feedkeeper 0.0.0-stage → 0.23.1

package/server/dist/oauth/routes.js

@@ -0,0 +1,370 @@
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import cors from "cors";
+import express, { Router } from "express";
+import rateLimit from "express-rate-limit";
+import { z } from "zod";
+import { config } from "../config.js";
+import { getUserCapabilities, hasUserCapability } from "../auth/capabilities.js";
+import { hasTotp, securityVersion, sessionIsSecure } from "../auth/security.js";
+import { verifyPasswordOrDummy } from "../auth/password.js";
+import { findUserByEmail, findUserById } from "../auth/users.js";
+import { ISSUER, MCP_RESOURCE } from "./constants.js";
+import { getOAuthHost } from "./host.js";
+import { renderConsent, renderError, renderLogin } from "./pages.js";
+import { consumeAuthorizationCode, createAuthorizationCode, findClient, issueGrant, registerClient, revokeByToken, rotateGrant, } from "./store.js";
+const issuer = ISSUER;
+const SCOPES = ["mcp:read", "mcp:write"];
+const PKCE_PATTERN = /^[A-Za-z0-9\-._~]{43,128}$/;
+const noStore = (res) => res.setHeader("Cache-Control", "no-store").setHeader("Pragma", "no-cache");
+function oauthError(res, status, error, description) {
+    noStore(res);
+    res.status(status).json({ error, ...(description ? { error_description: description } : {}) });
+}
+function sameResource(value) {
+    return typeof value === "string" && value.replace(/\/+$/, "") === MCP_RESOURCE;
+}
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+/** https anywhere (optionally limited to OAUTH_ALLOWED_REDIRECT_HOSTS) or plain http on this machine. */
+function validRedirectUri(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    if (url.hash || url.username || url.password)
+        return false;
+    if (url.protocol === "http:")
+        return LOOPBACK_HOSTS.has(url.hostname);
+    if (url.protocol !== "https:")
+        return false;
+    const allowed = config.oauthAllowedRedirectHosts;
+    return allowed.length === 0 || allowed.includes(url.hostname.toLowerCase());
+}
+// ---------------------------------------------------------------------------------------------
+// Public endpoints: metadata, registration, token, revocation. Called by connector backends and
+// browser tools without our cookies, so they get open CORS and no session.
+// ---------------------------------------------------------------------------------------------
+export const oauthPublicRouter = Router();
+const openCors = cors({ origin: "*", credentials: false, methods: ["GET", "POST", "OPTIONS"] });
+oauthPublicRouter.use(["/.well-known", "/oauth/register", "/oauth/token", "/oauth/revoke"], openCors);
+const formBodies = [express.urlencoded({ extended: false, limit: "20kb" }), express.json({ limit: "20kb" })];
+oauthPublicRouter.get(["/.well-known/oauth-protected-resource", "/.well-known/oauth-protected-resource/mcp"], (_req, res) => {
+    res.json({
+        resource: MCP_RESOURCE,
+        authorization_servers: [issuer],
+        scopes_supported: SCOPES,
+        bearer_methods_supported: ["header"],
+        resource_name: "FeedKeeper MCP",
+    });
+});
+oauthPublicRouter.get(["/.well-known/oauth-authorization-server", "/.well-known/openid-configuration"], (_req, res) => {
+    res.json({
+        issuer,
+        authorization_endpoint: `${issuer}/oauth/authorize`,
+        token_endpoint: `${issuer}/oauth/token`,
+        registration_endpoint: `${issuer}/oauth/register`,
+        revocation_endpoint: `${issuer}/oauth/revoke`,
+        response_types_supported: ["code"],
+        grant_types_supported: ["authorization_code", "refresh_token"],
+        code_challenge_methods_supported: ["S256"],
+        token_endpoint_auth_methods_supported: ["none"],
+        revocation_endpoint_auth_methods_supported: ["none"],
