From 52dfde95d147743b9e99870aee8aefdd2ca12e84 Mon Sep 17 00:00:00 2001
From: Hornwitser <github@hornwitser.no>
Date: Fri, 7 Mar 2025 14:11:07 +0100
Subject: [PATCH] Tie push subscriptions to current session

If a user logs out from a device the expectation should be that device
no longer having any association with the user's account.  Any existing
push notifications should thefore be removed on server.  For this reason
tie push notifications to a session, and remove them when the session is
deleted.
---
 components/Header.vue           |  6 +++---
 components/PushNotification.vue |  8 +++++---
 server/api/auth/session.get.ts  | 11 ++++++++---
 server/api/subscribe.post.ts    |  9 +++++++--
 server/api/unsubscribe.post.ts  |  6 +++---
 server/utils/session.ts         | 12 +++++++++++-
 shared/types/account.d.ts       |  2 ++
 7 files changed, 39 insertions(+), 15 deletions(-)

diff --git a/components/Header.vue b/components/Header.vue
index a41a5cc..0f87157 100644
--- a/components/Header.vue
+++ b/components/Header.vue
@@ -8,9 +8,9 @@
 		</nav>
 		<div class="account">
 			<template v-if="session?.account">
-				{{ session?.account.name || "anonymous" }}
-				(s:{{ session?.id }} a:{{ session?.account.id }})
-				{{ session?.account.type }}
+				{{ session.account.name || "anonymous" }}
+				(s:{{ session.id }} a:{{ session.account.id }}{{ session.push ? " push" : null }})
+				{{ session.account.type }}
 				<button type="button" @click="logOut">Log out</button>
 			</template>
 			<template v-else>
diff --git a/components/PushNotification.vue b/components/PushNotification.vue
index 85ea65e..4e1e6f1 100644
--- a/components/PushNotification.vue
+++ b/components/PushNotification.vue
@@ -99,12 +99,14 @@ async function getSubscription(
 const unsupported = ref<boolean | undefined>(undefined);
 const subscription = ref<PushSubscription | null>(null);
 const runtimeConfig = useRuntimeConfig();
+const { refresh: refreshSession } = useAccountSession();
 
-function onClick() {
+async function onClick() {
 	if (!subscription.value)
-		registerAndSubscribe(runtimeConfig.public.vapidPublicKey, (subs) => { subscription.value = subs })
+		await registerAndSubscribe(runtimeConfig.public.vapidPublicKey, (subs) => { subscription.value = subs })
 	else
-		unsubscribe(subscription.value, () => { subscription.value = null })
+		await unsubscribe(subscription.value, () => { subscription.value = null })
+	refreshSession();
 }
 
 onMounted(() => {
diff --git a/server/api/auth/session.get.ts b/server/api/auth/session.get.ts
index f25b263..487ff3a 100644
--- a/server/api/auth/session.get.ts
+++ b/server/api/auth/session.get.ts
@@ -1,14 +1,19 @@
-import { readAccounts } from "~/server/database";
+import { readAccounts, readSubscriptions } from "~/server/database";
 import { AccountSession } from "~/shared/types/account";
 
-export default defineEventHandler(async (event) => {
+export default defineEventHandler(async (event): Promise<AccountSession | undefined> => {
 	const session = await getAccountSession(event);
 	if (!session)
 		return;
 	const accounts = await readAccounts();
+	const subscriptions = await readSubscriptions();
+	const push = Boolean(
+		subscriptions.find(sub => sub.type === "push" && sub.sessionId === session.id)
+	);
 
 	return {
 		id: session.id,
 		account: accounts.find(account => account.id === session.accountId)!,
-	} satisfies AccountSession;
+		push,
+	};
 })
diff --git a/server/api/subscribe.post.ts b/server/api/subscribe.post.ts
index 37b600e..eb89685 100644
--- a/server/api/subscribe.post.ts
+++ b/server/api/subscribe.post.ts
@@ -2,12 +2,17 @@ import { readSubscriptions, writeSubscriptions } from "~/server/database";
 import { Subscription } from "~/shared/types/account";
 
