From 64c3b2a14f68c0e283f7e01864abb343e8fd6d2d Mon Sep 17 00:00:00 2001 From: hariharan Jaganathan Date: Sun, 5 Jul 2026 14:22:06 +0100 Subject: [PATCH 1/5] Add direct-APNs sender for WidgetKit push subscriptions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When Core reports a tracked entity change for a widget, it POSTs a { push_subscription, push_token, registration_info } payload to the relay. The push_token is an iOS 26 WidgetKit widget push token — a raw APNs token that FCM can't route (messaging.send targets FCM registration tokens), so this path can't go through the messaging SDK. Add widget-push.js, which sends a silent WidgetKit refresh straight to APNs over HTTP/2 (apns-push-type: widgets, topic .push-type.widgets, {"aps":{"content-changed":true}}), authenticated with a .p8-signed provider JWT (ES256). It tries the production host and falls back to sandbox on BadDeviceToken so it works for both Xcode and store builds. sendPushNotification now routes requests carrying push_subscription to this handler; the APNs key, key id and team id are provided as Functions secrets (Secret Manager). Everything else still goes through FCM unchanged. Add tests covering the success response, headers/topic, sandbox fallback, and the missing-token / missing-app-id / missing-credentials / rejection paths. --- functions/index.js | 15 ++- functions/test/widget-push.test.js | 140 +++++++++++++++++++++++ functions/widget-push.js | 173 +++++++++++++++++++++++++++++ 3 files changed, 325 insertions(+), 3 deletions(-) create mode 100644 functions/test/widget-push.test.js create mode 100644 functions/widget-push.js diff --git a/functions/index.js b/functions/index.js index f9af52a..08638ea 100644 --- a/functions/index.js +++ b/functions/index.js @@ -8,6 +8,7 @@ initializeApp(); const android = require('./android'); const legacy = require('./legacy'); +const widgetPush = require('./widget-push'); const region = (functions.config().app && functions.config().app.region) || 'us-central1'; const regionalFunctions = functions.region(region).runWith({ timeoutSeconds: 10 }); @@ -22,9 +23,17 @@ exports.androidV1 = regionalFunctions.https.onRequest(async (req, res) => handleRequest(req, res, android.createPayload), ); -exports.sendPushNotification = regionalFunctions.https.onRequest(async (req, res) => - handleRequest(req, res, legacy.createPayload), -); +exports.sendPushNotification = functions + .region(region) + .runWith({ timeoutSeconds: 10, secrets: widgetPush.SECRETS }) + .https.onRequest(async (req, res) => { + // Widget push_subscription payloads target a WidgetKit push token, which FCM + // can't route — send those straight to APNs instead of through messaging.send. + if (req.body && req.body.push_subscription) { + return widgetPush.sendWidgetPush(req, res); + } + return handleRequest(req, res, legacy.createPayload); + }); exports.checkRateLimits = regionalFunctions.https.onRequest(async (req, res) => handleCheckRateLimits(req, res), diff --git a/functions/test/widget-push.test.js b/functions/test/widget-push.test.js new file mode 100644 index 0000000..026629d --- /dev/null +++ b/functions/test/widget-push.test.js @@ -0,0 +1,140 @@ +'use strict'; + +const crypto = require('crypto'); +const { createMockRequest, createMockResponse } = require('./utils/mock-factories'); + +jest.mock('node:http2', () => ({ connect: jest.fn() })); +const http2 = require('node:http2'); + +const widgetPush = require('../widget-push'); + +const WIDGET_TOKEN = '80f7d67347204c7dda85d331a95ec31c1e3c62b9173836ada8ed9abf'; + +// A real P-256 key so ES256 signing succeeds; its value is irrelevant to the mock. +const TEST_P8 = crypto + .generateKeyPairSync('ec', { namedCurve: 'P-256' }) + .privateKey.export({ type: 'pkcs8', format: 'pem' }); + +// Makes http2.connect return a client whose request replays the given APNs +// responses in order (one per connect call, so we can exercise the fallback). +function mockApns(responses, onRequest) { + let index = 0; + http2.connect.mockImplementation(() => { + const response = responses[Math.min(index, responses.length - 1)]; + index += 1; + const handlers = {}; + const request = { + on: jest.fn((event, cb) => { + handlers[event] = cb; + return request; + }), + setEncoding: jest.fn(), + end: jest.fn(() => { + process.nextTick(() => { + handlers.response?.({ ':status': response.status, 'apns-id': response.apnsId }); + if (response.body) handlers.data?.(response.body); + handlers.end?.(); + }); + }), + }; + return { + on: jest.fn(), + request: jest.fn((headers) => { + onRequest?.(headers); + return request; + }), + close: jest.fn(), + }; + }); +} + +function widgetRequest(overrides = {}) { + return createMockRequest({ + body: { + push_subscription: { subscription_id: 'ios-widget-sensors', target: 'sensors' }, + push_token: WIDGET_TOKEN, + registration_info: { app_id: 'io.test.HomeAssistant' }, + ...overrides, + }, + }); +} + +describe('widget-push', () => { + beforeEach(() => { + jest.clearAllMocks(); + process.env.APNS_KEY_P8 = TEST_P8; + process.env.APNS_KEY_ID = 'KEY1234567'; + process.env.APNS_TEAM_ID = 'TEAM123456'; + }); + + it('returns 201 and echoes the apns-id on a successful send', async () => { + mockApns([{ status: 200, apnsId: 'apns-success' }]); + const res = createMockResponse(); + + await widgetPush.sendWidgetPush(widgetRequest(), res); + + expect(res.status).toHaveBeenCalledWith(201); + expect(res.send).toHaveBeenCalledWith( + expect.objectContaining({ + target: WIDGET_TOKEN, + messageId: 'apns-success', + pushType: 'widgets', + }), + ); + }); + + it('sends the widgets push type, widget topic and device path', async () => { + let headers; + mockApns([{ status: 200, apnsId: 'x' }], (h) => { + headers = h; + }); + + await widgetPush.sendWidgetPush(widgetRequest(), createMockResponse()); + + expect(headers['apns-push-type']).toBe('widgets'); + expect(headers['apns-topic']).toBe('io.test.HomeAssistant.push-type.widgets'); + expect(headers[':path']).toBe(`/3/device/${WIDGET_TOKEN}`); + expect(headers.authorization).toMatch(/^bearer /); + }); + + it('falls back to the sandbox host on BadDeviceToken', async () => { + mockApns([ + { status: 400, body: '{"reason":"BadDeviceToken"}' }, + { status: 200, apnsId: 'sandbox-ok' }, + ]); + const res = createMockResponse(); + + await widgetPush.sendWidgetPush(widgetRequest(), res); + + expect(http2.connect).toHaveBeenCalledTimes(2); + expect(http2.connect).toHaveBeenNthCalledWith(1, 'https://api.push.apple.com'); + expect(http2.connect).toHaveBeenNthCalledWith(2, 'https://api.sandbox.push.apple.com'); + expect(res.status).toHaveBeenCalledWith(201); + }); + + it('returns 403 when no token is sent', async () => { + const res = createMockResponse(); + await widgetPush.sendWidgetPush(widgetRequest({ push_token: null }), res); + expect(res.status).toHaveBeenCalledWith(403); + }); + + it('returns 400 when registration_info.app_id is missing', async () => { + const res = createMockResponse(); + await widgetPush.sendWidgetPush(widgetRequest({ registration_info: {} }), res); + expect(res.status).toHaveBeenCalledWith(400); + }); + + it('returns 500 when APNs credentials are not configured', async () => { + delete process.env.APNS_KEY_P8; + const res = createMockResponse(); + await widgetPush.sendWidgetPush(widgetRequest(), res); + expect(res.status).toHaveBeenCalledWith(500); + }); + + it('propagates a non-fallback APNs rejection status', async () => { + mockApns([{ status: 410, body: '{"reason":"Unregistered"}' }]); + const res = createMockResponse(); + await widgetPush.sendWidgetPush(widgetRequest(), res); + expect(res.status).toHaveBeenCalledWith(410); + }); +}); diff --git a/functions/widget-push.js b/functions/widget-push.js new file mode 100644 index 0000000..3afe01a --- /dev/null +++ b/functions/widget-push.js @@ -0,0 +1,173 @@ +'use strict'; + +// Direct-to-APNs sender for iOS 26 WidgetKit push subscriptions. +// +// Core registers a widget's push token + tracked entities and, when one of those +// entities changes, POSTs a { push_subscription, push_token, registration_info } +// payload to this relay (the same push_url as normal notifications). +// +// The push_token here is a WidgetKit widget push token — a raw APNs token that +// FCM has no mapping for, so messaging.send() can't deliver it. This module +// bypasses the FCM SDK for this one path and talks to APNs directly over HTTP/2, +// authenticating with the APNs auth key (.p8) provided as a Functions secret. + +const http2 = require('node:http2'); +const crypto = require('node:crypto'); + +// Xcode/dev builds get sandbox tokens; App Store / TestFlight get production ones. +// The token itself doesn't say which, so we try production and fall back to +// sandbox when APNs replies BadDeviceToken (wrong environment). +const APNS_HOST_PRODUCTION = 'api.push.apple.com'; +const APNS_HOST_SANDBOX = 'api.sandbox.push.apple.com'; + +// iOS 26 WidgetKit push: apns-push-type is "widgets" and the topic is the app's +// bundle id with a ".push-type.widgets" suffix. +const APNS_PUSH_TYPE = 'widgets'; +const WIDGET_TOPIC_SUFFIX = '.push-type.widgets'; + +// Provider JWTs are valid up to 1 hour and APNs rate-limits token creation, so we +// sign once and reuse well within the window. +const JWT_TTL_MS = 40 * 60 * 1000; + +// Secret Manager names, injected as env vars at runtime via defineSecret/runWith. +const SECRETS = ['APNS_KEY_P8', 'APNS_KEY_ID', 'APNS_TEAM_ID']; + +let cachedJwt = null; +let cachedJwtAt = 0; + +function base64url(value) { + return Buffer.from(value) + .toString('base64') + .replace(/=/g, '') + .replace(/\+/g, '-') + .replace(/\//g, '_'); +} + +// Builds an APNs provider-auth JWT signed with the .p8 key (ES256). The private +// key never leaves the function; only this signature travels to Apple. +function signProviderToken() { + const header = base64url(JSON.stringify({ alg: 'ES256', kid: process.env.APNS_KEY_ID })); + const payload = base64url( + JSON.stringify({ iss: process.env.APNS_TEAM_ID, iat: Math.floor(Date.now() / 1000) }), + ); + const signingInput = `${header}.${payload}`; + + // dsaEncoding 'ieee-p1363' yields the raw R||S signature that JWS/ES256 expects + // (Node's default is DER, which APNs would reject). + const signature = crypto + .sign('sha256', Buffer.from(signingInput), { + key: process.env.APNS_KEY_P8, + dsaEncoding: 'ieee-p1363', + }) + .toString('base64') + .replace(/=/g, '') + .replace(/\+/g, '-') + .replace(/\//g, '_'); + + return `${signingInput}.${signature}`; +} + +function providerToken() { + const now = Date.now(); + if (!cachedJwt || now - cachedJwtAt > JWT_TTL_MS) { + cachedJwt = signProviderToken(); + cachedJwtAt = now; + } + return cachedJwt; +} + +// Sends one request to APNs over HTTP/2 and resolves with { status, apnsId, body }. +function postToApns(host, deviceToken, headers, body) { + return new Promise((resolve, reject) => { + const client = http2.connect(`https://${host}`); + client.on('error', reject); + + const request = client.request({ + ':method': 'POST', + ':path': `/3/device/${deviceToken}`, + ...headers, + }); + + let status; + let apnsId; + let data = ''; + request.on('response', (responseHeaders) => { + status = responseHeaders[':status']; + apnsId = responseHeaders['apns-id']; + }); + request.setEncoding('utf8'); + request.on('data', (chunk) => { + data += chunk; + }); + request.on('end', () => { + client.close(); + resolve({ status, apnsId, body: data }); + }); + request.on('error', (err) => { + client.close(); + reject(err); + }); + + request.end(body); + }); +} + +// Handles a widget push_subscription payload by sending a silent WidgetKit +// refresh straight to APNs. +async function sendWidgetPush(req, res) { + const token = req.body.push_token; + const appId = req.body.registration_info && req.body.registration_info.app_id; + + if (!token) { + return res.status(403).send({ errorMessage: 'You did not send a token!' }); + } + if (!appId) { + return res.status(400).send({ errorMessage: 'Missing registration_info.app_id' }); + } + if (!process.env.APNS_KEY_P8 || !process.env.APNS_KEY_ID || !process.env.APNS_TEAM_ID) { + return res.status(500).send({ errorMessage: 'APNs credentials are not configured' }); + } + + const headers = { + 'apns-topic': `${appId}${WIDGET_TOPIC_SUFFIX}`, + 'apns-push-type': APNS_PUSH_TYPE, + 'apns-priority': '5', + }; + // Silent and data-free: WidgetKit just reloads the widget's timeline. + const body = JSON.stringify({ aps: { 'content-changed': true } }); + + let result; + try { + result = await postToApns( + APNS_HOST_PRODUCTION, + token, + { ...headers, authorization: `bearer ${providerToken()}` }, + body, + ); + + if (result.status === 400 && result.body.includes('BadDeviceToken')) { + result = await postToApns( + APNS_HOST_SANDBOX, + token, + { ...headers, authorization: `bearer ${providerToken()}` }, + body, + ); + } + } catch (err) { + return res.status(502).send({ errorMessage: `Failed to reach APNs: ${err.message}` }); + } + + if (result.status === 200) { + return res.status(201).send({ + target: token, + messageId: result.apnsId, + pushType: APNS_PUSH_TYPE, + }); + } + + return res.status(result.status || 502).send({ + errorMessage: `APNs rejected the widget push: ${result.body || 'unknown error'}`, + }); +} + +module.exports = { sendWidgetPush, SECRETS }; From 2af7e8759fea904bfac22063bc18738d642c0ea2 Mon Sep 17 00:00:00 2001 From: hariharan Jaganathan Date: Sun, 5 Jul 2026 14:50:25 +0100 Subject: [PATCH 2/5] Rate-limit widget pushes per token MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The widget path short-circuited to sendWidgetPush before handleRequest's rate limiter, leaving an unbounded path an attacker (or a runaway caller) could use to hammer APNs — raising cost and risking APNs throttling and device battery drain. Route widget pushes through the same per-token rate limiter: record the attempt, return 429 when the token exceeds the daily max, and record success/error after the send (best-effort). Export the shared limiter from handlers.js and add tests for the rate-limited and outcome-recording paths. --- functions/handlers.js | 1 + functions/test/widget-push.test.js | 32 +++++++++++++++++++++++++++++ functions/widget-push.js | 33 ++++++++++++++++++++++++++++++ 3 files changed, 66 insertions(+) diff --git a/functions/handlers.js b/functions/handlers.js index adf4677..a1c2fa0 100644 --- a/functions/handlers.js +++ b/functions/handlers.js @@ -348,3 +348,4 @@ function buildLogMetadata(req) { exports.handleRequest = handleRequest; exports.handleCheckRateLimits = handleCheckRateLimits; +exports.rateLimiter = rateLimiter; diff --git a/functions/test/widget-push.test.js b/functions/test/widget-push.test.js index 026629d..418e8f1 100644 --- a/functions/test/widget-push.test.js +++ b/functions/test/widget-push.test.js @@ -6,6 +6,13 @@ const { createMockRequest, createMockResponse } = require('./utils/mock-factorie