@takosjp/yurucommu-core 3.0.3 → 3.2.1

package/packages/api/src/lib/api/notification-target.ts

@@ -0,0 +1,106 @@
+import type {
+  Notification,
+  NotificationTargetKind,
+} from "../../types/index.ts";
+
+export interface NotificationTarget {
+  readonly target_kind: NotificationTargetKind;
+  readonly target_id: string | null;
+  /**
+   * Same-origin in-app path shaped for the yurucommu web client's routing.
+   * Other clients should prefer `target_kind` + `target_id` and build their own
+   * path. Never treat this as an external URL.
+   */
+  readonly target_url: string;
+}
+
+/** True if the string contains any C0 control character (0x00-0x1f). */
+function hasControlChar(value: string): boolean {
+  for (let index = 0; index < value.length; index += 1) {
+    if (value.charCodeAt(index) < 0x20) return true;
+  }
+  return false;
+}
+
+/**
+ * Guard an in-app navigation path against open-redirect / protocol-relative /
+ * control-character abuse. Returns the value only if it is a plain same-origin
+ * absolute path (`/...`, not `//...`), else null. Promoted from the yurucommu
+ * and yurume web clients, which each carried an identical copy.
+ */
+export function safeNotificationPath(
+  value: string | null | undefined,
+): string | null {
+  if (
+    !value ||
+    !value.startsWith("/") ||
+    value.startsWith("//") ||
+    value.includes("\\") ||
+    hasControlChar(value)
+  ) {
+    return null;
+  }
+  return value;
+}
+
+function isStoryNotification(notification: Notification): boolean {
+  return (
+    notification.target_kind === "story" ||
+    !!notification.object_ap_id?.includes("/ap/stories/")
+  );
+}
+
+/**
+ * Resolve the navigation target for a notification. Prefers the server-provided
+ * `target_*` fields (3.2.0+) after re-validating `target_url`; when a server
+ * older than 3.2.0 omitted them, synthesizes the same mapping the server uses
+ * from `type` + `object_ap_id`. Always returns a safe same-origin path.
+ */
+export function resolveNotificationTarget(
+  notification: Notification,
+): NotificationTarget {
+  const declaredKind = notification.target_kind;
+  const declaredUrl = safeNotificationPath(notification.target_url);
+  if (declaredKind && declaredUrl) {
+    return {
+      target_kind: declaredKind,
+      target_id: notification.target_id ?? null,
+      target_url: declaredUrl,
+    };
+  }
+
+  if (
+    notification.type === "follow" ||
+    notification.type === "follow_request"
+  ) {
+    const actorApId = notification.actor?.ap_id ?? null;
+    return {
+      target_kind: "profile",
+      target_id: actorApId,
+      target_url: actorApId
+        ? `/profile/${encodeURIComponent(actorApId)}`
+        : "/notifications",
+    };
+  }
+
+  const objectApId = notification.object_ap_id;
+  if (objectApId && isStoryNotification(notification)) {
+    return {
+      target_kind: "story",
+      target_id: objectApId,
+      target_url: `/?story=${encodeURIComponent(objectApId)}`,
+    };
+  }
+  if (objectApId) {
+    return {
+      target_kind: "post",
+      target_id: objectApId,
+      target_url: `/post/${encodeURIComponent(objectApId)}`,
+    };
+  }
+  return {
+    target_kind: "notifications",
+    target_id: null,
+    target_url: "/notifications",
+  };
+}

package/packages/api/src/lib/api/notifications.ts

@@ -1,4 +1,9 @@
-import type { Notification } from "../../types/index.ts";
+import type {
+  Notification,
+  NotificationPusherInput,
+  NotificationPusherProduct,
+  NotificationPusherRegistration,
+} from "../../types/index.ts";
 import { normalizeNotification } from "./normalize.ts";
 import { apiDelete, apiFetch, apiPost, assertOk } from "./fetch.ts";
 
