Back/webpush #2662

p1gp1g · 2025-11-28T08:54:15Z

This PR adds web push support to send push notifications. Web Push is defined by 3 RFCs: RFC8030 (the requests), RFC8291 (encryption) and RFC8292 (server authorization).

It can then be used by the web application to receive real time notifications, even when nextcloud isn't opened in a tab, and without the notify_push app (which adds a websocket support to nextcloud). This is particularly useful for collaborative work, as nexcloud isn't always opened but we can expect to be notified anyway. This support is in the second PR

This support also allow to get push notifications on Android without the proxy:

FCM servers can be notified with webpush
UnifiedPush can be used, for user who prefer or can't use the Play Services

Fix #1225

Required for:
nextcloud/android#8684
nextcloud/talk-android#257

Which will also fix:
nextcloud/android#12151 (won't be necessary)
nextcloud/android#11898 (duplicate)
nextcloud/android#5510 (supersede, openpush was a research project, and their website now link to unifiedpush)
nextcloud/android#8800 (another duplicated ?)
nextcloud/android#3333 (UP supports allow using FCM without the proprietary lib)
(There might be other issues)

wrenix · 2025-11-28T09:56:45Z

You do not signoff your commits, could you please check the DCO CI job?

p1gp1g · 2025-11-28T11:33:34Z

@provokateurin it may interest you for Neon

nickvergessen · 2025-12-02T07:15:08Z

We'll check the rough idea later this week, but CI seems pretty red at the moment 🙈

p1gp1g · 2025-12-02T07:53:38Z

We'll check the rough idea later this week, but CI seems pretty red at the moment 🙈

Indeed, I'm fixing it. I was waiting for the CI to run

PS: I forgot to mention, this feature is part of a grant with NLnet

nickvergessen · 2025-12-02T09:47:56Z

It's conflicting in composer.lock so CI is not starting 🙈

p1gp1g · 2025-12-02T10:12:23Z

Should be ok now

p1gp1g · 2025-12-03T10:51:32Z

@nickvergessen Can you run the CI again ?

p1gp1g · 2025-12-03T14:58:23Z

I will need some help to fix the CI.

The static-psalm-analysis raises many UndefinedClass: I don't know how you manage to fix this on other existent classes?
The integration tests fail, I think it is because test:integration runs tests/Integration/run.sh and it misses mozart compose, used to get minishlink/web-push. I can't run the CI on my own repo, I think that because the workflows use your own runners. Do you mind if I push a commit that I think should work ? We probably can expect one or 2 tries before
it works

p1gp1g · 2025-12-04T07:59:39Z

The changes for the android-lib are ready, once this PR is done: nextcloud/android-library@master...p1gp1g:nextcloud-library:feat/webpush

p1gp1g · 2025-12-05T09:40:56Z

@nickvergessen : Are you OK to run the CI if I push a potential fix for it? (cf. #2662 (comment))

nickvergessen · 2025-12-05T09:55:44Z

You were missing some files to set up Mozart correctly, I added them. Let's see what that does to CI.

nickvergessen · 2025-12-05T09:59:10Z

composer.lock

            "time": "2025-12-02T00:53:42+00:00"
        },
-        {
-            "name": "psr/clock",


Something is wrong here.
It might be that your dependency brings in psr/clock or in a different version or something

it has moved to the packages list, same version: it may be possible another lib use it. Is it a problem since the lib is still listed ?

The problem is that it should be here, but aparently is not anymore as per Psalm:

Error: lib/BackgroundJob/GenerateUserSettings.php:21:3: MissingDependency: OCP\AppFramework\Utility\ITimeFactory depends on class or interface psr\clock\clockinterface that does not exist (see https://psalm.dev/157)

Is it ok if I do composer require psr/clock --dev and update the lock, so it will be explicitly included in dev requirement ?

I'm not sure how that fully works, but psr/clock is part of server's 3rdparty directory already and we should not duplicate it or create a conflict or something.
Maybe you can try if provide solves that?
https://github.com/ChristophWurst/nextcloud_sentry/blob/9e8385fb2c0c170edbedc3d81f3d304f50197cd6/composer.json#L27-L29

If I understand correctly, we have to add the "provide" to nextcloud/ocp, I can push a test using a temporary repo to override nextcloud/ocp

I've tested different combinations, with/without provide, in notification app, in ocp, with require/require-dev and nothing works: p1gp1g#1 any idea ?

