@takosjp/yurucommu-core 3.0.3 → 3.2.1

package/src/backend/routes/notifications.ts

@@ -6,13 +6,10 @@ import {
   count,
   desc,
   eq,
-  exists,
   inArray,
   isNotNull,
   isNull,
   lt,
-  ne,
-  notExists,
   or,
   type SQL,
 } from "drizzle-orm";
@@ -34,7 +31,10 @@ import { batchLoadActorInfo } from "./communities/membership-shared.ts";
 import { requireActor } from "./actors-helpers.ts";
 import { communityReadableApIds } from "../lib/community-visibility.ts";
 import { chunkForInClause } from "../lib/chunk.ts";
-import { excludeBlockedMutedAuthors } from "../lib/feed-exclude.ts";
+import {
+  NOTIFICATION_ACTIVITY_TYPES,
+  notificationEligibilityWhere,
+} from "../lib/notification-eligibility.ts";
 
 const notifications = new Hono<{ Bindings: Env; Variables: Variables }>();
 
@@ -53,7 +53,6 @@ const ARCHIVE_CREATE_BATCH_SIZE = 30;
 // the rest drains on later runs.
 const ARCHIVE_CLEANUP_BATCH = 200;
 const ARCHIVE_ALL_CAP = 1000;
-const NOTIFICATION_ACTIVITY_TYPES = ["Follow", "Like", "Announce", "Create"];
 
 /**
  * Tracks the last cleanup timestamp per actor so cleanup is throttled to one
@@ -233,6 +232,47 @@ function encodeNotifCursor(row: { created_at: string; id: string }): string {
   return `${row.created_at}${NOTIF_CURSOR_SEP}${row.id}`;
 }
 
+function notificationTarget(
+  type: string | null,
+  activityActorApId: string,
+  objectApId: string | null,
+  objectType: string | null,
+): {
+  target_kind: "post" | "story" | "profile" | "notifications";
+  target_id: string | null;
+  // Same-origin in-app path shaped for the yurucommu web client's routing.
+  // Other clients (e.g. yurume's distinct IA) must treat target_kind/target_id
+  // as authoritative and build their own path, not follow target_url blindly.
+  target_url: string;
+} {
+  if (type === "follow" || type === "follow_request") {
+    return {
+      target_kind: "profile",
+      target_id: activityActorApId,
+      target_url: `/profile/${encodeURIComponent(activityActorApId)}`,
+    };
+  }
+  if (objectApId && objectType === "Story") {
+    return {
+      target_kind: "story",
+      target_id: objectApId,
+      target_url: `/?story=${encodeURIComponent(objectApId)}`,
+    };
+  }
+  if (objectApId) {
+    return {
+      target_kind: "post",
+      target_id: objectApId,
+      target_url: `/post/${encodeURIComponent(objectApId)}`,
+    };
+  }
+  return {
+    target_kind: "notifications",
+    target_id: null,
+    target_url: "/notifications",
+  };
+}
+
 // ---------------------------------------------------------------------------
 // Routes
 // ---------------------------------------------------------------------------
@@ -267,37 +307,22 @@ notifications.get("/", async (c) => {
       ? typeToActivityType[typeFilter]
       : NOTIFICATION_ACTIVITY_TYPES;
 
