@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.4

package/dist/notifications/push-config.controller.js

@@ -0,0 +1,275 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PushConfigController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const index_1 = require("../identity/index");
+const index_2 = require("../core/index");
+const notifications_constants_1 = require("./notifications.constants");
+const push_config_service_1 = require("./push-config.service");
+const push_test_service_1 = require("./push-test.service");
+const generate_push_config_dto_1 = require("./dto/generate-push-config.dto");
+const push_config_response_dto_1 = require("./dto/push-config-response.dto");
+const push_config_confirmation_dto_1 = require("./dto/push-config-confirmation.dto");
+const push_test_dto_1 = require("./dto/push-test.dto");
+const update_push_config_dto_1 = require("./dto/update-push-config.dto");
+// =============================================================================
+// PushConfigController (issue #355)
+// =============================================================================
+//
+// The HTTP surface behind `/admin/settings/push`. Six operations:
+//
+//   GET    /api/admin/push-config           push:read
+//   PUT    /api/admin/push-config           push:write
+//   POST   /api/admin/push-config/generate  push:write
+//   POST   /api/admin/push-config/rotate    push:write
+//   DELETE /api/admin/push-config           push:write
+//   POST   /api/admin/push-config/test      push:write  (#618)
+//
+// `test` is `push:write`, not `push:read`: it performs a real signed send and
+// can prune the caller's own dead subscription rows — an action, not a read.
+//
+// `push:read`/`push:write` RATHER THAN `system_settings:*`, deliberately —
+// see `roles.constants.ts` for the full reasoning (generating/rotating key
+// material has a real blast radius: every existing subscriber goes dark).
+//
+// -----------------------------------------------------------------------------
+// A SEPARATE CONTROLLER, NOT A ROUTE ON `NotificationsController`
+// -----------------------------------------------------------------------------
+//
+// Same reasoning as `EmailSettingsController` living apart from
+// `SystemSettingsController`: this surface writes a settings row and a
+// credential that `NotificationsController`'s existing routes have no reason
+// to touch, and keeping it separate keeps the OpenAPI tag — and therefore the
+// API reference — aligned with the settings page it backs.
+// =============================================================================
+/**
+ * Exported for an app's own unit tests (`@marinoscar/platform-api/notifications/testing`); not an extension point: reach it through `NotificationsModule` and its documented seams.
+ *
+ * @internal
+ */
+let PushConfigController = class PushConfigController {
+    pushConfig;
+    pushTest;
+    constructor(pushConfig, pushTest) {
+        this.pushConfig = pushConfig;
+        this.pushTest = pushTest;
+    }
+    async getConfig() {
+        return this.pushConfig.describeForAdmin();
+    }
+    async replaceConfig(dto, userId, ifMatch) {
+        // `Number.isInteger` rather than a bare `parseInt`, matching
+        // `EmailSettingsController.replaceSettings`: `parseInt('abc')` is `NaN`,
+        // and `NaN !== currentVersion` is always true, so a malformed header would
+        // turn every save into an unrecoverable 409. Treated as absent instead.
