@meith/notifications 0.16.0

package/src/push.ts

@@ -0,0 +1,236 @@
+import { createCipheriv, hkdfSync, randomBytes } from 'node:crypto'
+
+export const PUSH_PAYLOAD_LIMIT = 3000
+
+export const PUSH_RECORD_SIZE = 4096
+
+export const PUSH_REQUEST_TIMEOUT_MS = 10_000
+
+export const PUSH_TTL_SECONDS = 86_400
+
+const VAPID_EXPIRY_SECONDS = 12 * 60 * 60
+
+const CURVE: EcKeyImportParams = { name: 'ECDH', namedCurve: 'P-256' }
+
+const SIGNING: EcKeyImportParams = { name: 'ECDSA', namedCurve: 'P-256' }
+
+export interface VapidKeyPair {
+  readonly publicKey: string
+  readonly privateKey: string
+}
+
+export interface VapidDetails extends VapidKeyPair {
+  readonly subject: string
+}
+
+export interface PushSubscriptionKeys {
+  readonly endpoint: string
+  readonly p256dh: string
+  readonly auth: string
+}
+
+export type PushSendOutcome = 'sent' | 'gone' | 'failed'
+
+export interface PushSendResult {
+  readonly outcome: PushSendOutcome
+  readonly status: number | null
+  readonly error: string | null
+}
+
+function decode(value: string): Buffer {
+  return Buffer.from(value, 'base64url')
+}
+
+function encode(value: ArrayBuffer | Uint8Array): string {
+  return Buffer.from(value instanceof Uint8Array ? value : new Uint8Array(value)).toString(
+    'base64url',
+  )
+}
+
+function bytes(value: Buffer): Uint8Array<ArrayBuffer> {
+  return new Uint8Array(value)
+}
+
+export async function generateVapidKeys(): Promise<VapidKeyPair> {
+  const pair = await crypto.subtle.generateKey(SIGNING, true, ['sign', 'verify'])
+  const jwk = await crypto.subtle.exportKey('jwk', pair.privateKey)
+  const raw = await crypto.subtle.exportKey('raw', pair.publicKey)
+
+  if (jwk.d === undefined) throw new Error('The generated key carries no private scalar.')
+
+  return { publicKey: encode(raw), privateKey: jwk.d }
+}
+
+export function isVapidPublicKey(value: string): boolean {
+  const raw = decode(value)
+  return raw.length === 65 && raw[0] === 4
+}
+
+export function isVapidPrivateKey(value: string): boolean {
+  return decode(value).length === 32
+}
+
+function jwkFor(keys: VapidKeyPair): JsonWebKey {
+  const raw = decode(keys.publicKey)
+  if (raw.length !== 65 || raw[0] !== 4) {
+    throw new Error('A VAPID public key is a 65-byte uncompressed P-256 point.')
+  }
+
+  return {
+    kty: 'EC',
+    crv: 'P-256',
+    x: raw.subarray(1, 33).toString('base64url'),
+    y: raw.subarray(33, 65).toString('base64url'),
+    d: keys.privateKey,
+    ext: true,
+  }
+}
+
+export function pushAudience(endpoint: string): string {
+  const url = new URL(endpoint)
+  return `${url.protocol}//${url.host}`
+}
+
+export async function vapidAuthorization(
+  vapid: VapidDetails,
+  endpoint: string,
+  now: Date = new Date(),
+): Promise<string> {
+  const header = encode(Buffer.from(JSON.stringify({ typ: 'JWT', alg: 'ES256' })))
+  const claims = encode(
+    Buffer.from(
+      JSON.stringify({
+        aud: pushAudience(endpoint),
+        exp: Math.floor(now.getTime() / 1000) + VAPID_EXPIRY_SECONDS,
+        sub: vapid.subject,
+      }),
+    ),
+  )
+
+  const key = await crypto.subtle.importKey('jwk', jwkFor(vapid), SIGNING, false, ['sign'])
+  const signature = await crypto.subtle.sign(
+    { name: 'ECDSA', hash: 'SHA-256' },
+    key,
+    bytes(Buffer.from(`${header}.${claims}`)),
+  )
+
+  return `vapid t=${header}.${claims}.${encode(signature)}, k=${vapid.publicKey}`
+}
+
+export interface EncryptedPushPayload {
+  readonly body: Buffer
+  readonly salt: Buffer
+  readonly serverPublicKey: Buffer
+}
+
+export async function encryptPushPayload(
+  subscription: Pick<PushSubscriptionKeys, 'p256dh' | 'auth'>,
+  payload: string,
+  salt: Buffer = randomBytes(16),
+): Promise<EncryptedPushPayload> {
+  const plaintext = Buffer.from(payload, 'utf8')
+  if (plaintext.byteLength > PUSH_PAYLOAD_LIMIT) {
+    throw new Error(`A push payload may not exceed ${PUSH_PAYLOAD_LIMIT} bytes.`)
+  }
+
+  const clientPublic = decode(subscription.p256dh)
+  const authSecret = decode(subscription.auth)
+
+  const client = await crypto.subtle.importKey('raw', bytes(clientPublic), CURVE, false, [])
