malice

public

Star0

Fork 0

Watch0

111 commits 2 branches 0 tags 0 releases4.4 MiB

Commit `aa3dce5114d0`

tarball

atagen <boss@atagen.co>2026-10-26 06:54 UTC

31 files changed+2521-23

server: deliver Web Push from both builds through malice's own gateway

Matrix push needs a gateway and none of the public ones reach browsers, so malice-server resolves event_id_only notifies with the session's client, and malice-static relays full-format notifies statelessly with the subscription in the pusher data. Continuwuity ignores the rejected pushkeys in a notify response, so the hosted gateway removes gone pushers itself. Also moves to macltok a586532, and builds the PBKDF2 and AEAD crates optimised in dev and in the size-optimised worker because seven 200k-round derivations made a debug cold restore take 8.7s.

Modified file: Cargo.lock+45 additions−3 deletions@@ -265,6 +265,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e"
 dependencies = [
  "aws-lc-sys",
+ "untrusted 0.7.1",
  "zeroize",
 ]
 
@@ -2249,7 +2250,7 @@ checksum = "7ef0d4ed8669f8f8826eb00dc878084aa8f253506c4fd5e8f58f5bce72ddb97e"
 [[package]]
 name = "macltok"
 version = "0.1.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/macltok?rev=419c65426a62191a26b47d07a0e0661e047317da#419c65426a62191a26b47d07a0e0661e047317da"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/macltok?rev=a5865326c81b53de3d590e28dd59f07f2de00a09#a5865326c81b53de3d590e28dd59f07f2de00a09"
 dependencies = [
  "futures-util",
  "getrandom 0.2.17",
@@ -2280,6 +2281,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "macltok-push-gateway"
+version = "0.1.0"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/macltok?rev=a5865326c81b53de3d590e28dd59f07f2de00a09#a5865326c81b53de3d590e28dd59f07f2de00a09"
+dependencies = [
+ "ruma-common",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
 name = "macroific"
 version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2384,7 +2395,9 @@ dependencies = [
  "hex",
  "http-body-util",
  "macltok",
+ "macltok-push-gateway",
  "malice-core",
+ "malice-push",
  "malice-static",
  "matrix-sdk",
  "rand_core 0.6.4",
@@ -2409,22 +2422,45 @@ dependencies = [
  "futures-util",
  "image",
  "macltok",
+ "malice-push",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "malice-push"
+version = "0.1.0"
+dependencies = [
+ "aws-lc-rs",
+ "base64 0.22.1",
+ "reqwest",
  "serde",
  "serde_json",
+ "tempfile",
+ "tokio",
+ "tracing",
+ "url",
+ "wiremock",
 ]
 
 [[package]]
 name = "malice-static"
 version = "0.1.0"
 dependencies = [
+ "aws-lc-rs",
  "axum",
+ "base64 0.22.1",
  "listenfd",
+ "macltok-push-gateway",
+ "malice-push",
  "reqwest",
+ "serde_json",
  "tempfile",
  "tokio",
  "tower-http",
  "tracing",
  "tracing-subscriber",
+ "wiremock",
 ]
 
 [[package]]
@@ -3680,7 +3716,7 @@ dependencies = [
  "cfg-if",
  "getrandom 0.2.17",
  "libc",
- "untrusted",
+ "untrusted 0.9.0",
  "windows-sys 0.52.0",
 ]
 
@@ -3952,7 +3988,7 @@ dependencies = [
  "aws-lc-rs",
  "ring",
  "rustls-pki-types",
- "untrusted",
+ "untrusted 0.9.0",
 ]
 
 [[package]]
@@ -4976,6 +5012,12 @@ dependencies = [
 
 [[package]]
 name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
+[[package]]
+name = "untrusted"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"

Modified file: Cargo.toml+15 additions−2 deletions@@ -1,9 +1,10 @@
 [workspace]
 resolver = "3"
-members = ["crates/malice-core", "crates/malice-server", "crates/malice-static"]
+members = ["crates/malice-core", "crates/malice-push", "crates/malice-server", "crates/malice-static"]
 
 [workspace.dependencies]
-macltok = { git = "ssh://brewery@pls.lobotomise.me:33/atagen/macltok", rev = "419c65426a62191a26b47d07a0e0661e047317da" }
+macltok = { git = "ssh://brewery@pls.lobotomise.me:33/atagen/macltok", rev = "a5865326c81b53de3d590e28dd59f07f2de00a09" }
+macltok-push-gateway = { git = "ssh://brewery@pls.lobotomise.me:33/atagen/macltok", rev = "a5865326c81b53de3d590e28dd59f07f2de00a09" }
 ruma = { version = "0.16", default-features = false }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
@@ -13,3 +14,15 @@ http = "1"
 
 [workspace.lints.rust]
 unsafe_code = "forbid"
+
+[profile.dev.package.pbkdf2]
+opt-level = 3
+
+[profile.dev.package.sha2]
+opt-level = 3
+
+[profile.dev.package.hmac]
+opt-level = 3
+
+[profile.dev.package.chacha20poly1305]
+opt-level = 3

Modified file: crates/malice-core/Cargo.toml+1

@@ -8,6 +8,7 @@ name = "malice_core"

99 [dependencies]

1010 macltok = { workspace = true, features = ["serde", "mirror"] }

11+malice-push = { path = "../malice-push", default-features = false }

1112 futures-util = { version = "0.3", default-features = false, features = ["std"] }

1213 serde = { workspace = true }

1314 serde_json = { workspace = true }

Modified file: crates/malice-core/src/lib.rs+1

@@ -3,4 +3,5 @@ pub mod feed;

33 pub mod login;

44 pub mod media;

55 pub mod parse;

6+pub mod push;

67 pub mod request;

Added file: crates/malice-core/src/push.rs+124 additions@@ -0,0 +1,124 @@
+use macltok::{
+    HttpPusher, PushFormat, PushNotification, PushNotificationEvent, PushNotificationRoom,
+    PushNotificationStatus, RoomMembership, State,
+};
+use malice_push::{Content, Notice};
+use serde::{Deserialize, Serialize};
+use serde_json::{Value, json};
+
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PusherFormat {
+    #[default]
+    #[serde(alias = "Full")]
+    Full,
+    #[serde(alias = "EventIdOnly")]
+    EventIdOnly,
+}
+
+impl From<PusherFormat> for PushFormat {
+    fn from(format: PusherFormat) -> Self {
+        match format {
+            PusherFormat::Full => Self::Full,
+            PusherFormat::EventIdOnly => Self::EventIdOnly,
+        }
+    }
+}
+
+impl From<PushFormat> for PusherFormat {
+    fn from(format: PushFormat) -> Self {
+        match format {
+            PushFormat::Full => Self::Full,
+            PushFormat::EventIdOnly => Self::EventIdOnly,
+        }
+    }
+}
+
+pub fn pusher_json(pusher: &HttpPusher) -> Value {
+    json!({
+        "app_id": pusher.app_id,
+        "pushkey": pusher.pushkey,
+        "app_display_name": pusher.app_display_name,
+        "device_display_name": pusher.device_display_name,
+        "lang": pusher.lang,
+        "url": pusher.url,
+        "format": PusherFormat::from(pusher.format),
+        "data": pusher.data,
+    })
+}
+
+/// Unread notifications across joined rooms, or `None` before the mirror has
+/// any rooms. The pushed room counts at least the pushed event, which neither
+/// the mirror nor the store had synced when tried against continuwuity.
+pub fn unread_total(state: &State, pushed: &PushNotificationRoom) -> Option<u64> {
+    if state.rooms.is_empty() {
+        return None;
+    }
+    let mut pushed_count = pushed.unread_notifications.unwrap_or(0);
+    let mut others = 0;
+    for room in state
+        .rooms
+        .iter()
+        .filter(|room| room.membership == RoomMembership::Joined)
+    {
+        if room.room_id == pushed.room_id {
+            pushed_count = pushed_count.max(room.unread_notifications);
+        } else {
+            others += room.unread_notifications;
+        }
+    }
+    Some(others + pushed_count.max(1))
+}
+
+pub fn notice(notification: &PushNotification, unread: Option<u64>) -> Notice {
+    let sender = notification
+        .sender
+        .display_name
+        .clone()
+        .filter(|name| !name.trim().is_empty())
+        .unwrap_or_else(|| notification.sender.user_id.localpart().to_owned());
+    let (event, invite) = match &notification.event {
+        PushNotificationEvent::Timeline(raw) => (serde_json::from_str(raw.json().get()), false),
+        PushNotificationEvent::Invite(raw) => (serde_json::from_str(raw.json().get()), true),
+    };
+    let event: Value = event.unwrap_or_default();
+    let content = Content::of(
+        event.get("type").and_then(Value::as_str),
+        event.get("content"),
+        invite,
+    );
+    let room = &notification.room;
+    Notice {
+        title: if room.direct {
+            sender.clone()
+        } else {
+            room.name.clone()
+        },
+        body: content.body(&sender, room.direct),
+        room_id: room.room_id.to_string(),
+        event_id: notification.event_id.to_string(),
+        encrypted: content == Content::Encrypted,
+        mention: notification.has_mention.unwrap_or(false),
+        silent: notification.noisy == Some(false),
+        unread,
+    }
+}
+
+/// `origin` prefixes the payload's `navigate` URL.
+pub fn status_json(status: &PushNotificationStatus, state: &State, origin: &str) -> Value {
+    match status {
+        PushNotificationStatus::Event(notification) => {
+            let notice = notice(notification, unread_total(state, &notification.room));
+            json!({
+                "status": "event",
+                "title": notice.title,
+                "body": notice.body,
+                "payload": notice.to_value(origin),
+                "thread_id": notification.thread_id,
+            })
+        }
+        PushNotificationStatus::NotFound => json!({ "status": "not_found" }),
+        PushNotificationStatus::FilteredOut => json!({ "status": "filtered_out" }),
+        PushNotificationStatus::Redacted => json!({ "status": "redacted" }),
+    }
+}

Modified file: crates/malice-core/src/request.rs+131 additions−1 deletions@@ -1,6 +1,7 @@
 use macltok::ruma::{OwnedTransactionId, events::GlobalAccountDataEventType, serde::Raw};
 use macltok::{
-    AttachmentUpload, ClientHandle, CreateRoomOptions, ImagePackSource, MediaId, MediaSize,
+    AttachmentUpload, ClientHandle, CreateRoomOptions, HttpPusher, ImagePackSource, MediaId,
+    MediaSize, PusherKey,
     MemberFilter, MentionKey, MentionsBoundary, MessageContent, MessageEditContent, MirrorHandle,
     PackImageInfo, PackUsage, Patch, RichText, RoomNotificationMode, SearchScope, TimelineId, VerificationAction,
     VerificationTarget,
@@ -10,6 +11,7 @@ use serde_json::json;
 
 use crate::{
     error::CoreError,
+    push::{PusherFormat, pusher_json, status_json},
     media::{
         AVATAR_MAX_SIZE, AVATAR_MIN_SIZE, AVATAR_SIZE, AvatarSource, THUMBNAIL_SIZE,
         attachment_content_type, image_content_type,
@@ -487,6 +489,32 @@ pub enum Request {
     Unignore {
         user_id: String,
     },
+    SetPusher {
+        app_id: String,
+        pushkey: String,
+        url: String,
+        #[serde(default)]
+        format: PusherFormat,
+        #[serde(default)]
+        data: serde_json::Map<String, serde_json::Value>,
+        #[serde(default)]
+        app_display_name: Option<String>,
+        #[serde(default)]
+        device_display_name: Option<String>,
+        #[serde(default)]
+        lang: Option<String>,
+    },
+    RemovePusher {
+        app_id: String,
+        pushkey: String,
+    },
+    Pushers,
+    ResolvePushNotification {
+        room_id: String,
+        event_id: String,
+        #[serde(default)]
+        origin: String,
+    },
 }
 
 #[derive(Debug, Deserialize)]
@@ -1477,7 +1505,76 @@ pub async fn dispatch(
             handle.unignore_user(parse_user_id(&user_id)?).await?;
             Ok(Reply::Done)
         }
+        Request::SetPusher {
+            app_id,
+            pushkey,
+            url,
+            format,
+            mut data,
+            app_display_name,
+            device_display_name,
+            lang,
+        } => {
+            data.remove("url");
+            data.remove("format");
+            handle
+                .set_pusher(HttpPusher {
+                    app_id: pusher_text(app_id, "app_id", 64)?,
+                    pushkey: pusher_text(pushkey, "pushkey", 512)?,
+                    app_display_name: app_display_name.unwrap_or_else(|| "malice".to_owned()),
+                    device_display_name: device_display_name
+                        .unwrap_or_else(|| "Browser".to_owned()),
+                    lang: lang.unwrap_or_else(|| "en".to_owned()),
+                    url: pusher_url(url)?,
+                    format: format.into(),
+                    data,
+                })
+                .await?;
+            Ok(Reply::Done)
+        }
+        Request::RemovePusher { app_id, pushkey } => {
+            handle.remove_pusher(PusherKey { app_id, pushkey }).await?;
+            Ok(Reply::Done)
+        }
+        Request::Pushers => {
+            let pushers = handle.pushers().await?;
+            let pushers: Vec<_> = pushers.iter().map(pusher_json).collect();
+            Ok(Reply::Json(json!({ "pushers": pushers })))
+        }
+        Request::ResolvePushNotification {
+            room_id,
+            event_id,
+            origin,
+        } => {
+            let status = handle
+                .resolve_push_notification(&parse_room_id(&room_id)?, &parse_event_id(&event_id)?)
+                .await?;
+            Ok(Reply::Json(status_json(
+                &status,
+                &mirror.snapshot(),
+                origin.trim_end_matches('/'),
+            )))
+        }
+    }
+}
+
+fn pusher_text(value: String, what: &str, max: usize) -> Result<String, CoreError> {
+    if value.is_empty() || value.len() > max {
+        return Err(CoreError::bad_request(format!(
+            "{what} must be 1..{max} bytes"
+        )));
     }
+    Ok(value)
+}
+
+fn pusher_url(url: String) -> Result<String, CoreError> {
+    if !(url.starts_with("https://") || url.starts_with("http://"))
+        || url.len() > MAX_PREVIEW_URL_BYTES
+        || url.chars().any(|c| c.is_whitespace() || c.is_control())
+    {
+        return Err(CoreError::bad_request("url must be a short http(s) url"));
+    }
+    Ok(url)
 }
 
 fn image_upload_type(bytes: &[u8]) -> Result<&'static str, CoreError> {
@@ -1578,6 +1675,39 @@ mod tests {
     }
 
