@takosjp/yurucommu-core 3.2.0 → 3.3.0

package/migrations/0019_notification_push_delivery.sql

@@ -1,3 +1,9 @@
+-- NO foreign keys on these tables. Cloudflare D1 ENFORCES declared FKs (see
+-- 0010/0011, which dropped the actors FKs for exactly that reason), local
+-- libsql runs with enforcement OFF, and the trigger below fires on EVERY
+-- unread inbox insert — an actors FK here would let a single missing actors
+-- row abort unrelated inbox writes in production only. Referential cleanup is
+-- app-level, like everywhere else (routes/account-teardown.ts).
 CREATE TABLE IF NOT EXISTS notification_pushers (
   id TEXT PRIMARY KEY,
   actor_ap_id TEXT NOT NULL,
@@ -15,13 +21,11 @@ CREATE TABLE IF NOT EXISTS notification_pushers (
   gateway_url TEXT NOT NULL,
   created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
   updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-  last_seen_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-  FOREIGN KEY (actor_ap_id) REFERENCES actors(ap_id) ON DELETE CASCADE
+  last_seen_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
 );
 
-CREATE UNIQUE INDEX IF NOT EXISTS notification_pushers_actor_product_app_pushkey_idx
-  ON notification_pushers(actor_ap_id, product, app_id, pushkey_hash);
-
+-- Device uniqueness is (product, app_id, pushkey_hash) — strictly stronger
+-- than any actor-scoped variant, so no second unique index is declared.
 CREATE INDEX IF NOT EXISTS notification_pushers_actor_product_idx
   ON notification_pushers(actor_ap_id, product);
 
@@ -44,8 +48,7 @@ CREATE TABLE IF NOT EXISTS notification_push_jobs (
   last_error TEXT,
   created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
   updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-  delivered_at TEXT,
-  FOREIGN KEY (actor_ap_id) REFERENCES actors(ap_id) ON DELETE CASCADE
+  delivered_at TEXT
 );
 
 CREATE UNIQUE INDEX IF NOT EXISTS notification_push_jobs_actor_activity_idx

package/migrations/0020_call_sessions.sql

@@ -0,0 +1,23 @@
+CREATE TABLE IF NOT EXISTS call_sessions (
+  id TEXT PRIMARY KEY,
+  local_actor_ap_id TEXT NOT NULL,
+  peer_actor_ap_id TEXT NOT NULL,
+  direction TEXT NOT NULL,
+  state TEXT NOT NULL DEFAULT 'ringing',
+  media_audio INTEGER NOT NULL DEFAULT 1,
+  media_video INTEGER NOT NULL DEFAULT 0,
+  sfu_focus TEXT,
+  peer_signal_endpoint TEXT,
+  end_reason TEXT,
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  connected_at TEXT,
+  ended_at TEXT,
+  FOREIGN KEY (local_actor_ap_id) REFERENCES actors(ap_id) ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS call_sessions_local_created_idx
+  ON call_sessions(local_actor_ap_id, created_at);
+
+CREATE INDEX IF NOT EXISTS call_sessions_state_idx
+  ON call_sessions(state);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@takosjp/yurucommu-core",
-  "version": "3.2.0",
+  "version": "3.3.0",
   "license": "AGPL-3.0-only",
   "type": "module",
   "workspaces": [
@@ -19,6 +19,7 @@
     "packages/api/src/types",
     "packages/api/src/lib/api.ts",
     "packages/api/src/lib/transport.ts",
+    "packages/api/src/lib/rtc-client.ts",
     "packages/api/src/lib/fetch-with-timeout.ts",
     "packages/api/src/lib/api/account.ts",
     "packages/api/src/lib/api/actors.ts",
@@ -32,8 +33,10 @@
     "packages/api/src/lib/api/moderation.ts",
     "packages/api/src/lib/api/notes.ts",
     "packages/api/src/lib/api/normalize.ts",
+    "packages/api/src/lib/api/notification-target.ts",
     "packages/api/src/lib/api/notifications.ts",
     "packages/api/src/lib/api/posts.ts",
+    "packages/api/src/lib/api/push-config.ts",
     "packages/api/src/lib/api/recommendations.ts",
     "packages/api/src/lib/api/search.ts",
     "packages/api/src/lib/api/stories.ts",
@@ -56,7 +59,8 @@
     "start": "bun src/backend/server.ts",
     "dev": "bun src/backend/server.ts",
     "dev:server": "bun src/backend/server.ts",
-    "check": "tsc --noEmit",
+    "check": "tsc --noEmit && bun run check:no-opentofu-artifacts",
+    "check:no-opentofu-artifacts": "bun scripts/check-no-opentofu-artifacts.mjs",
     "test": "bun run build:api && bun test test/ src/backend/ packages/api/src/ scripts/check-publish-version-discipline.test.ts scripts/publish-package-resumable.test.ts && bun run check:release-contents",
     "test:backend": "bun test src/backend/",
     "build": "bun run build:api",

