R9 Web Push, then the honest version: VAPID key, push subscriptions, encrypted pushes, 4.5.0 advertised

The server's VAPID key (PushKeys, made on first need, in Mongo) is the instance API's vapid.public_key and every app's
vapid_key. /api/v1/push/subscription (POST, GET, PUT, DELETE) keeps one subscription per access token, so per persona;
every notification kept (never a filtered one) is queued as a SendPush job for the subscriptions whose alert and policy
admit it, and sent through the `push` client (the safe handler, https only) encrypted as RFC 8291 aes128gcm or the
aesgcm draft with an ES256 VAPID JWT. 404/410 delete the subscription, 429/5xx/timeouts retry, other answers drop the
push. Subscriptions end with their tokens (revocation, sessions ended, suspension, deletion, a restore); backups hold
neither keys nor subscriptions. The walk of every Mastodon 4.3-4.5 client route (docs/MASTODON-API.md) added
conversations/:id/unread, domain_blocks/preview, v2 notifications clear and PUT policy, /oauth/userinfo and stubs, so both
instance APIs now say 4.5.0 (compatible; PrivaPub <release>). The pasture gets a push sink (pushsink.test) and
scenarios/push.sh in batch A.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Api/Mastodon/Auth/OAuthSetup.cs

@@ -72,6 +72,23 @@ namespace PrivaPub.Api.Mastodon.Auth
 					options.AddEventHandler<ApplyAuthorizationResponseContext>(builder => builder.UseInlineHandler(OutOfBandCode)
 						.SetOrder(OpenIddictServerAspNetCoreHandlers.Authentication.ProcessFormPostResponse.Descriptor.Order - 1_000)
 						.SetType(OpenIddictServerHandlerType.Custom));
+					// a revoked token takes its Web Push subscription with it (R9), once OpenIddict has revoked it
+					options.AddEventHandler<HandleRevocationRequestContext>(builder => builder.UseInlineHandler(async context =>
+						{
+							if (context.GenericTokenPrincipal?.GetTokenId() is { Length: > 0 } tokenId)
+								await PrivaPub.Domain.Social.WebPush.ForgetToken(tokenId);
+						})
+						.SetOrder(OpenIddictServerHandlers.Revocation.RevokeToken.Descriptor.Order + 1_000)
+						.SetType(OpenIddictServerHandlerType.Custom));
+					// Mastodon 4.4's userinfo (Controllers/UserinfoController), named in the authorization server's metadata
+					options.AddEventHandler<HandleConfigurationRequestContext>(builder => builder.UseInlineHandler(context =>
+						{
+							if (context.Issuer != default)
+								context.UserInfoEndpoint = new Uri(context.Issuer, Controllers.UserinfoController.Path.TrimStart('/'));
+							return default;
+						})
+						.SetOrder(OpenIddictServerHandlers.Discovery.AttachEndpoints.Descriptor.Order + 1_000)
+						.SetType(OpenIddictServerHandlerType.Custom));
 					options.AddEventHandler<ApplyTokenResponseContext>(builder => builder.UseInlineHandler(context =>
 					{
 						if (context.Response.AccessToken != default)

PrivaPub/Api/Mastodon/Auth/PersonaExchange.cs

@@ -27,6 +27,9 @@ namespace PrivaPub.Api.Mastodon.Auth
 		public static string FirstPartyClientId(IConfiguration configuration) =>
 			configuration["ClientApi:FirstPartyClientId"] is { Length: > 0 } clientId ? clientId : "decepub";
 
+		// what the first-party client's persona tokens may hold: push since R9, so decePub can subscribe to Web Push
+		public static readonly string[] FirstPartyScopes = { "read", "write", "follow", "push" };
+
 		//the first-party application: public (a browser keeps no secret), token exchange only, no redirect
 		public static async Task EnsureFirstPartyClient(IServiceProvider services, CancellationToken token)
 		{
@@ -46,7 +49,7 @@ namespace PrivaPub.Api.Mastodon.Auth
 					Permissions.GrantTypes.TokenExchange
 				}
 			};
-			foreach (var scopeName in new[] { "read", "write", "follow" })
+			foreach (var scopeName in FirstPartyScopes)
 				descriptor.Permissions.Add(Permissions.Prefixes.Scope + scopeName);
 
 			var existing = await applications.FindByClientIdAsync(clientId, token);

PrivaPub/Api/Mastodon/Auth/TokenController.cs

@@ -70,7 +70,7 @@ namespace PrivaPub.Api.Mastodon.Auth
 			var identity = new ClaimsIdentity(TokenValidationParameters.DefaultAuthenticationType, Claims.Name, Claims.Role);
 			identity.SetClaim(Claims.Subject, avatar.ID);
 			identity.SetClaim(Claims.Name, avatar.UserName);
-			identity.SetScopes(MastodonScopes.Parse(request.Scope).Intersect(new[] { "read", "write", "follow" }));
+			identity.SetScopes(MastodonScopes.Parse(request.Scope).Intersect(PersonaExchange.FirstPartyScopes));
 			identity.SetDestinations(_ => new[] { Destinations.AccessToken });
 			return SignIn(new ClaimsPrincipal(identity), OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
 		}