R9 Web Push, then the honest version: VAPID key, push subscriptions, encrypted pushes, 4.5.0 advertised

The server's VAPID key (PushKeys, made on first need, in Mongo) is the instance API's vapid.public_key and every app's
vapid_key. /api/v1/push/subscription (POST, GET, PUT, DELETE) keeps one subscription per access token, so per persona;
every notification kept (never a filtered one) is queued as a SendPush job for the subscriptions whose alert and policy
admit it, and sent through the `push` client (the safe handler, https only) encrypted as RFC 8291 aes128gcm or the
aesgcm draft with an ES256 VAPID JWT. 404/410 delete the subscription, 429/5xx/timeouts retry, other answers drop the
push. Subscriptions end with their tokens (revocation, sessions ended, suspension, deletion, a restore); backups hold
neither keys nor subscriptions. The walk of every Mastodon 4.3-4.5 client route (docs/MASTODON-API.md) added
conversations/:id/unread, domain_blocks/preview, v2 notifications clear and PUT policy, /oauth/userinfo and stubs, so both
instance APIs now say 4.5.0 (compatible; PrivaPub <release>). The pasture gets a push sink (pushsink.test) and
scenarios/push.sh in batch A.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Api/Mastodon/Auth/OAuthSetup.cs

@@ -72,6 +72,23 @@ namespace PrivaPub.Api.Mastodon.Auth
 					options.AddEventHandler<ApplyAuthorizationResponseContext>(builder => builder.UseInlineHandler(OutOfBandCode)
 						.SetOrder(OpenIddictServerAspNetCoreHandlers.Authentication.ProcessFormPostResponse.Descriptor.Order - 1_000)
 						.SetType(OpenIddictServerHandlerType.Custom));
+					// a revoked token takes its Web Push subscription with it (R9), once OpenIddict has revoked it
+					options.AddEventHandler<HandleRevocationRequestContext>(builder => builder.UseInlineHandler(async context =>
+						{
+							if (context.GenericTokenPrincipal?.GetTokenId() is { Length: > 0 } tokenId)
+								await PrivaPub.Domain.Social.WebPush.ForgetToken(tokenId);
+						})
+						.SetOrder(OpenIddictServerHandlers.Revocation.RevokeToken.Descriptor.Order + 1_000)
+						.SetType(OpenIddictServerHandlerType.Custom));
+					// Mastodon 4.4's userinfo (Controllers/UserinfoController), named in the authorization server's metadata
+					options.AddEventHandler<HandleConfigurationRequestContext>(builder => builder.UseInlineHandler(context =>
+						{
+							if (context.Issuer != default)
+								context.UserInfoEndpoint = new Uri(context.Issuer, Controllers.UserinfoController.Path.TrimStart('/'));
+							return default;
+						})
+						.SetOrder(OpenIddictServerHandlers.Discovery.AttachEndpoints.Descriptor.Order + 1_000)
+						.SetType(OpenIddictServerHandlerType.Custom));
 					options.AddEventHandler<ApplyTokenResponseContext>(builder => builder.UseInlineHandler(context =>
 					{
 						if (context.Response.AccessToken != default)

PrivaPub/Api/Mastodon/Auth/PersonaExchange.cs

@@ -27,6 +27,9 @@ namespace PrivaPub.Api.Mastodon.Auth
 		public static string FirstPartyClientId(IConfiguration configuration) =>
 			configuration["ClientApi:FirstPartyClientId"] is { Length: > 0 } clientId ? clientId : "decepub";
 
+		// what the first-party client's persona tokens may hold: push since R9, so decePub can subscribe to Web Push
+		public static readonly string[] FirstPartyScopes = { "read", "write", "follow", "push" };
+
 		//the first-party application: public (a browser keeps no secret), token exchange only, no redirect
 		public static async Task EnsureFirstPartyClient(IServiceProvider services, CancellationToken token)
 		{
@@ -46,7 +49,7 @@ namespace PrivaPub.Api.Mastodon.Auth
 					Permissions.GrantTypes.TokenExchange
 				}
 			};
-			foreach (var scopeName in new[] { "read", "write", "follow" })
+			foreach (var scopeName in FirstPartyScopes)
 				descriptor.Permissions.Add(Permissions.Prefixes.Scope + scopeName);
 
 			var existing = await applications.FindByClientIdAsync(clientId, token);

PrivaPub/Api/Mastodon/Auth/TokenController.cs

@@ -70,7 +70,7 @@ namespace PrivaPub.Api.Mastodon.Auth
 			var identity = new ClaimsIdentity(TokenValidationParameters.DefaultAuthenticationType, Claims.Name, Claims.Role);
 			identity.SetClaim(Claims.Subject, avatar.ID);
 			identity.SetClaim(Claims.Name, avatar.UserName);
-			identity.SetScopes(MastodonScopes.Parse(request.Scope).Intersect(new[] { "read", "write", "follow" }));
+			identity.SetScopes(MastodonScopes.Parse(request.Scope).Intersect(PersonaExchange.FirstPartyScopes));
 			identity.SetDestinations(_ => new[] { Destinations.AccessToken });
 			return SignIn(new ClaimsPrincipal(identity), OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
 		}

PrivaPub/Api/Mastodon/Controllers/AccountsController.cs

@@ -47,7 +47,8 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			_outbox = outbox;
 		}
 
-		[HttpGet("/api/v1/accounts/verify_credentials"), Scope("read:accounts")]
+		// Mastodon 4.4: a token with the profile scope alone may read it too
+		[HttpGet("/api/v1/accounts/verify_credentials"), Scope("read:accounts|profile")]
 		public async Task<IActionResult> VerifyCredentials(CancellationToken token) => Json(await _mapper.Local(Me, withSource: true, token));
 
 		[HttpPatch("/api/v1/accounts/update_credentials"), Scope("write:accounts"), EnableRateLimiting(RateLimiting.Uploads), RequestSizeLimit(20 * 1024 * 1024),
@@ -398,6 +399,28 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		public async Task<IActionResult> DomainBlocks(CancellationToken token) =>
 			Json((await DB.Default.Find<AccountDomainBlock>().Match(b => b.AvatarId == MyId).Sort(b => b.Domain, Order.Ascending).ExecuteAsync(token)).Select(b => b.Domain).ToList());
 
+		// Mastodon's preview of a server block: how many of the accounts the persona follows, and of those following it, the
+		// block would take away, counted as BlockDomain takes them (an account on the server or a subdomain, or whose handle
+		// is)
+		[HttpGet("/api/v1/domain_blocks/preview"), Scope("write:blocks")]
+		public async Task<IActionResult> PreviewDomainBlock(CancellationToken token)
+		{
+			var domain = Params.Get("domain")?.Trim().ToLowerInvariant();
+			if (string.IsNullOrEmpty(domain))
+				return Error(StatusCodes.Status400BadRequest, "Param is missing or the value is empty: domain");
+			if (Uri.CheckHostName(domain) != UriHostNameType.Dns)
+				return Error(StatusCodes.Status422UnprocessableEntity, "Validation failed: Domain is invalid");
+			var followings = await _dbEntities.Followings.Match(f => f.AvatarId == MyId && !f.TargetIsLocal && f.State == FollowState.Accepted)
+				.ExecuteAsync(token);
+			var followers = await _dbEntities.Followers.Match(f => f.LocalActorId == MyId && f.IsAccepted).ExecuteAsync(token);
+			var handles = await Hidden.HandleDomains(followings.Select(f => f.TargetActorURI).Concat(followers.Select(f => f.ActorURI)).ToList(), token);
+			return Json(new
+			{
+				following_count = followings.Count(f => Hidden.Blocks(domain, f.TargetActorURI, handles.GetValueOrDefault(f.TargetActorURI))),
+				followers_count = followers.Count(f => Hidden.Blocks(domain, f.ActorURI, handles.GetValueOrDefault(f.ActorURI)))
+			});
+		}
+
 		[HttpPost("/api/v1/domain_blocks"), Scope("write:blocks")]
 		public async Task<IActionResult> BlockDomain(CancellationToken token)
 		{

PrivaPub/Api/Mastodon/Controllers/AppsController.cs

@@ -16,10 +16,12 @@ namespace PrivaPub.Api.Mastodon.Controllers
 	public class AppsController : MastodonController
 	{
 		readonly IOpenIddictApplicationManager _applications;
+		readonly PrivaPub.Infrastructure.Push.IVapid _vapid;
 
-		public AppsController(IOpenIddictApplicationManager applications)
+		public AppsController(IOpenIddictApplicationManager applications, PrivaPub.Infrastructure.Push.IVapid vapid)
 		{
 			_applications = applications;
+			_vapid = vapid;
 		}
 
 		[HttpPost("/api/v1/apps"), AllowAnonymous]
@@ -69,7 +71,8 @@ namespace PrivaPub.Api.Mastodon.Controllers
 				RedirectUris = redirects,
 				RedirectUri = string.Join("\n", redirects),
 				ClientId = descriptor.ClientId,
-				ClientSecret = descriptor.ClientSecret
+				ClientSecret = descriptor.ClientSecret,
+				VapidKey = (await _vapid.Key(token)).ForApi//Web Push's server key, as Mastodon still gives it here
 			});
 		}
 
@@ -88,7 +91,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 				website = properties.TryGetValue("website", out var website) ? website.GetString() : default,
 				scopes = User.GetScopes().ToList(),
 				redirect_uris = (await _applications.GetRedirectUrisAsync(application, token)).ToList(),
-				vapid_key = string.Empty
+				vapid_key = (await _vapid.Key(token)).ForApi
 			});
 		}
 

