!450 · krz/gitbay

CHANGELOG.org +6

   =instance=, the instance's =site_url=, and =user=, the recipient's
   username — together the account's identity.
 - =DuePush= joins =users= for the recipient; no schema change.
+- =notifications device add= now returns the row id, so a client that
+  wants to deregister does not have to list devices and match its own
+  token against the truncated display value.
+- The alert carries =aps.badge=, the recipient's unread inbox count.
+  =DuePush= counts it at send time, a subquery against =inbox=, so a
+  cleared inbox is reflected even though the row was queued earlier.
 * v1.32.0 — 2026-09-20

docs/specs/2026-09-20-ios-push-notifications-design.md +5 −2

 | Command | Notes |
 |---|---|
-| `notifications device add` | `--label <name>`, token on stdin. `ReadsStdin: true`. |
+| `notifications device add` | `--label <name>`, token on stdin. `ReadsStdin: true`. Returns the row id, for deregistration. |
 | `notifications device list` | `ReadOnly`. Token shown truncated, never in full. |
 | `notifications device remove <id>` | Own devices only. |
 | `notifications settings push on\|off` | Joins `settings mail` and `settings watch`. |
   "aps": {
     "alert": {"title": "krz/gitbay", "body": "cmc opened issue #12"},
     "sound": "default",
+    "badge": 3,
     "thread-id": "krz/gitbay"
   },
   "path": "krz/gitbay/issues/12",
 string the inbox row carries, so the two surfaces cannot disagree.
 `thread-id` groups a repository's notices in Notification Center.
 `path` is the inbox row's `path` field, which the app already knows how
-to turn into a link.
+to turn into a link. `badge` is the recipient's unread inbox count,
+counted by `DuePush` at send time rather than at enqueue, so a cleared
+inbox is reflected.
 `instance` is this instance's `site_url` and `user` the recipient's
 username. A device token is one install, and an install registers

e2e/push_test.go +4

 	if inst, _ := got[0]["instance"].(string); !strings.HasPrefix(inst, "https://") {
 		t.Fatalf("instance = %v, want this instance's site_url", inst)
 	}
+	// Bob's one unread notice, for the app icon badge.
+	if aps["badge"] != float64(1) {
+		t.Fatalf("badge = %v", aps["badge"])
+	}
 	// Apple retires the token. The next push reaps the device.
 	mu.Lock()

internal/control/notifications.go +4 −3

 	if len(token) > maxDeviceTokenBytes {
 		return c.fail(protocol.ExitUsage, "device token is too long")
 	}
-	if _, err := c.Store.AddPushDevice(c.User.ID, token, f.Value("--label")); err != nil {
+	id, err := c.Store.AddPushDevice(c.User.ID, token, f.Value("--label"))
+	if err != nil {
 		return c.fail(protocol.ExitFailure, "%v", err)
 	}
-	return c.emit(map[string]string{"status": "registered"}, func(w io.Writer) {
+	return c.emit(map[string]any{"id": id, "status": "registered"}, func(w io.Writer) {
-		fmt.Fprintln(w, "device registered")
+		fmt.Fprintf(w, "device %d registered\n", id)
 	})
 }

