fix(push): stop web push from posting to arbitrary endpoints

This commit is contained in:
Yun Chan 2026-09-28 00:53:48 +09:00
parent 1afaea7214
commit 043ef579a8
7 changed files with 418 additions and 34 deletions

View file

@ -19,6 +19,7 @@ import {
import { readApnsConfig, sendApnsMessage } from '../_shared/apns.ts'
import { readWebPushConfig, sendWebPushMessage } from '../_shared/webpush.ts'
import { createServiceRoleClient } from '../_shared/quota.ts'
import { presentDispatchOutcome } from './dispatch-response.ts'
const JSON_HEADERS = {
...corsHeaders,
@ -739,29 +740,8 @@ Deno.serve(async (req: Request) => {
dispatchLeaseToken: reservation.dispatchLeaseToken,
inviteContext: resolved.inviteContext,
})
const responseBody = {
event_type: input.eventType,
resource_id: input.resourceId,
duplicate: false,
status: result.status,
complete: result.complete,
attempted: result.attempted,
sent: result.delivered,
stale_removed: result.stale,
retryable_failed: result.retryableFailed,
permanent_failed: result.permanentFailed,
next_retry_at: result.nextRetryAt,
}
if (result.transientError) {
return jsonResponse(
{ error: result.transientError, ...responseBody },
result.transientStatus ?? 502,
)
}
if (result.status === 'partial' || result.status === 'failed') {
return jsonResponse({ error: 'push_delivery_failed', ...responseBody }, 502)
}
return jsonResponse(responseBody, result.complete ? 200 : 202)
const presented = presentDispatchOutcome(actor.kind, input.eventType, input.resourceId, result)
return jsonResponse(presented.body, presented.status)
} catch (error) {
if (error instanceof PushContractError) {
return jsonResponse({ error: error.code, message: error.code }, error.status)