     #[test]
+    fn pusher_requests_parse() {
+        let set: Request = serde_json::from_str(
+            r#"{"op":"set_pusher","app_id":"dev.malice.device","pushkey":"BKey","url":"https://m.example/_matrix/push/v1/notify","data":{"endpoint":"https://fcm.googleapis.com/x","auth":"a"}}"#,
+        )
+        .unwrap();
+        assert!(matches!(
+            set,
+            Request::SetPusher {
+                format: PusherFormat::Full,
+                ..
+            }
+        ));
+        let resolve: Request = serde_json::from_str(
+            r#"{"op":"resolve_push_notification","room_id":"!r:x","event_id":"$e"}"#,
+        )
+        .unwrap();
+        assert!(matches!(resolve, Request::ResolvePushNotification { .. }));
+        let capitalised: Request = serde_json::from_str(
+            r#"{"op":"set_pusher","app_id":"a","pushkey":"k","url":"https://x/","format":"Full"}"#,
+        )
+        .unwrap();
+        assert!(matches!(
+            capitalised,
+            Request::SetPusher {
+                format: PusherFormat::Full,
+                ..
+            }
+        ));
+        assert!(pusher_url("ftp://x".to_owned()).is_err());
+        assert!(pusher_text(String::new(), "app_id", 64).is_err());
+    }
+
+    #[test]
     fn reaction_keys() {
         assert!(valid_reaction_key("👍"));
         assert!(!valid_reaction_key(""));

Added file: crates/malice-push/Cargo.toml+29 additions@@ -0,0 +1,29 @@
+[package]
+name = "malice-push"
+version = "0.1.0"
+edition = "2024"
+
+[lib]
+name = "malice_push"
+
+[features]
+default = ["send"]
+send = ["dep:aws-lc-rs", "dep:base64", "dep:reqwest", "dep:tokio", "dep:tracing", "dep:url"]
+
+[dependencies]
+serde = { workspace = true }
+serde_json = { workspace = true }
+aws-lc-rs = { version = "1", optional = true }
+base64 = { version = "0.22", optional = true }
+reqwest = { version = "0.13", default-features = false, features = ["rustls"], optional = true }
+tokio = { workspace = true, features = ["time"], optional = true }
+tracing = { workspace = true, optional = true }
+url = { version = "2", optional = true }
+
+[dev-dependencies]
+tempfile = "3"
+tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
+wiremock = "0.6"
+
+[lints]
+workspace = true

Added file: crates/malice-push/src/ece.rs+225 additions@@ -0,0 +1,225 @@
+//! RFC 8291 message encryption with the aes128gcm content coding of RFC 8188,
+//! as a single record.
+
+use aws_lc_rs::{
+    aead::{AES_128_GCM, Aad, LessSafeKey, Nonce, UnboundKey},
+    agreement::{self, ECDH_P256, PrivateKey, UnparsedPublicKey},
+    hkdf::{HKDF_SHA256, KeyType, Salt},
+};
+
+const RECORD_SIZE: u32 = 4096;
+const TAG_LEN: usize = 16;
+const HEADER_LEN: usize = 16 + 4 + 1 + 65;
+/// Push services cap the encrypted body at 4096 bytes.
+pub const MAX_PLAINTEXT: usize = 4096 - HEADER_LEN - TAG_LEN - 1;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum EceError {
+    BadKey,
+    TooLong,
+    Crypto,
+}
+
+impl std::fmt::Display for EceError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(match self {
+            Self::BadKey => "the subscription's keys are not valid",
+            Self::TooLong => "the push payload is too long",
+            Self::Crypto => "push encryption failed",
+        })
+    }
+}
+
+impl std::error::Error for EceError {}
+
+struct Len(usize);
+
+impl KeyType for Len {
+    fn len(&self) -> usize {
+        self.0
+    }
+}
+
+fn expand(salt: &[u8], secret: &[u8], info: &[&[u8]], out: &mut [u8]) -> Result<(), EceError> {
+    Salt::new(HKDF_SHA256, salt)
+        .extract(secret)
+        .expand(info, Len(out.len()))
+        .and_then(|okm| okm.fill(out))
+        .map_err(|_| EceError::Crypto)
+}
+
+struct Keys {
+    cek: [u8; 16],
+    nonce: [u8; 12],
+}
+
+fn derive(
+    ecdh_secret: &[u8],
+    auth: &[u8],
+    ua_public: &[u8],
+    as_public: &[u8],
+    salt: &[u8],
+) -> Result<Keys, EceError> {
+    let mut ikm = [0u8; 32];
+    expand(
+        auth,
+        ecdh_secret,
+        &[b"WebPush: info\0", ua_public, as_public],
+        &mut ikm,
+    )?;
+    let mut keys = Keys {
+        cek: [0; 16],
+        nonce: [0; 12],
+    };
+    expand(
+        salt,
+        &ikm,
+        &[b"Content-Encoding: aes128gcm\0"],
+        &mut keys.cek,
+    )?;
+    expand(salt, &ikm, &[b"Content-Encoding: nonce\0"], &mut keys.nonce)?;
+    Ok(keys)
+}
+
+fn ecdh(private: &PrivateKey, public: &[u8]) -> Result<Vec<u8>, EceError> {
+    agreement::agree(
+        private,
+        UnparsedPublicKey::new(&ECDH_P256, public),
+        EceError::BadKey,
+        |secret| Ok(secret.to_vec()),
+    )
+}
+
+/// Encrypts `plaintext` for the subscription whose `p256dh` key is
+/// `ua_public` (uncompressed, 65 bytes) and whose auth secret is `auth`.
+pub fn encrypt(ua_public: &[u8], auth: &[u8], plaintext: &[u8]) -> Result<Vec<u8>, EceError> {
+    let as_private = PrivateKey::generate(&ECDH_P256).map_err(|_| EceError::Crypto)?;
+    let mut salt = [0u8; 16];
+    aws_lc_rs::rand::fill(&mut salt).map_err(|_| EceError::Crypto)?;
+    encrypt_with(&as_private, salt, ua_public, auth, plaintext)
+}
+
+fn encrypt_with(
+    as_private: &PrivateKey,
+    salt: [u8; 16],
+    ua_public: &[u8],
+    auth: &[u8],
+    plaintext: &[u8],
+) -> Result<Vec<u8>, EceError> {
+    if ua_public.len() != 65 || auth.len() != 16 {
+        return Err(EceError::BadKey);
+    }
+    if plaintext.len() > MAX_PLAINTEXT {
+        return Err(EceError::TooLong);
+    }
+    let as_public = as_private
+        .compute_public_key()
+        .map_err(|_| EceError::Crypto)?;
+    let as_public = as_public.as_ref();
+    let secret = ecdh(as_private, ua_public)?;
+    let keys = derive(&secret, auth, ua_public, as_public, &salt)?;
+
+    let mut out = Vec::with_capacity(HEADER_LEN + plaintext.len() + 1 + TAG_LEN);
+    out.extend_from_slice(&salt);
+    out.extend_from_slice(&RECORD_SIZE.to_be_bytes());
+    out.push(as_public.len() as u8);
+    out.extend_from_slice(as_public);
+    let mut record = Vec::with_capacity(plaintext.len() + 1 + TAG_LEN);
+    record.extend_from_slice(plaintext);
+    record.push(2);
+    LessSafeKey::new(UnboundKey::new(&AES_128_GCM, &keys.cek).map_err(|_| EceError::Crypto)?)
+        .seal_in_place_append_tag(
+            Nonce::assume_unique_for_key(keys.nonce),
+            Aad::empty(),
+            &mut record,
+        )
+        .map_err(|_| EceError::Crypto)?;
+    out.extend_from_slice(&record);
+    Ok(out)
+}
+
+/// The user agent's side, for tests and the mock push service.
+pub fn decrypt(ua_private: &PrivateKey, auth: &[u8], body: &[u8]) -> Result<Vec<u8>, EceError> {
+    if body.len() < 21 {
+        return Err(EceError::Crypto);
+    }
+    let salt = &body[..16];
+    let id_len = body[20] as usize;
+    let as_public = body.get(21..21 + id_len).ok_or(EceError::Crypto)?;
+    let mut record = body[21 + id_len..].to_vec();
+    let ua_public = ua_private
+        .compute_public_key()
+        .map_err(|_| EceError::Crypto)?;
+    let secret = ecdh(ua_private, as_public)?;
+    let keys = derive(&secret, auth, ua_public.as_ref(), as_public, salt)?;
+    let plain =
+        LessSafeKey::new(UnboundKey::new(&AES_128_GCM, &keys.cek).map_err(|_| EceError::Crypto)?)
+            .open_in_place(
+                Nonce::assume_unique_for_key(keys.nonce),
+                Aad::empty(),
+                &mut record,
+            )
+            .map_err(|_| EceError::Crypto)?;
+    match plain.iter().rposition(|&byte| byte != 0) {
+        Some(end) if plain[end] == 2 => Ok(plain[..end].to_vec()),
+        _ => Err(EceError::Crypto),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use base64::{Engine, engine::general_purpose::URL_SAFE_NO_PAD};
+
+    use super::*;
+
+    fn b64(value: &str) -> Vec<u8> {
+        URL_SAFE_NO_PAD.decode(value).unwrap()
+    }
+
+    // RFC 8291 section 5 and appendix A
+    const PLAINTEXT: &str = "V2hlbiBJIGdyb3cgdXAsIEkgd2FudCB0byBiZSBhIHdhdGVybWVsb24";
+    const AS_PRIVATE: &str = "yfWPiYE-n46HLnH0KqZOF1fJJU3MYrct3AELtAQ-oRw";
+    const UA_PUBLIC: &str =
+        "BCVxsr7N_eNgVRqvHtD0zTZsEc6-VV-JvLexhqUzORcxaOzi6-AYWXvTBHm4bjyPjs7Vd8pZGH6SRpkNtoIAiw4";
+    const UA_PRIVATE: &str = "q1dXpw3UpT5VOmu_cf_v6ih07Aems3njxI-JWgLcM94";
+    const SALT: &str = "DGv6ra1nlYgDCS1FRnbzlw";
+    const AUTH: &str = "BTBZMqHH6r4Tts7J_aSIgg";
+    const MESSAGE: &str = "DGv6ra1nlYgDCS1FRnbzlwAAEABBBP4z9KsN6nGRTbVYI_c7VJSPQTBtkgcy27mlmlMoZIIgDll6e3vCYLocInmYWAmS6TlzAC8wEqKK6PBru3jl7A_yl95bQpu6cVPTpK4Mqgkf1CXztLVBSt2Ks3oZwbuwXPXLWyouBWLVWGNWQexSgSxsj_Qulcy4a-fN";
+
+    #[test]
+    fn rfc8291_vector_encrypts_exactly() {
+        let as_private = PrivateKey::from_private_key(&ECDH_P256, &b64(AS_PRIVATE)).unwrap();
+        let salt: [u8; 16] = b64(SALT).try_into().unwrap();
+        let body = encrypt_with(
+            &as_private,
+            salt,
+            &b64(UA_PUBLIC),
+            &b64(AUTH),
+            &b64(PLAINTEXT),
+        )
+        .unwrap();
+        assert_eq!(URL_SAFE_NO_PAD.encode(body), MESSAGE);
+    }
+
+    #[test]
+    fn rfc8291_vector_decrypts() {
+        let ua_private = PrivateKey::from_private_key(&ECDH_P256, &b64(UA_PRIVATE)).unwrap();
+        let plain = decrypt(&ua_private, &b64(AUTH), &b64(MESSAGE)).unwrap();
+        assert_eq!(plain, b64(PLAINTEXT));
+    }
+
+    #[test]
+    fn random_keys_round_trip_and_bad_input_is_refused() {
+        let ua_private = PrivateKey::generate(&ECDH_P256).unwrap();
+        let ua_public = ua_private.compute_public_key().unwrap();
+        let auth = [9u8; 16];
+        let body = encrypt(ua_public.as_ref(), &auth, b"hello").unwrap();
+        assert_eq!(decrypt(&ua_private, &auth, &body).unwrap(), b"hello");
+        assert!(decrypt(&ua_private, &[1u8; 16], &body).is_err());
+        assert_eq!(encrypt(&[4u8; 65], &auth, b"x"), Err(EceError::BadKey));
+        assert_eq!(
+            encrypt(ua_public.as_ref(), &auth, &vec![0; MAX_PLAINTEXT + 1]),
+            Err(EceError::TooLong)
+        );
+    }
+}

