feat(push): make gateway origin configurable

.env.example

@@ -75,10 +75,9 @@ RELAY_URL=ws://localhost:3000
 # BUZZ_WEB_DIR=./web/dist
 
 # NIP-PL mobile push is an explicit deployment opt-in. A gateway URL alone
-# never enables it. When enabled and the URL is absent, the canonical
-# https://push.buzz.xyz/v1/deliveries/apns endpoint is used.
+# never enables it. When enabled, the exact HTTPS delivery URL is required.
 BUZZ_PUSH_ENABLED=false
-# BUZZ_PUSH_GATEWAY_DELIVERY_URL=https://push.buzz.xyz/v1/deliveries/apns
+BUZZ_PUSH_GATEWAY_DELIVERY_URL=https://push.buzz.xyz/v1/deliveries/apns
 
 # -----------------------------------------------------------------------------
 # Admin Dashboard (private moderation surface)

.github/workflows/_ci-clients.yml

@@ -111,9 +111,9 @@ jobs:
       - name: Analyze
         run: cd mobile && flutter analyze
       - name: Test
-        run: cd mobile && flutter test
+        run: cd mobile && flutter test --dart-define=BUZZ_PUSH_GATEWAY_URL=https://push.example
       - name: Build Android debug APK
-        run: just mobile-build-android
+        run: BUZZ_PUSH_GATEWAY_URL=https://push.example just mobile-build-android
 
   mobile-swift:
     name: Mobile Swift
@@ -132,7 +132,7 @@ jobs:
       - name: Test
         run: swift test --package-path mobile/ios/BuzzPushKit
       - name: Build complete unsigned iOS release
-        run: cd mobile && flutter build ios --release --no-codesign --no-pub
+        run: cd mobile && flutter build ios --release --no-codesign --no-pub --dart-define=BUZZ_PUSH_GATEWAY_URL=https://push.example
 
   results:
     name: Results

AGENTS.md

@@ -691,7 +691,7 @@ The mobile app lives in `mobile/` — a Flutter app using Riverpod + Hooks.
 cd mobile
 dart format --output=none --set-exit-if-changed .
 flutter analyze
-flutter test
+flutter test --dart-define=BUZZ_PUSH_GATEWAY_URL=https://push.example
 ```
 
 Or from repo root: `just mobile-fmt` (auto-fix), `just mobile-check` (lint + fmt check), `just mobile-test` (tests).

Justfile

@@ -804,7 +804,7 @@ mobile-check:
 
 # Run mobile tests
 mobile-test:
-    unset GIT_DIR GIT_WORK_TREE; cd {{mobile_dir}} && flutter test
+    unset GIT_DIR GIT_WORK_TREE; cd {{mobile_dir}} && flutter test --dart-define=BUZZ_PUSH_GATEWAY_URL=https://push.example
 
 # Regenerate the emoji dataset asset from desktop's emoji-mart install.
 # Output is committed — rerun after bumping @emoji-mart/data.
@@ -813,8 +813,9 @@ mobile-emoji-data:
 
 # Compile an unsigned Android debug APK (worktree-aware debug identity)
 mobile-build-android:
+    test -n "${BUZZ_PUSH_GATEWAY_URL:-}" || { echo "BUZZ_PUSH_GATEWAY_URL is required" >&2; exit 1; }
     ./scripts/mobile-worktree-overrides.sh
-    unset GIT_DIR GIT_WORK_TREE; cd {{mobile_dir}} && flutter build apk --debug --no-pub
+    unset GIT_DIR GIT_WORK_TREE; cd {{mobile_dir}} && flutter build apk --debug --no-pub --dart-define="BUZZ_PUSH_GATEWAY_URL=${BUZZ_PUSH_GATEWAY_URL}"
 
 # Run the mobile app on iOS simulator (worktree-aware debug identity)
 mobile-dev:
@@ -825,9 +826,15 @@ mobile-dev:
         sleep 3
     fi
     ./scripts/mobile-worktree-overrides.sh
+    gateway_url="${BUZZ_PUSH_GATEWAY_URL:-}"
+    overrides_file="{{mobile_dir}}/ios/Flutter/AppOverrides.xcconfig"
+    if [[ -z "$gateway_url" && -f "$overrides_file" ]]; then
+        gateway_url="$(sed -nE 's/^[[:space:]]*BUZZ_PUSH_GATEWAY_URL[[:space:]]*=[[:space:]]*(.*[^[:space:]])[[:space:]]*$/\1/p' "$overrides_file" | tail -n 1 | sed 's/\$()//g')"
+    fi
+    test -n "$gateway_url" || { echo "BUZZ_PUSH_GATEWAY_URL is required in the environment or AppOverrides.xcconfig" >&2; exit 1; }
     cd {{mobile_dir}}
     unset GIT_DIR GIT_WORK_TREE
-    flutter run
+    flutter run --dart-define="BUZZ_PUSH_GATEWAY_URL=${gateway_url}"
 
 # Uninstall stale worktree-suffixed Buzz debug installs (production apps kept)
 mobile-clean:

crates/buzz-db/src/runtime/migration.rs

@@ -702,7 +702,7 @@ mod postgres_tests {
         let mut migrations: Vec<_> = MIGRATOR.iter().collect();
         migrations.sort_by_key(|migration| migration.version);
 
-        assert_eq!(migrations.len(), 44);
+        assert_eq!(migrations.len(), 45);
         assert_eq!(migrations[0].version, 1);
         assert_eq!(&*migrations[0].description, "initial schema");
         assert!(migrations[0]

crates/buzz-push-gateway/migrations/0005_retain_revocation_tombstones.sql

@@ -0,0 +1,15 @@
+-- Revoked installations remain as retry tombstones until authority expiry.
+-- Restrict ownership uniqueness to live rows so a replacement can enroll
+-- without deleting the old installation's idempotency state.
+ALTER TABLE push_gateway_installations
+    DROP CONSTRAINT push_gateway_installations_app_attest_key_id_key;
+ALTER TABLE push_gateway_installations
+    DROP CONSTRAINT push_gateway_installations_app_profile_token_fingerprint_key;
+
+CREATE UNIQUE INDEX push_gateway_installations_active_app_attest_key
+    ON push_gateway_installations (app_attest_key_id)
+    WHERE revoked_at IS NULL;
+
+CREATE UNIQUE INDEX push_gateway_installations_active_profile_token
+    ON push_gateway_installations (app_profile, token_fingerprint)
+    WHERE revoked_at IS NULL;