+        scopes_supported: SCOPES,
+        authorization_response_iss_parameter_supported: true,
+    });
+});
+const registerLimiter = rateLimit({ windowMs: 60 * 60 * 1000, limit: 30, standardHeaders: true, legacyHeaders: false });
+const tokenLimiter = rateLimit({ windowMs: 60 * 1000, limit: 60, standardHeaders: true, legacyHeaders: false });
+const registerSchema = z.object({
+    client_name: z.string().trim().min(1).max(100).optional(),
+    redirect_uris: z.array(z.string().max(2000)).min(1).max(10),
+    token_endpoint_auth_method: z.literal("none").optional(),
+    grant_types: z.array(z.enum(["authorization_code", "refresh_token"])).optional(),
+    response_types: z.array(z.literal("code")).optional(),
+});
+oauthPublicRouter.post("/oauth/register", registerLimiter, formBodies[1], (req, res) => {
+    const parsed = registerSchema.safeParse(req.body);
+    if (!parsed.success) {
+        oauthError(res, 400, "invalid_client_metadata", "Public clients (token_endpoint_auth_method none) with 1-10 redirect_uris are supported.");
+        return;
+    }
+    if (!parsed.data.redirect_uris.every(validRedirectUri)) {
+        oauthError(res, 400, "invalid_redirect_uri", "Redirect URIs must be https, or http on localhost, without credentials or fragment.");
+        return;
+    }
+    const client = registerClient(parsed.data.client_name ?? "MCP client", [...new Set(parsed.data.redirect_uris)]);
+    if (!client) {
+        oauthError(res, 503, "temporarily_unavailable", "Too many registered clients.");
+        return;
+    }
+    noStore(res);
+    res.status(201).json({
+        client_id: client.client_id,
+        client_name: client.client_name,
+        redirect_uris: client.redirect_uris,
+        token_endpoint_auth_method: "none",
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        client_id_issued_at: Math.floor(Date.parse(client.created_at) / 1000),
+    });
+});
+function basicClientId(req) {
+    const header = req.headers.authorization;
+    if (!header?.startsWith("Basic "))
+        return null;
+    const [id] = Buffer.from(header.slice(6), "base64").toString("utf8").split(":");
+    if (!id)
+        return null;
+    try {
+        return decodeURIComponent(id);
+    }
+    catch {
+        // A malformed escape is a client that does not exist, not a server error.
+        return null;
+    }
+}
+const str = (value) => (typeof value === "string" ? value : "");
+function tokenResponse(res, tokens, scope) {
+    noStore(res);
+    res.json({
+        access_token: tokens.accessToken,
+        token_type: "Bearer",
+        expires_in: tokens.expiresIn,
+        refresh_token: tokens.refreshToken,
+        scope: scope === "write" ? "mcp:read mcp:write" : "mcp:read",
+    });
+}
+function pkceMatches(verifier, challenge) {
+    if (!PKCE_PATTERN.test(verifier))
+        return false;
+    const computed = Buffer.from(createHash("sha256").update(verifier).digest("base64url"));
+    const stored = Buffer.from(challenge);
+    return computed.length === stored.length && timingSafeEqual(computed, stored);
+}
+oauthPublicRouter.post("/oauth/token", tokenLimiter, ...formBodies, (req, res) => {
+    const body = (req.body ?? {});
+    const clientId = str(body.client_id) || basicClientId(req) || "";
+    const client = clientId ? findClient(clientId) : null;
+    if (!client) {
+        oauthError(res, 401, "invalid_client");
+        return;
+    }
+    if (body.resource !== undefined && !sameResource(body.resource)) {
+        oauthError(res, 400, "invalid_target", `The only resource is ${MCP_RESOURCE}.`);
+        return;
+    }
+    const grantType = str(body.grant_type);
+    if (grantType === "authorization_code") {
+        // The code is spent by the lookup, so a failed attempt cannot be retried with a corrected verifier.