Added file: crates/malice-push/src/env.rs+38 additions@@ -0,0 +1,38 @@
+use std::path::Path;
+
+use crate::{Allowlist, Sender, Vapid};
+
+/// `MALICE_PUBLIC_URL`, the origin browsers and the homeserver reach this server at.
+pub fn public_url() -> Option<String> {
+    let url = std::env::var("MALICE_PUBLIC_URL").ok()?;
+    let url = url.trim().trim_end_matches('/');
+    match url::Url::parse(url) {
+        Ok(parsed) if matches!(parsed.scheme(), "http" | "https") && parsed.has_host() => {
+            Some(url.to_owned())
+        }
+        _ => {
+            tracing::warn!("ignoring MALICE_PUBLIC_URL, it is not an http(s) URL");
+            None
+        }
+    }
+}
+
+/// The VAPID `sub`: `MALICE_PUSH_CONTACT`, else the public URL.
+pub fn contact(public_url: Option<&str>) -> String {
+    std::env::var("MALICE_PUSH_CONTACT")
+        .ok()
+        .map(|contact| contact.trim().to_owned())
+        .filter(|contact| contact.starts_with("mailto:") || contact.starts_with("https://"))
+        .or_else(|| {
+            public_url
+                .filter(|url| url.starts_with("https://"))
+                .map(str::to_owned)
+        })
+        .unwrap_or_else(|| "mailto:webpush@localhost".to_owned())
+}
+
+/// A sender with the VAPID key kept in `dir`, configured from the environment.
+pub fn sender(dir: &Path, public_url: Option<&str>) -> Result<Sender, String> {
+    let vapid = Vapid::load_or_create(&dir.join("vapid.pk8"))?;
+    Sender::new(vapid, contact(public_url), Allowlist::from_env())
+}

Added file: crates/malice-push/src/lib.rs+19 additions@@ -0,0 +1,19 @@
+//! Web Push for malice: the notification payload both servers send, and with
+//! the `send` feature the VAPID key, RFC 8291 encryption and the HTTP sender.
+
+pub mod payload;
+
+#[cfg(feature = "send")]
+pub mod ece;
+#[cfg(feature = "send")]
+pub mod env;
+#[cfg(feature = "send")]
+pub mod send;
+#[cfg(feature = "send")]
+pub mod vapid;
+
+pub use payload::{Content, Notice};
+#[cfg(feature = "send")]
+pub use send::{Allowlist, Message, Outcome, Sender, Subscription, Urgency};
+#[cfg(feature = "send")]
+pub use vapid::Vapid;

Added file: crates/malice-push/src/payload.rs+203 additions@@ -0,0 +1,203 @@
+use serde_json::{Value, json};
+
+const TITLE_CHARS: usize = 80;
+const BODY_CHARS: usize = 400;
+
+/// What a push says about its event, before it becomes notification text.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Content {
+    Text(String),
+    Emote(String),
+    /// e.g. "sent an image", shown after the sender's name
+    Action(&'static str),
+    Encrypted,
+}
+
+impl Content {
+    pub fn of(event_type: Option<&str>, content: Option<&Value>, user_is_target: bool) -> Self {
+        let field = |name: &str| content.and_then(|content| content.get(name)?.as_str());
+        match event_type.unwrap_or_default() {
+            "m.room.encrypted" => Self::Encrypted,
+            "m.room.message" => match (field("msgtype"), field("body")) {
+                (Some("m.text" | "m.notice"), Some(body)) => Self::Text(strip_reply_fallback(body)),
+                (Some("m.emote"), Some(body)) => Self::Emote(strip_reply_fallback(body)),
+                (Some("m.image"), _) => Self::Action("sent an image"),
+                (Some("m.video"), _) => Self::Action("sent a video"),
+                (Some("m.audio"), _) => Self::Action("sent an audio clip"),
+                (Some("m.file"), _) => Self::Action("sent a file"),
+                (Some("m.location"), _) => Self::Action("shared a location"),
+                (_, Some(body)) => Self::Text(strip_reply_fallback(body)),
+                (_, None) => Self::Action("sent a message"),
+            },
+            "m.sticker" => Self::Action("sent a sticker"),
+            "m.room.member" if user_is_target && field("membership") == Some("invite") => {
+                Self::Action("invited you")
+            }
+            "m.call.invite" => Self::Action("is calling"),
+            "m.poll.start" | "org.matrix.msc3381.poll.start" => Self::Action("started a poll"),
+            _ => Self::Action("sent a message"),
+        }
+    }
+
+    pub fn body(&self, sender: &str, direct: bool) -> String {
+        match (self, direct) {
+            (Self::Text(text), true) => text.clone(),
+            (Self::Text(text), false) => format!("{sender}: {text}"),
+            (Self::Emote(text), _) => format!("* {sender} {text}"),
+            (Self::Action(action), _) => format!("{sender} {action}"),
+            (Self::Encrypted, true) => "Encrypted message".to_owned(),
+            (Self::Encrypted, false) => format!("{sender}: Encrypted message"),
+        }
+    }
+}
+
+/// Older clients quote the replied-to message as leading "> " lines and a
+/// blank line, which would crowd out the reply itself.
+fn strip_reply_fallback(body: &str) -> String {
+    if !body.starts_with("> ") {
+        return body.to_owned();
+    }
+    let mut lines = body.lines().skip_while(|line| line.starts_with('>'));
+    let rest: Vec<&str> = match lines.next() {
+        Some("") | None => lines.collect(),
+        Some(first) => std::iter::once(first).chain(lines).collect(),
+    };
+    if rest.is_empty() {
+        body.to_owned()
+    } else {
+        rest.join("\n")
+    }
+}
+
+/// The notification one push shows, in the Declarative Web Push shape so
+/// Safari can display it without running the service worker.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct Notice {
+    pub title: String,
+    pub body: String,
+    pub room_id: String,
+    pub event_id: String,
+    /// the body is generic because the event could not be read
+    pub encrypted: bool,
+    pub mention: bool,
+    pub silent: bool,
+    pub unread: Option<u64>,
+}
+
+impl Notice {
+    /// `origin` without a trailing slash, or empty for a relative `navigate`.
+    pub fn to_value(&self, origin: &str) -> Value {
+        let room = &self.room_id;
+        let mut notification = json!({
+            "title": truncate(&self.title, TITLE_CHARS),
+            "body": truncate(&self.body, BODY_CHARS),
+            "navigate": format!("{origin}/?room={}", query_escape(room)),
+            "tag": format!("room:{room}"),
+            "silent": self.silent,
+        });
+        if let Some(unread) = self.unread {
+            notification["app_badge"] = Value::String(unread.to_string());
+        }
+        json!({
+            "web_push": 8030,
+            "notification": notification,
+            "malice": {
+                "room_id": room,
+                "event_id": self.event_id,
+                "encrypted": self.encrypted,
+                "mention": self.mention,
+                "unread": self.unread,
+            },
+        })
+    }
+
+    pub fn to_bytes(&self, origin: &str) -> Vec<u8> {
+        serde_json::to_vec(&self.to_value(origin)).expect("a json value serialises")
+    }
+}
+
+fn truncate(text: &str, max: usize) -> String {
+    match text.char_indices().nth(max) {
+        Some((end, _)) => format!("{}…", text[..end].trim_end()),
+        None => text.to_owned(),
+    }
+}
+
+fn query_escape(value: &str) -> String {
+    let mut out = String::with_capacity(value.len());
+    for byte in value.bytes() {
+        match byte {
+            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'.' | b'_' | b'~' | b'!' | b':' => {
+                out.push(byte as char);
+            }
+            _ => out.push_str(&format!("%{byte:02X}")),
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn content_reads_messages_and_hides_encrypted_ones() {
+        let text = json!({"msgtype": "m.text", "body": "> <@a:x> old\n\nnew"});
+        assert_eq!(
+            Content::of(Some("m.room.message"), Some(&text), false),
+            Content::Text("new".to_owned())
+        );
+        assert_eq!(
+            Content::of(
+                Some("m.room.encrypted"),
+                Some(&json!({"ciphertext": "x"})),
+                false
+            ),
+            Content::Encrypted
+        );
+        let image = json!({"msgtype": "m.image", "body": "cat.png"});
+        assert_eq!(
+            Content::of(Some("m.room.message"), Some(&image), false).body("Ann", false),
+            "Ann sent an image"
+        );
+        assert_eq!(Content::Text("hi".to_owned()).body("Ann", false), "Ann: hi");
+        assert_eq!(Content::Text("hi".to_owned()).body("Ann", true), "hi");
+        let invite = json!({"membership": "invite"});
+        assert_eq!(
+            Content::of(Some("m.room.member"), Some(&invite), true),
+            Content::Action("invited you")
+        );
+    }
+
+    #[test]
+    fn notice_matches_the_wire_contract_and_stays_small() {
+        let notice = Notice {
+            title: "Room".to_owned(),
+            body: "x".repeat(5000),
+            room_id: "!r:example.org".to_owned(),
+            event_id: "$e".to_owned(),
+            encrypted: false,
+            mention: true,
+            silent: false,
+            unread: Some(3),
+        };
+        let value = notice.to_value("https://chat.example");
+        assert_eq!(value["web_push"], 8030);
+        assert_eq!(
+            value["notification"]["navigate"],
+            "https://chat.example/?room=!r:example.org"
+        );
+        assert_eq!(value["notification"]["tag"], "room:!r:example.org");
+        assert_eq!(value["notification"]["app_badge"], "3");
+        assert_eq!(value["malice"]["unread"], 3);
+        assert_eq!(value["malice"]["mention"], true);
+        assert!(notice.to_bytes("https://chat.example").len() < 3 * 1024);
+        let unknown = Notice {
+            unread: None,
+            ..notice
+        }
+        .to_value("");
+        assert!(unknown["notification"].get("app_badge").is_none());
+        assert_eq!(unknown["malice"]["unread"], Value::Null);
+    }
+}