-  // Archive partition pushed INTO SQL as a correlated EXISTS / NOT EXISTS, not a
-  // post-query filter. Filtering archived rows out in the result loop made two
-  // bugs: (1) `has_more` under-reported — a page whose limit+1 probe rows were
-  // mostly the wrong archive state returned < limit items yet there were older
-  // pages, so the client stopped loading; (2) every archived id for the actor
-  // was loaded into an unbounded in-memory Set per request. As an SQL predicate
-  // the limit+1 probe counts only rows that actually belong on the page.
-  const archivedCorrelation = and(
-    eq(notificationArchived.actorApId, inboxTable.actorApId),
-    eq(notificationArchived.activityApId, inboxTable.activityApId),
-  );
-  const archivedSubquery = db
-    .select({ activityApId: notificationArchived.activityApId })
-    .from(notificationArchived)
-    .where(archivedCorrelation);
-  const archiveCondition = showArchived
-    ? exists(archivedSubquery)
-    : notExists(archivedSubquery);
-
-  // Build inbox query with JOIN to activities. A direct (DM) Note is delivered
-  // as a `Create` inbox row just like a mention, so without excluding it every
-  // DM would double-surface here as a "mention" (with its body) AND inflate the
-  // unread badge independently of the DM view. LEFT JOIN the object and drop
-  // direct-visibility Creates; the join is LEFT because Follow's object is an
-  // actor (no `objects` row) → NULL visibility must be kept.
+  // Build inbox query with JOIN to activities. Shared eligibility predicate
+  // (lib/notification-eligibility.ts) — the SAME builder used by the unread
+  // badge and push delivery — supplies: not-self, user-facing types, the
+  // archive partition (pushed into SQL as a correlated EXISTS/NOT EXISTS so the
+  // limit+1 probe counts only rows that belong on the page, not a post-query
+  // filter), the direct-DM exclusion (a DM's `Create` inbox row must not
+  // double-surface here as a mention), and block/mute suppression. Direct
+  // Creates are dropped via LEFT JOIN + NULL-visibility keep (Follow's object
+  // is an actor, no `objects` row).
   const conditions = [
     eq(inboxTable.actorApId, actor.ap_id),
-    ne(activities.actorApId, actor.ap_id),
-    inArray(activities.type, activityTypes),
-    or(isNull(objects.visibility), ne(objects.visibility, "direct"))!,
-    archiveCondition,
+    ...notificationEligibilityWhere(db, actor.ap_id, {
+      direct: "exclude",
+      archived: showArchived ? "only" : "exclude",
+      activityTypes,
+    }),
   ];
   // reply vs mention both map to a Create; the split is whether the Create's
   // object is a reply (`inReplyTo` set). Pushed into SQL too so a type-filtered
@@ -310,17 +335,6 @@ notifications.get("/", async (c) => {
   if (before) {
     conditions.push(notifCursorPredicate(decodeNotifCursor(before)));
   }
-  // Suppress notifications whose actor the recipient has blocked or muted. This
-  // is the read-time choke point: mutes are read-only everywhere, and not every
-  // notify WRITE path block-checks, so gating here covers like/repost/follow/
-  // reply/mention (local AND federated) for both blocks and mutes. Keyed on the
-  // activity actor (subquery-scoped → D1-param-safe).
-  const listBlockMute = excludeBlockedMutedAuthors(
-    db,
-    actor.ap_id,
-    activities.actorApId,
-  );
-  if (listBlockMute) conditions.push(listBlockMute);
 
   const inboxEntries = await db
     .select({
@@ -358,6 +372,7 @@ notifications.get("/", async (c) => {
       ? db
           .select({
             apId: objects.apId,
+            type: objects.type,
             content: objects.content,
             inReplyTo: objects.inReplyTo,
             audienceJson: objects.audienceJson,
@@ -438,6 +453,7 @@ notifications.get("/", async (c) => {
     objectRows.map((o) => [
       o.apId,
       {
+        type: o.type,
         content: readableObjectIds.has(o.apId) ? o.content : "",
         inReplyTo: o.inReplyTo,
       },
@@ -464,6 +480,9 @@ notifications.get("/", async (c) => {
       icon_url: string | null;
     };
     object_content: string;
+    target_kind: "post" | "story" | "profile" | "notifications";
+    target_id: string | null;
+    target_url: string;
   }> = [];
 
   for (const entry of inboxEntries) {
@@ -484,6 +503,12 @@ notifications.get("/", async (c) => {
       followStatus,
     );
     const actorInfo = actorMap.get(entry.activityActorApId);
+    const target = notificationTarget(
+      notifType,
+      entry.activityActorApId,
+      entry.activityObjectApId,
+      objectData?.type ?? null,
+    );
 
     notifications_list.push({
       id: entry.activityApId,
@@ -499,6 +524,7 @@ notifications.get("/", async (c) => {
         icon_url: actorInfo?.iconUrl ?? null,
       },
       object_content: objectData?.content ?? "",
+      ...target,
     });
   }
 
@@ -528,23 +554,10 @@ notifications.get("/unread/count", async (c) => {
   const db = c.get("db");
   await maybeCleanupArchivedNotifications(db, actor.ap_id);
 