PrivaPub/Api/Mastodon/Controllers/InstanceController.cs

@@ -28,7 +28,19 @@ namespace PrivaPub.Api.Mastodon.Controllers
 	// are enforced.
 	public class InstanceController : MastodonController
 	{
-		public const string Version = "4.2.0 (compatible; PrivaPub)";
+		// The Mastodon version this API answers as, then PrivaPub's own release (its tag, or the commit a build came from).
+		// 4.5.0 since R9 (2026-10-18): every client route of Mastodon 4.3, 4.4 and 4.5 is served or answers as a documented
+		// stub (docs/MASTODON-API.md), streaming and Web Push included. api_versions.mastodon is 4.5's own, 7.
+		public const string MastodonVersion = "4.5.0";
+		public static readonly string Version = Advertised(string.IsNullOrEmpty(BuildInfo.Ref) ? BuildInfo.Commit : BuildInfo.Ref);
+
+		static string Advertised(string release)
+		{
+			var own = release?.Trim();
+			if (own is { Length: > 1 } && own[0] == 'v' && char.IsDigit(own[1]))
+				own = own[1..];//a tag v1.27.0 is release 1.27.0
+			return string.IsNullOrEmpty(own) ? $"{MastodonVersion} (compatible; PrivaPub)" : $"{MastodonVersion} (compatible; PrivaPub {own})";
+		}
 		const int ActivityWeeks = 12;
 		static readonly TimeSpan ActivityLifetime = TimeSpan.FromHours(1);
 		static volatile CachedActivity _activity;
@@ -39,14 +51,16 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		readonly IOptionsMonitor<RegistrationOptions> _registrations;
 		readonly IInstanceSettings _settings;
 		readonly MastodonMapper _mapper;
+		readonly PrivaPub.Infrastructure.Push.IVapid _vapid;
 
 		public InstanceController(ILocalActorService localActors, IOptionsMonitor<RegistrationOptions> registrations, IInstanceSettings settings,
-			MastodonMapper mapper)
+			MastodonMapper mapper, PrivaPub.Infrastructure.Push.IVapid vapid)
 		{
 			_localActors = localActors;
 			_registrations = registrations;
 			_settings = settings;
 			_mapper = mapper;
+			_vapid = vapid;
 		}
 
 		bool Open => _registrations.CurrentValue.IsOpen;
@@ -165,7 +179,8 @@ namespace PrivaPub.Api.Mastodon.Controllers
 				statuses = Statuses,
 				media_attachments = MediaAttachments,
 				polls = Polls,
-				translation = new { enabled = false }
+				translation = new { enabled = false },
+				vapid = new { public_key = (await _vapid.Key(token)).ForApi }//Web Push (R9): the key every push is signed with
 			},
 			registrations = new { enabled = Open, approval_required = false, message = Open ? default : RegistrationOptions.ClosedMessage },
 			contact = new { email = Settings.ContactEmail ?? string.Empty, account = await ContactAccount(Settings, token) },

PrivaPub/Api/Mastodon/Controllers/NotificationRequestsController.cs

@@ -69,7 +69,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		[HttpGet("/api/v2/notifications/policy"), Scope("read:notifications")]
 		public async Task<IActionResult> Policy(CancellationToken token) => Json(await V2(await NotificationPolicies.Of(MyId, token), token));
 
-		[HttpPatch("/api/v2/notifications/policy"), Scope("write:notifications")]
+		[HttpPatch("/api/v2/notifications/policy"), HttpPut("/api/v2/notifications/policy"), Scope("write:notifications")]
 		public async Task<IActionResult> SetPolicy(CancellationToken token)
 		{
 			var policy = await NotificationPolicies.Of(MyId, token);

PrivaPub/Api/Mastodon/Controllers/PushController.cs

@@ -0,0 +1,169 @@
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Options;
+
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using OpenIddict.Abstractions;
+using OpenIddict.Validation.AspNetCore;
+
+using PrivaPub.Api.Mastodon.Infrastructure;
+using PrivaPub.Domain.Social;
+using PrivaPub.Infrastructure.Http;
+using PrivaPub.Infrastructure.Push;
+using PrivaPub.Models.Social;
+
+namespace PrivaPub.Api.Mastodon.Controllers
+{
+	// Mastodon's Web Push API (completion program R9): one subscription per access token, so per persona, made, read, changed
+	// and deleted with the token itself (the `push` scope). Its parameters as Mastodon takes them, as a form or JSON:
+	// subscription[endpoint], subscription[keys][p256dh], subscription[keys][auth], subscription[standard] (4.4: RFC 8291
+	// and RFC 8292, else the aesgcm draft), data[alerts][<type>] and data[policy] (all, followed, follower, none). Its answer is
+	// Mastodon's WebPushSubscription. What is pushed, and how, is WebPushDispatcher's and WebPushJob's.
+	public class PushController : MastodonController
+	{
+		const int MaxEndpointLength = 2048;
+
+		readonly IVapid _vapid;
+		readonly IOptionsMonitor<FederationOptions> _federation;
+
+		public PushController(IVapid vapid, IOptionsMonitor<FederationOptions> federation)
+		{
+			_vapid = vapid;
+			_federation = federation;
+		}
+
+		string TokenId => User.GetTokenId();
+
+		// a new subscription replaces the one this token had, as on Mastodon
+		[HttpPost("/api/v1/push/subscription"), Scope("push")]
+		public async Task<IActionResult> Create(CancellationToken token)
+		{
+			var endpoint = Params.Get("subscription[endpoint]")?.Trim();
+			if (string.IsNullOrEmpty(endpoint))
+				return Error(StatusCodes.Status400BadRequest, "Param is missing or the value is empty: subscription");
+			if (endpoint.Length > MaxEndpointLength || !Uri.TryCreate(endpoint, UriKind.Absolute, out var uri) || !WebPushJob.IsAllowed(uri, _federation.CurrentValue))
+				return Error(StatusCodes.Status422UnprocessableEntity, "Validation failed: Endpoint is not a valid URL");
+			var p256dh = Params.Get("subscription[keys][p256dh]")?.Trim();
+			var auth = Params.Get("subscription[keys][auth]")?.Trim();
+			if (string.IsNullOrEmpty(p256dh) || string.IsNullOrEmpty(auth))
+				return Error(StatusCodes.Status422UnprocessableEntity, "Validation failed: Key p256dh can't be blank, Key auth can't be blank");
+			if (!WebPushCrypto.AreUsable(WebPushCrypto.FromBase64Url(p256dh), WebPushCrypto.FromBase64Url(auth)))
+				return Error(StatusCodes.Status422UnprocessableEntity, "Validation failed: Keys are not valid Web Push keys");
+			var (alerts, policy, invalid) = Data();
+			if (invalid != default)
+				return invalid;
+			var tokenId = TokenId;
+			var accessToken = await AccessToken();
+			if (string.IsNullOrEmpty(tokenId) || string.IsNullOrEmpty(accessToken))
+				return Error(StatusCodes.Status401Unauthorized, "The access token is invalid");
+
+			var subscription = new PushSubscription
+			{
+				AvatarId = MyId,
+				TokenId = tokenId,
+				AccessToken = accessToken,
+				Endpoint = endpoint,
+				P256dh = p256dh,
+				Auth = auth,
+				Standard = Params.Bool("subscription[standard]") == true,
+				Alerts = alerts,
+				Policy = policy
+			};
+			// (two at once with one token: the unique index on the token keeps one, and the later replaces it)
+			for (var attempt = 0; ; attempt++)
+			{
+				await WebPush.ForgetToken(tokenId);
+				try
+				{
+					subscription.ID = default;
+					await DB.Default.SaveAsync(subscription, token);
+					break;
+				}
+				catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey && attempt < 2)
+				{
+				}
+			}
+			return Json(await View(subscription, token));
+		}
+
+		[HttpGet("/api/v1/push/subscription"), Scope("push")]
+		public async Task<IActionResult> Show(CancellationToken token) =>
+			await Mine(token) is { } subscription ? Json(await View(subscription, token)) : NotFoundError();
+
+		// Mastodon's update: the data given replaces what was there (alerts left out are off, the policy left out is all)
+		[HttpPut("/api/v1/push/subscription"), Scope("push")]
+		public async Task<IActionResult> Update(CancellationToken token)
+		{
+			var subscription = await Mine(token);
+			if (subscription == default)
+				return NotFoundError();
+			var (alerts, policy, invalid) = Data();
+			if (invalid != default)
+				return invalid;
+			subscription.Alerts = alerts;
+			subscription.Policy = policy;
+			subscription.UpdatedAt = DateTime.UtcNow;
+			await DB.Default.Update<PushSubscription>().MatchID(subscription.ID)
+				.Modify(s => s.Alerts, alerts)
+				.Modify(s => s.Policy, policy)
+				.Modify(s => s.UpdatedAt, subscription.UpdatedAt)
+				.ExecuteAsync(token);
+			return Json(await View(subscription, token));
+		}
+
+		[HttpDelete("/api/v1/push/subscription"), Scope("push")]
+		public async Task<IActionResult> Delete(CancellationToken token)
+		{
+			await WebPush.ForgetToken(TokenId);
+			return Json(new { });
+		}
+
+		async Task<PushSubscription> Mine(CancellationToken token)
+		{
+			var tokenId = TokenId;
+			var avatarId = MyId;
+			return string.IsNullOrEmpty(tokenId) ? default
+				: await DB.Default.Find<PushSubscription>().Match(s => s.TokenId == tokenId && s.AvatarId == avatarId).ExecuteFirstAsync(token);
+		}
+
+		// data[alerts][<type>] (each true or false; unknown types are ignored, as Mastodon permits only its own) and
+		// data[policy]
+		(List<string> Alerts, PushPolicy Policy, IActionResult Invalid) Data()
+		{
+			var alerts = WebPush.Alerts.Where(alert => Params.Bool($"data[alerts][{alert}]") == true).ToList();
+			var given = Params.Get("data[policy]");
+			if (string.IsNullOrWhiteSpace(given))
+				return (alerts, PushPolicy.All, default);
+			return WebPush.ParsePolicy(given) is { } policy
+				? (alerts, policy, default)
+				: (alerts, PushPolicy.All, Error(StatusCodes.Status422UnprocessableEntity, "Validation failed: Policy is not included in the list"));
+		}
+
+		// the bearer token of this request, wherever the client put it (OpenIddict takes the header, a form field or the
+		// query): the payload carries it back, as Mastodon's does
+		async Task<string> AccessToken()
+		{
+			var stored = await HttpContext.GetTokenAsync(OpenIddictValidationAspNetCoreDefaults.AuthenticationScheme,
+				OpenIddictValidationAspNetCoreConstants.Tokens.AccessToken);
+			if (!string.IsNullOrEmpty(stored))
+				return stored;
+			var header = Request.Headers.Authorization.ToString();
+			if (header.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase))
+				return header["Bearer ".Length..].Trim();
+			return Params.Get("access_token");
+		}
+
+		// Mastodon's WebPushSubscription
+		async Task<object> View(PushSubscription subscription, CancellationToken token) => new
+		{
+			id = subscription.ID,
+			endpoint = subscription.Endpoint,
+			standard = subscription.Standard,
+			alerts = WebPush.Alerts.ToDictionary(alert => alert, alert => subscription.Alerts.Contains(alert)),
+			server_key = (await _vapid.Key(token)).ForApi,
+			policy = WebPush.Name(subscription.Policy)
+		};
+	}
+}