Added file: crates/malice-push/src/send.rs+317 additions@@ -0,0 +1,317 @@
+use std::{sync::Arc, time::Duration};
+
+use aws_lc_rs::digest::{SHA256, digest};
+use base64::{
+    Engine,
+    engine::general_purpose::{STANDARD_NO_PAD, URL_SAFE_NO_PAD},
+};
+use reqwest::{StatusCode, header};
+use serde::{Deserialize, Serialize};
+use url::Url;
+
+use crate::{
+    ece::{self, EceError},
+    vapid::Vapid,
+};
+
+const PUSH_HOSTS: &[&str] = &[
+    "*.push.apple.com",
+    "fcm.googleapis.com",
+    "updates.push.services.mozilla.com",
+    "*.notify.windows.com",
+];
+const ALLOW_HOSTS_ENV: &str = "MALICE_PUSH_ALLOW_HOSTS";
+const MAX_ENDPOINT_LEN: usize = 2048;
+const TTL_SECS: u32 = 12 * 60 * 60;
+
+/// A browser's `PushSubscription`, keys as the browser's `toJSON` gives them.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Subscription {
+    pub endpoint: String,
+    pub p256dh: String,
+    pub auth: String,
+}
+
+impl Subscription {
+    /// Whether the keys decode to a P-256 point and a 16-byte secret.
+    pub fn keys_valid(&self) -> bool {
+        matches!(
+            (decode_key(&self.p256dh), decode_key(&self.auth)),
+            (Some(p256dh), Some(auth)) if p256dh.len() == 65 && p256dh[0] == 4 && auth.len() == 16
+        )
+    }
+}
+
+fn decode_key(value: &str) -> Option<Vec<u8>> {
+    let value = value.trim().trim_end_matches('=');
+    URL_SAFE_NO_PAD
+        .decode(value)
+        .or_else(|_| STANDARD_NO_PAD.decode(value))
+        .ok()
+}
+
+/// Push service hosts this server will POST to, so a pusher can't aim it at
+/// an arbitrary URL.
+#[derive(Debug, Clone, Default)]
+pub struct Allowlist {
+    /// `host:port` authorities also allowed over plain http, for local testing
+    extra: Vec<String>,
+}
+
+impl Allowlist {
+    /// The built-in push services, plus any `host:port` entries in
+    /// `MALICE_PUSH_ALLOW_HOSTS`.
+    pub fn from_env() -> Self {
+        let extra = std::env::var(ALLOW_HOSTS_ENV)
+            .unwrap_or_default()
+            .split(',')
+            .map(|host| host.trim().to_ascii_lowercase())
+            .filter(|host| !host.is_empty())
+            .collect::<Vec<_>>();
+        if !extra.is_empty() {
+            tracing::warn!(hosts = ?extra, "{ALLOW_HOSTS_ENV} allows extra push hosts, for testing only");
+        }
+        Self { extra }
+    }
+
+    pub fn with_extra(extra: impl IntoIterator<Item = String>) -> Self {
+        Self {
+            extra: extra.into_iter().collect(),
+        }
+    }
+
+    pub fn check(&self, endpoint: &str) -> Option<Url> {
+        if endpoint.len() > MAX_ENDPOINT_LEN {
+            return None;
+        }
+        let url = Url::parse(endpoint).ok()?;
+        if !url.username().is_empty() || url.password().is_some() {
+            return None;
+        }
+        let port = url.port_or_known_default()?;
+        let builtin = url.scheme() == "https"
+            && port == 443
+            && url.domain().is_some_and(|host| {
+                PUSH_HOSTS
+                    .iter()
+                    .any(|pattern| match pattern.strip_prefix('*') {
+                        Some(suffix) => host.len() > suffix.len() && host.ends_with(suffix),
+                        None => host == *pattern,
+                    })
+            });
+        let extra = matches!(url.scheme(), "http" | "https")
+            && self.extra.contains(&format!("{}:{port}", url.host_str()?));
+        (builtin || extra).then_some(url)
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Urgency {
+    Normal,
+    High,
+}
+
+pub struct Message<'a> {
+    pub payload: &'a [u8],
+    pub urgency: Urgency,
+    /// pushes sharing a topic replace each other while still queued
+    pub topic: &'a str,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Outcome {
+    Delivered,
+    /// the push service no longer knows the subscription (404 or 410)
+    Gone,
+    /// the endpoint is not an allowed push service, or the keys are unusable
+    Refused,
+    Retryable,
+    Failed(String),
+}
+
+impl Outcome {
+    pub fn drops_subscription(&self) -> bool {
+        matches!(self, Self::Gone | Self::Refused)
+    }
+}
+
+/// Encrypts and delivers pushes, signed with this server's VAPID key.
+#[derive(Clone)]
+pub struct Sender {
+    http: reqwest::Client,
+    vapid: Arc<Vapid>,
+    contact: String,
+    allow: Allowlist,
+}
+
+impl Sender {
+    /// `contact` is the VAPID `sub`, a `mailto:` or `https:` URL.
+    pub fn new(vapid: Vapid, contact: String, allow: Allowlist) -> Result<Self, String> {
+        let http = reqwest::Client::builder()
+            .redirect(reqwest::redirect::Policy::none())
+            .connect_timeout(Duration::from_secs(5))
+            .timeout(Duration::from_secs(10))
+            .build()
+            .map_err(|error| format!("building the push client: {error}"))?;
+        Ok(Self {
+            http,
+            vapid: Arc::new(vapid),
+            contact,
+            allow,
+        })
+    }
+
+    pub fn vapid_public_key(&self) -> &str {
+        self.vapid.public_key()
+    }
+
+    pub fn allows(&self, endpoint: &str) -> bool {
+        self.allow.check(endpoint).is_some()
+    }
+
+    /// Sends once, and once more after a second if the push service asks to retry.
+    pub async fn send(&self, subscription: &Subscription, message: &Message<'_>) -> Outcome {
+        let Some(url) = self.allow.check(&subscription.endpoint) else {
+            return Outcome::Refused;
+        };
+        let (Some(p256dh), Some(auth)) = (
+            decode_key(&subscription.p256dh),
+            decode_key(&subscription.auth),
+        ) else {
+            return Outcome::Refused;
+        };
+        let body = match ece::encrypt(&p256dh, &auth, message.payload) {
+            Ok(body) => body,
+            Err(EceError::BadKey) => return Outcome::Refused,
+            Err(error) => return Outcome::Failed(error.to_string()),
+        };
+        let authorization = match self
+            .vapid
+            .authorization(&url.origin().ascii_serialization(), &self.contact)
+        {
+            Ok(authorization) => authorization,
+            Err(error) => return Outcome::Failed(error),
+        };
+        let topic = topic(message.topic);
+        let urgency = match message.urgency {
+            Urgency::Normal => "normal",
+            Urgency::High => "high",
+        };
+        for attempt in 0..2 {
+            if attempt > 0 {
+                tokio::time::sleep(Duration::from_secs(1)).await;
+            }
+            let response = self
+                .http
+                .post(url.clone())
+                .header(header::AUTHORIZATION, &authorization)
+                .header(header::CONTENT_ENCODING, "aes128gcm")
+                .header(header::CONTENT_TYPE, "application/octet-stream")
+                .header("TTL", TTL_SECS)
+                .header("Urgency", urgency)
+                .header("Topic", &topic)
+                .body(body.clone())
+                .send()
+                .await;
+            let outcome = match response {
+                Ok(response) => classify(response.status()),
+                Err(error) => {
+                    tracing::debug!(%error, "push service unreachable");
+                    Outcome::Retryable
+                }
+            };
+            if outcome != Outcome::Retryable {
+                return outcome;
+            }
+        }
+        Outcome::Retryable
+    }
+}
+
+fn classify(status: StatusCode) -> Outcome {
+    match status {
+        status if status.is_success() => Outcome::Delivered,
+        StatusCode::NOT_FOUND | StatusCode::GONE => Outcome::Gone,
+        StatusCode::TOO_MANY_REQUESTS => Outcome::Retryable,
+        status if status.is_server_error() => Outcome::Retryable,
+        status => Outcome::Failed(format!("push service answered {status}")),
+    }
+}
+
+/// RFC 8030 limits a topic to 32 characters of the base64url alphabet.
+fn topic(raw: &str) -> String {
+    let mut topic = URL_SAFE_NO_PAD.encode(digest(&SHA256, raw.as_bytes()));
+    topic.truncate(32);
+    topic
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn allowlist_admits_push_services_only() {
+        let allow = Allowlist::default();
+        assert!(
+            allow
+                .check("https://fcm.googleapis.com/fcm/send/abc")
+                .is_some()
+        );
+        assert!(allow.check("https://web.push.apple.com/QGx").is_some());
+        assert!(
+            allow
+                .check("https://wns2-par02p.notify.windows.com/w/?token=x")
+                .is_some()
+        );
+        assert!(
+            allow
+                .check("https://updates.push.services.mozilla.com/wpush/v2/x")
+                .is_some()
+        );
+        assert!(allow.check("http://fcm.googleapis.com/x").is_none());
+        assert!(allow.check("https://fcm.googleapis.com:8443/x").is_none());
+        assert!(allow.check("https://push.apple.com/x").is_none());
+        assert!(allow.check("https://evilpush.apple.com/x").is_none());
+        assert!(
+            allow
+                .check("https://fcm.googleapis.com.evil.org/x")
+                .is_none()
+        );
+        assert!(allow.check("https://user@fcm.googleapis.com/x").is_none());
+        assert!(allow.check("https://127.0.0.1/x").is_none());
+        assert!(allow.check("http://127.0.0.1:9000/x").is_none());
+        let allow = Allowlist::with_extra(["localhost:9000".to_owned()]);
+        assert!(allow.check("http://localhost:9000/x").is_some());
+        assert!(allow.check("http://localhost:9001/x").is_none());
+        let allow = Allowlist::with_extra(["127.0.0.1:9000".to_owned()]);
+        assert!(allow.check("http://127.0.0.1:9000/x").is_some());
+    }
+
+    #[test]
+    fn topics_fit_rfc8030() {
+        let topic = topic("!room:example.org");
+        assert_eq!(topic.len(), 32);
+        assert!(
+            topic
+                .chars()
+                .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_')
+        );
+    }
+
+    #[test]
+    fn keys_validate() {
+        let good = Subscription {
+            endpoint: String::new(),
+            p256dh: "BCVxsr7N_eNgVRqvHtD0zTZsEc6-VV-JvLexhqUzORcxaOzi6-AYWXvTBHm4bjyPjs7Vd8pZGH6SRpkNtoIAiw4".to_owned(),
+            auth: "BTBZMqHH6r4Tts7J_aSIgg==".to_owned(),
+        };
+        assert!(good.keys_valid());
+        assert!(
+            !Subscription {
+                auth: "short".to_owned(),
+                ..good
+            }
+            .keys_valid()
+        );
+    }
+}

Added file: crates/malice-push/src/vapid.rs+147 additions@@ -0,0 +1,147 @@
+use std::{
+    io::{ErrorKind, Write},
+    path::Path,
+    time::{SystemTime, UNIX_EPOCH},
+};
+
+use aws_lc_rs::{
+    rand::SystemRandom,
+    signature::{ECDSA_P256_SHA256_FIXED_SIGNING, EcdsaKeyPair, KeyPair},
+};
+use base64::{Engine, engine::general_purpose::URL_SAFE_NO_PAD};
+
+const TOKEN_LIFETIME_SECS: u64 = 12 * 60 * 60;
+
+/// The server's VAPID identity (RFC 8292), an ES256 key kept on disk.
+pub struct Vapid {
+    key: EcdsaKeyPair,
+    public: String,
+}
+
+impl Vapid {
+    /// Reads the PKCS#8 key at `path`, or creates it owner-only.
+    pub fn load_or_create(path: &Path) -> Result<Self, String> {
+        match std::fs::read(path) {
+            Ok(bytes) => return Self::from_pkcs8(&bytes),
+            Err(error) if error.kind() != ErrorKind::NotFound => {
+                return Err(format!("reading the VAPID key: {error}"));
+            }
+            Err(_) => {}
+        }
+        let document =
+            EcdsaKeyPair::generate_pkcs8(&ECDSA_P256_SHA256_FIXED_SIGNING, &SystemRandom::new())
+                .map_err(|_| "generating the VAPID key failed".to_owned())?;
+        let mut options = std::fs::OpenOptions::new();
+        options.write(true).create_new(true);
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::OpenOptionsExt;
+            options.mode(0o600);
+        }
+        match options.open(path) {
+            Ok(mut file) => {
+                if let Err(error) = file
+                    .write_all(document.as_ref())
+                    .and_then(|_| file.sync_all())
+                {
+                    let _ = std::fs::remove_file(path);
+                    return Err(format!("writing the VAPID key: {error}"));
+                }
+                Self::from_pkcs8(document.as_ref())
+            }
+            Err(error) if error.kind() == ErrorKind::AlreadyExists => {
+                let bytes = std::fs::read(path)
+                    .map_err(|error| format!("reading the VAPID key: {error}"))?;
+                Self::from_pkcs8(&bytes)
+            }
+            Err(error) => Err(format!("creating the VAPID key: {error}")),
+        }
+    }
+
+    fn from_pkcs8(bytes: &[u8]) -> Result<Self, String> {
+        let key = EcdsaKeyPair::from_pkcs8(&ECDSA_P256_SHA256_FIXED_SIGNING, bytes)
+            .map_err(|_| "the VAPID key file is not a P-256 PKCS#8 key".to_owned())?;
+        let public = URL_SAFE_NO_PAD.encode(key.public_key().as_ref());
+        Ok(Self { key, public })
+    }
+
+    /// The uncompressed public point, base64url, as `applicationServerKey` takes it.
+    pub fn public_key(&self) -> &str {
+        &self.public
+    }
+
+    /// The `Authorization` header for a push service at `audience` (its origin).
+    pub fn authorization(&self, audience: &str, contact: &str) -> Result<String, String> {
+        let now = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .map_err(|_| "the clock is before 1970".to_owned())?
+            .as_secs();
+        let header = URL_SAFE_NO_PAD.encode(br#"{"typ":"JWT","alg":"ES256"}"#);
+        let claims = serde_json::json!({
+            "aud": audience,
+            "exp": now + TOKEN_LIFETIME_SECS,
+            "sub": contact,
+        });
+        let claims = URL_SAFE_NO_PAD.encode(claims.to_string());
+        let signing_input = format!("{header}.{claims}");
+        let signature = self
+            .key
+            .sign(&SystemRandom::new(), signing_input.as_bytes())
+            .map_err(|_| "signing the VAPID token failed".to_owned())?;
+        Ok(format!(
+            "vapid t={signing_input}.{}, k={}",
+            URL_SAFE_NO_PAD.encode(signature.as_ref()),
+            self.public
+        ))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use aws_lc_rs::signature::{ECDSA_P256_SHA256_FIXED, UnparsedPublicKey};
+
+    use super::*;
+
+    #[test]
+    fn key_persists_owner_only_and_signs_verifiable_tokens() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("vapid.pk8");
+        let first = Vapid::load_or_create(&path).unwrap();
+        let again = Vapid::load_or_create(&path).unwrap();
+        assert_eq!(first.public_key(), again.public_key());
+        let public = URL_SAFE_NO_PAD.decode(first.public_key()).unwrap();
+        assert_eq!(public.len(), 65);
+        assert_eq!(public[0], 4);
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            let mode = std::fs::metadata(&path).unwrap().permissions().mode();
+            assert_eq!(mode & 0o777, 0o600);
+        }
+
+        let header = first
+            .authorization("https://fcm.googleapis.com", "mailto:a@example.org")
+            .unwrap();
+        let (token, key) = header
+            .strip_prefix("vapid t=")
+            .unwrap()
+            .split_once(", k=")
+            .unwrap();
+        assert_eq!(key, first.public_key());
+        let (input, signature) = token.rsplit_once('.').unwrap();
+        UnparsedPublicKey::new(&ECDSA_P256_SHA256_FIXED, &public)
+            .verify(
+                input.as_bytes(),
+                &URL_SAFE_NO_PAD.decode(signature).unwrap(),
+            )
+            .unwrap();
+        let claims: serde_json::Value = serde_json::from_slice(
+            &URL_SAFE_NO_PAD
+                .decode(input.split_once('.').unwrap().1)
+                .unwrap(),
+        )
+        .unwrap();
+        assert_eq!(claims["aud"], "https://fcm.googleapis.com");
+        assert_eq!(claims["sub"], "mailto:a@example.org");
+    }
+}