+        const code = consumeAuthorizationCode(str(body.code));
+        if (!code || code.client_id !== client.client_id || code.redirect_uri !== str(body.redirect_uri) || !pkceMatches(str(body.code_verifier), code.code_challenge)) {
+            oauthError(res, 400, "invalid_grant");
+            return;
+        }
+        tokenResponse(res, issueGrant(code.user_id, client.client_id, code.scope), code.scope);
+        return;
+    }
+    if (grantType === "refresh_token") {
+        const result = rotateGrant(str(body.refresh_token), client.client_id);
+        if (!result.ok) {
+            oauthError(res, 400, "invalid_grant");
+            return;
+        }
+        tokenResponse(res, result.tokens, result.scope);
+        return;
+    }
+    oauthError(res, 400, "unsupported_grant_type");
+});
+oauthPublicRouter.post("/oauth/revoke", tokenLimiter, ...formBodies, (req, res) => {
+    const body = (req.body ?? {});
+    // RFC 7009: the answer never reveals whether the token existed.
+    revokeByToken(str(body.token), str(body.client_id) || basicClientId(req));
+    noStore(res);
+    res.status(200).json({});
+});
+// ---------------------------------------------------------------------------------------------
+// Authorization: runs in the user's browser with the cookie session.
+// ---------------------------------------------------------------------------------------------
+export const oauthAuthorizeRouter = Router();
+const publicOrigin = new URL(issuer).origin;
+const loginLimiter = rateLimit({ windowMs: 15 * 60 * 1000, limit: 10, standardHeaders: true, legacyHeaders: false });
+const formOnly = express.urlencoded({ extended: false, limit: "20kb" });
+/**
+ * The consent and login forms only ever post from our own pages. Browsers state that themselves in
+ * Sec-Fetch-Site; Origin is the fallback for older ones. With `Referrer-Policy: no-referrer` (helmet's
+ * default) a same-origin form post carries `Origin: null`, so a null Origin alone proves nothing.
+ */
+function sameOriginOnly(req, res, next) {
+    const site = req.headers["sec-fetch-site"];
+    const origin = req.headers.origin;
+    const foreign = site !== undefined ? site !== "same-origin" : origin !== undefined && origin !== publicOrigin;
+    if (foreign) {
+        page(res, 403, renderError(req, "forbidden"));
+        return;
+    }
+    next();
+}
+const LOOPBACK_FORM_ACTIONS = "http://localhost:* http://127.0.0.1:* http://[::1]:*";
+/** Pages are never cached or framed. Consent may submit on to the client's redirect address, which form-action also covers after a redirect. */
+function page(res, status, html, allowRedirects = false) {
+    noStore(res);
+    // The forms check where a post came from; give them an Origin to check.
+    res.setHeader("Referrer-Policy", "same-origin");
+    res.setHeader("Content-Security-Policy", `default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'${allowRedirects ? ` https: ${LOOPBACK_FORM_ACTIONS}` : ""}`);
+    res.status(status).type("html").send(html);
+}
+function parseAuthorization(params) {
+    const client = findClient(str(params.client_id));
+    if (!client)
+        return { kind: "fatal", message: "unknownClient" };
+    const redirectUri = str(params.redirect_uri);
+    // Unlike every other problem, these two must never bounce back to an unverified address.
+    if (!client.redirect_uris.includes(redirectUri))
+        return { kind: "fatal", message: "badRedirect" };
+    const state = str(params.state);
+    const fail = (error) => ({ kind: "redirect", redirectUri, state, error });
+    if (str(params.response_type) !== "code")
+        return fail("unsupported_response_type");
+    const codeChallenge = str(params.code_challenge);
+    if (!PKCE_PATTERN.test(codeChallenge) || str(params.code_challenge_method) !== "S256")
+        return fail("invalid_request");
+    if (params.resource !== undefined && !sameResource(params.resource))
+        return fail("invalid_target");
+    // Unknown scopes (openid, offline_access, ...) are ignored; the user picks the final level.
