Add web push

app/push/manager.py

@@ -0,0 +1,148 @@
+"""Web Push dispatch manager.
+
+Handles filtering subscriptions by their preferences and sending push
+notifications concurrently when a new message arrives.
+"""
+
+import asyncio
+import json
+import logging
+
+from pywebpush import WebPushException
+
+from app.push.send import send_push
+from app.push.vapid import get_vapid_private_key
+from app.repository.push_subscriptions import PushSubscriptionRepository
+
+logger = logging.getLogger(__name__)
+
+_SEND_TIMEOUT = 10  # seconds per push send
+_VAPID_CLAIMS = {"sub": "mailto:noreply@meshcore.local"}
+
+
+def _state_key_for_message(data: dict) -> str:
+    """Derive the conversation state key from a message event payload."""
+    msg_type = data.get("type", "")
+    conversation_key = data.get("conversation_key", "")
+    if msg_type == "PRIV":
+        return f"contact-{conversation_key}"
+    return f"channel-{conversation_key}"
+
+
+def _matches_filter(sub: dict, data: dict) -> bool:
+    """Check whether a message event matches a subscription's filter."""
+    mode = sub.get("filter_mode", "all_messages")
+    if mode == "all_messages":
+        return True
+    if mode == "all_dms":
+        return data.get("type") == "PRIV"
+    if mode == "selected":
+        key = _state_key_for_message(data)
+        return key in (sub.get("filter_conversations") or [])
+    return False
+
+
+def _build_payload(data: dict) -> str:
+    """Build the push notification JSON payload from a message event."""
+    msg_type = data.get("type", "")
+    text = data.get("text", "")
+    sender_name = data.get("sender_name") or ""
+    channel_name = data.get("channel_name") or ""
+
+    if msg_type == "PRIV":
+        title = f"Message from {sender_name}" if sender_name else "New direct message"
+        body = text
+    else:
+        # Channel messages include "SenderName: text" in the text field
+        title = f"#{channel_name}" if channel_name else "Channel message"
+        body = text
+
+    conversation_key = data.get("conversation_key", "")
+    if msg_type == "PRIV":
+        url_hash = f"#contact/{conversation_key}"
+    else:
+        url_hash = f"#channel/{conversation_key}"
+
+    return json.dumps(
+        {
+            "title": title,
+            "body": body,
+            "tag": f"meshcore-{data.get('id', '')}",
+            "url_hash": url_hash,
+        }
+    )
+
+
+def _subscription_info(sub: dict) -> dict:
+    """Build the subscription_info dict that pywebpush expects."""
+    return {
+        "endpoint": sub["endpoint"],
+        "keys": {
+            "p256dh": sub["p256dh"],
+            "auth": sub["auth"],
+        },
+    }
+
+
+class PushManager:
+    async def dispatch_message(self, data: dict) -> None:
+        """Send push notifications for a message event to matching subscriptions."""
+        # Don't notify for messages the operator just sent themselves
+        if data.get("outgoing"):
+            return
+
+        try:
+            subs = await PushSubscriptionRepository.get_all()
+        except Exception:
+            logger.debug("Push dispatch: failed to load subscriptions", exc_info=True)
+            return
+
+        if not subs:
+            return
+
+        matching = [s for s in subs if _matches_filter(s, data)]
+        if not matching:
+            return
+
+        payload = _build_payload(data)
+        vapid_key = get_vapid_private_key()
+        if not vapid_key:
+            logger.debug("Push dispatch: no VAPID key configured, skipping")
+            return
+
+        tasks = [self._send_one(sub, payload, vapid_key) for sub in matching]
+        await asyncio.gather(*tasks, return_exceptions=True)
+
+    async def _send_one(self, sub: dict, payload: str, vapid_key: str) -> None:
+        sub_id = sub["id"]
+        try:
+            async with asyncio.timeout(_SEND_TIMEOUT):
+                await send_push(
+                    subscription_info=_subscription_info(sub),
+                    payload=payload,
+                    vapid_private_key=vapid_key,
+                    vapid_claims=_VAPID_CLAIMS,
+                )
+            await PushSubscriptionRepository.record_success(sub_id)
+        except WebPushException as e:
+            status = getattr(e, "response", None)
+            status_code = getattr(status, "status_code", 0) if status else 0
+            if status_code in (404, 410):
+                logger.info(
+                    "Push subscription expired (HTTP %d), removing %s",
+                    status_code,
+                    sub_id,
+                )
+                await PushSubscriptionRepository.delete(sub_id)
+            else:
+                logger.warning("Push send failed for %s: %s", sub_id, e)
+                await PushSubscriptionRepository.record_failure(sub_id)
+        except TimeoutError:
+            logger.warning("Push send timed out for %s", sub_id)
+            await PushSubscriptionRepository.record_failure(sub_id)
+        except Exception:
+            logger.debug("Push send error for %s", sub_id, exc_info=True)
+            await PushSubscriptionRepository.record_failure(sub_id)
+
+
+push_manager = PushManager()

