Skip to content

A native Push subscription ends with its login

Decided for Sundown for iOS, and not yet built. An iPhone's registration for push is a Push subscription like a browser's: the same model, with a transport, in the same Settings device list. It differs in one way. A native Push subscription records the session it was made under, and Fan-out skips and deletes one whose session is gone: no row, or a row past its expiry. A browser's Push subscription keeps outliving its login, as it does today.

Why

ADR-0009 signs out a phone that is out of reach by changing the password, which ends its session. Nothing in that touches the phone's Push subscription, and Fan-out picks devices by Membership alone. A lost phone would go on showing what the Circle adds and schedules on its lock screen, to whoever holds it, after its owner believed it signed out.

The app also removes its own Push subscription before it signs out, while the token can still authorise the call. That call can fail or never arrive. Binding the subscription to the session makes the outcome the same either way.

What was turned down

  • Doing as the web does, and leaving the device list's Remove as the remedy. It asks a person who has just lost a phone to know that changing the password was not enough.
  • Binding browsers' subscriptions too. It would be the consistent rule, but it changes what the web does today: a browser whose login lapses after a year would fall silent with nothing on screen to say so. It can be taken up on its own.
  • Deleting subscriptions when a session is deleted. Sessions end in several places (logout, password change, expiry, clearsessions), some inside allauth. Checking at send time is one place, and needs no hook in any of them.

Consequences

  • Fan-out reads the session table for native subscriptions on every send.
  • The app registers again whenever it stores a new token. A password change on the phone itself hands it a new session (ADR-0009), and the old subscription dies with the old one.
  • A year after login the phone falls silent and the app's next request is a 401, so the person is at the login screen when they next open it.
  • If sliding expiry is adopted (ADR-0009 leaves it open), nothing here changes: the subscription follows whatever the session's life is.