feat(push): make gateway origin configurable

.env.example

@@ -75,10 +75,9 @@ RELAY_URL=ws://localhost:3000
 # BUZZ_WEB_DIR=./web/dist
 
 # NIP-PL mobile push is an explicit deployment opt-in. A gateway URL alone
-# never enables it. When enabled and the URL is absent, the canonical
-# https://push.buzz.xyz/v1/deliveries/apns endpoint is used.
+# never enables it. When enabled, the exact HTTPS delivery URL is required.
 BUZZ_PUSH_ENABLED=false
-# BUZZ_PUSH_GATEWAY_DELIVERY_URL=https://push.buzz.xyz/v1/deliveries/apns
+BUZZ_PUSH_GATEWAY_DELIVERY_URL=https://push.buzz.xyz/v1/deliveries/apns
 
 # -----------------------------------------------------------------------------
 # Admin Dashboard (private moderation surface)

.github/workflows/_ci-clients.yml

@@ -111,7 +111,11 @@ jobs:
       - name: Analyze
         run: cd mobile && flutter analyze
       - name: Test
-        run: cd mobile && flutter test
+        run: cd mobile && flutter test --dart-define=BUZZ_PUSH_GATEWAY_URL=https://push.example
+      - name: Test mobile without push configuration
+        run: cd mobile && flutter test test/shared/push/push_unconfigured_build_test.dart
+      - name: Test mobile recipe argument forwarding
+        run: /bin/bash scripts/test-mobile-gateway-recipes.sh
       - name: Build Android debug APK
         run: just mobile-build-android
 
@@ -134,7 +138,9 @@ jobs:
       - name: Build complete iOS simulator app
         run: cd mobile && flutter build ios --simulator --debug --no-pub
       - name: Build complete unsigned iOS release
-        run: cd mobile && flutter build ios --release --no-codesign --no-pub
+        run: |
+          /bin/bash scripts/test-mobile-gateway-recipes.sh
+          cd mobile && flutter build ios --release --no-codesign --no-pub
 
