Sessions 5-7a: 955 tests, deployment ready

src/routes/push.js

@@ -0,0 +1,87 @@
+/**
+ * Push subscription endpoints.
+ *
+ *   POST   /api/push/subscribe   — register a new browser push endpoint
+ *   DELETE /api/push/unsubscribe — remove a subscription by endpoint
+ *
+ * Subscriptions are stored in push_subscriptions (migration 015) with RLS
+ * gated to auth.uid() = user_id. We use the service role here so we don't
+ * have to thread the user JWT through Supabase — requireAuth has already
+ * verified the user.
+ */
+
+const express = require('express');
+const { requireAuth } = require('../middleware/auth');
+const { getSupabaseServiceClient } = require('../utils/supabase');
+
+const router = express.Router();
+
+function validSubscription(sub) {
+  if (!sub || typeof sub !== 'object') return false;
+  if (typeof sub.endpoint !== 'string' || !sub.endpoint.startsWith('https://')) return false;
+  if (!sub.keys || typeof sub.keys !== 'object') return false;
+  if (typeof sub.keys.p256dh !== 'string' || typeof sub.keys.auth !== 'string') return false;
+  return true;
+}
+
+router.post('/subscribe', requireAuth, async (req, res) => {
+  const { subscription, preferences } = req.body || {};
+  if (!validSubscription(subscription)) {
+    return res.status(400).json({ error: 'Invalid subscription payload' });
+  }
+  try {
+    const supabase = getSupabaseServiceClient();
+    const row = {
+      user_id: req.user.id,
+      endpoint: subscription.endpoint,
+      keys_p256dh: subscription.keys.p256dh,
+      keys_auth: subscription.keys.auth,
+    };
+    if (Array.isArray(preferences?.sports)) row.sport_preferences = preferences.sports;
+    if (typeof preferences?.notify_on_resolution === 'boolean') {
+      row.notify_on_resolution = preferences.notify_on_resolution;
+    }
+    if (typeof preferences?.notify_on_cascade === 'boolean') {
+      row.notify_on_cascade = preferences.notify_on_cascade;
+    }
+    if (typeof preferences?.notify_on_cheatsheet === 'boolean') {
+      row.notify_on_cheatsheet = preferences.notify_on_cheatsheet;
+    }
+    const { error } = await supabase
+      .from('push_subscriptions')
+      .upsert(row, { onConflict: 'user_id,endpoint' });
+    if (error) {
+      console.error('[VYNDR] Push subscribe error:', error.message);
+      return res.status(503).json({ error: 'Subscription save failed' });
+    }
+    return res.json({ ok: true });
+  } catch (err) {
+    console.error('[VYNDR] Push subscribe error:', err.message);
+    return res.status(503).json({ error: 'Subscription save failed' });
+  }
+});
+
+router.delete('/unsubscribe', requireAuth, async (req, res) => {
+  const { endpoint } = req.body || {};
+  if (typeof endpoint !== 'string' || !endpoint.startsWith('https://')) {
+    return res.status(400).json({ error: 'Invalid endpoint' });
+  }
+  try {
+    const supabase = getSupabaseServiceClient();
+    const { error } = await supabase
+      .from('push_subscriptions')
+      .delete()
+      .eq('user_id', req.user.id)
+      .eq('endpoint', endpoint);
+    if (error) {
+      console.error('[VYNDR] Push unsubscribe error:', error.message);
+      return res.status(503).json({ error: 'Unsubscribe failed' });
+    }
+    return res.json({ ok: true });
+  } catch (err) {
+    console.error('[VYNDR] Push unsubscribe error:', err.message);
+    return res.status(503).json({ error: 'Unsubscribe failed' });
+  }
+});
+
+module.exports = router;