+    const scopes = str(params.scope).split(/\s+/);
+    const requested = scopes.includes("mcp:write") ? "write" : scopes.includes("mcp:read") ? "read" : null;
+    return { kind: "ok", client, redirectUri, state, codeChallenge, requested, resource: MCP_RESOURCE };
+}
+function redirectBack(res, redirectUri, values) {
+    const url = new URL(redirectUri);
+    for (const [key, value] of Object.entries({ ...values, iss: issuer }))
+        if (value)
+            url.searchParams.set(key, value);
+    noStore(res);
+    res.redirect(303, url.toString());
+}
+function csrfToken(userId, a) {
+    const material = ["oauth-consent", userId, a.client.client_id, a.redirectUri, a.state, a.codeChallenge, a.requested ?? "", a.resource].join("\n");
+    return createHmac("sha256", config.sessionSecret).update(material).digest("hex");
+}
+function csrfValid(expected, given) {
+    const a = Buffer.from(expected);
+    const b = Buffer.from(given);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+/** The signed-in user, or null once the host or the login page has taken over the response. */
+function resolveOwner(req, res, client) {
+    const host = getOAuthHost();
+    if (host)
+        return host.resolveResourceOwner(req, res);
+    const userId = req.session?.userId;
+    if (userId && findUserById(userId) && sessionIsSecure(req, userId))
+        return userId;
+    page(res, 200, renderLogin(req, { clientName: client.client_name, returnTo: req.originalUrl }));
+    return null;
+}
+function mayUseMcp(req, res, userId) {
+    if (hasUserCapability(userId, "mcp"))
+        return true;
+    page(res, 403, renderError(req, "noAccess", getUserCapabilities(userId).manageUrl));
+    return false;
+}
+oauthAuthorizeRouter.get("/oauth/authorize", (req, res) => {
+    const parsed = parseAuthorization(req.query);
+    if (parsed.kind === "fatal") {
+        page(res, 400, renderError(req, parsed.message));
+        return;
+    }
+    if (parsed.kind === "redirect") {
+        redirectBack(res, parsed.redirectUri, { error: parsed.error, state: parsed.state });
+        return;
+    }
+    const userId = resolveOwner(req, res, parsed.client);
+    if (userId === null || !mayUseMcp(req, res, userId))
+        return;
+    const user = findUserById(userId);
+    page(res, 200, renderConsent(req, {
+        clientName: parsed.client.client_name,
+        redirectHost: new URL(parsed.redirectUri).host,
+        userName: user.display_name || user.email,
+        preselect: parsed.requested === "write" ? "write" : "read",
+        allowWrite: parsed.requested !== "read",
+        fields: {
+            client_id: parsed.client.client_id,
+            redirect_uri: parsed.redirectUri,
+            state: parsed.state,
+            code_challenge: parsed.codeChallenge,
+            code_challenge_method: "S256",
+            response_type: "code",
+            scope: parsed.requested === "write" ? "mcp:read mcp:write" : parsed.requested === "read" ? "mcp:read" : "",
+            resource: parsed.resource,
+            csrf: csrfToken(userId, parsed),
+        },
+    }), true);
+});
+const loginSchema = z.object({ email: z.string().email(), password: z.string().min(1), return_to: z.string().max(4000) });
+oauthAuthorizeRouter.post("/oauth/authorize/login", sameOriginOnly, loginLimiter, formOnly, (req, res) => {
+    const parsed = loginSchema.safeParse(req.body);
+    // Only our own authorize URL is a valid destination; anything else would be an open redirect.