-  // Mirror the list query's DM exclusion (see GET /): a direct Note's Create
-  // inbox row must not count toward the notification badge — the DM has its own
-  // unread badge, and marking it read never clears this inbox row.
-  // Mirror the default list view's archive exclusion: an archived notification
-  // is hidden from the inbox list, so it must NOT count toward the badge either —
-  // otherwise archiving an UNREAD notification (read stays 0) leaves a phantom
-  // count the client can never clear (its mark-read sweep only touches rows the
-  // inbox view returns, which no longer include the archived one).
-  const archivedSubquery = db
-    .select({ activityApId: notificationArchived.activityApId })
-    .from(notificationArchived)
-    .where(
-      and(
-        eq(notificationArchived.actorApId, inboxTable.actorApId),
-        eq(notificationArchived.activityApId, inboxTable.activityApId),
-      ),
-    );
+  // SAME shared eligibility builder as the list and push delivery: not-self,
+  // user-facing types, archive exclusion (an archived UNREAD notification must
+  // not leave a phantom count the client can never clear), the direct-DM
+  // exclusion (a DM has its own badge), and block/mute suppression.
   const result = await db
     .select({ count: count() })
     .from(inboxTable)
@@ -554,13 +567,7 @@ notifications.get("/unread/count", async (c) => {
       and(
         eq(inboxTable.actorApId, actor.ap_id),
         eq(inboxTable.read, 0),
-        ne(activities.actorApId, actor.ap_id),
-        inArray(activities.type, NOTIFICATION_ACTIVITY_TYPES),
-        or(isNull(objects.visibility), ne(objects.visibility, "direct"))!,
-        notExists(archivedSubquery),
-        // Mirror the list query: don't count notifications from blocked/muted
-        // actors toward the unread badge.
-        excludeBlockedMutedAuthors(db, actor.ap_id, activities.actorApId),
+        ...notificationEligibilityWhere(db, actor.ap_id, { direct: "exclude" }),
       ),
     )
     .get();

package/src/backend/routes/posts/transformers.ts

@@ -2,12 +2,14 @@ import { formatUsername, safeJsonParse } from "../../federation-helpers.ts";
 
 export const MAX_POST_CONTENT_LENGTH = 5000;
 export const MAX_POST_SUMMARY_LENGTH = 500;
-// Bound the attachments payload. PostAttachment is an open-ended record, so cap
-// both the COUNT and the serialized SIZE — the size cap bounds row/federated-doc
-// bloat regardless of internal shape (key count / field length). 16 KiB is ample
-// for MAX_ATTACHMENTS media descriptors with alt text + blurhash.
-export const MAX_ATTACHMENTS = 8;
-export const MAX_ATTACHMENTS_JSON_LENGTH = 16 * 1024;
+// Attachment bounds live in lib/attachments.ts (shared with the DM and
+// community-chat validators); re-exported here for the existing post-route and
+// inbound-handler importers.
+export {
+  boundAttachmentsJson,
+  MAX_ATTACHMENTS,
+  MAX_ATTACHMENTS_JSON_LENGTH,
+} from "../../lib/attachments.ts";
 
 /** Truncate a string to `max` characters (no-op when already within bounds). */
 export function truncate(s: string, max: number): string {
@@ -28,10 +30,6 @@ export function boundInboundSummary(summary: unknown): string | null {
     ? truncate(summary, MAX_POST_SUMMARY_LENGTH)
     : null;
 }
-/** Drop an oversized inbound attachments blob to "[]" rather than store it. */
-export function boundAttachmentsJson(json: string): string {
-  return json.length > MAX_ATTACHMENTS_JSON_LENGTH ? "[]" : json;
-}
 // Capped at 90 (not 100): a page's object ids are re-queried via
 // `inArray(col, objectApIds)` for like/bookmark enrichment, and Cloudflare D1
 // allows at most 100 bound parameters per query. 90 leaves headroom for the

package/src/backend/server.ts

@@ -96,6 +96,12 @@ const ENV_PASSTHROUGH_KEYS = [
   "DELIVERY_DLQ_NAME",
   "YURUCOMMU_ENABLE_LOCAL_SUBSTRATE_REMOTE_FETCHES",
   "YURUCOMMU_ENABLE_LOCAL_DELIVERY_QUEUE",
+  "YURUCOMMU_NOTIFICATION_PUSH_GATEWAY_ALLOWED_HOSTS",
+  "YURUCOMMU_NOTIFICATION_PUSH_GATEWAY_URL",
+  "YURUCOMMU_NOTIFICATION_PUSH_GATEWAY_TOKEN",
+  "YURUCOMMU_NOTIFICATION_PUSH_GATEWAY_TIMEOUT_MS",
+  "YURUCOMMU_NOTIFICATION_PUSH_ALLOW_INSECURE_LOOPBACK",
+  "YURUCOMMU_NOTIFICATION_PUSH_WEB_PUSH_PUBLIC_KEY",
 ] as const;
 
