!449 · krz/gitbay

CHANGELOG.org +11

	@@ -4,6 +4,17 @@ Versioning follows semver from v0.1.0. Database migrations run
4	automatically on daemon start; upgrade notes appear per release when	4	automatically on daemon start; upgrade notes appear per release when
5	anything beyond "replace the binary and restart" is needed.	5	anything beyond "replace the binary and restart" is needed.
6		6
		7	* v1.32.1 — 2026-09-20
		8
		9	A push alert names the account it is for (#89).
		10
		11	- The payload carried =path= and nothing else, so a device signed in to
		12	more than one account could not tell which instance a notice came
		13	from: two instances can hold the same =owner/name=. It now carries
		14	=instance=, the instance's =site_url=, and =user=, the recipient's
		15	username — together the account's identity.
		16	- =DuePush= joins =users= for the recipient; no schema change.
		17
7	* v1.32.0 — 2026-09-20	18	* v1.32.0 — 2026-09-20
8		19
9	Push notifications to iOS devices (#89): activity reaches a registered	20	Push notifications to iOS devices (#89): activity reaches a registered

cmd/gitbayd/main.go +1 −1

	@@ -178,7 +178,7 @@ func serveCmd() *cobra.Command {
178	go notify.New(st, cfg, retryBase).Run(whCtx)	178	go notify.New(st, cfg, retryBase).Run(whCtx)
179	}	179	}
180	if cfg.Push.Enabled {	180	if cfg.Push.Enabled {
181	p, err := push.New(st, cfg.Push, retryBase)	181	p, err := push.New(st, cfg.Push, cfg.Server.SiteURL, retryBase)
182	if err != nil {	182	if err != nil {
183	// Config validation already parsed the key, so this	183	// Config validation already parsed the key, so this
184	// is not a misconfiguration; fail loudly rather than	184	// is not a misconfiguration; fail loudly rather than