I've found the issue: mozart removes the vendor directory after namespacing, and psc/clock is a transitive dependence of the webpush lib

p1gp1g · 2025-12-05T10:02:59Z

Thank you. I think we need to ignore the new vendor directories too?

nickvergessen · 2025-12-05T10:13:24Z

I think we need to ignore the new vendor directories too?

The vendor-bin/ part is correctly ignored already:

/vendor-bin/*/vendor

But since this app is shipped with the server it has to be buildable repeatingly, so we need to commit lib/Vendor/ at the end of the pull request work or in a follow up. (Please don't commit it yet, as it makes the PR even more unreadable and not loadable in the GitHub UI)

p1gp1g · 2025-12-05T10:18:16Z

OK, I see, maybe excluding them from the lint checks then ?

lib/Migration/Version6000Date20251112110000.php

Signed-off-by: Joas Schilling <coding@schilljs.com>

Fix index too long for the DB Signed-off-by: sim <git@sgougeon.fr>

Signed-off-by: sim <git@sgougeon.fr>

p1gp1g · 2025-12-09T08:05:13Z

The psalm CI was fixed, but there was still some errors. The lint error is fixed now, and I moved the VAPID initialization to fix other CI. There shouldn't be much to do now. The openapi CI is expected to fail because lib/Vendor isn't included in the git repo at this moment

p1gp1g · 2025-12-09T12:16:59Z

OK, the CI is finally good 👍

blizzz · 2025-12-09T12:50:19Z

The openapi CI is expected to fail because lib/Vendor isn't included in the git repo at this moment

Are you sure? I think the lib/Vendor is just misleading, the actual mismatch that leads to the error state happens before. Did you try regenerating the openapi specs?

p1gp1g · 2025-12-09T12:58:23Z

The openapi CI is expected to fail because lib/Vendor isn't included in the git repo at this moment

Are you sure? I think the lib/Vendor is just misleading, the actual mismatch that leads to the error state happens before. Did you try regenerating the openapi specs?

Yes, the openapi jsons are updated in the PR, and if I run composer run openapi nothing changes

nickvergessen · 2025-12-09T13:34:30Z

Yeah that's okay for now.

Unfortunately I'm sick atm, but I hope to be able to review it in more detail later this or next week.

p1gp1g · 2025-12-09T14:04:39Z

I wish you good recovery. I'll finish UnifiedPush support for Talk android until then :)

github-actions · 2025-12-13T02:30:37Z

Hello there,
Thank you so much for taking the time and effort to create a pull request to our Nextcloud project.

We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process.

Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6

Thank you for contributing to Nextcloud and we hope to hear from you soon!

(If you believe you should not receive this message, you can add yourself to the blocklist.)

wrenix · 2025-12-13T09:00:00Z

Why not put lib/Vendor into the .gitignore ?

nickvergessen · 2025-12-13T15:27:57Z

Why not put lib/Vendor into the .gitignore ?

Because we need repeatable builds and packages, so any shipped code needs to be checked in at the end.

p1gp1g · 2026-01-05T13:31:43Z

Hey, I wish you recovered well, and a happy new year. This is a gentle bump to find out when you think you'll be able to continue the review ?

nickvergessen · 2026-01-08T16:20:14Z

Hey, I wish you recovered well, and a happy new year.

Not fully there yet, but getting there. Thanks a lot.

This is a gentle bump to find out when you think you'll be able to continue the review ?

Yes.

nickvergessen

After writing the summary I pressed outside of the box and it wiped the text. Sorry if this is shorter now, just can't write it twice.

I reviewed most of the code, but can't follow all the changes in Push.php. Some look like they try to do things that are unrelated to introducing webpush support?

Also we are now checking 2 database tables all the time. Comparing the table structures it should almost be possible to map them to a single one?

id
uid
token
endpoint = proxyserver
p256dh = devicepublickey
auth = pushtokenhash
apptypes = apptype
activated = ??
activation_token = deviceidentifier

Not sure that makes sense, just an idea. Otherwise we should start caching if a user has at least one device in webpush and/or pushhash to save queries where possible.

