From 6832df6177ad973ad0e1b4f0a49d7a6da06c6e04 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Fri, 9 Oct 2026 12:08:31 +0200 Subject: feat: notifications on Android while closed, with nothing to install The phone fetches what is new every fifteen minutes with a poll secret (POST /v1/push/poll) that reads notification lines and nothing else. When a UnifiedPush distributor is already installed, the hub also pushes at once, encrypted to the phone (RFC 8291); losing the distributor falls back to fetching. The hub now honours "disable all notifications" itself: create_notification creates nothing for that account, as it already did for a muted group, so neither switch lets anything reach a phone. The interface used to be the only reader of the account-wide switch. Push endpoints are member-supplied URLs: a send refuses non-public addresses, connects to the address it checked, and follows no redirect. Android build untested here (no SDK on this machine). Co-Authored-By: Claude Opus 5.5 --- packages/meshbay-hub/tests/test_android_shell.py | 30 ++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) (limited to 'packages/meshbay-hub/tests/test_android_shell.py') diff --git a/packages/meshbay-hub/tests/test_android_shell.py b/packages/meshbay-hub/tests/test_android_shell.py index 71832f2..129732c 100644 --- a/packages/meshbay-hub/tests/test_android_shell.py +++ b/packages/meshbay-hub/tests/test_android_shell.py @@ -135,11 +135,15 @@ def test_the_shim_offers_desktop_channels_and_native_answers_each(): preload = set(re.findall(r"ipcRenderer\.invoke\('([\w:-]+)'", preload_js)) native = set() for path in (SRC / "bridge" / "Channels.kt", SRC / "bridge" / "KeyChannels.kt", - SRC / "cast" / "CastChannels.kt"): + SRC / "cast" / "CastChannels.kt", SRC / "notify" / "PushChannels.kt"): native |= set(re.findall(r'^\s*"([\w:-]+)" ->', _read(path), flags=re.M)) shim = _shim_channels() assert shim, "no channel found in the shim" - assert shim <= preload, f"channels the desktop does not have: {shim - preload}" + # A phone has a push distributor to talk to and a desktop does not; that + # family is the one the desktop lacks rather than the one it shares. + phone_only = {c for c in shim if c.startswith("push:")} + assert phone_only, "the push channels are gone from the shim" + assert shim - phone_only <= preload, f"channels the desktop does not have: {shim - preload}" assert shim == native, f"shim and native disagree: {shim ^ native}" @@ -196,6 +200,28 @@ def test_nothing_is_granted_and_video_may_go_fullscreen(): assert "override fun onHideCustomView" in activity +def test_a_notification_is_drawn_only_when_it_opened_and_leads_inside_the_page(): + """The distributor is another application: its receiver must not be ours + to call, a message nobody encrypted to this phone is not drawn, and the + link a notification carries is a route in the page, never a URL.""" + manifest = _read(APP / "src" / "main" / "AndroidManifest.xml") + service = manifest.split('android:name=".notify.PushReceiver"', 1)[1].split("", 1)[0] + assert 'android:exported="false"' in service + job = manifest.split('android:name=".notify.PollJob"', 1)[1].split("/>", 1)[0] + assert 'android:exported="false"' in job and "BIND_JOB_SERVICE" in job + # The background fetch carries the poll secret, never a session token. + poll = _read(SRC / "notify" / "PollJob.kt") + assert "/v1/push/poll" in poll and "Authorization" not in poll + receiver = _read(SRC / "notify" / "PushReceiver.kt") + assert "!message.decrypted" in receiver + notifier = _read(SRC / "notify" / "Notifier.kt") + assert 'Regex("^#/[A-Za-z0-9/_-]{0,200}$")' in notifier + assert "FLAG_IMMUTABLE" in notifier + activity = _read(SRC / "MainActivity.kt") + assert activity.count("Notifier.linkOf(intent)") == 2 + assert 'location.hash = ${JSONObject.quote(link)}' in activity + + def test_no_backup_carries_the_keys_away(): manifest = _read(APP / "src" / "main" / "AndroidManifest.xml") assert 'android:allowBackup="false"' in manifest -- cgit v1.2.3