From a846211262f37238c001e5210938749294f8db6a Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Sat, 12 Sep 2026 10:05:10 -0700
Subject: UnifiedPush: reach a phone that has no Google in it.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Web push on Android is Firebase's, so a phone without Google Play Services —
GrapheneOS, CalyxOS, any de-Googled Android — cannot be woken by a web app at
all. UnifiedPush is the way that doesn't involve Google: the user runs a
distributor (ntfy and friends), apps ask it for an endpoint, and whoever
wants to reach the device POSTs to that endpoint.

THE WRAPPER speaks the protocol directly — four broadcasts each way, so it
pulls in no library; an APK this small has no business growing a Kotlin
runtime for eight intents. It asks the distributor on every launch (the call
is idempotent, and it's how a distributor installed later gets noticed),
raises a notification when a message arrives, and acknowledges it so the
distributor stops resending.

THE ENDPOINT reaches the web app on the launch URL as ?up=, the same road
payment intents already travel — because the distributor talks to the app and
only the web app knows which pubkeys are worth watching. It's registered with
the notifier in place of a browser subscription, for notifications and for
NWC alike, and needs neither permission nor push service.

THE NOTIFIER sends to either kind: one deliver() that POSTs the payload to a
UnifiedPush endpoint, or hands it to web-push as before. Same payloads, same
404/410 pruning. The endpoint is the only secret there, so it's never logged
in full.

Verified: a POST to a live ntfy endpoint delivers the payload byte for byte,
so the app parses exactly what the notifier sent; the APK builds, carries the
receiver, and is signed with the certificate assetlinks already pins (v1.6).
tools/unifiedpush-test.js drives a browser with no push service and checks
the endpoint is taken off the URL, kept, and registered.

Honest about the limit: a UnifiedPush message wakes the ANDROID app, not
Chrome's service worker, and the wallet's keys live in the browser's storage
where nothing here can reach them. So a zap request arrives as a notification
you tap, and the wallet answers when it opens — one tap instead of none.
Automatic answering while closed still needs a browser with a push service.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019mrt228Upn9nNCwGixzSLx
---
 src/features/messages.js | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

(limited to 'src/features/messages.js')

diff --git a/src/features/messages.js b/src/features/messages.js
index b12efa7..5ff1492 100644
--- a/src/features/messages.js
+++ b/src/features/messages.js
@@ -1267,8 +1267,38 @@ export function messagesFeature(ctx) {
     } catch { inboxAt = 0; }
   }
 
+  // The Android wrapper hands us a UnifiedPush endpoint on its launch URL
+  // (?up=), because the distributor talks to the app and only the web app
+  // knows which pubkeys are worth watching. On a phone without Google Play
+  // Services this is the ONLY way to be reached while closed, so it takes
+  // precedence over the browser's own push — which there doesn't work at all.
+  const UP_KEY = 'coinos-unifiedpush';
+  const upEndpoint = () => { try { return localStorage.getItem(UP_KEY) || null; } catch { return null; } };
+  (() => {
+    try {
+      const u = new URLSearchParams(location.search).get('up');
+      if (!u) return;
+      localStorage.setItem(UP_KEY, u);
+      // tidy the URL the way the payment intent does
+      history.replaceState(null, '', location.pathname || '/');
+    } catch {}
+  })();
+
   async function registerPush({ interactive = false } = {}) {
     try {
+      // A UnifiedPush endpoint needs no permission and no push service: it's
+      // a URL the distributor gave the wrapper, and the notifier POSTs to it.
+      const up = upEndpoint();
+      if (up) {
+        const r = await fetch(`${NOTIFIER}/register`, {
+          method: 'POST', headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({ subscription: { endpoint: up, unifiedpush: true }, notify: pushWatch() }),
+        });
+        if (!r.ok) return false;
+        const s2 = st();
+        if (!s2.push || s2.noPushService) { s2.push = true; delete s2.noPushService; save(s2); }
+        return true;
+      }
       if (typeof Notification === 'undefined' || !('serviceWorker' in navigator) || !('PushManager' in window)) return false;
       if (Notification.permission !== 'granted') {
         if (!interactive) return false;
-- 
cgit v1.2.3