+        const parsed = ifMatch !== undefined ? Number.parseInt(ifMatch, 10) : NaN;
+        const expectedVersion = Number.isInteger(parsed) ? parsed : undefined;
+        return this.pushConfig.update(dto, userId, expectedVersion);
+    }
+    async generate(dto, userId) {
+        return this.pushConfig.generate(dto, userId);
+    }
+    async rotate(dto, userId) {
+        return this.pushConfig.rotate(dto, userId);
+    }
+    async remove(dto, userId) {
+        return this.pushConfig.remove(dto, userId);
+    }
+    async sendTest(dto, userId) {
+        return this.pushTest.runTest(userId, dto);
+    }
+};
+exports.PushConfigController = PushConfigController;
+__decorate([
+    (0, common_1.Get)(),
+    (0, index_1.Auth)({ permissions: [notifications_constants_1.PERMISSIONS.PUSH_READ] }),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Get Web Push configuration (Admin only)',
+        description: 'Returns the Web Push configuration together with `privateKeyStatus`, a masked, ' +
+            'non-secret description of the stored VAPID private key. **The private key itself ' +
+            'is never returned by this or any other endpoint** — it is held in the encrypted ' +
+            'credential store and is unreadable through the API by design.\n\n' +
+            '`configured` is `true` only when BOTH a public key is stored and a private-key ' +
+            'credential exists; a settings page renders its empty ("Generate & enable") state ' +
+            'exactly when this is `false`.',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'Web Push configuration and stored-key status',
+        type: push_config_response_dto_1.PushConfigResponseDto,
+    }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], PushConfigController.prototype, "getConfig", null);
+__decorate([
+    (0, common_1.Put)(),
+    (0, index_1.Auth)({ permissions: [notifications_constants_1.PERMISSIONS.PUSH_WRITE] }),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Replace Web Push configuration (Admin only)',
+        description: 'Full replace of `{ enabled, subject }`. **This endpoint flips the switch; it does ' +
+            'not manufacture keys** — setting `enabled: true` before a key pair has ever been ' +
+            'generated returns `409`. Neither VAPID key is settable here: `publicKey` is ' +
+            'server-derived from the `generate`/`rotate` actions, and the private key never ' +
+            'travels through this endpoint at all.',
+    }),
+    (0, swagger_1.ApiHeader)({
+        name: 'If-Match',
+        description: 'Expected `version` for optimistic concurrency. Use `0` to assert that nothing ' +
+            'is stored yet. Omit to overwrite unconditionally.',
+        required: false,
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'Updated Web Push configuration',
+        type: push_config_response_dto_1.PushConfigResponseDto,
+    }),
+    (0, swagger_1.ApiResponse)({ status: 400, description: 'Validation error' }),
+    (0, swagger_1.ApiResponse)({
+        status: 409,
+        description: 'Version conflict, or `enabled: true` was requested with no key pair generated yet',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, index_1.CurrentUser)('id')),
+    __param(2, (0, common_1.Headers)('if-match')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [update_push_config_dto_1.UpdatePushConfigDto, String, String]),
+    __metadata("design:returntype", Promise)
+], PushConfigController.prototype, "replaceConfig", null);
+__decorate([
+    (0, common_1.Post)('generate'),
+    (0, index_1.Auth)({ permissions: [notifications_constants_1.PERMISSIONS.PUSH_WRITE] }),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Generate the first VAPID key pair and enable Web Push (Admin only)',
+        description: 'First-time-only key generation: generates a fresh VAPID key pair with `web-push`, ' +
+            'stores the private key in the encrypted credential store, stores the public key ' +
+            'and sets `enabled: true`. **`409` if a key pair already exists** — use the rotate ' +
+            'action to replace an existing configuration instead.',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'The generated configuration',
+        type: push_config_response_dto_1.PushConfigResponseDto,
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 409,
