Web Push channel: alerts to paired phones without a third-party messenger

[okieselbach]

What this adds

A Web Push notification channel: alerts reach paired phones and browsers directly from the backend, end-to-end encrypted per device (RFC 8291), without a third-party messenger. Decisions D-327 to D-330.

• Provider Push (50) in both channel scopes. The channel carries no destination; NotificationChannelDispatcher now takes a NotificationScope from every caller and the push transport resolves the scope's paired devices at send time (table-backed Admin/Operator in a tenant, GlobalAdmin with matching identity binding on the platform). The tenant-scope provider stays Global-Admin-only until the customer release, behind the same validation gate as Telegram.
• Pairing without a sign-in on the phone. A signed-in Admin/Operator creates a one-shot code (QR or 11 characters, hashed, 10 minutes, five-failure burn); the phone redeems it anonymously; the portal session confirms the device. The phone's only credential is a device token in a request header, good for status, re-subscribe and unpair of its own row.
• Library src/Push (BCL only, no packages): VAPID key ring with a kid on every device row, RFC 8291 aes128gcm encryption with the RFC's Appendix A vector pinned byte for byte, an SSRF-gated HTTP client and an endpoint host policy.
• Lock-screen projection: a push carries an allow-list of facts only, never rule sections, raw payloads, failure reasons or the ops message; serial numbers masked; 2 KB cap.
• Lifecycle: 404/410 mark a device Stale instead of deleting it (the receiver re-arms itself on open); devices pause when their owner stops signing in and resume by themselves; role loss sends a wipe push and deletes the row. PushDevices and PushPairingGrants are credential-bearing: raw-table deny-list, no backup, redacted dependency telemetry.
• Receiver app under /push/ (service worker, Declarative Web Push shape, local history, pairing and status pages, manifest and icons) and portal UI (provider in the channel editor, pairing dialog with QR, device lists for tenant and platform scope, "Notify me when done" on a session).
• Operations: 22 catalogued routes, ops events PushDeliveryFailed and PushEndpointRefused, maintenance sweep inside the existing run, settings template, health markers.

A second review pass (35 confirmed findings) is folded in: Global-Admin session watches fan out over the watcher's own scopes, per-device throttle on the token routes, one pause path for send time and maintenance, no Revoked state anywhere, CAS retry loop, re-arm after transport-failure pauses, de-duplicated ops events.

Verification

Suite	Result
Backend (xUnit)	7371 passed (+183 new push tests)
Push library	125 passed
MCP	997 passed
Web	2061 passed, tsc 0, eslint 0
Solution build	0 warnings
zizmor on ci.yml	no findings

Before the first push (operator)

1. Push__Vapid__ActiveKey is set (generator script in the infra repo).
2. Add /api/push to the Function App's client-certificate exclusion paths. Platform CORS already reflects the X-Push-Device-Token header; without the exclusion the push routes answer 403 from the platform before any code runs.
3. Deploy Backend, then Web, then MCP (the provider enum changes both generated wire files). Verify the deployed version.
4. Admin › Alerts: create the ops channel "Push to paired devices" and bind rules. Alerts › Push devices: pair a phone.
5. Log alert on the PushDelivery custom event to the Action Group e-mail, so a push outage is not reported only over push.

Still open

• Interop on real devices (iPhone home-screen app without a portal sign-in, Android, Windows, macOS, Firefox).
• Trust text for the Conditional-Access consequence before any customer tenant uses the channel.
• Key rotation remains a re-pair campaign; the receiver cannot migrate to a new VAPID key by itself.
• Push.Tests has only run on Windows so far; production is Linux.

The branch also carries four dependency commits made on it in parallel (sprintf-js removal, sharp/proxy-addr/source-map-js bumps, validate.js replacing ajv-cli).

🤖 Generated with Claude Code