app/push/send.py

@@ -0,0 +1,45 @@
+"""Thin wrapper around pywebpush for sending push notifications.
+
+Isolates the pywebpush dependency and runs the synchronous send in
+a thread executor to avoid blocking the event loop.
+"""
+
+import asyncio
+import logging
+
+from pywebpush import webpush
+
+logger = logging.getLogger(__name__)
+
+
+async def send_push(
+    subscription_info: dict,
+    payload: str,
+    vapid_private_key: str,
+    vapid_claims: dict,
+) -> int:
+    """Send an encrypted push notification.
+
+    Args:
+        subscription_info: {"endpoint": ..., "keys": {"p256dh": ..., "auth": ...}}
+        payload: JSON string to encrypt and send
+        vapid_private_key: PEM-encoded VAPID private key
+        vapid_claims: {"sub": "mailto:..."} or {"sub": "https://..."}
+
+    Returns:
+        HTTP status code from the push service.
+
+    Raises:
+        WebPushException: on push service error (caller handles 404/410 cleanup).
+    """
+    loop = asyncio.get_running_loop()
+    response = await loop.run_in_executor(
+        None,
+        lambda: webpush(
+            subscription_info=subscription_info,
+            data=payload,
+            vapid_private_key=vapid_private_key,
+            vapid_claims=vapid_claims,
+        ),
+    )
+    return response.status_code  # type: ignore[union-attr]

app/push/vapid.py

@@ -0,0 +1,65 @@
+"""VAPID key management for Web Push.
+
+Generates a P-256 key pair on first use and caches it in app_settings.
+The public key is served to browsers for PushManager.subscribe().
+"""
+
+import base64
+import logging
+
+from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat
+from py_vapid import Vapid
+
+from app.database import db
+
+logger = logging.getLogger(__name__)
+
+_cached_private_key: str = ""
+_cached_public_key: str = ""
+
+
+async def ensure_vapid_keys() -> tuple[str, str]:
+    """Read or generate VAPID keys. Call once at startup after DB connect."""
+    global _cached_private_key, _cached_public_key
+
+    cursor = await db.conn.execute(
+        "SELECT vapid_private_key, vapid_public_key FROM app_settings WHERE id = 1"
+    )
+    row = await cursor.fetchone()
+
+    if row and row["vapid_private_key"] and row["vapid_public_key"]:
+        _cached_private_key = row["vapid_private_key"]
+        _cached_public_key = row["vapid_public_key"]
+        logger.info("VAPID keys loaded from database")
+        return _cached_private_key, _cached_public_key
+
+    # Generate new key pair
+    vapid = Vapid()
+    vapid.generate_keys()
+
+    # Private key as PEM for pywebpush
+    _cached_private_key = vapid.private_pem().decode("utf-8")
+
+    # Public key as uncompressed P-256 point, base64url-encoded (no padding)
+    # for the browser Push API's applicationServerKey
+    raw_pub = vapid.public_key.public_bytes(Encoding.X962, PublicFormat.UncompressedPoint)  # type: ignore[union-attr]
+    _cached_public_key = base64.urlsafe_b64encode(raw_pub).rstrip(b"=").decode("ascii")
+
+    await db.conn.execute(
+        "UPDATE app_settings SET vapid_private_key = ?, vapid_public_key = ? WHERE id = 1",
+        (_cached_private_key, _cached_public_key),
+    )
+    await db.conn.commit()
+    logger.info("Generated and stored new VAPID key pair")
+
+    return _cached_private_key, _cached_public_key
+
+
+def get_vapid_public_key() -> str:
+    """Return the cached VAPID public key (base64url). Must call ensure_vapid_keys() first."""
+    return _cached_public_key
+
+
+def get_vapid_private_key() -> str:
+    """Return the cached VAPID private key (PEM). Must call ensure_vapid_keys() first."""
+    return _cached_private_key