@yuriai/relay-server 0.1.2-beta.2 → 0.1.3

package/DOCUMENTATION.md

@@ -302,6 +302,18 @@ Push process:
 | `YURI_PUSH_RELAY_APNS_BUNDLE_ID` | `com.yee94.yuri` | App bundle ID |
 | `YURI_PUSH_RELAY_APNS_P8` | required unless path set | APNs `.p8` PEM |
 | `YURI_PUSH_RELAY_APNS_P8_PATH` | unset | Path to the `.p8` file |
+| `YURI_PUSH_RELAY_APNS_APPS_JSON` | unset | Up to 32 additional app configurations; see README Multi-app APNs push |
+
+Registration accepts optional `bundleId`. If present it is appended as
+`.${bundleId}` to the existing signed register message (including `kind` for Live
+Activity). The Relay validates it against its configured applications, then stores
+it with the token binding. Send bodies cannot override that identity. A token with
+an explicit binding cannot be reassigned to another app; historical callers that
+omit it preserve the binding. Unregister keeps its existing owner-authenticated
+signature. Missing identities use the configured default only; unknown explicit
+identities are never guessed. Both cached-store and SQLite persist the field,
+including across worker/process restarts. APNs providers are isolated per app and
+environment. See the README for migration, deployment order and rollback limits.
 
 TestFlight and App Store Hosts use `YURI_APNS_ENVIRONMENT=production`. Each send request carries `env`; the Push process does not pick sandbox vs production itself.
 

package/README.md

@@ -1,5 +1,48 @@
 # Yuri Relay Server
 
+## Multi-app APNs push
+
+One Push process can deliver to multiple installed apps. `YURI_PUSH_RELAY_APNS_BUNDLE_ID`
+is the default topic for historical registrations without an app identity. Keep that
+default unchanged when retaining old clients. Add explicitly allowed apps with
+`YURI_PUSH_RELAY_APNS_APPS_JSON`:
+
+```yaml
+environment:
+  YURI_PUSH_RELAY_APNS_BUNDLE_ID: com.example.legacy
+  YURI_PUSH_RELAY_APNS_KEY_ID: ${APNS_KEY_ID}
+  YURI_PUSH_RELAY_APNS_TEAM_ID: ${APPLE_TEAM_ID}
+  YURI_PUSH_RELAY_APNS_P8_PATH: /run/secrets/apns_default
+  YURI_PUSH_RELAY_APNS_APPS_JSON: >-
+    [{"bundleId":"com.yee94.yuri"}]
+```
+
+An entry with only `bundleId` shares the default APNs key (the key must authorize
+that app and environment). For a separate key, provide **all** of `keyId`, `teamId`
+and `p8Path` (or `p8`) in that entry. Mount key files read-only. This uses APNs
+authentication `.p8` keys, not Apple Distribution / Developer ID `.p12` files.
+Each app has isolated JWT and HTTP/2 connection state; alert and Live Activity
+topics follow the stored app binding. Unknown apps fail registration; removed
+configurations do not fall back to another app's key or invalidate their tokens.
+
+Upgrade Relay first, then the Host and mobile web bundle. New native registrations
+read the installed shell's Bundle ID and the Host signs it into the Relay binding.
+An old Host cannot forward this identity, and old clients without it cannot be
+distinguished automatically. Reopen upgraded clients to re-register. Existing
+explicit bindings survive older registration requests without being downgraded.
+No alternate-topic probing is performed. Single-app direct Host APNs remains
+single-app and skips explicitly mismatched tokens without deleting them.
+
+The SQLite migration adds a nullable `bundle_id` column without deleting existing
+rows. Legacy rows retain default-topic behavior until re-registration. Back up the
+database before rollout; an old writer does not understand explicit app bindings,
+so rollbacks require the matching pre-upgrade database and single-app deployment.
+Use one process per database and a persistent volume (not a temporary directory).
+
+For a Docker-only release with an independent Relay package version, run the
+`Relay Docker` workflow with `version` matching this package, `push=true`, and
+`require_root_version_match=false`. The default remains `true` for full releases.
+
 `yuri-relay` is the self-hosted Layer 1 relay for Yuri remote access. It gives Yuri Hosts an outbound Relay connection and carries encrypted client traffic through that connection.
 
