Index: src/routes/admin-push.js
===================================================================
--- src/routes/admin-push.js (revision 053bf51d2047068ccfdc7ac5a76e3c8275bba1b5)
+++ src/routes/admin-push.js (revision 053bf51d2047068ccfdc7ac5a76e3c8275bba1b5)
@@ -0,0 +1,22 @@
+/**
+ * Admin: Notificaties (web push) — the owner's per-device toggle page.
+ * Not premium-gated: notifications are infrastructure, not an extra.
+ */
+import express from 'express';
+import { renderPage } from '../middleware/render.js';
+import { requireSiteManager } from '../middleware/auth.js';
+import Push from '../services/PushService.js';
+
+const router = express.Router();
+
+router.get('/', requireSiteManager, async (req, res) => {
+ renderPage(req, res, 'pages/admin-push', {
+ pageTitle: 'Notificaties',
+ bodyClass: 'on-admin',
+ vapidKey: await Push.publicKey(), // null → feature unavailable
+ subscriptions: Push.listSubscriptions(req.session.user.id),
+ defaultAlerts: Push.DEFAULT_ALERTS,
+ });
+});
+
+export default router;
Index: src/routes/push.js
===================================================================
--- src/routes/push.js (revision 053bf51d2047068ccfdc7ac5a76e3c8275bba1b5)
+++ src/routes/push.js (revision 053bf51d2047068ccfdc7ac5a76e3c8275bba1b5)
@@ -0,0 +1,64 @@
+/**
+ * Web Push (docs/webpush-design.md) slice 2: enable/disable + test.
+ * The public VAPID key is public by design (it only identifies this server to
+ * the browser's push service); everything that touches a subscription is a
+ * logged-in action. Web Push delivery itself is cookie-less.
+ */
+import express from 'express';
+import db from '../config/database.js';
+import { requireAuth } from '../middleware/auth.js';
+import Push from '../services/PushService.js';
+
+const router = express.Router();
+
+// A subscription row is personal: only its creator may touch it.
+function ownRow(endpoint, userId) {
+ if (!endpoint) return null;
+ const row = db.prepare('SELECT endpoint, user_id FROM push_subscriptions WHERE endpoint = ?').get(String(endpoint));
+ return row && row.user_id === userId ? row : null;
+}
+
+router.get('/vapid', async (req, res) => {
+ const key = await Push.publicKey();
+ if (!key) return res.status(503).json({ error: 'push_unavailable' });
+ res.json({ publicKey: key });
+});
+
+router.post('/subscribe', requireAuth, express.json({ limit: '16kb' }), async (req, res) => {
+ if (!(await Push.pushReady())) return res.status(503).json({ error: 'push_unavailable' });
+ const s = req.body && req.body.subscription;
+ const keys = s && s.keys;
+ const ok = Push.saveSubscription({
+ endpoint: s && s.endpoint, userId: req.session.user.id,
+ p256dh: keys && keys.p256dh, auth: keys && keys.auth,
+ alertTypes: req.body.alerts || null,
+ uaLabel: String(req.body.uaLabel || '').slice(0, 120) || null,
+ });
+ if (!ok) return res.status(400).json({ error: 'bad_subscription' });
+ res.json({ ok: true });
+});
+
+router.post('/unsubscribe', requireAuth, express.json({ limit: '4kb' }), (req, res) => {
+ const row = ownRow(req.body && req.body.endpoint, req.session.user.id);
+ if (!row) return res.status(404).json({ error: 'not_found' });
+ Push.deleteSubscription(row.endpoint);
+ res.json({ ok: true });
+});
+
+router.post('/alerts', requireAuth, express.json({ limit: '4kb' }), (req, res) => {
+ const row = ownRow(req.body && req.body.endpoint, req.session.user.id);
+ if (!row) return res.status(404).json({ error: 'not_found' });
+ Push.updateAlerts(row.endpoint, req.session.user.id, req.body.alerts || {});
+ res.json({ ok: true });
+});
+
+// A test ping to all of the caller's own devices (bypasses alert prefs).