Added file: crates/malice-push/tests/send.rs+107 additions@@ -0,0 +1,107 @@
+use aws_lc_rs::agreement::{ECDH_P256, PrivateKey};
+use base64::{Engine, engine::general_purpose::URL_SAFE_NO_PAD};
+use malice_push::{Allowlist, Message, Outcome, Sender, Subscription, Urgency, Vapid, ece};
+use wiremock::{
+    Mock, MockServer, ResponseTemplate,
+    matchers::{header, method, path},
+};
+
+struct Browser {
+    private: PrivateKey,
+    auth: [u8; 16],
+}
+
+impl Browser {
+    fn new() -> Self {
+        Self {
+            private: PrivateKey::generate(&ECDH_P256).unwrap(),
+            auth: [3; 16],
+        }
+    }
+
+    fn subscription(&self, endpoint: String) -> Subscription {
+        Subscription {
+            endpoint,
+            p256dh: URL_SAFE_NO_PAD.encode(self.private.compute_public_key().unwrap().as_ref()),
+            auth: URL_SAFE_NO_PAD.encode(self.auth),
+        }
+    }
+}
+
+async fn sender(server: &MockServer, dir: &tempfile::TempDir) -> Sender {
+    let authority = server.address().to_string();
+    Sender::new(
+        Vapid::load_or_create(&dir.path().join("vapid.pk8")).unwrap(),
+        "mailto:test@example.org".to_owned(),
+        Allowlist::with_extra([authority]),
+    )
+    .unwrap()
+}
+
+#[tokio::test]
+async fn delivers_encrypted_and_reports_gone_retry_and_refusal() {
+    let server = MockServer::start().await;
+    Mock::given(method("POST"))
+        .and(path("/push/ok"))
+        .and(header("content-encoding", "aes128gcm"))
+        .and(header("urgency", "high"))
+        .and(header("ttl", "43200"))
+        .respond_with(ResponseTemplate::new(201))
+        .expect(1)
+        .mount(&server)
+        .await;
+    Mock::given(method("POST"))
+        .and(path("/push/gone"))
+        .respond_with(ResponseTemplate::new(410))
+        .mount(&server)
+        .await;
+    Mock::given(method("POST"))
+        .and(path("/push/flaky"))
+        .respond_with(ResponseTemplate::new(503))
+        .up_to_n_times(1)
+        .with_priority(1)
+        .mount(&server)
+        .await;
+    Mock::given(method("POST"))
+        .and(path("/push/flaky"))
+        .respond_with(ResponseTemplate::new(201))
+        .with_priority(2)
+        .mount(&server)
+        .await;
+
+    let dir = tempfile::tempdir().unwrap();
+    let sender = sender(&server, &dir).await;
+    let browser = Browser::new();
+    let message = Message {
+        payload: br#"{"web_push":8030}"#,
+        urgency: Urgency::High,
+        topic: "!room:example.org",
+    };
+
+    let ok = browser.subscription(format!("{}/push/ok", server.uri()));
+    assert_eq!(sender.send(&ok, &message).await, Outcome::Delivered);
+    let requests = server.received_requests().await.unwrap();
+    let request = &requests[0];
+    let authorization = request.headers["authorization"].to_str().unwrap();
+    assert!(authorization.starts_with("vapid t="));
+    assert!(authorization.ends_with(&format!("k={}", sender.vapid_public_key())));
+    assert_eq!(request.headers["topic"].to_str().unwrap().len(), 32);
+    let plain = ece::decrypt(&browser.private, &browser.auth, &request.body).unwrap();
+    assert_eq!(plain, message.payload);
+
+    let gone = browser.subscription(format!("{}/push/gone", server.uri()));
+    let outcome = sender.send(&gone, &message).await;
+    assert_eq!(outcome, Outcome::Gone);
+    assert!(outcome.drops_subscription());
+
+    let flaky = browser.subscription(format!("{}/push/flaky", server.uri()));
+    assert_eq!(sender.send(&flaky, &message).await, Outcome::Delivered);
+
+    let elsewhere = browser.subscription("https://example.org/push".to_owned());
+    assert_eq!(sender.send(&elsewhere, &message).await, Outcome::Refused);
+    let bad_keys = Subscription {
+        p256dh: "AAAA".to_owned(),
+        ..ok
+    };
+    assert_eq!(sender.send(&bad_keys, &message).await, Outcome::Refused);
+}

Modified file: crates/malice-server/Cargo.toml+2

@@ -14,6 +14,8 @@ path = "src/lib.rs"

1414 [dependencies]

1515 malice-core = { path = "../malice-core" }

1616 malice-static = { path = "../malice-static" }

17+malice-push = { path = "../malice-push" }

18+macltok-push-gateway = { workspace = true }

1719 macltok = { workspace = true, features = ["sqlite", "serde", "mirror"] }

1820 axum = { version = "0.8", features = ["macros", "multipart"] }

1921 futures-util = { version = "0.3", default-features = false, features = ["std"] }

Modified file: crates/malice-server/src/lib.rs+1

@@ -1,4 +1,5 @@

11 pub mod csrf;

22 pub mod error;

3+pub mod push;

34 pub mod routes;

45 pub mod state;

Modified file: crates/malice-server/src/main.rs+4 additions−1 deletions@@ -1,6 +1,7 @@
 use std::path::PathBuf;
 
 use malice::{
+    push::HostedPush,
     routes::router,
     state::{AppState, ensure_dirs, load_or_create_master_key},
 };
@@ -59,7 +60,9 @@ async fn main() {
         load_or_create_master_key(&data_dir).expect("loading the master key must succeed");
     let cookie_secure = env_flag("MALICE_SESSION_COOKIE_SECURE", true);
     let allow_http_homeserver = env_flag("MALICE_ALLOW_HTTP_HOMESERVER", false);
-    let state = AppState::new(data_dir, master_key, cookie_secure, allow_http_homeserver);
+    let push = HostedPush::from_env(&data_dir).expect("setting up web push must succeed");
+    let state = AppState::new(data_dir, master_key, cookie_secure, allow_http_homeserver)
+        .with_push(push);
     let app = router(state.clone(), web_dir());
     let listener = bind_listener().await;
     serve(