package/packages/api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@takosjp/yurucommu-api",
-  "version": "3.2.0",
+  "version": "3.3.0",
   "description": "Typed client SDK and public API contract for yurucommu-server clients.",
   "license": "AGPL-3.0-only",
   "type": "module",

package/packages/api/src/index.ts

@@ -1,4 +1,5 @@
 export * from "./lib/api.ts";
 export * from "./lib/transport.ts";
+export * from "./lib/rtc-client.ts";
 export * from "./social-server.ts";
 export * from "./types/index.ts";

package/packages/api/src/lib/api/browser-push.ts

@@ -294,6 +294,17 @@ function normalizeServerOrigin(value: string): string | null {
   }
 }
 
+/**
+ * Client-side gateway URL policy. MUST stay behaviorally equivalent to the
+ * server's `normalizeGatewayUrl` in the notification pusher contract — a
+ * client-accepted / server-rejected URL yields a confusing "registers but
+ * 400s" failure. The equivalence is pinned by a shared-fixture drift test.
+ * Exported for that test; app code calls the higher-level helpers above.
+ */
+export function normalizeBrowserPushGatewayUrl(value: string): string | null {
+  return normalizeGatewayUrl(value);
+}
+
 function normalizeGatewayUrl(value: string): string | null {
   try {
     const url = new URL(value.trim());

package/packages/api/src/lib/api/normalize.ts

@@ -6,6 +6,7 @@ import {
   Post,
   Story,
 } from "../../types/index.ts";
+import { resolveNotificationTarget } from "./notification-target.ts";
 
 type ActorLike = {
   ap_id: string;
@@ -71,7 +72,17 @@ export const normalizeActorNote = (note: ActorNote): ActorNote => ({
 
 export const normalizeNotification = (
   notification: Notification,
-): Notification => ({
-  ...notification,
-  actor: normalizeActor(notification.actor),
-});
+): Notification => {
+  // Fill the navigation target so consumers get a stable, safe same-origin
+  // path even from a pre-3.2.0 server that omitted target_* (or sent an unsafe
+  // target_url). resolveNotificationTarget re-validates a declared target and
+  // otherwise synthesizes it from type + object_ap_id.
+  const target = resolveNotificationTarget(notification);
+  return {
+    ...notification,
+    actor: normalizeActor(notification.actor),
+    target_kind: target.target_kind,
+    target_id: target.target_id,
+    target_url: target.target_url,
+  };
+};