 The same `@yuriai/relay-server` package also ships `yuri-push-relay`, an isolated APNs push process. Layer 1 never receives Apple credentials. Push never terminates E2EE tunnels.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yuriai/relay-server",
-  "version": "0.1.2-beta.2",
+  "version": "0.1.3",
   "description": "Self-hosted private relay server for Yuri",
   "private": false,
   "type": "module",

package/src/push/apns.js

@@ -14,6 +14,24 @@ export const DEAD_TOKEN_REASONS = new Set(['BadDeviceToken', 'Unregistered', 'De
 const normalizePem = (value) => (typeof value === 'string' ? value.replace(/\\n/g, '\n').trim() : '');
 
 export const createApnsProvider = (options = {}) => {
+  if (options.apps?.length) {
+    const providers = new Map();
+    try {
+      for (const app of [{ ...options, apps: undefined }, ...options.apps]) {
+        providers.set(app.bundleId, createApnsProvider({ ...options, ...app, apps: undefined }));
+      }
+    } catch (error) {
+      for (const provider of providers.values()) provider.close();
+      throw error;
+    }
+    return {
+      send(input) {
+        const provider = providers.get(input.bundleId ?? options.bundleId);
+        return provider ? provider.send(input) : Promise.resolve({ ok: false });
+      },
+      close() { for (const provider of providers.values()) provider.close(); },
+    };
+  }
   const clock = { now: Date.now, setTimeout, clearTimeout, ...options.clock };
   const connect = options.http2?.connect ?? http2.connect;
   const sessionTtlMs = options.sessionTtlMs ?? SESSION_TTL_MS;
@@ -120,6 +138,7 @@ export const createApnsProvider = (options = {}) => {
 
   return {
     async send(input) {
+      if (input.bundleId !== undefined && input.bundleId !== bundleId) return { ok: false };
       const first = await dispatch(input, false);
       if (first.expired) {
         const retry = await dispatch(input, true);

package/src/push/cached-store.js

@@ -103,8 +103,8 @@ export const createCachedTokenStore = (databasePath, { maxTokens, maxPending = 6
     ready,
     get(token) { assertReady(); return records.get(token) ?? null; },
     count() { assertReady(); return records.size; },
-    upsert(token, serverId, platform, updatedAt) {
-      return write('upsert', [token, serverId, platform, updatedAt], () => records.set(token, { serverId, platform, updatedAt }), () => {
+    upsert(token, serverId, platform, updatedAt, bundleId) {
+      return write('upsert', [token, serverId, platform, updatedAt, bundleId], () => records.set(token, { serverId, platform, updatedAt, ...(bundleId ? { bundleId } : {}) }), () => {
         if (!records.has(token) && records.size >= maxTokens) throw overloaded();
         return false;
       });

package/src/push/config.js

@@ -61,6 +61,9 @@ export const validDatabasePath = (name, value) => {
 
 export const normalizePem = (value) => (typeof value === 'string' ? value.replace(/\\n/g, '\n').trim() : '');
 