docs/specs/2026-09-20-ios-push-notifications-design.md +10 −1

     "sound": "default",
     "thread-id": "krz/gitbay"
   },
-  "path": "krz/gitbay/issues/12"
+  "path": "krz/gitbay/issues/12",
+  "instance": "https://gitbay.org",
+  "user": "cmc"
 }
 ```
 `path` is the inbox row's `path` field, which the app already knows how
 to turn into a link.
+`instance` is this instance's `site_url` and `user` the recipient's
+username. A device token is one install, and an install registers
+against every account signed in on it, so `path` alone cannot say which
+account a notice belongs to — two instances can hold the same
+`owner/name`. The pair is the account's identity, and the client
+resolves it before routing.
 `apns-push-type: alert`, `apns-topic` from config, and
 `apns-collapse-id` unset — collapsing is wrong here, two comments are
 two notices.

e2e/push_test.go +8

	@@ -125,6 +125,14 @@ environment = "production"
125	if got[0]["path"] != "alice/app/issues/1" {	125	if got[0]["path"] != "alice/app/issues/1" {
126	t.Fatalf("path = %v", got[0]["path"])	126	t.Fatalf("path = %v", got[0]["path"])
127	}	127	}
		128	// The account the notice is for. A device signed in to several
		129	// accounts cannot tell from the path alone which one this is.
		130	if got[0]["user"] != "bob" {
		131	t.Fatalf("user = %v", got[0]["user"])
		132	}
		133	if inst, _ := got[0]["instance"].(string); !strings.HasPrefix(inst, "https://") {
		134	t.Fatalf("instance = %v, want this instance's site_url", inst)
		135	}
128		136
129	// Apple retires the token. The next push reaps the device.	137	// Apple retires the token. The next push reaps the device.
130	mu.Lock()	138	mu.Lock()

internal/push/apns.go +17 −6

 	host   string
 	scheme string
 	topic  string
+	// siteURL is this instance, as the alert reports it. With the
+	// recipient's username it identifies the account a notice belongs
+	// to, which a device signed in to several cannot otherwise tell.
+	siteURL string
 }
-func NewClient(cfg config.Push) (*Client, error) {
+func NewClient(cfg config.Push, siteURL string) (*Client, error) {
 	c := &Client{
 		// stdlib negotiates HTTP/2 over ALPN, which is what APNs
 		// requires; no explicit http2 transport is needed.
-		http:   &http.Client{Timeout: 30 * time.Second},
+		http:    &http.Client{Timeout: 30 * time.Second},
-		host:   cfg.Host(),
+		host:    cfg.Host(),
-		scheme: apnsScheme(),
+		scheme:  apnsScheme(),
-		topic:  cfg.Topic,
+		topic:   cfg.Topic,
+		siteURL: siteURL,
 	}
 	if cfg.KeyFile != "" {
 		key, err := config.LoadAPNSKey(cfg.KeyFile)
 // Send delivers one alert. The returned duration is the server's
 // Retry-After when it gave one, zero otherwise.
-func (c *Client) Send(ctx context.Context, token, title, body, path string) (result, time.Duration, error) {
+func (c *Client) Send(ctx context.Context, token, user, title, body, path string) (result, time.Duration, error) {
 	if len(body) > maxBodyBytes {
 		// A raw byte cut can land mid-rune on multi-byte UTF-8 (emoji,
 		// accents, non-Latin usernames). ToValidUTF8 drops the
 			"thread-id": title,
 		},
 		"path": path,
+		// Which account this is for. A device token is one install, and
+		// an install registers against every account signed in on it, so
+		// path alone is ambiguous — two instances can hold the same
+		// owner/name. Together these are the account's identity.
+		"instance": c.siteURL,
+		"user":     user,
 	})
 	if err != nil {
 		return resultDead, 0, err

internal/push/apns_test.go +33 −4

 	c, err := NewClient(config.Push{
 		Enabled: true, KeyID: "K", TeamID: "T",
 		Topic: "org.gitbay.gitbay", Environment: "production",
-	})
+	}, "https://gitbay.example")
 	if err != nil {
 		t.Fatal(err)
 	}
 		json.Unmarshal(raw, &payload)
 		w.WriteHeader(200)
 	})
-	res, _, err := c.Send(context.Background(), "DEVTOKEN", "krz/gitbay", "cmc opened issue #12", "krz/gitbay/issues/12")
+	res, _, err := c.Send(context.Background(), "DEVTOKEN", "cmc", "krz/gitbay", "cmc opened issue #12", "krz/gitbay/issues/12")
 	if err != nil || res != resultSent {
 		t.Fatalf("res = %v, err = %v", res, err)
 	}
 				w.WriteHeader(tc.status)
 				io.WriteString(w, tc.body)
 			})
-			res, after, err := c.Send(context.Background(), "T", "t", "b", "p")
+			res, after, err := c.Send(context.Background(), "T", "u", "t", "b", "p")
 			// Only a delivered push has no error. Every other result
 			// carries the status and reason, which is what the drainer
 			// records on the queue row.
 	// even offset, so a raw cut at maxBodyBytes is guaranteed to land on
 	// the second byte of one of them rather than a rune boundary.
 	long := "x" + strings.Repeat("é", 2000)
