Notifications that arrive when ihasmail is closed

ihasmail's notifications came from EventSource, which lives exactly as long as a tab does -- so "desktop notifications" has always quietly meant "while you are looking". That switch is now labelled as much, and a second one does the thing people assumed the first one did. Stalwart 0.16 signs Web Push with VAPID (RFC 9749) and can put the message itself in the payload (draft-ietf-jmap-emailpush). The server pushes straight to the browser's own push service: ihasmail's server is not in the delivery path, there is no relay to run, and nothing beyond the browser vendor's endpoint that Web Push requires of everyone. Checked against the live 0.16.19 before any of this was written, because an advertised capability is not a configured one: - the session publishes a real applicationServerKey, so no key generation or server configuration is needed - PushSubscription/get answers an ordinary user rather than refusing - emailpush is advertised, and its draft defines a filter, an ordered properties list and an urgency -- so the payload can carry sender and subject, and the server drops properties from the end when it will not fit rather than failing the notification Three things this gets right that are easy to get wrong: - The verification handshake. A JMAP subscription delivers nothing until the client echoes back a code the server pushed, and the service worker cannot answer it -- no credentials in that context. It forwards the code to a tab, or leaves it in the cache when no tab was open to forward it to. - Key encoding. The W3C Push API produces unpadded base64url and Stalwart 0.16 was fixed to accept exactly that, so nothing here pads on the way out. The VAPID key needs padding on the way *in* for atob; getting that backwards fails at subscribe() with an opaque error, so it lives in one named function with tests. - Sign-out. A subscription belongs to the account, not the session. Without tearing it down, a shared machine keeps notifying for a mailbox nobody is signed into -- which is somebody else's mail. The mock models the JMAP half, including refusing padded keys and non-https endpoints, and creating subscriptions *unverified*. Delivery cannot be mocked -- it runs through the browser vendor's real push service -- but a mock that marked a subscription verified on creation would let a client ship without the handshake, and the symptom in production is "registered, and silent". Not verified end to end: an actual notification arriving. That needs a real browser, a real push service and real delivery, so it is live testing or nothing.
2026-08-26 13:51:09 -07:00
parent e2f17f6f49
commit 96bc7b53d7
9 changed files with 648 additions and 4 deletions
@@ -0,0 +1,130 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { client } from "@/jmap/client";
+import {
+  applicationServerKey,
+  decodeApplicationServerKey,
+  encodeKey,
+  subscriptionPayload,
+  supportsEmailPush,
+  webPushAvailable,
+} from "@/lib/webpush";
+import type { JmapSession } from "@/jmap/types";
+
+/**
+ * The key encoding is where this breaks silently. `subscribe()` fails with an
+ * opaque error on a mis-decoded VAPID key, and Stalwart 0.16 had to be fixed to
+ * accept the *unpadded* base64url the W3C Push API produces — so re-padding on
+ * the way out would be sending a shape the server has not been tested against.
+ *
+ * The real key from the live 0.16.19 is used below rather than a made-up one:
+ * its length is what exercises the padding arithmetic.
+ */
+const LIVE_KEY = "BBvig2GPmqohMJJHMzp6bTKviHibYiVCyAY8gdq2fPhS-9YfO9_0TnhMyZ0a0JxTsbCqd3zm1rEiXsXsL3jveJY";
+
+function session(caps: Record<string, unknown>): JmapSession {
+  return { capabilities: caps, accounts: {}, primaryAccounts: {}, state: "s" } as unknown as JmapSession;
+}
+
+afterEach(() => {
+  client.session = null;
+  vi.unstubAllGlobals();
+});
+
+describe("the VAPID key", () => {
+  it("is read from the capability the server publishes", () => {
+    client.session = session({ "urn:ietf:params:jmap:webpush-vapid": { applicationServerKey: LIVE_KEY } });
+    expect(applicationServerKey()).toBe(LIVE_KEY);
+  });
+
+  it("is null when the server does not do Web Push, rather than an empty string", () => {
+    client.session = session({ "urn:ietf:params:jmap:core": {} });
+    expect(applicationServerKey()).toBeNull();
+  });
+
+  it("decodes to the 65 bytes of an uncompressed P-256 point", () => {
+    const buf = decodeApplicationServerKey(LIVE_KEY);
+    expect(buf.byteLength).toBe(65);
+    // 0x04 marks an uncompressed EC point; the Push API rejects anything else.