+    if (!parsed.success || !parsed.data.return_to.startsWith("/oauth/authorize?")) {
+        page(res, 400, renderError(req, "forbidden"));
+        return;
+    }
+    const returnTo = parsed.data.return_to;
+    const clientId = new URL(returnTo, issuer).searchParams.get("client_id") ?? "";
+    const client = findClient(clientId);
+    if (!client) {
+        page(res, 400, renderError(req, "unknownClient"));
+        return;
+    }
+    const user = findUserByEmail(parsed.data.email);
+    const passwordMatches = verifyPasswordOrDummy(parsed.data.password, user?.password_hash);
+    if (!user || !passwordMatches) {
+        page(res, 401, renderLogin(req, { clientName: client.client_name, returnTo, failed: true }));
+        return;
+    }
+    if (hasTotp(user.id)) {
+        res.redirect(303, `/login?next=${encodeURIComponent(returnTo)}`);
+        return;
+    }
+    req.session = { userId: user.id, securityVersion: securityVersion(user.id) };
+    res.redirect(303, returnTo);
+});
+oauthAuthorizeRouter.post("/oauth/authorize/decision", sameOriginOnly, formOnly, (req, res) => {
+    const body = (req.body ?? {});
+    const parsed = parseAuthorization(body);
+    if (parsed.kind === "fatal") {
+        page(res, 400, renderError(req, parsed.message));
+        return;
+    }
+    if (parsed.kind === "redirect") {
+        redirectBack(res, parsed.redirectUri, { error: parsed.error, state: parsed.state });
+        return;
+    }
+    const userId = resolveOwner(req, res, parsed.client);
+    if (userId === null)
+        return;
+    // Every field of the consent page is bound into the token, so a forged or altered form fails here.
+    if (!csrfValid(csrfToken(userId, parsed), str(body.csrf))) {
+        page(res, 403, renderError(req, "forbidden"));
+        return;
+    }
+    if (!mayUseMcp(req, res, userId))
+        return;
+    if (str(body.decision) !== "allow") {
+        redirectBack(res, parsed.redirectUri, { error: "access_denied", state: parsed.state });
+        return;
+    }
+    const scope = str(body.grant_scope) === "write" && parsed.requested !== "read" ? "write" : "read";
+    const code = createAuthorizationCode({
+        clientId: parsed.client.client_id,
+        userId,
+        redirectUri: parsed.redirectUri,
+        codeChallenge: parsed.codeChallenge,
+        scope,
+    });
+    redirectBack(res, parsed.redirectUri, { code, state: parsed.state });
+});
+//# sourceMappingURL=routes.js.map

package/server/dist/oauth/store.js

@@ -0,0 +1,104 @@
+import { createHash, randomBytes } from "node:crypto";
+import { db } from "../db/index.js";
+export const ACCESS_TTL_MS = 60 * 60 * 1000;
+export const REFRESH_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+export const CODE_TTL_MS = 60 * 1000;
+/** Clients nobody ever authorized are dropped after this long. */
+const UNUSED_CLIENT_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+const MAX_CLIENTS = 5000;
+function hash(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function newSecret(prefix) {
+    return `${prefix}${randomBytes(32).toString("base64url")}`;
+}
+const now = () => new Date().toISOString();
+const inMs = (ms) => new Date(Date.now() + ms).toISOString();
+export function registerClient(name, redirectUris) {
+    return db.transaction(() => {
+        db.prepare(`DELETE FROM oauth_clients WHERE created_at < ? AND NOT EXISTS (SELECT 1 FROM oauth_grants WHERE oauth_grants.client_id = oauth_clients.client_id)`).run(new Date(Date.now() - UNUSED_CLIENT_TTL_MS).toISOString());
+        const count = db.prepare("SELECT COUNT(*) AS n FROM oauth_clients").get().n;
+        if (count >= MAX_CLIENTS)
+            return null;
+        const clientId = `fkc_${randomBytes(16).toString("base64url")}`;
+        db.prepare("INSERT INTO oauth_clients (client_id, client_name, redirect_uris) VALUES (?, ?, ?)").run(clientId, name, JSON.stringify(redirectUris));
+        return findClient(clientId);
+    })();
+}
+export function findClient(clientId) {
+    const row = db.prepare("SELECT * FROM oauth_clients WHERE client_id = ?").get(clientId);
+    return row ? { ...row, redirect_uris: JSON.parse(row.redirect_uris) } : null;
+}
+export function createAuthorizationCode(input) {
+    const code = newSecret("fkcode_");
+    db.prepare("DELETE FROM oauth_codes WHERE expires_at <= ?").run(now());
+    db.prepare(`INSERT INTO oauth_codes (code_hash, client_id, user_id, redirect_uri, code_challenge, scope, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?)`).run(hash(code), input.clientId, input.userId, input.redirectUri, input.codeChallenge, input.scope, inMs(CODE_TTL_MS));
+    return code;
+}
+/** A code works once: it is deleted whether or not the caller's checks pass afterwards. */
+export function consumeAuthorizationCode(code) {
+    return db.transaction(() => {
+        const row = db
+            .prepare("SELECT * FROM oauth_codes WHERE code_hash = ?")