Added file: crates/malice-server/src/push.rs+580 additions@@ -0,0 +1,580 @@
+use std::{
+    collections::HashMap,
+    path::{Path, PathBuf},
+    sync::{Mutex, MutexGuard, PoisonError},
+    time::Duration,
+};
+
+use axum::{
+    Router,
+    body::Bytes,
+    extract::{DefaultBodyLimit, State},
+    http::{HeaderMap, StatusCode},
+    response::{IntoResponse, Response},
+    routing::{get, post},
+};
+use macltok::{HttpPusher, PushFormat, PushNotificationStatus, PusherKey};
+use macltok_push_gateway::{GatewayDevice, GatewayNotification, notify_response, parse_notify};
+use malice_core::push::{notice, unread_total};
+use malice_push::{Message, Outcome, Sender, Subscription, Urgency};
+use malice_static::push::{NOTIFY_PATH, json_response};
+use rand_core::{OsRng, RngCore};
+use serde::{Deserialize, Serialize};
+use tokio::{sync::Semaphore, time::timeout};
+
+use crate::{
+    error::{ApiError, json_ok, no_content},
+    routes::auth,
+    state::{AppState, RestoreError},
+};
+
+pub const HOSTED_APP_ID: &str = "dev.malice.hosted";
+const CONCURRENT_NOTIFIES: usize = 8;
+const RESOLVE_TIMEOUT: Duration = Duration::from_secs(20);
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct Entry {
+    sid: String,
+    subscription: Subscription,
+}
+
+/// Browser subscriptions by the random pushkey each one's pusher carries,
+/// kept in `push.json` beside the sessions.
+pub struct HostedPush {
+    sender: Sender,
+    public_url: Option<String>,
+    path: PathBuf,
+    entries: Mutex<HashMap<String, Entry>>,
+    permits: Semaphore,
+}
+
+impl HostedPush {
+    pub fn new(data_dir: &Path, public_url: Option<String>, sender: Sender) -> Self {
+        let path = data_dir.join("push.json");
+        let entries = match std::fs::read(&path) {
+            Ok(bytes) => serde_json::from_slice(&bytes).unwrap_or_else(|error| {
+                tracing::warn!(%error, "push subscriptions are unreadable, starting empty");
+                HashMap::new()
+            }),
+            Err(_) => HashMap::new(),
+        };
+        Self {
+            sender,
+            public_url,
+            path,
+            entries: Mutex::new(entries),
+            permits: Semaphore::new(CONCURRENT_NOTIFIES),
+        }
+    }
+
+    /// The VAPID key lives in `data_dir`. Subscribing needs `MALICE_PUBLIC_URL`,
+    /// since the homeserver must reach the notify endpoint.
+    pub fn from_env(data_dir: &Path) -> Result<Self, String> {
+        let public_url = malice_push::env::public_url();
+        if public_url.is_none() {
+            tracing::info!("web push is off until MALICE_PUBLIC_URL is set");
+        }
+        let sender = malice_push::env::sender(data_dir, public_url.as_deref())?;
+        Ok(Self::new(data_dir, public_url, sender))
+    }
+
+    fn entries(&self) -> MutexGuard<'_, HashMap<String, Entry>> {
+        self.entries.lock().unwrap_or_else(PoisonError::into_inner)
+    }
+
+    fn save(&self, entries: &HashMap<String, Entry>) {
+        let result = serde_json::to_vec(entries)
+            .map_err(std::io::Error::other)
+            .and_then(|bytes| {
+                let temp = self.path.with_extension("json.tmp");
+                let mut options = std::fs::OpenOptions::new();
+                options.write(true).create(true).truncate(true);
+                #[cfg(unix)]
+                {
+                    use std::os::unix::fs::OpenOptionsExt;
+                    options.mode(0o600);
+                }
+                let mut file = options.open(&temp)?;
+                std::io::Write::write_all(&mut file, &bytes)?;
+                file.sync_all()?;
+                std::fs::rename(&temp, &self.path)
+            });
+        if let Err(error) = result {
+            tracing::warn!(%error, "saving push subscriptions failed");
+        }
+    }
+
+    /// Files `subscription` under `sid`, keeping the pushkey if this session
+    /// already had it. Returns the pushkey, and the session and pushkey that
+    /// held the endpoint before when another session did.
+    fn claim(&self, sid: &str, subscription: Subscription) -> (String, Option<(String, String)>) {
+        let mut entries = self.entries();
+        let held = entries
+            .iter()
+            .find(|(_, entry)| entry.subscription.endpoint == subscription.endpoint)
+            .map(|(pushkey, entry)| (pushkey.clone(), entry.sid.clone()));
+        let (pushkey, displaced) = match held {
+            Some((pushkey, owner)) if owner == sid => (pushkey, None),
+            Some((pushkey, owner)) => {
+                entries.remove(&pushkey);
+                (new_pushkey(), Some((owner, pushkey)))
+            }
+            None => (new_pushkey(), None),
+        };
+        entries.insert(
+            pushkey.clone(),
+            Entry {
+                sid: sid.to_owned(),
+                subscription,
+            },
+        );
+        self.save(&entries);
+        (pushkey, displaced)
+    }
+
+    fn get(&self, pushkey: &str) -> Option<Entry> {
+        self.entries().get(pushkey).cloned()
+    }
+
+    fn find(&self, sid: &str, endpoint: &str) -> Option<String> {
+        self.entries()
+            .iter()
+            .find(|(_, entry)| entry.sid == sid && entry.subscription.endpoint == endpoint)
+            .map(|(pushkey, _)| pushkey.clone())
+    }
+
+    fn forget(&self, pushkey: &str) {
+        let mut entries = self.entries();
+        if entries.remove(pushkey).is_some() {
+            self.save(&entries);
+        }
+    }
+
+    /// The pushers a logout of `sid` should take down with it.
+    pub fn pusher_keys(&self, sid: &str) -> Vec<PusherKey> {
+        self.entries()
+            .iter()
+            .filter(|(_, entry)| entry.sid == sid)
+            .map(|(pushkey, _)| PusherKey {
+                app_id: HOSTED_APP_ID.to_owned(),
+                pushkey: pushkey.clone(),
+            })
+            .collect()
+    }
+
+    pub fn forget_session(&self, sid: &str) {
+        let mut entries = self.entries();
+        let before = entries.len();
+        entries.retain(|_, entry| entry.sid != sid);
+        if entries.len() != before {
+            self.save(&entries);
+        }
+    }
+}
+
+fn new_pushkey() -> String {
+    let mut bytes = [0u8; 16];
+    OsRng.fill_bytes(&mut bytes);
+    hex::encode(bytes)
+}
+
+#[derive(Debug, Deserialize)]
+struct SubscribeKeys {
+    p256dh: String,
+    auth: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct SubscribeBody {
+    endpoint: String,
+    keys: SubscribeKeys,
+}
+
+#[derive(Debug, Deserialize)]
+struct UnsubscribeBody {
+    endpoint: String,
+}
+
+pub fn api_routes() -> Router<AppState> {
+    Router::new()
+        .route("/push/vapid", get(vapid))
+        .route("/push/subscribe", post(subscribe))
+        .route("/push/unsubscribe", post(unsubscribe))
+}
+
+pub fn notify_route() -> Router<AppState> {
+    Router::new()
+        .route(NOTIFY_PATH, post(notify))
+        .layer(DefaultBodyLimit::max(64 * 1024))
+}
+
+fn push_off() -> ApiError {
+    ApiError::new(StatusCode::SERVICE_UNAVAILABLE, "web push is not set up")
+}
+
+/// The push service, the public URL to point pushers at, or why push is off.
+fn configured(state: &AppState) -> Result<(&HostedPush, &str), ApiError> {
+    let push = state.push().ok_or_else(push_off)?;
+    let url = push.public_url.as_deref().ok_or_else(push_off)?;
+    Ok((push, url))
+}
+
+async fn vapid(State(state): State<AppState>) -> Response {
+    match configured(&state) {
+        Ok((push, _)) => json_ok(
+            &serde_json::json!({ "public_key": push.sender.vapid_public_key() }),
+            None,
+        ),
+        Err(error) => error.into_response(),
+    }
+}
+
+async fn subscribe(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    body: axum::Json<SubscribeBody>,
+) -> Response {
+    let (push, public_url) = match configured(&state) {
+        Ok(configured) => configured,
+        Err(error) => return error.into_response(),
+    };
+    let (user, sid) = match auth(&state, &headers).await {
+        Ok(pair) => pair,
+        Err(error) => return error.into_response(),
+    };
+    let subscription = Subscription {
+        endpoint: body.0.endpoint,
+        p256dh: body.0.keys.p256dh,
+        auth: body.0.keys.auth,
+    };
+    if !push.sender.allows(&subscription.endpoint) {
+        return ApiError::bad_request("endpoint is not a known push service").into_response();
+    }
+    if !subscription.keys_valid() {
+        return ApiError::bad_request("subscription keys are not valid").into_response();
+    }
+    let (pushkey, displaced) = push.claim(&sid, subscription);
+    if let Some((owner, pushkey)) = displaced {
+        let state = state.clone();
+        tokio::spawn(async move {
+            if let Ok(owner) = state.get_or_restore(&owner).await {
+                let _ = owner
+                    .handle
+                    .remove_pusher(PusherKey {
+                        app_id: HOSTED_APP_ID.to_owned(),
+                        pushkey,
+                    })
+                    .await;
+            }
+        });
+    }
+    let pusher = HttpPusher {
+        app_id: HOSTED_APP_ID.to_owned(),
+        pushkey: pushkey.clone(),
+        app_display_name: "malice".to_owned(),
+        device_display_name: "Browser".to_owned(),
+        lang: "en".to_owned(),
+        url: format!("{public_url}{NOTIFY_PATH}"),
+        format: PushFormat::EventIdOnly,
+        data: serde_json::Map::new(),
+    };
+    match user.handle.set_pusher(pusher).await {
+        Ok(()) => no_content(None),
+        Err(error) => {
+            push.forget(&pushkey);
+            ApiError::from(malice_core::error::CoreError::from(error)).into_response()
+        }
+    }
+}
+
+async fn unsubscribe(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    body: axum::Json<UnsubscribeBody>,
+) -> Response {
+    let Some(push) = state.push() else {
+        return push_off().into_response();
+    };
+    let (user, sid) = match auth(&state, &headers).await {
+        Ok(pair) => pair,
+        Err(error) => return error.into_response(),
+    };
+    let Some(pushkey) = push.find(&sid, &body.0.endpoint) else {
+        return no_content(None);
+    };
+    let removed = user
+        .handle
+        .remove_pusher(PusherKey {
+            app_id: HOSTED_APP_ID.to_owned(),
+            pushkey: pushkey.clone(),
+        })
+        .await;
+    match removed {
+        Ok(()) => {
+            push.forget(&pushkey);
+            no_content(None)
+        }
+        Err(error) => ApiError::from(malice_core::error::CoreError::from(error)).into_response(),
+    }
+}
+
+async fn notify(State(state): State<AppState>, body: Bytes) -> Response {
+    let Some(push) = state.push() else {
+        return StatusCode::NOT_FOUND.into_response();
+    };
+    let notification = match parse_notify(&body) {
+        Ok(notification) => notification,
+        Err(error) => {
+            return ApiError::bad_request(error.to_string()).into_response();
+        }
+    };
+    if !notification.is_event() {
+        return json_response(StatusCode::OK, notify_response(&[]));
+    }
+    let Ok(_permit) = push.permits.acquire().await else {
+        return StatusCode::SERVICE_UNAVAILABLE.into_response();
+    };
+    let mut rejected = Vec::new();
+    for device in &notification.devices {
+        if deliver(&state, push, &notification, device).await {
+            push.forget(&device.pushkey);
+            rejected.push(device.pushkey.clone());
+        }
+    }
+    json_response(StatusCode::OK, notify_response(&rejected))
+}
+
+/// Resolves and sends one device's push. True when its pushkey should be rejected.
+async fn deliver(
+    state: &AppState,
+    push: &HostedPush,
+    notification: &GatewayNotification,
+    device: &GatewayDevice,
+) -> bool {
+    let (Some(room_id), Some(event_id)) = (&notification.room_id, &notification.event_id) else {
+        return false;
+    };
+    if device.app_id != HOSTED_APP_ID {
+        return true;
+    }
+    let Some(entry) = push.get(&device.pushkey) else {
+        return true;
+    };
+    let user = match state.get_or_restore(&entry.sid).await {
+        Ok(user) => user,
+        Err(RestoreError::Unavailable(error)) => {
+            tracing::warn!(%error, "push for a session that would not restore");
+            return false;
+        }
+        Err(
+            RestoreError::NotFound | RestoreError::Stale(_) | RestoreError::SoftLoggedOut { .. },
+        ) => return true,
+    };
+    let status = match timeout(
+        RESOLVE_TIMEOUT,
+        user.handle.resolve_push_notification(room_id, event_id),
+    )
+    .await
+    {
+        Ok(Ok(status)) => status,
+        Ok(Err(error)) => {
+            tracing::warn!(%error, "resolving a push failed");
+            return false;
+        }
+        Err(_) => {
+            tracing::warn!("resolving a push timed out");
+            return false;
+        }
+    };
+    let PushNotificationStatus::Event(resolved) = status else {
+        return false;
+    };
+    let unread = unread_total(&user.mirror.snapshot(), &resolved.room);
+    let notice = notice(&resolved, unread);
+    let urgency = if notice.mention || resolved.room.direct {
+        Urgency::High
+    } else {
+        Urgency::Normal
+    };
+    let outcome = push
+        .sender
+        .send(
+            &entry.subscription,
+            &Message {
+                payload: &notice.to_bytes(push.public_url.as_deref().unwrap_or_default()),
+                urgency,
+                topic: &notice.room_id,
+            },
+        )
+        .await;
+    if matches!(outcome, Outcome::Failed(_) | Outcome::Retryable) {
+        tracing::warn!(?outcome, "web push delivery failed");
+    }
+    if !outcome.drops_subscription() {
+        return false;
+    }
+    // continuwuity 26.9 ignores a notify response's rejected pushkeys
+    let _ = user
+        .handle
+        .remove_pusher(PusherKey {
+            app_id: HOSTED_APP_ID.to_owned(),
+            pushkey: device.pushkey.clone(),
+        })
+        .await;
+    true
+}
+
+#[cfg(test)]
+mod tests {
+    use axum::{body::Body, http::Request};
+    use http_body_util::BodyExt;
+    use malice_push::{Allowlist, Vapid};
+    use serde_json::{Value, json};
+    use tower::ServiceExt;
+
+    use super::*;
+
+    fn hosted(dir: &tempfile::TempDir) -> HostedPush {
+        let sender = Sender::new(
+            Vapid::load_or_create(&dir.path().join("vapid.pk8")).unwrap(),
+            "mailto:test@example.org".to_owned(),
+            Allowlist::default(),
+        )
+        .unwrap();
+        HostedPush::new(
+            dir.path(),
+            Some("https://malice.example".to_owned()),
+            sender,
+        )
+    }
+
+    fn subscription(endpoint: &str) -> Subscription {
+        Subscription {
+            endpoint: endpoint.to_owned(),
+            p256dh: "BCVxsr7N_eNgVRqvHtD0zTZsEc6-VV-JvLexhqUzORcxaOzi6-AYWXvTBHm4bjyPjs7Vd8pZGH6SRpkNtoIAiw4".to_owned(),
+            auth: "BTBZMqHH6r4Tts7J_aSIgg".to_owned(),
+        }
+    }
+
+    #[test]
+    fn registry_persists_and_moves_endpoints_between_sessions() {
+        let dir = tempfile::tempdir().unwrap();
+        let push = hosted(&dir);
+        let (first, displaced) = push.claim("alpha", subscription("https://fcm.googleapis.com/a"));
+        assert!(displaced.is_none());
+        let (again, _) = push.claim("alpha", subscription("https://fcm.googleapis.com/a"));
+        assert_eq!(first, again);
+        let (moved, displaced) = push.claim("beta", subscription("https://fcm.googleapis.com/a"));
+        assert_ne!(moved, first);
+        assert_eq!(displaced, Some(("alpha".to_owned(), first.clone())));
+        push.claim("beta", subscription("https://fcm.googleapis.com/b"));
+
+        let reloaded = hosted(&dir);
+        assert_eq!(reloaded.pusher_keys("beta").len(), 2);
+        assert!(reloaded.pusher_keys("alpha").is_empty());
+        assert_eq!(
+            reloaded.find("beta", "https://fcm.googleapis.com/a"),
+            Some(moved)
+        );
+        reloaded.forget_session("beta");
+        assert!(hosted(&dir).pusher_keys("beta").is_empty());
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            let mode = std::fs::metadata(dir.path().join("push.json"))
+                .unwrap()
+                .permissions()
+                .mode();
+            assert_eq!(mode & 0o777, 0o600);
+        }
+    }
+
+    async fn notify(state: &AppState, notification: Value) -> (StatusCode, Value) {
+        let response = crate::routes::router(state.clone(), None)
+            .oneshot(
+                Request::post(NOTIFY_PATH)
+                    .body(Body::from(
+                        json!({ "notification": notification }).to_string(),
+                    ))
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        let status = response.status();
+        let body = response.into_body().collect().await.unwrap().to_bytes();
+        (status, serde_json::from_slice(&body).unwrap_or(Value::Null))
+    }
+
+    #[tokio::test]
+    async fn notify_drops_count_only_pushes_and_rejects_unknown_pushers() {
+        let dir = tempfile::tempdir().unwrap();
+        let push = hosted(&dir);
+        let (orphan, _) = push.claim(
+            "nosuchsession",
+            subscription("https://fcm.googleapis.com/o"),
+        );
+        let state = AppState::new(dir.path().to_owned(), [7; 32], false, false).with_push(push);
+        let device = |app_id: &str, pushkey: &str| json!({"app_id": app_id, "pushkey": pushkey});
+
+        let (status, body) = notify(
+            &state,
+            json!({"counts": {"unread": 1}, "devices": [device(HOSTED_APP_ID, &orphan)]}),
+        )
+        .await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(body, json!({"rejected": []}));
+        assert_eq!(state.push().unwrap().pusher_keys("nosuchsession").len(), 1);
+
+        let (status, body) = notify(
+            &state,
+            json!({
+                "event_id": "$e:x",
+                "room_id": "!r:x",
+                "devices": [
+                    device(HOSTED_APP_ID, "unknown"),
+                    device("dev.malice.device", "foreign"),
+                    device(HOSTED_APP_ID, &orphan),
+                ],
+            }),
+        )
+        .await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(body, json!({"rejected": ["unknown", "foreign", orphan]}));
+        assert!(
+            state
+                .push()
+                .unwrap()
+                .pusher_keys("nosuchsession")
+                .is_empty()
+        );
+
+        let (status, _) = notify(&state, json!("not a notification")).await;
+        assert_eq!(status, StatusCode::BAD_REQUEST);
+    }
+
+    #[tokio::test]
+    async fn vapid_needs_a_public_url() {
+        let dir = tempfile::tempdir().unwrap();
+        let mut push = hosted(&dir);
+        let key = push.sender.vapid_public_key().to_owned();
+        let state =
+            AppState::new(dir.path().to_owned(), [7; 32], false, false).with_push(hosted(&dir));
+        let get = |state: &AppState| {
+            crate::routes::router(state.clone(), None)
+                .oneshot(Request::get("/api/push/vapid").body(Body::empty()).unwrap())
+        };
+        let response = get(&state).await.unwrap();
+        assert_eq!(response.status(), StatusCode::OK);
+        let body = response.into_body().collect().await.unwrap().to_bytes();
+        assert_eq!(
+            serde_json::from_slice::<Value>(&body).unwrap()["public_key"],
+            key
+        );
+        push.public_url = None;
+        let state = AppState::new(dir.path().to_owned(), [7; 32], false, false).with_push(push);
+        assert_eq!(
+            get(&state).await.unwrap().status(),
+            StatusCode::SERVICE_UNAVAILABLE
+        );
+    }
+}

Modified file: crates/malice-server/src/routes.rs+5 additions−3 deletions@@ -183,7 +183,7 @@ struct SessionResponse {
     soft_logout: Option<SoftLogoutInfo>,
 }
 