 function isTruthyEnv(value: string | undefined): boolean {

package/src/backend/types.ts

@@ -67,6 +67,18 @@ export interface EnvVars {
   // app falls back to the YURUCOMMU_VERSION default constant.
   YURUCOMMU_SOFTWARE_VERSION?: string;
 
+  // Product-neutral notification pusher gateway. Public gateway registration
+  // is fail-closed until its hostname is explicitly allowlisted. The bearer is
+  // attached only when data.url exactly matches the canonical URL.
+  YURUCOMMU_NOTIFICATION_PUSH_GATEWAY_ALLOWED_HOSTS?: string;
+  YURUCOMMU_NOTIFICATION_PUSH_GATEWAY_URL?: string;
+  YURUCOMMU_NOTIFICATION_PUSH_GATEWAY_TOKEN?: string;
+  YURUCOMMU_NOTIFICATION_PUSH_GATEWAY_TIMEOUT_MS?: string;
+  YURUCOMMU_NOTIFICATION_PUSH_ALLOW_INSECURE_LOOPBACK?: string;
+  // Public VAPID application-server key exposed to authenticated browser
+  // clients. The corresponding private key remains gateway-owned.
+  YURUCOMMU_NOTIFICATION_PUSH_WEB_PUSH_PUBLIC_KEY?: string;
+
   // CSRF allowed origins (comma-separated). APP_URL の origin に加えて
   // 受け付ける追加 origin (= dev hostname (`https://yurucommu.test`) を
   // production-equivalent な strict CSRF check 経由で踏むため)。 未設定なら

package/src/db/index.ts

@@ -47,16 +47,17 @@ export async function getDbSQLite(databasePath: string): Promise<Database> {
   const { drizzle } = await import("drizzle-orm/libsql");
 
   const client = createClient({ url: `file:${databasePath}` });
-  // Foreign keys are explicitly turned OFF so the libsql engine matches
-  // Cloudflare D1, which ignores the FK constraints declared in the
-  // migrations. NOTE: libsql (unlike bun:sqlite / stock SQLite, which default
-  // OFF) defaults foreign_keys ON, so this must be set explicitly — simply
-  // not enabling it is not enough. Remote actors are stored in actor_cache
-  // (never in actors), yet objects.attributed_to / follows.* / likes.* /
-  // announces.* FK-reference actors(ap_id); enforcement would make every
-  // inbound federated activity from a remote actor violate the FK and fail to
-  // insert. Referential cleanup is handled at the app level by
-  // delete-cascade.ts, identically on D1.
+  // Foreign keys are explicitly turned OFF so the libsql engine matches the
+  // MIGRATED production schema. Cloudflare D1 ENFORCES declared FKs (the old
+  // "D1 ignores FK" assumption was wrong — see migrations/0011, which exists
+  // precisely because enforcement broke inbound federation): remote actors
+  // live only in actor_cache, never in actors, so 0010/0011 REBUILT the
+  // affected tables to drop their actors FKs. Post-0011 the schema declares
+  // essentially no FKs and referential cleanup is handled at the app level by
+  // delete-cascade.ts / account-teardown.ts, identically on D1. NOTE: libsql
+  // (unlike bun:sqlite / stock SQLite, which default OFF) defaults
+  // foreign_keys ON, so this must be set explicitly — pre-0010 FKs still
+  // present in older local DB files must not diverge from D1 behavior.
   await client.execute("PRAGMA foreign_keys = OFF");
   sqliteDb = drizzle(client, { schema });
   return sqliteDb;

package/src/db/schema/mobile.ts

@@ -2,7 +2,13 @@
  * Mobile client tables.
  */
 
-import { index, sqliteTable, text, uniqueIndex } from "drizzle-orm/sqlite-core";
+import {
+  index,
+  integer,
+  sqliteTable,
+  text,
+  uniqueIndex,
+} from "drizzle-orm/sqlite-core";
 import { nowIsoUtc } from "./date-utils.ts";
 import { actors } from "./actors.ts";
 