I'm also missing some general information. Which server is being used by default if a user/device/app would use this? Is it sending data to any 3rd party servers, e.g. unifiedpush.org?

nickvergessen · 2026-01-08T15:55:03Z

lib/Controller/WebPushController.php

+	case NO_SUB = 3;
+}
+
+#[OpenAPI(scope: 'push')]


Nitpick: I think we should use a different scope, as a client either needs to implement and handle the APIs of push or the ones from webpush, but basically not both?

As you prefer. On the other side, this controller only adds 3 endpoints, and they are about push notifications too, and webpush is added to the push capabilities too.

Let me know if you still prefer a new scope (webpush)

lib/Controller/WebPushController.php

nickvergessen · 2026-01-08T16:14:24Z

lib/Controller/WebPushController.php

+	 * @param string $endpoint Push Server URL, max 765 chars (RFC8030)
+	 * @param string $uaPublicKey Public key of the device, uncompress base64url encoded (RFC8291)
+	 * @param string $auth Authentication tag, base64url encoded (RFC8291)
+	 * @param string $apptypes comma seperated list of types used to filter incoming notifications - apptypes are alphanum - use "all" to get all notifications, prefix with `-` to exclude (eg. 'all,-talk')


Nitpick: Looks like it's "our choice", then let's stick with current naming patterns:

Suggested change

* @param string $apptypes comma seperated list of types used to filter incoming notifications - apptypes are alphanum - use "all" to get all notifications, prefix with `-` to exclude (eg. 'all,-talk')

* @param string $appTypes comma seperated list of types used to filter incoming notifications - apptypes are alphanum - use "all" to get all notifications, prefix with `-` to exclude (eg. 'all,-talk')

nickvergessen · 2026-01-08T16:15:24Z

lib/Controller/WebPushController.php

+	 * Register a subscription for push notifications
+	 *
+	 * @param string $endpoint Push Server URL, max 765 chars (RFC8030)
+	 * @param string $uaPublicKey Public key of the device, uncompress base64url encoded (RFC8291)


UA is user agent? I'd prefer to stick with the naming you use to explain it in the description :P

Suggested change

* @param string $uaPublicKey Public key of the device, uncompress base64url encoded (RFC8291)

* @param string $devicePublicKey Public key of the device, uncompress base64url encoded (RFC8291)

RFC8291 always refer to user agents, and it may be more realistic given a single device can have multiple user agents (multiple browsers, multiple sessions, etc). Device in the comment is a shortcut

Again, let me know, I can rename if you still prefer changing

lib/Controller/WebPushController.php

nickvergessen · 2026-01-08T16:55:58Z

lib/Push.php

 			$device['token'] = (int)$device['token'];
 			if (!$this->validateToken($device['token'], $maxAge)) {
 				// Token does not exist anymore
+				$this->deleteProxyPushToken($device['token']);


When the device was inactive for 60 days we shouldn't delete it directly.
It's possible that the device/user is coming back online.
The problem is the comment is misleading by now.

cf. https://github.com/nextcloud/notifications/pull/2662/files#r2673154228 comment

validateToken used to call this function in this case, delete*PushToken have just been moved out of validateToken

Not fully, last branch of validateToken is also returning false and not deleting it:

notifications/lib/Push.php

Lines 568 to 574 in 1237d5f

if ($age > $maxAge) {

$this->printInfo('Device token is valid');

return true;

}

$this->printInfo('<comment>Device token "last checked" is older than 60 days: ' . $age . '</comment>');

return false;

nickvergessen · 2026-01-08T16:59:03Z

lib/Push.php

+					// The nextcloud application, requested with the proxy push,
+					// use to not support `delete-multiple`
+					if (!\in_array($app, ['spreed', 'talk', 'admin_notification_talk'], true)) {


I don't understand where this is coming from?

It comes with this commit, which will be easier to understand alone: 424adbc

424adbc#diff-5f4fa2d752904832306c56f7832e2126a1e12db8dd1679abd71e526b77989821L173

If the application wasn't 'talk' (so assumed nextcloud), we used to split notificationIds into arrays of 1 element and call pushDeleteToDevice for each elements. That's because nextcloud application doesn't support (yet) delete-multiple (which I have implemented for Nextcloud, but that's another question)

As:

We don't have any legacy to maintain with the new webpush feature, so that's the best moment to avoid introducing a debt here => we expect all web push client to support delete-multiple