+const isPushBundleId = (value) => typeof value === 'string'
+  && value.length <= 255 && /^[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+$/.test(value);
+
 export const validatePushRelayLimits = (limits) => {
   if (limits.replayMs < limits.timestampSkewMs * 2 || limits.maxReplayEntries < 1) throw new RangeError('invalid replay limits');
   if (limits.maxTokens < 1 || limits.maxInFlight < 1 || limits.registerLimitPerMinute < 1 || limits.sendLimitPerMinute < 1 || limits.serverSendLimitPerMinute < 1) {
@@ -79,7 +82,12 @@ export const normalizePushRelayOptions = (options = {}) => {
   validDatabasePath('databasePath', databasePath);
   if (!options.apnsProvider) {
     const apns = options.apns ?? {};
-    if (!apns.keyId || !apns.teamId || !apns.p8 || !apns.bundleId) throw new Error('Invalid APNs configuration');
+    const apps = [apns, ...(apns.apps ?? [])];
+    const ids = new Set();
+    for (const app of apps) {
+      if (!app.keyId || !app.teamId || !app.p8 || !isPushBundleId(app.bundleId) || ids.has(app.bundleId)) throw new Error('Invalid APNs configuration');
+      ids.add(app.bundleId);
+    }
   }
   return {
     host,
@@ -134,12 +142,33 @@ export const buildPushRelayConfig = (parsed = {}, env = process.env) => {
   if (typeof teamId !== 'string' || teamId.trim().length === 0) fail(`${ENV_PREFIX}APNS_TEAM_ID`);
   const p8 = loadP8(env);
   if (!p8) fail(`${ENV_PREFIX}APNS_P8`);
+  const apps = [];
+  const appsJson = env[`${ENV_PREFIX}APNS_APPS_JSON`];
+  if (appsJson !== undefined) {
+    let entries;
+    try { entries = JSON.parse(appsJson); } catch { fail(`${ENV_PREFIX}APNS_APPS_JSON`); }
+    if (!Array.isArray(entries) || entries.length > 32) fail(`${ENV_PREFIX}APNS_APPS_JSON`);
+    const ids = new Set([bundleId]);
+    for (const app of entries) {
+      if (!app || !isPushBundleId(app.bundleId) || ids.has(app.bundleId)) fail(`${ENV_PREFIX}APNS_APPS_JSON`);
+      ids.add(app.bundleId);
+      // Omit all credential fields to share the default team's APNs key.
+      const ownKey = ['keyId', 'teamId', 'p8', 'p8Path'].some((key) => app[key] !== undefined);
+      if (ownKey && (typeof app.keyId !== 'string' || !app.keyId.trim() || typeof app.teamId !== 'string' || !app.teamId.trim())) fail(`${ENV_PREFIX}APNS_APPS_JSON`);
+      const appP8 = ownKey ? loadP8({
+        [`${ENV_PREFIX}APNS_P8`]: app.p8,
+        [`${ENV_PREFIX}APNS_P8_PATH`]: app.p8Path,
+      }) : p8;
+      apps.push({ bundleId: app.bundleId, keyId: ownKey ? app.keyId.trim() : keyId.trim(), teamId: ownKey ? app.teamId.trim() : teamId.trim(), p8: appP8 });
+    }
+  }
+  if (!isPushBundleId(bundleId)) fail(`${ENV_PREFIX}APNS_BUNDLE_ID`);
   return {
     host,
     port,
     databasePath,
     trustProxy: parsed.trustProxy ?? bool(envName('trustProxy'), envValue(env, 'trustProxy')),
     limits: merged,
-    apns: { keyId: keyId.trim(), teamId: teamId.trim(), p8, bundleId: String(bundleId).trim() },
+    apns: { keyId: keyId.trim(), teamId: teamId.trim(), p8, bundleId: String(bundleId).trim(), ...(apps.length ? { apps } : {}) },
   };
 };

package/src/push/handler.js

@@ -64,6 +64,7 @@ const readBody = (request, maxBytes) => new Promise((resolve, reject) => {
 export const createPushRelayHandler = (options = {}) => {
   const claimHealthEndpoints = options.claimHealthEndpoints !== false;
   const config = normalizePushRelayOptions(options);
+  const allowedBundleIds = new Set([config.apns?.bundleId, ...(config.apns?.apps ?? []).map((app) => app.bundleId)].filter(Boolean));
   const limits = config.limits;
   const clock = { now: Date.now, setTimeout, clearTimeout, setInterval, clearInterval, setImmediate, ...config.clock };
   const resolveClientIp = config.resolveClientIp ?? ((request) => resolvePushRelayClientIp(request, config.trustProxy));
@@ -114,9 +115,10 @@ export const createPushRelayHandler = (options = {}) => {
   };
 