   results:
     name: Results

AGENTS.md

@@ -691,7 +691,7 @@ The mobile app lives in `mobile/` — a Flutter app using Riverpod + Hooks.
 cd mobile
 dart format --output=none --set-exit-if-changed .
 flutter analyze
-flutter test
+flutter test --dart-define=BUZZ_PUSH_GATEWAY_URL=https://push.example
 ```
 
 Or from repo root: `just mobile-fmt` (auto-fix), `just mobile-check` (lint + fmt check), `just mobile-test` (tests).

Justfile

@@ -829,7 +829,9 @@ mobile-check:
 
 # Run mobile tests
 mobile-test:
-    unset GIT_DIR GIT_WORK_TREE; cd {{mobile_dir}} && flutter test
+    /bin/bash ./scripts/test-mobile-gateway-recipes.sh
+    unset GIT_DIR GIT_WORK_TREE; cd {{mobile_dir}} && flutter test --dart-define=BUZZ_PUSH_GATEWAY_URL=https://push.example
+    unset GIT_DIR GIT_WORK_TREE; cd {{mobile_dir}} && flutter test test/shared/push/push_unconfigured_build_test.dart
 
 # Regenerate the emoji dataset asset from desktop's emoji-mart install.
 # Output is committed — rerun after bumping @emoji-mart/data.
@@ -838,8 +840,16 @@ mobile-emoji-data:
 
 # Compile an unsigned Android debug APK (worktree-aware debug identity)
 mobile-build-android:
+    #!/usr/bin/env bash
+    set -euo pipefail
     ./scripts/mobile-worktree-overrides.sh
-    unset GIT_DIR GIT_WORK_TREE; cd {{mobile_dir}} && flutter build apk --debug --no-pub
+    set -- build apk --debug --no-pub
+    if [[ -n "${BUZZ_PUSH_GATEWAY_URL:-}" ]]; then
+        set -- "$@" --dart-define="BUZZ_PUSH_GATEWAY_URL=${BUZZ_PUSH_GATEWAY_URL}"
+    fi
+    unset GIT_DIR GIT_WORK_TREE
+    cd {{mobile_dir}}
+    flutter "$@"
 
 # Run the mobile app on iOS simulator (worktree-aware debug identity)
 mobile-dev:
@@ -850,9 +860,18 @@ mobile-dev:
         sleep 3
     fi
     ./scripts/mobile-worktree-overrides.sh
+    gateway_url="${BUZZ_PUSH_GATEWAY_URL:-}"
+    overrides_file="{{mobile_dir}}/ios/Flutter/AppOverrides.xcconfig"
+    if [[ -z "$gateway_url" && -f "$overrides_file" ]]; then
+        gateway_url="$(sed -nE 's/^[[:space:]]*BUZZ_PUSH_GATEWAY_URL[[:space:]]*=[[:space:]]*(.*[^[:space:]])[[:space:]]*$/\1/p' "$overrides_file" | tail -n 1 | sed 's/\$()//g')"
+    fi
+    set -- run
+    if [[ -n "$gateway_url" ]]; then
+        set -- "$@" --dart-define="BUZZ_PUSH_GATEWAY_URL=${gateway_url}"
+    fi
     cd {{mobile_dir}}
     unset GIT_DIR GIT_WORK_TREE
-    flutter run
+    flutter "$@"
 
 # Uninstall stale worktree-suffixed Buzz debug installs (production apps kept)
 mobile-clean:

crates/buzz-db/src/runtime/migration.rs

@@ -702,7 +702,7 @@ mod postgres_tests {
         let mut migrations: Vec<_> = MIGRATOR.iter().collect();
         migrations.sort_by_key(|migration| migration.version);
 
-        assert_eq!(migrations.len(), 44);
+        assert_eq!(migrations.len(), 45);
         assert_eq!(migrations[0].version, 1);
         assert_eq!(&*migrations[0].description, "initial schema");
         assert!(migrations[0]

crates/buzz-push-gateway/migrations/0005_retain_revocation_tombstones.sql

@@ -0,0 +1,15 @@
+-- Revoked installations remain as retry tombstones until authority expiry.
+-- Restrict ownership uniqueness to live rows so a replacement can enroll
+-- without deleting the old installation's idempotency state.
+ALTER TABLE push_gateway_installations
+    DROP CONSTRAINT push_gateway_installations_app_attest_key_id_key;
+ALTER TABLE push_gateway_installations
+    DROP CONSTRAINT push_gateway_installations_app_profile_token_fingerprint_key;
+
+CREATE UNIQUE INDEX push_gateway_installations_active_app_attest_key
+    ON push_gateway_installations (app_attest_key_id)
+    WHERE revoked_at IS NULL;
+
+CREATE UNIQUE INDEX push_gateway_installations_active_profile_token
+    ON push_gateway_installations (app_profile, token_fingerprint)
+    WHERE revoked_at IS NULL;

crates/buzz-push-gateway/src/authority.rs

@@ -103,6 +103,8 @@ pub enum DeliveryDisposition {
 pub enum AuthorityError {
     #[error("authority state rejected the request")]
     Rejected,
+    #[error("installation authority is already live")]
+    Conflict,
     #[error("authority request rate exceeded")]
     RateLimited,
     #[error("authority store unavailable")]
@@ -140,6 +142,13 @@ pub trait AuthorityStore: Send + Sync {
         now: i64,
     ) -> Result<Option<Installation>, AuthorityError>;
     async fn installation(&self, id: Uuid, now: i64) -> Result<Installation, AuthorityError>;
+    /// Load an unexpired installation for authenticated revocation retry,
+    /// including its terminal tombstone.
+    async fn installation_for_revocation(
+        &self,
+        id: Uuid,
+        now: i64,
+    ) -> Result<Installation, AuthorityError>;
     async fn advance_assertion_counter(
         &self,
         installation_id: Uuid,
@@ -155,8 +164,9 @@ pub trait AuthorityStore: Send + Sync {
         token_ciphertext: Vec<u8>,
         token_fingerprint: [u8; 32],
     ) -> Result<(), AuthorityError>;
-    /// Revoke an active delegation only when `expected_generation` is current,
-    /// retaining that generation as the replacement watermark.
+    /// Revoke a delegation only when `expected_generation` is current,
+    /// retaining that generation as the replacement watermark. Repeating the
+    /// exact revocation succeeds so clients can recover from a lost response.
     async fn revoke_delegation(
         &self,
         installation_id: Uuid,
@@ -267,7 +277,7 @@ impl AuthorityStore for MemoryAuthorityStore {
         if s.installations.contains_key(&n.id) {
             return Err(AuthorityError::Rejected);
         }
-        let replaced = s
+        let matching = s
             .installations
             .values()
             .filter(|installation| {
@@ -277,14 +287,22 @@ impl AuthorityStore for MemoryAuthorityStore {
             })