+    expect(new Uint8Array(buf)[0]).toBe(0x04);
+  });
+
+  it("handles base64url without padding, which is how it arrives", () => {
+    expect(LIVE_KEY).not.toContain("=");
+    expect(LIVE_KEY).toMatch(/[-_]/);
+    expect(() => decodeApplicationServerKey(LIVE_KEY)).not.toThrow();
+  });
+
+  it("returns an ArrayBuffer, which is what subscribe() accepts", () => {
+    expect(decodeApplicationServerKey(LIVE_KEY)).toBeInstanceOf(ArrayBuffer);
+  });
+});
+
+describe("encoding keys for the server", () => {
+  it("produces unpadded base64url, the form Stalwart was fixed to accept", () => {
+    // 5 bytes: a length that would be padded with "===" in standard base64.
+    const buf = new Uint8Array([1, 2, 3, 4, 5]).buffer;
+    const out = encodeKey(buf);
+    expect(out).not.toContain("=");
+    expect(out).not.toContain("+");
+    expect(out).not.toContain("/");
+  });
+
+  it("round-trips through the decoder", () => {
+    const bytes = new Uint8Array([0, 255, 128, 64, 32, 16]);
+    expect(new Uint8Array(decodeApplicationServerKey(encodeKey(bytes.buffer)))).toEqual(bytes);
+  });
+
+  it("gives an empty string rather than throwing on a missing key", () => {
+    expect(encodeKey(null)).toBe("");
+  });
+});
+
+describe("what gets registered", () => {
+  const fakeSub = {
+    endpoint: "https://push.example/abc",
+    toJSON: () => ({ keys: { p256dh: "cGRoLWtleQ", auth: "YXV0aA" } }),
+    getKey: () => null,
+  } as unknown as PushSubscription;
+
+  it("asks for the message itself when the server supports emailpush", () => {
+    client.session = session({
+      "urn:ietf:params:jmap:webpush-vapid": { applicationServerKey: LIVE_KEY },
+      "urn:ietf:params:jmap:emailpush": {},
+    });
+    const body = subscriptionPayload(fakeSub, "a1") as Record<string, any>;
+    expect(body.url).toBe("https://push.example/abc");
+    expect(body.keys).toEqual({ p256dh: "cGRoLWtleQ", auth: "YXV0aA" });
+    expect(body.emailPush.a1.properties).toContain("subject");
+    expect(body.emailPush.a1.properties).toContain("from");
+    // Order is priority: the server drops from the end when the payload is
+    // too large, so the sender must outrank the preview.
+    const props: string[] = body.emailPush.a1.properties;
+    expect(props.indexOf("from")).toBeLessThan(props.indexOf("preview"));
+  });
+
+  it("omits emailPush entirely when the server does not support it", () => {
+    client.session = session({ "urn:ietf:params:jmap:webpush-vapid": { applicationServerKey: LIVE_KEY } });
+    expect(supportsEmailPush()).toBe(false);
+    expect(subscriptionPayload(fakeSub, "a1")).not.toHaveProperty("emailPush");
+  });
+
+  it("omits emailPush when there is no account to scope it to", () => {
+    client.session = session({
+      "urn:ietf:params:jmap:webpush-vapid": { applicationServerKey: LIVE_KEY },
+      "urn:ietf:params:jmap:emailpush": {},
+    });
+    expect(subscriptionPayload(fakeSub, null)).not.toHaveProperty("emailPush");
+  });
+
+  it("subscribes to Email changes only, since EventSource covers an open tab", () => {
+    client.session = session({ "urn:ietf:params:jmap:webpush-vapid": { applicationServerKey: LIVE_KEY } });
+    expect((subscriptionPayload(fakeSub, "a1") as Record<string, unknown>).types).toEqual(["Email"]);
+  });
+});
+
+describe("availability", () => {
+  it("is false without a push key, however capable the browser", () => {
+    client.session = session({ "urn:ietf:params:jmap:core": {} });
+    expect(webPushAvailable()).toBe(false);
+  });
+});