   const handleRegister = (parsed) => mutate(async () => {
-    const message = parsed.kind
+    let message = parsed.kind
       ? `${parsed.ts}.${parsed.token}.${parsed.platform}.${parsed.kind}`
       : `${parsed.ts}.${parsed.token}.${parsed.platform}`;
+    if (parsed.bundleId !== undefined) message += `.${parsed.bundleId}`;
     const authError = authenticate(parsed.publicKeyJwk, message, parsed.sig, parsed.ts);
     if (authError) return { status: 401, body: { error: authError } };
     const serverId = deriveServerId(parsed.publicKeyJwk);
@@ -124,9 +126,12 @@ export const createPushRelayHandler = (options = {}) => {
     if (replay.has(replayKey)) return { status: 200, body: { ok: true } };
     const tokens = store;
     const existing = tokens.get(parsed.token);
+    if (parsed.bundleId !== undefined && !allowedBundleIds.has(parsed.bundleId)) return { status: 400, body: { error: 'unsupported_app' } };
+    const bundleId = parsed.bundleId ?? existing?.bundleId;
+    if (existing?.bundleId && existing.bundleId !== bundleId) return { status: 409, body: { error: 'app_mismatch' } };
     if (!existing && tokens.count() >= limits.maxTokens) { reasons.limited += 1; return { status: 429, body: { error: 'token_limit' } }; }
     if (!replay.remember(replayKey)) { reasons.limited += 1; return { status: 429, body: { error: 'rate_limited' } }; }
-    try { await tokens.upsert(parsed.token, serverId, parsed.platform, clock.now()); } catch (error) { replay.forget(replayKey); throw error; }
+    try { await tokens.upsert(parsed.token, serverId, parsed.platform, clock.now(), bundleId); } catch (error) { replay.forget(replayKey); throw error; }
     return { status: 200, body: { ok: true } };
   });
 
@@ -160,7 +165,7 @@ export const createPushRelayHandler = (options = {}) => {
       const acquired = await inFlight.acquire();
       if (!acquired) { reasons.limited += 1; return { token, ok: false }; }
       try {
-        const outcome = await apns.send({ token, env: parsed.env, payload: parsed.payload, collapseId: parsed.collapseId });
+        const outcome = await apns.send({ token, bundleId: binding.bundleId ?? config.apns?.bundleId, env: parsed.env, payload: parsed.payload, collapseId: parsed.collapseId });
         if (outcome?.drop === true) {
           await tokens.delete(token, binding);
           return { token, ok: false, drop: true };
@@ -200,7 +205,7 @@ export const createPushRelayHandler = (options = {}) => {
       const acquired = await inFlight.acquire();
       if (!acquired) { reasons.limited += 1; return { token, ok: false }; }
       try {
-        const outcome = await apns.send({ token, env: parsed.env, payload, pushType: 'liveactivity' });
+        const outcome = await apns.send({ token, bundleId: binding.bundleId ?? config.apns?.bundleId, env: parsed.env, payload, pushType: 'liveactivity' });
         if (outcome?.drop === true) {
           await tokens.delete(token, binding);
           return { token, ok: false, drop: true };

package/src/push/index.d.ts

@@ -22,6 +22,7 @@ export interface PushRelayApnsConfig {
   teamId: string;
   p8: string;
   bundleId: string;
+  apps?: Array<Omit<PushRelayApnsConfig, 'apps'>>;
 }
 
 export interface PushRelayClock {
@@ -35,6 +36,7 @@ export interface PushRelayClock {
 
 export interface PushApnsSendInput {
   token: string;
+  bundleId?: string;
   env: PushRelayEnv;
   payload: unknown;
   collapseId?: string;
@@ -55,11 +57,12 @@ export interface PushTokenRecord {
   serverId: string;
   platform: string;
   updatedAt: number;
+  bundleId?: string;
 }
 
 export interface PushTokenStore {
   get(token: string): PushTokenRecord | null;
-  upsert(token: string, serverId: string, platform: string, updatedAt: number): void | Promise<void>;
+  upsert(token: string, serverId: string, platform: string, updatedAt: number, bundleId?: string): void | Promise<void>;
   delete(token: string, expected?: PushTokenRecord): void | Promise<void>;
   count(): number;
   close(): void | Promise<void>;

