feat: migrate to UnifiedPush

app/api/push/jmap/[id]/route.ts

@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { logger } from '@/lib/logger';
 import { subscriptionStore } from '@/lib/push/store';
-import { sendExpoPush } from '@/lib/push/expo';
+import { sendUnifiedPush } from '@/lib/push/unified-push';
 import { isValidSubscriptionId } from '@/lib/push/validation';
 import type { JmapPushBody } from '@/lib/push/types';
 
@@ -75,7 +75,7 @@ export async function POST(
     }
 
     if (body['@type'] === 'StateChange') {
-      const ok = await sendExpoPush(record, body);
+      const ok = await sendUnifiedPush(record, body);
       record.lastPushAt = Date.now();
       await subscriptionStore.put(id, record);
       return NextResponse.json({ ok });

app/api/push/register/route.ts

@@ -2,41 +2,57 @@ import { NextRequest, NextResponse } from 'next/server';
 import { logger } from '@/lib/logger';
 import { subscriptionStore } from '@/lib/push/store';
 import {
-  isValidExpoPushToken,
+  isValidAuthSecret,
+  isValidP256dh,
+  isValidPushEndpoint,
   isValidSubscriptionId,
 } from '@/lib/push/validation';
 import type { SubscriptionRecord } from '@/lib/push/types';
 
 /**
  * POST /api/push/register
- * Body: { subscriptionId, expoPushToken, accountLabel? }
+ * Body: { subscriptionId, endpoint, p256dh, auth, accountLabel? }
  *
- * Called by the mobile app once it has created a JMAP PushSubscription and
- * received the subscriptionId it plans to use. We hold only the device's
- * Expo push token + that id — no user credentials pass through the relay.
+ * Called by the mobile app once its UnifiedPush distributor has produced a
+ * push endpoint. We hold only the Web Push keys needed to encrypt payloads
+ * per RFC 8291 — no user credentials pass through the relay.
  */
 export async function POST(request: NextRequest) {
   try {
     const body = (await request.json().catch(() => null)) as {
       subscriptionId?: unknown;
-      expoPushToken?: unknown;
+      endpoint?: unknown;
+      p256dh?: unknown;
+      auth?: unknown;
       accountLabel?: unknown;
     } | null;
     if (!body) return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 });
 
-    const { subscriptionId, expoPushToken, accountLabel } = body;
+    const { subscriptionId, endpoint, p256dh, auth, accountLabel } = body;
     if (!isValidSubscriptionId(subscriptionId)) {
       return NextResponse.json({ error: 'Invalid subscriptionId' }, { status: 400 });
     }
-    if (!isValidExpoPushToken(expoPushToken)) {
-      return NextResponse.json({ error: 'Invalid expoPushToken' }, { status: 400 });
+    if (!isValidPushEndpoint(endpoint)) {
+      return NextResponse.json({ error: 'Invalid endpoint' }, { status: 400 });
+    }
+    if (!isValidP256dh(p256dh)) {
+      return NextResponse.json({ error: 'Invalid p256dh' }, { status: 400 });
+    }
+    if (!isValidAuthSecret(auth)) {
+      return NextResponse.json({ error: 'Invalid auth' }, { status: 400 });
     }
 
+    // Preserve verificationCode if a previous record exists — the JMAP server
+    // may have already POSTed PushVerification before the app re-registers.
+    const existing = await subscriptionStore.get(subscriptionId);
+
     const record: SubscriptionRecord = {
-      expoPushToken,
-      verificationCode: null,
-      createdAt: Date.now(),
-      lastPushAt: null,
+      endpoint,
+      p256dh,
+      auth,
+      verificationCode: existing?.verificationCode ?? null,
+      createdAt: existing?.createdAt ?? Date.now(),
+      lastPushAt: existing?.lastPushAt ?? null,
       accountLabel:
         typeof accountLabel === 'string' ? accountLabel.slice(0, 120) : undefined,
     };

app/api/push/vapid/route.ts

@@ -0,0 +1,22 @@
+import { NextResponse } from 'next/server';
+import { logger } from '@/lib/logger';
+import { getVapidKeys } from '@/lib/push/vapid';
+
+/**
+ * GET /api/push/vapid
+ *
+ * Returns the relay's VAPID public key. The mobile app passes this to the
+ * UnifiedPush distributor so the distributor can lock the endpoint to pushes
+ * signed by us. Generated on first call; persisted under `data/push/vapid.json`.
+ */
+export async function GET() {
+  try {
+    const keys = await getVapidKeys();
+    return NextResponse.json({ publicKey: keys.publicKey });
+  } catch (error) {
+    logger.error('push: vapid key fetch failed', {
+      error: error instanceof Error ? error.message : 'Unknown error',
+    });
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}