@takosjp/yurucommu-core 3.0.3 → 3.2.1

package/src/backend/lib/delivery/queue.ts

@@ -21,6 +21,11 @@ import { computeDeliveryJobId, safeEndpointHost } from "./transformers.ts";
 import { emitMetric } from "./metrics.ts";
 import { logger } from "../logger.ts";
 import { filterBlockedActorApIds, isActorBlocked } from "../blocklist.ts";
+import {
+  enqueuePendingNotificationPushJobs,
+  processNotificationPushJob,
+  recoverDeadLetteredNotificationPushJob,
+} from "../notification-push.ts";
 
 const log = logger.child({ component: "delivery.queue" });
 
@@ -471,6 +476,9 @@ export async function handleDeliveryQueueBatch(
         case "reconcile_job":
           await processReconcileJob(db, env, body, message);
           break;
+        case "notification_push":
+          await processNotificationPushJob(env, body, message);
+          break;
         default:
           assertNever(body);
       }
@@ -512,6 +520,17 @@ export async function handleDeliveryQueueBatch(
       }
     },
   );
+
+  // Community fanout can create local inbox rows inside this consumer rather
+  // than an HTTP request. Flush the same DB-triggered outbox choke point here.
+  try {
+    await enqueuePendingNotificationPushJobs(env);
+  } catch (error) {
+    log.error("Failed to enqueue notification push outbox", {
+      event: "notification.push.enqueue_failed",
+      error,
+    });
+  }
 }
 
 export async function handleDeliveryDlqBatch(
@@ -521,10 +540,21 @@ export async function handleDeliveryDlqBatch(
   for (const message of batch.messages) {
     const body = message.body;
     if (!isDeliveryDlqMessageV1(body)) {
+      // Not an app-built `dlq` message. Cloudflare Queues also delivers here
+      // the RAW original body of any MAIN-queue message that exhausted its
+      // retries (automatic dead-lettering). Those must NOT be silently acked as
+      // "invalid": a lost fanout/resolve drops local notifications or delivery
+      // planning, and a lost notification_push strands its durable outbox row.
+      if (isDeliveryQueueMessageV1(body)) {
+        await handleAutoDeadLetteredMessage(env, body);
+        message.ack();
+        continue;
+      }
       log.warn("Invalid DLQ message format, skipping", {
         event: "delivery.dlq.invalid_message",
         bodyPreview: JSON.stringify(body).slice(0, 200),
       });
+      emitMetric("delivery.dlq.invalid_message", 1, {});
       message.ack();
       continue;
     }
@@ -574,3 +604,46 @@ export async function handleDeliveryDlqBatch(
     message.ack();
   }
 }
+
+/**
+ * Recover / account for a MAIN-queue message that Cloudflare auto-dead-lettered
+ * (retries exhausted with the raw body). `notification_push` rows are durable,
+ * so reset the job to retry through the outbox instead of stranding it;
+ * everything else is logged with an alerting metric rather than swallowed.
+ */
+async function handleAutoDeadLetteredMessage(
+  env: Env,
+  body: DeliveryQueueMessageV1,
+): Promise<void> {
+  if (body.type === "notification_push") {
+    try {
+      const recovered = await recoverDeadLetteredNotificationPushJob(
+        env.DB_INSTANCE,
+        body.jobId,
+      );
+      log.error("notification_push dead-lettered; reset durable outbox row", {
+        event: "delivery.dlq.notification_push_recovered",
+        jobId: body.jobId,
+        recovered,
+      });
+      emitMetric("delivery.dlq.notification_push_recovered", 1, {});
+    } catch (error) {
+      log.error("Failed to recover dead-lettered notification_push", {
+        event: "delivery.dlq.notification_push_recover_failed",
+        jobId: body.jobId,
+        error,
+      });
+      emitMetric("delivery.dlq.notification_push_recover_failed", 1, {});
+    }
+    return;
+  }
+
+  // fanout_*/resolve_actor/deliver_endpoint/reconcile_job: no durable ledger to
+  // rewind here, but make the loss explicit (alertable) rather than a silent
+  // "invalid message" ack.
+  log.error("Delivery message auto-dead-lettered; dropping", {
+    event: "delivery.dlq.auto_dead_lettered",
+    messageType: body.type,
+  });
+  emitMetric("delivery.dlq.auto_dead_lettered", 1, { message_type: body.type });
+}

package/src/backend/lib/delivery/types.ts

@@ -60,12 +60,24 @@ export type DeliveryReconcileJobMessageV1 = {
   scheduledAt: string; // ISO8601 UTC
 };
 
+/**
+ * Product notification delivery. The queue carries only the durable outbox id;
+ * device pushkeys, gateway URLs, and notification content remain in the DB.
+ */
+export type DeliveryNotificationPushMessageV1 = {
+  version: typeof DELIVERY_QUEUE_MESSAGE_VERSION;
+  type: "notification_push";
+  jobId: string;
+  scheduledAt: string; // ISO8601 UTC
+};
+
 export type DeliveryQueueMessageV1 =
   | DeliveryFanoutFollowersMessageV1
   | DeliveryFanoutCommunityMessageV1
   | DeliveryResolveActorMessageV1
   | DeliveryDeliverEndpointMessageV1
-  | DeliveryReconcileJobMessageV1;
+  | DeliveryReconcileJobMessageV1
+  | DeliveryNotificationPushMessageV1;
 