-async fn auth(
+pub(crate) async fn auth(
     state: &AppState,
     headers: &HeaderMap,
 ) -> Result<(Arc<UserSession>, String), ApiError> {
@@ -1157,7 +1157,8 @@ pub fn router(state: AppState, web_dir: Option<String>) -> Router {
         .route("/encryption", get(get_encryption))
         .route("/encryption/recover", post(recover_encryption))
         .route("/encryption/start", post(start_verification))
-        .route("/encryption/verify", post(verify_encryption));
+        .route("/encryption/verify", post(verify_encryption))
+        .merge(crate::push::api_routes());
     let compression = CompressionLayer::new().compress_when(
         DefaultPredicate::new()
             .and(NotForContentType::const_new("video/"))
@@ -1166,7 +1167,8 @@ pub fn router(state: AppState, web_dir: Option<String>) -> Router {
     );
     let api = Router::new()
         .nest("/api", api.layer(compression))
-        .layer(middleware::from_fn(csrf_guard));
+        .layer(middleware::from_fn(csrf_guard))
+        .merge(crate::push::notify_route());
     let router = api.with_state(state).layer(TraceLayer::new_for_http());
     match web_dir {
         Some(dir) => {

Modified file: crates/malice-server/src/state.rs+24 additions−2 deletions@@ -24,7 +24,7 @@ use malice_core::{
     login::login_error,
 };
 
-use crate::csrf::valid_sid;
+use crate::{csrf::valid_sid, push::HostedPush};
 
 const AUTH_TIMEOUT: Duration = Duration::from_secs(20);
 
@@ -53,6 +53,7 @@ struct Inner {
 #[derive(Clone)]
 pub struct AppState {
     inner: Arc<Inner>,
+    push: Option<Arc<HostedPush>>,
 }
 
 #[derive(Debug)]
@@ -83,9 +84,21 @@ impl AppState {
                 cookie_secure,
                 allow_http_homeserver,
             }),
+            push: None,
         }
     }
 
+    pub fn with_push(self, push: HostedPush) -> Self {
+        Self {
+            push: Some(Arc::new(push)),
+            ..self
+        }
+    }
+
+    pub fn push(&self) -> Option<&HostedPush> {
+        self.push.as_deref()
+    }
+
     pub fn allow_http_homeserver(&self) -> bool {
         self.inner.allow_http_homeserver
     }
@@ -291,8 +304,12 @@ impl AppState {
     pub async fn logout(&self, sid: &str) {
         let user = { self.inner.sessions.read().await.get(sid).cloned() };
         if let Some(user) = user {
+            let pushers = self
+                .push()
+                .map(|push| push.pusher_keys(sid))
+                .unwrap_or_default();
             // answers once the server has let go of the device, and the engine stops itself
-            let _ = timeout(Duration::from_secs(5), user.handle.logout(Vec::new())).await;
+            let _ = timeout(Duration::from_secs(5), user.handle.logout(pushers)).await;
         }
         self.remove_session(sid, Retain::Nothing).await;
     }
@@ -321,6 +338,11 @@ impl AppState {
             }
         }
         self.apply_retention(&sessions, retain).await;
+        if retain == Retain::Nothing
+            && let Some(push) = self.push()
+        {
+            push.forget_session(sid);
+        }
     }
 
     /// Graceful shutdown: ask every engine to stop, keep persisted records so

Modified file: crates/malice-static/Cargo.toml+7 additions−1 deletions@@ -14,14 +14,20 @@ path = "src/lib.rs"
 [dependencies]
 axum = { version = "0.8", default-features = false, features = ["http1", "tokio", "tracing"] }
 listenfd = "1"
-tokio = { workspace = true, features = ["macros", "net", "rt-multi-thread", "signal", "time"] }
+macltok-push-gateway = { workspace = true }
+malice-push = { path = "../malice-push" }
+serde_json = { workspace = true }
+tokio = { workspace = true, features = ["macros", "net", "rt-multi-thread", "signal", "sync", "time"] }
 tower-http = { version = "0.6", features = ["fs", "trace"] }
 tracing = { workspace = true }
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 
 [dev-dependencies]
+aws-lc-rs = "1"
+base64 = "0.22"
 reqwest = { version = "0.13", default-features = false }
 tempfile = "3"
+wiremock = "0.6"
 
 [lints]
 workspace = true

Modified file: crates/malice-static/src/lib.rs+1

@@ -1,4 +1,5 @@

11 pub mod idle;

2+pub mod push;

34 use std::{future::Future, net::SocketAddr, time::Duration};

Modified file: crates/malice-static/src/main.rs+11 additions−2 deletions@@ -1,4 +1,10 @@
-use malice_static::{bind_listener, serve, static_router};
+use std::sync::Arc;
+
+use malice_static::{
+    bind_listener,
+    push::{Gateway, push_off_router, push_router},
+    serve, static_router,
+};
 
 fn web_dir() -> Option<String> {
     let dir = std::env::var("MALICE_WEB_DIR").ok()?;
@@ -20,6 +26,9 @@ async fn main() {
         .compact()
         .init();
 
-    let app = static_router(web_dir());
+    let app = match Gateway::from_env() {
+        Some(gateway) => push_router(Arc::new(gateway)).merge(static_router(web_dir())),
+        None => push_off_router().merge(static_router(web_dir())),
+    };
     serve(bind_listener().await, app, async {}).await;
 }

Added file: crates/malice-static/src/push.rs+247 additions@@ -0,0 +1,247 @@
+use std::{path::PathBuf, sync::Arc};
+
+use axum::{
+    Router,
+    body::Bytes,
+    extract::{DefaultBodyLimit, State},
+    http::{HeaderMap, HeaderValue, StatusCode, header},
+    response::{IntoResponse, Response},
+    routing::{get, post},
+};
+use macltok_push_gateway::{GatewayDevice, GatewayNotification, notify_response, parse_notify};
+use malice_push::{Content, Message, Notice, Outcome, Sender, Subscription, Urgency};
+use serde_json::Value;
+use tokio::sync::Semaphore;
+
+pub const DEVICE_APP_ID: &str = "dev.malice.device";
+pub const NOTIFY_PATH: &str = "/_matrix/push/v1/notify";
+const NOTIFY_BODY_LIMIT: usize = 64 * 1024;
+const CONCURRENT_NOTIFIES: usize = 16;
+
+/// A push gateway that keeps nothing per user: each pusher's data carries its
+/// browser subscription's endpoint and auth secret, and its pushkey is the
+/// subscription's p256dh key, as Sygnal's webpush pushkin does it.
+pub struct Gateway {
+    sender: Sender,
+    public_url: Option<String>,
+    permits: Semaphore,
+}
+
+impl Gateway {
+    pub fn new(sender: Sender, public_url: Option<String>) -> Self {
+        Self {
+            sender,
+            public_url,
+            permits: Semaphore::new(CONCURRENT_NOTIFIES),
+        }
+    }
+
+    /// Keeps the VAPID key in `MALICE_DATA_DIR`, systemd's `STATE_DIRECTORY`
+    /// or the XDG state dir. Push stays off when none of them is usable.
+    pub fn from_env() -> Option<Self> {
+        let Some(dir) = state_dir() else {
+            tracing::warn!("no state directory for the VAPID key, push is off");
+            return None;
+        };
+        if let Err(error) = create_private_dir(&dir) {
+            tracing::warn!(%error, dir = %dir.display(), "creating the push state directory failed, push is off");
+            return None;
+        }
+        let public_url = malice_push::env::public_url();
+        match malice_push::env::sender(&dir, public_url.as_deref()) {
+            Ok(sender) => Some(Self::new(sender, public_url)),
+            Err(error) => {
+                tracing::warn!(%error, "push is off");
+                None
+            }
+        }
+    }
+
+    fn origin(&self, headers: &HeaderMap) -> String {
+        if let Some(url) = &self.public_url {
+            return url.clone();
+        }
+        headers
+            .get(header::HOST)
+            .and_then(|host| host.to_str().ok())
+            .map(|host| format!("https://{host}"))
+            .unwrap_or_default()
+    }
+}
+
+fn state_dir() -> Option<PathBuf> {
+    let var = |name| std::env::var_os(name).filter(|value| !value.is_empty());
+    if let Some(dir) = var("MALICE_DATA_DIR") {
+        return Some(dir.into());
+    }
+    if let Some(dirs) = var("STATE_DIRECTORY") {
+        return std::env::split_paths(&dirs).next();
+    }
+    var("XDG_STATE_HOME")
+        .map(PathBuf::from)
+        .or_else(|| var("HOME").map(|home| PathBuf::from(home).join(".local/state")))
+        .map(|dir| dir.join("malice"))
+}
+
+fn create_private_dir(path: &std::path::Path) -> std::io::Result<()> {
+    let mut builder = std::fs::DirBuilder::new();
+    builder.recursive(true);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::DirBuilderExt;
+        builder.mode(0o700);
+    }
+    builder.create(path)
+}
+
+pub fn push_router(gateway: Arc<Gateway>) -> Router {
+    Router::new()
+        .route("/push/vapid", get(vapid))
+        .route(NOTIFY_PATH, post(notify))
+        .layer(DefaultBodyLimit::max(NOTIFY_BODY_LIMIT))
+        .with_state(gateway)
+}
+
+/// Keeps the push paths from falling through to the app shell.
+pub fn push_off_router() -> Router {
+    let off = || async { StatusCode::NOT_FOUND };
+    Router::new()
+        .route("/push/vapid", get(off))
+        .route(NOTIFY_PATH, post(off))
+}
+
+async fn vapid(State(gateway): State<Arc<Gateway>>) -> Response {
+    json_response(
+        StatusCode::OK,
+        serde_json::to_vec(&serde_json::json!({ "public_key": gateway.sender.vapid_public_key() }))
+            .unwrap_or_default(),
+    )
+}
+
+pub fn json_response(status: StatusCode, body: Vec<u8>) -> Response {
+    (
+        status,
+        [(
+            header::CONTENT_TYPE,
+            HeaderValue::from_static("application/json"),
+        )],
+        body,
+    )
+        .into_response()
+}
+
+async fn notify(State(gateway): State<Arc<Gateway>>, headers: HeaderMap, body: Bytes) -> Response {
+    let notification = match parse_notify(&body) {
+        Ok(notification) => notification,
+        Err(error) => {
+            return json_response(
+                StatusCode::BAD_REQUEST,
+                serde_json::to_vec(&serde_json::json!({ "error": error.to_string() }))
+                    .unwrap_or_default(),
+            );
+        }
+    };
+    if !notification.is_event() {
+        return json_response(StatusCode::OK, notify_response(&[]));
+    }
+    let Ok(_permit) = gateway.permits.acquire().await else {
+        return StatusCode::SERVICE_UNAVAILABLE.into_response();
+    };
+    let origin = gateway.origin(&headers);
+    let mut rejected = Vec::new();
+    for device in &notification.devices {
+        if deliver(&gateway.sender, &notification, device, &origin)
+            .await
+            .drops_subscription()
+        {
+            rejected.push(device.pushkey.clone());
+        }
+    }
+    json_response(StatusCode::OK, notify_response(&rejected))
+}
+
+async fn deliver(
+    sender: &Sender,
+    notification: &GatewayNotification,
+    device: &GatewayDevice,
+    origin: &str,
+) -> Outcome {
+    let data = |key: &str| device.data.get(key).and_then(Value::as_str);
+    let (DEVICE_APP_ID, Some(endpoint), Some(auth)) =
+        (device.app_id.as_str(), data("endpoint"), data("auth"))
+    else {
+        return Outcome::Refused;
+    };
+    let subscription = Subscription {
+        endpoint: endpoint.to_owned(),
+        p256dh: device.pushkey.clone(),
+        auth: auth.to_owned(),
+    };
+    let notice = device_notice(notification, device);
+    let urgency = if notice.mention || notification.room_name.is_none() {
+        Urgency::High
+    } else {
+        Urgency::Normal
+    };
+    let outcome = sender
+        .send(
+            &subscription,
+            &Message {
+                payload: &notice.to_bytes(origin),
+                urgency,
+                topic: &notice.room_id,
+            },
+        )
+        .await;
+    if matches!(outcome, Outcome::Failed(_) | Outcome::Retryable) {
+        tracing::warn!(?outcome, "web push delivery failed");
+    }
+    outcome
+}
+
+/// Room and sender as the homeserver named them. A room without a name is
+/// taken for a DM, so its title is the sender.
+pub fn device_notice(notification: &GatewayNotification, device: &GatewayDevice) -> Notice {
+    let sender = notification
+        .sender_display_name
+        .clone()
+        .filter(|name| !name.trim().is_empty())
+        .or_else(|| {
+            notification
+                .sender
+                .as_ref()
+                .map(|user| user.localpart().to_owned())
+        })
+        .unwrap_or_default();
+    let content: Option<Value> = notification
+        .content
+        .as_ref()
+        .and_then(|raw| serde_json::from_str(raw.get()).ok());
+    let content = Content::of(
+        notification.event_type.as_deref(),
+        content.as_ref(),
+        notification.user_is_target,
+    );
+    let direct = notification.room_name.is_none();
+    Notice {
+        title: notification
+            .room_name
+            .clone()
+            .unwrap_or_else(|| sender.clone()),
+        body: content.body(&sender, direct),
+        room_id: notification
+            .room_id
+            .as_ref()
+            .map(ToString::to_string)
+            .unwrap_or_default(),
+        event_id: notification
+            .event_id
+            .as_ref()
+            .map(ToString::to_string)
+            .unwrap_or_default(),
+        encrypted: content == Content::Encrypted,
+        mention: device.tweaks.get("highlight").and_then(Value::as_bool) == Some(true),
+        silent: !device.tweaks.contains_key("sound"),
+        unread: Some(notification.counts.unread),
+    }
+}