PrivaPub/Api/Mastodon/Controllers/SearchController.cs

@@ -140,9 +140,6 @@ namespace PrivaPub.Api.Mastodon.Controllers
 
 	public class StubsController : MastodonController
 	{
-		[HttpGet("/api/v1/push/subscription"), Scope("push")]
-		public IActionResult PushSubscription() => Error(StatusCodes.Status404NotFound, "Record not found");
-
 		// Routes Mastodon answers that we have nothing behind: an empty or default answer lets clients degrade, where a
 		// 404 breaks some of them (Mastodon invariant 5)
 		[HttpGet("/api/v1/timelines/link"), Microsoft.AspNetCore.Authorization.AllowAnonymous]
@@ -163,9 +160,35 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		[HttpPost("/api/v1/statuses/{id}/translate"), Scope("read:statuses")]
 		public IActionResult Translate(string id) => Error(StatusCodes.Status422UnprocessableEntity, "Translation is not available on this server");
 
-		// Mastodon 4.3's yearly reports (Wrapstodon): none are made here, so there are never any to show
-		[HttpGet("/api/v1/annual_reports"), Scope("read:accounts")]
-		public IActionResult AnnualReports() => Json(new { annual_reports = Array.Empty<object>(), accounts = Array.Empty<object>(), statuses = Array.Empty<object>() });
+		// Mastodon 4.3's yearly reports (Wrapstodon): none are made here, so there are never any to show, for any year (4.4's
+		// show), and marking one read changes nothing
+		[HttpGet("/api/v1/annual_reports"), HttpGet("/api/v1/annual_reports/{year}"), Scope("read:accounts")]
+		public IActionResult AnnualReports(string year) => Json(new { annual_reports = Array.Empty<object>(), accounts = Array.Empty<object>(), statuses = Array.Empty<object>() });
+
+		[HttpPost("/api/v1/annual_reports/{year}/read"), Scope("write:accounts")]
+		public IActionResult ReadAnnualReport(string year) => Json(new { });
+
+		// Registration through the API is cut (owner decision 2026-10-17): a login is made by setup or an invitation, on
+		// /clientapi. Mastodon answers this when its registrations are closed; its e-mail confirmation routes follow, since no
+		// account here waits for one
+		[HttpPost("/api/v1/accounts"), Microsoft.AspNetCore.Authorization.AllowAnonymous]
+		public IActionResult Register() => Error(StatusCodes.Status403Forbidden, "This action is not allowed");
+
+		[HttpPost("/api/v1/emails/confirmations"), Scope("write:accounts")]
+		public IActionResult ResendConfirmation() =>
+			Error(StatusCodes.Status403Forbidden, "This method is only available while the e-mail is awaiting confirmation");
+
+		[HttpGet("/api/v1/emails/check_confirmation"), Scope("read:accounts")]
+		public IActionResult CheckConfirmation() => Json(true);
+
+		// the peers' names are not published (/instance/peers stays empty), so a search of them finds none
+		[HttpGet("/api/v1/peers/search"), Microsoft.AspNetCore.Authorization.AllowAnonymous]
+		public IActionResult SearchPeers() => Json(Array.Empty<string>());
+
+		// Mastodon 4.4's asynchronous refreshes are announced by a Mastodon-Async-Refresh header, which PrivaPub never sends
+		// (a thread's replies are read again in the background and simply show up): there is never one to ask about
+		[HttpGet("/api/v1_alpha/async_refreshes/{id}"), Scope("read")]
+		public IActionResult AsyncRefresh(string id) => NotFoundError();
 
 		// the Mastodon admin API is cut: moderation stays on /clientapi (ModeratorController, AdminController), so every
 		// admin route answers as Mastodon answers an account that may not use it, whoever asks

PrivaPub/Api/Mastodon/Controllers/TimelinesController.cs

@@ -177,6 +177,18 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			return Json(conversation ?? new Conversation { Id = group.ID });
 		}
 
+		// Mastodon's unread (R9): shown unread again until it is read
+		[HttpPost("/api/v1/conversations/{id}/unread"), Scope("write:conversations")]
+		public async Task<IActionResult> UnreadConversation(string id, CancellationToken token)
+		{
+			var group = await MyConversation(id, token);
+			if (group == default)
+				return NotFoundError();
+			await ConversationStates.Unread(MyId, group.ID, token);
+			var conversation = (await ConversationsOf(new List<DmGroup> { group }, token)).FirstOrDefault();
+			return Json(conversation ?? new Conversation { Id = group.ID, Unread = true });
+		}
+
 		// off the persona's list until a newer message; the messages themselves stay
 		[HttpDelete("/api/v1/conversations/{id}"), Scope("write:conversations")]
 		public async Task<IActionResult> RemoveConversation(string id, CancellationToken token)
@@ -410,7 +422,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			return mapped == default ? NotFoundError() : Json(mapped);
 		}
 
-		[HttpPost("/api/v1/notifications/clear"), Scope("write:notifications")]
+		[HttpPost("/api/v1/notifications/clear"), HttpPost("/api/v2/notifications/clear"), Scope("write:notifications")]
 		public async Task<IActionResult> Clear(CancellationToken token)
 		{
 			await DB.Default.DeleteAsync<NotificationEntity>(n => n.AvatarId == MyId);

PrivaPub/Api/Mastodon/Controllers/UserinfoController.cs

@@ -0,0 +1,40 @@
+using Microsoft.AspNetCore.Mvc;
+
+using PrivaPub.Api.Mastodon.Infrastructure;
+using PrivaPub.Api.Mastodon.Mappers;
+using PrivaPub.Federation.Actors;
+
+namespace PrivaPub.Api.Mastodon.Controllers
+{
+	// Mastodon 4.4's OAuth userinfo (OpenID Connect's shape, GET or POST, the `profile` scope): who the token's persona is,
+	// for a site that signs in with it. Only what its public account says already; never its login. The authorization
+	// server's metadata names it (OAuthSetup).
+	public class UserinfoController : MastodonController
+	{
+		public const string Path = "/oauth/userinfo";
+
+		readonly MastodonMapper _mapper;
+		readonly ILocalActorService _localActors;
+
+		public UserinfoController(MastodonMapper mapper, ILocalActorService localActors)
+		{
+			_mapper = mapper;
+			_localActors = localActors;
+		}
+
+		[HttpGet(Path), HttpPost(Path), Scope("profile")]
+		public async Task<IActionResult> Show(CancellationToken token)
+		{
+			var account = await _mapper.Local(Me, false, token);
+			return Json(new
+			{
+				iss = _localActors.BaseAddress + "/",
+				sub = Me.Uri,
+				name = account.DisplayName,
+				preferred_username = account.Username,
+				profile = account.Url,
+				picture = account.Avatar
+			});
+		}
+	}
+}

PrivaPub/Api/Mastodon/Infrastructure/MastodonController.cs

@@ -48,7 +48,8 @@ namespace PrivaPub.Api.Mastodon.Infrastructure
 			var scope = context.ActionDescriptor.EndpointMetadata.OfType<ScopeAttribute>().LastOrDefault();
 			if (User.Identity?.IsAuthenticated == true)
 			{
-				if (scope != default && !MastodonScopes.Grants(User.GetScopes(), scope.Scope))
+				// (a scope written a|b is either)
+				if (scope != default && !scope.Scope.Split('|').Any(one => MastodonScopes.Grants(User.GetScopes(), one)))
 				{
 					context.Result = Error(StatusCodes.Status403Forbidden, "This action is outside the authorized scopes");
 					return;

PrivaPub/Domain/Moderation/AccountModeration.cs

@@ -154,6 +154,7 @@ namespace PrivaPub.Domain.Moderation
 				// nothing acts as it from now on: its Mastodon tokens end and its open streams close
 				await _tokens.RevokeBySubjectAsync(avatar.ID, CancellationToken.None);
 				await _authorizations.RevokeBySubjectAsync(avatar.ID, CancellationToken.None);
+				await Social.WebPush.Forget(new[] { avatar.ID });//and its Web Push subscriptions with them (R9): it is pushed nothing
 				Streams.CloseFor(avatar.ID);
 			}
 			if (action is ModerationActions.Silence or ModerationActions.Suspend)

PrivaPub/Domain/Social/Notifications.cs

@@ -7,6 +7,25 @@ namespace PrivaPub.Domain.Social
 {
 	public static class Notifications
 	{
+		// told of every notification once it is kept for the persona's lists and streams: never one the notification policy
+		// filtered or dropped, nor one its blocks and mutes hid. Web Push hangs here (R9, WebPushDispatcher, set while the
+		// host runs; the command line sets nothing). Whatever it does never fails the notification.
+		public static Func<Notification, CancellationToken, Task> Told { get; set; }
+
+		static async Task Tell(Notification notification, CancellationToken token)
+		{
+			if (Told is not { } told)
+				return;
+			try
+			{
+				await told(notification, token);
+			}
+			catch (Exception)
+			{
+				//the hook logs its own failures
+			}
+		}
+
 		public static async Task Add(string avatarId, NotificationType type, string fromAccountId, string fromActorUri, string postId,
 			CancellationToken token, string emoji = default, string emojiUrl = default, string text = default)
 		{
@@ -42,6 +61,7 @@ namespace PrivaPub.Domain.Social
 				var told = new Timelines.Streams.Event("notification", notification.ID);
 				Timelines.Streams.ToPersona(avatarId, new Timelines.Streams.Key(Timelines.Streams.User), told);
 				Timelines.Streams.ToPersona(avatarId, new Timelines.Streams.Key(Timelines.Streams.UserNotification), told);
+				await Tell(notification, token);
 			}
 			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
 			{
@@ -73,6 +93,7 @@ namespace PrivaPub.Domain.Social
 			var told = new Timelines.Streams.Event("notification", notification.ID);
 			Timelines.Streams.ToPersona(avatarId, new Timelines.Streams.Key(Timelines.Streams.User), told);
 			Timelines.Streams.ToPersona(avatarId, new Timelines.Streams.Key(Timelines.Streams.UserNotification), told);
+			await Tell(notification, CancellationToken.None);
 		}
 	}
 }