+        description: 'Web Push is already configured; use rotate instead',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, index_1.CurrentUser)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [generate_push_config_dto_1.GeneratePushConfigDto, String]),
+    __metadata("design:returntype", Promise)
+], PushConfigController.prototype, "generate", null);
+__decorate([
+    (0, common_1.Post)('rotate'),
+    (0, index_1.Auth)({ permissions: [notifications_constants_1.PERMISSIONS.PUSH_WRITE] }),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Rotate the VAPID key pair (Admin only)',
+        description: 'Generates a fresh VAPID key pair and replaces the stored one. **Disruptive**: ' +
+            'every existing push subscriber stops receiving pushes until their browser next ' +
+            'calls `pushManager.subscribe` against the new public key (typically on next app ' +
+            'open). `enabled` is left exactly as it was — rotating is not a decision about ' +
+            'whether push should be on.\n\n' +
+            'Requires the typed confirmation `{ "confirmation": "ROTATE" }` — see this ' +
+            "endpoint's request schema. A body copied from the remove endpoint's confirmation " +
+            'is rejected: the two use deliberately different words.\n\n' +
+            '**`400` if nothing is configured yet** — use the generate action for a first key ' +
+            'pair.',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'The rotated configuration',
+        type: push_config_response_dto_1.PushConfigResponseDto,
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 400,
+        description: 'Missing/incorrect confirmation, or nothing is configured yet',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, index_1.CurrentUser)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [push_config_confirmation_dto_1.RotatePushConfigDto, String]),
+    __metadata("design:returntype", Promise)
+], PushConfigController.prototype, "rotate", null);
+__decorate([
+    (0, common_1.Delete)(),
+    (0, index_1.Auth)({ permissions: [notifications_constants_1.PERMISSIONS.PUSH_WRITE] }),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Remove the Web Push configuration (Admin only)',
+        description: 'Deletes both the stored VAPID private-key credential and the `webPush` settings ' +
+            'row, then returns the resulting (empty) configuration — the same shape GET/PUT/ ' +
+            'generate/rotate all return, so a client can render the post-removal state without ' +
+            'a follow-up GET. **Destructive and immediate** — every existing push subscription ' +
+            'becomes unusable, and there is no way to bring the same key pair back; a ' +
+            'subsequent `generate` mints an entirely new one.\n\n' +
+            'Requires the typed confirmation `{ "confirmation": "REMOVE" }` — deliberately a ' +
+            "different word from the rotate endpoint's, so a body copied from one to the other " +
+            'is rejected rather than silently accepted.',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'The resulting (now empty) configuration',
+        type: push_config_response_dto_1.PushConfigResponseDto,
+    }),
+    (0, swagger_1.ApiResponse)({ status: 400, description: 'Missing or incorrect confirmation' }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, index_1.CurrentUser)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [push_config_confirmation_dto_1.RemovePushConfigDto, String]),
+    __metadata("design:returntype", Promise)
+], PushConfigController.prototype, "remove", null);
+__decorate([
+    (0, common_1.Post)('test'),
+    (0, index_1.Auth)({ permissions: [notifications_constants_1.PERMISSIONS.PUSH_WRITE] }),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({
+        summary: "Send a test Web Push to the caller's own devices, with diagnostics (Admin only)",
+        description: "Sends a real, signed test push to **the calling admin's own** push subscriptions " +
+            '(never anyone else\'s) and returns, link by link, what was found: whether a VAPID ' +
+            'key pair is active and where it comes from, whether the public key is a valid P-256 ' +
+            'point and matches the stored private key, whether the subject is acceptable, whether ' +
+            "this browser's subscription is registered and was created with the active key, " +
+            'whether policy and preferences keep push open for each push-capable event, and the ' +
