@openchambery/relay-server 1.19.3-beta.5 → 1.19.3-beta.6

package/DOCUMENTATION.md

@@ -39,7 +39,7 @@ export OPENCHAMBER_PUSH_RELAY_APNS_P8_PATH=/etc/openchamber/AuthKey.p8
 openchamber-push-relay --host 127.0.0.1 --port 8788
 ```
 
-The Host maps the effective Relay `wss://`/`ws://` URL to the same host as `https://`/`http://` `/v1/push/send`. Set `OPENCHAMBER_PUSH_RELAY_URL` on the Host to override. After a Relay switch, the Host re-registers persisted tokens and binds them before the first send.
+The Host maps the effective Relay `wss://`/`ws://` URL to the same host as `https://`/`http://` `/v1/push/send`. Set `OPENCHAMBER_PUSH_RELAY_URL` on the Host to override. After a Relay switch, the Host re-registers persisted tokens and binds them before the first send. iOS Live Activity uses the same Push origin: `POST /v1/push/register-live-activity-token`, `POST /v1/push/unregister-live-activity-token`, and `POST /v1/push/live-activity`. Each Live Activity APNs request authenticates with the Host signing key, uses topic `{bundleId}.push-type.liveactivity`, and carries only `aps.timestamp`, `aps.event`, `aps.content-state`, and optional `dismissal-date` / `stale-date`. Successful `end` deliveries delete the token binding.
 
 ### Caddy
 

package/README.md

@@ -261,7 +261,7 @@ These variables belong on the OpenChamber Host, not on the Push process:
 | `OPENCHAMBER_PUSH_RELAY_URL` | derived from the effective Relay `ws`/`wss` URL | Host override for `https://` or `http://` `…/v1/push/send` |
 | `OPENCHAMBER_PUSH_RELAY_DISABLED` | unset | Host-only; `true` skips Push Relay and uses direct APNs |
 
-The derived send URL always uses `/v1/push/send` on the same host and port as the Relay URL. `wss` maps to `https`; `ws` maps to `http`. Register is the same origin with `/v1/push/register-token`.
+The derived send URL always uses `/v1/push/send` on the same host and port as the Relay URL. `wss` maps to `https`; `ws` maps to `http`. Register is the same origin with `/v1/push/register-token`. iOS Live Activity tokens use `/v1/push/register-live-activity-token`, `/v1/push/unregister-live-activity-token`, and `/v1/push/live-activity` on that same origin. Live Activity APNs requests use topic `{bundleId}.push-type.liveactivity` and never include session IDs, titles, alerts, or collapse IDs.
 
 ### Push process environment
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openchambery/relay-server",
-  "version": "1.19.3-beta.5",
+  "version": "1.19.3-beta.6",
   "description": "Self-hosted private relay server for OpenChamber",
   "private": false,
   "type": "module",

package/src/push/apns.js

@@ -65,15 +65,16 @@ export const createApnsProvider = (options = {}) => {
     const jwt = getJwt(forceJwt);
     let client;
     try { client = getSession(input.env); } catch { resolve({ ok: false }); return; }
+    const liveActivity = input.pushType === 'liveactivity';
     const headers = {
       ':method': 'POST',
       ':path': `/3/device/${input.token}`,
       authorization: `bearer ${jwt}`,
-      'apns-topic': bundleId,
-      'apns-push-type': 'alert',
+      'apns-topic': liveActivity ? `${bundleId}.push-type.liveactivity` : bundleId,
+      'apns-push-type': liveActivity ? 'liveactivity' : 'alert',
       'apns-priority': '10',
     };
-    if (input.collapseId) headers['apns-collapse-id'] = input.collapseId;
+    if (!liveActivity && input.collapseId) headers['apns-collapse-id'] = input.collapseId;
     let req;
     try { req = client.request(headers); } catch {
       dropSession(input.env, client);