+            .get(hash(code));
+        if (!row)
+            return null;
+        db.prepare("DELETE FROM oauth_codes WHERE code_hash = ?").run(hash(code));
+        return row.expires_at > now() ? row : null;
+    })();
+}
+export function issueGrant(userId, clientId, scope) {
+    const accessToken = newSecret("fk_oat_");
+    const refreshToken = newSecret("fk_ort_");
+    db.prepare(`INSERT INTO oauth_grants (user_id, client_id, scope, access_hash, access_expires_at, refresh_hash, refresh_expires_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?)`).run(userId, clientId, scope, hash(accessToken), inMs(ACCESS_TTL_MS), hash(refreshToken), inMs(REFRESH_TTL_MS));
+    return { accessToken, refreshToken, expiresIn: ACCESS_TTL_MS / 1000 };
+}
+/** Swaps in a new token pair. A refresh token that was already replaced revokes the whole grant. */
+export function rotateGrant(refreshToken, clientId) {
+    return db.transaction(() => {
+        const refreshHash = hash(refreshToken);
+        const reused = db.prepare("SELECT * FROM oauth_grants WHERE previous_refresh_hash = ?").get(refreshHash);
+        if (reused) {
+            db.prepare("DELETE FROM oauth_grants WHERE id = ?").run(reused.id);
+            return { ok: false };
+        }
+        const grant = db.prepare("SELECT * FROM oauth_grants WHERE refresh_hash = ?").get(refreshHash);
+        if (!grant || grant.client_id !== clientId || grant.refresh_expires_at <= now())
+            return { ok: false };
+        const accessToken = newSecret("fk_oat_");
+        const newRefresh = newSecret("fk_ort_");
+        db.prepare(`UPDATE oauth_grants SET access_hash = ?, access_expires_at = ?, refresh_hash = ?, previous_refresh_hash = ?, refresh_expires_at = ? WHERE id = ?`).run(hash(accessToken), inMs(ACCESS_TTL_MS), hash(newRefresh), refreshHash, inMs(REFRESH_TTL_MS), grant.id);
+        return { ok: true, scope: grant.scope, tokens: { accessToken, refreshToken: newRefresh, expiresIn: ACCESS_TTL_MS / 1000 } };
+    })();
+}
+export function resolveAccessToken(token) {
+    const row = db
+        .prepare("SELECT * FROM oauth_grants WHERE access_hash = ?")
+        .get(hash(token));
+    if (!row || row.access_expires_at <= now())
+        return null;
+    db.prepare("UPDATE oauth_grants SET last_used_at = ? WHERE id = ?").run(now(), row.id);
+    return { userId: row.user_id, scope: row.scope, grantId: row.id };
+}
+/** Revokes by either token. Returns whether a grant was removed. */
+export function revokeByToken(token, clientId) {
+    const tokenHash = hash(token);
+    const grant = db
+        .prepare("SELECT id, client_id FROM oauth_grants WHERE access_hash = ? OR refresh_hash = ?")