It is more efficient to send delete-multiple

We don't have a single "application type" per UA/client with web push, but the clients subscribe to different types. It allows:

to handle every subscriptions independently and more efficiently

3rd party clients don't have to "fake" being nextcloud or talk

it allows another application to subscribe only for its own notifications (for example, a task application could subscribe for tasks notifications only)

And because we don't want the behavior to change for proxy push, and notifiationIds isn't a single element array anymore, we do the notificationIds split in proxyPushDeleteToDevice if the application doesn't target talk

But looking closer at the implementation, we should do a condition to control that the device's apptype is talk, not if the app emitting the notification is talk. Which is different from the current behavior, but will probably break the CI tests (cf. 424adbc#diff-5f4fa2d752904832306c56f7832e2126a1e12db8dd1679abd71e526b77989821L173 memo: $this->deletesToPush is $userId => $appId => $notificationIds)

When/If the future PR for Nextcloud application is merged, I can open a PR here, to assume delete-multiple is supported by all proxy-push clients too, which would avoid any issue. I think it will be OK to merge it ~a year after the Nextcloud app support it

Ah, thanks for the explanation, my biggest point of trouble was the negation on !in_array which I had missed and I was wondering why you would stop doing the better version for talk :D

nickvergessen · 2026-01-08T17:01:35Z

lib/Push.php

 				if ($type === IToken::WIPE_TOKEN) {
 					// Token does not exist any more, should drop the push device entry
 					$this->printInfo('Device token is marked for remote wipe');
-					$this->deletePushToken($tokenId);


Should be kept with deleteProxyPushToken

cf. This commit 094eccb =>

Before that commit, validateToken used to:

be used for proxyPush only

call deletePushToken before returning false, in 2 different cases

After that commit, validateToken:

can be used to validate tokens for proxyPush and webpush

therefore, doesn't call deletePushToken directly

As it used to call deletePushToken everytime it returned false, deleteProxyPushToken and deleteWebPushToken are now called in place everytime the validation failed; cf

094eccb#diff-5f4fa2d752904832306c56f7832e2126a1e12db8dd1679abd71e526b77989821R386

094eccb#diff-5f4fa2d752904832306c56f7832e2126a1e12db8dd1679abd71e526b77989821R507

I think it is more readable if the deletion doesn't happen in the validation function. If it helps to review the PR, I can do something else: keep the deletion in validateToken and add a parameter to inform if it is called for web push or proxy push. Then I can potentially open another PR to move the deletion out of the function

nickvergessen · 2026-01-08T17:01:58Z

lib/Push.php

 			} catch (InvalidTokenException) {
 				// Token does not exist any more, should drop the push device entry
 				$this->printInfo('<error>InvalidTokenException is thrown</error>');
-				$this->deletePushToken($tokenId);


Should be kept with deleteProxyPushToken

cf. https://github.com/nextcloud/notifications/pull/2662/files#r2673154228 comment

delete*PushToken have just been moved out of validateToken

nickvergessen · 2026-01-08T17:03:52Z

lib/Push.php

+	 */
+	protected function webPushCallback(MessageSentReport $report): void {
+		if ($report->isSubscriptionExpired()) {
+			$this->deleteWebPushTokenByEndpoint($report->getEndpoint());


This permanently removes all the device entries, even if the subscription is continued in the future?

It removes a single push subscription, endpoints are unique

Signed-off-by: sim <git@sgougeon.fr>

p1gp1g

After writing the summary I pressed outside of the box and it wiped the text. Sorry if this is shorter now, just can't write it twice.

Thanks a lot for the review! No problem for the missing summary :)

I tried to answer all your points. I've to push a few commits after submitting that review. You made some comments to potentially change a few things, such as variable names, I made a comment to explain why I did that way, just confirm for each comments if you still want to make the modification and I'll commit it

I reviewed most of the code, but can't follow all the changes in Push.php. Some look like they try to do things that are unrelated to introducing webpush support?

Changes in Push.php should not change how it works for proxy push. But I had to move a few things when it wasn't applicable to web push. There are mainly 2 things:

the delete*Token has been moved out the verification function, but is called for the same events
the split of notificationIds for non-talk app is done later but applies to the same events

I have commented these different changes

Also we are now checking 2 database tables all the time. Comparing the table structures it should almost be possible to map them to a single one?
* id

* uid

* token

* endpoint = proxyserver

* p256dh = devicepublickey

* auth = pushtokenhash

* apptypes = apptype

* activated = ??