@@ -59,3 +64,50 @@ export async function archiveAllNotifications(): Promise<number> {
   const data = (await res.json()) as { archived_count?: number };
   return data.archived_count ?? 0;
 }
+
+export async function registerNotificationPusher(input: {
+  product: NotificationPusherProduct;
+  scope?: string;
+  pusher: NotificationPusherInput;
+}): Promise<NotificationPusherRegistration> {
+  const res = await apiPost("/api/notifications/pushers", input);
+  await assertOk(res, "Failed to register notification pusher");
+  const data = (await res.json()) as {
+    pusher: NotificationPusherRegistration;
+  };
+  return data.pusher;
+}
+
+export async function unregisterNotificationPusher(input: {
+  product: NotificationPusherProduct;
+  scope?: string;
+  app_id: string;
+  pushkey: string;
+}): Promise<void> {
+  const res = await apiDelete("/api/notifications/pushers", input);
+  await assertOk(res, "Failed to unregister notification pusher");
+}
+
+export interface NotificationPusherPublicConfig {
+  readonly enabled: boolean;
+  readonly gateway_url: string | null;
+  readonly web_push_public_key: string | null;
+}
+
+/** Non-secret runtime configuration used by browser/PWA clients. */
+export async function fetchNotificationPusherPublicConfig(): Promise<NotificationPusherPublicConfig> {
+  const res = await apiFetch("/api/notifications/pushers/config");
+  await assertOk(res, "Failed to load notification pusher configuration");
+  const value = (await res.json()) as Partial<NotificationPusherPublicConfig>;
+  const gatewayUrl =
+    typeof value.gateway_url === "string" ? value.gateway_url : null;
+  const publicKey =
+    typeof value.web_push_public_key === "string"
+      ? value.web_push_public_key
+      : null;
+  return {
+    enabled: Boolean(gatewayUrl && publicKey),
+    gateway_url: gatewayUrl,
+    web_push_public_key: publicKey,
+  };
+}

