Extend the push pipeline to Android devices through the Silo push
relay's /v1/fcm/send endpoint. push_devices gains platform-conditional
FCM token columns (encrypted at rest with row AAD, hashed like APNs
tokens), the generic POST /notifications/push/devices endpoint the
Android client already calls registers FCM tokens, and fanout,
operational dispatch, retries, and terminal UNREGISTERED device
disabling all reuse the existing Apple machinery. Delivery is gated by
a new notifications.android_push_delivery_enabled setting, advertised
through the capability endpoint's android_push block, and testable via
POST /admin/notifications/push/fcm/test.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Add push notifications support
* fix(notifications): address push notification review findings
- Gate the capability endpoint's apple_push availability on the admin
delivery toggle, matching web push: Available now means setup will
actually deliver.
- Reject direct admin writes to push_relay_deployment_id/api_key; the
relay issues them as a pair during registration and a lone write
desyncs them (and poisons the next rotation request).
- Purge a device's registrations under other profiles when it
re-registers, so a profile switch on a shared device stops the old
profile's pushes (attempts cascade); adds a DB-backed test.
- Extract the shared channelDispatcher core + retry sweep and rebuild
the webhook/web push/Apple push dispatchers on it instead of keeping
three copies of the worker-pool/retry loop.
- Deduplicate relay URL validation (admin setting + register flow) and
the push outbox attempt-building loops behind shared helpers.
- Cap free-text decline reasons in notification display bodies.
- Fix TestHandleApplePushDisplayDB expectations to match the shared
display copy (test previously failed under SILO_TEST_DATABASE_URL).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(notifications): route push relay URL writes through registration only
Direct writes to notifications.push_relay_url via the admin settings
endpoint bypassed the relay registration flow, letting the stored URL
drift out of sync with the deployment id / API key pair the relay
minted for it. Reject the URL alongside the deployment id and API key
in the settings handler; POST /admin/notifications/push/relay/register
remains the only path that persists all three together.
The admin UI's Relay URL field now edits local draft state and is
applied by the Register/Rotate action instead of the settings save.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Quick104