Fixes

Author: lourou

prisma/migrations/20251003172324_add_v2_push_notification_models/migration.sql

@@ -27,6 +27,9 @@ CREATE TABLE "ClientIdentifier" (
 -- CreateIndex
 CREATE INDEX "DeviceRegistration_pushToken_idx" ON "DeviceRegistration"("pushToken");
 
+-- CreateIndex
+CREATE INDEX "DeviceRegistration_disabled_pushFailures_idx" ON "DeviceRegistration"("disabled", "pushFailures");
+
 -- CreateIndex
 CREATE INDEX "ClientIdentifier_deviceId_idx" ON "ClientIdentifier"("deviceId");
 

prisma/schema.prisma

@@ -192,6 +192,7 @@ model DeviceRegistration {
   clientIdentifiers ClientIdentifier[]
 
   @@index([pushToken])
+  @@index([disabled, pushFailures])
 }
 
 model ClientIdentifier {

src/api/shared/notifications/constants.ts

@@ -0,0 +1,9 @@
+/**
+ * Maximum number of consecutive push notification failures before disabling a device
+ */
+export const MAX_PUSH_FAILURES = 10;
+
+/**
+ * Maximum size in bytes for JWT metadata to prevent token bloat
+ */
+export const MAX_JWT_METADATA_SIZE = 1024; // 1KB

src/api/shared/notifications/webhook-handler.ts

@@ -13,6 +13,7 @@ import {
 import { getHttpDeliveryNotificationAuthHeader } from "@/notifications/utils";
 import { prisma } from "@/utils/prisma";
 import { createV2JwtToken } from "@/utils/v2/jwt";
+import { MAX_PUSH_FAILURES } from "./constants";
 
 const notificationClient = createNotificationClient();
 const pushNotificationService = getPushNotificationService();
@@ -186,7 +187,10 @@ async function handleV2Notification(args: {
   const { notification, client, req } = args;
 
   // Check if device is disabled or has too many failures
-  if (client.device.disabled || client.device.pushFailures >= 10) {
+  if (
+    client.device.disabled ||
+    client.device.pushFailures >= MAX_PUSH_FAILURES
+  ) {
     req.log.warn(
       `Device ${client.deviceId} is disabled or has too many failures. Skipping notification.`,
     );
@@ -264,7 +268,7 @@ async function handleV2Notification(args: {
       data: {
         pushFailures: newFailureCount,
         lastFailureAt: new Date(),
-        disabled: newFailureCount >= 10,
+        disabled: newFailureCount >= MAX_PUSH_FAILURES,
       },
     });
     req.log.warn(

src/api/v2/auth/auth.router.ts

@@ -1,6 +1,6 @@
 import { Router } from "express";
-import { authV2Middleware } from "@/middleware/v2/auth";
 import { authRateLimitMiddleware } from "@/middleware/rateLimit";
+import { authV2Middleware } from "@/middleware/v2/auth";
 import { generateToken } from "./handlers/generate-token";
 
 const authRouter = Router();

src/api/v2/auth/handlers/generate-token.ts

@@ -3,6 +3,22 @@ import { z } from "zod";
 import { prisma } from "@/utils/prisma";
 import { createV2JwtToken } from "@/utils/v2/jwt";
 
+/**
+ * Token Generation Security Model
+ *
+ * This endpoint generates short-lived JWT tokens for Gateway authentication:
+ *
+ * 1. The outer authV2Middleware validates the request using Firebase AppCheck,
+ *    which verifies the request originates from a legitimate app instance.
+ * 2. AppCheck validation is sufficient to prove device ownership - if a device
+ *    passes AppCheck, it's trusted to request tokens for any client identifier
+ *    associated with that device.
+ * 3. The clientIdentifier->deviceId mapping is validated in the database to
+ *    ensure the client belongs to the requesting device.
+ * 4. Rate limiting (10 requests per 15 minutes) prevents token exhaustion attacks.
+ * 5. Tokens are short-lived (15 minutes) to limit exposure window.
+ */
+
 const generateTokenRequestSchema = z.object({
   clientIdentifier: z.string(),
   deviceId: z.string(),

src/utils/v2/jwt.ts

@@ -1,4 +1,5 @@
 import * as jose from "jose";
+import { MAX_JWT_METADATA_SIZE } from "@/api/shared/notifications/constants";
 import { AppError } from "@/utils/errors";
 import logger from "@/utils/logger";
 import { tryCatch } from "@/utils/try-catch";
@@ -20,6 +21,17 @@ export const createV2JwtToken = async (args: {
   metadata?: V2JWTMetadata;
   expirationTime?: string;
 }) => {
+  // Validate metadata size to prevent JWT bloat
+  if (args.metadata) {
+    const metadataSize = JSON.stringify(args.metadata).length;
+    if (metadataSize > MAX_JWT_METADATA_SIZE) {
+      throw new AppError(
+        400,
+        `JWT metadata exceeds maximum size of ${MAX_JWT_METADATA_SIZE} bytes`,
+      );
+    }
+  }
+
   const payload: V2JWTPayload = {
     clientIdentifier: args.clientIdentifier,
     deviceId: args.deviceId,