package/packages/api/src/lib/api/push-config.ts

@@ -0,0 +1,132 @@
+import type { NotificationPusherProduct } from "../../types/index.ts";
+import {
+  clearBrowserNotificationPush,
+  disableBrowserNotificationPush,
+  type BrowserNotificationPushConfig,
+} from "./browser-push.ts";
+import { fetchNotificationPusherPublicConfig } from "./notifications.ts";
+
+/**
+ * Stable identity of a browser/PWA push client. Everything here is a per-app
+ * constant; only the gateway URL, VAPID key, and server origin are resolved at
+ * runtime.
+ */
+export interface BrowserPushClientIdentity {
+  readonly product: NotificationPusherProduct;
+  readonly appId: string;
+  readonly appDisplayName: string;
+  /** Root-relative service worker script path (e.g. "/notification-push-sw.js"). */
+  readonly serviceWorkerPath: string;
+  readonly scope?: string;
+  readonly lang?: string;
+}
+
+/** Non-secret runtime gateway values, from a fetch or build-time fallback. */
+export interface BrowserPushRuntimeValues {
+  readonly gatewayUrl?: string | null;
+  readonly vapidPublicKey?: string | null;
+}
+
+export interface BrowserPushConfigResolverOptions {
+  readonly identity: BrowserPushClientIdentity;
+  /**
+   * Origin of the yurucommu-compatible API that owns the registration. Returns
+   * null when it cannot be determined (e.g. SSR, or an unconfigured shell), in
+   * which case config resolution yields null.
+   */
+  readonly resolveServerOrigin: () => string | null;
+  /**
+   * Build-time fallback used only while a server rolls forward to 3.2.0; a
+   * responding runtime config always wins.
+   */
+  readonly buildTimeValues?: () => BrowserPushRuntimeValues | null;
+}
+
+export interface BrowserPushConfigResolver {
+  /** Build config from build-time values only (no network). */
+  readonly buildTimeConfig: () => BrowserNotificationPushConfig | null;
+  /**
+   * Resolve config from the server's runtime pusher config, falling back to
+   * build-time values if the server is unreachable or has push disabled.
+   */
+  readonly resolveConfig: () => Promise<BrowserNotificationPushConfig | null>;
+  /**
+   * Invalidate this device's endpoint before sign-out / account teardown,
+   * disabling via the resolved config when possible and always clearing the
+   * local subscription so a signed-out device is never woken.
+   */
+  readonly clearBeforeSignOut: () => Promise<void>;
+}
+
+/**
+ * Build a browser push config resolver for a single client identity. Promoted
+ * from the near-identical per-app resolvers in the yurucommu and yurume web
+ * clients so the fetch/fallback/clear flow lives in one place.
+ */
+export function createBrowserPushConfigResolver(
+  options: BrowserPushConfigResolverOptions,
+): BrowserPushConfigResolver {
+  const { identity, resolveServerOrigin, buildTimeValues } = options;
+
+  const build = (
+    values: BrowserPushRuntimeValues | null | undefined,
+  ): BrowserNotificationPushConfig | null => {
+    const gatewayUrl = values?.gatewayUrl?.trim();
+    const vapidPublicKey = values?.vapidPublicKey?.trim();
+    if (!gatewayUrl || !vapidPublicKey) return null;
+    const serverOrigin = resolveServerOrigin();
+    if (!serverOrigin) return null;
+    return {
+      product: identity.product,
+      appId: identity.appId,
+      appDisplayName: identity.appDisplayName,
+      serverOrigin,
+      gatewayUrl,
+      vapidPublicKey,
+      serviceWorkerPath: identity.serviceWorkerPath,
+      ...(identity.scope ? { scope: identity.scope } : {}),
+      ...(identity.lang ? { lang: identity.lang } : {}),
+    };
+  };
+
+  const buildTimeConfig = (): BrowserNotificationPushConfig | null =>
+    build(buildTimeValues?.() ?? null);
+
+  const resolveConfig =
+    async (): Promise<BrowserNotificationPushConfig | null> => {
+      try {
+        const runtime = await fetchNotificationPusherPublicConfig();
+        if (
+          !runtime.enabled ||
+          !runtime.gateway_url ||
+          !runtime.web_push_public_key
+        ) {
+          return null;
+        }
+        return build({
+          gatewayUrl: runtime.gateway_url,
+          vapidPublicKey: runtime.web_push_public_key,
+        });
+      } catch {
+        // Compatibility with older servers while they roll forward. Build-time
+        // public values are a fallback only; a responding runtime config is the
+        // deployment authority.
+        return buildTimeConfig();
+      }
+    };
+
+  const clearBeforeSignOut = async (): Promise<void> => {
+    const config = await resolveConfig().catch(() => null);
+    if (config) {
+      try {
+        await disableBrowserNotificationPush(config);
+        return;
+      } catch {
+        // Fall through to local endpoint invalidation.
+      }
+    }
+    await clearBrowserNotificationPush(identity).catch(() => undefined);
+  };
+
+  return { buildTimeConfig, resolveConfig, clearBeforeSignOut };
+}

package/packages/api/src/lib/api.ts

@@ -7,6 +7,9 @@ export * from "./api/posts.ts";
 export * from "./api/communities.ts";
 export * from "./api/dm.ts";
 export * from "./api/notifications.ts";
+export * from "./api/notification-target.ts";
+export * from "./api/browser-push.ts";
+export * from "./api/push-config.ts";
 export * from "./api/search.ts";
 export * from "./api/media.ts";
 export * from "./api/stories.ts";

package/packages/api/src/social-server.ts

@@ -16,6 +16,11 @@ export interface SocialServerDiscovery {
     readonly defaultEntry: "feed" | "messages";
   }[];
   readonly issuer: string;
+  readonly oidcClientId?: string;
+  readonly auth?: {
+    readonly oidc: boolean;
+    readonly password: boolean;
+  };
   readonly apiBaseUrl: string;
   readonly activitypubOrigin: string;
   readonly mediaOrigin: string;
@@ -24,10 +29,14 @@ export interface SocialServerDiscovery {
   readonly endpoints: {
     readonly api: string;
     readonly authProviders: string;
+    readonly mobilePasswordLogin: string;
+    readonly mobileOidcExchange: string;
     readonly currentUser: string;
     readonly timeline: string;
     readonly conversations: string;
     readonly notifications: string;
+    readonly notificationPushers: string;
+    /** @deprecated Use notificationPushers. */
     readonly mobilePushRegistrations: string;
   };
 }