PrivaPub/Domain/Social/WebPush.cs

@@ -0,0 +1,156 @@
+using MongoDB.Entities;
+
+using PrivaPub.Api.Mastodon.Controllers;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Federation;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Social;
+
+using System.Text.Json;
+
+namespace PrivaPub.Domain.Social
+{
+	public sealed record PushPayload(string SubscriptionId, string NotificationId);
+
+	// What Web Push sends, and to whom (completion program R9). A notification is pushed to each subscription of its persona
+	// whose alert for its type is on and whose policy admits its sender, as Mastodon's Web::PushSubscription#pushable? says;
+	// a filtered one never is, nor anything for a persona held back (suspended, or its login banned).
+	public static class WebPush
+	{
+		// Mastodon 4.5's alerts (its Notification::TYPES, which data[alerts] takes), then Pleroma's for emoji reactions.
+		// admin.sign_up and admin.report are kept but never fire: moderation is on /clientapi, and it notifies nobody.
+		public static readonly IReadOnlyList<string> Alerts = new[]
+		{
+			"mention", "quote", "status", "reblog", "follow", "follow_request", "favourite", "poll", "update", "quoted_update",
+			"severed_relationships", "moderation_warning", "annual_report", "admin.sign_up", "admin.report", "pleroma:emoji_reaction"
+		};
+
+		/// <summary>The alert a notification's type answers to: its Mastodon name.</summary>
+		public static string AlertOf(NotificationType type) => NotificationsController.Names.TryGetValue(type, out var name) ? name : default;
+
+		public static string Name(PushPolicy policy) => policy switch
+		{
+			PushPolicy.Followed => "followed",
+			PushPolicy.Follower => "follower",
+			PushPolicy.None => "none",
+			_ => "all"
+		};
+
+		public static PushPolicy? ParsePolicy(string value) => value?.Trim().ToLowerInvariant() switch
+		{
+			"all" => PushPolicy.All,
+			"followed" => PushPolicy.Followed,
+			"follower" => PushPolicy.Follower,
+			"none" => PushPolicy.None,
+			_ => (PushPolicy?)null
+		};
+
+		public static async Task<bool> Pushable(PushSubscription subscription, Notification notification, CancellationToken token)
+		{
+			if (notification.Filtered || notification.AvatarId != subscription.AvatarId)
+				return false;
+			var alert = AlertOf(notification.Type);
+			if (alert == default || !subscription.Alerts.Contains(alert))
+				return false;
+			return await Admits(subscription, notification, token);
+		}
+
+		// Mastodon's policy_allows_notification?: everyone, nobody, the accounts the persona follows, those that follow it. What
+		// the persona tells itself (its own poll ended, a warning from the staff, which Mastodon sends from the account itself)
+		// passes every policy but none.
+		static async Task<bool> Admits(PushSubscription subscription, Notification notification, CancellationToken token)
+		{
+			if (subscription.Policy == PushPolicy.None)
+				return false;
+			if (subscription.Policy == PushPolicy.All || notification.FromAccountId == subscription.AvatarId)
+				return true;
+			var avatarId = subscription.AvatarId;
+			var fromId = notification.FromAccountId;
+			var fromUri = notification.FromActorURI;
+			if (subscription.Policy == PushPolicy.Followed)
+			{
+				if (!string.IsNullOrEmpty(fromId) && await DB.Default.Find<Following>()
+					.Match(f => f.AvatarId == avatarId && f.FollowerKind == null && f.State == FollowState.Accepted && f.TargetAccountId == fromId).ExecuteAnyAsync(token))
+					return true;
+				return !string.IsNullOrEmpty(fromUri) && await DB.Default.Find<Following>()
+					.Match(f => f.AvatarId == avatarId && f.FollowerKind == null && f.State == FollowState.Accepted && f.TargetActorURI == fromUri).ExecuteAnyAsync(token);
+			}
+			if (!string.IsNullOrEmpty(fromUri) && await DB.Default.Find<Follower>()
+				.Match(f => f.LocalActorId == avatarId && f.LocalActorKind == LocalActorKind.Person && f.IsAccepted && f.ActorURI == fromUri).ExecuteAnyAsync(token))
+				return true;
+			return !string.IsNullOrEmpty(fromId) && await DB.Default.Find<Following>()
+				.Match(f => f.AvatarId == fromId && f.FollowerKind == null && f.State == FollowState.Accepted && f.TargetAccountId == avatarId).ExecuteAnyAsync(token);
+		}
+
+		/// <summary>Every subscription of these personas goes (their tokens ended, or they did).</summary>
+		public static async Task Forget(IReadOnlyCollection<string> avatarIds)
+		{
+			var ids = avatarIds?.Where(id => !string.IsNullOrEmpty(id)).Distinct().ToList() ?? new List<string>();
+			if (ids.Count > 0)
+				await DB.Default.DeleteAsync<PushSubscription>(s => ids.Contains(s.AvatarId));//a delete takes no token outside a transaction
+		}
+
+		/// <summary>The subscription made with this token goes (the token was revoked).</summary>
+		public static async Task ForgetToken(string tokenId)
+		{
+			if (!string.IsNullOrEmpty(tokenId))
+				await DB.Default.DeleteAsync<PushSubscription>(s => s.TokenId == tokenId);
+		}
+	}
+
+	// Hangs on Notifications.Told while the host runs and queues one SendPush job per subscription the notification goes to
+	// (WebPushJob sends it, encrypted). Queueing is a few indexed reads and inserts; nothing leaves the server here.
+	public class WebPushDispatcher : IHostedService
+	{
+		readonly IJobQueue _jobs;
+		readonly ILogger<WebPushDispatcher> _logger;
+
+		public WebPushDispatcher(IJobQueue jobs, ILogger<WebPushDispatcher> logger)
+		{
+			_jobs = jobs;
+			_logger = logger;
+		}
+
+		public Task StartAsync(CancellationToken cancellationToken)
+		{
+			Notifications.Told = Dispatch;
+			return Task.CompletedTask;
+		}
+
+		public Task StopAsync(CancellationToken cancellationToken)
+		{
+			Notifications.Told = default;
+			return Task.CompletedTask;
+		}
+
+		public async Task Dispatch(Notification notification, CancellationToken token)
+		{
+			try
+			{
+				if (notification == default || notification.Filtered || Moderation.Restrictions.IsSuspended(notification.AvatarId))
+					return;
+				var alert = WebPush.AlertOf(notification.Type);
+				if (alert == default)
+					return;
+				var avatarId = notification.AvatarId;
+				var subscriptions = await DB.Default.Find<PushSubscription>().Match(s => s.AvatarId == avatarId && s.Alerts.Contains(alert)).ExecuteAsync(token);
+				var jobs = new List<Job>();
+				foreach (var subscription in subscriptions)
+					if (await WebPush.Pushable(subscription, notification, token))
+						jobs.Add(new Job
+						{
+							Kind = JobKind.SendPush,
+							Payload = JsonSerializer.Serialize(new PushPayload(subscription.ID, notification.ID)),
+							Host = Uri.TryCreate(subscription.Endpoint, UriKind.Absolute, out var endpoint) ? endpoint.Host : default,
+							DedupeKey = $"push|{subscription.ID}|{notification.ID}"
+						});
+				if (jobs.Count > 0)
+					await _jobs.EnqueueMany(jobs, token);
+			}
+			catch (Exception ex) when (ex is not OperationCanceledException || !token.IsCancellationRequested)
+			{
+				_logger.LogWarning(ex, "{Service} could not queue the pushes of a notification", nameof(WebPushDispatcher));
+			}
+		}
+	}
+}

PrivaPub/Domain/Statuses/ConversationStates.cs

@@ -21,14 +21,40 @@ namespace PrivaPub.Domain.Statuses
 				await Read(authorAvatarId, conversationId, postId, token);
 		}
 
-		public static Task Read(string avatarId, string conversationId, string postId, CancellationToken token) =>
-			Mark(avatarId, conversationId, s => s.LastReadPostId, postId, token);
+		public static async Task Read(string avatarId, string conversationId, string postId, CancellationToken token)
+		{
+			await Mark(avatarId, conversationId, s => s.LastReadPostId, postId, token);
+			await DB.Default.Update<ConversationState>()
+				.Match(s => s.AvatarId == avatarId && s.ConversationId == conversationId && s.MarkedUnread)
+				.Modify(s => s.MarkedUnread, false)
+				.ExecuteAsync(token);
+		}
+
+		// Mastodon's unread: the conversation shows unread, whoever wrote last, until the persona reads it again (R9)
+		public static async Task Unread(string avatarId, string conversationId, CancellationToken token)
+		{
+			Task Write() => DB.Default.Update<ConversationState>()
+				.Match(s => s.AvatarId == avatarId && s.ConversationId == conversationId)
+				.Modify(s => s.MarkedUnread, true)
+				.Modify(s => s.UpdatedAt, DateTime.UtcNow)
+				.Option(o => o.IsUpsert = true)
+				.ExecuteAsync(token);
+			try
+			{
+				await Write();
+			}
+			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
+			{
+				await Write();
+			}
+		}
 
 		public static Task Hide(string avatarId, string conversationId, string postId, CancellationToken token) =>
 			Mark(avatarId, conversationId, s => s.HiddenUpTo, postId, token);
 
 		public static bool IsUnread(ConversationState state, string lastPostId, string lastAuthorId, string avatarId) =>
-			lastPostId != default && lastAuthorId != avatarId && string.CompareOrdinal(lastPostId, state?.LastReadPostId) > 0;
+			state?.MarkedUnread == true
+			|| lastPostId != default && lastAuthorId != avatarId && string.CompareOrdinal(lastPostId, state?.LastReadPostId) > 0;
 
 		public static bool IsHidden(ConversationState state, string lastPostId) =>
 			state?.HiddenUpTo != default && string.CompareOrdinal(lastPostId, state.HiddenUpTo) <= 0;

PrivaPub/Infrastructure/Backup/ProtectiveMerge.cs

@@ -168,6 +168,9 @@ namespace PrivaPub.Infrastructure.Backup
 					.Set("CredentialsChangedAt", now), cancellationToken: token);
 			foreach (var collection in new[] { "openiddict.tokens", "openiddict.authorizations" })
 				report.SessionsEnded += (int)(await database.GetCollection<BsonDocument>(collection).DeleteManyAsync(FilterDefinition<BsonDocument>.Empty, token)).DeletedCount;
+			// and the Web Push subscriptions made with those tokens (R9; never in a backup): clients subscribe again once signed
+			// in. The VAPID key (PushKeys, never in a backup either) stays the live one.
+			await database.GetCollection<BsonDocument>("PushSubscription").DeleteManyAsync(FilterDefinition<BsonDocument>.Empty, token);
 