+  const server = await crypto.subtle.generateKey(CURVE, true, ['deriveBits'])
+  const serverPublic = Buffer.from(await crypto.subtle.exportKey('raw', server.publicKey))
+
+  const shared = Buffer.from(
+    await crypto.subtle.deriveBits({ name: 'ECDH', public: client }, server.privateKey, 256),
+  )
+
+  const keyInfo = Buffer.concat([
+    Buffer.from('WebPush: info\0', 'utf8'),
+    clientPublic,
+    serverPublic,
+  ])
+
+  const ikm = Buffer.from(hkdfSync('sha256', shared, authSecret, keyInfo, 32))
+  const key = Buffer.from(
+    hkdfSync('sha256', ikm, salt, Buffer.from('Content-Encoding: aes128gcm\0', 'utf8'), 16),
+  )
+  const nonce = Buffer.from(
+    hkdfSync('sha256', ikm, salt, Buffer.from('Content-Encoding: nonce\0', 'utf8'), 12),
+  )
+
+  const cipher = createCipheriv('aes-128-gcm', key, nonce)
+  const sealed = Buffer.concat([
+    cipher.update(Buffer.concat([plaintext, Buffer.from([2])])),
+    cipher.final(),
+    cipher.getAuthTag(),
+  ])
+
+  const header = Buffer.alloc(5)
+  header.writeUInt32BE(PUSH_RECORD_SIZE, 0)
+  header.writeUInt8(serverPublic.length, 4)
+
+  return {
+    body: Buffer.concat([salt, header, serverPublic, sealed]),
+    salt,
+    serverPublicKey: serverPublic,
+  }
+}
+
+export function pushOutcomeFor(status: number): PushSendOutcome {
+  if (status >= 200 && status < 300) return 'sent'
+  if (status === 404 || status === 410) return 'gone'
+  return 'failed'
+}
+
+export async function sendWebPush(input: {
+  readonly subscription: PushSubscriptionKeys
+  readonly payload: string
+  readonly vapid: VapidDetails
+  readonly ttlSeconds?: number
+  readonly now?: Date
+  readonly fetchImpl?: typeof fetch
+}): Promise<PushSendResult> {
+  const doFetch = input.fetchImpl ?? fetch
+
+  let encrypted: EncryptedPushPayload
+  let authorization: string
+  try {
+    encrypted = await encryptPushPayload(input.subscription, input.payload)
+    authorization = await vapidAuthorization(
+      input.vapid,
+      input.subscription.endpoint,
+      input.now ?? new Date(),
+    )
+  } catch (err) {
+    return { outcome: 'failed', status: null, error: message(err) }
+  }
+
+  try {
+    const response = await doFetch(input.subscription.endpoint, {
+      method: 'POST',
+      headers: {
+        authorization,
+        'content-encoding': 'aes128gcm',
+        'content-type': 'application/octet-stream',
+        ttl: String(input.ttlSeconds ?? PUSH_TTL_SECONDS),
+        urgency: 'normal',
+      },
+      body: bytes(encrypted.body),
+      redirect: 'manual',
+      signal: AbortSignal.timeout(PUSH_REQUEST_TIMEOUT_MS),
+    })
+
+    const outcome = pushOutcomeFor(response.status)
+    return {
+      outcome,
+      status: response.status,
+      error: outcome === 'sent' ? null : `HTTP ${response.status}`,
+    }
+  } catch (err) {
+    return { outcome: 'failed', status: null, error: message(err) }
+  }
+}
+
+function message(err: unknown): string {
+  return err instanceof Error ? err.message : String(err)
+}

package/src/render.ts

@@ -0,0 +1,275 @@
+import { EN_CATALOG, sourceTranslator, type Translator } from '@meith/i18n'
+
+import { notificationKind } from './kinds'
+import type { NotificationData, NotificationRecord } from './types'
+
+export interface NotificationView {
+  readonly id: number
+  readonly subject: string
+  readonly body: string
+  readonly href: string | null
+  readonly kind: string
+  readonly occurrences: number
+  readonly createdAt: Date
+  readonly updatedAt: Date
+  readonly isRead: boolean
+  readonly unsubscribeToken: string | null
+}
+
+function objects(data: NotificationData, key: string): readonly NotificationData[] {
+  const value = data[key]
+  if (!Array.isArray(value)) return []
+  return value.filter(
+    (entry): entry is NotificationData =>
+      entry !== null && typeof entry === 'object' && !Array.isArray(entry),
+  )
+}
+
+function str(data: NotificationData, key: string, fallback = ''): string {
+  const value = data[key]
+  if (typeof value === 'string') return value
+  if (typeof value === 'number' || typeof value === 'boolean') return String(value)
+  return fallback
+}
+
+function num(data: NotificationData, key: string, fallback = 0): number {