package/packages/api/src/types/index.ts

@@ -102,6 +102,8 @@ export interface DMMessage {
   id: string;
   sender: DMSender;
   content: string;
+  /** Media attachments (image/video), same shape as post attachments. */
+  attachments?: MediaAttachment[];
   created_at: string;
 }
 
@@ -120,10 +122,56 @@ export interface Notification {
   type: "follow" | "follow_request" | "like" | "announce" | "reply" | "mention";
   actor: NotificationActor;
   object_ap_id: string | null;
+  /**
+   * Navigation target for the notification. OPTIONAL: a server older than
+   * 3.2.0 omits these fields, and `normalizeNotification` then synthesizes them
+   * from `object_ap_id`. Prefer `target_kind` + `target_id` and build your own
+   * in-app path; `target_url` is shaped for the yurucommu web client's routing
+   * and is same-origin only — never treat it as an external URL.
+   */
+  target_kind?: NotificationTargetKind;
+  target_id?: string | null;
+  target_url?: string;
   read: boolean;
   created_at: string;
 }
 
+export type NotificationTargetKind =
+  "post" | "story" | "profile" | "notifications";
+
+export type NotificationPusherProduct = "yurucommu" | "yurume";
+
+export interface NotificationPusherInput {
+  kind: "http";
+  app_id: string;
+  pushkey: string;
+  app_display_name?: string;
+  device_display_name?: string;
+  profile_tag?: string;
+  lang?: string;
+  data: {
+    url: string;
+    format?: "event_id_only" | "full";
+    [key: string]: unknown;
+  };
+}
+
+export interface NotificationPusherRegistration {
+  id: string;
+  kind: "http";
+  app_id: string;
+  app_display_name?: string;
+  device_display_name?: string;
+  profile_tag?: string;
+  lang?: string;
+  data: Record<string, unknown>;
+  gateway_url: string;
+  product: NotificationPusherProduct;
+  scope: string | null;
+  registered_at: string;
+  last_seen_at: string;
+}
+
 // Story attachment (image or video)
 export interface StoryAttachment {
   type: string; // "Document" or "Video"

package/src/backend/index.ts

@@ -1,5 +1,6 @@
 import { Hono, type Context } from "hono";
 import { MOBILE_PUSH_REGISTRATION_PATH } from "./lib/mobile-contract.ts";
+import { NOTIFICATION_PUSHER_REGISTRATION_PATH } from "./lib/notification-pusher-contract.ts";
 import type { Env, EnvVars, Variables } from "./types.ts";
 import { extractActorFromSession } from "./lib/session-actor.ts";
 import { isBackendPath } from "./lib/backend-paths.ts";
@@ -27,6 +28,7 @@ import recommendationsRoutes from "./routes/recommendations.ts";
 import { moderationRoutes } from "./routes/moderation.ts";
 import { appsApiRoutes, appsServeRoutes } from "./routes/apps.ts";
 import mobileRoutes from "./routes/mobile.ts";
+import notificationPusherRoutes from "./routes/notification-pushers.ts";
 
 import { rateLimit, RateLimitConfigs } from "./middleware/rate-limit.ts";
 import { csrfProtection } from "./middleware/csrf.ts";
@@ -38,6 +40,7 @@ import {
 import { logger } from "./lib/logger.ts";
 
 const log = logger.child({ component: "backend.index" });
+let lastNotificationPushRecoverySweep = 0;
 import type { MessageBatch } from "@cloudflare/workers-types";
 import type {
   DeliveryDlqMessageV1,
@@ -47,6 +50,7 @@ import {
   handleDeliveryDlqBatch,
   handleDeliveryQueueBatch,
 } from "./lib/delivery/queue.ts";
+import { enqueuePendingNotificationPushJobs } from "./lib/notification-push.ts";
 
 type YurucommuApp = Hono<{ Bindings: Env; Variables: Variables }>;
 