 			// what the backup remembered of servers being down is long past
 			await database.GetCollection<BsonDocument>("RemoteInstance").UpdateManyAsync(FilterDefinition<BsonDocument>.Empty,

PrivaPub/Infrastructure/Backup/ServerBackup.cs

@@ -42,7 +42,9 @@ namespace PrivaPub.Infrastructure.Backup
 			["AppConfiguration"] = "the configuration's copy holds the SMTP password, and is made again from appsettings at boot",
 			[nameof(RestoreRecord)] = "what restores did outlives what they restore",
 			["PersonaArchive"] = "personas' archives being made or imported belong to the moment",
-			["ServerSetup"] = "the server is set up once: a restore never opens its setup again"
+			["ServerSetup"] = "the server is set up once: a restore never opens its setup again",
+			["PushSubscription"] = "Web Push subscriptions belong to sessions: a restore ends every one, and clients subscribe again",
+			["PushKeys"] = "the VAPID key every push subscription was made with: a restore keeps the live one"
 		};
 
 		static readonly JsonWriterSettings Json = new() { OutputMode = JsonOutputMode.CanonicalExtendedJson, Indent = false };

PrivaPub/Infrastructure/Cli/AdminCommands.cs

@@ -290,6 +290,7 @@ namespace PrivaPub.Infrastructure.Cli
 			await DB.Default.Update<RootToAvatar>().MatchID(link.ID).Modify(ra => ra.RootId, root.ID).ExecuteAsync();
 			await services.GetRequiredService<IOpenIddictTokenManager>().RevokeBySubjectAsync(persona.ID);
 			await services.GetRequiredService<IOpenIddictAuthorizationManager>().RevokeBySubjectAsync(persona.ID);
+			await Domain.Social.WebPush.Forget(new[] { persona.ID });//its Web Push subscriptions go with its tokens (R9)
 			await Log(services, AdminActions.PersonaMove, AdminTargets.Persona, persona.ID, "@" + personaName, "moved to another login");
 			output.WriteLine($"@{personaName}: moved to {login}");
 			return 0;

PrivaPub/Infrastructure/Data/Indexes.cs

@@ -73,6 +73,9 @@ namespace PrivaPub.Infrastructure.Data
 			await Plain<PersonaNote>(token, n => n.TargetAccountId);
 			await DB.Default.Index<SuggestionDismissal>().Key(d => d.AvatarId, KeyType.Ascending).Key(d => d.AccountId, KeyType.Ascending)
 				.Option(o => o.Unique = true).CreateAsync(token);
+			// Web Push (a new collection, R9): one subscription per access token, a persona's read when it is notified
+			await Unique<PushSubscription>(s => s.TokenId, Builders<PushSubscription>.Filter.Gt(s => s.TokenId, ""), token);
+			await Plain<PushSubscription>(token, s => s.AvatarId);
 			// the staff's log, read newest first
 			await DB.Default.Index<Models.AdminAction>().Key(a => a.At, KeyType.Descending).CreateAsync(token);
 

PrivaPub/Infrastructure/Http/SafeHttpHandlerFactory.cs

@@ -11,7 +11,7 @@ namespace PrivaPub.Infrastructure.Http
 
 	public static class SafeHttpHandlerFactory
 	{
-		public static SocketsHttpHandler Create(FederationOptions options, IConnectedAddresses connected = default) => new()
+		public static SocketsHttpHandler Create(FederationOptions options, IConnectedAddresses connected = default, TimeSpan? connectTimeout = default) => new()
 		{
 			SslOptions = options.AcceptAnyCertificate
 				? new SslClientAuthenticationOptions { RemoteCertificateValidationCallback = (_, _, _, _) => true }
@@ -20,7 +20,7 @@ namespace PrivaPub.Infrastructure.Http
 			UseProxy = false,
 			UseCookies = false,
 			AutomaticDecompression = DecompressionMethods.All,
-			ConnectTimeout = TimeSpan.FromSeconds(10),
+			ConnectTimeout = connectTimeout ?? TimeSpan.FromSeconds(10),
 			PooledConnectionLifetime = TimeSpan.FromMinutes(2),
 			MaxResponseHeadersLength = 64,
 			ConnectCallback = (context, token) => Connect(context.DnsEndPoint, options.AllowPrivateNetworks, token, connected)

PrivaPub/Infrastructure/Push/Vapid.cs

@@ -0,0 +1,116 @@
+using MongoDB.Driver;
+using MongoDB.Entities;
+
+using PrivaPub.Models;
+
+using System.Globalization;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+
+namespace PrivaPub.Infrastructure.Push
+{
+	// The server's VAPID key (RFC 8292, completion program R9) and the JWT every push carries. The key is made the first time
+	// it is needed and kept in Mongo (PushKeys, one document); every process reads that one.
+	public interface IVapid
+	{
+		Task<VapidKey> Key(CancellationToken token);
+	}
+
+	public sealed class VapidKey
+	{
+		// RFC 8292 2: no more than 24 hours ahead; half of it leaves room for a push service's clock
+		public static readonly TimeSpan TokenLifetime = TimeSpan.FromHours(12);
+
+		readonly ECParameters _parameters;
+
+		public VapidKey(byte[] publicPoint, byte[] d)
+		{
+			PublicPoint = publicPoint;
+			_parameters = new ECParameters
+			{
+				Curve = ECCurve.NamedCurves.nistP256,
+				D = d,
+				Q = new ECPoint { X = publicPoint[1..33], Y = publicPoint[33..] }
+			};
+		}
+
+		public byte[] PublicPoint { get; }
+
+		/// <summary>As the APIs give it (the instance's vapid.public_key, an app's vapid_key, a subscription's server_key):
+		/// URL-safe base64 with its padding, as Mastodon's VAPID_PUBLIC_KEY is written.</summary>
+		public string ForApi => Convert.ToBase64String(PublicPoint).Replace('+', '-').Replace('/', '_');
+
+		/// <summary>As headers take it (RFC 8292's k, the draft's Crypto-Key p256ecdsa): base64url without padding.</summary>
+		public string ForHeader => WebPushCrypto.Base64Url(PublicPoint);
+
+		/// <summary>The ES256 JWT for one push service (aud: its origin), signed by this key.</summary>
+		public string Token(string audience, string subject, DateTime now)
+		{
+			var header = WebPushCrypto.Base64Url("{\"typ\":\"JWT\",\"alg\":\"ES256\"}"u8);
+			var claims = WebPushCrypto.Base64Url(JsonSerializer.SerializeToUtf8Bytes(new Dictionary<string, object>
+			{
+				["aud"] = audience,
+				["exp"] = new DateTimeOffset(now + TokenLifetime).ToUnixTimeSeconds(),
+				["sub"] = subject
+			}));
+			var signed = header + "." + claims;
+			using var key = ECDsa.Create(_parameters);
+			var signature = key.SignData(Encoding.ASCII.GetBytes(signed), HashAlgorithmName.SHA256, DSASignatureFormat.IeeeP1363FixedFieldConcatenation);
+			return signed + "." + WebPushCrypto.Base64Url(signature);
+		}
+
+		/// <summary>A push service's origin, the JWT's aud: scheme, host and a port that is not the scheme's own.</summary>
+		public static string Audience(Uri endpoint) => endpoint.GetLeftPart(UriPartial.Authority).ToLower(CultureInfo.InvariantCulture);
+	}
+
+	public class Vapid : IVapid
+	{
+		readonly SemaphoreSlim _gate = new(1, 1);
+		volatile VapidKey _key;
+
+		public async Task<VapidKey> Key(CancellationToken token)
+		{
+			if (_key is { } known)
+				return known;
+			await _gate.WaitAsync(token);
+			try
+			{
+				if (_key is { } meanwhile)
+					return meanwhile;
+				var stored = await Stored(token) ?? await Make(token);
+				_key = new VapidKey(WebPushCrypto.FromBase64Url(stored.PublicKey), WebPushCrypto.FromBase64Url(stored.PrivateKey));
+				return _key;
+			}
+			finally
+			{
+				_gate.Release();
+			}
+		}
+
+		static Task<PushKeys> Stored(CancellationToken token) =>
+			DB.Default.Find<PushKeys>().Match(k => k.ID == PushKeys.Name).ExecuteFirstAsync(token);
+
+		// the first need makes it; two processes at once keep the first one saved
+		static async Task<PushKeys> Make(CancellationToken token)
+		{
+			using var key = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+			var parameters = key.ExportParameters(true);
+			var keys = new PushKeys
+			{
+				ID = PushKeys.Name,
+				PublicKey = WebPushCrypto.Base64Url([0x04, .. parameters.Q.X, .. parameters.Q.Y]),
+				PrivateKey = WebPushCrypto.Base64Url(parameters.D)
+			};
+			try
+			{
+				await DB.Default.InsertAsync(keys, token);
+				return keys;
+			}
+			catch (MongoWriteException ex) when (ex.WriteError?.Category == ServerErrorCategory.DuplicateKey)
+			{
+				return await Stored(token);
+			}
+		}
+	}
+}