jest.mock('node:http2', () => ({ connect: jest.fn() })); const http2 = require('node:http2'); +const mockRateLimiter = { + recordAttempt: jest.fn(), + recordSuccess: jest.fn(), + recordError: jest.fn(), +}; +jest.mock('../handlers', () => ({ rateLimiter: mockRateLimiter })); + const widgetPush = require('../widget-push'); const WIDGET_TOKEN = '80f7d67347204c7dda85d331a95ec31c1e3c62b9173836ada8ed9abf'; @@ -65,6 +72,9 @@ describe('widget-push', () => { process.env.APNS_KEY_P8 = TEST_P8; process.env.APNS_KEY_ID = 'KEY1234567'; process.env.APNS_TEAM_ID = 'TEAM123456'; + mockRateLimiter.recordAttempt.mockResolvedValue({ isRateLimited: false, rateLimits: {} }); + mockRateLimiter.recordSuccess.mockResolvedValue({}); + mockRateLimiter.recordError.mockResolvedValue({}); }); it('returns 201 and echoes the apns-id on a successful send', async () => { @@ -83,6 +93,28 @@ describe('widget-push', () => { ); }); + it('rate-limits per token and returns 429 without reaching APNs', async () => { + mockRateLimiter.recordAttempt.mockResolvedValueOnce({ + isRateLimited: true, + rateLimits: { successful: 500 }, + }); + const res = createMockResponse(); + + await widgetPush.sendWidgetPush(widgetRequest(), res); + + expect(res.status).toHaveBeenCalledWith(429); + expect(http2.connect).not.toHaveBeenCalled(); + }); + + it('records the attempt outcome with the rate limiter on success', async () => { + mockApns([{ status: 200, apnsId: 'x' }]); + + await widgetPush.sendWidgetPush(widgetRequest(), createMockResponse()); + + expect(mockRateLimiter.recordAttempt).toHaveBeenCalledWith(WIDGET_TOKEN); + expect(mockRateLimiter.recordSuccess).toHaveBeenCalledWith(WIDGET_TOKEN); + }); + it('sends the widgets push type, widget topic and device path', async () => { let headers; mockApns([{ status: 200, apnsId: 'x' }], (h) => { diff --git a/functions/widget-push.js b/functions/widget-push.js index 3afe01a..5f2c1d6 100644 --- a/functions/widget-push.js +++ b/functions/widget-push.js @@ -112,6 +112,16 @@ function postToApns(host, deviceToken, headers, body) { }); } +// Records the send outcome for a token, best-effort — the push has already been +// sent, so a rate-limiter write failure here must not change the response. +async function recordOutcome(rateLimiter, token, succeeded) { + try { + await (succeeded ? rateLimiter.recordSuccess(token) : rateLimiter.recordError(token)); + } catch { + // Accounting is best-effort and must not affect delivery. + } +} + // Handles a widget push_subscription payload by sending a silent WidgetKit // refresh straight to APNs. async function sendWidgetPush(req, res) { @@ -128,6 +138,27 @@ async function sendWidgetPush(req, res) { return res.status(500).send({ errorMessage: 'APNs credentials are not configured' }); } + // Widget pushes go through the same per-token rate limiting as normal + // notifications, so a widget push token can't be used to hammer APNs (cost, + // throttling, device battery drain). Required lazily so it uses the instance + // index.js initialises once the environment is set. + const { rateLimiter } = require('./handlers'); + let attempt; + try { + attempt = await rateLimiter.recordAttempt(token); + } catch (err) { + return res.status(500).send({ errorMessage: `Rate limit check failed: ${err.message}` }); + } + if (attempt.isRateLimited) { + return res.status(429).send({ + errorType: 'RateLimited', + message: + 'The given target has reached the maximum number of notifications allowed per day. Please try again later.', + target: token, + rateLimits: attempt.rateLimits, + }); + } + const headers = { 'apns-topic': `${appId}${WIDGET_TOPIC_SUFFIX}`, 'apns-push-type': APNS_PUSH_TYPE, @@ -158,6 +189,7 @@ async function sendWidgetPush(req, res) { } if (result.status === 