Pete/internal/web/pwa.go

package web

import (
	"io/fs"
	"log/slog"
	"net/http"

	"pete/internal/safehttp"
	"pete/internal/storage"
)

// maxPushBodyBytes caps a subscription payload. A PushSubscription JSON is an
// endpoint URL plus two short base64 keys — a few hundred bytes — so 4 KiB is
// generous headroom for long endpoint URLs.
const maxPushBodyBytes = 4096

// handlePushSubscribe stores the caller's Web Push subscription. The body is the
// browser's PushSubscription.toJSON() shape: {endpoint, keys:{p256dh, auth}}.
func (s *Server) handlePushSubscribe(w http.ResponseWriter, r *http.Request) {
	u := s.requireUser(w, r)
	if u == nil {
		return
	}
	if !s.cfg.Push.Enabled {
		http.Error(w, `{"error":"push disabled"}`, http.StatusNotFound)
		return
	}
	var req struct {
		Endpoint string `json:"endpoint"`
		Keys     struct {
			P256dh string `json:"p256dh"`
			Auth   string `json:"auth"`
		} `json:"keys"`
	}
	if !decodeStateBodyN(w, r, &req, maxPushBodyBytes) {
		return
	}
	if req.Endpoint == "" || req.Keys.P256dh == "" || req.Keys.Auth == "" {
		http.Error(w, `{"error":"incomplete subscription"}`, http.StatusBadRequest)
		return
	}
	// The endpoint is delivered to server-side; reject non-http(s) schemes here so
	// a client can't stash a file:// or gopher:// target. The digest sender's
	// SSRF-guarded client blocks non-public hosts at dial time, but keeping bad
	// endpoints out of the table avoids storing garbage in the first place.
	if err := safehttp.ValidateURL(req.Endpoint); err != nil {
		http.Error(w, `{"error":"invalid endpoint"}`, http.StatusBadRequest)
		return
	}
	// The localpart is captured here because this is the only place the mapping is
	// available: the alert sender runs on a ticker with no session to read. It may
	// be empty for a session minted before the game economy existed — that costs
	// only the owner-scoped alerts, and heals on the next re-subscribe.
	if err := storage.AddPushSubscription(u.Sub, buyerLocalpart(u), req.Endpoint, req.Keys.P256dh, req.Keys.Auth); err != nil {
		slog.Error("push: subscribe failed", "sub", u.Sub, "err", err)
		http.Error(w, `{"error":"internal error"}`, http.StatusInternalServerError)
		return
	}
	w.WriteHeader(http.StatusNoContent)
}

// handlePushHeal fills in the Matrix handle on a subscription stored before the
// column existed. W6 shipped owner-scoped adventure alerts keyed on the
// localpart, and every row that predates it carries an empty one — so those
// subscribers get the realm-wide Siege alerts and silently never get the ones
// about their own adventurer. Nothing in the browser re-subscribes on its own
// (pwa.js only calls subscribe() on a click), so without this they stay broken
// until they happen to toggle notifications off and on again.
//
// It takes only an endpoint, and it is deliberately not a subscribe: see
// HealPushSubscriptionLocalpart on why re-using the upsert here would have
// silenced the digest for anybody who reads the site regularly.
func (s *Server) handlePushHeal(w http.ResponseWriter, r *http.Request) {
	u := s.requireUser(w, r)
	if u == nil {
		return
	}
	if !s.cfg.Push.Enabled {
		http.Error(w, `{"error":"push disabled"}`, http.StatusNotFound)
		return
	}
	var req struct {
		Endpoint string `json:"endpoint"`
	}
	if !decodeStateBodyN(w, r, &req, maxPushBodyBytes) {
		return
	}
	if req.Endpoint == "" {
		http.Error(w, `{"error":"incomplete subscription"}`, http.StatusBadRequest)
		return
	}
	// 204 whether or not a row moved. The client asks once per endpoint and has
	// nothing to do with the answer, and reporting a miss would tell a caller
	// whether somebody else's endpoint is on file.
	if err := storage.HealPushSubscriptionLocalpart(u.Sub, req.Endpoint, buyerLocalpart(u)); err != nil {
		slog.Error("push: heal failed", "sub", u.Sub, "err", err)
		http.Error(w, `{"error":"internal error"}`, http.StatusInternalServerError)
		return
	}
	w.WriteHeader(http.StatusNoContent)
}

// handlePushUnsubscribe drops the caller's own stored subscription by endpoint.
// The delete is scoped to the signed-in user so one account can't remove
// another's subscription by presenting its endpoint string.
func (s *Server) handlePushUnsubscribe(w http.ResponseWriter, r *http.Request) {
	u := s.requireUser(w, r)
	if u == nil {
		return
	}
	var req struct {
		Endpoint string `json:"endpoint"`
	}
	if !decodeStateBodyN(w, r, &req, maxPushBodyBytes) {
		return
	}
	if req.Endpoint == "" {
		http.Error(w, `{"error":"missing endpoint"}`, http.StatusBadRequest)
		return
	}
	if err := storage.RemovePushSubscriptionForUser(u.Sub, req.Endpoint); err != nil {
		slog.Error("push: unsubscribe failed", "sub", u.Sub, "err", err)
		http.Error(w, `{"error":"internal error"}`, http.StatusInternalServerError)
		return
	}
	w.WriteHeader(http.StatusNoContent)
}

// handleManifest serves the web app manifest from the embedded static tree. It
// lives at the root so the installable scope covers the whole origin.
func (s *Server) handleManifest(w http.ResponseWriter, r *http.Request) {
	s.serveEmbedded(w, r, "manifest.webmanifest", "application/manifest+json; charset=utf-8", "public, max-age=3600")
}

// handleServiceWorker serves /sw.js from the root. Serving it here rather than
// under /static/ lets its scope be the whole origin (a worker's default scope
// is its own path), and we set Service-Worker-Allowed as a belt-and-braces in
// case it's ever moved. no-cache keeps updated workers from being pinned by the
// HTTP cache — the browser still byte-compares to decide whether to install.
func (s *Server) handleServiceWorker(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Service-Worker-Allowed", "/")
	s.serveEmbedded(w, r, "sw.js", "text/javascript; charset=utf-8", "no-cache")
}

// serveEmbedded writes a file from the embedded static FS with explicit headers.
func (s *Server) serveEmbedded(w http.ResponseWriter, _ *http.Request, name, contentType, cacheControl string) {
	sub, err := fs.Sub(staticFS, "static")
	if err != nil {
		http.Error(w, "internal error", http.StatusInternalServerError)
		return
	}
	b, err := fs.ReadFile(sub, name)
	if err != nil {
		http.NotFound(w, nil)
		return
	}
	w.Header().Set("Content-Type", contentType)
	w.Header().Set("Cache-Control", cacheControl)
	_, _ = w.Write(b)
}