PrivaPub/Infrastructure/Push/WebPushCrypto.cs

@@ -0,0 +1,169 @@
+using System.Buffers.Binary;
+using System.Security.Cryptography;
+using System.Text;
+
+namespace PrivaPub.Infrastructure.Push
+{
+	// Web Push message encryption, on System.Security.Cryptography alone (completion program R9). Two encodings, as Mastodon
+	// sends them:
+	// - RFC 8291 (`aes128gcm`, in RFC 8188's record), for a subscription made with `standard` (Mastodon 4.4);
+	// - the draft before it (`aesgcm`: draft-ietf-webpush-encryption-04 over draft-ietf-httpbis-encryption-encoding-03), for
+	//   every other one, with its salt in the Encryption header and our public key in Crypto-Key.
+	// Both: a fresh P-256 key pair and a fresh 16-byte salt per message, ECDH with the client's p256dh, HKDF-SHA-256 keyed by
+	// its auth secret, AES-128-GCM, one record. Only the client can read the message; the push service carries it blind.
+	public static class WebPushCrypto
+	{
+		public const int RecordSize = 4096;
+		// the largest payload a 4096-byte aes128gcm body holds: 86 bytes of header, the delimiter and the tag
+		public const int MaxPayload = RecordSize - 86 - 1 - 16;
+		const int SaltLength = 16;
+		const int TagLength = 16;
+
+		public sealed record Message(byte[] Body, string ContentEncoding, byte[] Salt, byte[] ServerPublicKey);
+
+		public static Message Aes128Gcm(ReadOnlySpan<byte> plaintext, byte[] clientPublicKey, byte[] authSecret)
+		{
+			using var server = ECDiffieHellman.Create(ECCurve.NamedCurves.nistP256);
+			return Aes128Gcm(plaintext, clientPublicKey, authSecret, server, RandomNumberGenerator.GetBytes(SaltLength));
+		}
+
+		public static Message Aes128Gcm(ReadOnlySpan<byte> plaintext, byte[] clientPublicKey, byte[] authSecret, ECDiffieHellman server, byte[] salt)
+		{
+			if (plaintext.Length > MaxPayload)
+				throw new ArgumentException($"a push payload holds {MaxPayload} bytes at most", nameof(plaintext));
+			var serverPublic = PublicPoint(server);
+			var shared = SharedSecret(server, clientPublicKey);
+			// RFC 8291 3.3 and 3.4: PRK_key = HMAC-SHA-256(auth, ecdh); IKM = HKDF-Expand(PRK_key, "WebPush: info" 0x00
+			// ua_public as_public, 32)
+			var keyInfo = Concat(Encoding.ASCII.GetBytes("WebPush: info\0"), clientPublicKey, serverPublic);
+			var ikm = HKDF.Expand(HashAlgorithmName.SHA256, HKDF.Extract(HashAlgorithmName.SHA256, shared, authSecret), 32, keyInfo);
+			// RFC 8188 2.2 and 2.3: the content encryption key and the nonce, from the salt
+			var prk = HKDF.Extract(HashAlgorithmName.SHA256, ikm, salt);
+			var cek = HKDF.Expand(HashAlgorithmName.SHA256, prk, 16, Encoding.ASCII.GetBytes("Content-Encoding: aes128gcm\0"));
+			var nonce = HKDF.Expand(HashAlgorithmName.SHA256, prk, 12, Encoding.ASCII.GetBytes("Content-Encoding: nonce\0"));
+			// one record, the last: the payload, its delimiter 0x02, no padding
+			var record = new byte[plaintext.Length + 1];
+			plaintext.CopyTo(record);
+			record[^1] = 0x02;
+			var encrypted = Seal(cek, nonce, record);
+			// RFC 8188 2.1's header: the salt, the record size, the key id's length and the key id (RFC 8291: our public key)
+			var body = new byte[SaltLength + 4 + 1 + serverPublic.Length + encrypted.Length];
+			salt.CopyTo(body, 0);
+			BinaryPrimitives.WriteUInt32BigEndian(body.AsSpan(SaltLength), RecordSize);
+			body[SaltLength + 4] = (byte)serverPublic.Length;
+			serverPublic.CopyTo(body, SaltLength + 5);
+			encrypted.CopyTo(body, SaltLength + 5 + serverPublic.Length);
+			return new Message(body, "aes128gcm", salt, serverPublic);
+		}
+
+		public static Message AesGcm(ReadOnlySpan<byte> plaintext, byte[] clientPublicKey, byte[] authSecret)
+		{
+			using var server = ECDiffieHellman.Create(ECCurve.NamedCurves.nistP256);
+			return AesGcm(plaintext, clientPublicKey, authSecret, server, RandomNumberGenerator.GetBytes(SaltLength));
+		}
+
+		public static Message AesGcm(ReadOnlySpan<byte> plaintext, byte[] clientPublicKey, byte[] authSecret, ECDiffieHellman server, byte[] salt)
+		{
+			if (plaintext.Length > MaxPayload)
+				throw new ArgumentException($"a push payload holds {MaxPayload} bytes at most", nameof(plaintext));
+			var serverPublic = PublicPoint(server);
+			var shared = SharedSecret(server, clientPublicKey);
+			// the draft's: IKM = HKDF(salt: auth, ecdh, "Content-Encoding: auth" 0x00, 32), then the key and nonce from the salt
+			// over a context of both public keys, each after its length
+			var ikm = HKDF.Expand(HashAlgorithmName.SHA256, HKDF.Extract(HashAlgorithmName.SHA256, shared, authSecret), 32,
+				Encoding.ASCII.GetBytes("Content-Encoding: auth\0"));
+			var context = Concat(Encoding.ASCII.GetBytes("P-256\0"), Length16(clientPublicKey), clientPublicKey, Length16(serverPublic), serverPublic);
+			var prk = HKDF.Extract(HashAlgorithmName.SHA256, ikm, salt);
+			var cek = HKDF.Expand(HashAlgorithmName.SHA256, prk, 16, Concat(Encoding.ASCII.GetBytes("Content-Encoding: aesgcm\0"), context));
+			var nonce = HKDF.Expand(HashAlgorithmName.SHA256, prk, 12, Concat(Encoding.ASCII.GetBytes("Content-Encoding: nonce\0"), context));
+			// two bytes saying how much padding follows (none), then the payload
+			var padded = new byte[2 + plaintext.Length];
+			plaintext.CopyTo(padded.AsSpan(2));
+			return new Message(Seal(cek, nonce, padded), "aesgcm", salt, serverPublic);
+		}
+
+		/// <summary>A client's public key: an uncompressed point on P-256, or a CryptographicException.</summary>
+		public static ECDiffieHellman ImportPublic(byte[] point)
+		{
+			if (point is not { Length: 65 } || point[0] != 0x04)
+				throw new CryptographicException("not an uncompressed P-256 point");
+			var key = ECDiffieHellman.Create(new ECParameters
+			{
+				Curve = ECCurve.NamedCurves.nistP256,
+				Q = new ECPoint { X = point[1..33], Y = point[33..] }
+			});
+			return key;
+		}
+
+		/// <summary>Whether a subscription's keys can be encrypted to: a point on P-256 and a 16-byte secret.</summary>
+		public static bool AreUsable(byte[] p256dh, byte[] auth)
+		{
+			if (auth is not { Length: 16 })
+				return false;
+			try
+			{
+				using var key = ImportPublic(p256dh);
+				using var probe = ECDiffieHellman.Create(ECCurve.NamedCurves.nistP256);
+				probe.DeriveRawSecretAgreement(key.PublicKey);
+				return true;
+			}
+			catch (CryptographicException)
+			{
+				return false;
+			}
+		}
+
+		public static byte[] PublicPoint(ECAlgorithm key)
+		{
+			var parameters = key.ExportParameters(false);
+			return [0x04, .. parameters.Q.X, .. parameters.Q.Y];
+		}
+
+		public static string Base64Url(ReadOnlySpan<byte> bytes) =>
+			Convert.ToBase64String(bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_');
+
+		/// <summary>base64url or base64, padded or not, as clients send keys; null when it is neither.</summary>
+		public static byte[] FromBase64Url(string text)
+		{
+			if (string.IsNullOrWhiteSpace(text))
+				return default;
+			var normal = text.Trim().TrimEnd('=').Replace('-', '+').Replace('_', '/');
+			normal = normal.PadRight(normal.Length + (4 - normal.Length % 4) % 4, '=');
+			var bytes = new byte[normal.Length * 3 / 4];
+			return Convert.TryFromBase64String(normal, bytes, out var written) ? bytes[..written] : default;
+		}
+
+		static byte[] SharedSecret(ECDiffieHellman server, byte[] clientPublicKey)
+		{
+			using var client = ImportPublic(clientPublicKey);
+			return server.DeriveRawSecretAgreement(client.PublicKey);
+		}
+
+		static byte[] Seal(byte[] key, byte[] nonce, byte[] plaintext)
+		{
+			var output = new byte[plaintext.Length + TagLength];
+			using var aes = new AesGcm(key, TagLength);
+			aes.Encrypt(nonce, plaintext, output.AsSpan(0, plaintext.Length), output.AsSpan(plaintext.Length));
+			return output;
+		}
+
+		static byte[] Length16(byte[] value)
+		{
+			var length = new byte[2];
+			BinaryPrimitives.WriteUInt16BigEndian(length, (ushort)value.Length);
+			return length;
+		}
+
+		static byte[] Concat(params byte[][] parts)
+		{
+			var all = new byte[parts.Sum(p => p.Length)];
+			var at = 0;
+			foreach (var part in parts)
+			{
+				part.CopyTo(all, at);
+				at += part.Length;
+			}
+			return all;
+		}
+	}
+}