+        .get(tokenHash, tokenHash);
+    if (!grant || (clientId && grant.client_id !== clientId))
+        return false;
+    return db.prepare("DELETE FROM oauth_grants WHERE id = ?").run(grant.id).changes > 0;
+}
+export function listGrantsForUser(userId) {
+    return db
+        .prepare(`SELECT g.id, c.client_name, g.scope, g.created_at, g.last_used_at
+       FROM oauth_grants g JOIN oauth_clients c ON c.client_id = g.client_id
+       WHERE g.user_id = ? ORDER BY g.created_at DESC`)
+        .all(userId);
+}
+export function deleteGrant(userId, grantId) {
+    return db.prepare("DELETE FROM oauth_grants WHERE id = ? AND user_id = ?").run(grantId, userId).changes > 0;
+}
+//# sourceMappingURL=store.js.map

package/server/dist/push.js

@@ -0,0 +1,147 @@
+import webpush from "web-push";
+import { db } from "./db/index.js";
+import { assertPublicHttpUrl, createPublicHttpsAgent } from "./feeds/ssrfGuard.js";
+const MAX_DEVICES_PER_USER = 10;
+const VAPID_SUBJECT = "https://github.com/visualfusion/feedkeeper";
+let vapid = null;
+/** The server's own push keys, created on first use and kept in the database. */
+function vapidKeys() {
+    if (vapid)
+        return vapid;
+    const read = (key) => db.prepare("SELECT value FROM system_settings WHERE key = ?").get(key)?.value;
+    let publicKey = read("vapid_public_key");
+    let privateKey = read("vapid_private_key");
+    if (!publicKey || !privateKey) {
+        ({ publicKey, privateKey } = webpush.generateVAPIDKeys());
+        const save = db.prepare("INSERT INTO system_settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value");
+        db.transaction(() => {
+            save.run("vapid_public_key", publicKey);
+            save.run("vapid_private_key", privateKey);
+        })();
+    }
+    vapid = { publicKey, privateKey };
+    return vapid;
+}
+export function vapidPublicKey() {
+    return vapidKeys().publicKey;
+}
+const defaultSender = async (target, payload) => {
+    // An absolute deadline includes DNS, connection and response, not just socket inactivity.
+    // Destroying this delivery's agent also closes a stalled request before the next one starts.
+    const agent = createPublicHttpsAgent();
+    let expired = false;
+    let timer;
+    const deadline = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+            expired = true;
+            agent.destroy();
+            reject(new DOMException("Push deadline exceeded", "TimeoutError"));
+        }, 10_000);
+    });
+    try {
+        await Promise.race([(async () => {
+                // Browser-supplied endpoints retain preflight and socket-level SSRF protection.
+                await assertPublicHttpUrl(target.endpoint);
+                if (expired)
+                    return;
+                const { publicKey, privateKey } = vapidKeys();
+                await webpush.sendNotification(target, payload, { TTL: 60 * 60, timeout: 10_000, agent, vapidDetails: { subject: VAPID_SUBJECT, publicKey, privateKey } });
+            })(), deadline]);
+    }
+    finally {
+        clearTimeout(timer);
+        agent.destroy();
+    }
+};
+let sender = defaultSender;
+/** Replace the function that talks to the push service (tests). */
+export function setPushSender(next) {
+    sender = next ?? defaultSender;
+}
+/** One attempt. The durable outbox owns recipient cursors and bounded retries. */
+export function sendPushTarget(target, payload) {
+    return sender(target, JSON.stringify(payload));
+}
+export function saveDevice(userId, target) {
+    db.transaction(() => {
+        db.prepare(`INSERT INTO push_devices (user_id, endpoint, p256dh, auth) VALUES (?, ?, ?, ?)
+       ON CONFLICT(endpoint) DO UPDATE SET user_id = excluded.user_id, p256dh = excluded.p256dh, auth = excluded.auth`).run(userId, target.endpoint, target.keys.p256dh, target.keys.auth);
+        // Keep the newest devices only.