@@ -106,6 +110,7 @@ const DEFAULT_DISCOVERY_OPTIONS = {
     "activitypub.server.v1",
     "client.yurucommu.feed.v1",
     "client.yurume.messages.v1",
+    "notification.pushers.v1",
   ],
 } satisfies Required<YurucommuBackendDiscoveryOptionsV1>;
 
@@ -214,6 +219,7 @@ function buildSocialServerDiscovery(
   appUrl: string,
   issuer: string,
   options: YurucommuBackendDiscoveryOptionsV1 = {},
+  auth: { oidcClientId?: string; passwordEnabled?: boolean } = {},
 ) {
   const discovery = {
     ...DEFAULT_DISCOVERY_OPTIONS,
@@ -233,6 +239,11 @@ function buildSocialServerDiscovery(
     },
     clients: discovery.clients,
     issuer,
+    oidcClientId: auth.oidcClientId,
+    auth: {
+      oidc: Boolean(auth.oidcClientId),
+      password: Boolean(auth.passwordEnabled),
+    },
     apiBaseUrl: appUrl,
     activitypubOrigin: appUrl,
     mediaOrigin: `${appUrl}/media`,
@@ -241,10 +252,14 @@ function buildSocialServerDiscovery(
     endpoints: {
       api: `${appUrl}/api`,
       authProviders: `${appUrl}/api/auth/providers`,
+      mobilePasswordLogin: `${appUrl}/api/auth/mobile/login`,
+      mobileOidcExchange: `${appUrl}/api/auth/mobile/oidc`,
       currentUser: `${appUrl}/api/auth/me`,
       timeline: `${appUrl}/api/timeline`,
       conversations: `${appUrl}/api/dm/contacts`,
       notifications: `${appUrl}/api/notifications`,
+      notificationPushers: `${appUrl}${NOTIFICATION_PUSHER_REGISTRATION_PATH}`,
+      // Retained for older mobile clients. New clients use notificationPushers.
       mobilePushRegistrations: `${appUrl}${MOBILE_PUSH_REGISTRATION_PATH}`,
     },
   };
@@ -324,9 +339,19 @@ function mountReadinessRoutes(
   ) => {
     const appUrl = normalizeOrigin(c.env.APP_URL, c.req.url);
     const issuer = getOidcIssuerUrl(c.env) ?? appUrl;
-    return c.json(buildSocialServerDiscovery(appUrl, issuer, discovery), 200, {
-      "Cache-Control": "public, max-age=300",
-    });
+    const { clientId } = getOidcClientCredentials(c.env);
+    return c.json(
+      buildSocialServerDiscovery(appUrl, issuer, discovery, {
+        oidcClientId: getOidcIssuerUrl(c.env)
+          ? clientId || undefined
+          : undefined,
+        passwordEnabled: Boolean(c.env.AUTH_PASSWORD_HASH?.trim()),
+      }),
+      200,
+      {
+        "Cache-Control": "public, max-age=300",
+      },
+    );
   };
 