Added file: crates/malice-static/tests/push_gateway.rs+187 additions@@ -0,0 +1,187 @@
+use std::sync::Arc;
+
+use aws_lc_rs::agreement::{ECDH_P256, PrivateKey};
+use base64::{Engine, engine::general_purpose::URL_SAFE_NO_PAD};
+use malice_push::{Allowlist, Sender, Vapid, ece};
+use malice_static::push::{Gateway, push_router};
+use reqwest::{Client, StatusCode};
+use serde_json::{Value, json};
+use wiremock::{
+    Mock, MockServer, ResponseTemplate,
+    matchers::{method, path},
+};
+
+async fn gateway(push_service: &MockServer, dir: &tempfile::TempDir) -> String {
+    let sender = Sender::new(
+        Vapid::load_or_create(&dir.path().join("vapid.pk8")).unwrap(),
+        "mailto:test@example.org".to_owned(),
+        Allowlist::with_extra([push_service.address().to_string()]),
+    )
+    .unwrap();
+    let app = push_router(Arc::new(Gateway::new(
+        sender,
+        Some("https://malice.example".to_owned()),
+    )));
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let base = format!("http://{}", listener.local_addr().unwrap());
+    tokio::spawn(async move { axum::serve(listener, app).await.unwrap() });
+    base
+}
+
+fn device(browser: &PrivateKey, auth: &[u8], endpoint: String) -> Value {
+    json!({
+        "app_id": "dev.malice.device",
+        "pushkey": URL_SAFE_NO_PAD.encode(browser.compute_public_key().unwrap().as_ref()),
+        "data": {"format": "full", "endpoint": endpoint, "auth": URL_SAFE_NO_PAD.encode(auth)},
+        "tweaks": {"sound": "default", "highlight": true},
+    })
+}
+
+async fn notify(client: &Client, base: &str, notification: Value) -> (StatusCode, Value) {
+    let response = client
+        .post(format!("{base}/_matrix/push/v1/notify"))
+        .body(json!({ "notification": notification }).to_string())
+        .send()
+        .await
+        .unwrap();
+    let status = response.status();
+    (
+        status,
+        serde_json::from_slice(&response.bytes().await.unwrap()).unwrap(),
+    )
+}
+
+#[tokio::test]
+async fn gateway_encrypts_for_the_subscription_and_rejects_gone_pushkeys() {
+    let push_service = MockServer::start().await;
+    Mock::given(method("POST"))
+        .and(path("/live"))
+        .respond_with(ResponseTemplate::new(201))
+        .expect(2)
+        .mount(&push_service)
+        .await;
+    Mock::given(method("POST"))
+        .and(path("/gone"))
+        .respond_with(ResponseTemplate::new(410))
+        .expect(1)
+        .mount(&push_service)
+        .await;
+    let dir = tempfile::tempdir().unwrap();
+    let base = gateway(&push_service, &dir).await;
+    let client = Client::new();
+
+    let vapid = client
+        .get(format!("{base}/push/vapid"))
+        .send()
+        .await
+        .unwrap()
+        .text()
+        .await
+        .unwrap();
+    let vapid: Value = serde_json::from_str(&vapid).unwrap();
+    assert_eq!(
+        URL_SAFE_NO_PAD
+            .decode(vapid["public_key"].as_str().unwrap())
+            .unwrap()
+            .len(),
+        65
+    );
+
+    let browser = PrivateKey::generate(&ECDH_P256).unwrap();
+    let auth = [5u8; 16];
+    let live = device(&browser, &auth, format!("{}/live", push_service.uri()));
+    let gone = device(&browser, &auth, format!("{}/gone", push_service.uri()));
+    let event = |devices: Vec<Value>| {
+        json!({
+            "event_id": "$event:example.org",
+            "room_id": "!room:example.org",
+            "type": "m.room.message",
+            "sender": "@ann:example.org",
+            "sender_display_name": "Ann",
+            "room_name": "Garden",
+            "prio": "high",
+            "content": {"msgtype": "m.text", "body": "the tomatoes are ripe"},
+            "counts": {"unread": 4},
+            "devices": devices,
+        })
+    };
+
+    let (status, body) = notify(&client, &base, event(vec![live.clone()])).await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(body, json!({"rejected": []}));
+    let requests = push_service.received_requests().await.unwrap();
+    let payload: Value =
+        serde_json::from_slice(&ece::decrypt(&browser, &auth, &requests[0].body).unwrap()).unwrap();
+    assert_eq!(
+        payload,
+        json!({
+            "web_push": 8030,
+            "notification": {
+                "title": "Garden",
+                "body": "Ann: the tomatoes are ripe",
+                "navigate": "https://malice.example/?room=!room:example.org",
+                "tag": "room:!room:example.org",
+                "silent": false,
+                "app_badge": "4",
+            },
+            "malice": {
+                "room_id": "!room:example.org",
+                "event_id": "$event:example.org",
+                "encrypted": false,
+                "mention": true,
+                "unread": 4,
+            },
+        })
+    );
+    assert_eq!(requests[0].headers["urgency"], "high");
+
+    let gone_key = gone["pushkey"].clone();
+    let (status, body) = notify(&client, &base, event(vec![gone, live])).await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(body, json!({ "rejected": [gone_key] }));
+
+    let mut encrypted = event(vec![]);
+    encrypted["type"] = json!("m.room.encrypted");
+    encrypted["content"] = json!({"algorithm": "m.megolm.v1.aes-sha2", "ciphertext": "x"});
+    let foreign = json!({
+        "app_id": "org.example.other",
+        "pushkey": "elsewhere",
+        "data": {"endpoint": format!("{}/live", push_service.uri()), "auth": "x"},
+    });
+    let unlisted = device(&browser, &auth, "https://example.org/push".to_owned());
+    let unlisted_key = unlisted["pushkey"].clone();
+    encrypted["devices"] = json!([foreign, unlisted]);
+    let (_, body) = notify(&client, &base, encrypted).await;
+    assert_eq!(body, json!({ "rejected": ["elsewhere", unlisted_key] }));
+
+    let count_only = json!({
+        "counts": {"unread": 1},
+        "devices": [device(&browser, &auth, format!("{}/gone", push_service.uri()))],
+    });
+    let (status, body) = notify(&client, &base, count_only).await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(body, json!({"rejected": []}));
+}
+
+#[test]
+fn device_notice_hides_encrypted_content_and_titles_dms_by_sender() {
+    let notification = macltok_push_gateway::parse_notify(
+        json!({"notification": {
+            "event_id": "$e:x",
+            "room_id": "!dm:x",
+            "type": "m.room.encrypted",
+            "sender": "@bob:x",
+            "content": {"ciphertext": "x"},
+            "devices": [{"app_id": "dev.malice.device", "pushkey": "k"}],
+        }})
+        .to_string()
+        .as_bytes(),
+    )
+    .unwrap();
+    let notice = malice_static::push::device_notice(&notification, &notification.devices[0]);
+    assert_eq!(notice.title, "bob");
+    assert_eq!(notice.body, "Encrypted message");
+    assert!(notice.encrypted);
+    assert!(notice.silent);
+    assert!(!notice.mention);
+}

Modified file: crates/malice-static/tests/static_only.rs+9 additions@@ -43,6 +43,7 @@ async fn start(port: u16, web_dir: &TempDir, idle_secs: u64, client: &Client) ->
     let child = Command::new(server_binary())
         .env("MALICE_BIND", format!("127.0.0.1:{port}"))
         .env("MALICE_WEB_DIR", web_dir.path())
+        .env("MALICE_DATA_DIR", web_dir.path().join("state"))
         .env("MALICE_IDLE_EXIT_SECS", idle_secs.to_string())
         .stdout(Stdio::null())
         .stderr(Stdio::inherit())
@@ -174,6 +175,14 @@ async fn static_only_serves_the_bundle_and_exits_when_idle() {
         StatusCode::NOT_FOUND,
     );
 
+    let vapid = client
+        .get(format!("{base}/push/vapid"))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(vapid.status(), StatusCode::OK);
+    assert!(vapid.text().await.unwrap().contains("\"public_key\""));
+
     let status = tokio::time::timeout(Duration::from_secs(10), async {
         loop {
             if let Some(status) = server.0.try_wait().expect("poll backend") {

Modified file: crates/malice-worker/Cargo.lock+10 additions−1 deletions@@ -1999,7 +1999,7 @@ checksum = "7ef0d4ed8669f8f8826eb00dc878084aa8f253506c4fd5e8f58f5bce72ddb97e"
 [[package]]
 name = "macltok"
 version = "0.1.0"
-source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/macltok?rev=419c65426a62191a26b47d07a0e0661e047317da#419c65426a62191a26b47d07a0e0661e047317da"
+source = "git+ssh://brewery@pls.lobotomise.me:33/atagen/macltok?rev=a5865326c81b53de3d590e28dd59f07f2de00a09#a5865326c81b53de3d590e28dd59f07f2de00a09"
 dependencies = [
  "futures-util",
  "getrandom 0.2.17",
@@ -2136,6 +2136,15 @@ dependencies = [
  "futures-util",
  "image",
  "macltok",
+ "malice-push",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "malice-push"
+version = "0.1.0"
+dependencies = [
  "serde",
  "serde_json",
 ]

Modified file: crates/malice-worker/Cargo.toml+13 additions−1 deletions@@ -14,7 +14,7 @@ publish = false
 crate-type = ["cdylib", "rlib"]
 
 [target.'cfg(target_family = "wasm")'.dependencies]
-macltok = { git = "ssh://brewery@pls.lobotomise.me:33/atagen/macltok", rev = "419c65426a62191a26b47d07a0e0661e047317da", features = ["indexeddb", "serde", "mirror"] }
+macltok = { git = "ssh://brewery@pls.lobotomise.me:33/atagen/macltok", rev = "a5865326c81b53de3d590e28dd59f07f2de00a09", features = ["indexeddb", "serde", "mirror"] }
 malice-core = { path = "../malice-core" }
 ruma = { version = "0.16", default-features = false }
 futures-util = { version = "0.3", default-features = false, features = ["std"] }
@@ -48,3 +48,15 @@ lto = true
 codegen-units = 1
 panic = "abort"
 strip = true
+
+[profile.release.package.pbkdf2]
+opt-level = 3
+
+[profile.release.package.sha2]
+opt-level = 3
+
+[profile.release.package.hmac]
+opt-level = 3
+
+[profile.release.package.chacha20poly1305]
+opt-level = 3

Modified file: crates/malice-worker/src/lib.rs+15 additions−4 deletions@@ -10,8 +10,8 @@ use std::rc::Rc;
 use std::sync::Arc;
 
 use macltok::{
-    EncryptedSessionStore, MediaId, MediaLocation, MediaSize, Restore, Retain, Session,
-    SessionStore, StoreConfig,
+    EncryptedSessionStore, MediaId, MediaLocation, MediaSize, PusherKey, Restore, Retain,
+    Session, SessionStore, StoreConfig,
 };
 use malice_core::error::CoreError;
 use malice_core::feed::WireEvent;
@@ -144,7 +144,18 @@ impl Host {
         }
     }
 
-    pub async fn logout(&self, account: String) -> Result<(), JsValue> {
+    /// `remove_pushers` is a JSON array of `{app_id, pushkey}`, this
+    /// browser's own pushers, since pushers belong to the account.
+    pub async fn logout(
+        &self,
+        account: String,
+        remove_pushers: Option<String>,
+    ) -> Result<(), JsValue> {
+        let remove_pushers: Vec<PusherKey> = match remove_pushers {
+            Some(json) => serde_json::from_str(&json)
+                .map_err(|error| error_value("bad_request", error.to_string()))?,
+            None => Vec::new(),
+        };
         let handle = self
             .0
             .accounts
@@ -152,7 +163,7 @@ impl Host {
             .get(&account)
             .map(|entry| entry.handle.clone());
         if let Some(handle) = handle {
-            let _ = handle.logout(Vec::new()).await;
+            let _ = handle.logout(remove_pushers).await;
         }
         self.0.remove_account(&account, Retain::Nothing).await;
         Ok(())

Modified file: crates/malice-worker/tests/host.rs+2 additions−2 deletions@@ -68,7 +68,7 @@ async fn logs_in_syncs_and_logs_out() {
         Some("bad_request")
     );
 
-    host.logout(account.clone())
+    host.logout(account.clone(), None)
         .await
         .expect("logout should discard the store cleanly");
     let restored = host
@@ -130,7 +130,7 @@ async fn restore_after_shutdown_frees_the_store() {
         Some("resumed")
     );
 
-    host.logout(account)
+    host.logout(account, None)
         .await
         .expect("logout should discard the store cleanly");
 }

Modified file: flake.nix+1

@@ -166,6 +166,7 @@

166166 "-p"

167167 "malice-static"

168168 ];

169+ SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";

169170 meta.mainProgram = "malice-static";

170171 };

171172 server = pkgs.symlinkJoin {

malice

Commit aa3dce5114d0

Commit `aa3dce5114d0`