 export type DeliveryDlqMessageV1 = {
   version: typeof DELIVERY_QUEUE_MESSAGE_VERSION;
@@ -116,6 +128,8 @@ export function isDeliveryQueueMessageV1(
         typeof v.reconcileAttempt === "number" &&
         typeof v.scheduledAt === "string"
       );
+    case "notification_push":
+      return typeof v.jobId === "string" && typeof v.scheduledAt === "string";
     default:
       return false;
   }

package/src/backend/lib/notification-eligibility.ts

@@ -0,0 +1,150 @@
+/**
+ * Shared social-notification eligibility predicates.
+ *
+ * SINGLE owner of the WHERE fragments that decide whether an inbox row is a
+ * user-facing notification. Consumed by ALL of:
+ *   - GET /api/notifications (list),
+ *   - GET /api/notifications/unread/count (badge),
+ *   - the push outbox processor (delivery-time re-check + push unread badge)
+ * so a change to eligibility (a new activity type, a new suppression rule)
+ * cannot silently drift between the list, the badge, and push delivery — the
+ * dispersion that past audits repeatedly flagged for visibility logic.
+ */
+
+import {
+  and,
+  eq,
+  exists,
+  inArray,
+  isNull,
+  ne,
+  notExists,
+  or,
+  type SQL,
+} from "drizzle-orm";
+
+import {
+  activities,
+  dmArchivedConversations,
+  inbox,
+  notificationArchived,
+  objects,
+  type Database,
+} from "../../db/index.ts";
+import { excludeBlockedMutedAuthors } from "./feed-exclude.ts";
+
+/**
+ * The activity types that surface as notifications. Any addition must hold for
+ * the list, the unread badge, AND push delivery — they all read this constant.
+ */
+export const NOTIFICATION_ACTIVITY_TYPES = [
+  "Follow",
+  "Like",
+  "Announce",
+  "Create",
+] as const;
+
+export interface NotificationEligibilityOptions {
+  /**
+   * How direct-visibility (DM) Creates are treated:
+   * - "exclude" (list/badge): a DM surfaces in the DM view, never as a
+   *   notification row, so drop it entirely.
+   * - "unless-dm-archived" (push): a direct Create IS push-eligible (routed to
+   *   Yurume), unless the recipient archived the conversation — archiving is a
+   *   delivery preference, not merely a presentation filter.
+   */
+  readonly direct: "exclude" | "unless-dm-archived";
+  /**
+   * Archive partition. "exclude" (default: badge/push and the default list
+   * view) hides archived rows; "only" (the list's archived view) shows ONLY
+   * archived rows.
+   */
+  readonly archived?: "exclude" | "only";
+  /**
+   * Restrict to a subset of NOTIFICATION_ACTIVITY_TYPES (the list's type
+   * filter). Defaults to the full set; callers must not widen it.
+   */
+  readonly activityTypes?: readonly string[];
+}
+
+/**
+ * Eligibility conditions for a query shaped as
+ * `inbox JOIN activities LEFT JOIN objects` scoped to `actorApId`'s inbox.
+ * Returns the shared conditions only; callers add their own paging/read/type
+ * filters on top.
+ */
+export function notificationEligibilityWhere(
+  db: Database,
+  actorApId: string,
+  options: NotificationEligibilityOptions,
+): SQL[] {
+  // Never notify an actor about their own activity.
+  const notSelf = ne(activities.actorApId, actorApId);
+
+  // Only user-facing activity types.
+  const userFacingType = inArray(activities.type, [
+    ...(options.activityTypes ?? NOTIFICATION_ACTIVITY_TYPES),
+  ]);
+
+  // Archive partition. Archived notifications are hidden from the default
+  // list, excluded from the badge, and must not push; the list's archived view
+  // inverts the predicate.
+  const archivedSubquery = db
+    .select({ activityApId: notificationArchived.activityApId })
+    .from(notificationArchived)
+    .where(
+      and(
+        eq(notificationArchived.actorApId, inbox.actorApId),
+        eq(notificationArchived.activityApId, inbox.activityApId),
+      ),
+    );
+  const notArchived =
+    options.archived === "only"
+      ? exists(archivedSubquery)
+      : notExists(archivedSubquery);
+
+  // Direct (DM) handling. The object join is LEFT (Follow's object is an
+  // actor, not an objects row), so NULL visibility must be kept.
+  let directCondition: SQL;
+  if (options.direct === "exclude") {
+    directCondition = or(
+      isNull(objects.visibility),
+      ne(objects.visibility, "direct"),
+    )!;
+  } else {
+    const archivedDmSubquery = db
+      .select({ conversationId: dmArchivedConversations.conversationId })
+      .from(dmArchivedConversations)
+      .where(
+        and(
+          eq(dmArchivedConversations.actorApId, actorApId),
+          eq(dmArchivedConversations.conversationId, objects.conversation),
+        ),
+      );
+    directCondition = or(
+      isNull(objects.visibility),
+      ne(objects.visibility, "direct"),
+      notExists(archivedDmSubquery),
+    )!;
+  }
+
+  const conditions: SQL[] = [
+    notSelf,
+    userFacingType,
+    notArchived,
+    directCondition,
+  ];
+
+  // Suppress notifications whose actor the recipient has blocked or muted.
+  // This is the read-time choke point: mutes are read-only everywhere, and not
+  // every notify WRITE path block-checks, so gating here covers like/repost/
+  // follow/reply/mention (local AND federated) for both blocks and mutes.
+  const blockMute = excludeBlockedMutedAuthors(
+    db,
+    actorApId,
+    activities.actorApId,
+  );
+  if (blockMute) conditions.push(blockMute);
+
+  return conditions;
+}