   app.get("/.well-known/yurucommu", wellKnownSocialServer);
@@ -545,6 +570,44 @@ function applyGlobalMiddleware(app: YurucommuApp): void {
   app.use("*", async (c, next) => {
     c.set("db", c.env.DB_INSTANCE);
     await next();
+
+    // Every unread inbox insert is captured by the DB outbox trigger. Flush it
+    // after the request instead of wiring every follow/like/story/DM write path
+    // separately (which is both leak- and duplicate-prone). Queue binding is
+    // optional; when absent this is an immediate no-op and the durable rows stay
+    // pending until a correctly configured runtime handles later traffic.
+    const method = c.req.method.toUpperCase();
+    const now = Date.now();
+    const mutating = !["GET", "HEAD", "OPTIONS"].includes(method);
+    const recoveryDue = now - lastNotificationPushRecoverySweep >= 60_000;
+    if (mutating || recoveryDue) {
+      if (recoveryDue) lastNotificationPushRecoverySweep = now;
+      const sweep = (async () => {
+        try {
+          await enqueuePendingNotificationPushJobs(c.env);
+        } catch (error) {
+          log.error("Failed to enqueue notification push outbox", {
+            event: "notification.push.enqueue_failed",
+            error,
+          });
+        }
+      })();
+      // Prefer to run the sweep AFTER the response is sent (waitUntil) so its
+      // 2-4 D1 round-trips never add latency to the request. `executionCtx`
+      // throws when no runtime context exists (tests / plain fetch); fall back
+      // to awaiting inline there.
+      let deferred = false;
+      try {
+        const ctx = c.executionCtx;
+        if (ctx && typeof ctx.waitUntil === "function") {
+          ctx.waitUntil(sweep);
+          deferred = true;
+        }
+      } catch {
+        // No execution context; await inline below.
+      }
+      if (!deferred) await sweep;
+    }
   });
 
   app.use("/api/*", async (c, next) => {
@@ -690,6 +753,7 @@ function mountCoreRoutes(app: YurucommuApp): void {
   });
 
   app.route("/api/notifications", notificationsRoutes);
+  app.route("/api/notifications/pushers", notificationPusherRoutes);
   app.route("/api/mobile", mobileRoutes);
   app.route("/api/stories", storiesRoutes);
   app.route("/api/search", searchRoutes);

package/src/backend/lib/attachments.ts

@@ -0,0 +1,52 @@
+/**
+ * Shared attachment bounds + validation.
+ *
+ * Owner of the attachment payload limits used by every write surface (post
+ * create, DM messages, community chat) and by inbound-federation bounding.
+ * Route files must import from here instead of copy-pasting the checks or
+ * reaching into another route's transformers module.
+ */
+
+// Bound the attachments payload. An attachment is an open-ended record, so cap
+// both the COUNT and the serialized SIZE — the size cap bounds row/federated-doc
+// bloat regardless of internal shape (key count / field length). 16 KiB is ample
+// for MAX_ATTACHMENTS media descriptors with alt text + blurhash.
+export const MAX_ATTACHMENTS = 8;
+export const MAX_ATTACHMENTS_JSON_LENGTH = 16 * 1024;
+
+/** Drop an oversized inbound attachments blob to "[]" rather than store it. */
+export function boundAttachmentsJson(json: string): string {
+  return json.length > MAX_ATTACHMENTS_JSON_LENGTH ? "[]" : json;
+}
+
+export type ChatAttachment = Record<string, unknown>;
+
+export type ChatAttachmentsResult =
+  | { readonly ok: true; readonly attachments: ChatAttachment[] }
+  | { readonly ok: false; readonly error: string };
+
+/**
+ * Validate a chat message's attachments array (mirrors the post-create bounds:
+ * records only, capped count + serialized size). Returns the validated array
+ * ([] when absent) or an error message. Used by both the DM and community-chat
+ * send routes so the two cannot drift.
+ */
+export function validateChatAttachments(raw: unknown): ChatAttachmentsResult {
+  if (raw === undefined || raw === null) return { ok: true, attachments: [] };
+  if (!Array.isArray(raw)) {
+    return { ok: false, error: "attachments must be an array" };
+  }
+  if (raw.some((a) => !a || typeof a !== "object" || Array.isArray(a))) {
+    return { ok: false, error: "attachments must be objects" };
+  }
+  if (raw.length > MAX_ATTACHMENTS) {
+    return {
+      ok: false,
+      error: `Too many attachments (max ${MAX_ATTACHMENTS})`,
+    };
+  }
+  if (JSON.stringify(raw).length > MAX_ATTACHMENTS_JSON_LENGTH) {
+    return { ok: false, error: "attachments payload too large" };
+  }
+  return { ok: true, attachments: raw as ChatAttachment[] };
+}