PrivaPub/Infrastructure/Push/WebPushJob.cs

@@ -0,0 +1,264 @@
+using Microsoft.Extensions.Localization;
+using Microsoft.Extensions.Options;
+
+using MongoDB.Entities;
+
+using OpenIddict.Abstractions;
+
+using PrivaPub.Api.Mastodon.Controllers;
+using PrivaPub.Api.Mastodon.Mappers;
+using PrivaPub.Domain.Instance;
+using PrivaPub.Domain.Moderation;
+using PrivaPub.Domain.Social;
+using PrivaPub.Federation.Actors;
+using PrivaPub.Infrastructure.Http;
+using PrivaPub.Infrastructure.Jobs;
+using PrivaPub.Models.Jobs;
+using PrivaPub.Models.Social;
+using PrivaPub.Models.User;
+using PrivaPub.Resources;
+
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Sockets;
+using System.Text.Json;
+using System.Text.RegularExpressions;
+
+using static OpenIddict.Abstractions.OpenIddictConstants;
+
+namespace PrivaPub.Infrastructure.Push
+{
+	// Sends one Web Push notification to one subscription (JobKind.SendPush, queued by WebPushDispatcher; completion
+	// program R9), as Mastodon's Web::PushNotificationWorker does:
+	// - the payload is Mastodon's (access_token, preferred_locale, notification_id, notification_type, icon, title, body), built
+	//   when it is sent, as the persona sees the notification then (one it can no longer see, or dismissed meanwhile, is not
+	//   sent), its access_token the subscription's own: the token is checked to be valid and the persona's first;
+	// - encrypted for the client alone (WebPushCrypto): RFC 8291 aes128gcm with RFC 8292's `vapid t=, k=` for a standard
+	//   subscription, otherwise the aesgcm draft with Encryption and Crypto-Key and `WebPush <jwt>`; the JWT (Vapid) names the
+	//   push service's origin (aud), lasts twelve hours (exp) and the server's contact (sub: mailto: the contact email, or
+	//   the server's address; never a persona);
+	// - TTL two days and Urgency normal, as Mastodon's;
+	// - through the `push` client: public addresses only, https only, no redirects, small timeouts (the federation client's
+	//   safe handler, with the pasture's exceptions where Federation says so).
+	// A 404 or 410 means the subscription is gone: it is deleted. 408, 429, a 5xx, a timeout or a broken connection retry on
+	// the jobs' backoff; any other answer drops the push (logged by the push service's host alone).
+	public class WebPushJob : IJobHandler
+	{
+		public const string ClientName = "push";
+		public static readonly TimeSpan RequestTimeout = TimeSpan.FromSeconds(15);
+		public static readonly TimeSpan ConnectTimeout = TimeSpan.FromSeconds(5);
+		// Mastodon's Web::PushNotificationWorker::TTL and URGENCY
+		const int TimeToLive = 48 * 3600;
+		const string Urgency = "normal";
+		const int BodyLength = 140;
+
+		readonly IHttpClientFactory _http;
+		readonly IVapid _vapid;
+		readonly IServiceScopeFactory _scopes;
+		readonly IInstanceSettings _settings;
+		readonly ILocalActorService _localActors;
+		readonly IOptionsMonitor<FederationOptions> _federation;
+		readonly IStringLocalizer<GenericRes> _localizer;
+		readonly ILogger<WebPushJob> _logger;
+
+		public WebPushJob(IHttpClientFactory http, IVapid vapid, IServiceScopeFactory scopes, IInstanceSettings settings, ILocalActorService localActors,
+			IOptionsMonitor<FederationOptions> federation, IStringLocalizer<GenericRes> localizer, ILogger<WebPushJob> logger)
+		{
+			_http = http;
+			_vapid = vapid;
+			_scopes = scopes;
+			_settings = settings;
+			_localActors = localActors;
+			_federation = federation;
+			_localizer = localizer;
+			_logger = logger;
+		}
+
+		public JobKind Kind => JobKind.SendPush;
+		public int Concurrency => 4;
+		public int MaxAttempts => 6;
+		public int PerHostLimit => 4;
+
+		public async Task<JobOutcome> Handle(Job job, CancellationToken token)
+		{
+			var payload = JsonSerializer.Deserialize<PushPayload>(job.Payload ?? "null");
+			if (string.IsNullOrEmpty(payload?.SubscriptionId) || string.IsNullOrEmpty(payload.NotificationId))
+				return JobOutcome.Done;
+			var subscriptionId = payload.SubscriptionId;
+			var subscription = await DB.Default.Find<PushSubscription>().Match(s => s.ID == subscriptionId).ExecuteFirstAsync(token);
+			if (subscription == default)
+				return JobOutcome.Done;
+			// a persona held back (suspended, its login banned) gets no push
+			if (Restrictions.IsSuspended(subscription.AvatarId))
+				return JobOutcome.Done;
+			var notificationId = payload.NotificationId;
+			var avatarId = subscription.AvatarId;
+			var notification = await DB.Default.Find<Notification>().Match(n => n.ID == notificationId && n.AvatarId == avatarId).ExecuteFirstAsync(token);
+			if (notification == default || !await WebPush.Pushable(subscription, notification, token))
+				return JobOutcome.Done;
+			if (!Uri.TryCreate(subscription.Endpoint, UriKind.Absolute, out var endpoint) || !IsAllowed(endpoint, _federation.CurrentValue))
+				return JobOutcome.Dead("endpoint");
+
+			byte[] json;
+			using (var scope = _scopes.CreateScope())
+			{
+				// the token the subscription was made with must still be valid, and the persona's: it goes into the payload
+				if (!await TokenHolds(scope.ServiceProvider.GetRequiredService<IOpenIddictTokenManager>(), subscription, token))
+				{
+					await WebPush.ForgetToken(subscription.TokenId);
+					return JobOutcome.Done;
+				}
+				var avatar = await DB.Default.Find<Avatar>().Match(a => a.ID == avatarId && a.DeletionAt == null).ExecuteFirstAsync(token);
+				if (avatar == default)
+				{
+					await WebPush.Forget(new[] { avatarId });
+					return JobOutcome.Done;
+				}
+				var mapped = (await scope.ServiceProvider.GetRequiredService<MastodonMapper>().Notifications(new List<Notification> { notification }, avatarId, token))
+					.FirstOrDefault();
+				if (mapped == default)
+					return JobOutcome.Done;
+				json = JsonSerializer.SerializeToUtf8Bytes(new Dictionary<string, object>
+				{
+					["access_token"] = subscription.AccessToken,
+					["preferred_locale"] = Locale(avatar, scope.ServiceProvider),
+					["notification_id"] = notification.ID,
+					["notification_type"] = WebPush.AlertOf(notification.Type),
+					["icon"] = mapped.Account?.AvatarStatic ?? mapped.Account?.Avatar,
+					["title"] = Title(notification, mapped),
+					["body"] = Body(mapped)
+				});
+			}
+
+			var key = await _vapid.Key(token);
+			var p256dh = WebPushCrypto.FromBase64Url(subscription.P256dh);
+			var auth = WebPushCrypto.FromBase64Url(subscription.Auth);
+			if (!WebPushCrypto.AreUsable(p256dh, auth))
+				return JobOutcome.Dead("keys");
+			var message = subscription.Standard ? WebPushCrypto.Aes128Gcm(json, p256dh, auth) : WebPushCrypto.AesGcm(json, p256dh, auth);
+			var jwt = key.Token(VapidKey.Audience(endpoint), Subject(), DateTime.UtcNow);
+
+			using var request = new HttpRequestMessage(HttpMethod.Post, endpoint) { Content = new ByteArrayContent(message.Body) };
+			request.Content.Headers.ContentType = new MediaTypeHeaderValue("application/octet-stream");
+			request.Content.Headers.ContentEncoding.Add(message.ContentEncoding);
+			request.Headers.TryAddWithoutValidation("TTL", TimeToLive.ToString(System.Globalization.CultureInfo.InvariantCulture));
+			request.Headers.TryAddWithoutValidation("Urgency", Urgency);
+			if (subscription.Standard)
+				request.Headers.TryAddWithoutValidation("Authorization", $"vapid t={jwt}, k={key.ForHeader}");
+			else
+			{
+				request.Headers.TryAddWithoutValidation("Authorization", $"WebPush {jwt}");
+				request.Headers.TryAddWithoutValidation("Encryption", $"salt={WebPushCrypto.Base64Url(message.Salt)}");
+				request.Headers.TryAddWithoutValidation("Crypto-Key", $"dh={WebPushCrypto.Base64Url(message.ServerPublicKey)};p256ecdsa={key.ForHeader}");
+			}
+
+			try
+			{
+				using var response = await _http.CreateClient(ClientName).SendAsync(request, HttpCompletionOption.ResponseHeadersRead, token);
+				var status = (int)response.StatusCode;
+				if (status is >= 200 and < 300)
+					return JobOutcome.Done;
+				if (response.StatusCode is HttpStatusCode.NotFound or HttpStatusCode.Gone)
+				{
+					await DB.Default.DeleteAsync<PushSubscription>(subscription.ID);
+					_logger.LogInformation("{Kind}: {Host} answered {Status}, the subscription is gone", Kind, endpoint.Host, status);
+					return JobOutcome.Done;
+				}
+				if (response.StatusCode is HttpStatusCode.RequestTimeout or HttpStatusCode.TooManyRequests || status >= 500)
+					return JobOutcome.Retry($"status {status}");
+				_logger.LogWarning("{Kind}: {Host} refused a push with {Status}; it is dropped", Kind, endpoint.Host, status);
+				return JobOutcome.Dead($"status {status}");
+			}
+			catch (BlockedDestinationException)
+			{
+				_logger.LogWarning("{Kind}: {Host} does not resolve to a public address; the push is dropped", Kind, endpoint.Host);
+				return JobOutcome.Dead("blocked destination");
+			}
+			catch (TaskCanceledException) when (!token.IsCancellationRequested)
+			{
+				return JobOutcome.Retry("timeout");
+			}
+			catch (HttpRequestException ex) when (ex.InnerException is BlockedDestinationException)
+			{
+				_logger.LogWarning("{Kind}: {Host} does not resolve to a public address; the push is dropped", Kind, endpoint.Host);
+				return JobOutcome.Dead("blocked destination");
+			}
+			catch (Exception ex) when (ex is HttpRequestException or IOException or SocketException)
+			{
+				return JobOutcome.Retry(ex.GetType().Name);
+			}
+		}
+
+		/// <summary>https, a host, no user information; plain http only on a test network (Federation:AllowPlainHttp, which
+		/// production refuses at start).</summary>
+		public static bool IsAllowed(Uri endpoint, FederationOptions options) =>
+			endpoint != default && endpoint.IsAbsoluteUri && !string.IsNullOrEmpty(endpoint.Host) && string.IsNullOrEmpty(endpoint.UserInfo)
+			&& (endpoint.Scheme == Uri.UriSchemeHttps || options?.AllowPlainHttp == true && endpoint.Scheme == Uri.UriSchemeHttp);
+
+		static async Task<bool> TokenHolds(IOpenIddictTokenManager tokens, PushSubscription subscription, CancellationToken token)
+		{
+			if (string.IsNullOrEmpty(subscription.TokenId) || string.IsNullOrEmpty(subscription.AccessToken))
+				return false;
+			var stored = await tokens.FindByIdAsync(subscription.TokenId, token);
+			if (stored == default || !await tokens.HasStatusAsync(stored, Statuses.Valid, token))
+				return false;
+			if (await tokens.GetExpirationDateAsync(stored, token) is { } expires && expires < DateTimeOffset.UtcNow)
+				return false;
+			return await tokens.GetSubjectAsync(stored, token) == subscription.AvatarId;
+		}
+
+		// RFC 8292's sub: how the push service reaches the server's operator. The contact email the administrator gave, or
+		// the server's own address; never a persona. (A server on plain http, a test network, has no https: address to give,
+		// so it names a mailbox at its host: RFC 8292 takes only mailto: and https:.)
+		string Subject()
+		{
+			var email = _settings.Current.ContactEmail?.Trim();
+			if (!string.IsNullOrEmpty(email) && !email.Any(char.IsWhiteSpace) && email.Contains('@'))
+				return "mailto:" + email;
+			var address = _localActors.BaseAddress;
+			return Uri.TryCreate(address, UriKind.Absolute, out var base_) && base_.Scheme != Uri.UriSchemeHttps
+				? "mailto:privapub@" + base_.Host
+				: address;
+		}
+
+		// the persona's language (its default for posts), else the server's first
+		static string Locale(Avatar avatar, IServiceProvider services)
+		{
+			var language = avatar.Settings?.DefaultLanguage;
+			return string.IsNullOrWhiteSpace(language) ? InstanceController.LanguageCodes(services)[0] : language.Trim();
+		}
+
+		// Mastodon's notification_mailer subjects
+		string Title(Notification notification, Api.Mastodon.Entities.Notification mapped)
+		{
+			var name = string.IsNullOrWhiteSpace(mapped.Account?.DisplayName) ? mapped.Account?.Username ?? string.Empty : mapped.Account.DisplayName;
+			return notification.Type switch
+			{
+				NotificationType.Mention => string.Format(_localizer["You were mentioned by {0}"], name),
+				NotificationType.Status => string.Format(_localizer["{0} just posted"], name),
+				NotificationType.Reblog => string.Format(_localizer["{0} boosted your post"], name),
+				NotificationType.Follow => string.Format(_localizer["{0} is now following you"], name),
+				NotificationType.FollowRequest => string.Format(_localizer["Pending follower: {0}"], name),
+				NotificationType.Favourite => string.Format(_localizer["{0} favorited your post"], name),
+				NotificationType.Poll => string.Format(_localizer["A poll by {0} has ended"], name),
+				NotificationType.Update => string.Format(_localizer["{0} edited a post"], name),
+				NotificationType.Quote => string.Format(_localizer["{0} quoted your post"], name),
+				NotificationType.Reaction => string.Format(_localizer["{0} reacted to your post with {1}"], name, notification.Emoji),
+				NotificationType.ModerationWarning => _localizer["You have received a moderation warning"],
+				_ => name
+			};
+		}
+
+		// Mastodon's: the post's warning, else its words, else the account's bio, without tags, 140 characters at most
+		static string Body(Api.Mastodon.Entities.Notification mapped)
+		{
+			var source = !string.IsNullOrWhiteSpace(mapped.Status?.SpoilerText) ? mapped.Status.SpoilerText
+				: mapped.Status?.Content ?? mapped.ModerationWarning?.Text ?? mapped.Account?.Note ?? string.Empty;
+			var text = WebUtility.HtmlDecode(Tags.Replace(Breaks.Replace(source, "\n"), string.Empty)).Trim();
+			return text.Length <= BodyLength ? text : text[..(BodyLength - 3)] + "...";
+		}
+
+		static readonly Regex Breaks = new(@"<br\s*/?>|</p>\s*<p[^>]*>", RegexOptions.IgnoreCase | RegexOptions.Compiled);
+		static readonly Regex Tags = new("<[^>]*>", RegexOptions.Compiled);
+	}
+}