internal/control/notifications_test.go +22

	@@ -2,6 +2,7 @@ package control
2		2
3	import (	3	import (
4	"bytes"	4	"bytes"
		5	"fmt"
5	"strings"	6	"strings"
6	"testing"	7	"testing"
7		8
	@@ -221,6 +222,27 @@ func TestNotificationsDeviceListMasksAShortToken(t *testing.T) {
221	}	222	}
222	}	223	}
223		224
		225	// device add returns the row id. Without it a client that wants to
		226	// deregister has to list devices and match its own token against the
		227	// truncated display value, which is identity by rendered string.
		228	func TestNotificationsDeviceAddReturnsTheID(t *testing.T) {
		229	c := notifTestCtx(t, "alice")
		230	c.Stdin = strings.NewReader("DEVTOKEN\n")
		231	var out bytes.Buffer
		232	c.Stdout, c.JSON = &out, true
		233	if code := runNotificationsDeviceAdd(c, nil); code != 0 {
		234	t.Fatalf("exit %d", code)
		235	}
		236	devices, _ := c.Store.PushDevices(c.User.ID)
		237	if len(devices) != 1 {
		238	t.Fatalf("want one device, got %d", len(devices))
		239	}
		240	want := fmt.Sprintf(`"id":%d`, devices[0].ID)
		241	if !strings.Contains(out.String(), want) {
		242	t.Fatalf("output %s does not carry %s", out.String(), want)
		243	}
		244	}
		245
224	func TestNotificationsSettingsShowsPush(t *testing.T) {	246	func TestNotificationsSettingsShowsPush(t *testing.T) {
225	c := notifTestCtx(t, "alice")	247	c := notifTestCtx(t, "alice")
226	var out bytes.Buffer	248	var out bytes.Buffer

internal/push/apns.go +2 −1

 // Send delivers one alert. The returned duration is the server's
 // Retry-After when it gave one, zero otherwise.
-func (c *Client) Send(ctx context.Context, token, user, title, body, path string) (result, time.Duration, error) {
+func (c *Client) Send(ctx context.Context, token, user string, badge int, title, body, path string) (result, time.Duration, error) {
 	if len(body) > maxBodyBytes {
 		// A raw byte cut can land mid-rune on multi-byte UTF-8 (emoji,
 		// accents, non-Latin usernames). ToValidUTF8 drops the
 		"aps": map[string]any{
 			"alert":     map[string]string{"title": title, "body": body},
 			"sound":     "default",
+			"badge":     badge,
 			"thread-id": title,
 		},
 		"path": path,

internal/push/apns_test.go +8 −4

 		json.Unmarshal(raw, &payload)
 		w.WriteHeader(200)
 	})
-	res, _, err := c.Send(context.Background(), "DEVTOKEN", "cmc", "krz/gitbay", "cmc opened issue #12", "krz/gitbay/issues/12")
+	res, _, err := c.Send(context.Background(), "DEVTOKEN", "cmc", 3, "krz/gitbay", "cmc opened issue #12", "krz/gitbay/issues/12")
 	if err != nil || res != resultSent {
 		t.Fatalf("res = %v, err = %v", res, err)
 	}
 				w.WriteHeader(tc.status)
 				io.WriteString(w, tc.body)
 			})
-			res, after, err := c.Send(context.Background(), "T", "u", "t", "b", "p")
+			res, after, err := c.Send(context.Background(), "T", "u", 0, "t", "b", "p")
 			// Only a delivered push has no error. Every other result
 			// carries the status and reason, which is what the drainer
 			// records on the queue row.
 	// even offset, so a raw cut at maxBodyBytes is guaranteed to land on
 	// the second byte of one of them rather than a rune boundary.
 	long := "x" + strings.Repeat("é", 2000)
-	res, _, err := c.Send(context.Background(), "T", "u", "t", long, "p")
+	res, _, err := c.Send(context.Background(), "T", "u", 0, "t", long, "p")
 	if err != nil || res != resultSent {
 		t.Fatalf("res = %v, err = %v", res, err)
 	}
 	})
 	c.siteURL = "https://gitbay.org"
-	if _, _, err := c.Send(context.Background(), "DEVTOKEN", "cmc",
+	if _, _, err := c.Send(context.Background(), "DEVTOKEN", "cmc", 2,
 		"krz/gitbay", "cmc opened issue #12", "krz/gitbay/issues/12"); err != nil {
 		t.Fatalf("Send: %v", err)
 	}
 	if payload["path"] != "krz/gitbay/issues/12" {
 		t.Fatalf("path = %v", payload["path"])
 	}
+	aps := payload["aps"].(map[string]any)
+	if aps["badge"] != float64(2) {
+		t.Fatalf("badge = %v", aps["badge"])
+	}
 }