             .map(|installation| installation.id)
             .collect::<Vec<_>>();
-        if replaced.iter().any(|id| {
+        if matching.iter().any(|id| {
             s.installations
                 .get(id)
                 .is_some_and(|installation| !installation.revoked && installation.expires_at >= now)
         }) {
             // App identity and token possession never supersede a live installation.
-            return Err(AuthorityError::Rejected);
+            return Err(AuthorityError::Conflict);
         }
+        let replaced = matching
+            .into_iter()
+            .filter(|id| {
+                s.installations
+                    .get(id)
+                    .is_some_and(|installation| installation.expires_at < now)
+            })
+            .collect::<Vec<_>>();
         for id in replaced {
             if let Some(old) = s.installations.remove(&id) {
                 s.token_owners.remove(&(old.profile, old.token_fingerprint));
@@ -323,6 +341,20 @@ impl AuthorityStore for MemoryAuthorityStore {
         Ok(i.clone())
     }
 
+    async fn installation_for_revocation(
+        &self,
+        id: Uuid,
+        now: i64,
+    ) -> Result<Installation, AuthorityError> {
+        let s = self.0.lock().map_err(|_| AuthorityError::Unavailable)?;
+        let i = s
+            .installations
+            .get(&id)
+            .filter(|i| i.expires_at >= now)
+            .ok_or(AuthorityError::Rejected)?;
+        Ok(i.clone())
+    }
+
     async fn matching_installation(
         &self,
         key_id: &[u8],
@@ -361,7 +393,7 @@ impl AuthorityStore for MemoryAuthorityStore {
             .installations
             .get_mut(&id)
             .ok_or(AuthorityError::Rejected)?;
-        if i.revoked || i.assertion_counter != previous {
+        if i.assertion_counter != previous {
             return Err(AuthorityError::Rejected);
         }
         i.assertion_counter = next;
@@ -449,9 +481,12 @@ impl AuthorityStore for MemoryAuthorityStore {
             .delegations
             .get_mut(&key)
             .ok_or(AuthorityError::Rejected)?;
-        if old.revoked || expected_generation != old.generation {
+        if expected_generation != old.generation {
             return Err(AuthorityError::Rejected);
         }
+        if old.revoked {
+            return Ok(());
+        }
         old.revoked = true;
         Ok(())
     }
@@ -470,6 +505,9 @@ impl AuthorityStore for MemoryAuthorityStore {
             .installations
             .get_mut(&id)
             .ok_or(AuthorityError::Rejected)?;
+        if i.revoked && i.endpoint_epoch == new {
+            return Ok(());
+        }
         if i.revoked || i.endpoint_epoch != expected {
             return Err(AuthorityError::Rejected);
         }
@@ -758,7 +796,7 @@ mod tests {
             store
                 .create_installation(replacement(Uuid::from_u128(5)), 1_999)
                 .await,
-            Err(AuthorityError::Rejected)
+            Err(AuthorityError::Conflict)
         );
         store
             .create_installation(replacement(Uuid::from_u128(5)), 2_001)
@@ -838,6 +876,10 @@ mod tests {
             .revoke_delegation(Uuid::from_u128(1), &"11".repeat(32), 1)
             .await
             .expect("the current generation can be revoked");
+        store
+            .revoke_delegation(Uuid::from_u128(1), &"11".repeat(32), 1)
+            .await
+            .expect("the exact revocation is idempotent after response loss");
         assert!(admitted(&store, &"55".repeat(32), Uuid::new_v4())
             .await
             .is_err());
@@ -878,4 +920,57 @@ mod tests {
             .await
             .expect("generation 2 authority is active");
     }
+
+    #[tokio::test]
+    async fn installation_revocation_is_authenticated_and_idempotent() {
+        let store = store().await;
+        let id = Uuid::from_u128(1);
+        let before = store.installation(id, 1_000).await.unwrap();
+
+        store
+            .revoke_installation(id, 1, 2)
+            .await
+            .expect("the current endpoint epoch can be revoked");
+        let tombstone = store
+            .installation_for_revocation(id, 1_000)
+            .await
+            .expect("revocation retry can authenticate against the tombstone");
+        assert!(tombstone.revoked);
+        store
+            .advance_assertion_counter(id, before.assertion_counter, before.assertion_counter + 1)
+            .await
+            .expect("an authenticated tombstone retry can advance its assertion counter");
+        store
+            .revoke_installation(id, 1, 2)
+            .await
+            .expect("the exact installation revocation is idempotent");
+        store
+            .create_installation(
+                NewInstallation {
+                    id: Uuid::from_u128(5),
+                    app_attest_key_id: vec![1],
+                    app_attest_public_key: vec![5; 33],
+                    assertion_counter: 0,
+                    profile: AppProfile::BuzzIosDogfood,
+                    token_ciphertext: vec![6],
+                    token_fingerprint: [4; 32],
+                    endpoint_epoch: 1,
+                    expires_at: 3_000,
+                },
+                1_001,
+            )
+            .await
+            .expect("a replacement can reuse ownership without deleting the tombstone");
+        assert!(
+            store
+                .installation_for_revocation(id, 1_001)
+                .await
+                .expect("replacement preserves the prior revocation tombstone")
+                .revoked
+        );
+        assert_eq!(
+            store.revoke_installation(id, 2, 3).await,
+            Err(AuthorityError::Rejected)
+        );
+    }
 }