* activation_token = deviceidentifier
Not sure that makes sense, just an idea. Otherwise we should start caching if a user has at least one device in webpush and/or pushhash to save queries where possible.

We used to do this kind of casting for other app, and this isn't great. The columns will contain different types of data. It leads to confusion, may have side effect and make it harder to modify in the future. So I prefer 2 tables :)

I'm also missing some general information. Which server is being used by default if a user/device/app would use this? Is it sending data to any 3rd party servers, e.g. unifiedpush.org?

This first PR is about web push, so most of the time you will have one of the big players push servers (fcm.googleapis.com for Chromium based browsers, push.services.mozilla.com for Firefox based browsers, and push.apple.com for Apple products). Once this PR and the frontend PR are merged, we'll be able to get notifications on browser even when Nextcloud isn't opened in a tab (which will help me to not miss Talk messages :))

And of course, the idea is to reuse this feature for UnifiedPush too, which I have already implemented on Nextcloud app. Web push can also be used to push to FCM (Google play notifications) without nextcloud proxy, using VAPID authentication instead of the secret hosted on nextcloud proxy, which may be used to reduce load on your nextcloud proxy. The feature will probably be used by Neon too

And finally, other push servers may be used. Gnome browser doesn't have one yet, but it may be added later, and there are some new browsers being implemented

p1gp1g · 2026-01-09T11:21:27Z

lib/Controller/WebPushController.php

+	case NO_SUB = 3;
+}
+
+#[OpenAPI(scope: 'push')]


As you prefer. On the other side, this controller only adds 3 endpoints, and they are about push notifications too, and webpush is added to the push capabilities too.

Let me know if you still prefer a new scope (webpush)

p1gp1g · 2026-01-09T11:24:28Z

lib/Controller/WebPushController.php

+	 * Register a subscription for push notifications
+	 *
+	 * @param string $endpoint Push Server URL, max 765 chars (RFC8030)
+	 * @param string $uaPublicKey Public key of the device, uncompress base64url encoded (RFC8291)


RFC8291 always refer to user agents, and it may be more realistic given a single device can have multiple user agents (multiple browsers, multiple sessions, etc). Device in the comment is a shortcut

Again, let me know, I can rename if you still prefer changing

p1gp1g · 2026-01-09T11:39:58Z

lib/Migration/Version6000Date20251112110000.php

+				'notnull' => true,
+				'length' => 767,
+			]);
+			$table->addColumn('p256dh', Types::STRING, [


Are you ok with ua_public, like RFC8291 does, if we continue with uaPublicKey wit the previous comment ?

p1gp1g · 2026-01-09T11:42:32Z

lib/Migration/Version6000Date20251112110000.php

+				'notnull' => true,
+				'length' => 32,
+			]);
+			$table->addColumn('apptypes', Types::STRING, [


It was for consistency with notifications_pushhash table

Confirm and I change 👍

p1gp1g · 2026-01-09T11:55:24Z

lib/WebPushClient.php

+		$publicKey = $this->appConfig->getValueString(
+			Application::APP_ID,
+			'webpush_vapid_pubkey',
+			lazy: true


I don't know the details, and you probably know better than me.

The only thing I have is the doc saying "do not flag as lazy part of code that might be called during the global loading of the instance and its apps", and getVapid isn't done called during that phase. Should I remove ?

PS: There is a typo in the doc where lazy is written in leet with a 1, 1azy

p1gp1g · 2026-01-09T13:35:52Z

lib/Push.php


 			if (!$this->validateToken($device['token'], $maxAge)) {
 				// Token does not exist anymore
+				$this->deleteProxyPushToken($device['token']);


cf. https://github.com/nextcloud/notifications/pull/2662/files#r2673154228 comment

validateToken used to call this function in this case, delete*PushToken have just been moved out of validateToken

p1gp1g · 2026-01-09T14:39:20Z

lib/Push.php

+					// The nextcloud application, requested with the proxy push,
+					// use to not support `delete-multiple`
+					if (!\in_array($app, ['spreed', 'talk', 'admin_notification_talk'], true)) {


It comes with this commit, which will be easier to understand alone: 424adbc

424adbc#diff-5f4fa2d752904832306c56f7832e2126a1e12db8dd1679abd71e526b77989821L173

