Source PR: #87 · docs/rfcs/push-notification-subscriptions.md · @pgherveou
Description
Four methods let a product manage the (signer, topic) push whitelist on the user's own device; the backend pushes when a matching signed statement appears on the Statement Store. A fifth, push_broadcast, is an interim publish path where the host binds signer itself.
Motivation
Push v2 puts delivery behind a whitelist the user controls, but no TrUAPI method can edit it. Push tokens must stay in the backend and never reach a product.
Requirements
signer is mandatory on every rule, and every operation is scoped to the calling user's own subscription.add and remove are idempotent; set replaces the whole set atomically; list is read-only.- The product never sees a push token.
push_broadcast is interim, and its signer is not product-overridable.
Tasks
Source PR: #87 ·
docs/rfcs/push-notification-subscriptions.md· @pgherveouDescription
Four methods let a product manage the
(signer, topic)push whitelist on the user's own device; the backend pushes when a matching signed statement appears on the Statement Store. A fifth,push_broadcast, is an interim publish path where the host bindssigneritself.Motivation
Push v2 puts delivery behind a whitelist the user controls, but no TrUAPI method can edit it. Push tokens must stay in the backend and never reach a product.
Requirements
signeris mandatory on every rule, and every operation is scoped to the calling user's own subscription.addandremoveare idempotent;setreplaces the whole set atomically;listis read-only.push_broadcastis interim, and itssigneris not product-overridable.Tasks