feat: web notification

[CedrikNikita]

Note

High Risk
Touches authentication (feed sessions), new persistence and delivery paths, and proxy trust settings that affect rate limiting and IP spoofing if misconfigured; large surface area with many edge cases around dedup, retention, and multi-channel fan-out.

Overview
Adds a full web notification stack on top of the existing Expo mobile pipeline: persisted per-address feed rows, REST + bearer sessions minted from æternity signatures, a /notifications Socket.IO namespace for live notification / unread-count, and a Web Push (VAPID) channel with Bull-backed sends and subscription management.

Database & delivery: New notifications and web_push_subscriptions tables (TypeORM migration WebNotificationFeed1718900000020, manual SQL doc updated). DatabaseChannel writes feed rows, dedups per channel, and emits live updates; WebPushChannel enqueues per-endpoint jobs. Invitation-claimed and post-comment types now route through expo, database, and web-push with toDatabase(); incoming transfers stay Expo-only (no feed rows for every SpendTx). Social listeners drop the mobile hasDevices gate so web-only users still get feed/push.

Auth & ops: Feed challenge/session flow reuses device nonces with a distinct signed message; FeedSessionGuard binds bearer tokens to :address. Hourly retention cron caps rows per address and prunes old read items. Config/env covers session TTL, socket caps, handshake rate limits per IP, VAPID keys, and opt-in NOTIF_DEBUG smoke tooling.

Proxy fix: TRUST_PROXY is parsed in shared trust-proxy / client-ip helpers, applied in main.ts for Express and in the notifications gateway so per-IP rate limits and socket handshake caps use real client IPs behind nginx/ELB/Cloudflare—not the proxy peer.

^{Reviewed by Cursor Bugbot for commit 4bd500d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4bd500d. Configure here.}

[cursor]

Temporary debug spam left in

Medium Severity

NotificationSpamDebugService and the gateway/send-web-push [TEMP] / [TEMP-PUSH] traces are marked temporary to remove, yet they ship in this feature. When NOTIF_DEBUG=true, the interval emits live socket events and real VAPID pushes every 10s while logging at error level.

Additional Locations (2)

• src/notifications/services/notification-spam.debug.ts#L30-L44
• src/notifications/notifications.gateway.ts#L72-L82

 

^{Reviewed by Cursor Bugbot for commit 4bd500d. Configure here.}