200) { + await recordOutcome(rateLimiter, token, true); return res.status(201).send({ target: token, messageId: result.apnsId, @@ -165,6 +197,7 @@ async function sendWidgetPush(req, res) { }); } + await recordOutcome(rateLimiter, token, false); return res.status(result.status || 502).send({ errorMessage: `APNs rejected the widget push: ${result.body || 'unknown error'}`, }); From 044ba1b9e44ba38228aa1648a0f14cb2e8e8bfa4 Mon Sep 17 00:00:00 2001 From: hariharan Jaganathan Date: Sun, 5 Jul 2026 15:01:56 +0100 Subject: [PATCH 3/5] Give widget pushes their own daily rate-limit cap Follow-up to the widget rate-limiting: widget pushes now use a separate limiter instance with their own daily max (MAX_WIDGET_PUSHES_PER_DAY, default 100) rather than sharing the notification cap. Apple's WidgetKit push budget is small, so a lower cap fits and keeps widget traffic from consuming a device's normal notification allowance. Widget tokens are a distinct key namespace, so their counters never collide with FCM-token counters. --- functions/handlers.js | 32 +++++++++++++++++++----------- functions/test/widget-push.test.js | 2 +- functions/widget-push.js | 10 +++++----- 3 files changed, 26 insertions(+), 18 deletions(-) diff --git a/functions/handlers.js b/functions/handlers.js index a1c2fa0..9ae0a0b 100644 --- a/functions/handlers.js +++ b/functions/handlers.js @@ -5,6 +5,9 @@ const { getMessaging } = require('firebase-admin/messaging'); const { FirestoreRateLimiter, ValkeyRateLimiter } = require('./rate-limiter'); const MAX_NOTIFICATIONS_PER_DAY = parseInt(process.env.MAX_NOTIFICATIONS_PER_DAY || '500'); +// Widget pushes get a separate, lower daily cap: Apple's WidgetKit push budget is +// small, so a widget token needs far fewer sends than a normal device. +const MAX_WIDGET_PUSHES_PER_DAY = parseInt(process.env.MAX_WIDGET_PUSHES_PER_DAY || '100'); const REGION = (process.env.REGION || 'us-central1').toLowerCase(); const usingCloudFunctions = process.env.FUNCTION_TARGET !== undefined; @@ -13,20 +16,25 @@ const messaging = getMessaging(); const logging = new Logging(); const debug = process.env.DEBUG === 'true'; -// Use Valkey rate limiter if Valkey config is available, otherwise use Firestore -let rateLimiter; +// Use Valkey rate limiter if Valkey config is available, otherwise use Firestore. const useValkey = process.env.VALKEY_HOST && process.env.VALKEY_PORT; -if (useValkey) { - rateLimiter = new ValkeyRateLimiter( - MAX_NOTIFICATIONS_PER_DAY, - debug, - process.env.VALKEY_HOST, - parseInt(process.env.VALKEY_PORT, 10), - ); -} else { - rateLimiter = new FirestoreRateLimiter(MAX_NOTIFICATIONS_PER_DAY, debug); +function buildRateLimiter(maxPerDay) { + if (useValkey) { + return new ValkeyRateLimiter( + maxPerDay, + debug, + process.env.VALKEY_HOST, + parseInt(process.env.VALKEY_PORT, 10), + ); + } + return new FirestoreRateLimiter(maxPerDay, debug); } +const rateLimiter = buildRateLimiter(MAX_NOTIFICATIONS_PER_DAY); +// Separate instance so widgets have their own daily cap; widget tokens are a +// different key namespace from FCM tokens, so their counters never collide. +const widgetRateLimiter = buildRateLimiter(MAX_WIDGET_PUSHES_PER_DAY); + async function handleCheckRateLimits(req, res) { const { push_token: token } = req.body; if (!token) { @@ -348,4 +356,4 @@ function buildLogMetadata(req) { exports.handleRequest = handleRequest; exports.handleCheckRateLimits = handleCheckRateLimits; -exports.rateLimiter = rateLimiter; +exports.widgetRateLimiter = widgetRateLimiter; diff --git a/functions/test/widget-push.test.js b/functions/test/widget-push.test.js index 418e8f1..ae3851f 100644 --- a/functions/test/widget-push.test.js +++ b/functions/test/widget-push.test.js @@ -11,7 +11,7 @@ const mockRateLimiter = { recordSuccess: jest.fn(), recordError: jest.fn(), }; -jest.mock('../handlers', () => ({ rateLimiter: mockRateLimiter })); +jest.mock('../handlers', () => ({ widgetRateLimiter: mockRateLimiter })); const widgetPush = require('../widget-push'); diff --git a/functions/widget-push.js b/functions/widget-push.js index 5f2c1d6..4bcb46c 100644 --- a/functions/widget-push.js +++ b/functions/widget-push.js @@ -138,11 +138,11 @@ async function sendWidgetPush(req, res) { return res.status(500).send({ errorMessage: 'APNs credentials are not configured' }); } - // Widget pushes go through the same per-token rate limiting as normal - // notifications, so a widget push token can't be used to hammer APNs (cost, - // throttling, device battery drain). Required lazily so it uses the instance - // index.js initialises once the environment is set. - const { rateLimiter } = require('./handlers'); + // Widget pushes are rate-limited per token (with their own daily cap) so a + // widget push token can't be used to hammer APNs (cost, throttling, device + // battery drain). Required lazily so it uses the instance index.js initialises + // once the environment is set. + const { widgetRateLimiter: rateLimiter } = require('./handlers'); let attempt; try { attempt = await rateLimiter.recordAttempt(token); From 3fa81bb4d5ab5b3393abd477c624b0f94015c6be Mon Sep 17 00:00:00 2001 From: hariharan Jaganathan Date: Sun, 5 Jul 2026 15:47:51 +0100 Subject: [PATCH 4/5] Harden widget push: validate token/app id and close APNs client on errors Addresses two Copilot review findings on the widget-push relay: - Reject non-hex push tokens and non-bundle-id app ids before they reach the APNs :path and apns-topic headers, avoiding malformed/injected requests. - Close the HTTP/2 client when the session errors so the socket isn't leaked until GC, matching the stream error handler. --- functions/test/widget-push.test.js | 33 ++++++++++++++++++++++++++++++ functions/widget-push.js | 17 ++++++++++++++- 2 files changed, 49 insertions(+), 1 deletion(-) diff --git a/functions/test/widget-push.test.js b/functions/test/widget-push.test.js index ae3851f..38fadc9 100644 --- a/functions/test/widget-push.test.js +++ b/functions/test/widget-push.test.js @@ -156,6 +156,39 @@ describe('widget-push', () => { expect(res.status).toHaveBeenCalledWith(400); }); + it('rejects a non-hex push token without reaching APNs', async () => { + const res = createMockResponse(); + await widgetPush.sendWidgetPush(widgetRequest({ push_token: `${WIDGET_TOKEN}/../evil` }), res); + expect(res.status).toHaveBeenCalledWith(400); + expect(http2.connect).not.toHaveBeenCalled(); + }); + + it('rejects an app id with illegal characters without reaching APNs', async () => { + const res = createMockResponse(); + await widgetPush.sendWidgetPush( + widgetRequest({ registration_info: { app_id: 'io.test.HomeAssistant\r\nx-evil: 1' } }), + res, + ); + expect(res.status).toHaveBeenCalledWith(400); + expect(http2.connect).not.toHaveBeenCalled(); + }); + + it('closes the HTTP/2 client and rejects on a session error', async () => { + const request = { on: jest.fn().mockReturnThis(), setEncoding: jest.fn(), end: jest.fn() }; + const client = { on: jest.fn(), request: jest.fn(() => request), close: jest.fn() }; + client.on.mockImplementation((event, cb) => { + if (event === 'error') process.nextTick(() => cb(new Error('boom'))); + return client; + }); + http2.connect.mockReturnValue(client); + const res = createMockResponse(); + + await widgetPush.sendWidgetPush(widgetRequest(), res); + + expect(client.close).toHaveBeenCalled(); + expect(res.status).toHaveBeenCalledWith(502); + }); + it('returns 500 when APNs credentials are not