+router.post('/test', requireAuth, async (req, res) => {
+ const sent = await Push.notifyUser(req.session.user.id, {
+ type: 'test', title: 'Klonkt-testnotificatie',
+ body: 'Werkt. Zo komen meldingen binnen op dit apparaat.', url: '/admin/push',
+ });
+ res.json({ ok: true, sent });
+});
+
+export default router;
Index: src/server.js
===================================================================
--- src/server.js (revision ad107154f7df0224781cab7686f02aa6148d5a9e)
+++ src/server.js (revision 053bf51d2047068ccfdc7ac5a76e3c8275bba1b5)
@@ -47,4 +47,6 @@
import adminStatsRoutes from './routes/admin-stats.js';
import adminPaidRoutes from './routes/admin-paid.js';
+import adminPushRoutes from './routes/admin-push.js';
+import pushRoutes from './routes/push.js';
import adminMediaRoutes from './routes/admin-media.js';
import circleRoutes from './routes/circle.js';
@@ -381,4 +383,5 @@
app.use('/admin/stats', adminStatsRoutes);
app.use('/admin/paid', adminPaidRoutes);
+app.use('/admin/push', adminPushRoutes);
app.use('/admin/newsletter', adminNewsletterRoutes);
app.use('/admin/shows', adminShowsRoutes);
@@ -402,4 +405,5 @@
app.use('/', langRoutes); // /lang/:code — interface-taal kiezen (vóór de catch-all)
app.use('/paid', paidRoutes); // paid-posts patron/passkey flow (before the /:slug catch-all)
+app.use('/push', pushRoutes); // web-push subscribe/test (before the /:slug catch-all)
app.use('/', postsRoutes);
@@ -478,5 +482,5 @@
res.set('Cache-Control', 'no-cache');
res.send(`
-const CACHE_VERSION = 'pcms-v18-' + new Date().toISOString().split('T')[0];
+const CACHE_VERSION = 'pcms-v19-' + new Date().toISOString().split('T')[0];
self.addEventListener('install', e => {
e.waitUntil(caches.open(CACHE_VERSION).then(c => c.addAll(['/'])));
@@ -522,4 +526,28 @@
);
});
+// Web push (docs/webpush-design.md): payload is JSON {type,title,body,url},
+// encrypted end-to-end to this browser (RFC 8291). Show it; click opens url.
+self.addEventListener('push', e => {
+ let d = {};
+ try { d = e.data ? e.data.json() : {}; } catch (err) { /* non-JSON push */ }
+ const title = d.title || 'Klonkt';
+ e.waitUntil(self.registration.showNotification(title, {
+ body: d.body || '',
+ icon: '/favicon.svg',
+ badge: '/favicon.svg',
+ tag: d.type ? ('klonkt-' + d.type) : undefined, // collapse same-type bursts
+ data: { url: d.url || '/' },
+ }));
+});
+self.addEventListener('notificationclick', e => {
+ e.notification.close();
+ const url = (e.notification.data && e.notification.data.url) || '/';
+ e.waitUntil(clients.matchAll({ type: 'window', includeUncontrolled: true }).then(list => {
+ for (const c of list) {
+ if (new URL(c.url).origin === self.location.origin && 'focus' in c) { c.navigate(url); return c.focus(); }
+ }
+ return clients.openWindow(url);
+ }));
+});
`);
});
Index: src/views/pages/admin-push.ejs
===================================================================
--- src/views/pages/admin-push.ejs (revision 053bf51d2047068ccfdc7ac5a76e3c8275bba1b5)
+++ src/views/pages/admin-push.ejs (revision 053bf51d2047068ccfdc7ac5a76e3c8275bba1b5)
@@ -0,0 +1,165 @@
+
+
Notificaties
+
+ Krijg een melding op dit apparaat bij nieuwe volgers, reacties en berichten,
+ ook als de site niet open staat. Versleuteld tot in je browser; wij sturen zo
+ min mogelijk inhoud mee.
+
+
+ <% if (!vapidKey) { %>
+
Push is op deze server niet beschikbaar (sleutel kon niet worden aangemaakt of de dependency ontbreekt).
+ <% } else { %>
+
+
+ Deze browser ondersteunt geen push-notificaties.
+
+
+ Op iPhone/iPad werkt dit alleen als de site op je beginscherm staat:
+ deel-knop → Zet op beginscherm, en open 'm daarna vanaf daar.
+