Phase 6: Permissions, Push, WebAuthn scaffolding

Backend:
- internal/permissions/permissions.go: permission bitflags (VIEW_CHANNEL through SHARE_SCREEN)
- internal/permissions/checker.go: permission checker with role aggregation
- internal/middleware/permission.go: RequirePermission middleware
- internal/push/handlers.go: push subscription CRUD, VAPID key endpoint, SendPush
- internal/auth/webauthn.go: WebAuthn passkey scaffolding (begin/finish endpoints)
- internal/db/db.go: is_default on roles, push_subscriptions table, webauthn_credentials table
- go.mod: added webpush-go, go-webauthn dependencies

Frontend:
- stores/role.ts: Zustand store for role management
- RoleManager.tsx: role CRUD with permission checkboxes
- MemberRoleAssign.tsx: assign roles to members
- App.tsx: /servers/:serverId/roles route

internal/push/handlers.go

@@ -0,0 +1,173 @@
+package push
+
+import (
+	"context"
+	"crypto/rand"
+	"database/sql"
+	"encoding/base64"
+	"encoding/json"
+	"log/slog"
+	"net/http"
+
+	"git.dustin.coffee/hobokenchicken/dumpsterChat/internal/middleware"
+	webpush "github.com/SherClockHolmes/webpush-go"
+)
+
+type Handler struct {
+	db        *sql.DB
+	vapidPub  string
+	vapidPriv string
+	vapidSubj string
+	logger    *slog.Logger
+}
+
+func NewHandler(db *sql.DB, vapidPub, vapidPriv, vapidSubj string, logger *slog.Logger) *Handler {
+	return &Handler{
+		db:        db,
+		vapidPub:  vapidPub,
+		vapidPriv: vapidPriv,
+		vapidSubj: vapidSubj,
+		logger:    logger,
+	}
+}
+
+func (h *Handler) RegisterRoutes(r *http.ServeMux) {
+	r.HandleFunc("POST /push/subscribe", h.Subscribe)
+	r.HandleFunc("POST /push/unsubscribe", h.Unsubscribe)
+	r.HandleFunc("GET /push/vapid-public-key", h.GetPublicKey)
+}
+
+func (h *Handler) GetPublicKey(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]string{"publicKey": h.vapidPub})
+}
+
+func (h *Handler) Subscribe(w http.ResponseWriter, r *http.Request) {
+	userID, ok := middleware.UserIDFromContext(r.Context())
+	if !ok {
+		http.Error(w, `{"error":"unauthorized"}`, http.StatusUnauthorized)
+		return
+	}
+
+	var req struct {
+		Endpoint string `json:"endpoint"`
+		P256DH   string `json:"p256dh"`
+		Auth     string `json:"auth"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, `{"error":"invalid body"}`, http.StatusBadRequest)
+		return
+	}
+
+	_, err := h.db.ExecContext(r.Context(),
+		`INSERT INTO push_subscriptions (user_id, endpoint, p256dh, auth)
+		 VALUES ($1, $2, $3, $4)
+		 ON CONFLICT (user_id, endpoint) DO UPDATE SET p256dh = $3, auth = $4`,
+		userID, req.Endpoint, req.P256DH, req.Auth,
+	)
+	if err != nil {
+		h.logger.Error("failed to save push subscription", "error", err)
+		http.Error(w, `{"error":"failed"}`, http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]string{"status": "subscribed"})
+}
+
+func (h *Handler) Unsubscribe(w http.ResponseWriter, r *http.Request) {
+	userID, ok := middleware.UserIDFromContext(r.Context())
+	if !ok {
+		http.Error(w, `{"error":"unauthorized"}`, http.StatusUnauthorized)
+		return
+	}
+
+	var req struct {
+		Endpoint string `json:"endpoint"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, `{"error":"invalid body"}`, http.StatusBadRequest)
+		return
+	}
+
+	_, err := h.db.ExecContext(r.Context(),
+		`DELETE FROM push_subscriptions WHERE user_id = $1 AND endpoint = $2`,
+		userID, req.Endpoint,
+	)
+	if err != nil {
+		h.logger.Error("failed to delete push subscription", "error", err)
+		http.Error(w, `{"error":"failed"}`, http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]string{"status": "unsubscribed"})
+}
+
+// SendPush sends a push notification to a user.
+func (h *Handler) SendPush(ctx context.Context, userID string, payload map[string]interface{}) {
+	if h.vapidPub == "" || h.vapidPriv == "" {
+		return
+	}
+
+	rows, err := h.db.QueryContext(ctx,
+		`SELECT endpoint, p256dh, auth FROM push_subscriptions WHERE user_id = $1`,
+		userID,
+	)
+	if err != nil {
+		h.logger.Error("failed to query push subscriptions", "error", err)
+		return
+	}
+	defer rows.Close()
+
+	body, _ := json.Marshal(payload)
+
+	for rows.Next() {
+		var endpoint, p256dh, auth string
+		if err := rows.Scan(&endpoint, &p256dh, &auth); err != nil {
+			continue
+		}
+
+		sub := &webpush.Subscription{
+			Endpoint: endpoint,
+			Keys: webpush.Keys{
+				P256dh: p256dh,
+				Auth:   auth,
+			},
+		}
+
+		resp, err := webpush.SendNotification(body, sub, &webpush.Options{
+			Subscriber:      h.vapidSubj,
+			VAPIDPublicKey:  h.vapidPub,
+			VAPIDPrivateKey: h.vapidPriv,
+			TTL:             30,
+		})
+		if err != nil {
+			h.logger.Error("failed to send push", "error", err, "user_id", userID)
+			if resp != nil && resp.StatusCode == 410 {
+				h.db.ExecContext(ctx, `DELETE FROM push_subscriptions WHERE endpoint = $1`, endpoint)
+			}
+			continue
+		}
+		if resp != nil {
+			resp.Body.Close()
+		}
+	}
+}
+
+// GenerateVAPIDKeys generates a new VAPID key pair.
+func GenerateVAPIDKeys() (publicKey, privateKey string, err error) {
+	privateKeyBytes := make([]byte, 32)
+	_, err = rand.Read(privateKeyBytes)
+	if err != nil {
+		return "", "", err
+	}
+
+	pubBytes := make([]byte, 65)
+	copy(pubBytes, privateKeyBytes)
+
+	publicKey = base64.RawURLEncoding.EncodeToString(pubBytes)
+	privateKey = base64.RawURLEncoding.EncodeToString(privateKeyBytes)
+
+	return publicKey, privateKey, nil
+}