PrivaPub/Middleware/SocialPubConfigurations.cs

@@ -57,7 +57,21 @@ namespace PrivaPub.Middleware
 				.ConfigurePrimaryHttpMessageHandler(provider =>
 					SafeHttpHandlerFactory.Create(provider.GetRequiredService<IOptions<FederationOptions>>().Value, provider.GetRequiredService<IConnectedAddresses>()))
 				.AddHttpMessageHandler(provider => new EdgeHintsHandler(provider.GetRequiredService<IEdgeHints>()));
+			// not federation: Web Push (R9), to the push services clients subscribed with. The same safe handler (public
+			// addresses only, the pasture's exceptions where Federation says so, no redirects), https only (WebPushJob),
+			// small timeouts, and no statistics of where it connects
+			service.AddHttpClient(Infrastructure.Push.WebPushJob.ClientName, (provider, client) =>
+				{
+					var baseAddress = provider.GetRequiredService<IOptionsMonitor<AppConfiguration>>().CurrentValue.BackendBaseAddress?.TrimEnd('/');
+					client.Timeout = Infrastructure.Push.WebPushJob.RequestTimeout;
+					client.DefaultRequestHeaders.UserAgent.ParseAdd($"PrivaPub/{BuildInfo.Ref} (+{baseAddress}/)");
+				})
+				.ConfigurePrimaryHttpMessageHandler(provider =>
+					SafeHttpHandlerFactory.Create(provider.GetRequiredService<IOptions<FederationOptions>>().Value, connectTimeout: Infrastructure.Push.WebPushJob.ConnectTimeout));
 			return service
+				.AddSingleton<Infrastructure.Push.IVapid, Infrastructure.Push.Vapid>()
+				.AddSingleton<IJobHandler, Infrastructure.Push.WebPushJob>()
+				.AddHostedService<Domain.Social.WebPushDispatcher>()
 				.AddSingleton<IConnectedAddresses, ConnectedAddresses>()
 				.AddSingleton<IEdgeHints, EdgeHints>()
 				.AddSingleton<IFederationHttp, FederationHttp>()

PrivaPub/Models/Jobs/Job.cs

@@ -40,7 +40,8 @@ namespace PrivaPub.Models.Jobs
 		ExportArchive,
 		ImportArchive,
 		SyncFeeds,
-		SendEmailVerification
+		SendEmailVerification,
+		SendPush//a Web Push notification to one subscription (R9, WebPushJob)
 	}
 
 	public enum JobState

PrivaPub/Models/PushKeys.cs

@@ -0,0 +1,18 @@
+using MongoDB.Entities;
+
+namespace PrivaPub.Models
+{
+	// The server's VAPID key pair (RFC 8292, completion program R9): one P-256 key, made the first time something needs it
+	// (Infrastructure/Push/Vapid) and kept here, one document with the fixed id `vapid`. Every push carries a JWT it signs,
+	// and the push services tie each subscription to its public key, which the instance API and app registrations
+	// advertise. Never in a backup and never dropped by a restore (ServerBackup.Excluded): a restored key would break every
+	// subscription a client made since.
+	public class PushKeys : Entity
+	{
+		public const string Name = "vapid";
+
+		public string PublicKey { get; set; }//the uncompressed point (0x04 || X || Y), base64url without padding
+		public string PrivateKey { get; set; }//the private scalar D, base64url without padding
+		public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+	}
+}

PrivaPub/Models/Social/ConversationState.cs

@@ -10,6 +10,7 @@ namespace PrivaPub.Models.Social
 		public string ConversationId { get; set; }
 		public string LastReadPostId { get; set; }
 		public string HiddenUpTo { get; set; }
+		public bool MarkedUnread { get; set; }//Mastodon's POST /api/v1/conversations/:id/unread, until it is read again (R9)
 		public DateTime UpdatedAt { get; set; } = DateTime.UtcNow;
 	}
 }

PrivaPub/Models/Social/PushSubscription.cs

@@ -0,0 +1,34 @@
+using MongoDB.Entities;
+
+namespace PrivaPub.Models.Social
+{
+	// A Web Push subscription (completion program R9). One per Mastodon access token, as on Mastodon (a new one made with the
+	// same token replaces it), and so one persona's, the token's subject: never its login's, so nothing pairs sibling
+	// personas. It holds the token it was made with, which the encrypted payload carries back to the client as Mastodon's
+	// does (`access_token`), so it goes the moment the token does: revoked (/oauth/revoke, its login's sessions ended), its
+	// persona suspended, moved or deleted, a restore. Never in a backup (ServerBackup.Excluded).
+	public class PushSubscription : Entity
+	{
+		public string AvatarId { get; set; }
+		public string TokenId { get; set; }//the OpenIddict token's id; unique
+		public string AccessToken { get; set; }//the bearer token as the client sent it when it subscribed
+		public string Endpoint { get; set; }//the push service's URL for this client
+		public string P256dh { get; set; }//the client's ECDH public key: an uncompressed P-256 point, base64url as it sent it
+		public string Auth { get; set; }//its 16-byte authentication secret, base64url as it sent it
+		public bool Standard { get; set; }//RFC 8291 aes128gcm and RFC 8292 `vapid` when true (Mastodon 4.4), else the aesgcm draft
+		public List<string> Alerts { get; set; } = new();//the alerts turned on, by Mastodon's names (WebPush.Alerts)
+		public PushPolicy Policy { get; set; } = PushPolicy.All;
+		public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+		public DateTime UpdatedAt { get; set; } = DateTime.UtcNow;
+	}
+
+	// whose notifications are pushed (Mastodon's data[policy]): everyone's, the accounts the persona follows, the accounts
+	// that follow it, nobody's
+	public enum PushPolicy
+	{
+		All,
+		Followed,
+		Follower,
+		None
+	}
+}

PrivaPub/Services/PersonaRemoval.cs

@@ -95,6 +95,7 @@ namespace PrivaPub.Services
 			// nothing acts as it while it goes
 			await _tokens.RevokeBySubjectAsync(avatar.ID, token);
 			await _authorizations.RevokeBySubjectAsync(avatar.ID, token);
+			await Domain.Social.WebPush.Forget(new[] { avatar.ID });//its Web Push subscriptions with its tokens (R9)
 			Streams.CloseFor(avatar.ID);
 
 			foreach (var group in await _dbEntities.Groups.Match(g => g.OwnerAvatarId == avatar.ID && !g.DeletionAt.HasValue).ExecuteAsync(token))

PrivaPub/Services/RootSessions.cs

@@ -15,7 +15,7 @@ namespace PrivaPub.Services
 	}
 
 	// Ends everything a root is signed in with: its /clientapi tokens, through a new SessionStamp (checked by JwtEvents),
-	// and the Mastodon API tokens and authorizations of each of its personas. Used when its password is changed or
+	// and the Mastodon API tokens and authorizations of each of its personas, with their Web Push subscriptions. Used when its password is changed or
 	// recovered, when it signs out everywhere and when it is deleted. End signs out one session only: the device that
 	// asked (its Mastodon tokens it revokes itself).
 	public class RootSessions : IRootSessions
@@ -40,11 +40,14 @@ namespace PrivaPub.Services
 				.Modify(u => u.SessionStamp, Guid.NewGuid().ToString("N"))
 				.Modify(u => u.EndedSessions, new List<EndedSession>())//the new stamp ends those too
 				.ExecuteAsync(token);
-			foreach (var link in await _dbEntities.RootToAvatars.Match(ra => ra.RootId == rootId).ExecuteAsync(token))
+			var links = await _dbEntities.RootToAvatars.Match(ra => ra.RootId == rootId).ExecuteAsync(token);
+			foreach (var link in links)
 			{
 				await _tokens.RevokeBySubjectAsync(link.AvatarId, token);
 				await _authorizations.RevokeBySubjectAsync(link.AvatarId, token);
 			}
+			// their Web Push subscriptions go with their tokens (R9)
+			await Domain.Social.WebPush.Forget(links.Select(l => l.AvatarId).ToList());
 		}
 
 		// remembered as long as one of its tokens could still be valid; the ones that have expired are forgotten meanwhile