+        db.prepare(`DELETE FROM push_devices WHERE user_id = ? AND id NOT IN (SELECT id FROM push_devices WHERE user_id = ? ORDER BY id DESC LIMIT ?)`).run(userId, userId, MAX_DEVICES_PER_USER);
+    })();
+}
+export function removeDevice(userId, endpoint) {
+    db.prepare("DELETE FROM push_devices WHERE user_id = ? AND endpoint = ?").run(userId, endpoint);
+}
+export function hasDevice(userId, endpoint) {
+    return Boolean(db.prepare("SELECT 1 FROM push_devices WHERE user_id = ? AND endpoint = ?").get(userId, endpoint));
+}
+function devicesOf(userId) {
+    return db
+        .prepare("SELECT endpoint, p256dh, auth FROM push_devices WHERE user_id = ?")
+        .all(userId)
+        .map((row) => ({ endpoint: row.endpoint, keys: { p256dh: row.p256dh, auth: row.auth } }));
+}
+/** Deliver to every device of the user; devices the push service no longer knows are forgotten. */
+export async function sendToUser(userId, payload, signal) {
+    const body = JSON.stringify(payload);
+    let delivered = 0;
+    for (const target of devicesOf(userId)) {
+        if (signal?.aborted)
+            break;
+        try {
+            await sender(target, body);
+            delivered++;
+        }
+        catch (error) {
+            const status = error.statusCode;
+            if (status === 404 || status === 410)
+                db.prepare("DELETE FROM push_devices WHERE endpoint = ?").run(target.endpoint);
+        }
+    }
+    return delivered;
+}
+function unreadTotal(userId) {
+    return db
+        .prepare(`SELECT COUNT(*) AS n FROM items i JOIN subscriptions s ON s.feed_id = i.feed_id AND s.user_id = ?
+       WHERE s.badge = 1 AND NOT EXISTS (SELECT 1 FROM item_reads r WHERE r.item_id = i.id AND r.user_id = ?)`)
+        .get(userId, userId).n;
+}
+/** A bounded article snapshot is selected by the outbox's committed upper item ID. */
+export function newItemsPushPayload(feed, userId, label, latest) {
+    const muted = db.prepare("SELECT keyword FROM user_muted_keywords WHERE user_id = ?")
+        .all(userId).map(row => row.keyword.toLowerCase());
+    const fresh = latest.filter(item => {
+        const text = `${item.title ?? ""} ${item.content_snippet ?? ""}`.toLowerCase();
+        return !muted.some(keyword => text.includes(keyword));
+    });
+    if (!fresh.length)
+        return null;
+    const first = fresh[0].title?.trim() || feed.url;
+    return {
+        title: label ?? feed.title ?? new URL(feed.url).hostname,
+        body: fresh.length > 1 ? `${first} (+${fresh.length - 1})` : first,
+        url: fresh.length === 1 ? `/items?feed=${feed.id}&article=${fresh[0].id}` : `/items?feed=${feed.id}`,
+        tag: `feed-${feed.id}`,
+        unread: unreadTotal(userId),
+    };
+}
+/** Tell the people who asked for it that a feed has new articles. */
+export async function notifyNewItems(feed, newItems, signal) {
+    const subscribers = db
+        .prepare("SELECT user_id, NULLIF(TRIM(label), '') AS label FROM subscriptions WHERE feed_id = ? AND notify = 1")
+        .all(feed.id);
+    if (subscribers.length === 0)
+        return;
+    const latest = db
+        .prepare("SELECT id, title, content_snippet FROM items WHERE feed_id = ? ORDER BY id DESC LIMIT ?")
+        .all(feed.id, Math.min(newItems, 10));
+    for (const subscriber of subscribers) {
+        if (signal?.aborted)
+            break;
+        const payload = newItemsPushPayload(feed, subscriber.user_id, subscriber.label, latest);
+        if (payload)
+            await sendToUser(subscriber.user_id, payload, signal);
+    }
+}
+//# sourceMappingURL=push.js.map