 export default defineEventHandler(async (event) => {
+	const session = await requireAccountSession(event);
 	const body: { subscription: PushSubscriptionJSON } = await readBody(event);
 	const subscriptions = await readSubscriptions();
 	const existingIndex = subscriptions.findIndex(
-		sub => sub.type === "push" && sub.push.endpoint === body.subscription.endpoint
+		sub => sub.type === "push" && sub.sessionId === session.id
 	);
-	const subscription: Subscription = { type: "push", push: body.subscription };
+	const subscription: Subscription = {
+		type: "push",
+		sessionId: session.id,
+		push: body.subscription
+	};
 	if (existingIndex !== -1) {
 		subscriptions[existingIndex] = subscription;
 	} else {
diff --git a/server/api/unsubscribe.post.ts b/server/api/unsubscribe.post.ts
index 259b430..6f2874b 100644
--- a/server/api/unsubscribe.post.ts
+++ b/server/api/unsubscribe.post.ts
@@ -1,10 +1,10 @@
 import { readSubscriptions, writeSubscriptions } from "~/server/database";
 
 export default defineEventHandler(async (event) => {
-	const body: { subscription: PushSubscriptionJSON } = await readBody(event);
+	const session = await requireAccountSession(event);
 	const subscriptions = await readSubscriptions();
 	const existingIndex = subscriptions.findIndex(
-		sub => sub.type === "push" && sub.push.endpoint === body.subscription.endpoint
+		sub => sub.type === "push" && sub.sessionId === session.id
 	);
 	if (existingIndex !== -1) {
 		subscriptions.splice(existingIndex, 1);
@@ -13,4 +13,4 @@ export default defineEventHandler(async (event) => {
 	}
 	await writeSubscriptions(subscriptions);
 	return { message: "Existing subscription removed."};
-})
+});
diff --git a/server/utils/session.ts b/server/utils/session.ts
index 4278ce0..96dc06c 100644
--- a/server/utils/session.ts
+++ b/server/utils/session.ts
@@ -1,7 +1,16 @@
 import type { H3Event } from "h3";
-import { nextSessionId, readSessions, writeSessions } from "~/server/database";
+import { nextSessionId, readSessions, readSubscriptions, writeSessions, writeSubscriptions } from "~/server/database";
 import { Session } from "~/shared/types/account";
 
+async function removeSessionSubscription(sessionId: number) {
+	const subscriptions = await readSubscriptions();
+	const index = subscriptions.findIndex(subscription => subscription.sessionId === sessionId);
+	if (index !== -1) {
+		subscriptions.splice(index, 1);
+		await writeSubscriptions(subscriptions);
+	}
+}
+
 async function clearAccountSessionInternal(event: H3Event, sessions: Session[]) {
 	const existingSessionCookie = await getSignedCookie(event, "session");
 	if (existingSessionCookie) {
@@ -9,6 +18,7 @@ async function clearAccountSessionInternal(event: H3Event, sessions: Session[])
 		const sessionIndex = sessions.findIndex(session => session.id === sessionId);
 		if (sessionIndex !== -1) {
 			sessions.splice(sessionIndex, 1);
+			await removeSessionSubscription(sessionId);
 			return true;
 		}
 	}
diff --git a/shared/types/account.d.ts b/shared/types/account.d.ts
index c2da1ee..2864190 100644
--- a/shared/types/account.d.ts
+++ b/shared/types/account.d.ts
@@ -7,6 +7,7 @@ export interface Account {
 
 export interface Subscription {
 	type: "push",
+	sessionId: number,
 	push: PushSubscriptionJSON,
 }
 
@@ -18,4 +19,5 @@ export interface Session {
 export interface AccountSession {
 	id: number,
 	account: Account,
+	push: boolean,
 }