Documentation
¶
Overview ¶
Package pushnotify resolves stored enrollment push information and topic certificates for notification delivery.
Design ¶
Notifier looks up channel-specific targets, calls push.Pusher and publishes classified outcomes. StoreCertStore caches topic credentials and checks version changes on expiry of its TTL. Failed reloads return errors. Expiry queries support operator-managed renewal schedules.
PushTokenInvalid and PushRejected remain distinct because an inactive token and a topic/certificate configuration error require different handling. The transport-independent vocabulary stays in appleplatformservices/push; APNs acceptance does not establish device delivery.
References ¶
- Decision record 0007: https://github.com/deploymenttheory/go-apple-dm/blob/main/docs/research/decisions/0007-apns-push.md
- Decision record 0015: https://github.com/deploymenttheory/go-apple-dm/blob/main/docs/research/decisions/0015-push-cert-store.md
- Decision record 0042: https://github.com/deploymenttheory/go-apple-dm/blob/main/docs/research/decisions/0042-push-failure-classification.md
- Decision record 0044: https://github.com/deploymenttheory/go-apple-dm/blob/main/docs/research/decisions/0044-repository-layout.md
- Threat model: https://github.com/deploymenttheory/go-apple-dm/blob/main/docs/security/threat-model.md (push certificate rows)
- Apple: https://developer.apple.com/documentation/devicemanagement/sending-mdm-commands-to-a-device
Index ¶
Constants ¶
const DefaultCertTTL = 30 * time.Second
DefaultCertTTL is how long a StoreCertStore trusts a cached certificate before asking the store whether its Version moved.
Variables ¶
This section is empty.
Functions ¶
func ExpiringCerts ¶
func ExpiringCerts(ctx context.Context, s storage.PushCertStore, now time.Time, within time.Duration) ([]storage.PushCert, error)
ExpiringCerts lists the stored certificates whose NotAfter is within `within` of now, or already past, so a deployment can schedule its own renewal check without a timer inside the library. The records carry no key material. An empty store yields an empty, non-nil slice.
Types ¶
type CertStoreOption ¶
type CertStoreOption func(*StoreCertStore)
CertStoreOption configures a StoreCertStore.
func WithCertClock ¶
func WithCertClock(cl clock.Clock) CertStoreOption
WithCertClock sets the clock used for the TTL (tests).
func WithCertTTL ¶
func WithCertTTL(d time.Duration) CertStoreOption
WithCertTTL sets how long a cached certificate is served before its Version is checked again (default DefaultCertTTL). A non-positive TTL revalidates on every call, which reproduces a per-push staleness check.
type Notifier ¶
type Notifier struct {
Store storage.PushStore
Pusher push.Pusher
Bus event.Publisher
Clock clock.Clock
}
Notifier pushes enrollments by id: it looks push info up in storage, sends through the Pusher, and publishes PushTokenInvalid for tokens APNs rejected.
type StoreCertStore ¶
type StoreCertStore struct {
// contains filtered or unexported fields
}
StoreCertStore serves push certificates from a storage.PushCertStore with a per-topic cache revalidated against the stored Version once per TTL (decision record 0015). A renewal written through StorePushCert bumps the Version, so it is picked up within one TTL without a query per push, and a failed reload returns an error rather than silently keeping the old certificate.
func NewStoreCertStore ¶
func NewStoreCertStore(s storage.PushCertStore, opts ...CertStoreOption) *StoreCertStore
NewStoreCertStore returns a push.CertStore backed by s.
func (*StoreCertStore) PushCertificate ¶
func (c *StoreCertStore) PushCertificate(ctx context.Context, topic string) (tls.Certificate, error)
PushCertificate implements push.CertStore. A cached certificate is returned as is inside the TTL. After the TTL the stored Version is read: when it is unchanged the cache entry is kept for another TTL, otherwise the PEM pair is loaded and parsed again. A topic the store does not know maps to push.ErrNoCertificate. The mutex is held only around cache reads and writes, never across a storage call.
Source Files