If the application wasn't 'talk' (so assumed nextcloud), we used to split notificationIds into arrays of 1 element and call pushDeleteToDevice for each elements. That's because nextcloud application doesn't support (yet) delete-multiple (which I have implemented for Nextcloud, but that's another question)

As:

We don't have any legacy to maintain with the new webpush feature, so that's the best moment to avoid introducing a debt here => we expect all web push client to support delete-multiple

It is more efficient to send delete-multiple

We don't have a single "application type" per UA/client with web push, but the clients subscribe to different types. It allows:

to handle every subscriptions independently and more efficiently

3rd party clients don't have to "fake" being nextcloud or talk

it allows another application to subscribe only for its own notifications (for example, a task application could subscribe for tasks notifications only)

And because we don't want the behavior to change for proxy push, and notifiationIds isn't a single element array anymore, we do the notificationIds split in proxyPushDeleteToDevice if the application doesn't target talk

But looking closer at the implementation, we should do a condition to control that the device's apptype is talk, not if the app emitting the notification is talk. Which is different from the current behavior, but will probably break the CI tests (cf. 424adbc#diff-5f4fa2d752904832306c56f7832e2126a1e12db8dd1679abd71e526b77989821L173 memo: $this->deletesToPush is $userId => $appId => $notificationIds)

p1gp1g · 2026-01-09T14:41:38Z

lib/Push.php

+	 */
+	protected function webPushCallback(MessageSentReport $report): void {
+		if ($report->isSubscriptionExpired()) {
+			$this->deleteWebPushTokenByEndpoint($report->getEndpoint());


It removes a single push subscription, endpoints are unique

p1gp1g · 2026-01-09T14:56:52Z

lib/Push.php

+					// The nextcloud application, requested with the proxy push,
+					// use to not support `delete-multiple`
+					if (!\in_array($app, ['spreed', 'talk', 'admin_notification_talk'], true)) {


When/If the future PR for Nextcloud application is merged, I can open a PR here, to assume delete-multiple is supported by all proxy-push clients too, which would avoid any issue. I think it will be OK to merge it ~a year after the Nextcloud app support it

p1gp1g · 2026-01-09T15:13:22Z

lib/Controller/WebPushController.php

+	}
+
+	protected function getWPClient(): WebPushClient {
+		return new WebPushClient($this->appConfig);


Hm, no idea. For the moment this is another function so WebPushClient is initialized only if we need the VAPID public key or send a push notification, with the validation token

Co-authored-by: Joas Schilling <213943+nickvergessen@users.noreply.github.com> Signed-off-by: S1m <31284753+p1gp1g@users.noreply.github.com>

p1gp1g requested a review from nickvergessen as a code owner November 28, 2025 08:54

This was referenced Nov 28, 2025

Front/webpush #2663

Draft

WebPush support #1225

Open

p1gp1g force-pushed the back/webpush branch from c3f1d40 to 608bdec Compare November 28, 2025 10:03

nickvergessen added this to the Nextcloud 33 milestone Dec 2, 2025

nickvergessen added enhancement 2. developing feature: push 📲 feature: backend 🛠️ labels Dec 2, 2025

p1gp1g force-pushed the back/webpush branch 2 times, most recently from 9afa07d to 4da7b5f Compare December 2, 2025 09:03

p1gp1g force-pushed the back/webpush branch from 4da7b5f to 0fca97e Compare December 2, 2025 10:11

This was referenced Dec 4, 2025

Support notifications for f-droid version nextcloud/talk-android#257

Open

UnifiedPush for push notifications nextcloud/android#8684

Open

nickvergessen reviewed Dec 5, 2025

View reviewed changes

lib/Migration/Version6000Date20251112110000.php Outdated Show resolved Hide resolved

nickvergessen and others added 8 commits December 9, 2025 08:14

ci(cs): Ignore lib/Vendor/ dir from coding standards

5fa1b47

Signed-off-by: Joas Schilling <coding@schilljs.com>

feat(webpush): Reduce max size for endpoint

294025e

Fix index too long for the DB Signed-off-by: sim <git@sgougeon.fr>

feat(webpush): Lint

e2c0181

Signed-off-by: sim <git@sgougeon.fr>

feat(webpush): Update query count

180cf92

Signed-off-by: sim <git@sgougeon.fr>

feat(webpush): Keep vendor dir

de4a2bf

Signed-off-by: sim <git@sgougeon.fr>

feat(webpush): Fix psalm CI

1c94e08

Signed-off-by: sim <git@sgougeon.fr>

feat(webpush): Lint

c6b6bc8

Signed-off-by: sim <git@sgougeon.fr>

feat(webpush): Init VAPID in constructor

c57b446

Signed-off-by: sim <git@sgougeon.fr>

p1gp1g force-pushed the back/webpush branch from 96a9bef to c57b446 Compare December 9, 2025 08:01