+            "push service's status and response body per device — plus plain-English `hints`.\n\n" +
+            'Optionally pass this browser\'s current `endpoint` and the `applicationServerKey` its ' +
+            'subscription was created with. **Always `200`**: a failed send is the diagnostic, ' +
+            'reported in `overall` and per subscription. No `notifications` or ' +
+            '`notification_deliveries` row is written. A `404`/`410` from the push service ' +
+            'prunes that subscription, as a real delivery would.\n\n' +
+            'Never returns the VAPID private key, a subscription\'s `p256dh`/`auth`, or a full ' +
+            'endpoint (only `endpointPreview`).',
+    }),
+    (0, index_2.ApiDataResponse)(push_test_dto_1.PushTestResponseDto, {
+        description: 'Diagnostics and per-subscription send results',
+    }),
+    (0, swagger_1.ApiResponse)({ status: 400, description: 'Validation error' }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, index_1.CurrentUser)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [push_test_dto_1.PushTestRequestDto, String]),
+    __metadata("design:returntype", Promise)
+], PushConfigController.prototype, "sendTest", null);
+exports.PushConfigController = PushConfigController = __decorate([
+    (0, swagger_1.ApiTags)('Push Configuration'),
+    (0, common_1.Controller)('admin/push-config'),
+    __metadata("design:paramtypes", [push_config_service_1.PushConfigService,
+        push_test_service_1.PushTestService])
+], PushConfigController);
+//# sourceMappingURL=push-config.controller.js.map

package/dist/notifications/push-config.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-config.controller.js","sourceRoot":"","sources":["../../src/notifications/push-config.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAUwB;AACxB,6CAAgF;AAEhF,6CAAsD;AACtD,yCAAgD;AAChD,uEAAwD;AACxD,+DAA0D;AAC1D,2DAAsD;AACtD,6EAAuE;AACvE,6EAAuE;AACvE,qFAG4C;AAC5C,uDAA8E;AAC9E,yEAAmE;AAEnE,gFAAgF;AAChF,oCAAoC;AACpC,gFAAgF;AAChF,EAAE;AACF,kEAAkE;AAClE,EAAE;AACF,sDAAsD;AACtD,uDAAuD;AACvD,uDAAuD;AACvD,uDAAuD;AACvD,uDAAuD;AACvD,+DAA+D;AAC/D,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,EAAE;AACF,gFAAgF;AAChF,kEAAkE;AAClE,gFAAgF;AAChF,EAAE;AACF,gEAAgE;AAChE,uEAAuE;AACvE,6EAA6E;AAC7E,8EAA8E;AAC9E,2DAA2D;AAC3D,gFAAgF;AAEhF;;;;GAIG;AAGI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAEZ;IACA;IAFnB,YACmB,UAA6B,EAC7B,QAAyB;QADzB,eAAU,GAAV,UAAU,CAAmB;QAC7B,aAAQ,GAAR,QAAQ,CAAiB;IACzC,CAAC;IAoBE,AAAN,KAAK,CAAC,SAAS;QACb,OAAO,IAAI,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC;IAC5C,CAAC;IA+BK,AAAN,KAAK,CAAC,aAAa,CACT,GAAwB,EACb,MAAc,EACZ,OAAgB;QAErC,6DAA6D;QAC7D,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC1E,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAEtE,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IAC9D,CAAC;IAsBK,AAAN,KAAK,CAAC,QAAQ,CACJ,GAA0B,EACf,MAAc;QAEjC,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IA4BK,AAAN,KAAK,CAAC,MAAM,CACF,GAAwB,EACb,MAAc;QAEjC,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAwBK,AAAN,KAAK,CAAC,MAAM,CACF,GAAwB,EACb,MAAc;QAEjC,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IA2BK,AAAN,KAAK,CAAC,QAAQ,CACJ,GAAuB,EACZ,MAAc;QAEjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;CACF,CAAA;AAhMY,oDAAoB;AAwBzB;IAlBL,IAAA,YAAG,GAAE;IACL,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,qCAAW,CAAC,SAAS,CAAC,EAAE,CAAC;IAC9C,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,yCAAyC;QAClD,WAAW,EACT,iFAAiF;YACjF,mFAAmF;YACnF,kFAAkF;YAClF,mEAAmE;YACnE,iFAAiF;YACjF,mFAAmF;YACnF,+BAA+B;KAClC,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,8CAA8C;QAC3D,IAAI,EAAE,gDAAqB;KAC5B,CAAC;;;;qDAGD;AA+BK;IA7BL,IAAA,YAAG,GAAE;IACL,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,qCAAW,CAAC,UAAU,CAAC,EAAE,CAAC;IAC/C,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,6CAA6C;QACtD,WAAW,EACT,oFAAoF;YACpF,mFAAmF;YACnF,8EAA8E;YAC9E,iFAAiF;YACjF,uCAAuC;KAC1C,CAAC;IACD,IAAA,mBAAS,EAAC;QACT,IAAI,EAAE,UAAU;QAChB,WAAW,EACT,gFAAgF;YAChF,mDAAmD;QACrD,QAAQ,EAAE,KAAK;KAChB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,gCAAgC;QAC7C,IAAI,EAAE,gDAAqB;KAC5B,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAC7D,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EACT,mFAAmF;KACtF,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,mBAAW,EAAC,IAAI,CAAC,CAAA;IACjB,WAAA,IAAA,gBAAO,EAAC,UAAU,CAAC,CAAA;;qCAFP,4CAAmB;;yDAYjC;AAsBK;IApBL,IAAA,aAAI,EAAC,UAAU,CAAC;IAChB,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,qCAAW,CAAC,UAAU,CAAC,EAAE,CAAC;IAC/C,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,oEAAoE;QAC7E,WAAW,EACT,oFAAoF;YACpF,kFAAkF;YAClF,oFAAoF;YACpF,sDAAsD;KACzD,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6BAA6B;QAC1C,IAAI,EAAE,gDAAqB;KAC5B,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,oDAAoD;KAClE,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,mBAAW,EAAC,IAAI,CAAC,CAAA;;qCADL,gDAAqB;;oDAInC;AA4BK;IA1BL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,qCAAW,CAAC,UAAU,CAAC,EAAE,CAAC;IAC/C,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wCAAwC;QACjD,WAAW,EACT,gFAAgF;YAChF,iFAAiF;YACjF,kFAAkF;YAClF,gFAAgF;YAChF,gCAAgC;YAChC,4EAA4E;YAC5E,mFAAmF;YACnF,4DAA4D;YAC5D,mFAAmF;YACnF,OAAO;KACV,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2BAA2B;QACxC,IAAI,EAAE,gDAAqB;KAC5B,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,8DAA8D;KAC5E,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,mBAAW,EAAC,IAAI,CAAC,CAAA;;qCADL,kDAAmB;;kDAIjC;AAwBK;IAtBL,IAAA,eAAM,GAAE;IACR,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,qCAAW,CAAC,UAAU,CAAC,EAAE,CAAC;IAC/C,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EACT,kFAAkF;YAClF,kFAAkF;YAClF,oFAAoF;YACpF,oFAAoF;YACpF,2EAA2E;YAC3E,sDAAsD;YACtD,kFAAkF;YAClF,oFAAoF;YACpF,4CAA4C;KAC/C,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,yCAAyC;QACtD,IAAI,EAAE,gDAAqB;KAC5B,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC;IAE5E,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,mBAAW,EAAC,IAAI,CAAC,CAAA;;qCADL,kDAAmB;;kDAIjC;AA2BK;IAzBL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,qCAAW,CAAC,UAAU,CAAC,EAAE,CAAC;IAC/C,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,iFAAiF;QAC1F,WAAW,EACT,mFAAmF;YACnF,oFAAoF;YACpF,sFAAsF;YACtF,uFAAuF;YACvF,iFAAiF;YACjF,qFAAqF;YACrF,sFAAsF;YACtF,wFAAwF;YACxF,oFAAoF;YACpF,oEAAoE;YACpE,gFAAgF;YAChF,yDAAyD;YACzD,oFAAoF;YACpF,oCAAoC;KACvC,CAAC;IACD,IAAA,uBAAe,EAAC,mCAAmB,EAAE;QACpC,WAAW,EAAE,+CAA+C;KAC7D,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAE3D,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,mBAAW,EAAC,IAAI,CAAC,CAAA;;qCADL,kCAAkB;;oDAIhC;+BA/LU,oBAAoB;IAFhC,IAAA,iBAAO,EAAC,oBAAoB,CAAC;IAC7B,IAAA,mBAAU,EAAC,mBAAmB,CAAC;qCAGC,uCAAiB;QACnB,mCAAe;GAHjC,oBAAoB,CAgMhC"}

package/dist/notifications/push-config.schema.d.ts

@@ -0,0 +1,10 @@
+import type { PushConfig } from '@marinoscar/platform-contract/notifications';
+export { DEFAULT_VAPID_SUBJECT, pushConfigSchema, vapidSubjectSchema } from '@marinoscar/platform-contract/notifications';
+export type { PushConfig } from '@marinoscar/platform-contract/notifications';
+/**
+ * What an unconfigured deployment reads: push off, no key pair.
+ *
+ * @stability stable
+ */
+export declare const DEFAULT_PUSH_CONFIG: PushConfig;
+//# sourceMappingURL=push-config.schema.d.ts.map

package/dist/notifications/push-config.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-config.schema.d.ts","sourceRoot":"","sources":["../../src/notifications/push-config.schema.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6CAA6C,CAAC;AAE9E,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AAC1H,YAAY,EAAE,UAAU,EAAE,MAAM,6CAA6C,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,UAIjC,CAAC"}

package/dist/notifications/push-config.schema.js

@@ -0,0 +1,22 @@
+"use strict";
+// The wire schemas live in @marinoscar/platform-contract/notifications since
+// #738 (moved from this file with their meaning unchanged; channel ids are
+// open). This file wraps them as DTOs and re-exports them under their old
+// names, so the controllers and their importers did not change.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_PUSH_CONFIG = exports.vapidSubjectSchema = exports.pushConfigSchema = exports.DEFAULT_VAPID_SUBJECT = void 0;
+var notifications_1 = require("@marinoscar/platform-contract/notifications");
+Object.defineProperty(exports, "DEFAULT_VAPID_SUBJECT", { enumerable: true, get: function () { return notifications_1.DEFAULT_VAPID_SUBJECT; } });
+Object.defineProperty(exports, "pushConfigSchema", { enumerable: true, get: function () { return notifications_1.pushConfigSchema; } });
+Object.defineProperty(exports, "vapidSubjectSchema", { enumerable: true, get: function () { return notifications_1.vapidSubjectSchema; } });
+/**
+ * What an unconfigured deployment reads: push off, no key pair.
