCAAqD;AACrD,iDAKwB;AAQxB,gFAAgF;AAChF,kDAAkD;AAClD,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,0EAA0E;AAC1E,yEAAyE;AACzE,EAAE;AACF,gFAAgF;AAChF,kFAAkF;AAClF,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,wEAAwE;AACxE,6EAA6E;AAC7E,uEAAuE;AACvE,4EAA4E;AAC5E,oCAAoC;AACpC,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,sEAAsE;AACtE,uDAAuD;AACvD,uEAAuE;AACvE,wEAAwE;AACxE,kEAAkE;AAClE,2EAA2E;AAC3E,2EAA2E;AAC3E,kEAAkE;AAClE,0EAA0E;AAC1E,6BAA6B;AAC7B,EAAE;AACF,uDAAuD;AACvD,qEAAqE;AACrE,4EAA4E;AAC5E,4EAA4E;AAC5E,sEAAsE;AACtE,2EAA2E;AAC3E,4DAA4D;AAC5D,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,yEAAyE;AACzE,sEAAsE;AACtE,wEAAwE;AACxE,EAAE;AACF,gFAAgF;AAChF,2EAA2E;AAC3E,4BAA4B;AAC5B,gFAAgF;AAChF,EAAE;AACF,kEAAkE;AAClE,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,oEAAoE;AACpE,8EAA8E;AAC9E,wDAAwD;AACxD,gFAAgF;AAEhF,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,eAAe,GAAG,KAAK,CAAC;AAE9B;;;;;;;;;;GAUG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAuBjC;;;;GAIG;AAEI,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAMU;IACzB;IAE+C;IARzD,OAAO,GAAwB,MAAM,CAAC;IAE9B,MAAM,GAAG,IAAI,eAAM,CAAC,yBAAuB,CAAC,IAAI,CAAC,CAAC;IAEnE,YAC4C,MAA2B,EACpD,UAA6B,EAEkB,WAAoC;QAH1D,WAAM,GAAN,MAAM,CAAqB;QACpD,eAAU,GAAV,UAAU,CAAmB;QAEkB,gBAAW,GAAX,WAAW,CAAyB;IACnG,CAAC;IAEJ;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,SAAgC;QACxC,OAAO,SAAS,CAAC,MAAM,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO,CACX,OAAoC,EACpC,EAAU;QAEV,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,+DAA+D;YAC/D,uEAAuE;YACvE,qEAAqE;YACrE,mDAAmD;YACnD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,sCAAsC,IAAA,gCAAc,EAAC,GAAG,CAAC,EAAE;aACnE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,iBAAiB;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;OAIG;IACO,oBAAoB;QAC5B,OAAO,qCAAqC,CAAC;IAC/C,CAAC;IAED,uFAAuF;IAC/E,SAAS,CAAC,OAAoC;QACpD,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,OAAO,IAAA,iCAAkB,EAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,OAAO,CAAC,KAAK,CAAC,GAAG,8BAA8B,IAAA,gCAAc,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1H,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,OAAoC,EACpC,EAAU;QAEV,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;QAEnC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC;YAChE,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;SACnD,CAAC,CAAC;QAEH,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,wEAAwE;YACxE,mEAAmE;YACnE,kEAAkE;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,sEAAsE;YACtE,mCAAmC;YACnC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI,CAAC,oBAAoB,EAAE;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnD,CAAC;QAED,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,0BAA0B;QAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAA,2CAAY,EAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEjD,IAAI,YAA4B,CAAC;QAEjC,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC;gBACnD,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE;gBACjD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,4CAA4C,IAAA,gCAAc,EAAC,GAAG,CAAC,EAAE;aACzE,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAgB;YAC3B,EAAE,EAAE,YAAY,CAAC,EAAE;YACnB,QAAQ;YACR,KAAK;YACL,IAAI;YACJ,IAAI;SACL,CAAC;QACF,oEAAoE;QACpE,kDAAkD;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,IAAI,MAAM,CAAC,UAAU,CAAC,iBAAiB,CAAC,GAAG,qCAAsB,EAAE,CAAC;YAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,QAAQ,2BAA2B,qCAAsB,+BAA+B,CAAC,CAAC;YAC/H,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,4BAA4B;QAC5B,EAAE;QACF,0EAA0E;QAC1E,qEAAqE;QACrE,oEAAoE;QACpE,uEAAuE;QACvE,mEAAmE;QACnE,iEAAiE;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,EAAE,CAAC;QAEhE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,8DAA8D;aACtE,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;QAEF,sEAAsE;QACtE,uEAAuE;QACvE,oEAAoE;QACpE,sCAAsC;QACtC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