[Adron]

Release notes

Push notifications (API Reference → Push Notifications) are built. All 17 operations work, and the 501 not_implemented stubs are gone. This is Phase 2 item 9 in PLAN.md.

What's in it

• internal/push: provider clients, with no database access.
  • APNs over HTTP/2 with ES256 provider tokens, cached for 50 minutes.
  • FCM HTTP v1 with service-account OAuth, with the access token cached.
  • Web Push with VAPID JWTs and RFC 8291 aes128gcm encryption. The encryption is verified byte for byte against the RFC's test vector.
  • Every provider answer is classified as sent, retry, token gone, credential rejected, or failed.
  • It also includes a recording fake for tests and a log backend for local runs.
• Migration 0003_push.sql (expand-only):
  • four tables, three of them under test/live row-level security;
  • applications.receives_platform_notifications;
  • notifications.send for superadmin;
  • four new audit actions.
• Endpoints:
  • Push credentials: managed by people only. Key material is write-only and KMS-encrypted, and VAPID keys are generated.
  • Devices: a token-keyed upsert, bound to the registering session, capped at 20 active per User per app. A token registered by another User moves to them, and the old device is deleted.
  • Send: an access check, the push preference, 60 per recipient per hour, the 4 KB payload check, and deliveries written in the same transaction.
  • Inbox: list, get with deliveries, state changes, mark-read, and unread counts.
• Delivery worker:
  • Deliveries are claimed with a lease, so no transaction stays open across a provider call.
  • Retries run within the TTL.
  • A gone token deactivates the device; a rejected credential is marked failed, its owner is emailed, and push_credential.failed fires.
  • Each notification's push summary is recomputed, firing notification.push_failed when nothing went out.
• Platform alerts: new sign-in, password and email changes, MFA disabled, refresh-token reuse, organization invitation, and developer-granted access. Each is raised before any session revocation in the same transaction, so the warning reaches the devices about to be signed out.
• Lifecycle:
  • Devices deactivate on every session revocation (logout, single revoke, password reset or change, token reuse, MFA reset) and on suspension or deletion.
  • Export, the erasure cascade, and the test-data purge cover the new data.
  • A daily push-maintenance job handles stale devices and inbox retention.
• Operations:
  • PUSH_BACKEND is live (production default) or log (local default).
  • Push shares the webhook SQS queue, worker Lambda, and 1-minute sweep, so there's no new infrastructure.
  • Terraform adds only the push-maintenance schedule.
• Docs:
  • The implementation-status notes are removed.
  • The schema now records the push-count columns.
  • The DEPLOYMENT, README, PLAN, and Changelog entries are updated.

No API shape changed, so openapi.yaml only loses the "returns 501" note on the Notifications tag.

Verification

• make check passes locally. That covers lint, gen-check, and every unit, integration, and contract test, including the new push suites. Every response in them is validated against openapi.yaml. It also covers the Lambda builds and terraform fmt.
• internal/push has provider protocol tests:
  • APNs against a real HTTP/2 TLS server, with ES256 signature verification;
  • FCM against a fake OAuth exchange and send;
  • Web Push against a fake push service that decrypts the payload;
  • the RFC 8291 test vector.
• The Quickstart passed against a local devserver, and a manual push flow on the devserver settled to sent through the in-process worker.
• staticcheck with CI's check set is clean on new code.
• The docs build, and every internal link resolves.

Before turning on live in production: each Application needs its own APNs, FCM, or Web Push credential configured. Until one exists, sends for that app settle as skipped: no_credentials.

🤖 Generated with Claude Code