+ *
+ * @stability stable
+ */
+exports.DEFAULT_PUSH_CONFIG = {
+    enabled: false,
+    publicKey: null,
+    subject: null,
+};
+//# sourceMappingURL=push-config.schema.js.map

package/dist/notifications/push-config.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-config.schema.js","sourceRoot":"","sources":["../../src/notifications/push-config.schema.ts"],"names":[],"mappings":";AAAA,6EAA6E;AAC7E,2EAA2E;AAC3E,0EAA0E;AAC1E,gEAAgE;;;AAIhE,6EAA0H;AAAjH,sHAAA,qBAAqB,OAAA;AAAE,iHAAA,gBAAgB,OAAA;AAAE,mHAAA,kBAAkB,OAAA;AAGpE;;;;GAIG;AACU,QAAA,mBAAmB,GAAe;IAC7C,OAAO,EAAE,KAAK;IACd,SAAS,EAAE,IAAI;IACf,OAAO,EAAE,IAAI;CACd,CAAC"}

package/dist/notifications/push-config.service.d.ts

@@ -0,0 +1,205 @@
+import type { NotificationsPrisma } from './data/notifications-db';
+import { CredentialsService } from '../credentials/index';
+import { SystemSettingsRowStore } from '../settings/index';
+import { PushConfig } from './push-config.schema';
+import type { GeneratePushConfigInput } from './dto/generate-push-config.dto';
+import type { RemovePushConfigInput, RotatePushConfigInput } from './dto/push-config-confirmation.dto';
+import type { UpdatePushConfigInput } from './dto/update-push-config.dto';
+/**
+ * The `system_settings.key` this configuration is stored under.
+ *
+ * @stability stable
+ */
+export declare const PUSH_CONFIG_KEY = "webPush";
+/**
+ * The masked view of the stored VAPID private key that the admin page
+ * renders. Mirrors `SmtpPasswordStatus` exactly, including why a boolean
+ * alone is not enough: an admin who has just rotated the keys needs to see
+ * WHICH pair is live.
+  *
+  * @stability experimental
+ */
+export interface PrivateKeyStatus {
+    /** Is a private key stored at `(purpose 'push_vapid', name 'default')`? */
+    configured: boolean;
+    /** The store's own mask, e.g. `••••x9fQ`. Null when nothing is stored. */
+    hint: string | null;
+    /** When the stored private key was last written. */
+    updatedAt: Date | null;
+    /** Who last wrote it. Null when nothing is stored, or the user was deleted. */
+    updatedByUserId: string | null;
+}
+/**
+ * What `GET /api/admin/push-config` (and every write) renders. Extends
+ * `PushConfig` rather than nesting it, matching
+ * `EmailSettingsAdminView`, so a field added to the schema appears here with
+ * no edit.
+  *
+  * @stability experimental
+ */
+export interface PushConfigAdminView extends PushConfig {
+    /**
+     * Both halves of the key pair are present: `publicKey` is non-null AND a
+     * private-key credential is stored. The empty-state/configured-state split
+     * the admin page renders off of.
+     */
+    configured: boolean;
+    /** The private key's status (never its value). */
+    privateKeyStatus: PrivateKeyStatus;
+    /**
+     * Why the stored row could not be read, when it could not be. Null
+     * normally. FIELD PATHS ONLY — see the note where it is built.
+     */
+    settingsError: string | null;
+    /** Bumped on every write. The optimistic-concurrency token for `If-Match`. */
+    version: number;
+    /** Last update, or null before the first save. */
+    updatedAt: Date | null;
+    /** Who saved last, or null. */
+    updatedBy: {
+        /** Their user id. */
+        id: string;
+        /** Their address. */
+        email: string;
+    } | null;
+}
+/**
+ * What a channel needs to actually sign and send a push. Never rendered to a client.
+ *
+ * @stability experimental
+ */
+export interface ActiveVapidConfig {
+    /** The VAPID public key. */
+    publicKey: string;
+    /** The VAPID private key, from the credential store; held only for the send. */
+    privateKey: string;
+    /** The VAPID subject in force. */
+    subject: string;
+}
+/**
+ * The runtime Web Push (VAPID) configuration: the `webPush` row of
+ * `system_settings` (enabled, public key, subject) through the settings
+ * slice's row store, and the private key in the credential store. No
+ * environment variable configures it.