package/src/push/index.d.ts

@@ -38,6 +38,7 @@ export interface PushApnsSendInput {
   env: PushRelayEnv;
   payload: unknown;
   collapseId?: string;
+  pushType?: 'alert' | 'liveactivity';
 }
 
 export interface PushApnsSendResult {

package/src/push/schema.js

@@ -11,9 +11,14 @@ export const MAX_DATA_ENTRIES = 16;
 export const MAX_DATA_KEY_BYTES = 64;
 export const MAX_DATA_VALUE_BYTES = 256;
 export const MAX_DATA_TOTAL_BYTES = 2048;
+export const LIVE_ACTIVITY_KIND = 'liveactivity';
+export const LIVE_ACTIVITY_EVENTS = new Set(['update', 'end']);
+export const LIVE_ACTIVITY_STATUSES = new Set(['working', 'tool', 'retry', 'input', 'permission', 'stale', 'complete', 'error']);
+export const LIVE_ACTIVITY_CONTENT_KEYS = new Set(['status', 'eventVersion', 'updatedAt', 'endedAt']);
 
 const bytes = (value) => Buffer.byteLength(value, 'utf8');
 const isSafeInt = (value) => typeof value === 'number' && Number.isSafeInteger(value);
+const isFiniteNumber = (value) => typeof value === 'number' && Number.isFinite(value);
 
 export const isIosToken = (value) => typeof value === 'string' && IOS_TOKEN.test(value);
 
@@ -48,6 +53,37 @@ export const buildApnsPayload = ({ title, body, badge, collapseId, data }) => {
   return Object.keys(data).length > 0 ? { aps, ...data } : { aps };
 };
 
+export const buildLiveActivityPayload = ({ event, contentState, dismissalDate, staleDate, timestamp }) => {
+  const aps = { timestamp, event, 'content-state': contentState };
+  if (event === 'end' && dismissalDate !== undefined) aps['dismissal-date'] = dismissalDate;
+  if (event === 'update' && staleDate !== undefined) aps['stale-date'] = staleDate;
+  return { aps };
+};
+
+const uniqueTokens = (tokens) => {
+  const unique = [];
+  const seen = new Set();
+  for (const token of tokens) {
+    if (seen.has(token)) continue;
+    seen.add(token);
+    unique.push(token);
+  }
+  return unique;
+};
+
+const parseContentState = (value, event) => {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const keys = Object.keys(value);
+  if (keys.length === 0 || keys.some((key) => !LIVE_ACTIVITY_CONTENT_KEYS.has(key))) return null;
+  if (typeof value.status !== 'string' || !LIVE_ACTIVITY_STATUSES.has(value.status)) return null;
+  if (!isSafeInt(value.eventVersion) || !isFiniteNumber(value.updatedAt)) return null;
+  if (event === 'end' && !isFiniteNumber(value.endedAt)) return null;
+  if (value.endedAt !== undefined && !isFiniteNumber(value.endedAt)) return null;
+  const contentState = { status: value.status, eventVersion: value.eventVersion, updatedAt: value.updatedAt };
+  if (value.endedAt !== undefined) contentState.endedAt = value.endedAt;
+  return contentState;
+};
+
 export const validateRegisterBody = (body) => {
   if (!body || typeof body !== 'object' || Array.isArray(body)) return { error: 'invalid_request' };
   if (body.platform === 'android') return { error: 'unsupported_platform' };
@@ -60,6 +96,13 @@ export const validateRegisterBody = (body) => {
   return { value: { token: body.token, platform: 'ios', publicKeyJwk: jwk, ts, sig } };
 };
 
+export const validateLiveActivityRegisterBody = (body) => {
+  const parsed = validateRegisterBody(body);
+  if (parsed.error) return parsed;
+  if (body.kind !== LIVE_ACTIVITY_KIND) return { error: 'invalid_request' };
+  return { value: { ...parsed.value, kind: LIVE_ACTIVITY_KIND } };
+};
+
 export const validateSendBody = (body) => {
   if (!body || typeof body !== 'object' || Array.isArray(body)) return { error: 'invalid_request' };