+  const value = data[key]
+  if (typeof value === 'number' && Number.isFinite(value)) return value
+  if (typeof value === 'string') {
+    const parsed = Number(value)
+    if (Number.isFinite(parsed)) return parsed
+  }
+  return fallback
+}
+
+function args(data: NotificationData, key: string): Readonly<Record<string, string | number>> {
+  const raw = str(data, key)
+  if (raw === '') return {}
+
+  try {
+    const value: unknown = JSON.parse(raw)
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) return {}
+    return Object.fromEntries(
+      Object.entries(value).filter(
+        (entry): entry is [string, string | number] =>
+          typeof entry[1] === 'string' || typeof entry[1] === 'number',
+      ),
+    )
+  } catch {
+    return {}
+  }
+}
+
+function pluginMessage(
+  data: NotificationData,
+  textKey: string,
+  argsKey: string,
+  legacyKey: string,
+  t: Translator,
+): string {
+  const key = str(data, textKey)
+  return key === '' ? str(data, legacyKey) : t.t(key, args(data, argsKey))
+}
+
+function points(t: Translator, value: number): string {
+  return t.t('notification.render.points', { count: value })
+}
+
+const DIGEST_CADENCE_KEYS = {
+  daily: 'notification.render.digest.daily',
+  weekly: 'notification.render.digest.weekly',
+} as const
+
+const TEMPLATES: Readonly<
+  Record<string, (data: NotificationData, t: Translator) => { subject: string; body: string }>
+> = {
+  'warning.received': (data, t) => {
+    const title = str(data, 'title', t.t('notification.render.warning.fallbackTitle'))
+    const reason = str(data, 'reason')
+    const total = num(data, 'totalPoints')
+    const restriction = str(data, 'restriction')
+
+    const consequence =
+      restriction === 'suspend_posting'
+        ? ` ${t.t('notification.render.warning.suspendPosting')}`
+        : restriction === 'moderate_posting'
+          ? ` ${t.t('notification.render.warning.moderatePosting')}`
+          : restriction === 'ban'
+            ? ` ${t.t('notification.render.warning.banned')}`
+            : ''
+
+    return {
+      subject: t.t('notification.render.warning.subject', { title }),
+      body:
+        t.t('notification.render.warning.body', {
+          points: points(t, num(data, 'points')),
+          total: points(t, total),
+        }) +
+        consequence +
+        (reason === '' ? '' : `\n\n${t.t('notification.render.warning.reason', { reason })}`),
+    }
+  },
+
+  'report.actioned': (data, t) => {
+    const outcome = str(data, 'outcome')
+    const label = str(data, 'targetLabel', t.t('notification.render.report.fallbackLabel'))
+    return {
+      subject:
+        outcome === 'rejected'
+          ? t.t('notification.render.report.rejectedSubject')
+          : t.t('notification.render.report.actionedSubject'),
+      body:
+        outcome === 'rejected'
+          ? t.t('notification.render.report.rejectedBody', { label })
+          : t.t('notification.render.report.actionedBody', { label }),
+    }
+  },
+
+  'subscription.reply': (data, t) => {
+    const title = str(data, 'threadTitle', t.t('notification.render.reply.fallbackTitle'))
+    const posts = num(data, 'posts', 1)
+    const author = str(data, 'lastAuthor')
+
+    return {
+      subject: t.t('notification.render.reply.subject', { count: posts, title }),
+      body:
+        author === ''
+          ? t.t('notification.render.reply.noAuthor')
+          : t.t('notification.render.reply.author', { author }),
+    }
+  },
+
+  'subscription.digest': (data, t) => {
+    const cadence = str(data, 'cadence') === 'weekly' ? 'weekly' : 'daily'
+    const threadCount = num(data, 'threadCount')
+    const postCount = num(data, 'postCount')
+    const more = num(data, 'more')
+
+    const lines = objects(data, 'threads').map((thread) => {
+      const posts = num(thread, 'posts', 1)
+      const author = str(thread, 'lastAuthor')
+      return t.t('notification.render.digest.entry', {
+        title: str(thread, 'title', t.t('notification.render.digest.fallbackTitle')),
+        count: posts,
+        author: author === '' ? '' : t.t('notification.render.digest.entryAuthor', { author }),