+ *
+ * @stability experimental
+ */
+export declare class PushConfigService {
+    private readonly prisma;
+    private readonly credentials;
+    private readonly logger;
+    constructor(prisma: NotificationsPrisma, credentials: CredentialsService, rows?: SystemSettingsRowStore);
+    /** Every read and write of the `webPush` row goes through the row store (#738). */
+    private readonly rows;
+    /**
+     * Everything `GET /api/admin/push-config` renders. Mirrors
+     * `EmailSettingsService.describeForAdmin` exactly: it does NOT throw on an
+     * invalid stored row (this is the repair path, and a 500 here would take
+     * down the one screen capable of fixing the row), and it touches the
+     * credential store (which `resolveActiveVapidConfig` also does, but a send
+     * path has no business paying for a lookup this admin read needs anyway).
+     */
+    describeForAdmin(): Promise<PushConfigAdminView>;
+    /**
+     * The ONE place both `PushSubscriptionService` and `PushNotificationChannel`
+     * ask "what VAPID key pair, if any, is active right now". See this file's
+     * header for the full three-case precedence this implements.
+     *
+     * @returns `null` when push is not active for any reason — no row, an
+     *          explicit disable, or a corrupted/missing credential. Callers
+     *          treat `null` uniformly as "push is off"; they do not need to
+     *          know WHY.
+     */
+    resolveActiveVapidConfig(): Promise<ActiveVapidConfig | null>;
+    /**
+     * Apply the generic fallback subject, warning once per resolution when it
+     * is used. Centralised here (rather than duplicated in the channel, which
+     * used to do this inline) precisely because this method is now the single
+     * source both the env path and the DB path route through.
+     */
+    private resolveSubject;
+    /**
+     * Assemble the admin view from an already-validated settings object and the
+     * row it came from. Shared by {@link describeForAdmin} and every write
+     * below, matching `EmailSettingsService.toAdminView`.
+     */
+    private toAdminView;
+    /**
+     * `POST /api/admin/push-config/generate` — first-time key generation.
+     *
+     * FIRST-TIME ONLY. Throws 409 if a key pair already exists (a `publicKey`
+     * stored OR a private-key credential present — either alone means "this
+     * deployment has been configured before"), pointing the caller at
+     * {@link rotate} instead. This is deliberately not idempotent: a second
+     * `generate` call silently replacing a live key pair would invalidate every
+     * existing subscriber with no confirmation step at all — that destructive
+     * act is what `rotate`'s typed confirmation exists for.
+     *
+     * WRITES THE CREDENTIAL FIRST, THEN THE SETTINGS ROW — same
+     * partial-failure-safe ordering as `EmailSettingsService.update`. An
+     * orphaned credential with no row pointing at it is inert; the reverse
+     * (a row claiming a public key with no private-key credential behind it)
+     * is not, and would immediately misreport itself as `configured`.
+     *
+     * Sets `enabled: true`: an admin generating keys is, by that action, asking
+     * for Web Push to be on.
+     */
+    generate(input: GeneratePushConfigInput, userId: string): Promise<PushConfigAdminView>;
+    /**
+     * `POST /api/admin/push-config/rotate` — replace an existing key pair.
+     *
+     * 400 if nothing is configured yet (there is nothing to rotate — use
+     * {@link generate}). Overwrites BOTH the credential and the row's
+     * `publicKey`; keeps `enabled` exactly as it was — rotating keys is not a
+     * decision about whether push should be on, only about which keys back it.
+     * `subject`, if provided, replaces the stored one; omitted keeps it, since
+     * rotation replaces the KEYS, not necessarily the contact metadata.
+     */
+    rotate(input: RotatePushConfigInput, userId: string): Promise<PushConfigAdminView>;
+    /**
+     * `PUT /api/admin/push-config` — full-replace of `{ enabled, subject }`.
+     *
+     * THIS ENDPOINT FLIPS THE SWITCH; IT DOES NOT MANUFACTURE KEYS. 409 if
+     * `enabled: true` is requested but no key pair exists (no stored
+     * `publicKey`, or no private-key credential) — an admin must `generate`
+     * first. Disabling is always allowed: it is the non-destructive action
+     * (keys are retained, see the plan), so there is no guard on
+     * `enabled: false`.