package/packages/api/src/lib/api/notification-target.ts

@@ -0,0 +1,106 @@
+import type {
+  Notification,
+  NotificationTargetKind,
+} from "../../types/index.ts";
+
+export interface NotificationTarget {
+  readonly target_kind: NotificationTargetKind;
+  readonly target_id: string | null;
+  /**
+   * Same-origin in-app path shaped for the yurucommu web client's routing.
+   * Other clients should prefer `target_kind` + `target_id` and build their own
+   * path. Never treat this as an external URL.
+   */
+  readonly target_url: string;
+}
+
+/** True if the string contains any C0 control character (0x00-0x1f). */
+function hasControlChar(value: string): boolean {
+  for (let index = 0; index < value.length; index += 1) {
+    if (value.charCodeAt(index) < 0x20) return true;
+  }
+  return false;
+}
+
+/**
+ * Guard an in-app navigation path against open-redirect / protocol-relative /
+ * control-character abuse. Returns the value only if it is a plain same-origin
+ * absolute path (`/...`, not `//...`), else null. Promoted from the yurucommu
+ * and yurume web clients, which each carried an identical copy.
+ */
+export function safeNotificationPath(
+  value: string | null | undefined,
+): string | null {
+  if (
+    !value ||
+    !value.startsWith("/") ||
+    value.startsWith("//") ||
+    value.includes("\\") ||
+    hasControlChar(value)
+  ) {
+    return null;
+  }
+  return value;
+}
+
+function isStoryNotification(notification: Notification): boolean {
+  return (
+    notification.target_kind === "story" ||
+    !!notification.object_ap_id?.includes("/ap/stories/")
+  );
+}
+
+/**
+ * Resolve the navigation target for a notification. Prefers the server-provided
+ * `target_*` fields (3.2.0+) after re-validating `target_url`; when a server
+ * older than 3.2.0 omitted them, synthesizes the same mapping the server uses
+ * from `type` + `object_ap_id`. Always returns a safe same-origin path.
+ */
+export function resolveNotificationTarget(
+  notification: Notification,
+): NotificationTarget {
+  const declaredKind = notification.target_kind;
+  const declaredUrl = safeNotificationPath(notification.target_url);
+  if (declaredKind && declaredUrl) {
+    return {
+      target_kind: declaredKind,
+      target_id: notification.target_id ?? null,
+      target_url: declaredUrl,
+    };
+  }
+
+  if (
+    notification.type === "follow" ||
+    notification.type === "follow_request"
+  ) {
+    const actorApId = notification.actor?.ap_id ?? null;
+    return {
+      target_kind: "profile",
+      target_id: actorApId,
+      target_url: actorApId
+        ? `/profile/${encodeURIComponent(actorApId)}`
+        : "/notifications",
+    };
+  }
+
+  const objectApId = notification.object_ap_id;
+  if (objectApId && isStoryNotification(notification)) {
+    return {
+      target_kind: "story",
+      target_id: objectApId,
+      target_url: `/?story=${encodeURIComponent(objectApId)}`,
+    };
+  }
+  if (objectApId) {
+    return {
+      target_kind: "post",
+      target_id: objectApId,
+      target_url: `/post/${encodeURIComponent(objectApId)}`,
+    };
+  }
+  return {
+    target_kind: "notifications",
+    target_id: null,
+    target_url: "/notifications",
+  };
+}

