feat(push): reader content and reply notification fan-out (#2812)

* feat(push): add reader content and reply notification fan-out

Extend push-protocol, relay bindings/preferences, and core push APIs so Yohaku readers can receive published content and comment-reply alerts without changing Space admin push.

* feat(push): scope relay binding API to the owning installation

Devices now read, update, and revoke their own binding with Installation
credentials, and a source claim no longer overwrites device-owned
preferences while it replaces or clears reader_id.

* refactor(push): anonymous activation with optional reader association

Remove reader-scoped push endpoints and PushAuth in favor of a single
public POST /notifications/push/activate that claims relay tickets with
an optional session reader_id. Relay owns device binding preferences;
core stores source metadata with nullable owner_id.

* test(push): assert single public activate route in OpenAPI manifest

Also simplify push repository PG e2e owner lookup with a direct eq() import.

* fix(push): make the rewritten binding-owner migration actually apply

Migration 0033 was rewritten in place from an expand-only
push_reader_preferences table into the owner_id relaxation, but kept the
abandoned revision's journal timestamp. The schema migrator draws its
waterline from ledger rows that match no bundled hash, so any database
that ran the abandoned revision recorded the rewrite as applied and
silently skipped its SQL, leaving owner_id NOT NULL and the orphaned
preferences table in place. Re-tag it with a later timestamp, drop the
abandoned table, and repair the 0033 snapshot id/prevId that had been
copied from 0032 (drizzle-kit check reported the collision).

Activation also takes the optional reader id last, matching how the other
public reader-aware controllers declare it.

* feat(push): enrich reply and content notifications for APNs UI

Project public display metadata into push events, skip content publishes
without a summary, and build localized APNs payloads with mutable-content
for Communication Notifications on comment replies.

* fix(push): close review blockers before reader push merge

Prevent private content metadata from reaching push payloads, reject encoded
path traversal, and move Space iOS binding status and revoke operations to the
installation-authenticated Relay API after removing the legacy core routes.

Author: Innei

.gitignore

@@ -46,6 +46,8 @@ run
 /data
 /assets
 .env
+.env.local
+apps/push-relay/.env.local
 
 scripts/workflow/docker-compose.yml
 scripts/workflow/data

apps/core/openapi.json

@@ -245,16 +245,11 @@
     "/notifications/push/activate": {
       "post": {
         "operationId": "activatePushNotifications",
-        "summary": "Bind this authenticated owner installation to a Push Relay",
+        "summary": "Claim a Push Relay activation ticket for this device, optionally associating the current reader",
         "tags": [
           "notifications"
         ],
         "parameters": [],
-        "security": [
-          {
-            "bearerAuth": []
-          }
-        ],
         "requestBody": {
           "required": true,
           "content": {
@@ -310,115 +305,6 @@
         }
       }
     },
-    "/notifications/push/status": {
-      "get": {
-        "operationId": "getPushNotificationStatus",
-        "summary": "Read the current owner push binding status",
-        "tags": [
-          "notifications"
-        ],
-        "parameters": [],
-        "security": [
-          {
-            "bearerAuth": []
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "OK",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object",
-                  "required": [
-                    "data"
-                  ],
-                  "properties": {
-                    "data": {
-                      "$ref": "#/components/schemas/PushStatus"
-                    },
-                    "meta": {
-                      "$ref": "#/components/schemas/ResponseMeta"
-                    }
-                  }
-                }
-              }
-            }
-          },
-          "4XX": {
-            "description": "Error",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorEnvelope"
-                }
-              }
-            }
-          },
-          "5XX": {
-            "description": "Error",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorEnvelope"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
-    "/notifications/push/{binding_id}": {
-      "delete": {
-        "operationId": "deactivatePushNotifications",
-        "summary": "Revoke one mobile push binding",
-        "tags": [
-          "notifications"
-        ],
-        "parameters": [
-          {
-            "name": "binding_id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string",
-              "minLength": 1,
-              "maxLength": 128
-            }
-          }
-        ],
-        "security": [
-          {
-            "bearerAuth": []
-          }
-        ],
-        "responses": {
-          "204": {
-            "description": "No Content"
-          },
-          "4XX": {
-            "description": "Error",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorEnvelope"
-                }
-              }
-            }
-          },
-          "5XX": {
-            "description": "Error",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorEnvelope"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
     "/aggregate/desk": {
       "get": {
         "operationId": "getDesk",
@@ -2236,29 +2122,6 @@
         ],
         "additionalProperties": false
       },
-      "PushStatus": {
-        "type": "object",
-        "properties": {
-          "configured": {
-            "type": "boolean"
-          },
-          "enabled": {
-            "type": "boolean"
-          },
-          "relay_url": {
-            "type": "string",
-            "format": "uri"
-          },
-          "binding_id": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "configured",
-          "enabled"
-        ],
-        "additionalProperties": false
-      },
       "Desk": {
         "type": "object",
         "properties": {

apps/core/src/common/openapi/route-manifest.ts

@@ -26,8 +26,6 @@ import { NoteViews } from '~/modules/note/note.views'
 import {
   PushActivationRequestSchema,
   PushActivationResponseSchema,
-  PushBindingIdParamSchema,
-  PushStatusResponseSchema,
 } from '~/modules/push/push.schema'
 import {
   RecentlyRefCandidatesQuerySchema,
@@ -148,8 +146,9 @@ export const routeManifest: readonly OpenApiRoute[] = [
     method: 'post',
     path: '/notifications/push/activate',
     tag: 'notifications',
-    summary: 'Bind this authenticated owner installation to a Push Relay',
-    auth: true,
+    summary:
+      'Claim a Push Relay activation ticket for this device, optionally associating the current reader',
+    auth: false,
     body: {
       name: 'PushActivationRequest',
       schema: PushActivationRequestSchema,
@@ -159,27 +158,6 @@ export const routeManifest: readonly OpenApiRoute[] = [
       schema: PushActivationResponseSchema,
     },
   },
-  {
-    operationId: 'getPushNotificationStatus',
-    method: 'get',
-    path: '/notifications/push/status',
-    tag: 'notifications',
-    summary: 'Read the current owner push binding status',
-    auth: true,
-    response: {
-      name: 'PushStatus',
-      schema: PushStatusResponseSchema,
-    },
-  },
-  {
-    operationId: 'deactivatePushNotifications',
-    method: 'delete',
-    path: '/notifications/push/:bindingId',
-    tag: 'notifications',
-    summary: 'Revoke one mobile push binding',
-    auth: true,
-    params: PushBindingIdParamSchema,
-  },
 
   {
     operationId: 'getDesk',

apps/core/src/database/migrations/0033_push_binding_optional_owner.sql

@@ -0,0 +1,10 @@
+-- An earlier revision of this migration created "push_reader_preferences"
+-- before Relay took ownership of per-device preferences. Databases that applied
+-- it still carry the table, so retire it here rather than leaving it orphaned.
+DROP TABLE IF EXISTS "push_reader_preferences";
+--> statement-breakpoint
+ALTER TABLE "push_relay_bindings" DROP CONSTRAINT "push_relay_bindings_owner_id_readers_id_fk";
+--> statement-breakpoint
+ALTER TABLE "push_relay_bindings" ALTER COLUMN "owner_id" DROP NOT NULL;
+--> statement-breakpoint
+ALTER TABLE "push_relay_bindings" ADD CONSTRAINT "push_relay_bindings_owner_id_readers_id_fk" FOREIGN KEY ("owner_id") REFERENCES "public"."readers"("id") ON DELETE set null ON UPDATE no action;