CACjC,OAAO,CAAC,gBAAgB,CACtB;YACE,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE;SAC/D,EACD,iBAAiB,EACjB,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACzE,CACF,CACF,CAAC;QAEF,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,WAAW,GAAG,CAAC,CAAC;QAEpB,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;YAClC,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YAE1C,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,YAAY,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB;qBAC/B,MAAM,CAAC;oBACN,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE;oBAC9B,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,IAAI,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE;iBACrD,CAAC;oBACF,kEAAkE;oBAClE,gEAAgE;oBAChE,+DAA+D;oBAC/D,+CAA+C;qBAC9C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,sDAAsD,YAAY,CAAC,EAAE,KAAK,IAAA,gCAAc,EAAC,GAAG,CAAC,EAAE,CAChG,CAAC;gBACJ,CAAC,CAAC,CAAC;gBACL,OAAO;YACT,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;YAE1B,oEAAoE;YACpE,iEAAiE;YACjE,iEAAiE;YACjE,qEAAqE;YACrE,mEAAmE;YACnE,IACE,GAAG,YAAY,uBAAY;gBAC3B,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,EAClD,CAAC;gBACD,WAAW,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB;qBAC/B,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC;qBAC1C,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;oBACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,0CAA0C,YAAY,CAAC,EAAE,KAAK,IAAA,gCAAc,EAAC,SAAS,CAAC,EAAE,CAC1F,CAAC;gBACJ,CAAC,CAAC,CAAC;gBACL,OAAO;YACT,CAAC;YAED,oEAAoE;YACpE,oEAAoE;YACpE,oEAAoE;YACpE,oEAAoE;YACpE,gEAAgE;YAChE,qEAAqE;YACrE,gEAAgE;YAChE,oEAAoE;YACpE,qDAAqD;YACrD,WAAW,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB;iBAC/C,MAAM,CAAC;gBACN,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE;gBAC9B,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE;gBACxC,MAAM,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;aAC/B,CAAC;iBACD,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;gBACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oDAAoD,YAAY,CAAC,EAAE,KAAK,IAAA,gCAAc,EAAC,SAAS,CAAC,EAAE,CACpG,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;YAEL,IAAI,OAAO,IAAI,OAAO,CAAC,YAAY,IAAI,sBAAsB,EAAE,CAAC;gBAC9D,WAAW,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB;qBAC/B,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC;qBAC1C,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;oBACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,+CAA+C,YAAY,CAAC,EAAE,KAAK,IAAA,gCAAc,EAAC,SAAS,CAAC,EAAE,CAC/F,CAAC;gBACJ,CAAC,CAAC,CAAC;YACP,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,SAAS,QAAQ,cAAc,EAAE,KAAK,YAAY,SAAS;YACzD,GAAG,WAAW,YAAY,WAAW,0BAA0B;YAC/D,OAAO,aAAa,CAAC,MAAM,IAAI,CAClC,CAAC;QAEF,uEAAuE;QACvE,uEAAuE;QACvE,yEAAyE;QACzE,6DAA6D;QAC7D,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;QACvD,CAAC;QAED,sDAAsD;QACtD,4CAA4C;QAC5C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,uBAAuB,aAAa,CAAC,MAAM,qBAAqB,WAAW,WAAW;SAC9F,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACK,MAAM,CACZ,OAAoC;QAIpC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QAChC,MAAM,QAAQ,GACZ,uCAA4B,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAEtD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,uCAAuC,KAAK,CAAC,GAAG,KAAK;gBACnD,gEAAgE,CACnE,CAAC;YACF,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE;aACzD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAa,CAAC,EAAE,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,wCAAwC,KAAK,CAAC,GAAG,aAAa,IAAA,gCAAc,EAAC,GAAG,CAAC,EAAE;aAC3F,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AArWY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,eAAM,EAAC,uBAAe,CAAC,CAAA;IAGvB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,iCAAyB,CAAC,CAAA;6CAFjB,uCAAiB;GAPrC,uBAAuB,CAqWnC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,KAAa,EAAE,GAAW;IAC1C,OAAO,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;AACrE,CAAC"}