package/packages/api/src/lib/api/push-config.ts

@@ -0,0 +1,132 @@
+import type { NotificationPusherProduct } from "../../types/index.ts";
+import {
+  clearBrowserNotificationPush,
+  disableBrowserNotificationPush,
+  type BrowserNotificationPushConfig,
+} from "./browser-push.ts";
+import { fetchNotificationPusherPublicConfig } from "./notifications.ts";
+
+/**
+ * Stable identity of a browser/PWA push client. Everything here is a per-app
+ * constant; only the gateway URL, VAPID key, and server origin are resolved at
+ * runtime.
+ */
+export interface BrowserPushClientIdentity {
+  readonly product: NotificationPusherProduct;
+  readonly appId: string;
+  readonly appDisplayName: string;
+  /** Root-relative service worker script path (e.g. "/notification-push-sw.js"). */
+  readonly serviceWorkerPath: string;
+  readonly scope?: string;
+  readonly lang?: string;
+}
+
+/** Non-secret runtime gateway values, from a fetch or build-time fallback. */
+export interface BrowserPushRuntimeValues {
+  readonly gatewayUrl?: string | null;
+  readonly vapidPublicKey?: string | null;
+}
+
+export interface BrowserPushConfigResolverOptions {
+  readonly identity: BrowserPushClientIdentity;
+  /**
+   * Origin of the yurucommu-compatible API that owns the registration. Returns
+   * null when it cannot be determined (e.g. SSR, or an unconfigured shell), in
+   * which case config resolution yields null.
+   */
+  readonly resolveServerOrigin: () => string | null;
+  /**
+   * Build-time fallback used only while a server rolls forward to 3.2.0; a
+   * responding runtime config always wins.
+   */
+  readonly buildTimeValues?: () => BrowserPushRuntimeValues | null;
+}
+
+export interface BrowserPushConfigResolver {
+  /** Build config from build-time values only (no network). */
+  readonly buildTimeConfig: () => BrowserNotificationPushConfig | null;
+  /**
+   * Resolve config from the server's runtime pusher config, falling back to
+   * build-time values if the server is unreachable or has push disabled.
+   */
+  readonly resolveConfig: () => Promise<BrowserNotificationPushConfig | null>;
+  /**
+   * Invalidate this device's endpoint before sign-out / account teardown,
+   * disabling via the resolved config when possible and always clearing the
+   * local subscription so a signed-out device is never woken.
+   */
+  readonly clearBeforeSignOut: () => Promise<void>;
+}
+
+/**
+ * Build a browser push config resolver for a single client identity. Promoted
+ * from the near-identical per-app resolvers in the yurucommu and yurume web
+ * clients so the fetch/fallback/clear flow lives in one place.
+ */
+export function createBrowserPushConfigResolver(
+  options: BrowserPushConfigResolverOptions,
+): BrowserPushConfigResolver {
+  const { identity, resolveServerOrigin, buildTimeValues } = options;
+
+  const build = (
+    values: BrowserPushRuntimeValues | null | undefined,
+  ): BrowserNotificationPushConfig | null => {
+    const gatewayUrl = values?.gatewayUrl?.trim();
+    const vapidPublicKey = values?.vapidPublicKey?.trim();
+    if (!gatewayUrl || !vapidPublicKey) return null;
+    const serverOrigin = resolveServerOrigin();
+    if (!serverOrigin) return null;
+    return {
+      product: identity.product,
+      appId: identity.appId,
+      appDisplayName: identity.appDisplayName,
+      serverOrigin,
+      gatewayUrl,
+      vapidPublicKey,
+      serviceWorkerPath: identity.serviceWorkerPath,
+      ...(identity.scope ? { scope: identity.scope } : {}),
+      ...(identity.lang ? { lang: identity.lang } : {}),
+    };
+  };
+
+  const buildTimeConfig = (): BrowserNotificationPushConfig | null =>
+    build(buildTimeValues?.() ?? null);
+
+  const resolveConfig =
+    async (): Promise<BrowserNotificationPushConfig | null> => {
+      try {
+        const runtime = await fetchNotificationPusherPublicConfig();
+        if (
+          !runtime.enabled ||
+          !runtime.gateway_url ||
+          !runtime.web_push_public_key
+        ) {
+          return null;
+        }
+        return build({
+          gatewayUrl: runtime.gateway_url,
+          vapidPublicKey: runtime.web_push_public_key,
+        });
+      } catch {
+        // Compatibility with older servers while they roll forward. Build-time
+        // public values are a fallback only; a responding runtime config is the
+        // deployment authority.
+        return buildTimeConfig();
+      }
+    };
+
+  const clearBeforeSignOut = async (): Promise<void> => {
+    const config = await resolveConfig().catch(() => null);
+    if (config) {
+      try {
+        await disableBrowserNotificationPush(config);
+        return;
+      } catch {
+        // Fall through to local endpoint invalidation.
+      }
+    }
+    await clearBrowserNotificationPush(identity).catch(() => undefined);
+  };
+
+  return { buildTimeConfig, resolveConfig, clearBeforeSignOut };
+}

package/packages/api/src/lib/api.ts

@@ -7,7 +7,9 @@ export * from "./api/posts.ts";
 export * from "./api/communities.ts";
 export * from "./api/dm.ts";
 export * from "./api/notifications.ts";
+export * from "./api/notification-target.ts";
 export * from "./api/browser-push.ts";
+export * from "./api/push-config.ts";
 export * from "./api/search.ts";
 export * from "./api/media.ts";
 export * from "./api/stories.ts";