From 6bab5b4405c9adafb2ce76540595a62eea80acc0 Mon Sep 17 00:00:00 2001
From: Owen Jacobson <owen@grimoire.ca>
Date: Fri, 7 Nov 2025 21:39:39 -0500
Subject: De minimis "send me a notification" implementation.

When a user clicks "send a test notification," Pilcrow delivers a push message (with a fixed payload) to all active subscriptions. The included client then displays this as a notification, using browser APIs to do so. This lets us verify that push notification works, end to end - and it appears to.

The API endpoint for sending a test notification is not documented. I didn't feel it prudent to extensively document an endpoint that is intended to be temporary and whose side effects are very much subject to change. However, for posterity, the endpoint is

    POST /api/push/ping

    {}

and the push message payload is

    ping

Subscriptions with permanent delivery failures are nuked when we encounter them. Subscriptions with temporary failures cause the `ping` endpoint to return an internal server error, and are not retried. We'll likely want retry logic - including retry logic to handle server restarts - for any more serious use, but for a smoke test, giving up immediately is fine.

To make the push implementation testable, `App` is now generic over it. Tests use a dummy implementation that stores sent messages in memory. This has some significant limitations, documented in the test suite, but it beats sending real notifications to nowhere in tests.
---
 src/push/app.rs | 114 +++++++++++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 108 insertions(+), 6 deletions(-)

(limited to 'src/push/app.rs')

diff --git a/src/push/app.rs b/src/push/app.rs
index 358a8cc..56b9a02 100644
--- a/src/push/app.rs
+++ b/src/push/app.rs
@@ -1,17 +1,23 @@
+use futures::future::join_all;
+use itertools::Itertools as _;
 use p256::ecdsa::VerifyingKey;
 use sqlx::SqlitePool;
-use web_push::SubscriptionInfo;
+use web_push::{
+    ContentEncoding, PartialVapidSignatureBuilder, SubscriptionInfo, WebPushClient, WebPushError,
+    WebPushMessage, WebPushMessageBuilder,
+};
 
 use super::repo::Provider as _;
-use crate::{token::extract::Identity, vapid, vapid::repo::Provider as _};
+use crate::{login::Login, token::extract::Identity, vapid, vapid::repo::Provider as _};
 
-pub struct Push {
+pub struct Push<P> {
     db: SqlitePool,
+    webpush: P,
 }
 
-impl Push {
-    pub const fn new(db: SqlitePool) -> Self {
-        Self { db }
+impl<P> Push<P> {
+    pub const fn new(db: SqlitePool, webpush: P) -> Self {
+        Self { db, webpush }
     }
 
     pub async fn subscribe(
@@ -60,6 +66,76 @@ impl Push {
     }
 }
 
+impl<P> Push<P>
+where
+    P: WebPushClient,
+{
+    fn prepare_ping(
+        signer: &PartialVapidSignatureBuilder,
+        subscription: &SubscriptionInfo,
+    ) -> Result<WebPushMessage, WebPushError> {
+        let signature = signer.clone().add_sub_info(subscription).build()?;
+
+        let payload = "ping".as_bytes();
+
+        let mut message = WebPushMessageBuilder::new(subscription);
+        message.set_payload(ContentEncoding::Aes128Gcm, payload);
+        message.set_vapid_signature(signature);
+        let message = message.build()?;
+
+        Ok(message)
+    }
+
+    pub async fn ping(&self, recipient: &Login) -> Result<(), PushError> {
+        let mut tx = self.db.begin().await?;
+
+        let signer = tx.vapid().signer().await?;
+        let subscriptions = tx.push().by_login(recipient).await?;
+
+        let pings: Vec<_> = subscriptions
+            .into_iter()
+            .map(|sub| Self::prepare_ping(&signer, &sub).map(|message| (sub, message)))
+            .try_collect()?;
+
+        let deliveries = pings
+            .into_iter()
+            .map(async |(sub, message)| (sub, self.webpush.send(message).await));
+
+        let failures: Vec<_> = join_all(deliveries)
+            .await
+            .into_iter()
+            .filter_map(|(sub, result)| result.err().map(|err| (sub, err)))
+            .collect();
+
+        if !failures.is_empty() {
+            for (sub, err) in &failures {
+                match err {
+                    // I _think_ this is the complete set of permanent failures. See
+                    // <https://docs.rs/web-push/latest/web_push/enum.WebPushError.html> for a complete
+                    // list.
+                    WebPushError::Unauthorized(_)
+                    | WebPushError::InvalidUri
+                    | WebPushError::EndpointNotValid(_)
+                    | WebPushError::EndpointNotFound(_)
+                    | WebPushError::InvalidCryptoKeys
+                    | WebPushError::MissingCryptoKeys => {
+                        tx.push().unsubscribe(sub).await?;
+                    }
+                    _ => (),
+                }
+            }
+
+            return Err(PushError::Delivery(
+                failures.into_iter().map(|(_, err)| err).collect(),
+            ));
+        }
+
+        tx.commit().await?;
+
+        Ok(())
+    }
+}
+
 #[derive(Debug, thiserror::Error)]
 pub enum SubscribeError {
     #[error(transparent)]
@@ -74,3 +150,29 @@ pub enum SubscribeError {
     // client, which already knows the endpoint anyways and doesn't need us to tell them.
     Duplicate,
 }
+
+#[derive(Debug, thiserror::Error)]
+pub enum PushError {
+    #[error(transparent)]
+    Database(#[from] sqlx::Error),
+    #[error(transparent)]
+    Ecdsa(#[from] p256::ecdsa::Error),
+    #[error(transparent)]
+    Pkcs8(#[from] p256::pkcs8::Error),
+    #[error(transparent)]
+    WebPush(#[from] WebPushError),
+    #[error("push message delivery failures: {0:?}")]
+    Delivery(Vec<WebPushError>),
+}
+
+impl From<vapid::repo::Error> for PushError {
+    fn from(error: vapid::repo::Error) -> Self {
+        use vapid::repo::Error;
+        match error {
+            Error::Database(error) => error.into(),
+            Error::Ecdsa(error) => error.into(),
+            Error::Pkcs8(error) => error.into(),
+            Error::WebPush(error) => error.into(),
+        }
+    }
+}
-- 
cgit v1.2.3