feat: ship public ops features and cache docker builds

backend/src/services/web_push.rs

@@ -0,0 +1,122 @@
+use loco_rs::prelude::*;
+use serde_json::Value;
+use web_push::{
+    ContentEncoding, HyperWebPushClient, SubscriptionInfo, Urgency, VapidSignatureBuilder,
+    WebPushClient, WebPushMessageBuilder,
+};
+
+use crate::models::_entities::site_settings;
+
+const ENV_PUBLIC_WEB_PUSH_VAPID_PUBLIC_KEY: &str = "PUBLIC_WEB_PUSH_VAPID_PUBLIC_KEY";
+const ENV_LEGACY_WEB_PUSH_VAPID_PUBLIC_KEY: &str = "TERMI_WEB_PUSH_VAPID_PUBLIC_KEY";
+const ENV_WEB_PUSH_VAPID_PRIVATE_KEY: &str = "TERMI_WEB_PUSH_VAPID_PRIVATE_KEY";
+const ENV_WEB_PUSH_VAPID_SUBJECT: &str = "TERMI_WEB_PUSH_VAPID_SUBJECT";
+
+fn env_value(name: &str) -> Option<String> {
+    std::env::var(name)
+        .ok()
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty())
+}
+
+fn configured_value(value: Option<&String>) -> Option<String> {
+    value.and_then(|item| {
+        let trimmed = item.trim();
+        if trimmed.is_empty() {
+            None
+        } else {
+            Some(trimmed.to_string())
+        }
+    })
+}
+
+pub fn public_key(settings: &site_settings::Model) -> Option<String> {
+    configured_value(settings.web_push_vapid_public_key.as_ref())
+        .or_else(|| env_value(ENV_PUBLIC_WEB_PUSH_VAPID_PUBLIC_KEY))
+        .or_else(|| env_value(ENV_LEGACY_WEB_PUSH_VAPID_PUBLIC_KEY))
+}
+
+pub fn private_key(settings: &site_settings::Model) -> Option<String> {
+    configured_value(settings.web_push_vapid_private_key.as_ref())
+        .or_else(|| env_value(ENV_WEB_PUSH_VAPID_PRIVATE_KEY))
+}
+
+pub fn vapid_subject(settings: &site_settings::Model) -> Option<String> {
+    configured_value(settings.web_push_vapid_subject.as_ref())
+        .or_else(|| env_value(ENV_WEB_PUSH_VAPID_SUBJECT))
+}
+
+fn effective_vapid_subject(settings: &site_settings::Model, site_url: Option<&str>) -> String {
+    vapid_subject(settings)
+        .or_else(|| {
+            site_url
+                .map(str::trim)
+                .filter(|value| value.starts_with("http://") || value.starts_with("https://"))
+                .map(ToString::to_string)
+        })
+        .unwrap_or_else(|| "mailto:noreply@example.com".to_string())
+}
+
+pub fn public_key_configured(settings: &site_settings::Model) -> bool {
+    public_key(settings).is_some()
+}
+
+pub fn private_key_configured(settings: &site_settings::Model) -> bool {
+    private_key(settings).is_some()
+}
+
+pub fn is_enabled(settings: &site_settings::Model) -> bool {
+    settings.web_push_enabled.unwrap_or(false)
+        && public_key_configured(settings)
+        && private_key_configured(settings)
+}
+
+pub fn subscription_info_from_metadata(metadata: Option<&Value>) -> Result<SubscriptionInfo> {
+    let subscription = metadata
+        .and_then(Value::as_object)
+        .and_then(|object| object.get("subscription"))
+        .cloned()
+        .ok_or_else(|| Error::BadRequest("browser push metadata 缺少 subscription".to_string()))?;
+
+    serde_json::from_value::<SubscriptionInfo>(subscription)
+        .map_err(|_| Error::BadRequest("browser push metadata 非法".to_string()))
+}
+
+pub async fn send_payload(
+    settings: &site_settings::Model,
+    subscription_info: &SubscriptionInfo,
+    payload: &[u8],
+    urgency: Option<Urgency>,
+    ttl: u32,
+    site_url: Option<&str>,
+) -> Result<()> {
+    let private_key = private_key(settings)
+        .ok_or_else(|| Error::BadRequest("web push VAPID private key 未配置".to_string()))?;
+
+    let mut signature_builder = VapidSignatureBuilder::from_base64(&private_key, subscription_info)
+        .map_err(|error| Error::BadRequest(format!("web push vapid build failed: {error}")))?;
+    signature_builder.add_claim("sub", effective_vapid_subject(settings, site_url));
+    let signature = signature_builder
+        .build()
+        .map_err(|error| Error::BadRequest(format!("web push vapid sign failed: {error}")))?;
+
+    let mut builder = WebPushMessageBuilder::new(subscription_info);
+    builder.set_ttl(ttl);
+    if let Some(urgency) = urgency {
+        builder.set_urgency(urgency);
+    }
+    builder.set_payload(ContentEncoding::Aes128Gcm, payload);
+    builder.set_vapid_signature(signature);
+
+    let client = HyperWebPushClient::new();
+    let message = builder
+        .build()
+        .map_err(|error| Error::BadRequest(format!("web push message build failed: {error}")))?;
+
+    client
+        .send(message)
+        .await
+        .map_err(|error| Error::BadRequest(format!("web push send failed: {error}")))?;
+
+    Ok(())
+}