   const tokens = body.tokens;
@@ -75,13 +118,7 @@ export const validateSendBody = (body) => {
   const sig = parseSig(body.sig);
   const data = parseData(body.data);
   if (!jwk || ts === null || !sig || !data) return { error: 'invalid_request' };
-  const unique = [];
-  const seen = new Set();
-  for (const token of tokens) {
-    if (seen.has(token)) continue;
-    seen.add(token);
-    unique.push(token);
-  }
+  const unique = uniqueTokens(tokens);
   const payload = buildApnsPayload({
     title: body.title,
     body: body.body ?? '',
@@ -106,3 +143,43 @@ export const validateSendBody = (body) => {
     },
   };
 };
+
+export const validateLiveActivityBody = (body) => {
+  if (!body || typeof body !== 'object' || Array.isArray(body)) return { error: 'invalid_request' };
+  const tokens = body.tokens;
+  if (!Array.isArray(tokens) || tokens.length < 1 || tokens.length > MAX_TOKENS_PER_REQUEST) return { error: 'invalid_request' };
+  if (tokens.some((token) => !isIosToken(token))) return { error: 'invalid_request' };
+  if (typeof body.event !== 'string' || !LIVE_ACTIVITY_EVENTS.has(body.event)) return { error: 'invalid_request' };
+  const contentState = parseContentState(body.contentState, body.event);
+  if (!contentState) return { error: 'invalid_request' };
+  if (body.dismissalDate !== undefined && !isSafeInt(body.dismissalDate)) return { error: 'invalid_request' };
+  if (body.staleDate !== undefined && !isSafeInt(body.staleDate)) return { error: 'invalid_request' };
+  if (body.env !== undefined && body.env !== 'production' && body.env !== 'sandbox') return { error: 'invalid_request' };
+  const jwk = parsePublicJwk(body.publicKeyJwk);
+  const ts = parseTs(body.ts);
+  const sig = parseSig(body.sig);
+  if (!jwk || ts === null || !sig) return { error: 'invalid_request' };
+  const payload = buildLiveActivityPayload({
+    event: body.event,
+    contentState,
+    dismissalDate: body.dismissalDate,
+    staleDate: body.staleDate,
+    timestamp: 1_000_000_000,
+  });
+  if (bytes(JSON.stringify(payload)) > APNS_PAYLOAD_BYTES) return { error: 'invalid_request' };
+  return {
+    value: {
+      tokens,
+      uniqueTokens: uniqueTokens(tokens),
+      event: body.event,
+      contentState,
+      dismissalDate: body.dismissalDate,
+      staleDate: body.staleDate,
+      env: body.env === 'production' ? 'production' : 'sandbox',
+      publicKeyJwk: jwk,
+      ts,
+      sig,
+      payload,
+    },
+  };
+};

package/src/push/server.js

@@ -4,7 +4,7 @@ import { createApnsProvider } from './apns.js';
 import { normalizePushRelayOptions, resolvePushRelayClientIp, formatPushRelayUrl } from './config.js';
 import { deriveServerId, verifyP1363 } from './crypto.js';
 import { createInFlightGate, createReplayGuard, createSlidingWindowLimiter, createWorkTracker } from './guard.js';
-import { JSON_BODY_BYTES, validateRegisterBody, validateSendBody } from './schema.js';
+import { JSON_BODY_BYTES, buildLiveActivityPayload, validateLiveActivityBody, validateLiveActivityRegisterBody, validateRegisterBody, validateSendBody } from './schema.js';
 import { createTokenStore } from './store.js';
 
 const WINDOW_MS = 60_000;
@@ -98,10 +98,13 @@ export const createPushRelayServer = (options = {}) => {
   };
 
   const handleRegister = (parsed) => {
-    const authError = authenticate(parsed.publicKeyJwk, `${parsed.ts}.${parsed.token}.${parsed.platform}`, parsed.sig, parsed.ts);
+    const message = parsed.kind
+      ? `${parsed.ts}.${parsed.token}.${parsed.platform}.${parsed.kind}`