github-actions bot added the feedback-requested label Dec 13, 2025

nextcloud-bot mentioned this pull request Jan 7, 2026

33.0.0 beta 2 nextcloud/server#57398

Merged

nickvergessen requested changes Jan 8, 2026

View reviewed changes

nextcloud-bot mentioned this pull request Jan 9, 2026

33.0.0 beta 3 nextcloud/server#57441

Open

p1gp1g added 4 commits January 9, 2026 16:09

Rename appTypes

1b14795

Signed-off-by: sim <git@sgougeon.fr>

Store VAPID pubkey in plaintext

05fca1b

Signed-off-by: sim <git@sgougeon.fr>

Fix typo in comment

e73a982

Signed-off-by: sim <git@sgougeon.fr>

Add WebPushClient to Push constructor

3c1e695

Signed-off-by: sim <git@sgougeon.fr>

p1gp1g commented Jan 9, 2026

View reviewed changes

Apply suggestions from code review

36a6877

Co-authored-by: Joas Schilling <213943+nickvergessen@users.noreply.github.com> Signed-off-by: S1m <31284753+p1gp1g@users.noreply.github.com>

	* @param string $apptypes comma seperated list of types used to filter incoming notifications - apptypes are alphanum - use "all" to get all notifications, prefix with `-` to exclude (eg. 'all,-talk')
	* @param string $appTypes comma seperated list of types used to filter incoming notifications - apptypes are alphanum - use "all" to get all notifications, prefix with `-` to exclude (eg. 'all,-talk')

	* @param string $uaPublicKey Public key of the device, uncompress base64url encoded (RFC8291)
	* @param string $devicePublicKey Public key of the device, uncompress base64url encoded (RFC8291)

	if ($age > $maxAge) {
	$this->printInfo('Device token is valid');
	return true;
	}

	$this->printInfo('<comment>Device token "last checked" is older than 60 days: ' . $age . '</comment>');
	return false;

Back/webpush #2662

Are you sure you want to change the base?

Back/webpush #2662

Conversation

p1gp1g commented Nov 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wrenix commented Nov 28, 2025

Uh oh!

p1gp1g commented Nov 28, 2025

Uh oh!

nickvergessen commented Dec 2, 2025

Uh oh!

p1gp1g commented Dec 2, 2025

Uh oh!

nickvergessen commented Dec 2, 2025

Uh oh!

p1gp1g commented Dec 2, 2025

Uh oh!

p1gp1g commented Dec 3, 2025

Uh oh!

p1gp1g commented Dec 3, 2025

Uh oh!

p1gp1g commented Dec 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

p1gp1g commented Dec 5, 2025

Uh oh!

nickvergessen commented Dec 5, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

p1gp1g commented Dec 5, 2025

Uh oh!

nickvergessen commented Dec 5, 2025

Uh oh!

p1gp1g commented Dec 5, 2025

Uh oh!

Uh oh!

p1gp1g commented Dec 9, 2025

Uh oh!

p1gp1g commented Dec 9, 2025

Uh oh!

blizzz commented Dec 9, 2025

Uh oh!

p1gp1g commented Dec 9, 2025

Uh oh!

nickvergessen commented Dec 9, 2025

Uh oh!

p1gp1g commented Dec 9, 2025

Uh oh!

github-actions bot commented Dec 13, 2025

Uh oh!

wrenix commented Dec 13, 2025

Uh oh!

nickvergessen commented Dec 13, 2025

Uh oh!

p1gp1g commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nickvergessen commented Jan 8, 2026

Uh oh!

nickvergessen left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

p1gp1g commented Nov 28, 2025 •

edited

Loading

p1gp1g commented Dec 4, 2025 •

edited

Loading

p1gp1g commented Jan 5, 2026 •

edited

Loading