package/src/push/schema.js

@@ -134,11 +134,12 @@ export const validateRegisterBody = (body) => {
   if (body.platform === 'android') return { error: 'unsupported_platform' };
   if (body.platform !== 'ios') return { error: 'invalid_request' };
   if (!isIosToken(body.token)) return { error: 'invalid_request' };
+  if (body.bundleId !== undefined && (typeof body.bundleId !== 'string' || body.bundleId.length > 255 || !/^[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+$/.test(body.bundleId))) return { error: 'invalid_request' };
   const jwk = parsePublicJwk(body.publicKeyJwk);
   const ts = parseTs(body.ts);
   const sig = parseSig(body.sig);
   if (!jwk || ts === null || !sig) return { error: 'invalid_request' };
-  return { value: { token: body.token, platform: 'ios', publicKeyJwk: jwk, ts, sig } };
+  return { value: { token: body.token, platform: 'ios', publicKeyJwk: jwk, ts, sig, ...(body.bundleId !== undefined ? { bundleId: body.bundleId } : {}) } };
 };
 
 export const validateLiveActivityRegisterBody = (body) => {

package/src/push/store.js

@@ -20,9 +20,12 @@ export const createTokenStore = (databasePath, { busyTimeoutMs = 5_000 } = {}) =
   db.exec('PRAGMA journal_mode = WAL');
   db.exec(`PRAGMA busy_timeout = ${busyTimeoutMs}`);
   db.exec(SCHEMA);
-  const getStmt = db.prepare('SELECT server_id AS serverId, platform, updated_at AS updatedAt FROM push_tokens WHERE token = ?');
-  const upsertStmt = db.prepare(`INSERT INTO push_tokens (token, server_id, platform, updated_at) VALUES (?, ?, ?, ?)
-    ON CONFLICT(token) DO UPDATE SET server_id = excluded.server_id, platform = excluded.platform, updated_at = excluded.updated_at`);
+  if (!db.prepare('PRAGMA table_info(push_tokens)').all().some((column) => column.name === 'bundle_id')) {
+    db.exec('ALTER TABLE push_tokens ADD COLUMN bundle_id TEXT');
+  }
+  const getStmt = db.prepare('SELECT server_id AS serverId, platform, updated_at AS updatedAt, bundle_id AS bundleId FROM push_tokens WHERE token = ?');
+  const upsertStmt = db.prepare(`INSERT INTO push_tokens (token, server_id, platform, updated_at, bundle_id) VALUES (?, ?, ?, ?, ?)
+    ON CONFLICT(token) DO UPDATE SET server_id = excluded.server_id, platform = excluded.platform, updated_at = excluded.updated_at, bundle_id = excluded.bundle_id`);
   const deleteStmt = db.prepare('DELETE FROM push_tokens WHERE token = ?');
   const countStmt = db.prepare('SELECT COUNT(*) AS n FROM push_tokens');
   let closed = false;
@@ -30,18 +33,18 @@ export const createTokenStore = (databasePath, { busyTimeoutMs = 5_000 } = {}) =
   return {
     entries(maxTokens) {
       assertOpen();
-      const rows = db.prepare('SELECT token, server_id AS serverId, platform, updated_at AS updatedAt FROM push_tokens LIMIT ?').all(maxTokens + 1);
+      const rows = db.prepare('SELECT token, server_id AS serverId, platform, updated_at AS updatedAt, bundle_id AS bundleId FROM push_tokens LIMIT ?').all(maxTokens + 1);
       if (rows.length > maxTokens) throw new Error('token capacity exceeded');
-      return rows;
+      return rows.map(({ bundleId, ...row }) => ({ ...row, ...(bundleId ? { bundleId } : {}) }));
     },
     get(token) {
       assertOpen();
       const row = getStmt.get(token);
-      return row ? { serverId: row.serverId, platform: row.platform, updatedAt: row.updatedAt } : null;
+      return row ? { serverId: row.serverId, platform: row.platform, updatedAt: row.updatedAt, ...(row.bundleId ? { bundleId: row.bundleId } : {}) } : null;
     },
-    upsert(token, serverId, platform, updatedAt) {
+    upsert(token, serverId, platform, updatedAt, bundleId = null) {
       assertOpen();
-      upsertStmt.run(token, serverId, platform, updatedAt);
+      upsertStmt.run(token, serverId, platform, updatedAt, bundleId);
     },
     delete(token) {
       assertOpen();