@@ -35,3 +41,95 @@ export const mobilePushRegistrations = sqliteTable(
     index("mobile_push_registrations_last_seen_idx").on(t.lastSeenAt),
   ],
 );
+
+/**
+ * Product-neutral notification pushers shared by yurucommu-family clients.
+ *
+ * `pushkey` is an opaque downstream-provider identifier. Provider credentials
+ * never live in this table; they stay in the configured stateless gateway.
+ *
+ * NO foreign key on actor_ap_id: D1 ENFORCES declared FKs (0010/0011 dropped
+ * the actors FKs for that reason) and cleanup is app-level
+ * (routes/account-teardown.ts), matching the rest of the schema.
+ */
+export const notificationPushers = sqliteTable(
+  "notification_pushers",
+  {
+    id: text("id").primaryKey(),
+    actorApId: text("actor_ap_id").notNull(),
+    product: text("product").notNull(),
+    scope: text("scope"),
+    kind: text("kind").notNull().default("http"),
+    appId: text("app_id").notNull(),
+    pushkey: text("pushkey").notNull(),
+    pushkeyHash: text("pushkey_hash").notNull(),
+    appDisplayName: text("app_display_name"),
+    deviceDisplayName: text("device_display_name"),
+    profileTag: text("profile_tag"),
+    lang: text("lang"),
+    dataJson: text("data_json").notNull().default("{}"),
+    gatewayUrl: text("gateway_url").notNull(),
+    createdAt: text("created_at").notNull().$defaultFn(nowIsoUtc),
+    updatedAt: text("updated_at")
+      .notNull()
+      .$defaultFn(nowIsoUtc)
+      .$onUpdateFn(nowIsoUtc),
+    lastSeenAt: text("last_seen_at").notNull().$defaultFn(nowIsoUtc),
+  },
+  (t) => [
+    index("notification_pushers_actor_product_idx").on(t.actorApId, t.product),
+    // Device uniqueness — strictly stronger than any actor-scoped unique
+    // variant, so this is the ONLY unique index.
+    uniqueIndex("notification_pushers_device_idx").on(
+      t.product,
+      t.appId,
+      t.pushkeyHash,
+    ),
+    index("notification_pushers_last_seen_idx").on(t.lastSeenAt),
+  ],
+);
+
+/**
+ * Durable outbox for push delivery. A migration-owned trigger writes one row
+ * whenever an unread inbox entry is created. Queue messages contain only `id`.
+ */
+export const notificationPushJobs = sqliteTable(
+  "notification_push_jobs",
+  {
+    id: text("id").primaryKey(),
+    actorApId: text("actor_ap_id").notNull(),
+    activityApId: text("activity_ap_id").notNull(),
+    // Explicit for notification sources that do not create an inbox row (for
+    // example community talk). NULL means infer social/direct from the object.
+    product: text("product"),
+    status: text("status").notNull().default("pending"),
+    // Per-claim fencing token. Every processing-state mutation must match this
+    // value so an expired worker cannot overwrite a reclaimed job.
+    processingToken: text("processing_token"),
+    attempts: integer("attempts").notNull().default(0),
+    pendingPusherIdsJson: text("pending_pusher_ids_json"),
+    nextAttemptAt: text("next_attempt_at").notNull().$defaultFn(nowIsoUtc),
+    lastError: text("last_error"),
+    createdAt: text("created_at").notNull().$defaultFn(nowIsoUtc),
+    updatedAt: text("updated_at")
+      .notNull()
+      .$defaultFn(nowIsoUtc)
+      .$onUpdateFn(nowIsoUtc),
+    deliveredAt: text("delivered_at"),
+  },
+  (t) => [
+    uniqueIndex("notification_push_jobs_actor_activity_idx").on(
+      t.actorApId,
+      t.activityApId,
+    ),
+    index("notification_push_jobs_status_next_idx").on(
+      t.status,
+      t.nextAttemptAt,
+    ),
+    index("notification_push_jobs_terminal_retention_idx").on(
+      t.status,
+      t.updatedAt,
+    ),
+    index("notification_push_jobs_actor_idx").on(t.actorApId),
+  ],
+);