configured', async () => { delete process.env.APNS_KEY_P8; const res = createMockResponse(); diff --git a/functions/widget-push.js b/functions/widget-push.js index 4bcb46c..ee5458c 100644 --- a/functions/widget-push.js +++ b/functions/widget-push.js @@ -29,6 +29,12 @@ const WIDGET_TOPIC_SUFFIX = '.push-type.widgets'; // sign once and reuse well within the window. const JWT_TTL_MS = 40 * 60 * 1000; +// The token and app id go straight into the APNs :path and apns-topic, so reject +// anything malformed before building the request: device tokens are hex, bundle +// ids are reverse-DNS labels (letters, digits, dots, hyphens). +const HEX_TOKEN = /^[0-9a-f]+$/i; +const BUNDLE_ID = /^[A-Za-z0-9.-]+$/; + // Secret Manager names, injected as env vars at runtime via defineSecret/runWith. const SECRETS = ['APNS_KEY_P8', 'APNS_KEY_ID', 'APNS_TEAM_ID']; @@ -80,7 +86,10 @@ function providerToken() { function postToApns(host, deviceToken, headers, body) { return new Promise((resolve, reject) => { const client = http2.connect(`https://${host}`); - client.on('error', reject); + client.on('error', (err) => { + client.close(); + reject(err); + }); const request = client.request({ ':method': 'POST', @@ -134,6 +143,12 @@ async function sendWidgetPush(req, res) { if (!appId) { return res.status(400).send({ errorMessage: 'Missing registration_info.app_id' }); } + if (!HEX_TOKEN.test(token)) { + return res.status(400).send({ errorMessage: 'Invalid push token format' }); + } + if (!BUNDLE_ID.test(appId)) { + return res.status(400).send({ errorMessage: 'Invalid app id format' }); + } if (!process.env.APNS_KEY_P8 || !process.env.APNS_KEY_ID || !process.env.APNS_TEAM_ID) { return res.status(500).send({ errorMessage: 'APNs credentials are not configured' }); } From 261bcc0a1b9b2cf08c7d555904f7802041a5916c Mon Sep 17 00:00:00 2001 From: hariharan Jaganathan Date: Sun, 5 Jul 2026 15:52:47 +0100 Subject: [PATCH 5/5] Cover the widget-push stream-error and rate-limit-failure paths Adds tests for the two remaining uncovered lines flagged by Codecov: the stream-level request error handler (client close + reject) and the 500 returned when the rate-limit check itself throws. widget-push.js is now at 100% line coverage. --- functions/test/widget-push.test.js | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/functions/test/widget-push.test.js b/functions/test/widget-push.test.js index 38fadc9..8d0f059 100644 --- a/functions/test/widget-push.test.js +++ b/functions/test/widget-push.test.js @@ -189,6 +189,36 @@ describe('widget-push', () => { expect(res.status).toHaveBeenCalledWith(502); }); + it('closes the HTTP/2 client and rejects on a stream error', async () => { + const handlers = {}; + const request = { + on: jest.fn((event, cb) => { + handlers[event] = cb; + return request; + }), + setEncoding: jest.fn(), + end: jest.fn(() => process.nextTick(() => handlers.error?.(new Error('stream boom')))), + }; + const client = { on: jest.fn(), request: jest.fn(() => request), close: jest.fn() }; + http2.connect.mockReturnValue(client); + const res = createMockResponse(); + + await widgetPush.sendWidgetPush(widgetRequest(), res); + + expect(client.close).toHaveBeenCalled(); + expect(res.status).toHaveBeenCalledWith(502); + }); + + it('returns 500 when the rate-limit check throws', async () => { + mockRateLimiter.recordAttempt.mockRejectedValueOnce(new Error('firestore down')); + const res = createMockResponse(); + + await widgetPush.sendWidgetPush(widgetRequest(), res); + + expect(res.status).toHaveBeenCalledWith(500); + expect(http2.connect).not.toHaveBeenCalled(); + }); + it('returns 500 when APNs credentials are not configured', async () => { delete process.env.APNS_KEY_P8; const res = createMockResponse();