+      : `${parsed.ts}.${parsed.token}.${parsed.platform}`;
+    const authError = authenticate(parsed.publicKeyJwk, message, parsed.sig, parsed.ts);
     if (authError) return { status: 401, body: { error: authError } };
     const serverId = deriveServerId(parsed.publicKeyJwk);
-    const replayKey = `register.${serverId}.${parsed.ts}.${parsed.sig.toString('base64url')}`;
+    const replayKey = `${parsed.kind ? 'register-live-activity' : 'register'}.${serverId}.${parsed.ts}.${parsed.sig.toString('base64url')}`;
     if (replay.has(replayKey)) return { status: 200, body: { ok: true } };
     const tokens = liveStore();
     const existing = tokens.get(parsed.token);
@@ -111,6 +114,20 @@ export const createPushRelayServer = (options = {}) => {
     return { status: 200, body: { ok: true } };
   };
 
+  const handleUnregisterLiveActivity = (parsed) => {
+    const authError = authenticate(parsed.publicKeyJwk, `${parsed.ts}.${parsed.token}.${parsed.platform}.${parsed.kind}`, parsed.sig, parsed.ts);
+    if (authError) return { status: 401, body: { error: authError } };
+    const serverId = deriveServerId(parsed.publicKeyJwk);
+    const replayKey = `unregister-live-activity.${serverId}.${parsed.ts}.${parsed.sig.toString('base64url')}`;
+    if (replay.has(replayKey)) return { status: 200, body: { ok: true } };
+    const tokens = liveStore();
+    const existing = tokens.get(parsed.token);
+    if (existing && existing.serverId !== serverId) { reasons.authRejected += 1; return { status: 401, body: { error: 'invalid_signature' } }; }
+    if (!replay.remember(replayKey)) { reasons.limited += 1; return { status: 429, body: { error: 'rate_limited' } }; }
+    if (existing) tokens.delete(parsed.token);
+    return { status: 200, body: { ok: true } };
+  };
+
   const handleSend = async (parsed) => {
     const sorted = [...parsed.tokens].sort();
     const authError = authenticate(parsed.publicKeyJwk, `${parsed.ts}.${sorted.join(',')}.${parsed.title}`, parsed.sig, parsed.ts);
@@ -142,6 +159,47 @@ export const createPushRelayServer = (options = {}) => {
     return { status: 200, body: { results } };
   };
 
+  const handleLiveActivity = async (parsed) => {
+    const sorted = [...parsed.tokens].sort();
+    const contentState = parsed.contentState;
+    const message = `${parsed.ts}.${sorted.join(',')}.${parsed.event}.${contentState.status}.${contentState.eventVersion}.${contentState.updatedAt}.${contentState.endedAt ?? ''}.${parsed.dismissalDate ?? ''}.${parsed.staleDate ?? ''}`;
+    const authError = authenticate(parsed.publicKeyJwk, message, parsed.sig, parsed.ts);
+    if (authError) return { status: 401, body: { error: authError } };
+    const serverId = deriveServerId(parsed.publicKeyJwk);
+    const replayKey = `live-activity.${serverId}.${parsed.ts}.${parsed.sig.toString('base64url')}`;
+    if (replay.has(replayKey)) { reasons.replayRejected += 1; return { status: 401, body: { error: 'replay' } }; }
+    if (!replay.remember(replayKey)) { reasons.limited += 1; return { status: 429, body: { error: 'rate_limited' } }; }
+    if (!sendServerLimit.allow(serverId)) { reasons.limited += 1; return { status: 429, body: { error: 'rate_limited' } }; }
+    const payload = buildLiveActivityPayload({
+      event: parsed.event,
+      contentState,
+      dismissalDate: parsed.dismissalDate,
+      staleDate: parsed.staleDate,
+      timestamp: Math.floor(clock.now() / 1000),
+    });
+    const tokens = liveStore();
+    const results = await Promise.all(parsed.uniqueTokens.map(async (token) => {
