R9 Web Push in decePub: one subscription per persona, each with its own token and registration

Settings gets "Notifications on this device" (PushEditor): personas, alerts in four groups, policy, a test
notification, after a one-time notice of what the push service learns. Each persona ticked gets its own service
worker registration (push-worker.js at push/{slot}/), so its own endpoint and keys, subscribed with its own token
(IHttpService's *As); nothing PrivaPub stores ties two personas together and the worker never reads the payload's
token. PushService follows the tokens (re-subscribing after a renewal), reconciles at every session start, turns
off before sign-out and drops deleted or suspended personas. A click opens that persona's notifications; the app
badge counts the unread ones. Exchanges now ask for the push scope.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

Models/APIs.cs

@@ -122,7 +122,8 @@ public static class APIs
 		public const string POST_Revoke = "oauth/revoke";
 		public const string TokenExchangeGrant = "urn:ietf:params:oauth:grant-type:token-exchange";
 		public const string JwtTokenType = "urn:ietf:params:oauth:token-type:jwt";
-		public const string Scopes = "read write follow";
+		// push since R9: a persona's token subscribes that persona to Web Push (PrivaPub's PersonaExchange grants it)
+		public const string Scopes = "read write follow push";
 	}
 
 	public static class Mastodon
@@ -196,6 +197,11 @@ public static class APIs
 		public static string GET_M_FavouritedBy(string statusId) => $"api/v1/statuses/{Uri.EscapeDataString(statusId)}/favourited_by";
 		public static string GET_M_RebloggedBy(string statusId) => $"api/v1/statuses/{Uri.EscapeDataString(statusId)}/reblogged_by";
 		public const string POST_Reports = "api/v1/reports";
+		// Web Push: one subscription per access token, so the persona whose token goes with the request
+		public const string GET_PushSubscription = "api/v1/push/subscription";
+		public const string POST_PushSubscription = "api/v1/push/subscription";
+		public const string PUT_PushSubscription = "api/v1/push/subscription";
+		public const string DELETE_PushSubscription = "api/v1/push/subscription";
 		public const string GET_NotificationPolicy = "api/v2/notifications/policy";
 		public const string PATCH_NotificationPolicy = "api/v2/notifications/policy";
 		public const string GET_NotificationRequests = "api/v1/notifications/requests";

Models/Mastodon/InstanceV2.cs

@@ -1,7 +1,7 @@
 namespace decePubClient.Models.Mastodon;
 
 /// <summary>/api/v2/instance, the part the client reads: what the server calls itself and says of itself, its contact,
-/// its rules, and what an upload may be.</summary>
+/// its rules, what an upload may be, and its Web Push key.</summary>
 public class InstanceV2
 {
 	public string Domain { get; set; }
@@ -38,6 +38,14 @@ public class InstanceConfiguration
 {
 	public MediaConfiguration MediaAttachments { get; set; } = new();
 	public AccountsConfiguration Accounts { get; set; } = new();
+	public VapidConfiguration Vapid { get; set; } = new();
+}
+
+/// <summary>The server's VAPID public key (RFC 8292), the applicationServerKey a browser subscribes to Web Push with: the
+/// uncompressed P-256 point, URL-safe base64. Null on a server that pushes nothing.</summary>
+public class VapidConfiguration
+{
+	public string PublicKey { get; set; }
 }
 
 /// <summary>What an account may hold: how many hashtags it features on its profile (PrivaPub's 10).</summary>

Models/Mastodon/WebPush.cs

@@ -0,0 +1,55 @@
+using System.Text.Json.Serialization;
+
+namespace decePubClient.Models.Mastodon;
+
+/// <summary>Mastodon's WebPushSubscription (/api/v1/push/subscription): one per access token, so one per persona.
+/// Alerts holds every alert PrivaPub knows, true or false.</summary>
+public class WebPushSubscription
+{
+	public string Id { get; set; }
+	public string Endpoint { get; set; }
+	public bool Standard { get; set; }
+	public Dictionary<string, bool> Alerts { get; set; } = [];
+	/// <summary>The server's VAPID public key, URL-safe base64.</summary>
+	public string ServerKey { get; set; }
+	/// <summary>all, followed, follower or none.</summary>
+	public string Policy { get; set; }
+}
+
+/// <summary>POST /api/v1/push/subscription as JSON: the browser's subscription and what it is pushed. PrivaPub reads it as
+/// Mastodon's flattened parameters (subscription[endpoint], subscription[keys][p256dh], data[alerts][mention], ...).</summary>
+public class PushSubscriptionForm
+{
+	public PushEndpoint Subscription { get; set; } = new();
+	public PushData Data { get; set; } = new();
+}
+
+/// <summary>The browser's push subscription: where the push service takes the pushes, and the keys they are encrypted
+/// to. Standard: RFC 8291's aes128gcm (with RFC 8292's VAPID header), which every browser that pushes decrypts.</summary>
+public class PushEndpoint
+{
+	public string Endpoint { get; set; }
+	public PushKeys Keys { get; set; } = new();
+	public bool Standard { get; set; }
+}
+
+/// <summary>The browser's P-256 public key and authentication secret, URL-safe base64.</summary>
+public class PushKeys
+{
+	[JsonPropertyName("p256dh")]
+	public string P256dh { get; set; }
+	public string Auth { get; set; }
+}
+
+/// <summary>What a subscription is pushed: each alert on or off (one left out is off), and whose.</summary>
+public class PushData
+{
+	public Dictionary<string, bool> Alerts { get; set; } = [];
+	public string Policy { get; set; }
+}
+
+/// <summary>PUT /api/v1/push/subscription: data[alerts] and data[policy] replace what the subscription had.</summary>
+public class PushDataForm
+{
+	public PushData Data { get; set; } = new();
+}