+      })
+    })
+
+    if (more > 0) lines.push(t.t('notification.render.digest.more', { count: more }))
+
+    return {
+      subject: t.t('notification.render.digest.subject', {
+        cadence: t.t(DIGEST_CADENCE_KEYS[cadence]),
+        posts: postCount,
+        threads: threadCount,
+      }),
+      body: lines.join('\n'),
+    }
+  },
+
+  'post.mentioned': (data, t) => {
+    const by = str(data, 'byUsername', t.t('notification.render.somebody'))
+    const title = str(data, 'threadTitle', t.t('notification.render.threadFallback'))
+    return {
+      subject: t.t('notification.render.mentioned.subject', { by, title }),
+      body: t.t('notification.render.mentioned.body', { by, title }),
+    }
+  },
+
+  'post.quoted': (data, t) => {
+    const by = str(data, 'byUsername', t.t('notification.render.somebody'))
+    const title = str(data, 'threadTitle', t.t('notification.render.threadFallback'))
+    return {
+      subject: t.t('notification.render.quoted.subject', { by, title }),
+      body: t.t('notification.render.quoted.body', { by, title }),
+    }
+  },
+
+  'pm.received': (data, t) => {
+    const from = str(data, 'fromUsername', t.t('notification.render.somebody'))
+    const subject = str(data, 'subject', t.t('notification.render.pm.fallbackSubject'))
+    return {
+      subject: t.t('notification.render.pm.receivedSubject', { from }),
+      body: `“${subject}”`,
+    }
+  },
+
+  'pm.receipt': (data, t) => {
+    const by = str(data, 'byUsername', t.t('notification.render.pm.recipientFallback'))
+    const subject = str(data, 'subject', t.t('notification.render.pm.messageFallback'))
+    return {
+      subject: t.t('notification.render.pm.receiptSubject', { by }),
+      body: t.t('notification.render.pm.receiptBody', { subject }),
+    }
+  },
+
+  'system.task_failed': (data, t) => {
+    const taskId = str(data, 'taskId', t.t('notification.render.task.fallbackId'))
+    const error = str(data, 'error')
+    return {
+      subject: t.t('notification.render.task.subject', { taskId }),
+      body:
+        t.t('notification.render.task.body', { taskId }) +
+        (error === '' ? '' : `\n\n${t.t('notification.render.task.error', { error })}`),
+    }
+  },
+
+  'marketplace.update_available': (data, t) => {
+    const name = str(data, 'name', str(data, 'key'))
+    const version = str(data, 'version')
+    const packageName = str(data, 'package')
+    return {
+      subject: t.t('notification.render.marketplace.subject', { name, version }),
+      body: t.t('notification.render.marketplace.body', { package: packageName, version }),
+    }
+  },
+}
+
+export function renderNotification(
+  record: NotificationRecord,
+  t: Translator = sourceTranslator(EN_CATALOG),
+): NotificationView {
+  const template = TEMPLATES[record.kind]
+  const spec = notificationKind(record.kind)
+
+  const rendered =
+    template !== undefined
+      ? template(record.data, t)
+      : record.kind.startsWith('plugin.')
+        ? {
+            subject:
+              pluginMessage(record.data, 'subjectKey', 'subjectArgs', 'subject', t) ||
+              t.t('notification.render.pluginFallback'),
+            body: pluginMessage(record.data, 'bodyKey', 'bodyArgs', 'body', t),
+          }
+        : {
+            subject:
+              spec?.titleKey === undefined
+                ? (spec?.title ?? t.t('notification.render.generic', { kind: record.kind }))
+                : t.t(spec.titleKey),
+            body: '',
+          }
+
+  const subject =
+    record.occurrences > 1
+      ? t.t('notification.render.occurrences', {
+          subject: rendered.subject,
+          count: record.occurrences,
+        })
+      : rendered.subject
+
+  const unsubscribe = record.data.unsubscribe
+
+  return {
+    id: record.id,
+    subject,
+    body: rendered.body,
+    unsubscribeToken: typeof unsubscribe === 'string' && unsubscribe !== '' ? unsubscribe : null,
+    href: record.href,
+    kind: record.kind,
+    occurrences: record.occurrences,
+    createdAt: record.createdAt,
+    updatedAt: record.updatedAt,
+    isRead: record.readAt !== null,
+  }
+}