-	res, _, err := c.Send(context.Background(), "T", "t", long, "p")
+	res, _, err := c.Send(context.Background(), "T", "u", "t", long, "p")
 	if err != nil || res != resultSent {
 		t.Fatalf("res = %v, err = %v", res, err)
 	}
 		}
 	}
 }
+// The alert names the account it belongs to. One device token is one
+// install, and an install registers against every account signed in on
+// it, so `path` alone cannot say which instance a notice came from — two
+// instances can hold the same owner/name.
+func TestSendNamesTheAccount(t *testing.T) {
+	var payload map[string]any
+	c, _ := fakeAPNs(t, func(w http.ResponseWriter, r *http.Request) {
+		raw, _ := io.ReadAll(r.Body)
+		json.Unmarshal(raw, &payload)
+		w.WriteHeader(200)
+	})
+	c.siteURL = "https://gitbay.org"
+	if _, _, err := c.Send(context.Background(), "DEVTOKEN", "cmc",
+		"krz/gitbay", "cmc opened issue #12", "krz/gitbay/issues/12"); err != nil {
+		t.Fatalf("Send: %v", err)
+	}
+	if payload["instance"] != "https://gitbay.org" {
+		t.Fatalf("instance = %v", payload["instance"])
+	}
+	if payload["user"] != "cmc" {
+		t.Fatalf("user = %v", payload["user"])
+	}
+	// Still carries what it always did.
+	if payload["path"] != "krz/gitbay/issues/12" {
+		t.Fatalf("path = %v", payload["path"])
+	}
+}

internal/push/push.go +3 −3

	@@ -20,8 +20,8 @@ type Deliverer struct {
20	MaxAttempts int	20	MaxAttempts int
21	}	21	}
22		22
23	func New(st store.Store, cfg config.Push, retryBase time.Duration) (Deliverer, error) {	23	func New(st store.Store, cfg config.Push, siteURL string, retryBase time.Duration) (Deliverer, error) {
24	cl, err := NewClient(cfg)	24	cl, err := NewClient(cfg, siteURL)
25	if err != nil {	25	if err != nil {
26	return nil, err	26	return nil, err
27	}	27	}
	@@ -49,7 +49,7 @@ func (d *Deliverer) drain(ctx context.Context) {
49	return	49	return
50	}	50	}
51	for _, q := range due {	51	for _, q := range due {
52	res, after, sendErr := d.Cl.Send(ctx, q.Token, q.Title, q.Body, q.Path)	52	res, after, sendErr := d.Cl.Send(ctx, q.Token, q.Username, q.Title, q.Body, q.Path)
53	msg := ""	53	msg := ""
54	if sendErr != nil {	54	if sendErr != nil {
55	msg = sendErr.Error()	55	msg = sendErr.Error()

internal/store/push.go +9 −3

 	ID       int64
 	DeviceID int64
 	Token    string
+	// Username is the recipient. One device token is one install, and an
+	// install registers against every account signed in on it, so the
+	// alert has to name which of them it is for.
+	Username string
 	Title    string
 	Body     string
 	Path     string
 func (s *Store) DuePush(limit int) ([]QueuedPush, error) {
 	rows, err := s.DB.Query(`
-		SELECT q.id, q.device_id, d.token, q.title, q.body, q.path, q.attempts
+		SELECT q.id, q.device_id, d.token, u.username, q.title, q.body, q.path, q.attempts
-		FROM push_queue q JOIN push_devices d ON d.id = q.device_id
+		FROM push_queue q
+		JOIN push_devices d ON d.id = q.device_id
+		JOIN users u ON u.id = d.user_id
 		WHERE q.sent_at IS NULL AND q.failed_at IS NULL
 		  AND (q.next_attempt_at IS NULL OR q.next_attempt_at <= ?)
 		ORDER BY q.id LIMIT ?`, fmtTime(time.Now()), limit)
 	var out []QueuedPush
 	for rows.Next() {
 		var p QueuedPush
-		if err := rows.Scan(&p.ID, &p.DeviceID, &p.Token, &p.Title, &p.Body, &p.Path, &p.Attempts); err != nil {
+		if err := rows.Scan(&p.ID, &p.DeviceID, &p.Token, &p.Username, &p.Title, &p.Body, &p.Path, &p.Attempts); err != nil {
 			return nil, err
 		}
 		out = append(out, p)

internal/store/push_test.go +28

	@@ -247,3 +247,31 @@ func TestDeletePushDeviceByTokenTakesItsQueue(t *testing.T) {
247	t.Fatalf("queued rows outlived their device")	247	t.Fatalf("queued rows outlived their device")
248	}	248	}
249	}	249	}
		250
		251	// A queued push carries the recipient's username, so the alert can name
		252	// the account it belongs to. A device token is one install, and one
		253	// install registers against every account signed in on it; without the
		254	// username the client cannot tell which of them a push is for.
		255	func TestDuePushCarriesTheUsername(t *testing.T) {
		256	s := pushFixture(t)
		257	uid, err := s.CreateUser("alice", false)
		258	if err != nil {
		259	t.Fatal(err)
		260	}
		261	if _, err := s.AddPushDevice(uid, "tok-a", "iphone"); err != nil {
		262	t.Fatal(err)
		263	}
		264	if err := s.EnqueuePush(uid, "alice/app", "bob opened issue #1", "alice/app/issues/1"); err != nil {
		265	t.Fatal(err)
		266	}
		267	due, err := s.DuePush(20)
		268	if err != nil {
		269	t.Fatal(err)
		270	}
		271	if len(due) != 1 {
		272	t.Fatalf("want one queued push, got %d", len(due))
		273	}
		274	if due[0].Username != "alice" {
		275	t.Fatalf("Username = %q, want alice", due[0].Username)
		276	}
		277	}

push: name the account an alert is for !449