Models/PublicActionNotices.cs

@@ -2,7 +2,8 @@ namespace decePubClient.Models;
 
 /// <summary>
 /// The personas already told that an act of theirs is public (owner decision, PrivaPub's ROADMAP: each persona is told
-/// once, before its first one): reactions and poll votes, and joining an event. Kept in localStorage under its type name.
+/// once, before its first one): reactions and poll votes, and joining an event; and whether this device was told, before
+/// its first Web Push subscription, what the browser's push service learns. Kept in localStorage under its type name.
 /// </summary>
 public class PublicActionNotices
 {
@@ -10,10 +11,14 @@ public class PublicActionNotices
 	public List<string> PersonaIds { get; set; } = [];
 	/// <summary>Told about joining events.</summary>
 	public List<string> EventPersonaIds { get; set; } = [];
+	/// <summary>This device was told about Web Push (once for the device, whichever personas it subscribes).</summary>
+	public bool PushTold { get; set; }
 }
 
 public enum PublicAct
 {
 	Reaction = 0,
-	Participation = 1
+	Participation = 1,
+	/// <summary>Notifications on this device go through the browser's push service, which learns when they arrive.</summary>
+	Push = 2
 }

Models/PushDevice.cs

@@ -0,0 +1,54 @@
+using decePubClient.Models.Types;
+
+namespace decePubClient.Models
+{
+	/// <summary>
+	/// Web Push on this device (Services/PushService.cs), kept in localStorage under its type name: the personas whose
+	/// notifications reach it, and the alerts and policy each of their subscriptions holds. Never a token: each persona's
+	/// subscription is made with that persona's own token, which only AuthData keeps.
+	/// </summary>
+	public class PushDevice
+	{
+		/// <summary>The personas subscribed on this device, each through its own service worker registration.</summary>
+		public List<PushPersona> Personas { get; set; } = [];
+		/// <summary>The alerts turned on (PushAlerts.Offered's names).</summary>
+		public List<string> Alerts { get; set; } = [.. PushAlerts.Offered];
+		public PushPolicy Policy { get; set; } = PushPolicy.All;
+	}
+
+	/// <summary>One persona's subscription on this device.</summary>
+	public class PushPersona
+	{
+		/// <summary>The persona's avatar id.</summary>
+		public string PersonaId { get; set; }
+		/// <summary>A random name this device gives the persona's service worker registration (its scope is push/{slot}/), so
+		/// the persona's subscription has an endpoint and keys of its own; it means nothing anywhere else.</summary>
+		public string Slot { get; set; }
+		/// <summary>PrivaPub's id for the subscription, as it last answered.</summary>
+		public string SubscriptionId { get; set; }
+	}
+
+	/// <summary>What js/push.js says of this browser: whether it can be pushed to, why not (insecure, unsupported, or
+	/// ios-install: an iPhone or iPad pushes only to the app added to the Home Screen), and what the reader allowed.</summary>
+	public class PushSupport
+	{
+		public bool Supported { get; set; }
+		public string Reason { get; set; }
+		/// <summary>default, granted or denied (Notification.permission).</summary>
+		public string Permission { get; set; }
+
+		public bool IsGranted => Permission == "granted";
+		public bool IsDenied => Permission == "denied";
+	}
+
+	/// <summary>A persona's push subscription in this browser, as js/push.js reads it (its keys URL-safe base64), or why it
+	/// couldn't be made.</summary>
+	public class BrowserSubscription
+	{
+		public string Endpoint { get; set; }
+		public string P256dh { get; set; }
+		public string Auth { get; set; }
+		public bool Standard { get; set; }
+		public string Error { get; set; }
+	}
+}

Models/Types/PushPolicy.cs

@@ -0,0 +1,48 @@
+namespace decePubClient.Models.Types
+{
+	/// <summary>Whose notifications a Web Push subscription is pushed (Mastodon's data[policy]): anyone's, those of the
+	/// accounts the persona follows, of its followers, or nobody's. What the persona tells itself (its poll ended, a warning
+	/// from the staff) passes every policy but None.</summary>
+	public enum PushPolicy
+	{
+		All = 0,
+		Followed = 1,
+		Follower = 2,
+		None = 3
+	}
+
+	public static class PushPolicies
+	{
+		/// <summary>The policy as Mastodon's API names it.</summary>
+		public static string Name(PushPolicy policy) => policy switch
+		{
+			PushPolicy.Followed => "followed",
+			PushPolicy.Follower => "follower",
+			PushPolicy.None => "none",
+			_ => "all"
+		};
+
+		/// <summary>A policy Mastodon's API named; all for anything else, as PrivaPub reads a policy left out.</summary>
+		public static PushPolicy Of(string name) => name switch
+		{
+			"followed" => PushPolicy.Followed,
+			"follower" => PushPolicy.Follower,
+			"none" => PushPolicy.None,
+			_ => PushPolicy.All
+		};
+	}
+
+	/// <summary>
+	/// The alerts a decePub subscription offers: Mastodon 4.5's names (data[alerts]) that PrivaPub notifies, then Pleroma's
+	/// emoji reactions. PrivaPub keeps admin.sign_up, admin.report, quoted_update, severed_relationships and annual_report
+	/// too, but never fires them, so they are never offered and always sent off.
+	/// </summary>
+	public static class PushAlerts
+	{
+		public static readonly string[] Offered =
+		[
+			"mention", "status", "quote", "update", "poll", "favourite", "reblog", "pleroma:emoji_reaction", "follow", "follow_request",
+			"moderation_warning"
+		];
+	}
+}