+     *
+     * Copies the `If-Match`/version-conflict handling verbatim from
+     * `EmailSettingsService.update`.
+     */
+    update(input: UpdatePushConfigInput, userId: string, expectedVersion?: number): Promise<PushConfigAdminView>;
+    /**
+     * `DELETE /api/admin/push-config` — remove the configuration outright.
+     *
+     * DELETES THE CREDENTIAL FIRST, THEN THE ROW — the opposite order from
+     * {@link generate}, and deliberately so: the safer partial-failure state
+     * here is "row still present but the credential is gone", which
+     * {@link resolveActiveVapidConfig}'s case 4 already treats as disabled and
+     * logs loudly. The other order (row gone, credential still present) would
+     * mean a partial failure silently falls back to any env vars this
+     * deployment also has set — reactivating push on stale deploy-time keys
+     * the admin just asked to remove.
+     */
+    remove(_input: RemovePushConfigInput, userId: string): Promise<PushConfigAdminView>;
+    private storedPublicKey;
+    private parseStoredSettings;
+    /**
+     * The `webPush` row as stored, or `null` when there is none. Read RAW (not
+     * salvaged), so the admin view can report a damaged row instead of quietly
+     * serving defaults over it.
+     */
+    private readRow;
+    /**
+     * Writes the row through the row store (#738): validated against the
+     * schema, refused with a 409 on a stale `If-Match`, version bumped, audited
+     * under `action` with the new settings (no secret: the schema carries a
+     * compile-time proof it has none).
+     */
+    private writeSettingsRow;
+    /** `{ id, email }` of the user who last saved, or `null` (none, or deleted). */
+    private findUpdatedBy;
+    private auditEvent;
+}
+//# sourceMappingURL=push-config.service.d.ts.map

package/dist/notifications/push-config.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-config.service.d.ts","sourceRoot":"","sources":["../../src/notifications/push-config.service.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAkC,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAGL,UAAU,EAEX,MAAM,sBAAsB,CAAC;AAM9B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,KAAK,EACV,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AA0D1E;;;;GAIG;AACH,eAAO,MAAM,eAAe,YAAY,CAAC;AAKzC;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,UAAU,EAAE,OAAO,CAAC;IAEpB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAEpB,oDAAoD;IACpD,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IAEvB,+EAA+E;IAC/E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;IAEpB,kDAAkD;IAClD,gBAAgB,EAAE,gBAAgB,CAAC;IAEnC;;;OAGG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAEhB,kDAAkD;IAClD,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IAEvB,+BAA+B;IAC/B,SAAS,EAAE;QACT,qBAAqB;QACrB,EAAE,EAAE,MAAM,CAAC;QACX,qBAAqB;QACrB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,IAAI,CAAC;CACV;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;CACjB;AAeD;;;;;;;GAOG;AACH,qBACa,iBAAiB;IAID,OAAO,CAAC,QAAQ,CAAC,MAAM;IAMhD,OAAO,CAAC,QAAQ,CAAC,WAAW;IAT9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;gBAGjB,MAAM,EAAE,mBAAmB,EAMpD,WAAW,EAAE,kBAAkB,EAKpC,IAAI,CAAC,EAAE,sBAAsB;IAK3C,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyB;IAM9C;;;;;;;OAOG;IACG,gBAAgB,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAyBtD;;;;;;;;;OASG;IACG,wBAAwB,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IA8DnE;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAYtB;;;;OAIG;YACW,WAAW;IAgCzB;;;;;;;;;;;;;;;;;;;OAmBG;IACG,QAAQ,CACZ,KAAK,EAAE,uBAAuB,EAC9B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,CAAC;IAoC/B;;;;;;;;;OASG;IACG,MAAM,CACV,KAAK,EAAE,qBAAqB,EAC5B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,CAAC;IAoC/B;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,KAAK,EAAE,qBAAqB,EAC5B,MAAM,EAAE,MAAM,EACd,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,mBAAmB,CAAC;IAyC/B;;;;;;;;;;;OAWG;IACG,MAAM,CACV,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,CAAC;IA4B/B,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,mBAAmB;IAM3B;;;;OAIG;YACW,OAAO;IAKrB;;;;;OAKG;YACW,gBAAgB;IAe9B,gFAAgF;YAClE,aAAa;YASb,UAAU;CAgBzB"}