+      const binding = tokens.get(token);
+      if (!binding || binding.serverId !== serverId) return { token, ok: false };
+      const acquired = await inFlight.acquire();
+      if (!acquired) { reasons.limited += 1; return { token, ok: false }; }
+      try {
+        const outcome = await apns.send({ token, env: parsed.env, payload, pushType: 'liveactivity' });
+        if (outcome?.drop === true) {
+          tokens.delete(token);
+          return { token, ok: false, drop: true };
+        }
+        if (outcome?.ok === true && parsed.event === 'end') tokens.delete(token);
+        return { token, ok: outcome?.ok === true };
+      } catch {
+        return { token, ok: false };
+      } finally {
+        inFlight.release(acquired);
+      }
+    }));
+    return { status: 200, body: { results } };
+  };
+
   const onRequest = (request, response) => {
     let pathname;
     try { pathname = new URL(request.url ?? '/', 'http://push-relay').pathname; } catch { response.writeHead(404); response.end(); return; }
@@ -152,22 +210,31 @@ export const createPushRelayServer = (options = {}) => {
       return;
     }
     const isRegister = pathname === '/v1/push/register-token';
+    const isRegisterLive = pathname === '/v1/push/register-live-activity-token';
+    const isUnregisterLive = pathname === '/v1/push/unregister-live-activity-token';
     const isSend = pathname === '/v1/push/send';
-    if (request.method !== 'POST' || (!isRegister && !isSend) || state !== 'running') { response.writeHead(404); response.end(); return; }
+    const isLiveActivity = pathname === '/v1/push/live-activity';
+    if (request.method !== 'POST' || (!isRegister && !isRegisterLive && !isUnregisterLive && !isSend && !isLiveActivity) || state !== 'running') { response.writeHead(404); response.end(); return; }
     const ip = resolveClientIp(request);
-    const limiter = isRegister ? registerIpLimit : sendIpLimit;
+    const limiter = (isRegister || isRegisterLive || isUnregisterLive) ? registerIpLimit : sendIpLimit;
     if (!limiter.allow(ip)) { reasons.limited += 1; sendJson(response, 429, { error: 'rate_limited' }); return; }
     const endHttp = httpWork.begin();
     readBody(request, limits.jsonBodyBytes ?? JSON_BODY_BYTES).then(async (buffer) => {
       let body;
       try { body = JSON.parse(buffer.toString('utf8')); } catch { reasons.policyRejected += 1; sendJson(response, 400, { error: 'invalid_request' }); return; }
-      const parsed = isRegister ? validateRegisterBody(body) : validateSendBody(body);
+      const parsed = isRegister ? validateRegisterBody(body)
+        : (isRegisterLive || isUnregisterLive) ? validateLiveActivityRegisterBody(body)
+          : isLiveActivity ? validateLiveActivityBody(body)
+            : validateSendBody(body);
       if (parsed.error) {
         reasons.policyRejected += 1;
         sendJson(response, 400, { error: parsed.error });
         return;
       }
-      const result = isRegister ? handleRegister(parsed.value) : await handleSend(parsed.value);
+      const result = (isRegister || isRegisterLive) ? handleRegister(parsed.value)
+        : isUnregisterLive ? handleUnregisterLiveActivity(parsed.value)
+          : isLiveActivity ? await handleLiveActivity(parsed.value)
+            : await handleSend(parsed.value);
       sendJson(response, result.status, result.body);
     }).catch((error) => {
       if (error?.code === 'PAYLOAD_TOO_LARGE') { reasons.policyRejected += 1; sendJson(response, 413, { error: 'payload_too_large' }); return; }