internal/push/push.go +1 −1

	@@ -49,7 +49,7 @@ func (d *Deliverer) drain(ctx context.Context) {
49	return	49	return
50	}	50	}
51	for _, q := range due {	51	for _, q := range due {
52	res, after, sendErr := d.Cl.Send(ctx, q.Token, q.Username, q.Title, q.Body, q.Path)	52	res, after, sendErr := d.Cl.Send(ctx, q.Token, q.Username, q.Badge, q.Title, q.Body, q.Path)
53	msg := ""	53	msg := ""
54	if sendErr != nil {	54	if sendErr != nil {
55	msg = sendErr.Error()	55	msg = sendErr.Error()

internal/store/push.go +6 −2

 	Body     string
 	Path     string
 	Attempts int
+	// Badge is the recipient's unread inbox count, for the alert's badge.
+	// Counted here rather than at enqueue so a cleared inbox is reflected.
+	Badge int
 }
 // EnqueuePush writes one row per registered device, and nothing when the
 func (s *Store) DuePush(limit int) ([]QueuedPush, error) {
 	rows, err := s.DB.Query(`
-		SELECT q.id, q.device_id, d.token, u.username, q.title, q.body, q.path, q.attempts
+		SELECT q.id, q.device_id, d.token, u.username, q.title, q.body, q.path, q.attempts,
+		       (SELECT COUNT(*) FROM inbox WHERE user_id = d.user_id AND read_at IS NULL)
 		FROM push_queue q
 		JOIN push_devices d ON d.id = q.device_id
 		JOIN users u ON u.id = d.user_id
 	var out []QueuedPush
 	for rows.Next() {
 		var p QueuedPush
-		if err := rows.Scan(&p.ID, &p.DeviceID, &p.Token, &p.Username, &p.Title, &p.Body, &p.Path, &p.Attempts); err != nil {
+		if err := rows.Scan(&p.ID, &p.DeviceID, &p.Token, &p.Username, &p.Title, &p.Body, &p.Path, &p.Attempts, &p.Badge); err != nil {
 			return nil, err
 		}
 		out = append(out, p)

internal/store/push_test.go +37

	@@ -275,3 +275,40 @@ func TestDuePushCarriesTheUsername(t *testing.T) {
275	t.Fatalf("Username = %q, want alice", due[0].Username)	275	t.Fatalf("Username = %q, want alice", due[0].Username)
276	}	276	}
277	}	277	}
		278
		279	// The queue row carries the recipient's unread count, so the alert can
		280	// badge the app icon. Counted at send rather than at enqueue: an inbox
		281	// cleared in the seconds before delivery is reflected.
		282	func TestDuePushCarriesTheUnreadCount(t *testing.T) {
		283	s := pushFixture(t)
		284	uid, err := s.CreateUser("alice", false)
		285	if err != nil {
		286	t.Fatal(err)
		287	}
		288	repoID, err := s.CreateRepo("user", uid, "app", "public")
		289	if err != nil {
		290	t.Fatal(err)
		291	}
		292	if _, err := s.AddPushDevice(uid, "tok-a", "iphone"); err != nil {
		293	t.Fatal(err)
		294	}
		295	// Two unread inbox rows, then a queued push.
		296	for i := 0; i < 2; i++ {
		297	if err := s.AddNotice(uid, repoID, "issue", "bob", "opened issue #1", "alice/app/issues/1"); err != nil {
		298	t.Fatal(err)
		299	}
		300	}
		301	if err := s.EnqueuePush(uid, "alice/app", "bob opened issue #1", "alice/app/issues/1"); err != nil {
		302	t.Fatal(err)
		303	}
		304	due, err := s.DuePush(20)
		305	if err != nil {
		306	t.Fatal(err)
		307	}
		308	if len(due) != 1 {
		309	t.Fatalf("want one queued push, got %d", len(due))
		310	}
		311	if due[0].Badge != 2 {
		312	t.Fatalf("Badge = %d, want 2", due[0].Badge)
		313	}
		314	}

push: return the device id and badge the alert !450